vault-go 0.8.1 → 0.10.0

package/README.md

@@ -1,3 +1,9 @@
+## Login no navegador
+
+`bunx --bun vault-go@latest` abre o autenticador do AI Vault Memory no navegador. E-mail, senha e MFA são informados apenas no portal. Ao concluir, o terminal recebe um código de uso único por `127.0.0.1` e o troca com PKCE; tokens não aparecem na URL nem no console. O listener fecha ao concluir ou após cinco minutos.
+
+Para trocar a conta: `bunx --bun vault-go@latest login --force`. Para chave de API explícita: `bunx --bun vault-go@latest login --force --api-key`. Se a abertura automática falhar, use o endereço exibido no mesmo computador. Requer uma sessão local com navegador para o retorno loopback.
+
 # vault-go
 
 Servidor MCP em Bun para pesquisar, contextualizar e registrar memória na
@@ -50,23 +56,43 @@ bases, escrita, importação ou exclusão, use o cliente Bun completo abaixo.
 
 ### Opção Bun completa
 
-Para instalar e registrar no Codex, execute em um terminal:
+Execute em um terminal:
 
 ```sh
 bunx --bun vault-go@latest
 ```
 
-Quando executado diretamente em um terminal, o pacote detecta o modo
-interativo e chama `codex mcp add` com os argumentos corretos. O mesmo fluxo
-pode ser solicitado explicitamente:
+O assistente:
+
+1. valida uma sessão existente em `~/.memvault`;
+2. se necessário, abre o login do AI Vault Memory no navegador (chave de API somente com `--api-key`)
+   `vg_live_...`;
+3. detecta os clientes instalados;
+4. permite escolher onde registrar o MCP;
+5. preserva as outras configurações dos clientes.
+
+Clientes suportados:
+
+- Codex e ChatGPT Desktop local;
+- Claude Code e Claude Desktop;
+- Cursor e Windsurf;
+- VS Code com GitHub Copilot;
+- GitHub Copilot CLI;
+- Roo Code;
+- OpenCode.
+
+Comandos explícitos:
 
 ```sh
-bunx --bun vault-go@latest install
+bunx --bun vault-go@latest setup
+bunx --bun vault-go@latest setup --clients codex,claude,copilot
+bunx --bun vault-go@latest login --force
+bunx --bun vault-go@latest serve
 ```
 
-O `bunx` sozinho baixa o pacote para o cache; o instalador da biblioteca é que
-registra o servidor na configuração do Codex. Reinicie o Codex depois da
-primeira instalação.
+As credenciais são gravadas em `~/.memvault/auth.json` com permissão `0600`;
+o diretório usa `0700`. Senhas e códigos MFA não são persistidos. Reinicie os
+clientes que estavam abertos depois da primeira instalação.
 
 Configuração MCP genérica:
 
@@ -75,22 +101,22 @@ Configuração MCP genérica:
   "mcpServers": {
     "vault-go": {
       "command": "bunx",
-      "args": ["--bun", "vault-go@latest"]
+      "args": ["--bun", "vault-go@latest", "serve"]
     }
   }
 }
 ```
 
-Por padrão, o MCP reutiliza `~/.memvault/config.json` e
-`~/.memvault/auth.json`, criados pelo comando `memvault login`. Também é
-possível apontar outro diretório:
+Por padrão, todos os clientes reutilizam `~/.memvault/config.json` e
+`~/.memvault/auth.json`, criados pelo assistente. Também é possível apontar
+outro diretório:
 
 ```json
 {
   "mcpServers": {
     "vault-go": {
       "command": "bunx",
-      "args": ["--bun", "vault-go@latest"],
+      "args": ["--bun", "vault-go@latest", "serve"],
       "env": {
         "VAULT_GO_HOME": "/caminho/privado/.memvault"
       }

package/dist/auth.d.ts

@@ -0,0 +1,16 @@
+export interface AuthenticationResult {
+    email: string;
+    method: 'password' | 'browser' | 'api-key' | 'existing';
+}
+type Fetcher = typeof fetch;
+export declare function authenticateWithPassword(email: string, password: string, requestMfa: () => Promise<string>, home: string, fetcher?: Fetcher): Promise<AuthenticationResult>;
+export declare function authenticateWithApiKey(apiKey: string, home: string, fetcher?: Fetcher): Promise<AuthenticationResult>;
+export declare function validateExistingAuthentication(home: string, fetcher?: Fetcher): Promise<AuthenticationResult | null>;
+export declare function openVaultBrowser(url: string): Promise<void>;
+export declare function authenticateWithBrowser(home: string, options?: {
+    fetcher?: Fetcher;
+    openBrowser?: (url: string) => Promise<void>;
+    timeoutMs?: number;
+    report?: (message: string) => void;
+}): Promise<AuthenticationResult>;
+export {};

