remote-access-mcp 1.0.6 → 1.1.0

package/dist/cli/main.js

@@ -2,11 +2,14 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { loadConfig, saveConfig, generateToken, configPath, } from '../core/config.js';
+import net from 'node:net';
+import { loadConfig, saveConfig, generateToken, newTokenRecord, configPath, configDir, primaryToken, } from '../core/config.js';
 import { resolveReal } from '../core/policy.js';
-const PKG = { name: 'remote-access-mcp', version: '1.0.0' };
+import { AuditLog } from '../core/audit.js';
+const PKG_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const PKG = JSON.parse(fs.readFileSync(path.join(PKG_ROOT, 'package.json'), 'utf8'));
 // ---------------------------------------------------------------------------
-// help text
+// help
 // ---------------------------------------------------------------------------
 const HELP = `${PKG.name} v${PKG.version} — turn any Linux server into an AI-agent-accessible machine
 
@@ -14,23 +17,48 @@ Usage:
   ramcp <command> [options]
 
 Commands:
-  init                        Generate config + token (safe to re-run)
-  start [--host H] [--port P] Run the gateway in the foreground
-  url                         Print the MCP connector URL for chatbots
-  status                      Check whether the systemd service is running
-  token rotate                Generate a new token (old one dies instantly)
-  token show [--full]         Show the current token (masked unless --full)
-  policy                      Show the path policy + shell flag
-  policy allow <path>          Allow the AI access to a directory
-  policy deny <path>           Deny a directory (removes it from allowed)
-  policy shell on|off          Enable or disable shell execution
-  service install              Install systemd unit + nginx vhost
-  service uninstall            Remove systemd unit + nginx vhost
-  service logs [-f]            Tail gateway logs (journalctl wrapper)
-  version                      Print version
+  init                          Generate config + first token (safe to re-run)
+  start [--host H] [--port P]
+      [--read-only]            Run the gateway in the foreground
+  url [--token ID|name]         Print the MCP connector URL for chatbots
+  status                        Service status summary
+  doctor                        Diagnose token, port, nginx, DNS in one pass
+  version                       Print version
+
+  token list [--json]           List tokens (fingerprints only)
+  token add --name N [opts]      Create a token (see options below)
+  token show [ID|name] [--full]  Show a token
+  token rotate [ID|name]         Rotate a token (old one dies instantly)
+  token revoke ID|name           Revoke (delete) a token
+  token add options:
+      --shell / --no-shell       shell execution (default: off)
+      --paths a,b,c              allowed paths (comma-separated)
+      --deny a,b                 denied paths
+      --scopes group,group       tool groups (empty = all)
+      --read-only                refuse mutating tools
+      --rpm N                    max requests per minute
+      --expires YYYY-MM-DD       expiry date
+
+  policy [ID|name]               Show a token's policy
+  policy allow <path>            Allow a path (default token)
+  policy deny <path>             Deny a path
+  policy shell on|off            Enable/disable shell (default token)
+  policy readonly on|off         Global read-only kill-switch
+
+  audit [query] [--tool T] [--since ISO] [--limit N]
+      [--verify] [--json]       Query the tamper-evident audit log
+  audit chain                    Verify hash-chain integrity
+
+  service install [--domain D]    Install systemd unit (+ nginx vhost)
+  service uninstall               Remove service + nginx vhost
+  service logs [-f]               Tail gateway logs
+  service status                  Detailed service check
+
+  schedule list                   List scheduled tasks
 
 Options:
-  -h, --help                  Show this help
