wasper-cli 0.1.0 → 0.2.0

package/dist/index.js

@@ -2938,6 +2938,92 @@ function extractSecuritySchemes(doc) {
   }
   return result;
 }
+function toEnvKey(str) {
+  return str.replace(/[^a-zA-Z0-9]+(.)/g, (_, c) => c.toUpperCase()).replace(/^[A-Z]/, (c) => c.toLowerCase()).replace(/[^a-zA-Z0-9_]/g, "") || str.replace(/[^a-zA-Z0-9_]/g, "_").toLowerCase();
+}
+function extractSuggestedVars(rawText, baseUrl) {
+  let raw;
+  try {
+    raw = rawText.trimStart().startsWith("{") ? JSON.parse(rawText) : index_vite_proxy_tmp_default.load(rawText);
+  } catch {
+    return [];
+  }
+  const vars = [];
+  const seen = new Set;
+  const add = (key, value, description, source) => {
+    const k = key.trim();
+    if (!k || seen.has(k))
+      return;
+    seen.add(k);
+    vars.push({ key: k, value, description, source });
+  };
+  if (baseUrl)
+    add("baseUrl", baseUrl, "API base URL", "server");
+  const servers = raw.servers ?? [];
+  for (const server of servers.slice(0, 5)) {
+    if (!server.variables)
+      continue;
+    for (const [key, def] of Object.entries(server.variables)) {
+      add(toEnvKey(key), def.default ?? "", def.description ?? `Server variable: ${key}`, "server");
+    }
+  }
+  const components = raw.components ?? {};
+  const secSchemes = components.securitySchemes ?? {};
+  for (const [schemeName, scheme] of Object.entries(secSchemes)) {
+    if (!scheme || typeof scheme !== "object")
+      continue;
+    const type = scheme.type;
+    const slug = toEnvKey(schemeName);
+    if (type === "http") {
+      const httpScheme = (scheme.scheme ?? "").toLowerCase();
+      if (httpScheme === "bearer") {
+        add(`${slug}Token`, "", `Bearer token for ${schemeName}`, "auth");
+      } else if (httpScheme === "basic") {
+        add(`${slug}Username`, "", `Username for ${schemeName}`, "auth");
+        add(`${slug}Password`, "", `Password for ${schemeName}`, "auth");
+      }
+    } else if (type === "apiKey") {
+      const keyName = scheme.name ?? schemeName;
+      add(toEnvKey(keyName), "", `API key header/param: ${keyName}`, "auth");
+    } else if (type === "oauth2") {
+      add(`${slug}ClientId`, "", `OAuth2 client ID for ${schemeName}`, "auth");
+      add(`${slug}ClientSecret`, "", `OAuth2 client secret for ${schemeName}`, "auth");
+      add(`${slug}Token`, "", `OAuth2 access token for ${schemeName}`, "auth");
+    } else if (type === "openIdConnect") {
+      add(`${slug}Token`, "", `Access token for ${schemeName}`, "auth");
+    }
+  }
+  const paths = raw.paths ?? {};
+  const pathKeys = Object.keys(paths);
+  const paramFreq = {};
+  for (const [pathStr, pathItem] of Object.entries(paths)) {
+    if (!pathItem || typeof pathItem !== "object")
+      continue;
+    const params = pathItem.parameters ?? [];
+    const seenInPath = new Set;
+    for (const p of params) {
+      if (p.in === "path" && p.name && !seenInPath.has(p.name)) {
+        seenInPath.add(p.name);
+        paramFreq[p.name] = (paramFreq[p.name] ?? 0) + 1;
+      }
+    }
+    for (const [, param] of pathStr.matchAll(/\{([^}]+)\}/g)) {
+      if (!param)
+        continue;
+      if (!seenInPath.has(param)) {
+        seenInPath.add(param);
+        paramFreq[param] = (paramFreq[param] ?? 0) + 1;
+      }
+    }
+  }
+  const threshold = Math.max(3, Math.floor(pathKeys.length * 0.15));
+  for (const [name, count] of Object.entries(paramFreq)) {
+    if (count >= threshold) {
+      add(toEnvKey(name), "", `Common path param: {${name}}`, "path");
+    }
+  }
+  return vars;
+}
 var HTTP_METHODS;
 var init_parser = __esm(() => {
   init_js_yaml();
@@ -3045,6 +3131,33 @@ var SCHEMA = `
     updated_at INTEGER NOT NULL DEFAULT (unixepoch())
   );
   CREATE INDEX IF NOT EXISTS idx_saved_folder ON saved_requests(folder, created_at DESC);
+
+  CREATE TABLE IF NOT EXISTS spec_history (
+    id TEXT PRIMARY KEY,
+    url TEXT NOT NULL UNIQUE,
+    title TEXT,
+    version TEXT,
+    endpoint_count INTEGER,
+    last_used INTEGER NOT NULL DEFAULT (unixepoch()),
+    created_at INTEGER NOT NULL DEFAULT (unixepoch())
+  );
+  CREATE INDEX IF NOT EXISTS idx_spec_history_last_used ON spec_history(last_used DESC);
+
+  CREATE TABLE IF NOT EXISTS workflows (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL DEFAULT 'Untitled Workflow',
+    description TEXT NOT NULL DEFAULT '',
+    steps TEXT NOT NULL DEFAULT '[]',
+    created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+    updated_at INTEGER NOT NULL DEFAULT (unixepoch())
+  );
+  CREATE INDEX IF NOT EXISTS idx_workflows_updated ON workflows(updated_at DESC);
+
+  CREATE TABLE IF NOT EXISTS capture_bins (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL DEFAULT '',
+    created_at INTEGER NOT NULL DEFAULT (unixepoch())
+  );
 `;
 
 // src/db/index.ts
@@ -3188,6 +3301,39 @@ var init_db = __esm(() => {
       db.query(`UPDATE saved_requests SET ${cols}, updated_at = unixepoch() WHERE id = $id`).run(params);
     },
     deleteSavedRequest: (id) => db.query("DELETE FROM saved_requests WHERE id = ?").run(id),
+    getSpecHistory: () => db.query("SELECT * FROM spec_history ORDER BY last_used DESC").all(),
+    getLastSpec: () => db.query("SELECT * FROM spec_history ORDER BY last_used DESC LIMIT 1").get(),
+    upsertSpec: (url, title, version, endpointCount) => {
+      const existing = db.query("SELECT id FROM spec_history WHERE url = ?").get(url);
+      if (existing) {
+        db.query("UPDATE spec_history SET title=?, version=?, endpoint_count=?, last_used=unixepoch() WHERE url=?").run(title, version, endpointCount, url);
+      } else {
+        db.query(`INSERT INTO spec_history (id, url, title, version, endpoint_count)
+        VALUES (?, ?, ?, ?, ?)`).run(randomUUID2(), url, title, version, endpointCount);
+      }
+    },
+    deleteSpec: (id) => {
+      db.query("DELETE FROM spec_history WHERE id = ?").run(id);
+    },
+    getWorkflows: () => db.query("SELECT * FROM workflows ORDER BY updated_at DESC").all(),
+    getWorkflow: (id) => db.query("SELECT * FROM workflows WHERE id = ?").get(id),