package/dist/auth.js

@@ -0,0 +1,201 @@
+import { createServer } from 'node:http';
+import { randomBytes, createHash, timingSafeEqual } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { loadConfig, loadTokens, saveConfig, saveTokens, } from './config.js';
+function endpoint(home, path) {
+    const apiUrl = new URL(loadConfig(home).apiUrl);
+    return new URL(`${apiUrl.pathname.replace(/\/$/u, '')}${path}`, apiUrl.origin);
+}
+async function errorMessage(response) {
+    const body = (await response.json().catch(() => ({})));
+    return body.error || body.code || `HTTP ${response.status}`;
+}
+async function accountForToken(token, home, fetcher) {
+    const response = await fetcher(endpoint(home, '/me'), {
+        headers: { authorization: `Bearer ${token}` },
+        redirect: 'error',
+        signal: AbortSignal.timeout(10_000),
+    });
+    if (response.status === 401 || response.status === 403)
+        return null;
+    if (!response.ok)
+        throw new Error(`Falha ao validar a conta Vault: ${await errorMessage(response)}`);
+    const account = (await response.json());
+    if (!account.email)
+        throw new Error('A API Vault retornou uma conta sem e-mail.');
+    return account;
+}
+function persist(tokens, email, home) {
+    saveTokens(tokens, home);
+    saveConfig({ ...loadConfig(home), email }, home);
+}
+function normalizeTokens(value) {
+    if (!value || typeof value !== 'object') {
+        throw new Error('A API Vault retornou credenciais inválidas.');
+    }
+    const tokens = value;
+    if (typeof tokens.accessToken !== 'string' || tokens.accessToken.length === 0) {
+        throw new Error('A API Vault retornou credenciais sem access token.');
+    }
+    const normalized = { accessToken: tokens.accessToken };
+    if (typeof tokens.refreshToken === 'string')
+        normalized.refreshToken = tokens.refreshToken;
+    if (typeof tokens.expiresIn === 'number')
+        normalized.expiresIn = tokens.expiresIn;
+    normalized.expiresAt = Date.now() + (normalized.expiresIn ?? 900) * 1000;
+    return normalized;
+}
+export async function authenticateWithPassword(email, password, requestMfa, home, fetcher = fetch) {
+    const login = await fetcher(endpoint(home, '/auth/login'), {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ email, password }),
+        signal: AbortSignal.timeout(15_000),
+    });
+    if (!login.ok)
+        throw new Error(`Falha no login: ${await errorMessage(login)}`);
+    let body = (await login.json());
+    if ('twoFactorRequired' in body) {
+        const code = await requestMfa();
+        const verification = await fetcher(endpoint(home, '/auth/2fa/verify'), {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ ticket: body.ticket, code }),
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (!verification.ok) {
+            throw new Error(`Falha na verificação MFA: ${await errorMessage(verification)}`);
+        }
+        body = (await verification.json());
+    }
+    const tokens = normalizeTokens(body);
+    persist(tokens, email, home);
+    return { email, method: 'password' };
+}
+export async function authenticateWithApiKey(apiKey, home, fetcher = fetch) {
+    const account = await accountForToken(apiKey, home, fetcher);
+    if (!account)
+        throw new Error('Chave de API Vault inválida ou sem permissão de leitura.');
+    persist({ accessToken: apiKey }, account.email, home);
+    return { email: account.email, method: 'api-key' };
+}
+export async function validateExistingAuthentication(home, fetcher = fetch) {
+    let tokens = loadTokens(home);
+    if (!tokens)
+        return null;
+    let account = await accountForToken(tokens.accessToken, home, fetcher);
+    if (!account && tokens.refreshToken) {
+        const refreshed = await fetcher(endpoint(home, '/auth/refresh'), {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ refreshToken: tokens.refreshToken }),
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (refreshed.ok) {
+            tokens = normalizeTokens(await refreshed.json());
+            account = await accountForToken(tokens.accessToken, home, fetcher);
+        }
+    }
+    if (!account)
+        return null;
+    persist(tokens, account.email, home);
+    return { email: account.email, method: 'existing' };
+}
+export function openVaultBrowser(url) {
+    const command = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'rundll32' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+    return new Promise((resolve, reject) => { execFile(command, args, { timeout: 10_000 }, error => error ? reject(error) : resolve()); });
+}
