subconscious-cli 0.3.0 → 4.0.0

package/bin/auth.js

@@ -4,14 +4,15 @@
  * Login flow (localhost callback pattern, similar to Vercel/Supabase CLIs):
  *  1. CLI generates a random `state` token (CSRF protection) and starts
  *     an ephemeral HTTP server on a random port bound to 127.0.0.1.
- *  2. Opens the browser to {PLATFORM_URL}/cli/auth?port=...&state=...
+ *  2. Opens the browser to {platformUrl}/cli/auth?port=...&state=...
  *  3. The web app authenticates the user, generates an API key, and
  *     delivers it back to the CLI via a cross-origin fetch to
  *     localhost:{port}/callback?token=...&state=...
  *  4. CLI verifies the `state`, saves the key to ~/.subconscious/config.json,
  *     and creates a coding-agent profile under ~/.subconscious/profiles/.
  *
- * Override SUBCONSCIOUS_URL env var for local development.
+ * Override SUBCONSCIOUS_URL env var for local development
+ * (e.g. http://localhost:3000). Production defaults to platform.subconscious.dev.
  */
 
 import http from 'node:http';
@@ -22,6 +23,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { c } from './colors.js';
 import { clearProfileApiKey, DEFAULT_PROFILE, ensureProfile } from './profiles.js';
+import { printLoginUpgradeWarning } from './upgrade.js';
 
 const CONFIG_OVERRIDE = process.env.SUBC_CONFIG_DIR?.trim();
 const CONFIG_DIR = CONFIG_OVERRIDE || path.join(os.homedir(), '.subconscious');
@@ -29,8 +31,34 @@ const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
 const LEGACY_CONFIG_FILE = CONFIG_OVERRIDE
   ? null
   : path.join(os.homedir(), '.subcon', 'config.json');
-// Defaults to production. Developers set SUBCONSCIOUS_URL=http://localhost:3000 for local dev.
-const PLATFORM_URL = process.env.SUBCONSCIOUS_URL || 'https://www.subconscious.dev';
+// Defaults to the platform host. Developers set SUBCONSCIOUS_URL for local dev.
+export const DEFAULT_PLATFORM_URL = 'https://platform.subconscious.dev';
+
+export function getPlatformUrl() {
+  const raw = process.env.SUBCONSCIOUS_URL?.trim() || DEFAULT_PLATFORM_URL;
+  return raw.replace(/\/$/, '');
+}
+
+// Login callback CORS. After the marketing/platform split, /cli/auth lives on
+// platform. www may still 307 there for older CLIs; keep www so a redirected
+// or leftover tab can complete the callback.
+const CALLBACK_ORIGINS = new Set([
+  'https://www.subconscious.dev',
+  'https://platform.subconscious.dev',
+  'https://dev.subconscious.dev',
+  'https://platform-dev.subconscious.dev',
+]);
+
+export function isAllowedCallbackOrigin(origin, platformUrl = getPlatformUrl()) {
+  if (!origin) return false;
+  if (origin === platformUrl || CALLBACK_ORIGINS.has(origin)) return true;
+  try {
+    const { protocol, hostname } = new URL(origin);
+    return protocol === 'http:' && (hostname === 'localhost' || hostname === '127.0.0.1');
+  } catch {
+    return false;
+  }
+}
 
 // ── Config helpers ──────────────────────────────────────────────────────
 
@@ -83,6 +111,24 @@ export async function getApiKey(profile) {
   return null;
 }
 
+export async function probeLoginPage(platformUrl = getPlatformUrl(), fetchImpl = fetch) {
+  const url = `${platformUrl.replace(/\/$/, '')}/cli/auth`;
+  try {
+    const res = await fetchImpl(url, {
+      method: 'GET',
+      redirect: 'manual',
+      signal: AbortSignal.timeout(8000),
+    });
+    return res.status;
+  } catch {
+    return null;
+  }
+}
+
+export function isLoginMissing(status) {
+  return status === 404;
+}
+
 // ── Browser opener ──────────────────────────────────────────────────────
 
 function openBrowser(url) {
@@ -114,15 +160,13 @@ function startCallbackServer(expectedState) {
     });
 