+  -h, --help                    Show this help
+  --json                         Machine-readable output (where supported)
 `;
 function parseArgs(argv) {
     const [command = '', ...rest] = argv;
@@ -60,25 +88,47 @@ function parseArgs(argv) {
     }
     return { command, sub, flags, values };
 }
+const jsonOut = (args) => args.flags.has('json');
+// ---------------------------------------------------------------------------
+// token lookup helper
+// ---------------------------------------------------------------------------
+function findToken(cfg, idOrName) {
+    if (!idOrName)
+        return primaryToken(cfg);
+    const t = cfg.tokens.find(t => t.id === idOrName || t.name === idOrName);
+    if (!t) {
+        console.error(`Token "${idOrName}" not found. Try \`ramcp token list\`.`);
+        process.exit(1);
+    }
+    return t;
+}
+function maskToken(t) {
+    return t.slice(0, 6) + '…' + t.slice(-4);
+}
 // ---------------------------------------------------------------------------
 // init
 // ---------------------------------------------------------------------------
-function cmdInit() {
+function cmdInit(args) {
     const existing = fs.existsSync(configPath());
-    let cfg;
-    if (existing) {
-        cfg = loadConfig();
-        if (!cfg.token)
-            cfg.token = generateToken();
-    }
-    else {
-        cfg = {
-            ...loadConfig(),
-            token: generateToken(),
-        };
+    const cfg = existing ? loadConfig() : null;
+    if (cfg && cfg.tokens.length) {
+        console.log('Config already exists with ' + cfg.tokens.length + ' token(s) — nothing to do.');
+        console.log('Add more tokens with: ramcp token add --name <name>');
+        return;
     }
-    saveConfig(cfg);
-    const masked = cfg.token.slice(0, 6) + '…' + cfg.token.slice(-4);
+    const fresh = cfg || {
+        host: '127.0.0.1',
+        port: 8765,
+        public_host: '',
+        mcp_path: '/mcp',
+        log_level: 'info',
+        audit: { enabled: true, db_path: path.join(configDir(), 'audit.db') },
+        read_only: false,
+        tokens: [],
+    };
+    const rec = newTokenRecord({ name: 'default' });
+    fresh.tokens.push(rec);
+    saveConfig(fresh);
     console.log(`
   ___                        _____
  | _ \\__ _ __ _ ___ _ _   |_   _|__ _ _ _ __ _ ___
@@ -86,144 +136,314 @@ function cmdInit() {
  |_|_\\__,_\\__, \\___|_|      |_|\\___/_| |_| \\__,_\\___|
           |___/         ${PKG.name} v${PKG.version}
 
-${existing ? '✔ Existing config found — token kept' : '✔ Config written to ' + configPath()}
-✔ Token: ${masked} (full: ramcp token show --full)
-✔ Config: ${configPath()}
+${existing ? '✔ Existing config migrated to v2' : '✔ Config written to ' + configPath()}
+✔ Token "default": ${maskToken(rec.token)} (full: ramcp token show default --full)
+✔ Audit log: ${fresh.audit.enabled ? 'enabled' : 'disabled'} (${fresh.audit.db_path})
 
 Next steps:
-  1. ramcp start                    # run in foreground
-  2. ramcp service install          # systemd + nginx (production)
-  3. ramcp policy allow /srv/myapp  # let the AI touch your project
-  4. ramcp url                      # connector URL for your chatbot
+  1. ramcp start                     # run in foreground
+  2. ramcp service install           # systemd + nginx (production)
+  3. ramcp policy allow /srv/myapp   # let the AI touch your project
+  4. ramcp url                       # connector URL for your chatbot
 `);
 }
 // ---------------------------------------------------------------------------
 // start
 // ---------------------------------------------------------------------------
 async function cmdStart(args) {
-    const cfg = loadConfig();
-    if (args.values.has('host'))
-        cfg.host = args.values.get('host');
-    if (args.values.has('port'))
-        cfg.port = parseInt(args.values.get('port'), 10);
-    if (!cfg.token) {
-        console.error('No token. Run `ramcp init` first.');