+    insertWorkflow: (w) => db.query("INSERT INTO workflows (id, name, description, steps) VALUES ($id, $name, $description, $steps)").run({ $id: w.id, $name: w.name, $description: w.description, $steps: w.steps }),
+    updateWorkflow: (id, patch) => {
+      const cols = Object.keys(patch).map((k) => `${k} = $${k}`).join(", ");
+      const params = { $id: id };
+      for (const [k, v] of Object.entries(patch))
+        params[`$${k}`] = v;
+      db.query(`UPDATE workflows SET ${cols}, updated_at = unixepoch() WHERE id = $id`).run(params);
+    },
+    deleteWorkflow: (id) => db.query("DELETE FROM workflows WHERE id = ?").run(id),
+    getCaptureBins: () => db.query("SELECT * FROM capture_bins ORDER BY created_at DESC").all(),
+    getCaptureBin: (id) => db.query("SELECT * FROM capture_bins WHERE id = ?").get(id),
+    insertCaptureBin: (id, name) => {
+      db.query("INSERT INTO capture_bins (id, name) VALUES (?, ?)").run(id, name);
+    },
+    deleteCaptureBin: (id) => {
+      db.query("DELETE FROM capture_bins WHERE id = ?").run(id);
+    },
     getSetting: (key) => (db.query("SELECT value FROM settings WHERE key = ?").get(key) ?? null)?.value ?? null,
     setSetting: (key, value) => {
       db.run("INSERT INTO settings(key,value) VALUES(?,?) ON CONFLICT(key) DO UPDATE SET value=excluded.value", [key, value]);
@@ -3226,6 +3372,18 @@ class LogBus {
       }
     }
   }
+  broadcastServerEvent(payload) {
+    if (this.clients.size === 0)
+      return;
+    const data = JSON.stringify({ type: "server_event", ...payload });
+    for (const ws of this.clients) {
+      try {
+        ws.send(data);
+      } catch {
+        this.clients.delete(ws);
+      }
+    }
+  }
   get clientCount() {
     return this.clients.size;
   }
@@ -3428,7 +3586,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "wasper-cli",
-    version: "0.1.0",
+    version: "0.2.0",
     description: "Host an MCP server + API proxy from any OpenAPI spec. Like Drizzle Studio, but for APIs.",
     type: "module",
     homepage: "https://wasper.site",
@@ -4156,12 +4314,276 @@ var init_handler = __esm(() => {
   };
 });
 
+// src/proxy/capture.ts
+async function captureHandler(req) {
+  if (req.method === "OPTIONS") {
+    return new Response(null, { status: 204, headers: CORS3 });
+  }
+  const url = new URL(req.url);
+  const binId = url.pathname.split("/").filter(Boolean)[1];
+  if (!binId)
+    return new Response("Not found", { status: 404 });
+  const bin = dbQueries.getCaptureBin(binId);
+  if (!bin) {
+    return new Response(JSON.stringify({ error: "Capture bin not found or deleted" }), {
+      status: 404,
+      headers: { "Content-Type": "application/json", ...CORS3 }
+    });
+  }
+  const body = req.method !== "GET" && req.method !== "HEAD" ? await req.text().catch(() => null) : null;
+  const reqHeaders = {};
+  for (const [k, v] of req.headers.entries()) {
+    if (!["host", "connection"].includes(k.toLowerCase()))
+      reqHeaders[k] = v;
+  }
+  const id = randomUUID2();
+  const now = Date.now();
+  dbQueries.insertLog({
+    id,
+    source: "capture",
+    tool_name: binId,
+    method: req.method,
+    url: req.url,
+    request_headers: JSON.stringify(reqHeaders),
+    request_body: body,
+    status_code: 200,
+    response_headers: null,
+    response_body: null,
+    latency_ms: 0,
+    error: null
+  });
+  logBus.emit({
+    id,
+    source: "capture",
+    tool_name: binId,
+    method: req.method,
+    url: req.url,
+    request_headers: JSON.stringify(reqHeaders),
+    request_body: body,
+    status_code: 200,
+    response_headers: null,
+    response_body: null,
+    latency_ms: 0,
+    error: null,
+    created_at: now
+  });
+  return new Response(JSON.stringify({ ok: true, id, captured_at: now }), {
+    status: 200,
+    headers: { "Content-Type": "application/json", ...CORS3 }
+  });
+}
+var CORS3;
+var init_capture = __esm(() => {
+  init_db();
+  init_bus();
+  CORS3 = {
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD",
+    "Access-Control-Allow-Headers": "*",
+    "Access-Control-Expose-Headers": "*"
+  };
+});
+
+// src/workflows/engine.ts
+function interpolate(val, ctx) {
+  return val.replace(/\{\{(\w+)\}\}/g, (_, k) => ctx[k] ?? `{{${k}}}`);
+}
+function interpolateDeep(obj, ctx) {
+  if (typeof obj === "string")
+    return interpolate(obj, ctx);
+  if (Array.isArray(obj))
+    return obj.map((v) => interpolateDeep(v, ctx));
+  if (obj !== null && typeof obj === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(obj))
+      out[k] = interpolateDeep(v, ctx);
+    return out;
+  }
+  return obj;
+}
+function resolveJsonPath(data, path) {
+  if (!path || path === "$")
+    return data;
+  const normalized = path.startsWith("$.") ? path.slice(2) : path.startsWith("$[") ? path.slice(1) : path;
+  if (!normalized)
+    return data;
+  const parts = [];
+  for (const seg of normalized.split(".")) {
+    const m = seg.match(/^(\w+)\[(\d+)\]$/);
+    if (m) {
+      parts.push(m[1], parseInt(m[2], 10));
+    } else if (/^\d+$/.test(seg)) {
+      parts.push(parseInt(seg, 10));
+    } else {
+      parts.push(seg);
+    }
+  }
+  let cur = data;
+  for (const part of parts) {
+    if (cur === null || cur === undefined)
+      return;
+    cur = typeof part === "number" ? cur[part] : cur[part];
+  }
+  return cur;
+}
+async function executeStep(step, ctx) {
+  const { spec } = getState();
+  let base = spec.baseUrl;
+  if (!base?.startsWith("http") && spec.url) {
+    try {
+      base = new URL(spec.url).origin;
+    } catch {}
+  }
+  if (!base?.startsWith("http"))
+    throw new Error("Spec has no absolute server URL");
+  let urlPath = step.path;
+  for (const [k, v] of Object.entries(step.pathParams ?? {})) {
+    urlPath = urlPath.replace(`{${k}}`, encodeURIComponent(interpolate(v, ctx)));
+  }
+  urlPath = interpolate(urlPath, ctx);
+  const urlObj = new URL(`${base.replace(/\/$/, "")}${urlPath.startsWith("/") ? urlPath : `/${urlPath}`}`);
+  for (const [k, v] of Object.entries(step.queryParams ?? {})) {
+    urlObj.searchParams.set(k, interpolate(v, ctx));
+  }
+  const stepHeaders = {};
+  for (const [k, v] of Object.entries(step.headers ?? {})) {
+    stepHeaders[k] = interpolate(v, ctx);
