subconscious-cli 0.2.1 → 0.3.1

package/bin/auth.js

@@ -8,7 +8,8 @@
  *  3. The web app authenticates the user, generates an API key, and
  *     delivers it back to the CLI via a cross-origin fetch to
  *     localhost:{port}/callback?token=...&state=...
- *  4. CLI verifies the `state` matches, saves the key to ~/.subcon/config.json.
+ *  4. CLI verifies the `state`, saves the key to ~/.subconscious/config.json,
+ *     and creates a coding-agent profile under ~/.subconscious/profiles/.
  *
  * Override SUBCONSCIOUS_URL env var for local development.
  */
@@ -20,18 +21,55 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { c } from './colors.js';
+import { clearProfileApiKey, DEFAULT_PROFILE, ensureProfile } from './profiles.js';
 
-const CONFIG_DIR = path.join(os.homedir(), '.subcon');
+const CONFIG_OVERRIDE = process.env.SUBC_CONFIG_DIR?.trim();
+const CONFIG_DIR = CONFIG_OVERRIDE || path.join(os.homedir(), '.subconscious');
 const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
+const LEGACY_CONFIG_FILE = CONFIG_OVERRIDE
+  ? null
+  : path.join(os.homedir(), '.subcon', 'config.json');
 // Defaults to production. Developers set SUBCONSCIOUS_URL=http://localhost:3000 for local dev.
 const PLATFORM_URL = process.env.SUBCONSCIOUS_URL || 'https://www.subconscious.dev';
 
+// Login callback CORS. After the marketing/platform split, www 307s /cli/auth
+// to the platform host, so the browser Origin is platform even when the CLI
+// still opened www. Keep www so a non-redirected tab still works.
+const CALLBACK_ORIGINS = new Set([
+  'https://www.subconscious.dev',
+  'https://platform.subconscious.dev',
+  'https://dev.subconscious.dev',
+  'https://platform-dev.subconscious.dev',
+]);
+
+export function isAllowedCallbackOrigin(origin, platformUrl = PLATFORM_URL) {
+  if (!origin) return false;
+  if (origin === platformUrl || CALLBACK_ORIGINS.has(origin)) return true;
+  try {
+    const { protocol, hostname } = new URL(origin);
+    return protocol === 'http:' && (hostname === 'localhost' || hostname === '127.0.0.1');
+  } catch {
+    return false;
+  }
+}
+
 // ── Config helpers ──────────────────────────────────────────────────────
 
 async function loadConfig() {
   try {
     const content = await fs.readFile(CONFIG_FILE, 'utf-8');
     return JSON.parse(content);
+  } catch (error) {
+    if (error.code !== 'ENOENT' || !LEGACY_CONFIG_FILE) return {};
+  }
+
+  // One-way compatibility migration. Keep the old file untouched so this is
+  // recoverable, but all future writes go to ~/.subconscious.
+  try {
+    const content = await fs.readFile(LEGACY_CONFIG_FILE, 'utf-8');
+    const config = JSON.parse(content);
+    await saveConfig(config);
+    return config;
   } catch {
     return {};
   }
@@ -48,13 +86,20 @@ async function saveConfig(config) {
  * Resolve the active API key. The env var takes precedence over the saved
  * config so CI and per-shell overrides win. Returns null when unauthenticated.
  */
-export async function getApiKey() {
+export async function getApiKey(profile) {
   const envKey = process.env.SUBCONSCIOUS_API_KEY?.trim();
   if (envKey) return { key: envKey, source: 'SUBCONSCIOUS_API_KEY env var' };
 