-        process.exit(1);
-    }
     const { runServer } = await import('../server/run.js');
-    await runServer();
+    await runServer({
+        host: args.values.get('host'),
+        port: args.values.has('port') ? parseInt(args.values.get('port'), 10) : undefined,
+        readOnly: args.flags.has('read-only'),
+    });
 }
 // ---------------------------------------------------------------------------
 // url
 // ---------------------------------------------------------------------------
-function cmdUrl() {
+function cmdUrl(args) {
     const cfg = loadConfig();
-    if (!cfg.token) {
-        console.error('No token. Run `ramcp init` first.');
-        process.exit(1);
-    }
+    const t = findToken(cfg, args.sub[0]);
     const host = cfg.public_host || `${cfg.host}:${cfg.port}`;
     const scheme = cfg.public_host ? 'https' : 'http';
-    console.log(`${scheme}://${host}/${cfg.token}${cfg.mcp_path}`);
+    console.log(`${scheme}://${host}/${t.token}${cfg.mcp_path}`);
 }
 // ---------------------------------------------------------------------------
-// token
+// token management
 // ---------------------------------------------------------------------------
 function cmdToken(args) {
-    const sub = args.sub[0];
     const cfg = loadConfig();
-    if (sub === 'rotate') {
-        const fresh = generateToken();
-        cfg.token = fresh;
-        saveConfig(cfg);
-        console.log(`New token: ${fresh}`);
-        console.log('Old token is dead. Update your chatbot connector now.');
-        if (isSystemdInstalled()) {
-            console.log('Restart the service to apply: systemctl restart remote-access-mcp');
+    const sub = args.sub[0];
+    if (sub === 'list') {
+        if (jsonOut(args)) {
+            console.log(JSON.stringify(cfg.tokens.map(t => ({
+                id: t.id, name: t.name, created: t.created, expires: t.expires || null,
+                scopes: t.scopes, read_only: !!t.read_only, shell: t.shell_enabled,
+                fingerprint: AuditLog.fingerprint(t.token),
+            })), null, 2));
+            return;
+        }
+        for (const t of cfg.tokens) {
+            console.log(`${t.id}  ${t.name.padEnd(16)} shell:${t.shell_enabled ? 'on ' : 'off'} ro:${t.read_only ? 'yes' : 'no '} ${t.expires ? 'expires ' + t.expires + ' ' : ''}${t.scopes.length ? 'scopes: ' + t.scopes.join(',') + ' ' : ''}fp:${AuditLog.fingerprint(t.token)}`);
         }
+        return;
     }
-    else if (sub === 'show') {
-        if (!cfg.token) {
-            console.error('No token. Run `ramcp init` first.');
+    if (sub === 'add') {
+        const name = args.values.get('name');
+        if (!name) {
+            console.error('--name is required');
+            process.exit(1);
+        }
+        if (cfg.tokens.some(t => t.name === name)) {
+            console.error(`Token "${name}" already exists`);
             process.exit(1);
         }
+        const rec = newTokenRecord({
+            name,
+            shell_enabled: args.flags.has('shell') ? true : args.flags.has('no-shell') ? false : undefined,
+            allowed_paths: args.values.get('paths')?.split(',').map(s => s.trim()).filter(Boolean),
+            denied_paths: args.values.get('deny')?.split(',').map(s => s.trim()).filter(Boolean),
+            scopes: args.values.get('scopes')?.split(',').map(s => s.trim()).filter(Boolean),
+            read_only: args.flags.has('read-only'),
+            max_requests_per_minute: args.values.has('rpm') ? parseInt(args.values.get('rpm'), 10) : undefined,
+            expires: args.values.get('expires'),
+        });
+        // resolve allowed paths to real paths
+        rec.allowed_paths = rec.allowed_paths.map(resolveReal);
+        rec.denied_paths = rec.denied_paths.map(resolveReal);
+        cfg.tokens.push(rec);
+        saveConfig(cfg);
+        console.log(`Token "${name}" created (${rec.id})`);
+        console.log(`URL: https://${cfg.public_host || cfg.host + ':' + cfg.port}/${rec.token}${cfg.mcp_path}`);