+export async function authenticateWithBrowser(home, options = {}) {
+    const fetcher = options.fetcher ?? fetch;
+    const report = options.report ?? (message => process.stderr.write(message + '\n'));
+    const start = endpoint(home, '/auth/oauth/resolveup/start');
+    if (start.protocol !== 'https:' && !(start.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(start.hostname)))
+        throw new Error('A autenticação Vault requer HTTPS.');
+    const verifier = randomBytes(32).toString('base64url');
+    const state = randomBytes(32).toString('base64url');
+    let port = 0;
+    let claim;
+    let rejectClaim;
+    let accepted = false;
+    const received = new Promise((resolve, reject) => { claim = resolve; rejectClaim = reject; });
+    // A timeout can occur while the browser opener is still running.
+    void received.catch(() => { });
+    const server = createServer((req, res) => {
+        res.setHeader('Cache-Control', 'no-store');
+        res.setHeader('Referrer-Policy', 'no-referrer');
+        res.setHeader('Content-Security-Policy', "default-src 'none'; frame-ancestors 'none'");
+        let url;
+        try {
+            url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
+        }
+        catch {
+            res.writeHead(400).end();
+            return;
+        }
+        if (req.method !== 'GET' || req.headers.host !== `127.0.0.1:${port}` || url.pathname !== '/callback') {
+            res.writeHead(404).end();
+            return;
+        }
+        const incoming = url.searchParams.get('state') ?? '';
+        const validState = /^[A-Za-z0-9_-]{43}$/.test(incoming) && timingSafeEqual(Buffer.from(incoming), Buffer.from(state));
+        const code = url.searchParams.get('code');
+        if (!validState || url.searchParams.getAll('state').length !== 1 || accepted) {
+            res.writeHead(400).end('Retorno de autenticação inválido.');
+            return;
+        }
+        if (url.searchParams.has('error')) {
+            accepted = true;
+            res.writeHead(400).end('Login não concluído. Volte ao terminal.');
+            rejectClaim?.(new Error('Login cancelado ou recusado no Vault.'));
+            return;
+        }
+        if (!code || !/^[A-Za-z0-9_-]{43}$/.test(code) || url.searchParams.getAll('code').length !== 1) {
+            res.writeHead(400).end('Código inválido.');
+            return;
+        }
+        accepted = true;
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        res.end('<!doctype html><html lang="pt-BR"><title>AI Vault Memory</title><h1>AI Vault Memory</h1><p>Retorno recebido. Volte ao terminal para concluir.</p></html>');
+        claim?.(code);
+    });
+    let timer;
+    try {
+        await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
+        const address = server.address();
+        if (!address || typeof address === 'string')
+            throw new Error('Não foi possível iniciar o retorno local.');
+        port = address.port;
+        start.searchParams.set('mobile_challenge', createHash('sha256').update(verifier).digest('base64url'));
+        start.searchParams.set('mobile_state', state);
+        start.searchParams.set('cli_port', String(port));
+        timer = setTimeout(() => rejectClaim?.(new Error('Tempo de login esgotado. Execute vault-go login novamente.')), options.timeoutMs ?? 300_000);
+        report('Abrindo o autenticador do AI Vault Memory no navegador…');
+        report(`Se o navegador não abrir, acesse neste computador: ${start.href}`);
+        try {
+            await (options.openBrowser ?? openVaultBrowser)(start.href);
+        }
+        catch {
+            report('Não foi possível abrir o navegador automaticamente. Use o endereço acima.');
+        }
+        const code = await received;
+        const response = await fetcher(endpoint(home, '/auth/mobile/exchange'), {
+            method: 'POST', headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ code, verifier }), redirect: 'error', signal: AbortSignal.timeout(15_000),
+        });
+        if (!response.ok)
+            throw new Error('Não foi possível concluir o login do Vault. Tente novamente.');
+        const tokens = normalizeTokens(await response.json());
+        const account = await accountForToken(tokens.accessToken, home, fetcher);
+        if (!account)
+            throw new Error('O Vault não confirmou a conta autenticada.');
+        persist(tokens, account.email, home);
+        return { email: account.email, method: 'browser' };
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        server.closeAllConnections();
+        await new Promise(resolve => server.close(() => resolve()));
+    }
+}