+  }
+  const authRow = dbQueries.getAuthConfig();
+  const authConfig = authRow ? JSON.parse(authRow.config) : { type: "none" };
+  const { url: authedUrl, headers: authedHeaders } = await applyAuth(urlObj.toString(), stepHeaders, authConfig);
+  const noBodyMethod = ["GET", "HEAD", "OPTIONS"].includes(step.method.toUpperCase());
+  let bodyStr;
+  if (!noBodyMethod && step.body !== undefined && step.body !== null) {
+    const interpolated = interpolateDeep(step.body, ctx);
+    bodyStr = typeof interpolated === "string" ? interpolated : JSON.stringify(interpolated);
+    if (!authedHeaders["Content-Type"] && !authedHeaders["content-type"]) {
+      authedHeaders["Content-Type"] = "application/json";
+    }
+  }
+  const start = Date.now();
+  const res = await fetch(authedUrl, {
+    method: step.method.toUpperCase(),
+    headers: authedHeaders,
+    ...bodyStr !== undefined ? { body: bodyStr } : {},
+    signal: AbortSignal.timeout(30000)
+  });
+  const latency = Date.now() - start;
+  const responseHeaders = {};
+  res.headers.forEach((v, k) => {
+    responseHeaders[k] = v;
+  });
+  const responseText = await res.text();
+  let responseData;
+  try {
+    responseData = JSON.parse(responseText);
+  } catch {
+    responseData = responseText;
+  }
+  const extractedVars = {};
+  for (const ext of step.extract ?? []) {
+    const val = resolveJsonPath(responseData, ext.path);
+    if (val !== undefined && val !== null) {
+      extractedVars[ext.var] = typeof val === "string" ? val : JSON.stringify(val);
+    }
+  }
+  const assertions = [];
+  for (const a of step.assert ?? []) {
+    if (a.type === "status") {
+      const expected = a.statusCode ?? 200;
+      const pass2 = res.status === expected;
+      assertions.push({ pass: pass2, message: `HTTP ${res.status} ${pass2 ? "==" : "!="} ${expected}` });
+    } else if (a.type === "json") {
+      const val = resolveJsonPath(responseData, a.path ?? "$");
+      if ("eq" in a) {
+        const pass2 = JSON.stringify(val) === JSON.stringify(a.eq);
+        assertions.push({ pass: pass2, message: `${a.path} ${pass2 ? "==" : "!="} ${JSON.stringify(a.eq)}` });
+      } else if ("contains" in a && typeof val === "string") {
+        const pass2 = val.includes(a.contains);
+        assertions.push({ pass: pass2, message: `${a.path} ${pass2 ? "contains" : "doesn't contain"} "${a.contains}"` });
+      }
+    }
+  }
+  const pass = assertions.length === 0 ? res.ok : assertions.every((a) => a.pass);
+  return {
+    stepId: step.id,
+    label: step.label,
+    method: step.method,
+    resolvedPath: urlPath,
+    requestUrl: authedUrl,
+    requestHeaders: authedHeaders,
+    requestBody: bodyStr,
+    status: res.status,
+    statusText: res.statusText,
+    responseHeaders,
+    latency,
+    extractedVars,
+    assertions,
+    pass,
+    responseBody: responseText.slice(0, 1e4)
+  };
+}
+async function runWorkflow(steps, emit, signal) {
+  const ctx = {};
+  let passed = 0;
+  emit({ type: "run_start", totalSteps: steps.length });
+  for (const step of steps) {
+    if (signal?.aborted) {
+      emit({ type: "run_aborted", message: "Run cancelled" });
+      return;
+    }
+    emit({ type: "step_start", stepId: step.id, label: step.label, method: step.method, path: step.path });
+    try {
+      const result = await executeStep(step, ctx);
+      for (const [k, v] of Object.entries(result.extractedVars))
+        ctx[k] = v;
+      ctx[`${step.id}_status`] = String(result.status ?? "");
+      if (result.pass)
+        passed++;
+      emit({
+        type: "step_done",
+        stepId: result.stepId,
+        label: result.label,
+        method: result.method,
+        resolvedPath: result.resolvedPath,
+        requestUrl: result.requestUrl,
+        requestHeaders: result.requestHeaders,
+        requestBody: result.requestBody,
+        status: result.status,
+        statusText: result.statusText,
+        responseHeaders: result.responseHeaders,
+        latency: result.latency,
+        extractedVars: result.extractedVars,
+        assertions: result.assertions,
+        pass: result.pass,
+        responseBody: result.responseBody
+      });
+    } catch (e) {
+      emit({
+        type: "step_error",
+        stepId: step.id,
+        label: step.label,
+        method: step.method,
+        path: step.path,
+        error: e instanceof Error ? e.message : String(e),
+        pass: false
+      });
+    }
+  }
+  emit({ type: "run_done", totalSteps: steps.length, passedSteps: passed });
+}
+var init_engine2 = __esm(() => {
+  init_engine();
+  init_db();
+  init_state();
+});
+
 // src/api/routes.ts
 import dns from "dns/promises";
 function json(data, status = 200) {
   return new Response(JSON.stringify(data), {
     status,
-    headers: { "Content-Type": "application/json", ...CORS3 }
+    headers: { "Content-Type": "application/json", ...CORS4 }
   });
 }
 function notFound(msg = "Not found") {
@@ -4172,7 +4594,7 @@ function badRequest(msg) {
 }
 async function apiRouter(req) {
   if (req.method === "OPTIONS")
-    return new Response(null, { status: 204, headers: CORS3 });
+    return new Response(null, { status: 204, headers: CORS4 });
   const { pathname: path, searchParams } = new URL(req.url);
   const method = req.method;
   if (path === "/api/status" && method === "GET")
@@ -4239,6 +4661,24 @@ async function apiRouter(req) {
     return handleUpdateSaved(req, path);
   if (path.startsWith("/api/saved/") && method === "DELETE")
     return handleDeleteSaved(path);
+  if (path === "/api/workflows" && method === "GET")
+    return handleGetWorkflows();
+  if (path === "/api/workflows" && method === "POST")
+    return handleCreateWorkflow(req);
+  if (path === "/api/workflows/generate" && method === "POST")
+    return handleGenerateWorkflow(req);
+  if (path.startsWith("/api/workflows/") && path.endsWith("/run") && method === "POST")
+    return handleRunWorkflow(path);
+  if (path.startsWith("/api/workflows/") && method === "PUT")
+    return handleUpdateWorkflow(req, path);
+  if (path.startsWith("/api/workflows/") && method === "DELETE")