+        restartHint();
+        return;
+    }
+    if (sub === 'show') {
+        const t = findToken(cfg, args.sub[1]);
         if (args.flags.has('full'))
-            console.log(cfg.token);
+            console.log(t.token);
         else
-            console.log(cfg.token.slice(0, 6) + '…' + cfg.token.slice(-4) + '  (use --full for the complete token)');
+            console.log(`${t.name}: ${maskToken(t.token)} (use --full for the complete token)`);
+        return;
     }
-    else {
-        console.log('Usage: ramcp token <rotate|show [--full]>');
-        process.exit(1);
+    if (sub === 'rotate') {
+        const t = findToken(cfg, args.sub[1]);
+        t.token = generateToken();
+        saveConfig(cfg);
+        console.log(`Token "${t.name}" rotated: ${t.token}`);
+        console.log('Old token is dead. Update your chatbot connector now.');
+        restartHint();
+        return;
+    }
+    if (sub === 'revoke') {
+        const t = findToken(cfg, args.sub[1]);
+        cfg.tokens = cfg.tokens.filter(x => x !== t);
+        if (!cfg.tokens.length) {
+            console.error('Cannot revoke the last token.');
+            process.exit(1);
+        }
+        saveConfig(cfg);
+        console.log(`Token "${t.name}" (${t.id}) revoked.`);
+        restartHint();
+        return;
     }
+    console.log('Usage: ramcp token <list|add|show|rotate|revoke> …');
+    process.exit(1);
 }
 // ---------------------------------------------------------------------------
 // policy
 // ---------------------------------------------------------------------------
 function cmdPolicy(args) {
     const cfg = loadConfig();
-    const sub = args.sub[0] || '';
-    if (sub === 'allow' && args.sub[1]) {
-        const real = resolveReal(args.sub[1]);
-        if (!cfg.allowed_paths.includes(real))
-            cfg.allowed_paths.push(real);
+    // global readonly toggle has no token selector
+    if (args.sub[0] === 'readonly' && (args.sub[1] === 'on' || args.sub[1] === 'off')) {
+        cfg.read_only = args.sub[1] === 'on';
+        saveConfig(cfg);
+        console.log(`Global read-only: ${cfg.read_only ? 'ON — mutating tools refused' : 'off'}`);
+        restartHint();
+        return;
+    }
+    const t = findToken(cfg, args.sub[0] === 'allow' || args.sub[0] === 'deny' || args.sub[0] === 'shell' ? undefined : args.sub[0]);
+    const sub = args.sub[0] === 'allow' || args.sub[0] === 'deny' || args.sub[0] === 'shell' ? args.sub[0] : (args.sub[1] || 'show');
+    if (sub === 'allow' && args.values.size === 0 && !args.sub.find(s => s.startsWith('/'))) {
+        // ramcp policy allow <path> — path is in sub[1] (or sub[2] when selector given)
+    }
+    const pathArg = (() => {
+        const idx = args.sub.indexOf('allow') >= 0 ? args.sub.indexOf('allow') : args.sub.indexOf('deny');
+        return idx >= 0 ? args.sub[idx + 1] : undefined;
+    })();
+    if (sub === 'allow' && pathArg) {
+        const real = resolveReal(pathArg);
+        if (!t.allowed_paths.includes(real))
+            t.allowed_paths.push(real);
         saveConfig(cfg);
         console.log(`Allowed: ${real}`);
-        reloadService();
+        restartHint();
     }
-    else if (sub === 'deny' && args.sub[1]) {
-        const real = resolveReal(args.sub[1]);
-        cfg.allowed_paths = cfg.allowed_paths.filter((p) => p !== real);
-        if (!cfg.denied_paths.includes(real))
-            cfg.denied_paths.push(real);
+    else if (sub === 'deny' && pathArg) {
+        const real = resolveReal(pathArg);
+        t.allowed_paths = t.allowed_paths.filter((p) => p !== real);
+        if (!t.denied_paths.includes(real))
+            t.denied_paths.push(real);
         saveConfig(cfg);
         console.log(`Denied: ${real}`);
-        reloadService();
+        restartHint();
     }
-    else if (sub === 'shell' && args.sub[1]) {
-        const flag = args.sub[1].toLowerCase();
-        if (flag !== 'on' && flag !== 'off') {