package/dist/cli.d.ts

@@ -1,4 +1,5 @@
-export declare const CODEX_MCP_NAME = "vault-go";
-export declare const CODEX_MCP_COMMAND: readonly ["bunx", "--bun", "vault-go@latest"];
-export declare function shouldInstallFromCli(argument: string | undefined, stdinIsTTY: boolean, stderrIsTTY: boolean): boolean;
-export declare function installCodexMcp(): number;
+export type CliMode = 'help' | 'version' | 'setup' | 'login' | 'serve' | 'invalid';
+export declare function resolveCliMode(argument: string | undefined, stdinIsTTY: boolean, stderrIsTTY: boolean): CliMode;
+export declare function runLogin(args: string[]): Promise<number>;
+export declare function runSetup(args: string[]): Promise<number>;
+export declare function helpText(version: string): string;

package/dist/cli.js

@@ -1,34 +1,126 @@
-import { spawnSync } from 'node:child_process';
-export const CODEX_MCP_NAME = 'vault-go';
-export const CODEX_MCP_COMMAND = ['bunx', '--bun', 'vault-go@latest'];
-export function shouldInstallFromCli(argument, stdinIsTTY, stderrIsTTY) {
-    if (argument === 'install' || argument === 'setup' || argument === '--install') {
-        return true;
+import { authenticateWithApiKey, authenticateWithBrowser, validateExistingAuthentication, } from './auth.js';
+import { vaultHome } from './config.js';
+import { detectMcpClients, installMcpClient, MCP_CLIENTS, parseClientSelection, } from './installer.js';
+import { promptSecret, promptText } from './prompt.js';
+export function resolveCliMode(argument, stdinIsTTY, stderrIsTTY) {
+    if (argument === '--help' || argument === '-h')
+        return 'help';
+    if (argument === '--version' || argument === '-v')
+        return 'version';
+    if (argument === 'setup' || argument === 'install' || argument === '--install')
+        return 'setup';
+    if (argument === 'login' || argument === 'auth')
+        return 'login';
+    if (argument === 'serve')
+        return 'serve';
+    if (argument === undefined)
+        return stdinIsTTY && stderrIsTTY ? 'setup' : 'serve';
+    return 'invalid';
+}
+function optionValue(args, name) {
+    const exact = args.indexOf(name);
+    if (exact >= 0)
+        return args[exact + 1];
+    const prefix = `${name}=`;
+    return args.find((argument) => argument.startsWith(prefix))?.slice(prefix.length);
+}
+async function ensureAuthentication(home, force = false, apiKeyMode = false) {
+    if (!force) {
+        const existing = await validateExistingAuthentication(home);
+        if (existing) {
+            process.stderr.write(`✓ Autenticado no Vault como ${existing.email}.\n`);
+            return existing;
+        }
     }
-    return argument === undefined && stdinIsTTY && stderrIsTTY;
-}
-export function installCodexMcp() {
-    const existing = spawnSync('codex', ['mcp', 'get', CODEX_MCP_NAME], {
-        encoding: 'utf8',
-    });
-    if (existing.error && 'code' in existing.error && existing.error.code === 'ENOENT') {
-        process.stderr.write('vault-go: o comando "codex" não foi encontrado. Instale o Codex CLI e tente novamente.\n');
-        return 1;
+    if (apiKeyMode) {
+        const result = await authenticateWithApiKey(await promptSecret('Chave de API: '), home);
+        process.stderr.write(`✓ Chave validada para ${result.email}.\n`);
+        return result;
     }
-    if (existing.status === 0) {
-        process.stderr.write(`vault-go: o MCP "${CODEX_MCP_NAME}" já está registrado no Codex.\n`);
-        return 0;
+    const result = await authenticateWithBrowser(home);
+    process.stderr.write(`✓ Login realizado como ${result.email}.\n`);
+    return result;
+}
+function defaultClients() {
+    const detected = detectMcpClients().filter((item) => item.detected);
+    if (detected.length > 0)
+        return detected.map((item) => item.client);
+    return ['codex', 'claude', 'cursor', 'vscode', 'copilot'];
+}
+async function chooseClients(args) {
+    const configured = optionValue(args, '--clients');
+    if (configured)
+        return parseClientSelection(configured);
+    const detected = detectMcpClients();
+    process.stderr.write('\nClientes MCP disponíveis:\n');
+    for (const item of detected) {
+        process.stderr.write(`  - ${item.client}${item.detected ? ` (detectado: ${item.evidence})` : ''}\n`);
     }
-    process.stderr.write('vault-go: registrando o MCP no Codex...\n');
-    const installed = spawnSync('codex', ['mcp', 'add', CODEX_MCP_NAME, '--', ...CODEX_MCP_COMMAND], { stdio: 'inherit' });
-    if (installed.error) {
-        process.stderr.write(`vault-go: não foi possível executar o instalador: ${installed.error.message}\n`);
-        return 1;
+    const defaults = defaultClients();
+    const answer = await promptText(`Clientes separados por vírgula [${defaults.join(',')}]: `);
+    return answer ? parseClientSelection(answer) : defaults;
+}
+export async function runLogin(args) {
+    if (!process.stdin.isTTY || !process.stderr.isTTY) {
+        throw new Error('O login requer um terminal interativo.');
     }
-    if (installed.status !== 0) {
-        process.stderr.write('vault-go: o Codex não conseguiu registrar o MCP.\n');
-        return installed.status ?? 1;
+    await ensureAuthentication(vaultHome(), args.includes('--force'), args.includes('--api-key'));
+    return 0;
+}
+export async function runSetup(args) {
+    if (!process.stdin.isTTY || !process.stderr.isTTY) {
+        throw new Error('O setup requer um terminal interativo.');
+    }
+    process.stderr.write('vault-go — configuração MCP universal\n');
+    await ensureAuthentication(vaultHome(), args.includes('--reauth'), args.includes('--api-key'));
+    const clients = await chooseClients(args);
+    if (clients.length === 0)
+        throw new Error('Nenhum cliente MCP selecionado.');
+    process.stderr.write('\nInstalação MCP\n');
+    let failures = 0;
+    for (const client of clients) {
+        try {
+            const result = installMcpClient(client);
+            const marker = result.status === 'already-installed' ? '=' : '✓';
+            process.stderr.write(`${marker} ${client}: ${result.destination}\n`);
+        }
+        catch (error) {
+            failures += 1;
+            const message = error instanceof Error ? error.message : String(error);
+            process.stderr.write(`✗ ${client}: ${message}\n`);
+        }
     }
-    process.stderr.write('vault-go: MCP instalado. Reinicie o Codex para carregá-lo.\n');
+    if (failures > 0) {
+        process.stderr.write(`\n${failures} cliente(s) não puderam ser configurados.\n`);
+        return 1;
+    }
+    process.stderr.write('\nSetup concluído. Reinicie os clientes abertos para carregar o Vault.\n');
     return 0;
 }
+export function helpText(version) {
+    return `vault-go ${version}
+
+Servidor MCP universal para a plataforma Vault.
+
+Uso:
+  bunx --bun vault-go@latest
+      Abre o login Vault no navegador e instala nos clientes detectados.
+
+  bunx --bun vault-go@latest setup [--clients lista] [--reauth]
+      Executa o assistente de autenticação e instalação.
+
+  bunx --bun vault-go@latest login [--force] [--api-key]
+      Autentica sem alterar clientes MCP.
+
+  bunx --bun vault-go@latest serve
+      Inicia o servidor MCP por stdio.
+
+Clientes:
+  ${MCP_CLIENTS.join(', ')}
+
+Variáveis:
+  VAULT_GO_HOME         Diretório de configuração (padrão: ~/.memvault)
+  MEMVAULT_CONFIG_DIR   Diretório compartilhado com o agente MemVault
+  VAULT_GO_API_URL      Endpoint alternativo da API Vault
+`;
+}

