vault-go 0.10.0 → 0.11.0

package/README.md

@@ -8,7 +8,7 @@ Para trocar a conta: `bunx --bun vault-go@latest login --force`. Para chave de A
 
 Servidor MCP em Bun para pesquisar, contextualizar e registrar memória na
 plataforma Vault. A persistência fica no PostgreSQL do serviço Rust executado
-no EasyPanel; este pacote não cria banco local.
+no EasyPanel; o painel local mantém um cache privado das consultas recentes.
 
 ## Pré-requisito
 
@@ -69,7 +69,8 @@ O assistente:
    `vg_live_...`;
 3. detecta os clientes instalados;
 4. permite escolher onde registrar o MCP;
-5. preserva as outras configurações dos clientes.
+5. preserva as outras configurações dos clientes;
+6. instala e abre o painel local na porta 38850 (início automático no macOS).
 
 Clientes suportados:
 
@@ -195,7 +196,7 @@ consultas aplicam esse identificador, impedindo leitura entre contas.
 - Renova o access token usando o refresh token local com permissão privada.
 - Limita tamanhos, listas e janelas nos schemas das ferramentas.
 - Reserva `stdout` exclusivamente para o protocolo MCP.
-- Não persiste memória nem cria banco no dispositivo.
+- O painel guarda cache de projetos/memórias e metadados de chamadas MCP em arquivos privados locais.
 
 Instale o MCP apenas em clientes confiáveis: o cliente conectado pode pedir
 busca, gravação e exclusão de memórias dentro da conta autenticada.
@@ -221,3 +222,40 @@ semântica, publicação no npm, tag e GitHub Release:
 
 O segredo `NPM_TOKEN` existe apenas no GitHub Actions e nunca deve ser salvo no
 repositório ou em logs.
+
+
+## Painel local · localhost:38850
+
+```sh
+bunx --bun vault-go@latest setup --lang pt
+bunx --bun vault-go@latest local install
+bunx --bun vault-go@latest local open
+bunx --bun vault-go@latest local status
+bunx --bun vault-go@latest local stop
+bunx --bun vault-go@latest local uninstall
+```
+
+O assistente e a página de retorno do login suportam `--lang pt|en|es`.
+O painel detecta o idioma do navegador e oferece seletor PT/EN/ES, busca
+local, atividade MCP recente, projetos e memórias consultados na nuvem.
+Atualiza a interface a cada 5 segundos enquanto visível e consulta a nuvem
+a cada 15 segundos. Sem conexão, conserva o último cache da mesma conta.
+
+O serviço escuta exclusivamente em 127.0.0.1:38850. `local open` verifica
+uma prova criptográfica do serviço e abre uma sessão privada no navegador;
+o segredo local é removido do fragmento imediatamente e trocado por cookie
+HttpOnly/SameSite=Strict. Não há CORS nem acesso direto da nuvem ao localhost.
+O portal `/app/local` abre o painel da máquina atual.
+
+No macOS, `local install` registra um LaunchAgent do usuário. Em Linux e
+Windows, inicia o serviço nesta sessão; após reiniciar, use `local start`.
+O runtime fica em `~/.memvault/local-runtime`, independente do cache bunx.
+`local stop` para o processo; `local uninstall` remove o início automático e
+preserva autenticação, cache e atividade. Execute `local install` novamente
+após atualizar o pacote para atualizar o serviço persistente.
+
+A atividade registra método, rota, duração e resultado das chamadas feitas
+pelo MCP Vault, sem argumentos, consultas ou credenciais. Não captura toda a
+atividade da máquina nem importa automaticamente o banco do claude-mem em
+37701. A sincronização deste painel é de leitura da nuvem; as ferramentas
+MCP continuam responsáveis pelas gravações na API.