+    return handleDeleteWorkflow(path);
+  if (path === "/api/capture/bins" && method === "GET")
+    return handleGetCaptureBins();
+  if (path === "/api/capture/bins" && method === "POST")
+    return handleCreateCaptureBin(req);
+  if (path.startsWith("/api/capture/bins/") && method === "DELETE")
+    return handleDeleteCaptureBin(path);
   return notFound("API route not found");
 }
 function handleStatus() {
@@ -4280,8 +4720,14 @@ async function handleSetFeatures(req) {
       patch[key] = body[key];
   }
   setFeatures(patch);
+  persistAndBroadcastFeatures();
   return json(getFeatures());
 }
+function persistAndBroadcastFeatures() {
+  const f = getFeatures();
+  dbQueries.setSetting("features", JSON.stringify({ mcp: f.mcp, proxy: f.proxy, ai: f.ai }));
+  logBus.broadcastServerEvent({ kind: "features", data: f });
+}
 function handleServerInfo() {
   const state = hasState() ? getState() : null;
   return json({
@@ -4331,10 +4777,12 @@ async function handleSpecUpload(req) {
     return badRequest("Empty spec content");
   try {
     const state = loadSpecFromText(content, filename);
+    const suggestedVars = extractSuggestedVars(content, state.spec.baseUrl);
     return json({
       ok: true,
       spec: { title: state.spec.title, version: state.spec.version, baseUrl: state.spec.baseUrl },
-      endpointCount: state.operations.length
+      endpointCount: state.operations.length,
+      suggestedVars
     });
   } catch (e) {
     return json({ error: e instanceof Error ? e.message : String(e) }, 400);
@@ -4351,10 +4799,12 @@ async function handleSpecReloadUrl(req) {
     return badRequest("Missing url field");
   try {
     const state = await loadSpec(body.url);
+    const suggestedVars = extractSuggestedVars(state.spec.raw, state.spec.baseUrl);
     return json({
       ok: true,
       spec: { title: state.spec.title, version: state.spec.version, baseUrl: state.spec.baseUrl },
-      endpointCount: state.operations.length
+      endpointCount: state.operations.length,
+      suggestedVars
     });
   } catch (e) {
     return json({ error: e instanceof Error ? e.message : String(e) }, 400);
@@ -4975,7 +5425,11 @@ Authentication workflow: if requests return 401/403, call list_auth_profiles fir
 
 IMPORTANT: if an endpoint returns an error, diagnose it (check the schema, check auth) and fix the root cause before retrying. If the same endpoint fails 3 times the agent will be forcibly stopped. Do not retry without changing something.
 
-Be concise and practical. Format code and JSON in code blocks.`;
+Be concise and practical. Format code and JSON in code blocks.${body.extra_context ? `
+
+---
+## Current context
+${body.extra_context}` : ""}`;
   const provider = ai.provider ?? "anthropic";
   const requiresKey = provider !== "ollama" && provider !== "custom";
   if (requiresKey && !ai.apiKey) {
@@ -5058,7 +5512,7 @@ Be concise and practical. Format code and JSON in code blocks.`;
     headers: {
       "Content-Type": "text/event-stream",
       "Cache-Control": "no-cache",
-      ...CORS3
+      ...CORS4
     }
   });
 }
@@ -5463,15 +5917,220 @@ function handleDeleteSaved(path) {
   dbQueries.deleteSavedRequest(id);
   return json({ ok: true });
 }
-var CORS3, TOOL_DEFS, ANTHROPIC_TOOLS, OPENAI_TOOLS, MAX_TOTAL_TOOLS = 40, MAX_CONSECUTIVE_ERRORS = 5, MAX_SAME_ENDPOINT_ERRORS = 3;
+function workflowRow(row) {
+  if (!row)
+    return null;
+  let steps = [];
+  try {
+    steps = JSON.parse(row.steps);
+  } catch {}
+  return { ...row, steps };
+}
+function handleGetWorkflows() {
+  const rows = dbQueries.getWorkflows().map((r) => workflowRow(r)).filter(Boolean);
+  return json(rows);
+}
+async function handleCreateWorkflow(req) {
+  let body;
+  try {
+    body = await req.json();
+  } catch {
+    return badRequest("Invalid JSON");
+  }
+  const id = randomUUID2();
+  dbQueries.insertWorkflow({
+    id,
+    name: String(body.name ?? "Untitled Workflow"),
+    description: String(body.description ?? ""),
+    steps: typeof body.steps === "string" ? body.steps : JSON.stringify(body.steps ?? [])
+  });
+  return json(workflowRow(dbQueries.getWorkflow(id)), 201);
+}
+async function handleUpdateWorkflow(req, path) {
+  const id = path.slice("/api/workflows/".length);
+  if (!dbQueries.getWorkflow(id))
+    return notFound();
+  let body;
+  try {
+    body = await req.json();
+  } catch {
+    return badRequest("Invalid JSON");
+  }
+  const patch = {};
+  if ("name" in body)
+    patch.name = String(body.name);
+  if ("description" in body)
+    patch.description = String(body.description);
+  if ("steps" in body)
+    patch.steps = typeof body.steps === "string" ? body.steps : JSON.stringify(body.steps);
+  if (Object.keys(patch).length)
+    dbQueries.updateWorkflow(id, patch);
+  return json(workflowRow(dbQueries.getWorkflow(id)));
+}
+function handleDeleteWorkflow(path) {
+  const id = path.slice("/api/workflows/".length);
+  if (!dbQueries.getWorkflow(id))
+    return notFound();
+  dbQueries.deleteWorkflow(id);
+  return json({ ok: true });
+}
+async function handleGenerateWorkflow(req) {
+  if (!hasState())
+    return badRequest("No spec loaded");
+  let body;
+  try {
+    body = await req.json();
+  } catch {
+    return badRequest("Invalid JSON");
+  }
+  const settingsRow = dbQueries.getSettings();
+  const settings = settingsRow ? JSON.parse(settingsRow.value) : {};
+  const ai = settings.ai ?? {};
+  const provider = ai.provider ?? "anthropic";
+  if (provider !== "ollama" && !ai.apiKey) {
+    return json({ error: "No AI API key configured. Go to Settings \u2192 AI Provider to add one." }, 400);
+  }
+  const { spec, operations } = getState();
+  const endpointList = operations.slice(0, 80).map((op) => `${op.method.toUpperCase()} ${op.path}${op.operationId ? ` [${op.operationId}]` : ""}${op.summary ? ` \u2014 ${op.summary}` : ""}`).join(`
+`);
+  const userPrompt = body.prompt?.trim() || "Generate a realistic end-to-end test workflow covering authentication and CRUD operations.";
+  const systemMsg = `You generate API test workflows as JSON for the "${spec.title}" API (base: ${spec.baseUrl}).