package/dist/cloud.js

@@ -123,14 +123,15 @@ export class VaultCloudClient {
             return environmentToken;
         const tokens = loadTokens(this.home);
         if (!tokens) {
-            throw new Error('Vault não autenticado. Execute `memvault login` antes de iniciar o MCP.');
+            throw new Error('Vault não autenticado. Execute `bunx --bun vault-go@latest login`.');
         }
         const valid = !forceRefresh &&
             (!tokens.expiresAt || Date.now() < tokens.expiresAt - 60_000);
         if (valid)
             return tokens.accessToken;
-        if (!tokens.refreshToken)
-            throw new Error('Sessão expirada. Execute `memvault login` novamente.');
+        if (!tokens.refreshToken) {
+            throw new Error('Sessão expirada. Execute `bunx --bun vault-go@latest login --force`.');
+        }
         const response = await this.cloudFetch(this.endpoint('/auth/refresh'), {
             method: 'POST',
             headers: { 'content-type': 'application/json' },
@@ -138,7 +139,7 @@ export class VaultCloudClient {
             signal: AbortSignal.timeout(10_000),
         });
         if (!response.ok) {
-            throw new Error('Sessão expirada. Execute `memvault login` novamente.');
+            throw new Error('Sessão expirada. Execute `bunx --bun vault-go@latest login --force`.');
         }
         const refreshed = (await response.json());
         const stored = {

package/dist/config.d.ts

@@ -23,6 +23,7 @@ export declare function configPath(home?: string): string;
 export declare function authPath(home?: string): string;
 export declare function loadConfig(home?: string): VaultConfig;
 export declare function loadTokens(home?: string): StoredTokens | null;
+export declare function saveConfig(config: VaultConfig, home?: string): void;
 export declare function saveTokens(tokens: StoredTokens, home?: string): void;
 export declare function getStatus(home?: string): VaultStatus;
 export declare function validateApiUrl(value: string): URL;

package/dist/config.js

@@ -1,6 +1,6 @@
-import { chmodSync, existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
+import { basename, dirname, join, resolve } from 'node:path';
 export const DEFAULT_API_URL = 'https://vault.resolveup.com.br/api';
 const DEFAULT_CONFIG = {
     apiUrl: DEFAULT_API_URL,
@@ -51,12 +51,22 @@ export function loadTokens(home = vaultHome()) {
         return null;
     }
 }
+function ensureVaultHome(home) {
+    mkdirSync(home, { recursive: true, mode: 0o700 });
+    chmodSync(home, 0o700);
+}
+function atomicWrite(path, value, home) {
+    ensureVaultHome(home);
+    const temporary = join(dirname(path), `.${basename(path)}.${process.pid}.${Date.now()}.tmp`);
+    writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    renameSync(temporary, path);
+    chmodSync(path, 0o600);
+}
+export function saveConfig(config, home = vaultHome()) {
+    atomicWrite(configPath(home), config, home);
+}
 export function saveTokens(tokens, home = vaultHome()) {
-    const destination = authPath(home);
-    const temporary = join(dirname(destination), `.auth.${process.pid}.tmp`);
-    writeFileSync(temporary, `${JSON.stringify(tokens, null, 2)}\n`, { mode: 0o600 });
-    renameSync(temporary, destination);
-    chmodSync(destination, 0o600);
+    atomicWrite(authPath(home), tokens, home);
 }
 export function getStatus(home = vaultHome()) {
     const config = loadConfig(home);