package/dist/activity.d.ts

@@ -0,0 +1,9 @@
+export interface Activity {
+    id: string;
+    time: string;
+    operation: string;
+    ok: boolean;
+    durationMs: number;
+}
+export declare function recordActivity(home: string, operation: string, ok: boolean, durationMs: number): void;
+export declare function readActivity(home: string): Activity[];

package/dist/activity.js

@@ -0,0 +1,31 @@
+import { appendFileSync, chmodSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+export function recordActivity(home, operation, ok, durationMs) {
+    try {
+        mkdirSync(home, { recursive: true, mode: 0o700 });
+        const file = join(home, 'local-activity.jsonl');
+        // Bounded journal contains metadata only: never arguments, content or credentials.
+        try {
+            if (statSync(file).size > 2 * 1024 * 1024)
+                writeFileSync(file, '', { mode: 0o600 });
+        }
+        catch { }
+        appendFileSync(file, JSON.stringify({ id: randomUUID(), time: new Date().toISOString(), operation: operation.slice(0, 180), ok, durationMs: Math.round(durationMs) }) + '\n', { mode: 0o600 });
+        chmodSync(file, 0o600);
+    }
+    catch { /* Observability must never prevent an MCP operation. */ }
+}
+export function readActivity(home) {
+    try {
+        return readFileSync(join(home, 'local-activity.jsonl'), 'utf8').split('\n').filter(Boolean).slice(-100).flatMap(line => { try {
+            return [JSON.parse(line)];
+        }
+        catch {
+            return [];
+        } }).reverse();
+    }
+    catch {
+        return [];
+    }
+}

package/dist/auth.d.ts

@@ -1,3 +1,4 @@
+import { type Locale } from './locale.js';
 export interface AuthenticationResult {
     email: string;
     method: 'password' | 'browser' | 'api-key' | 'existing';
@@ -8,6 +9,7 @@ export declare function authenticateWithApiKey(apiKey: string, home: string, fet
 export declare function validateExistingAuthentication(home: string, fetcher?: Fetcher): Promise<AuthenticationResult | null>;
 export declare function openVaultBrowser(url: string): Promise<void>;
 export declare function authenticateWithBrowser(home: string, options?: {
+    locale?: Locale;
     fetcher?: Fetcher;
     openBrowser?: (url: string) => Promise<void>;
     timeoutMs?: number;