+
+Available endpoints:
+${endpointList}
+
+Return ONLY valid JSON (no markdown fences) matching this schema exactly:
+{
+  "name": "string",
+  "description": "string",
+  "steps": [
+    {
+      "id": "step_1",
+      "label": "Human-readable name",
+      "method": "GET|POST|PUT|PATCH|DELETE",
+      "path": "/exact/path/from/spec",
+      "operationId": "operationId or null",
+      "pathParams": {},
+      "queryParams": {},
+      "headers": {},
+      "body": null,
+      "extract": [{"var": "varName", "path": "$.field.nested"}],
+      "assert": [{"type": "status", "statusCode": 200}]
+    }
+  ]
+}
+
+Rules:
+- Use {{varName}} in path/headers/body values to reference vars extracted in prior steps
+- For auth: extract token after login, set headers: {"Authorization": "Bearer {{token}}"}
+- Keep 3\u20138 steps covering a realistic user journey
+- Only use paths that exist in the endpoint list above`;
+  try {
+    let text = "";
+    if (provider === "anthropic") {
+      const res = await fetch("https://api.anthropic.com/v1/messages", {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "x-api-key": ai.apiKey, "anthropic-version": "2023-06-01" },
+        body: JSON.stringify({ model: ai.model || "claude-sonnet-4-6", max_tokens: 4096, system: systemMsg, messages: [{ role: "user", content: userPrompt }] })
+      });
+      if (!res.ok)
+        throw new Error(`Anthropic: ${await res.text()}`);
+      const d = await res.json();
+      text = d.content.find((b) => b.type === "text")?.text ?? "";
+    } else {
+      const base = (ai.baseUrl || (provider === "openai" ? "https://api.openai.com" : provider === "groq" ? "https://api.groq.com/openai" : provider === "mistral" ? "https://api.mistral.ai" : "https://api.openai.com")).replace(/\/$/, "");
+      const hdrs = { "Content-Type": "application/json" };
+      if (ai.apiKey)
+        hdrs["Authorization"] = `Bearer ${ai.apiKey}`;
+      const res = await fetch(`${base}/v1/chat/completions`, {
+        method: "POST",
+        headers: hdrs,
+        body: JSON.stringify({ model: ai.model || "gpt-4o-mini", max_tokens: 2048, response_format: { type: "json_object" }, messages: [{ role: "system", content: systemMsg }, { role: "user", content: userPrompt }] })
+      });
+      if (!res.ok)
+        throw new Error(await res.text());
+      const d = await res.json();
+      text = d.choices[0]?.message.content ?? "";
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      const m = text.match(/```(?:json)?\s*\n?([\s\S]+?)\n?```/);
+      if (m)
+        parsed = JSON.parse(m[1]);
+      else
+        throw new Error("AI response was not valid JSON");
+    }
+    return json(parsed);
+  } catch (e) {
+    return json({ error: e instanceof Error ? e.message : String(e) }, 500);
+  }
+}
+function handleRunWorkflow(path) {
+  const id = path.slice("/api/workflows/".length, -"/run".length);
+  const row = dbQueries.getWorkflow(id);
+  if (!row)
+    return notFound();
+  if (!hasState())
+    return badRequest("No spec loaded");
+  let steps;
+  try {
+    steps = JSON.parse(row.steps);
+  } catch {
+    return badRequest("Invalid workflow steps JSON");
+  }
+  if (!steps.length)
+    return badRequest("Workflow has no steps");
+  const { readable, writable } = new TransformStream;
+  const writer = writable.getWriter();
+  const enc = new TextEncoder;
+  const emit = (e) => {
+    writer.write(enc.encode(`data: ${JSON.stringify(e)}
+
+`)).catch(() => {});
+  };
+  (async () => {
+    try {
+      await runWorkflow(steps, emit);
+    } catch (e) {
+      emit({ type: "error", message: e instanceof Error ? e.message : String(e) });
+    } finally {
+      try {
+        await writer.close();
+      } catch {}
+    }
+  })();
+  return new Response(readable, {
+    headers: { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", ...CORS4 }
+  });
+}
+function handleGetCaptureBins() {
+  return json(dbQueries.getCaptureBins());
+}
+async function handleCreateCaptureBin(req) {
+  const body = await req.json().catch(() => ({}));
+  const id = randomUUID2().replace(/-/g, "").slice(0, 8);
+  const name = String(body.name ?? "").trim() || "Untitled bin";
+  dbQueries.insertCaptureBin(id, name);
+  return json({ id, name, created_at: Math.floor(Date.now() / 1000) }, 201);
+}
+function handleDeleteCaptureBin(path) {
+  const id = path.replace("/api/capture/bins/", "");
+  dbQueries.deleteCaptureBin(id);
+  return json({ ok: true });
+}
+var CORS4, TOOL_DEFS, ANTHROPIC_TOOLS, OPENAI_TOOLS, MAX_TOTAL_TOOLS = 40, MAX_CONSECUTIVE_ERRORS = 5, MAX_SAME_ENDPOINT_ERRORS = 3;
 var init_routes = __esm(() => {
   init_db();
   init_engine();
   init_bus();
   init_state();
+  init_parser();
   init_config();
   init_version();
-  CORS3 = {
+  init_engine2();
+  CORS4 = {
     "Access-Control-Allow-Origin": "*",
     "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
     "Access-Control-Allow-Headers": "Content-Type, Authorization"
@@ -5677,7 +6336,7 @@ function printBanner(opts) {
   const hint = [
     `${paint.bold("r")} reload`,
     `${paint.bold("b")} background`,
-    `${paint.bold("/")} commands`,
+    `${paint.bold("/")} commands  ${paint.dim("(Tab to complete)")}`,
     `${paint.bold("q")} quit`,
     `${paint.bold("?")} help`
   ].join(`  ${dot}  `);
@@ -5908,6 +6567,392 @@ var init_update = __esm(() => {
   CHECK_INTERVAL = 24 * 60 * 60 * 1000;
 });
 
+// src/repl.ts
+function stripAnsi(s) {
+  return s.replace(/\x1B\[[0-9;]*[A-Za-z]/g, "");
+}
+function visualRows(line, cols) {
+  const len = stripAnsi(line).length;
+  if (len === 0)
+    return 1;
+  return Math.ceil(len / cols);
+}
+
+class Repl {
+  buf = "";
+  history = [];
+  histIdx = -1;
+  savedBuf = "";