package/dist/index.js

@@ -1,28 +1,35 @@
 #!/usr/bin/env bun
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { installCodexMcp, shouldInstallFromCli } from './cli.js';
+import { helpText, resolveCliMode, runLogin, runSetup } from './cli.js';
 import { createVaultGoServer, VERSION } from './server.js';
 const argument = process.argv[2];
-if (argument === '--version' || argument === '-v') {
-    process.stdout.write(`${VERSION}\n`);
-    process.exit(0);
-}
-if (argument === '--help' || argument === '-h') {
-    process.stdout.write(`vault-go ${VERSION}\n\nServidor MCP cloud por stdio, executado com Bun.\n\nUso:\n  bunx --bun vault-go@latest           Instala no Codex quando executado em um terminal\n  bunx --bun vault-go@latest install   Instala no Codex explicitamente\n  bunx --bun vault-go@latest serve     Inicia o servidor MCP por stdio\n\nVariáveis:\n  VAULT_GO_HOME         Diretório de configuração (padrão: ~/.memvault)\n  MEMVAULT_CONFIG_DIR   Mesmo diretório usado pelo agente\n`);
-    process.exit(0);
-}
+const mode = resolveCliMode(argument, process.stdin.isTTY === true, process.stderr.isTTY === true);
 async function main() {
+    if (mode === 'version') {
+        process.stdout.write(`${VERSION}\n`);
+        return;
+    }
+    if (mode === 'help') {
+        process.stdout.write(helpText(VERSION));
+        return;
+    }
+    if (mode === 'invalid') {
+        throw new Error(`Comando desconhecido: ${argument}\n\n${helpText(VERSION)}`);
+    }
+    if (mode === 'setup') {
+        process.exitCode = await runSetup(process.argv.slice(3));
+        return;
+    }
+    if (mode === 'login') {
+        process.exitCode = await runLogin(process.argv.slice(3));
+        return;
+    }
     const server = createVaultGoServer();
     const transport = new StdioServerTransport();
     await server.connect(transport);
 }
-if (shouldInstallFromCli(argument, process.stdin.isTTY === true, process.stderr.isTTY === true)) {
-    process.exitCode = installCodexMcp();
-}
-else {
-    main().catch((error) => {
-        const message = error instanceof Error ? error.stack ?? error.message : String(error);
-        process.stderr.write(`vault-go falhou: ${message}\n`);
-        process.exitCode = 1;
-    });
-}
+main().catch((error) => {
+    const message = error instanceof Error ? error.stack ?? error.message : String(error);
+    process.stderr.write(`vault-go falhou: ${message}\n`);
+    process.exitCode = 1;
+});

package/dist/installer.d.ts

@@ -0,0 +1,27 @@
+export declare const MCP_SERVER_NAME = "vault-go";
+export declare const MCP_SERVER_COMMAND: readonly ["bunx", "--bun", "vault-go@latest", "serve"];
+export declare const MCP_CLIENTS: readonly ["codex", "claude", "claude-desktop", "cursor", "vscode", "copilot", "windsurf", "roo", "opencode"];
+export type McpClient = (typeof MCP_CLIENTS)[number];
+export interface DetectedClient {
+    client: McpClient;
+    detected: boolean;
+    evidence?: string;
+}
+export interface InstallResult {
+    client: McpClient;
+    status: 'installed' | 'already-installed';
+    destination: string;
+}
+type CommandResult = {
+    status: number | null;
+    error?: Error;
+};
+type CommandRunner = (command: string, args: readonly string[]) => CommandResult;
+export declare function installMcpClient(client: McpClient, options?: {
+    home?: string;
+    cwd?: string;
+    runner?: CommandRunner;
+}): InstallResult;
+export declare function detectMcpClients(home?: string): DetectedClient[];
+export declare function parseClientSelection(value: string): McpClient[];
+export {};