package/dist/auth.js

@@ -1,3 +1,5 @@
+import { callbackPage } from './callback-page.js';
+import { copy, resolveLocale } from './locale.js';
 import { createServer } from 'node:http';
 import { randomBytes, createHash, timingSafeEqual } from 'node:crypto';
 import { execFile } from 'node:child_process';
@@ -107,6 +109,8 @@ export function openVaultBrowser(url) {
     return new Promise((resolve, reject) => { execFile(command, args, { timeout: 10_000 }, error => error ? reject(error) : resolve()); });
 }
 export async function authenticateWithBrowser(home, options = {}) {
+    const locale = options.locale ?? resolveLocale();
+    const t = copy[locale];
     const fetcher = options.fetcher ?? fetch;
     const report = options.report ?? (message => process.stderr.write(message + '\n'));
     const start = endpoint(home, '/auth/oauth/resolveup/start');
@@ -124,7 +128,7 @@ export async function authenticateWithBrowser(home, options = {}) {
     const server = createServer((req, res) => {
         res.setHeader('Cache-Control', 'no-store');
         res.setHeader('Referrer-Policy', 'no-referrer');
-        res.setHeader('Content-Security-Policy', "default-src 'none'; frame-ancestors 'none'");
+        res.setHeader('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'");
         let url;
         try {
             url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
@@ -147,7 +151,7 @@ export async function authenticateWithBrowser(home, options = {}) {
         if (url.searchParams.has('error')) {
             accepted = true;
             res.writeHead(400).end('Login não concluído. Volte ao terminal.');
-            rejectClaim?.(new Error('Login cancelado ou recusado no Vault.'));
+            rejectClaim?.(new Error(t.denied));
             return;
         }
         if (!code || !/^[A-Za-z0-9_-]{43}$/.test(code) || url.searchParams.getAll('code').length !== 1) {
@@ -156,7 +160,7 @@ export async function authenticateWithBrowser(home, options = {}) {
         }
         accepted = true;
         res.setHeader('Content-Type', 'text/html; charset=utf-8');
-        res.end('<!doctype html><html lang="pt-BR"><title>AI Vault Memory</title><h1>AI Vault Memory</h1><p>Retorno recebido. Volte ao terminal para concluir.</p></html>');
+        res.end(callbackPage(locale));
         claim?.(code);
     });
     let timer;
@@ -169,14 +173,14 @@ export async function authenticateWithBrowser(home, options = {}) {
         start.searchParams.set('mobile_challenge', createHash('sha256').update(verifier).digest('base64url'));
         start.searchParams.set('mobile_state', state);
         start.searchParams.set('cli_port', String(port));
-        timer = setTimeout(() => rejectClaim?.(new Error('Tempo de login esgotado. Execute vault-go login novamente.')), options.timeoutMs ?? 300_000);
-        report('Abrindo o autenticador do AI Vault Memory no navegador…');
-        report(`Se o navegador não abrir, acesse neste computador: ${start.href}`);
+        timer = setTimeout(() => rejectClaim?.(new Error(t.timeout)), options.timeoutMs ?? 300_000);
+        report(t.opening);
+        report(`${t.fallback} ${start.href}`);
         try {
             await (options.openBrowser ?? openVaultBrowser)(start.href);
         }
         catch {
-            report('Não foi possível abrir o navegador automaticamente. Use o endereço acima.');
+            report(t.openFailed);
         }
         const code = await received;
         const response = await fetcher(endpoint(home, '/auth/mobile/exchange'), {
@@ -184,7 +188,7 @@ export async function authenticateWithBrowser(home, options = {}) {
             body: JSON.stringify({ code, verifier }), redirect: 'error', signal: AbortSignal.timeout(15_000),
         });
         if (!response.ok)
-            throw new Error('Não foi possível concluir o login do Vault. Tente novamente.');
+            throw new Error(t.retry);
         const tokens = normalizeTokens(await response.json());
         const account = await accountForToken(tokens.accessToken, home, fetcher);
         if (!account)

package/dist/callback-page.d.ts

@@ -0,0 +1,3 @@
+import { type Locale } from './locale.js';
+/** All interpolated content is from the static locale catalog, never the callback URL. */
+export declare function callbackPage(locale: Locale): string;