+  running = false;
+  statusText = "";
+  promptDrawn = false;
+  drawingPrompt = false;
+  promptVisualRows = 0;
+  onCmd = null;
+  cols = process.stdout.columns || 80;
+  dynSuggestions = [];
+  constructor() {
+    if (isTTY) {
+      process.stdout.on("resize", () => {
+        this.cols = process.stdout.columns || 80;
+        if (this.running)
+          this.redraw();
+      });
+    }
+  }
+  setDynamicSuggestions(items) {
+    this.dynSuggestions = items;
+    if (this.running)
+      this.redraw();
+  }
+  setStatus(text) {
+    this.statusText = text;
+    if (this.running)
+      this.redraw();
+  }
+  print(line) {
+    process.stdout.write(line + `
+`);
+  }
+  start(onCmd) {
+    this.onCmd = onCmd;
+    this.running = true;
+    if (!isTTY || !process.stdin.setRawMode) {
+      this.startSimple(onCmd);
+      return;
+    }
+    const origWrite = process.stdout.write.bind(process.stdout);
+    const self = this;
+    const patched = function(chunk, enc, cb) {
+      if (self.drawingPrompt)
+        return origWrite(chunk, enc, cb);
+      const str = typeof chunk === "string" ? chunk : chunk instanceof Uint8Array ? new TextDecoder().decode(chunk) : String(chunk);
+      const isSpinnerWrite = str.startsWith("\r") && !str.includes(`
+`);
+      if (isSpinnerWrite || !self.promptDrawn)
+        return origWrite(chunk, enc, cb);
+      self.drawingPrompt = true;
+      for (let i = 0;i < self.promptVisualRows - 1; i++)
+        origWrite("\x1B[A");
+      origWrite("\r\x1B[J");
+      self.promptDrawn = false;
+      const r = origWrite(chunk, enc, cb);
+      if (!str.endsWith(`
+`))
+        origWrite(`
+`);
+      const lines = self.buildPromptLines();
+      self.promptVisualRows = lines.reduce((sum, l) => sum + visualRows(l, self.cols), 0);
+      origWrite(lines.join(`
+`));
+      self.promptDrawn = true;
+      self.drawingPrompt = false;
+      return r;
+    };
+    patched.__orig = origWrite;
+    process.stdout.write = patched;
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (key) => {
+      this.handleKey(key).catch(() => {});
+    });
+    this.drawPrompt();
+  }
+  stop() {
+    this.running = false;
+    if (this.promptDrawn)
+      this.clearPrompt();
+    if (process.stdout.write.__orig) {
+      process.stdout.write = process.stdout.write.__orig;
+    }
+    try {
+      process.stdin.setRawMode(false);
+      process.stdin.pause();
+    } catch {}
+  }
+  getSuggestions() {
+    if (!this.buf.startsWith("/"))
+      return [];
+    const raw = this.buf.slice(1);
+    if (!raw)
+      return BASE.slice(0, 6);
+    const parts = raw.split(" ");
+    const base = parts[0] ?? "";
+    if (raw.startsWith("auth use ") && this.dynSuggestions.length) {
+      const typed = raw.slice("auth use ".length);
+      return this.dynSuggestions.filter((s) => s.label.toLowerCase().startsWith(typed.toLowerCase()));
+    }
+    if (parts.length >= 2 && SUB[base]) {
+      return (SUB[base] ?? []).filter((s) => s.value.startsWith(raw));
+    }
+    return BASE.filter((c) => c.value.startsWith(raw));
+  }
+  getGhostText() {
+    if (!this.buf.startsWith("/"))
+      return "";
+    const suggestions = this.getSuggestions();
+    if (!suggestions.length)
+      return "";
+    const first = suggestions[0];
+    const full = "/" + first.value;
+    if (full === this.buf || !full.startsWith(this.buf))
+      return "";
+    return full.slice(this.buf.length);
+  }
+  buildPromptLines() {
+    const lines = [];
+    const suggestions = this.getSuggestions();
+    const DOT = paint.dim(" \xB7 ");
+    if (this.buf.startsWith("/") && suggestions.length > 0) {
+      const items = suggestions.slice(0, 5);
+      const row = items.map((s, i) => {
+        const label = "/" + s.label;
+        const desc = s.desc ? paint.dim("  " + s.desc) : "";
+        return i === 0 ? paint.cyan(label) + desc : paint.dim(label);
+      }).join(DOT);
+      lines.push(`  ${row}`);
+    }
+    if (this.statusText) {
+      const plain = stripAnsi(this.statusText);
+      const truncated = plain.length > this.cols - 4 ? plain.slice(0, this.cols - 7) + "\u2026" : plain;
+      lines.push(`  ${paint.dim(truncated)}`);
+    }
+    const ghost = this.getGhostText();
+    lines.push(`  ${paint.cyan("\u276F")} ${this.buf}${ghost ? paint.dim(ghost) : ""}`);
+    return lines;
+  }
+  clearPrompt() {
+    if (!this.promptDrawn)
+      return;
+    this.drawingPrompt = true;
+    for (let i = 0;i < this.promptVisualRows - 1; i++)
+      process.stdout.write("\x1B[A");
+    process.stdout.write("\r\x1B[J");
+    this.promptDrawn = false;
+    this.drawingPrompt = false;
+  }
+  drawPrompt() {
+    this.drawingPrompt = true;
+    const lines = this.buildPromptLines();
+    this.promptVisualRows = lines.reduce((sum, l) => sum + visualRows(l, this.cols), 0);
+    process.stdout.write(lines.join(`
+`));
+    this.promptDrawn = true;
+    this.drawingPrompt = false;
+  }
+  redraw() {
+    this.clearPrompt();
+    this.drawPrompt();
+  }
+  async handleKey(key) {
+    if (!this.running)
+      return;
+    if (key === "\x03" || key === "\x04") {
+      this.stop();
+      process.emit("SIGINT");
+      return;
+    }
+    if (key === "\f") {
+      this.drawingPrompt = true;
+      process.stdout.write("\x1B[2J\x1B[H");
+      this.drawingPrompt = false;
+      this.promptDrawn = false;
+      this.drawPrompt();
+      return;
+    }
+    if (key === "\x15") {
+      this.buf = "";
+      this.redraw();
+      return;
+    }
+    if (key === "\x17") {
+      this.buf = this.buf.replace(/\S+\s*$/, "");
+      this.redraw();
+      return;
+    }
+    if (key.startsWith("\x1B")) {
+      if (key === "\x1B") {
+        this.buf = "";