-            console.error('Usage: ramcp policy shell on|off');
-            process.exit(1);
-        }
-        cfg.shell_enabled = flag === 'on';
+    else if (sub === 'shell' && (args.sub.includes('on') || args.sub.includes('off'))) {
+        t.shell_enabled = args.sub.includes('on');
         saveConfig(cfg);
-        console.log(`Shell execution ${cfg.shell_enabled ? 'enabled' : 'disabled'}`);
-        reloadService();
+        console.log(`Shell execution for "${t.name}": ${t.shell_enabled ? 'enabled' : 'disabled'}`);
+        restartHint();
     }
     else {
-        console.log(`allowed: ${cfg.allowed_paths.length ? '\n  ' + cfg.allowed_paths.join('\n  ') : '(none)'}`);
-        console.log(`denied:  ${cfg.denied_paths.length ? '\n  ' + cfg.denied_paths.join('\n  ') : '(none)'}`);
-        console.log(`shell:   ${cfg.shell_enabled ? 'enabled' : 'disabled'}`);
+        console.log(`token:     ${t.name} (${t.id})`);
+        console.log(`allowed:   ${t.allowed_paths.length ? '\n  ' + t.allowed_paths.join('\n  ') : '(none)'}`);
+        console.log(`denied:    ${t.denied_paths.length ? '\n  ' + t.denied_paths.join('\n  ') : '(none)'}`);
+        console.log(`shell:     ${t.shell_enabled ? 'enabled' : 'disabled'}`);
+        console.log(`read_only: ${t.read_only ? 'yes' : 'no'}`);
+        console.log(`scopes:    ${t.scopes.length ? t.scopes.join(', ') : '(all tools)'}`);
     }
 }
 // ---------------------------------------------------------------------------
-// service
+// audit
 // ---------------------------------------------------------------------------
-const SERVICE_NAME = 'remote-access-mcp';
-const SERVICE_FILE = `/etc/systemd/system/${SERVICE_NAME}.service`;
-function isSystemdInstalled() {
-    return fs.existsSync(SERVICE_FILE);
-}
-function serviceRunning() {
-    try {
-        const out = fs.readFileSync(`/proc/self/cgroup`, 'utf8');
-        return false; // placeholder, real check below via systemctl
+function cmdAudit(args) {
+    const cfg = loadConfig();
+    if (!cfg.audit.enabled) {
+        console.log('Audit log is disabled (audit.enabled = false).');
+        return;
     }
-    catch {
-        return false;
+    const audit = new AuditLog(cfg.audit.db_path);
+    if (args.sub[0] === 'chain' || args.flags.has('verify')) {
+        const tampered = audit.verify();
+        console.log(tampered === null ? '✔ hash chain intact' : `✖ TAMPERED — first bad row id: ${tampered}`);
+        process.exit(tampered === null ? 0 : 2);
+    }
+    const rows = audit.query({
+        tool: args.values.get('tool'),
+        since: args.values.has('since') ? new Date(args.values.get('since')).getTime() : undefined,
+        limit: args.values.has('limit') ? parseInt(args.values.get('limit'), 10) : 50,
+    });
+    if (jsonOut(args)) {
+        console.log(JSON.stringify(rows, null, 2));
+    }
+    else {
+        if (!rows.length) {
+            console.log('(no audit entries)');
+            return;
+        }
+        for (const r of rows) {
+            const d = new Date(r.ts).toISOString().slice(0, 19);
+            console.log(`${d}  fp:${r.token_fingerprint}  ${r.tool.padEnd(20)} ${r.is_error ? 'ERR ' : 'ok  '} ${r.duration_ms}ms`);
+        }
     }
+    audit.close();
 }
-function reloadService() {
-    if (isSystemdInstalled()) {
+// ---------------------------------------------------------------------------
+// doctor
+// ---------------------------------------------------------------------------
+async function cmdDoctor(args) {
+    const results = [];
+    const ok = (name, msg) => results.push([`✔ ${name}`, msg]);
+    const bad = (name, msg) => results.push([`✖ ${name}`, msg]);
+    const warn = (name, msg) => results.push([`⚠ ${name}`, msg]);
+    const cfg = loadConfig();
+    // 1. token
+    if (cfg.tokens.length)
+        ok('tokens', `${cfg.tokens.length} configured, primary: ${cfg.tokens[0].name}`);
+    else
+        bad('tokens', 'none — run `ramcp init`');
+    // 2. bind port free?