package/dist/callback-page.js

@@ -0,0 +1,8 @@
+import { copy } from './locale.js';
+/** All interpolated content is from the static locale catalog, never the callback URL. */
+export function callbackPage(locale) {
+    const t = copy[locale];
+    return `<!doctype html><html lang="${locale}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="color-scheme" content="dark"><title>AI Vault Memory · ${t.received}</title><style>
+*{box-sizing:border-box}body{margin:0;min-height:100svh;display:grid;place-items:center;padding:24px;color:#f1f3fc;background:radial-gradient(ellipse at 20% 10%,#38305a60,transparent 50%),radial-gradient(ellipse at 90% 90%,#20394c40,transparent 55%),#080b12;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif}.panel{width:min(100%,520px);padding:44px;border:1px solid #cdd8ff26;border-radius:32px;background:linear-gradient(135deg,#272c3edb,#131724ed);box-shadow:0 32px 100px #0008,inset 0 1px #ffffff10;animation:arrive .6s cubic-bezier(.2,.8,.2,1) both}.mark{display:block;margin:0 auto 28px;width:92px;height:92px;filter:drop-shadow(0 8px 25px #9990ff40)}.ribbon{stroke-dasharray:180;animation:draw 1.1s ease both}.ribbon:nth-child(2){animation-delay:.12s}.ribbon:nth-child(3){animation-delay:.24s}.brand{text-align:center;color:#b9b6ff;font-size:10px;letter-spacing:.22em;font-weight:650}h1{text-align:center;font-size:34px;letter-spacing:-.045em;line-height:1.1;margin:16px 0}.intro{text-align:center;color:#acb4cb;font-size:15px;line-height:1.7;margin:0 0 30px}.steps{list-style:none;padding:0;margin:0;border-top:1px solid #cdd8ff20}.steps li{display:flex;align-items:center;gap:14px;padding:15px 0;border-bottom:1px solid #cdd8ff15;font-size:13px;animation:arrive .5s both}.steps li:nth-child(2){animation-delay:.15s}.steps li:nth-child(3){animation-delay:.3s}.step{display:grid;place-items:center;flex-shrink:0;width:28px;height:28px;border:1px solid #b9b6ff40;background:#b9b6ff12;border-radius:9px;color:#c8c5ff;font-size:11px}.return{margin:26px 0 0;padding:16px 18px;background:#b9b6ff14;border:1px solid #b9b6ff30;border-radius:16px;color:#d4d1ff;font-size:14px;line-height:1.6}.privacy{margin:22px 0 0;color:#929db6;font-size:11px;line-height:1.7;text-align:center}@keyframes arrive{from{opacity:0;transform:translateY(12px)}to{opacity:1;transform:translateY(0)}}@keyframes draw{from{stroke-dashoffset:180;opacity:0}to{stroke-dashoffset:0;opacity:1}}@media(max-width:480px){.panel{padding:30px 24px}h1{font-size:30px}}@media(prefers-reduced-motion:reduce){*,*::before,*::after{animation:none!important}}@media(forced-colors:active){.panel,.step,.return{border:1px solid CanvasText}svg{stroke:CanvasText}}
+</style></head><body><main class="panel"><svg class="mark" viewBox="0 0 100 100" fill="none" aria-hidden="true"><defs><linearGradient id="glass" x1="10" y1="10" x2="85" y2="90" gradientUnits="userSpaceOnUse"><stop stop-color="#e2edff"/><stop offset=".48" stop-color="#8b88df"/><stop offset="1" stop-color="#c4e6ff"/></linearGradient></defs><g stroke="url(#glass)" stroke-width="6" stroke-linecap="round" stroke-linejoin="round"><path class="ribbon" d="M12 20 50 84 88 20"/><path class="ribbon" d="M25 20 50 63 75 20"/><path class="ribbon" d="M38 20 50 41 62 20"/></g></svg><p class="brand">AI VAULT MEMORY</p><h1>${t.received}</h1><p class="intro">${t.body}</p><ol class="steps"><li><span class="step">01</span>${t.step1}</li><li><span class="step">02</span>${t.step2}</li><li><span class="step">03</span>${t.step3}</li></ol><p class="return">↗ ${t.back}</p><p class="privacy">${t.privacy}</p></main></body></html>`;
+}

package/dist/cli.d.ts

@@ -1,5 +1,12 @@
-export type CliMode = 'help' | 'version' | 'setup' | 'login' | 'serve' | 'invalid';
+import { type McpClient } from './installer.js';
+export type CliMode = 'help' | 'version' | 'setup' | 'login' | 'serve' | 'local' | 'invalid';
 export declare function resolveCliMode(argument: string | undefined, stdinIsTTY: boolean, stderrIsTTY: boolean): CliMode;
+export declare function parseNumberedClients(value: string): McpClient[];
+export declare function cliArguments(args: string[]): {
+    argument: string | undefined;
+    options: string[];
+};
+export declare function runLocal(args: string[]): Promise<number>;
 export declare function runLogin(args: string[]): Promise<number>;
 export declare function runSetup(args: string[]): Promise<number>;
 export declare function helpText(version: string): string;