     const server = http.createServer((req, res) => {
-      // CORS: only allow the web app's origin (production or localhost dev).
+      // CORS: only allow known web-app origins (or localhost dev).
       // This prevents arbitrary websites from hitting this callback.
       const origin = req.headers.origin || '';
-      const allowed =
-        origin === PLATFORM_URL ||
-        origin.startsWith('http://localhost:');
+      const allowed = isAllowedCallbackOrigin(origin);
       res.setHeader(
         'Access-Control-Allow-Origin',
-        allowed ? origin : PLATFORM_URL,
+        allowed ? origin : getPlatformUrl(),
       );
       res.setHeader('Access-Control-Allow-Methods', 'GET, OPTIONS');
       res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
@@ -279,10 +323,18 @@ export async function loginCommand(_argv = [], options = {}) {
   );
   console.log();
 
+  const platformUrl = getPlatformUrl();
+  const loginStatus = await probeLoginPage(platformUrl);
+  if (isLoginMissing(loginStatus)) {
+    printLoginUpgradeWarning();
+    process.exitCode = 1;
+    return;
+  }
+
   const state = crypto.randomBytes(16).toString('hex');
   const { port, promise } = await startCallbackServer(state);
 
-  const authUrl = `${PLATFORM_URL}/cli/auth?port=${port}&state=${state}`;
+  const authUrl = `${platformUrl}/cli/auth?port=${port}&state=${state}`;
 
   console.log(`  ${c.dim}Opening browser to sign in...${c.reset}`);
   console.log();
@@ -326,9 +378,8 @@ export async function loginCommand(_argv = [], options = {}) {
       console.log(`  ${c.dim}Saved to ~/.subconscious/config.json${c.reset}`);
     }
     console.log(`  ${c.dim}Runbook profile: ${profile.path}${c.reset}`);
-    const setup =
-      profileName === DEFAULT_PROFILE ? 'subc setup' : `subc --profile ${profileName} setup`;
-    console.log(`  ${c.dim}Run ${setup} once to configure all coding agents.${c.reset}`);
+    console.log(`  ${c.dim}Launch a terminal agent with ${c.reset}${c.cyan}subc claude${c.reset}${c.dim}, or install editor hooks with ${c.reset}${c.cyan}subc cursor install${c.reset}${c.dim}.${c.reset}`);
+    console.log(`  ${c.dim}Pi needs ${c.reset}${c.cyan}subc pi install${c.reset}${c.dim} first. List profiles with ${c.reset}${c.cyan}subc config${c.reset}${c.dim}.${c.reset}`);
     console.log();
   } catch (error) {
     clearInterval(spinner);
@@ -408,11 +459,16 @@ export async function whoamiCommand(_argv = [], options = {}) {
 
   // Validate the key against the server; falls back to offline display if unreachable
   try {
-    const res = await fetch(`${PLATFORM_URL}/api/cli/whoami`, {
+    const res = await fetch(`${getPlatformUrl()}/api/cli/whoami`, {
       headers: { Authorization: `Bearer ${key}` },
       signal: AbortSignal.timeout(5000),
     });
 
+    if (res.status === 404) {
+      printLoginUpgradeWarning();
+      return;
+    }
+
     if (res.ok) {
       const data = await res.json();
       console.log(`  ${c.green}✓ Authenticated${c.reset}`);

package/bin/cli.js

@@ -3,7 +3,7 @@
 /**
  * Subconscious CLI — log in, then launch coding agents on your hosted models.
  *
- *   subc login | update-key | logout | whoami — manage your API key
+ *   subc login | update-key | logout | whoami | upgrade — manage your API key
  *   subc <agent> [...args]            — launch or configure a coding agent
  *
  * Auth lives in ./auth.js, the agent launcher + registry in ./agents.js.
@@ -18,22 +18,29 @@ import {
   updateApiKeyCommand,
   whoamiCommand,
 } from './auth.js';
+import { upgradeCommand } from './upgrade.js';
 import {
   resolveAgent,
   runAgent,
   agentList,
-  parseSetupRequest,
+  agentCommandName,
   isAgentHelpRequest,
+  parseAgentAction,
 } from './agents.js';
 import {
   configCommand,
   DEFAULT_PROFILE,
   loadProfile,
   modelsCommand,
+  printConfigHelp,
   updateUrlCommand,
   validateProfileName,
 } from './profiles.js';
 