+    const inUse = await new Promise((resolve) => {
+        const srv = net.createServer();
+        srv.once('error', () => resolve(true));
+        srv.once('listening', () => { srv.close(() => resolve(false)); });
+        srv.listen(cfg.port, cfg.host);
+    });
+    const serviceActive = fs.existsSync(SERVICE_FILE) && run('systemctl', ['is-active', SERVICE_NAME]).trim() === 'active';
+    if (inUse) {
+        serviceActive ? ok('port', `${cfg.host}:${cfg.port} in use by the running service`) : warn('port', `${cfg.host}:${cfg.port} in use by ANOTHER process`);
+    }
+    else {
+        serviceActive ? warn('port', `port free but service claims active — crashed?`) : warn('port', `not listening — start with \`ramcp service install\` or \`ramcp start\``);
+    }
+    // 3. gateway answers?
+    if (!inUse || serviceActive) {
         try {
-            execFileSync('systemctl', ['restart', SERVICE_NAME], { stdio: 'ignore' });
-            console.log('Service restarted to apply changes.');
+            const resp = await fetch(`http://${cfg.host}:${cfg.port}/health`);
+            const body = (await resp.json());
+            if (body.status === 'ok')
+                ok('gateway', `healthy (v${body.version})`);
+            else
+                bad('gateway', `unexpected: ${JSON.stringify(body)}`);
         }
         catch {
-            console.log('Note: service did not restart (not root?). Reboot or restart manually.');
+            bad('gateway', `no answer on ${cfg.host}:${cfg.port}/health`);
+        }
+    }
+    // 4. nginx vhost?
+    if (cfg.public_host) {
+        const vhost = `/etc/nginx/sites-enabled/${cfg.public_host}`;
+        if (fs.existsSync(vhost)) {
+            const conf = fs.readFileSync(vhost, 'utf8');
+            if (conf.includes(`proxy_pass http://${cfg.host}:${cfg.port}`)) {
+                ok('nginx', `vhost for ${cfg.public_host} → ${cfg.host}:${cfg.port}`);
+            }
+            else {
+                warn('nginx', `${vhost} exists but does not proxy to ${cfg.host}:${cfg.port}`);
+            }
+        }
+        else {
+            warn('nginx', `no vhost at ${vhost} — run \`ramcp service install --domain ${cfg.public_host}\``);
+        }
+        // 5. public DNS resolves + Cloudflare edge reachable?
+        try {
+            const resp = await fetch(`https://${cfg.public_host}/health`, { signal: AbortSignal.timeout(8000) });
+            const body = (await resp.json());
+            if (body.status === 'ok')
+                ok('public', `https://${cfg.public_host} healthy end-to-end`);
+            else
+                warn('public', `got status ${resp.status} from edge`);
+        }
+        catch (e) {
+            warn('public', `https://${cfg.public_host} unreachable: ${e.message}`);
         }
     }
+    // 6. audit chain
+    if (cfg.audit.enabled && fs.existsSync(cfg.audit.db_path)) {
+        const audit = new AuditLog(cfg.audit.db_path);
+        const tampered = audit.verify();
+        tampered === null ? ok('audit', 'hash chain intact') : bad('audit', `tampered at row ${tampered}`);
+        audit.close();
+    }
+    else if (cfg.audit.enabled) {
+        warn('audit', 'enabled but db not created yet');
+    }
+    for (const [name, msg] of results)
+        console.log(`${name.padEnd(14)} ${msg}`);
+    const hasBad = results.some(r => r[0].startsWith('✖'));
+    process.exitCode = hasBad ? 1 : 0;
+}
+function run(cmd, args) {
+    try {
+        return execFileSync(cmd, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+    }
+    catch {
+        return '';
+    }
+}
+// ---------------------------------------------------------------------------
+// service
+// ---------------------------------------------------------------------------
+const SERVICE_NAME = 'remote-access-mcp';
+const SERVICE_FILE = `/etc/systemd/system/${SERVICE_NAME}.service`;
+function isSystemdInstalled() {
+    return fs.existsSync(SERVICE_FILE);
+}
+function restartHint() {
+    if (isSystemdInstalled()) {
+        console.log('(service restarts automatically on next request — config hot-reloads)');
+    }
 }
 function cmdService(args) {
     const sub = args.sub[0] || '';
@@ -247,7 +467,7 @@ function cmdService(args) {