+  const profileKey = profile?.values?.API_KEY?.trim();
+  if (profileKey) return { key: profileKey, source: profile.path };
+
+  // Named profiles are isolated: an empty/missing key must not silently fall
+  // back to the default credential and send traffic to the wrong account.
+  if (profile?.name && profile.name !== DEFAULT_PROFILE) return null;
+
   const config = await loadConfig();
   if (config.subconscious_api_key) {
-    return { key: config.subconscious_api_key, source: '~/.subcon/config.json' };
+    return { key: config.subconscious_api_key, source: '~/.subconscious/config.json' };
   }
   return null;
 }
@@ -90,12 +135,10 @@ function startCallbackServer(expectedState) {
     });
 
     const server = http.createServer((req, res) => {
-      // CORS: only allow the web app's origin (production or localhost dev).
+      // CORS: only allow known web-app origins (or localhost dev).
       // This prevents arbitrary websites from hitting this callback.
       const origin = req.headers.origin || '';
-      const allowed =
-        origin === PLATFORM_URL ||
-        origin.startsWith('http://localhost:');
+      const allowed = isAllowedCallbackOrigin(origin);
       res.setHeader(
         'Access-Control-Allow-Origin',
         allowed ? origin : PLATFORM_URL,
@@ -231,15 +274,20 @@ h1{font-size:15px;font-weight:600;margin-bottom:4px;letter-spacing:-.01em}
 
 // ── Commands ────────────────────────────────────────────────────────────
 
-export async function loginCommand() {
-  const existing = await getApiKey();
+export async function loginCommand(_argv = [], options = {}) {
+  const profileName = options.profileName || DEFAULT_PROFILE;
+  const existing = await getApiKey(options.profile);
 
   if (existing) {
+    const profile = await ensureProfile(profileName, existing.key);
+    const logout =
+      profileName === DEFAULT_PROFILE ? 'subc logout' : `subc --profile ${profileName} logout`;
     const masked = existing.key.slice(0, 8) + '...' + existing.key.slice(-4);
     console.log(`\n${c.yellow}Already logged in.${c.reset}`);
     console.log(`  Key: ${c.dim}${masked}${c.reset}`);
+    console.log(`  Profile: ${c.dim}${profile.path}${c.reset}`);
     console.log(
-      `\n  Run ${c.cyan}subconscious logout${c.reset} first to switch accounts.\n`,
+      `\n  Run ${c.cyan}${logout}${c.reset} first to switch accounts.\n`,
     );
     return;
   }
@@ -283,14 +331,22 @@ export async function loginCommand() {
     clearInterval(spinner);
     process.stdout.write('\r' + ' '.repeat(50) + '\r');
 
-    const config = await loadConfig();
-    config.subconscious_api_key = result.token;
-    await saveConfig(config);
+    if (profileName === DEFAULT_PROFILE) {
+      const config = await loadConfig();
+      config.subconscious_api_key = result.token;
+      await saveConfig(config);
+    }
+    const profile = await ensureProfile(profileName, result.token);
 
     const masked = result.token.slice(0, 8) + '...' + result.token.slice(-4);
     console.log(`  ${c.green}${c.bold}✓ Logged in successfully!${c.reset}`);
     console.log(`  ${c.dim}Key: ${masked}${c.reset}`);
-    console.log(`  ${c.dim}Saved to ~/.subcon/config.json${c.reset}`);
+    if (profileName === DEFAULT_PROFILE) {
+      console.log(`  ${c.dim}Saved to ~/.subconscious/config.json${c.reset}`);
+    }
+    console.log(`  ${c.dim}Runbook profile: ${profile.path}${c.reset}`);
+    console.log(`  ${c.dim}Launch a terminal agent with ${c.reset}${c.cyan}subc claude${c.reset}${c.dim}, or install editor hooks with ${c.reset}${c.cyan}subc cursor install${c.reset}${c.dim}.${c.reset}`);
+    console.log(`  ${c.dim}Pi needs ${c.reset}${c.cyan}subc pi install${c.reset}${c.dim} first. List profiles with ${c.reset}${c.cyan}subc config${c.reset}${c.dim}.${c.reset}`);
     console.log();
   } catch (error) {
     clearInterval(spinner);
@@ -300,29 +356,65 @@ export async function loginCommand() {
   }
 }
 