+function isHelpArg(arg) {
+  return arg === 'help' || arg === '-h' || arg === '--help';
+}
+
 function printHelp() {
   const agents = agentList()
     .map(({ name, alias, action }) => `    ${c.cyan}${alias.padEnd(13)}${c.reset}${c.dim}${action} ${name}${c.reset}`)
@@ -43,6 +50,7 @@ function printHelp() {
 
   ${c.bold}Usage${c.reset}
     ${c.cyan}subc${c.reset} <command> [...args]
+    ${c.cyan}subc${c.reset} <command> help
 
   ${c.bold}Auth${c.reset}
     ${c.cyan}login${c.reset}        Authenticate and save your API key
@@ -50,12 +58,10 @@ function printHelp() {
     ${c.cyan}update-url${c.reset}   Update the active profile's gateway URL automatically
     ${c.cyan}logout${c.reset}       Remove saved credentials
     ${c.cyan}whoami${c.reset}       Show current authentication status
+    ${c.cyan}upgrade${c.reset}      Upgrade this CLI to the latest version
 
-  ${c.bold}Setup and profiles${c.reset}
-    ${c.cyan}help <agent>${c.reset}  Show coding-agent integration help and settings
-    ${c.cyan}setup${c.reset}        Configure all or one coding-agent integration
-    ${c.cyan}config${c.reset}       Show or update the selected runbook profile
-    ${c.cyan}settings${c.reset}     Edit profile and per-agent settings interactively
+  ${c.bold}Profiles${c.reset}
+    ${c.cyan}config${c.reset}       List profiles, or show/edit one with ${c.dim}-p${c.reset}
     ${c.cyan}models${c.reset}       List available Subconscious models
 
   ${c.bold}Coding agents${c.reset}
@@ -69,17 +75,103 @@ ${agents}
 
   ${c.bold}Examples${c.reset}
     ${c.dim}$${c.reset} subc login
-    ${c.dim}$${c.reset} subc update-key sk-...
-    ${c.dim}$${c.reset} subc update-url https://api.subconscious.dev
-    ${c.dim}$${c.reset} subc setup
-    ${c.dim}$${c.reset} subc settings
-    ${c.dim}$${c.reset} subc models
-    ${c.dim}$${c.reset} subc help codex
+    ${c.dim}$${c.reset} subc upgrade
+    ${c.dim}$${c.reset} subc upgrade --latest
+    ${c.dim}$${c.reset} subc config
+    ${c.dim}$${c.reset} subc config help
+    ${c.dim}$${c.reset} subc -p staging config
+    ${c.dim}$${c.reset} subc config edit vim
     ${c.dim}$${c.reset} subc claude
-    ${c.dim}$${c.reset} subc --profile staging codex
-    ${c.dim}$${c.reset} subc codex --model subconscious/glm-5.2
+    ${c.dim}$${c.reset} subc claude help
+    ${c.dim}$${c.reset} subc cursor install
+    ${c.dim}$${c.reset} subc cursor uninstall
+    ${c.dim}$${c.reset} subc pi install
+    ${c.dim}$${c.reset} subc -p staging codex
+
+  ${c.dim}Use subc <command> help for command-specific usage.${c.reset}
+`);
+}
+
+const COMMAND_HELP = {
+  login: `
+Usage:
+  subc login
+  subc -p NAME login
+  subc login help
+
+Authenticate and save an API key to the selected profile.
+`,
+  logout: `
+Usage:
+  subc logout
+  subc -p NAME logout
+  subc logout help
+
+Remove the selected profile's saved API key. Non-secret settings are kept.
+`,
+  whoami: `
+Usage:
+  subc whoami
+  subc -p NAME whoami
+  subc whoami help
+
+Show the current authentication status for the selected profile.
+`,
+  upgrade: `
+Usage:
+  subc upgrade
+  subc upgrade --latest
+  subc upgrade help
+
+Upgrade subconscious-cli to the latest published version.
+
+  subc upgrade           Prompt "Do you want to upgrade?" then install @latest
+  subc upgrade --latest  Skip the prompt and install @latest
+`,
+  'update-key': `
+Usage:
+  subc update-key <api-key>
+  subc -p NAME update-key <api-key>
+  subc update-key help
+
+Replace the selected profile's shared API key.
+`,
+  'update-url': `
+Usage:
+  subc update-url <gateway-url>
+  subc update-url help
+
+Update the active profile's gateway URL.
+`,
+  models: `
+Usage:
+  subc models
+  subc models help
+
+List available Subconscious models.
+`,
+};
+
+function printRetiredSetup(args = []) {
+  const maybeAgent = resolveAgent(args[0]);
+  const command = maybeAgent ? agentCommandName(maybeAgent) : 'cursor';
+  console.error(`
+  ${c.red}subc setup is no longer used.${c.reset} Use the agent command instead:
 