package/dist/cli.js

@@ -2,6 +2,8 @@ import { authenticateWithApiKey, authenticateWithBrowser, validateExistingAuthen
 import { vaultHome } from './config.js';
 import { detectMcpClients, installMcpClient, MCP_CLIENTS, parseClientSelection, } from './installer.js';
 import { promptSecret, promptText } from './prompt.js';
+import { copy, resolveLocale } from './locale.js';
+import { installLocal, localStatus, localUrl, openLocal, startLocal, stopLocal, uninstallLocal } from './local-install.js';
 export function resolveCliMode(argument, stdinIsTTY, stderrIsTTY) {
     if (argument === '--help' || argument === '-h')
         return 'help';
@@ -13,6 +15,8 @@ export function resolveCliMode(argument, stdinIsTTY, stderrIsTTY) {
         return 'login';
     if (argument === 'serve')
         return 'serve';
+    if (argument === 'local')
+        return 'local';
     if (argument === undefined)
         return stdinIsTTY && stderrIsTTY ? 'setup' : 'serve';
     return 'invalid';
@@ -24,21 +28,22 @@ function optionValue(args, name) {
     const prefix = `${name}=`;
     return args.find((argument) => argument.startsWith(prefix))?.slice(prefix.length);
 }
-async function ensureAuthentication(home, force = false, apiKeyMode = false) {
+async function ensureAuthentication(home, force = false, apiKeyMode = false, locale = 'pt') {
+    const t = copy[locale];
     if (!force) {
         const existing = await validateExistingAuthentication(home);
         if (existing) {
-            process.stderr.write(`✓ Autenticado no Vault como ${existing.email}.\n`);
+            process.stderr.write(`  ✓ ${t.connected}: ${existing.email}\n`);
             return existing;
         }
     }
     if (apiKeyMode) {
-        const result = await authenticateWithApiKey(await promptSecret('Chave de API: '), home);
-        process.stderr.write(`✓ Chave validada para ${result.email}.\n`);
+        const result = await authenticateWithApiKey(await promptSecret(`${t.key}: `), home);
+        process.stderr.write(`  ✓ ${t.connected}: ${result.email}\n`);
         return result;
     }
-    const result = await authenticateWithBrowser(home);
-    process.stderr.write(`✓ Login realizado como ${result.email}.\n`);
+    const result = await authenticateWithBrowser(home, { locale });
+    process.stderr.write(`  ✓ ${t.connected}: ${result.email}\n`);
     return result;
 }
 function defaultClients() {
@@ -47,55 +52,153 @@ function defaultClients() {
         return detected.map((item) => item.client);
     return ['codex', 'claude', 'cursor', 'vscode', 'copilot'];
 }
-async function chooseClients(args) {
+export function parseNumberedClients(value) {
+    return parseClientSelection(value.split(',').map(item => {
+        const trimmed = item.trim();
+        if (!/^\d+$/.test(trimmed))
+            return trimmed;
+        const client = MCP_CLIENTS[Number(trimmed) - 1];
+        if (!client)
+            throw new Error(`Invalid assistant number: ${trimmed}`);
+        return client;
+    }).join(','));
+}
+async function chooseClients(args, locale) {
+    const t = copy[locale];
     const configured = optionValue(args, '--clients');
     if (configured)
-        return parseClientSelection(configured);
+        return parseNumberedClients(configured);
     const detected = detectMcpClients();
-    process.stderr.write('\nClientes MCP disponíveis:\n');
     for (const item of detected) {
-        process.stderr.write(`  - ${item.client}${item.detected ? ` (detectado: ${item.evidence})` : ''}\n`);
+        process.stderr.write(`  ${MCP_CLIENTS.indexOf(item.client) + 1}. ${item.client.padEnd(12)} ${item.detected ? `● ${t.detected}` : `○ ${t.available}`}\n`);
     }
     const defaults = defaultClients();
-    const answer = await promptText(`Clientes separados por vírgula [${defaults.join(',')}]: `);