package/dist/installer.js

@@ -0,0 +1,188 @@
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync, } from 'node:fs';
+import { homedir, platform } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
+export const MCP_SERVER_NAME = 'vault-go';
+export const MCP_SERVER_COMMAND = ['bunx', '--bun', 'vault-go@latest', 'serve'];
+export const MCP_CLIENTS = [
+    'codex',
+    'claude',
+    'claude-desktop',
+    'cursor',
+    'vscode',
+    'copilot',
+    'windsurf',
+    'roo',
+    'opencode',
+];
+const runCommand = (command, args) => spawnSync(command, [...args], { stdio: 'ignore' });
+function readJsonObject(path) {
+    if (!existsSync(path))
+        return {};
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch (error) {
+        throw new Error(`JSON inválido em ${path}; o arquivo não foi alterado.`, { cause: error });
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error(`Configuração inválida em ${path}; o arquivo não foi alterado.`);
+    }
+    return parsed;
+}
+function atomicWriteJson(path, value) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const temporary = join(dirname(path), `.${process.pid}.${Date.now()}.tmp`);
+    writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    renameSync(temporary, path);
+    chmodSync(path, 0o600);
+}
+function standardServer() {
+    return {
+        command: MCP_SERVER_COMMAND[0],
+        args: MCP_SERVER_COMMAND.slice(1),
+    };
+}
+function mergeServer(path, rootKey = 'mcpServers', server = standardServer()) {
+    const config = readJsonObject(path);
+    const existing = config[rootKey];
+    if (existing !== undefined && (!existing || typeof existing !== 'object' || Array.isArray(existing))) {
+        throw new Error(`Campo ${rootKey} inválido em ${path}; o arquivo não foi alterado.`);
+    }
+    atomicWriteJson(path, {
+        ...config,
+        [rootKey]: {
+            ...existing,
+            [MCP_SERVER_NAME]: server,
+        },
+    });
+}
+function claudeDesktopPath(home) {
+    if (platform() === 'darwin') {
+        return join(home, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json');
+    }
+    if (platform() === 'win32') {
+        return join(process.env['APPDATA'] ?? join(home, 'AppData', 'Roaming'), 'Claude', 'claude_desktop_config.json');
+    }
+    return join(home, '.config', 'Claude', 'claude_desktop_config.json');
+}
+function installViaCli(client, command, getArgs, addArgs, runner) {
+    const existing = runner(command, getArgs);
+    if (existing.status === 0) {
+        return { client, status: 'already-installed', destination: `${command} MCP config` };
+    }
+    const installed = runner(command, addArgs);
+    if (installed.error || installed.status !== 0) {
+        throw new Error(`Não foi possível configurar ${client}. Confirme que o comando "${command}" está instalado.`, { cause: installed.error });
+    }
+    return { client, status: 'installed', destination: `${command} MCP config` };
+}
+export function installMcpClient(client, options = {}) {
+    const home = options.home ?? homedir();
+    const cwd = options.cwd ?? process.cwd();
+    const runner = options.runner ?? runCommand;
+    if (client === 'codex') {
+        return installViaCli(client, 'codex', ['mcp', 'get', MCP_SERVER_NAME], ['mcp', 'add', MCP_SERVER_NAME, '--', ...MCP_SERVER_COMMAND], runner);
+    }
+    if (client === 'claude') {
+        return installViaCli(client, 'claude', ['mcp', 'get', MCP_SERVER_NAME], [
+            'mcp',
+            'add',
+            '--scope',
+            'user',
+            '--transport',
+            'stdio',
+            MCP_SERVER_NAME,
+            '--',
+            ...MCP_SERVER_COMMAND,
+        ], runner);
+    }
+    if (client === 'vscode') {
+        const payload = JSON.stringify({
+            name: MCP_SERVER_NAME,
+            command: MCP_SERVER_COMMAND[0],
+            args: MCP_SERVER_COMMAND.slice(1),
+        });
+        const installed = runner('code', ['--add-mcp', payload]);
+        if (installed.error || installed.status !== 0) {
+            throw new Error('Não foi possível configurar VS Code. Confirme que o comando "code" está instalado.');
+        }
+        return { client, status: 'installed', destination: 'VS Code user profile' };
+    }
+    let path;
+    if (client === 'claude-desktop')
+        path = claudeDesktopPath(home);
+    else if (client === 'cursor')
+        path = join(home, '.cursor', 'mcp.json');
+    else if (client === 'copilot')
+        path = join(home, '.copilot', 'mcp-config.json');
+    else if (client === 'windsurf')
+        path = join(home, '.codeium', 'windsurf', 'mcp_config.json');
+    else if (client === 'roo')
+        path = resolve(cwd, '.roo', 'mcp.json');
+    else
+        path = join(home, '.config', 'opencode', 'opencode.json');
+    if (client === 'opencode') {
+        mergeServer(path, 'mcp', {
+            type: 'local',
+            command: [...MCP_SERVER_COMMAND],
+            enabled: true,
+        });
+    }
+    else if (client === 'copilot') {
+        mergeServer(path, 'mcpServers', {
+            type: 'local',
+            ...standardServer(),
+            env: {},
+            tools: ['*'],
+        });
+    }
+    else {
+        mergeServer(path);
+    }
+    return { client, status: 'installed', destination: path };
+}
+export function detectMcpClients(home = homedir()) {
+    const definitions = [
+        ['codex', ['codex'], [join(home, '.codex')]],
+        ['claude', ['claude'], [join(home, '.claude')]],
+        ['claude-desktop', [], [claudeDesktopPath(home), '/Applications/Claude.app']],
+        ['cursor', ['cursor'], [join(home, '.cursor')]],
+        ['vscode', ['code'], [join(home, '.vscode')]],
+        ['copilot', ['copilot'], [join(home, '.copilot')]],
+        ['windsurf', ['windsurf'], [join(home, '.codeium', 'windsurf')]],
+        ['roo', [], []],
+        ['opencode', ['opencode'], [join(home, '.config', 'opencode')]],
+    ];
+    return definitions.map(([client, commands, paths]) => {
+        const command = commands.find((candidate) => Bun.which(candidate));
+        if (command)
+            return { client, detected: true, evidence: `comando ${command}` };
+        if (client === 'roo') {
+            const extensions = join(home, '.vscode', 'extensions');
+            try {
+                const detected = readdirSync(extensions).some((entry) => entry.toLowerCase().includes('roo-code'));
+                if (detected)
+                    return { client, detected: true, evidence: extensions };
+            }
+            catch {
+                // VS Code ou Roo não estão instalados.
+            }
+        }
+        const path = paths.find((candidate) => existsSync(candidate));
+        return path
+            ? { client, detected: true, evidence: path }
+            : { client, detected: false };
+    });
+}
+export function parseClientSelection(value) {
+    const normalized = value.trim().toLowerCase();
+    if (normalized === 'all' || normalized === 'todos')
+        return [...MCP_CLIENTS];
+    const selected = [...new Set(normalized.split(',').map((item) => item.trim()).filter(Boolean))];
+    const invalid = selected.filter((item) => !MCP_CLIENTS.includes(item));
+    if (invalid.length > 0)
+        throw new Error(`Clientes MCP desconhecidos: ${invalid.join(', ')}`);
+    return selected;
+}