-export async function logoutCommand() {
+export async function updateApiKeyCommand(argv = [], options = {}) {
+  if (argv.length !== 1 || !argv[0]?.trim()) {
+    throw new Error('Usage: subc update-key <api-key>');
+  }
+
+  const key = argv[0].trim();
+  const profileName = options.profileName || DEFAULT_PROFILE;
+  const profile = await ensureProfile(profileName, key);
+
+  if (profileName === DEFAULT_PROFILE) {
+    const config = await loadConfig();
+    config.subconscious_api_key = key;
+    await saveConfig(config);
+  }
+
+  const masked = key.length <= 12 ? '********' : `${key.slice(0, 8)}...${key.slice(-4)}`;
+  console.log(`\n  ${c.green}${c.bold}✓ API key updated.${c.reset}`);
+  console.log(`  ${c.dim}Profile: ${profile.path}${c.reset}`);
+  console.log(`  ${c.dim}Key:     ${masked}${c.reset}`);
+  if (process.env.SUBCONSCIOUS_API_KEY?.trim()) {
+    console.log(
+      `\n  ${c.yellow}SUBCONSCIOUS_API_KEY is set and will override this saved key.${c.reset}`,
+    );
+  }
+  console.log();
+}
+
+export async function logoutCommand(_argv = [], options = {}) {
+  const profileName = options.profileName || DEFAULT_PROFILE;
   const config = await loadConfig();
+  const clearedProfile = await clearProfileApiKey(profileName);
+  const clearSavedConfig = profileName === DEFAULT_PROFILE && config.subconscious_api_key;
 
-  if (!config.subconscious_api_key) {
+  if (!clearSavedConfig && !clearedProfile) {
     console.log(`\n  ${c.dim}Not logged in.${c.reset}\n`);
     return;
   }
 
-  delete config.subconscious_api_key;
-  await saveConfig(config);
+  if (clearSavedConfig) {
+    delete config.subconscious_api_key;
+    await saveConfig(config);
+  }
 
   console.log(
-    `\n  ${c.green}✓${c.reset} Logged out. API key removed from ${c.dim}~/.subcon/config.json${c.reset}\n`,
+    `\n  ${c.green}✓${c.reset} Logged out of profile '${profileName}'.${c.reset}\n`,
   );
 }
 
-export async function whoamiCommand() {
-  const auth = await getApiKey();
+export async function whoamiCommand(_argv = [], options = {}) {
+  const auth = await getApiKey(options.profile);
+  const profileFlag =
+    options.profileName && options.profileName !== DEFAULT_PROFILE
+      ? `--profile ${options.profileName} `
+      : '';
 
   if (!auth) {
     console.log(`\n  ${c.dim}Not logged in.${c.reset}`);
     console.log(
-      `  Run ${c.cyan}subconscious login${c.reset} to get started.\n`,
+      `  Run ${c.cyan}subc ${profileFlag}login${c.reset} to get started.\n`,
     );
     return;
   }
@@ -353,7 +445,7 @@ export async function whoamiCommand() {
       console.log(`  ${c.dim}Source: ${source}${c.reset}`);
       console.log();
       console.log(
-        `  Run ${c.cyan}subconscious logout${c.reset} then ${c.cyan}subconscious login${c.reset} to re-authenticate.`,
+        `  Run ${c.cyan}subc ${profileFlag}logout${c.reset} then ${c.cyan}subc ${profileFlag}login${c.reset} to re-authenticate.`,
       );
     }
   } catch {

package/bin/branding.js

@@ -0,0 +1,39 @@
+import { colorEnabled } from './colors.js';
+
+// Pre-rendered from assets/imgs/logo.png as portable, 7-bit ASCII art.
+const LOGO = [
+  '       #####        #####',
+  '      #######      #######',
+  '     ########      ########',
+  '      ########    ########',
+  '             ######',
+  '               ##',
+  ' ######       ####       ######',
+  '##########  ########  ##########',
+  '##########  ########  ##########',
+  ' ######       ####       ######',
+  '               ##',
+  '             ######',
+  '       #######    #######',
+  '      #######      #######',
+  '      #######      #######',
+  '      ######        #####',
+].join('\n');
+
+const ORANGE = '\x1b[38;2;255;92;40m';
+const BOLD = '\x1b[1m';
+const RESET = '\x1b[0m';
+
+export function renderBanner(options = {}) {
+  const isTTY = options.isTTY ?? process.stdout.isTTY === true;
+  const term = options.term ?? process.env.TERM;
+  const color = options.color ?? colorEnabled;
+  const title = color ? `${BOLD}Subconscious CLI${RESET}` : 'Subconscious CLI';
+
+  // Avoid multi-line art in logs and pipes. Interactive NO_COLOR sessions
+  // still get the same logo without ANSI styling.
+  if (!isTTY || term === 'dumb') return `  ${title}`;
+
+  const logo = color ? `${ORANGE}${LOGO}${RESET}` : LOGO;
+  return `${logo}\n\n  ${title}`;
+}