-    return answer ? parseClientSelection(answer) : defaults;
+    const answer = await promptText(`${t.choose} [${defaults.join(',')}]: `);
+    return answer ? parseNumberedClients(answer) : defaults;
+}
+export function cliArguments(args) {
+    const remaining = [...args];
+    for (let i = 0; i < remaining.length; i++) {
+        if (remaining[i] === '--lang') {
+            if (!remaining[i + 1] || !['pt', 'en', 'es'].includes(remaining[i + 1]))
+                throw new Error('--lang: pt, en, es');
+            remaining.splice(i, 2);
+            i--;
+        }
+        else if (remaining[i]?.startsWith('--lang=')) {
+            if (!['pt', 'en', 'es'].includes(remaining[i].slice(7)))
+                throw new Error('--lang: pt, en, es');
+            remaining.splice(i, 1);
+            i--;
+        }
+    }
+    return { argument: remaining[0], options: args.filter((_, index) => index !== args.indexOf(remaining[0])) };
+}
+async function chooseLocale(args) {
+    const configured = optionValue(args, '--lang');
+    if (configured)
+        return resolveLocale(configured);
+    const detected = resolveLocale();
+    const answer = await promptText(`  1. Português   2. English   3. Español [${detected}]: `);
+    if (!answer)
+        return detected;
+    const selected = { '1': 'pt', '2': 'en', '3': 'es' }[answer] ?? answer.toLowerCase();
+    if (!['pt', 'en', 'es'].includes(selected))
+        throw new Error('--lang: pt, en, es');
+    return resolveLocale(selected);
+}
+const localCopy = {
+    pt: { step: 'Instalar painel local', startup: 'Início automático ativado', manual: 'Início automático indisponível neste sistema. Após reiniciar, execute: vault-go local start', running: 'Painel local disponível', stopped: 'Serviço local parado', removed: 'Início automático removido; dados e credenciais preservados', retry: 'Tente novamente: vault-go local install; vault-go local open' },
+    en: { step: 'Install local dashboard', startup: 'Automatic startup enabled', manual: 'Automatic startup is unavailable on this system. After restarting, run: vault-go local start', running: 'Local dashboard available', stopped: 'Local service stopped', removed: 'Automatic startup removed; data and credentials preserved', retry: 'Retry: vault-go local install; vault-go local open' },
+    es: { step: 'Instalar panel local', startup: 'Inicio automático activado', manual: 'Inicio automático no disponible en este sistema. Después de reiniciar, ejecuta: vault-go local start', running: 'Panel local disponible', stopped: 'Servicio local detenido', removed: 'Inicio automático eliminado; datos y credenciales conservados', retry: 'Reintenta: vault-go local install; vault-go local open' },
+};
+export async function runLocal(args) {
+    const t = localCopy[resolveLocale(optionValue(args, '--lang'))];
+    const command = cliArguments(args).argument ?? 'open';
+    if (command === 'status') {
+        const status = await localStatus();
+        process.stdout.write(status ? `${t.running}: ${localUrl} (v${status.version})\n` : `${t.stopped}\n`);
+        return status ? 0 : 1;
+    }
+    if (command === 'stop') {
+        await stopLocal();
+        process.stderr.write(`${t.stopped}\n`);
+        return 0;
+    }
+    if (command === 'uninstall') {
+        await uninstallLocal();
+        process.stderr.write(`${t.removed}\n`);
+        return 0;
+    }
+    if (command === 'serve') {
+        const { startLocalService } = await import('./local-service.js');
+        await startLocalService({ home: vaultHome() });
+        process.stderr.write(`${t.running}: ${localUrl}\n`);
+        return 0;
+    }
+    if (command === 'install') {
+        const result = await installLocal();
+        process.stderr.write(`${result.startup ? t.startup : t.manual}\n`);