-  ${c.dim}Arguments are forwarded to terminal agents or their runbook setup.${c.reset}
+    ${c.cyan}subc ${command} install${c.reset}
+    ${c.cyan}subc ${command} uninstall${c.reset}
+    ${c.cyan}subc ${command} help${c.reset}
+`);
+}
+
+function printRetiredSettings() {
+  console.error(`
+  ${c.red}subc settings is no longer used.${c.reset} Use:
+
+    ${c.cyan}subc config${c.reset}                 List profiles
+    ${c.cyan}subc -p NAME config${c.reset}         Show a profile
+    ${c.cyan}subc -p NAME config edit${c.reset}    Open the profile env file
+    ${c.cyan}subc config help${c.reset}
 `);
 }
 
@@ -91,10 +183,8 @@ const authCommands = {
 };
 
 function extractProfile(argv) {
-  let profileName =
-    process.env.SUBC_PROFILE?.trim() ||
-    process.env.MBTA_PROFILE?.trim() ||
-    DEFAULT_PROFILE;
+  let profileName = process.env.SUBC_PROFILE?.trim() || DEFAULT_PROFILE;
+  let profileExplicit = false;
   const args = [];
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
@@ -106,39 +196,41 @@ function extractProfile(argv) {
       const value = argv[++i];
       if (!value) throw new Error(`${arg} requires a profile name`);
       profileName = value;
+      profileExplicit = true;
       continue;
     }
     if (arg.startsWith('--profile=')) {
       profileName = arg.slice('--profile='.length);
+      profileExplicit = true;
       continue;
     }
     args.push(arg);
   }
   validateProfileName(profileName);
-  return { args, profileName };
+  return { args, profileName, profileExplicit };
 }
 
 function requireNamedProfile(profile) {
   if (profile.name !== DEFAULT_PROFILE && !profile.exists) {
     throw new Error(
       `Profile '${profile.name}' does not exist. Create it with ` +
-        `subc --profile ${profile.name} config --api-key KEY`,
+        `subc -p ${profile.name} config --api-key KEY`,
     );
   }
 }
 
 async function main() {
   const parsed = extractProfile(process.argv.slice(2));
-  const { args, profileName } = parsed;
+  const { args, profileName, profileExplicit } = parsed;
   const command = args[0];
 
-  if (!command || command === '--help' || command === '-h') {
+  if (!command || command === '--help' || command === '-h' || (command === 'help' && !args[1])) {
     printHelp();
     return;
   }
 
   if (command === 'help') {
-    if (!args[1]) {
+    if (!args[1] || isHelpArg(args[1])) {
       printHelp();
       return;
     }
@@ -156,94 +248,76 @@ async function main() {
     return;
   }
 