package/bin/cli.js

@@ -3,61 +3,229 @@
 /**
  * Subconscious CLI — log in, then launch coding agents on your hosted models.
  *
- *   subconscious login | logout | whoami     — manage your API key
- *   subconscious <agent> [...args]            — launch a coding agent
+ *   subc login | update-key | logout | whoami — manage your API key
+ *   subc <agent> [...args]            — launch or configure a coding agent
  *
  * Auth lives in ./auth.js, the agent launcher + registry in ./agents.js.
  */
 
 import fs from 'node:fs/promises';
 import { c } from './colors.js';
-import { loginCommand, logoutCommand, whoamiCommand } from './auth.js';
-import { resolveAgent, runAgent, agentList } from './agents.js';
+import { renderBanner } from './branding.js';
+import {
+  loginCommand,
+  logoutCommand,
+  updateApiKeyCommand,
+  whoamiCommand,
+} from './auth.js';
+import {
+  resolveAgent,
+  runAgent,
+  agentList,
+  agentCommandName,
+  isAgentHelpRequest,
+  parseAgentAction,
+} from './agents.js';
+import {
+  configCommand,
+  DEFAULT_PROFILE,
+  loadProfile,
+  modelsCommand,
+  printConfigHelp,
+  updateUrlCommand,
+  validateProfileName,
+} from './profiles.js';
+
+function isHelpArg(arg) {
+  return arg === 'help' || arg === '-h' || arg === '--help';
+}
 
 function printHelp() {
   const agents = agentList()
-    .map(({ name, alias }) => `    ${c.cyan}${alias.padEnd(13)}${c.reset}${c.dim}Launch ${name}${c.reset}`)
+    .map(({ name, alias, action }) => `    ${c.cyan}${alias.padEnd(13)}${c.reset}${c.dim}${action} ${name}${c.reset}`)
     .join('\n');
 
-  console.log(`
-  ${c.magenta}${c.bold}Subconscious CLI${c.reset}
+  console.log(`${renderBanner()}
 
   ${c.bold}Usage${c.reset}
-    ${c.cyan}subconscious${c.reset} <command> [...args]
+    ${c.cyan}subc${c.reset} <command> [...args]
+    ${c.cyan}subc${c.reset} <command> help
 
   ${c.bold}Auth${c.reset}
     ${c.cyan}login${c.reset}        Authenticate and save your API key
+    ${c.cyan}update-key${c.reset}   Replace the selected profile's API key
+    ${c.cyan}update-url${c.reset}   Update the active profile's gateway URL automatically
     ${c.cyan}logout${c.reset}       Remove saved credentials
     ${c.cyan}whoami${c.reset}       Show current authentication status
 
+  ${c.bold}Profiles${c.reset}
+    ${c.cyan}config${c.reset}       List profiles, or show/edit one with ${c.dim}-p${c.reset}
+    ${c.cyan}models${c.reset}       List available Subconscious models
+
   ${c.bold}Coding agents${c.reset}
 ${agents}
 
   ${c.bold}Options${c.reset}
-    ${c.dim}--model <id>${c.reset}   Model to use (default subconscious/tim-qwen3.6-27b)
+    ${c.dim}--model <id>${c.reset}   Model to use (default subconscious/glm-5.2)
+    ${c.dim}-p, --profile${c.reset}  Select a profile (default: default)
     ${c.dim}-h, --help${c.reset}     Show this help
     ${c.dim}-v, --version${c.reset}  Show version
 