+    }
+    else if (command === 'start')
+        await startLocal();
+    else if (command === 'open')
+        await openLocal();
+    else
+        throw new Error('vault-go local [install|start|open|status|stop|uninstall|serve]');
+    process.stderr.write(`${t.running}: ${localUrl}\n`);
+    return 0;
 }
 export async function runLogin(args) {
+    const locale = resolveLocale(optionValue(args, '--lang'));
     if (!process.stdin.isTTY || !process.stderr.isTTY) {
-        throw new Error('O login requer um terminal interativo.');
+        throw new Error(copy[locale].interactive);
     }
-    await ensureAuthentication(vaultHome(), args.includes('--force'), args.includes('--api-key'));
+    await ensureAuthentication(vaultHome(), args.includes('--force'), args.includes('--api-key'), locale);
     return 0;
 }
 export async function runSetup(args) {
     if (!process.stdin.isTTY || !process.stderr.isTTY) {
         throw new Error('O setup requer um terminal interativo.');
     }
-    process.stderr.write('vault-go — configuração MCP universal\n');
-    await ensureAuthentication(vaultHome(), args.includes('--reauth'), args.includes('--api-key'));
-    const clients = await chooseClients(args);
+    process.stderr.write('\n  ◆ VAULT GO\n  ────────────────────────────────────────\n');
+    const locale = await chooseLocale(args);
+    const t = copy[locale];
+    const local = localCopy[locale];
+    process.env['VAULT_GO_LANG'] = locale;
+    process.stderr.write(`  ${t.subtitle}\n\n  [1/4] ${t.auth}\n`);
+    await ensureAuthentication(vaultHome(), args.includes('--reauth'), args.includes('--api-key'), locale);
+    process.stderr.write(`\n  [2/4] ${t.clients}\n`);
+    const clients = await chooseClients(args, locale);
     if (clients.length === 0)
-        throw new Error('Nenhum cliente MCP selecionado.');
-    process.stderr.write('\nInstalação MCP\n');
+        throw new Error(t.none);
+    process.stderr.write(`\n  [3/4] ${t.install}\n`);
     let failures = 0;
     for (const client of clients) {
         try {
             const result = installMcpClient(client);
             const marker = result.status === 'already-installed' ? '=' : '✓';
-            process.stderr.write(`${marker} ${client}: ${result.destination}\n`);
+            process.stderr.write(`  ${marker} ${client}: ${result.status === 'already-installed' ? t.already : t.installed}\n    ${result.destination}\n`);
         }
         catch (error) {
             failures += 1;
             const message = error instanceof Error ? error.message : String(error);
-            process.stderr.write(`✗ ${client}: ${message}\n`);
+            process.stderr.write(`  ✗ ${t.failed} ${client}: ${message}\n`);
         }
     }
-    if (failures > 0) {
-        process.stderr.write(`\n${failures} cliente(s) não puderam ser configurados.\n`);
-        return 1;
+    process.stderr.write(`\n  [4/4] ${local.step}\n`);
+    try {
+        const result = await installLocal();
+        process.stderr.write(`  ✓ ${result.startup ? local.startup : local.manual}\n`);
+        await openLocal();
+        process.stderr.write(`  ✓ ${local.running}: ${localUrl}\n`);
     }
-    process.stderr.write('\nSetup concluído. Reinicie os clientes abertos para carregar o Vault.\n');
-    return 0;
+    catch (error) {
+        failures++;
+        process.stderr.write(`  ✗ ${error instanceof Error ? error.message : String(error)}\n  ${local.retry}\n`);
+    }
+    process.stderr.write(`\n  ${failures ? `${t.failed}: ${failures}` : `✓ ${t.done}`}\n  ${t.restart}\n\n`);
+    return failures ? 1 : 0;
 }
 export function helpText(version) {
     return `vault-go ${version}
@@ -115,6 +218,12 @@ Uso:
   bunx --bun vault-go@latest serve
       Inicia o servidor MCP por stdio.
 