+  if (command === 'setup') {
+    printRetiredSetup(args.slice(1));
+    process.exitCode = 1;
+    return;
+  }
+
+  if (command === 'settings') {
+    printRetiredSettings();
+    process.exitCode = 1;
+    return;
+  }
+
   const authHandler = authCommands[command];
   if (authHandler) {
+    if (isHelpArg(args[1])) {
+      console.log(COMMAND_HELP[command]);
+      return;
+    }
     const profile = await loadProfile(profileName);
     await authHandler(args.slice(1), { profile, profileName });
     return;
   }
 
   if (command === 'config') {
-    await configCommand(args.slice(1), profileName);
-    return;
-  }
-
-  if (command === 'settings') {
-    if (['help', '-h', '--help'].includes(args[1])) {
-      console.log(`
-Usage:
-  subc settings
-  subc --profile NAME settings
-  subc --profile NAME config interactive
-
-Interactively choose or create a profile, then edit shared or per-agent settings.
-`);
+    if (isHelpArg(args[1])) {
+      printConfigHelp();
       return;
     }
-    if (args.length > 1) throw new Error('Usage: subc [--profile NAME] settings');
-    await configCommand(['interactive'], profileName);
+    await configCommand(args.slice(1), profileName, { profileExplicit });
     return;
   }
 
   if (command === 'models') {
+    if (isHelpArg(args[1])) {
+      console.log(COMMAND_HELP.models);
+      return;
+    }
     modelsCommand();
     return;
   }
 
-  if (command === 'update-url') {
-    await updateUrlCommand(args.slice(1), { profileName });
+  if (command === 'upgrade') {
+    if (isHelpArg(args[1])) {
+      console.log(COMMAND_HELP.upgrade);
+      return;
+    }
+    await upgradeCommand(args.slice(1));
     return;
   }
 
-  if (command === 'setup') {
-    const setupArgs = args.slice(1);
-    if (setupArgs[0] === '-h' || setupArgs[0] === '--help') {
-      console.log(`
-Usage:
-  subc setup [install|status|uninstall]
-  subc setup AGENT [install|status|uninstall] [agent options]
-
-Examples:
-  subc setup                    Configure every coding-agent integration
-  subc setup status             Show every integration's setup status
-  subc setup codex              Configure only Codex
-  subc setup codex status       Show only Codex's setup status
-  subc setup codex --subagents  Configure Codex's legacy subagent mode
-  subc setup codex env          Print persistent Codex exports for sourcing
-`);
+  if (command === 'update-url') {
+    if (isHelpArg(args[1])) {
+      console.log(COMMAND_HELP['update-url']);
       return;
     }
-    const request = parseSetupRequest(setupArgs);
-    const profile = await loadProfile(profileName);
-    const targetHelp = request.targeted && isAgentHelpRequest(request.args);
-    const persistentHelper = ['use', 'env', 'unset'].includes(request.action);
-    const oneOffApiKey = request.targeted && request.args.includes('--api-key');
-    if (!targetHelp && !persistentHelper && !oneOffApiKey) requireNamedProfile(profile);
-    const failures = [];
-    for (const agent of request.agents) {
-      const code = await runAgent(agent, request.args, { profile, setup: true });
-      if (code) failures.push(agent.name);
-    }
-    if (failures.length) {
-      throw new Error(`Setup failed for: ${failures.join(', ')}`);
-    }
-    if (targetHelp || persistentHelper) return;
-    const subject = request.targeted ? request.agents[0].name : 'Coding-agent';
-    const message =
-      request.action === 'status'
-        ? `${subject} status check complete.`
-        : request.action === 'uninstall'
-          ? `${subject} integration${request.targeted ? '' : 's'} removed.`
-          : `${subject} setup complete.`;
-    console.log(`\n  ${c.green}${c.bold}✓ ${message}${c.reset}\n`);
+    await updateUrlCommand(args.slice(1), { profileName });
     return;
   }
 
   const agent = resolveAgent(command);
   if (agent) {
+    const agentArgs = args.slice(1);
     const profile = await loadProfile(profileName);
-    if (!isAgentHelpRequest(args.slice(1))) requireNamedProfile(profile);
-    await runAgent(agent, args.slice(1), { profile });
+    if (!isAgentHelpRequest(agentArgs)) {
+      const action = parseAgentAction(agent, agentArgs);
+      if (action.action !== 'status' && action.action !== 'uninstall') {
+        requireNamedProfile(profile);
+      }
+    }
+    await runAgent(agent, agentArgs, { profile });
     return;
   }