   ${c.bold}Examples${c.reset}
-    ${c.dim}$${c.reset} subconscious login
-    ${c.dim}$${c.reset} subconscious claude-code
-    ${c.dim}$${c.reset} subconscious open-code --model subconscious/tim-qwen3.6-27b
+    ${c.dim}$${c.reset} subc login
+    ${c.dim}$${c.reset} subc config
+    ${c.dim}$${c.reset} subc config help
+    ${c.dim}$${c.reset} subc -p staging config
+    ${c.dim}$${c.reset} subc config edit vim
+    ${c.dim}$${c.reset} subc claude
+    ${c.dim}$${c.reset} subc claude help
+    ${c.dim}$${c.reset} subc cursor install
+    ${c.dim}$${c.reset} subc cursor uninstall
+    ${c.dim}$${c.reset} subc pi install
+    ${c.dim}$${c.reset} subc -p staging codex
 
-  ${c.dim}Anything after the agent name is forwarded to the underlying CLI.${c.reset}
+  ${c.dim}Use subc <command> help for command-specific usage.${c.reset}
 `);
 }
 
-const authCommands = { login: loginCommand, logout: logoutCommand, whoami: whoamiCommand };
+const COMMAND_HELP = {
+  login: `
+Usage:
+  subc login
+  subc -p NAME login
+  subc login help
+
+Authenticate and save an API key to the selected profile.
+`,
+  logout: `
+Usage:
+  subc logout
+  subc -p NAME logout
+  subc logout help
+
+Remove the selected profile's saved API key. Non-secret settings are kept.
+`,
+  whoami: `
+Usage:
+  subc whoami
+  subc -p NAME whoami
+  subc whoami help
+
+Show the current authentication status for the selected profile.
+`,
+  'update-key': `
+Usage:
+  subc update-key <api-key>
+  subc -p NAME update-key <api-key>
+  subc update-key help
+
+Replace the selected profile's shared API key.
+`,
+  'update-url': `
+Usage:
+  subc update-url <gateway-url>
+  subc update-url help
+
+Update the active profile's gateway URL.
+`,
+  models: `
+Usage:
+  subc models
+  subc models help
+
+List available Subconscious models.
+`,
+};
+
+function printRetiredSetup(args = []) {
+  const maybeAgent = resolveAgent(args[0]);
+  const command = maybeAgent ? agentCommandName(maybeAgent) : 'cursor';
+  console.error(`
+  ${c.red}subc setup is no longer used.${c.reset} Use the agent command instead:
+
+    ${c.cyan}subc ${command} install${c.reset}
+    ${c.cyan}subc ${command} uninstall${c.reset}
+    ${c.cyan}subc ${command} help${c.reset}
+`);
+}
+
+function printRetiredSettings() {
+  console.error(`
+  ${c.red}subc settings is no longer used.${c.reset} Use:
+
+    ${c.cyan}subc config${c.reset}                 List profiles
+    ${c.cyan}subc -p NAME config${c.reset}         Show a profile
+    ${c.cyan}subc -p NAME config edit${c.reset}    Open the profile env file
+    ${c.cyan}subc config help${c.reset}
+`);
+}
+
+const authCommands = {
+  login: loginCommand,
+  'update-key': updateApiKeyCommand,
+  logout: logoutCommand,
+  whoami: whoamiCommand,
+};
+
+function extractProfile(argv) {
+  let profileName = process.env.SUBC_PROFILE?.trim() || DEFAULT_PROFILE;
+  let profileExplicit = false;
+  const args = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--') {
+      args.push(...argv.slice(i));
+      break;
+    }
+    if (arg === '--profile' || arg === '-p') {
+      const value = argv[++i];
+      if (!value) throw new Error(`${arg} requires a profile name`);
+      profileName = value;
+      profileExplicit = true;
+      continue;
+    }
+    if (arg.startsWith('--profile=')) {
+      profileName = arg.slice('--profile='.length);
+      profileExplicit = true;
+      continue;
+    }
+    args.push(arg);
+  }
+  validateProfileName(profileName);
+  return { args, profileName, profileExplicit };
+}
+
+function requireNamedProfile(profile) {
+  if (profile.name !== DEFAULT_PROFILE && !profile.exists) {
+    throw new Error(
+      `Profile '${profile.name}' does not exist. Create it with ` +
+        `subc -p ${profile.name} config --api-key KEY`,
+    );
+  }
+}
 
 async function main() {
-  const args = process.argv.slice(2);
+  const parsed = extractProfile(process.argv.slice(2));
+  const { args, profileName, profileExplicit } = parsed;
   const command = args[0];
 