+  vault-go local [install|start|open|status|stop|uninstall|serve]
+      Painel local em http://localhost:38850; install ativa início automático no macOS.
+
+  --lang pt|en|es
+      Idioma do assistente (padrão: idioma do sistema).
+
 Clientes:
   ${MCP_CLIENTS.join(', ')}
 

package/dist/cloud.d.ts

@@ -32,7 +32,8 @@ export interface VaultMemoryApi {
 export declare class VaultCloudClient implements VaultMemoryApi {
     private readonly home;
     private readonly cloudFetch;
-    constructor(home?: string, cloudFetch?: typeof fetch);
+    private readonly journal;
+    constructor(home?: string, cloudFetch?: typeof fetch, journal?: boolean);
     health(): Promise<unknown>;
     projects(): Promise<unknown>;
     createProject(input: Record<string, unknown>): Promise<unknown>;
@@ -65,4 +66,5 @@ export declare class VaultCloudClient implements VaultMemoryApi {
     private endpoint;
     private accessToken;
     private request;
+    private performRequest;
 }

package/dist/cloud.js

@@ -1,10 +1,13 @@
+import { recordActivity } from './activity.js';
 import { loadConfig, loadTokens, saveTokens, validateApiUrl, vaultHome, } from './config.js';
 export class VaultCloudClient {
     home;
     cloudFetch;
-    constructor(home = vaultHome(), cloudFetch = globalThis.fetch) {
+    journal;
+    constructor(home = vaultHome(), cloudFetch = globalThis.fetch, journal = true) {
         this.home = home;
         this.cloudFetch = cloudFetch;
+        this.journal = journal;
     }
     async health() {
         return this.request('/health', { authenticated: false });
@@ -134,6 +137,7 @@ export class VaultCloudClient {
         }
         const response = await this.cloudFetch(this.endpoint('/auth/refresh'), {
             method: 'POST',
+            redirect: 'error',
             headers: { 'content-type': 'application/json' },
             body: JSON.stringify({ refreshToken: tokens.refreshToken }),
             signal: AbortSignal.timeout(10_000),
@@ -150,6 +154,19 @@ export class VaultCloudClient {
         return stored.accessToken;
     }
     async request(path, options = {}) {
+        const start = Date.now();
+        let ok = false;
+        try {
+            const result = await this.performRequest(path, options);
+            ok = true;
+            return result;
+        }
+        finally {
+            if (this.journal)
+                recordActivity(this.home, (options.method ?? 'GET') + ' ' + path.split('?')[0], ok, Date.now() - start);
+        }
+    }
+    async performRequest(path, options = {}) {
         const headers = new Headers({ accept: 'application/json' });
         if (options.body)
             headers.set('content-type', 'application/json');
@@ -158,6 +175,7 @@ export class VaultCloudClient {
         }
         const request = {
             method: options.method ?? 'GET',
+            redirect: 'error',
             headers,
             signal: AbortSignal.timeout(15_000),
         };
@@ -171,7 +189,7 @@ export class VaultCloudClient {
         }
         const response = await this.cloudFetch(endpoint, request);
         if (response.status === 401 && options.authenticated !== false && !options.retried) {
-            return this.request(path, { ...options, retried: true });
+            return this.performRequest(path, { ...options, retried: true });
         }
         const text = await response.text();
         const payload = text ? safeJson(text) : null;

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { helpText, resolveCliMode, runLogin, runSetup } from './cli.js';
+import { cliArguments, helpText, resolveCliMode, runLocal, runLogin, runSetup } from './cli.js';
 import { createVaultGoServer, VERSION } from './server.js';
-const argument = process.argv[2];
+const { argument, options } = cliArguments(process.argv.slice(2));
 const mode = resolveCliMode(argument, process.stdin.isTTY === true, process.stderr.isTTY === true);
 async function main() {
     if (mode === 'version') {
@@ -17,11 +17,15 @@ async function main() {
         throw new Error(`Comando desconhecido: ${argument}\n\n${helpText(VERSION)}`);
     }
     if (mode === 'setup') {
-        process.exitCode = await runSetup(process.argv.slice(3));
+        process.exitCode = await runSetup(options);
         return;
     }
     if (mode === 'login') {
-        process.exitCode = await runLogin(process.argv.slice(3));
+        process.exitCode = await runLogin(options);
+        return;
+    }
+    if (mode === 'local') {
+        process.exitCode = await runLocal(options);
         return;
     }
     const server = createVaultGoServer();

package/dist/local-dashboard.d.ts

@@ -0,0 +1,3 @@
+/** Local monitor: no secrets or cloud content are interpolated into this document. */
+export declare function dashboardHtml(): string;
+export declare function dashboardScript(): string;