package/dist/prompt.d.ts

@@ -0,0 +1,3 @@
+import type { ReadStream, WriteStream } from 'node:tty';
+export declare function promptText(question: string, input?: NodeJS.ReadableStream, output?: NodeJS.WritableStream): Promise<string>;
+export declare function promptSecret(question: string, input?: ReadStream, output?: WriteStream): Promise<string>;

package/dist/prompt.js

@@ -0,0 +1,51 @@
+import { createInterface } from 'node:readline/promises';
+export async function promptText(question, input = process.stdin, output = process.stderr) {
+    const readline = createInterface({ input, output, terminal: true });
+    try {
+        return (await readline.question(question)).trim();
+    }
+    finally {
+        readline.close();
+    }
+}
+export async function promptSecret(question, input = process.stdin, output = process.stderr) {
+    if (!input.isTTY || typeof input.setRawMode !== 'function') {
+        throw new Error('A autenticação interativa requer um terminal TTY.');
+    }
+    output.write(question);
+    const wasRaw = input.isRaw;
+    const wasPaused = input.isPaused();
+    input.setRawMode(true);
+    input.resume();
+    return new Promise((resolve, reject) => {
+        let value = '';
+        const cleanup = () => {
+            input.off('data', onData);
+            input.setRawMode(wasRaw);
+            if (wasPaused)
+                input.pause();
+            output.write('\n');
+        };
+        const onData = (chunk) => {
+            for (const character of String(chunk)) {
+                if (character === '\u0003') {
+                    cleanup();
+                    reject(new Error('Operação cancelada.'));
+                    return;
+                }
+                if (character === '\r' || character === '\n') {
+                    cleanup();
+                    resolve(value);
+                    return;
+                }
+                if (character === '\u007f' || character === '\b') {
+                    value = value.slice(0, -1);
+                    continue;
+                }
+                if (character >= ' ')
+                    value += character;
+            }
+        };
+        input.on('data', onData);
+    });
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "vault-go",
-  "version": "0.8.1",
-  "description": "Servidor MCP Bun para pesquisar e registrar memória na plataforma Vault.",
+  "version": "0.10.0",
+  "description": "Servidor MCP universal com autenticação e instalação multi-cliente para a plataforma Vault.",
   "type": "module",
   "bin": {
     "vault-go": "dist/index.js",
@@ -24,6 +24,12 @@
     "dist/index.d.ts",
     "dist/cli.js",
     "dist/cli.d.ts",
+    "dist/auth.js",
+    "dist/auth.d.ts",
+    "dist/installer.js",
+    "dist/installer.d.ts",
+    "dist/prompt.js",
+    "dist/prompt.d.ts",
     "dist/server.js",
     "dist/server.d.ts",
     "dist/config.js",
@@ -52,10 +58,10 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/GutierrezHenrique/vault-go.git"
+    "url": "git+https://github.com/resolveup-cloud/vault-go.git"
   },
   "bugs": {
-    "url": "https://github.com/GutierrezHenrique/vault-go/issues"
+    "url": "https://github.com/resolveup-cloud/vault-go/issues"
   },
   "homepage": "https://vault.resolveup.com.br",
   "keywords": [
@@ -64,7 +70,11 @@
     "memory",
     "vault",
     "memvault",
-    "knowledge"
+    "knowledge",
+    "codex",
+    "claude",
+    "copilot",
+    "cursor"
   ],
   "author": "Gutierrez Henrique",
   "license": "MIT",