         cmdStatus();
     }
     else {
-        console.log('Usage: ramcp service <install|uninstall|logs [-f]|status>');
+        console.log('Usage: ramcp service <install [--domain D]|uninstall|logs [-f]|status>');
         process.exit(1);
     }
 }
@@ -259,7 +479,7 @@ function installService(args) {
     const domain = args.values.get('domain') || '';
     const cfg = loadConfig();
     const nodeBin = process.execPath;
-    const pkgRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+    const pkgRoot = PKG_ROOT;
     const unit = `[Unit]
 Description=Remote Access MCP Gateway
 After=network.target
@@ -312,7 +532,7 @@ WantedBy=multi-user.target
         try {
             execFileSync('nginx', ['-t']);
             execFileSync('systemctl', ['reload', 'nginx']);
-            console.log(`✔ nginx vhost installed: ${domain} → 127.0.0.1:${cfg.port}`);
+            console.log(`✔ nginx vhost installed: ${domain} → ${cfg.host}:${cfg.port}`);
         }
         catch (e) {
             console.error(`nginx config test failed:\n${e.stdout || e.message}`);
@@ -328,8 +548,7 @@ function uninstallService() {
         console.error('service uninstall requires root (sudo).');
         process.exit(1);
     }
-    const { existsSync, readFileSync } = fs;
-    if (existsSync(SERVICE_FILE)) {
+    if (fs.existsSync(SERVICE_FILE)) {
         try {
             execFileSync('systemctl', ['disable', '--now', SERVICE_NAME]);
         }
@@ -341,13 +560,13 @@ function uninstallService() {
     else {
         console.log('Service not installed.');
     }
-    // remove any nginx vhost that points at us
     const sitesDir = '/etc/nginx/sites-enabled';
-    if (existsSync(sitesDir)) {
+    if (fs.existsSync(sitesDir)) {
+        const cfg = loadConfig();
         for (const f of fs.readdirSync(sitesDir)) {
             try {
-                const content = readFileSync(path.join(sitesDir, f), 'utf8');
-                if (content.includes(`proxy_pass http://127.0.0.1:${loadConfig().port}`)) {
+                const content = fs.readFileSync(path.join(sitesDir, f), 'utf8');
+                if (content.includes(`proxy_pass http://${cfg.host}:${cfg.port}`)) {
                     fs.unlinkSync(path.join(sitesDir, f));
                     console.log(`✔ nginx vhost removed: ${f}`);
                 }
@@ -368,17 +587,13 @@ function cmdStatus() {
     const installed = isSystemdInstalled();
     console.log(`service installed: ${installed ? 'yes' : 'no'}`);
     if (installed) {
-        try {
-            const out = execFileSync('systemctl', ['is-active', SERVICE_NAME], { encoding: 'utf8' }).trim();
-            console.log(`service status:   ${out}`);
-        }
-        catch (e) {
-            console.log(`service status:   ${e.stdout?.toString().trim() || 'unknown'}`);
-        }
+        console.log(`service status:   ${run('systemctl', ['is-active', SERVICE_NAME]).trim() || 'unknown'}`);
     }
     const cfg = loadConfig();
     console.log(`listen:           ${cfg.host}:${cfg.port}`);
-    console.log(`token:            ${cfg.token ? cfg.token.slice(0, 6) + '…' : '(none — run ramcp init)'}`);
+    console.log(`tokens:           ${cfg.tokens.length}`);
+    console.log(`audit:            ${cfg.audit.enabled ? 'on' : 'off'}`);
+    console.log(`read_only:        ${cfg.read_only ? 'on' : 'off'}`);
 }
 // ---------------------------------------------------------------------------
 // main
@@ -391,13 +606,13 @@ export async function main(argv) {
     }
     switch (args.command) {
         case 'init':
-            cmdInit();
+            cmdInit(args);
             break;
         case 'start':
             await cmdStart(args);
             break;
         case 'url':
-            cmdUrl();
+            cmdUrl(args);
             break;
         case 'token':
             cmdToken(args);
@@ -405,6 +620,12 @@ export async function main(argv) {
         case 'policy':
             cmdPolicy(args);
             break;
+        case 'audit':
+            cmdAudit(args);
+            break;
+        case 'doctor':
+            await cmdDoctor(args);
+            break;
         case 'service':
             cmdService(args);
             break;