+        this.redraw();
+        return;
+      }
+      if (key === "\x1B[A") {
+        this.historyUp();
+        return;
+      }
+      if (key === "\x1B[B") {
+        this.historyDown();
+        return;
+      }
+      if (key === "\x1B[C") {
+        const g = this.getGhostText();
+        if (g) {
+          this.buf += g;
+          const raw = this.buf.slice(1);
+          if (SUB[raw])
+            this.buf += " ";
+          this.redraw();
+        }
+        return;
+      }
+      return;
+    }
+    if (key === "\t") {
+      const g = this.getGhostText();
+      if (g) {
+        this.buf += g;
+        const raw = this.buf.slice(1);
+        if (SUB[raw])
+          this.buf += " ";
+      } else {
+        const suggestions = this.getSuggestions();
+        if (suggestions[0] && "/" + suggestions[0].value !== this.buf) {
+          this.buf = "/" + suggestions[0].value;
+        }
+      }
+      this.redraw();
+      return;
+    }
+    if (key === "\x7F" || key === "\b") {
+      if (this.buf.length > 0) {
+        this.buf = this.buf.slice(0, -1);
+        this.redraw();
+      }
+      return;
+    }
+    if (key === "\r" || key === `
+`) {
+      await this.submit();
+      return;
+    }
+    if (this.buf === "") {
+      switch (key.toLowerCase()) {
+        case "r":
+          await this.dispatchImmediate("r");
+          return;
+        case "b":
+          await this.dispatchImmediate("b");
+          return;
+        case "s":
+          await this.dispatchImmediate("s");
+          return;
+        case "q":
+          await this.dispatchImmediate("q");
+          return;
+        case "?":
+        case "h":
+          await this.dispatchImmediate("h");
+          return;
+        case "/":
+          this.buf = "/";
+          this.redraw();
+          return;
+      }
+    }
+    const printable = key.replace(/[^\x20-\x7E]/g, "");
+    if (printable) {
+      this.buf += printable;
+      this.redraw();
+    }
+  }
+  async submit() {
+    const cmd = this.buf.trim();
+    this.buf = "";
+    this.clearPrompt();
+    process.stdout.write(`
+`);
+    this.promptDrawn = false;
+    if (cmd) {
+      this.history.unshift(cmd);
+      if (this.history.length > 200)
+        this.history.pop();
+      this.histIdx = -1;
+      this.savedBuf = "";
+      if (this.onCmd)
+        await this.onCmd(cmd);
+    }
+    this.drawPrompt();
+  }
+  async dispatchImmediate(key) {
+    this.clearPrompt();
+    process.stdout.write(`
+`);
+    this.promptDrawn = false;
+    if (this.onCmd)
+      await this.onCmd(key);
+    this.drawPrompt();
+  }
+  historyUp() {
+    if (!this.history.length)
+      return;
+    if (this.histIdx === -1)
+      this.savedBuf = this.buf;
+    this.histIdx = Math.min(this.histIdx + 1, this.history.length - 1);
+    this.buf = this.history[this.histIdx] ?? "";
+    this.redraw();
+  }
+  historyDown() {
+    if (this.histIdx === -1)
+      return;
+    this.histIdx--;
+    this.buf = this.histIdx === -1 ? this.savedBuf : this.history[this.histIdx] ?? "";
+    this.redraw();
+  }
+  startSimple(onCmd) {
+    process.stdout.write("  \u276F ");
+    process.stdin.setEncoding("utf8");
+    let line = "";
+    process.stdin.on("data", async (chunk) => {
+      for (const ch of chunk) {
+        if (ch === `
+` || ch === "\r") {
+          const cmd = line.trim();
+          line = "";
+          if (cmd)
+            await onCmd(cmd);
+          process.stdout.write("  \u276F ");
+        } else {
+          line += ch;
+        }
+      }
+    });
+  }
+}
+var BASE, SUB;
+var init_repl = __esm(() => {
+  init_ui();
+  BASE = [
+    { value: "help", label: "help", desc: "Show all commands" },
+    { value: "status", label: "status", desc: "Show server status" },
+    { value: "reload", label: "reload", desc: "Hot-reload the spec" },
+    { value: "spec", label: "spec", desc: "Load a different spec" },
+    { value: "mcp", label: "mcp", desc: "Toggle MCP endpoint" },
+    { value: "proxy", label: "proxy", desc: "Toggle HTTP proxy" },
+    { value: "ai", label: "ai", desc: "Toggle AI chat" },
+    { value: "readonly", label: "readonly", desc: "Toggle read-only mode" },
+    { value: "auth", label: "auth", desc: "Manage auth roles" },
+    { value: "token", label: "token", desc: "Manage access token" },
+    { value: "tail", label: "tail", desc: "Live request log" },
+    { value: "open", label: "open", desc: "Open studio in browser" },
+    { value: "update", label: "update", desc: "Update wasper" },
+    { value: "quit", label: "quit", desc: "Quit" }
+  ];
+  SUB = {
+    auth: [
+      { value: "auth list", label: "list", desc: "List auth profiles" },
+      { value: "auth use ", label: "use", desc: "Switch active profile" },
+      { value: "auth none", label: "none", desc: "Disable auth" }
+    ],
+    mcp: [{ value: "mcp on", label: "on", desc: "" }, { value: "mcp off", label: "off", desc: "" }],
+    proxy: [{ value: "proxy on", label: "on", desc: "" }, { value: "proxy off", label: "off", desc: "" }],
+    ai: [{ value: "ai on", label: "on", desc: "" }, { value: "ai off", label: "off", desc: "" }],
+    readonly: [{ value: "readonly on", label: "on", desc: "" }, { value: "readonly off", label: "off", desc: "" }],
+    token: [{ value: "token new", label: "new", desc: "Generate token" }, { value: "token off", label: "off", desc: "Remove token" }],
+    tail: [{ value: "tail on", label: "on", desc: "" }, { value: "tail off", label: "off", desc: "" }]
+  };
+});
+
 // src/commands/start.ts
 var exports_start = {};
 __export(exports_start, {
@@ -5942,18 +6987,44 @@ async function run2(overrideOpts) {
     printHelp();
     process.exit(0);
   }