-  if (!command || command === '--help' || command === '-h') {
+  if (!command || command === '--help' || command === '-h' || (command === 'help' && !args[1])) {
     printHelp();
     return;
   }
 
+  if (command === 'help') {
+    if (!args[1] || isHelpArg(args[1])) {
+      printHelp();
+      return;
+    }
+    const agent = resolveAgent(args[1]);
+    if (!agent) throw new Error(`Unknown coding agent: ${args[1]}`);
+    const profile = await loadProfile(profileName);
+    await runAgent(agent, ['help'], { profile });
+    return;
+  }
+
   if (command === '--version' || command === '-v') {
     const pkgPath = new URL('../package.json', import.meta.url);
     const pkg = JSON.parse(await fs.readFile(pkgPath, 'utf-8'));
@@ -65,15 +233,67 @@ async function main() {
     return;
   }
 
+  if (command === 'setup') {
+    printRetiredSetup(args.slice(1));
+    process.exitCode = 1;
+    return;
+  }
+
+  if (command === 'settings') {
+    printRetiredSettings();
+    process.exitCode = 1;
+    return;
+  }
+
   const authHandler = authCommands[command];
   if (authHandler) {
-    await authHandler(args.slice(1));
+    if (isHelpArg(args[1])) {
+      console.log(COMMAND_HELP[command]);
+      return;
+    }
+    const profile = await loadProfile(profileName);
+    await authHandler(args.slice(1), { profile, profileName });
+    return;
+  }
+
+  if (command === 'config') {
+    if (isHelpArg(args[1])) {
+      printConfigHelp();
+      return;
+    }
+    await configCommand(args.slice(1), profileName, { profileExplicit });
+    return;
+  }
+
+  if (command === 'models') {
+    if (isHelpArg(args[1])) {
+      console.log(COMMAND_HELP.models);
+      return;
+    }
+    modelsCommand();
+    return;
+  }
+
+  if (command === 'update-url') {
+    if (isHelpArg(args[1])) {
+      console.log(COMMAND_HELP['update-url']);
+      return;
+    }
+    await updateUrlCommand(args.slice(1), { profileName });
     return;
   }
 
   const agent = resolveAgent(command);
   if (agent) {
-    await runAgent(agent, args.slice(1));
+    const agentArgs = args.slice(1);
+    const profile = await loadProfile(profileName);
+    if (!isAgentHelpRequest(agentArgs)) {
+      const action = parseAgentAction(agent, agentArgs);
+      if (action.action !== 'status' && action.action !== 'uninstall') {
+        requireNamedProfile(profile);
+      }
+    }
+    await runAgent(agent, agentArgs, { profile });
     return;
   }
 

package/bin/colors.js

@@ -1,12 +1,24 @@
-// ANSI color helpers shared across the CLI.
+// ANSI color helpers shared across the CLI. Keep redirected output machine
+// readable and honor the standard NO_COLOR opt-out.
+const noColor = Object.prototype.hasOwnProperty.call(process.env, 'NO_COLOR');
+const forceColor =
+  process.env.FORCE_COLOR !== undefined && process.env.FORCE_COLOR !== '0';
+
+export const colorEnabled =
+  !noColor &&
+  process.env.TERM !== 'dumb' &&
+  (forceColor || process.stdout.isTTY === true);
+
+const ansi = (code) => (colorEnabled ? `\x1b[${code}m` : '');
+
 export const c = {
-  reset: '\x1b[0m',
-  bold: '\x1b[1m',
-  dim: '\x1b[2m',
-  cyan: '\x1b[36m',
-  green: '\x1b[32m',
-  red: '\x1b[31m',
-  yellow: '\x1b[33m',
-  magenta: '\x1b[35m',
-  underline: '\x1b[4m',
+  reset: ansi(0),
+  bold: ansi(1),
+  dim: ansi(2),
+  cyan: ansi(36),
+  green: ansi(32),
+  red: ansi(31),
+  yellow: ansi(33),
+  magenta: ansi(35),
+  underline: ansi(4),
 };