-  const specUrl = overrideOpts?.url ?? (values.url ? String(values.url) : null) ?? process.env.WASPER_SPEC_URL ?? null;
+  let specUrl = overrideOpts?.url ?? (values.url ? String(values.url) : null) ?? process.env.WASPER_SPEC_URL ?? null;
   const PORT = overrideOpts?.port ?? parseInt(String(values.port ?? "3388"), 10);
   const HOST = overrideOpts?.host ?? (values.host ? String(values.host) : null) ?? process.env.WASPER_HOST ?? "0.0.0.0";
   const ORIGIN = (overrideOpts?.origin ?? (values.origin ? String(values.origin) : null) ?? process.env.WASPER_ORIGIN ?? null)?.replace(/\/$/, "") ?? null;
   const TOKEN = overrideOpts?.token ?? (values.token ? String(values.token) : null) ?? process.env.WASPER_TOKEN ?? null;
   const bgNow = overrideOpts?.daemon ?? !!(values.background || values.daemon);
   const isDaemon = overrideOpts?.isDaemon ?? !!values["_daemon"];
+  if (!specUrl && !isDaemon) {
+    const last = dbQueries.getLastSpec();
+    if (last) {
+      specUrl = last.url;
+      if (isTTY)
+        console.log(`  ${paint.dim("\u21A9")}  Resuming ${paint.cyan(last.title ?? last.url)}  ${paint.dim("(last used)")}
+`);
+    }
+  }
   setServerConfig({ port: PORT, host: HOST, origin: ORIGIN, token: TOKEN });
+  {
+    const saved = dbQueries.getSetting("features");
+    if (saved) {
+      try {
+        const obj = JSON.parse(saved);
+        const patch = {};
+        if (obj.mcp === false)
+          patch.mcp = false;
+        if (obj.proxy === false)
+          patch.proxy = false;
+        if (obj.ai === false)
+          patch.ai = false;
+        if (Object.keys(patch).length)
+          setFeatures(patch);
+      } catch {}
+    }
+  }
   setFeatures({
-    mcp: !values["no-mcp"],
-    proxy: !values["no-proxy"],
-    ai: !values["no-ai"],
+    ...values["no-mcp"] ? { mcp: false } : {},
+    ...values["no-proxy"] ? { proxy: false } : {},
+    ...values["no-ai"] ? { ai: false } : {},
     readonly: !!values.readonly
   });
   if (bgNow) {
@@ -5980,6 +7051,7 @@ async function run2(overrideOpts) {
       specVersion = state.spec.version;
       endpointCount = state.operations.length;
       spinner.stop();
+      dbQueries.upsertSpec(specUrl, specTitle ?? null, specVersion ?? null, endpointCount);
     } catch (e) {
       spinner.stop("\u2717", `Failed to load spec: ${e instanceof Error ? e.message : String(e)}`, "red");
     }
@@ -6002,6 +7074,8 @@ async function run2(overrideOpts) {
         if (req.method === "OPTIONS") {
           return new Response(null, { status: 204, headers: CORS_HEADERS });
         }
+        if (pathname.startsWith("/c/"))
+          return captureHandler(req);
         if (!isAuthorized(req)) {
           return new Response(JSON.stringify({ error: "Unauthorized: pass Authorization: Bearer <token> or ?token=" }), {
             status: 401,
@@ -6092,127 +7166,129 @@ async function run2(overrideOpts) {
 function attachKeyboard(opts) {
   const ctx = { specUrl: opts.specUrl, PORT: opts.PORT, tailOff: null };
   let isReloading = false;
-  let cmdBuf = null;
-  process.stdin.setRawMode(true);
-  process.stdin.resume();
-  process.stdin.setEncoding("utf8");
-  const spinner = new Spinner;
+  const repl = new Repl;
+  const buildStatus = () => {
+    const state = hasState() ? getState() : null;
+    const f = getFeatures();
+    const cfg = getServerConfig();
+    const active = dbQueries.getActiveProfile();
+    const parts = [];
+    if (state) {
+      parts.push(`${state.spec.title} v${state.spec.version} \xB7 ${state.operations.length} ep`);
+    } else {
+      parts.push("no spec");
+    }
+    parts.push(`:${ctx.PORT}`);
+    const flags = [];
+    if (!f.mcp)
+      flags.push("mcp:off");
+    if (!f.proxy)
+      flags.push("proxy:off");
+    if (!f.ai)
+      flags.push("ai:off");
+    if (f.readonly)
+      flags.push("readonly:on");
+    if (flags.length)
+      parts.push(flags.join(" "));
+    parts.push(`auth:${active ? active.name : "none"}`);
+    if (cfg.token)
+      parts.push("token:set");
+    if (ctx.tailOff)
+      parts.push("tail:on");
+    return parts.join("  \xB7  ");
+  };
+  const refreshStatus = () => repl.setStatus(buildStatus());
+  const refreshAuthSuggestions = () => {
+    const profiles = dbQueries.getProfiles();
+    repl.setDynamicSuggestions(profiles.map((p) => ({
+      value: `auth use ${p.name}`,
+      label: p.name,
+      desc: p.type
+    })));
+  };
   const reload = async () => {
     if (isReloading)
       return;
-    process.stdout.write(`
-`);
     if (!ctx.specUrl) {
-      console.log(`  ${paint.yellow("\u25CB")}  No spec URL \u2014 use /spec <url> or start with --url <url>`);
-      console.log();
+      console.log(`
+  ${paint.yellow("\u25CB")}  No spec URL \u2014 use /spec <url>
+`);
       return;
     }
     isReloading = true;
-    spinner.start(`Reloading spec\u2026`);
+    let fi = 0;
+    const base = buildStatus();
+    const spinTimer = setInterval(() => {
+      repl.setStatus(`${SPIN_FRAMES[fi++ % SPIN_FRAMES.length]}  Reloading\u2026  \xB7  ${base}`);
+    }, 80);
     try {
       const state = await loadSpec(ctx.specUrl);
-      spinner.stop("\u2713", `${paint.bold(state.spec.title)}  ${paint.dim("v" + state.spec.version)}  ${paint.dim("\xB7")}  ${paint.green(state.operations.length + " endpoints")}`, "green");
+      clearInterval(spinTimer);
+      dbQueries.upsertSpec(ctx.specUrl, state.spec.title, state.spec.version, state.operations.length);
+      console.log(`  ${paint.green("\u2713")}  ${paint.bold(state.spec.title)}  ${paint.dim("v" + state.spec.version)}  \xB7  ${paint.green(state.operations.length + " endpoints")}
+`);
     } catch (e) {
-      spinner.stop("\u2717", `Reload failed: ${e instanceof Error ? e.message : String(e)}`, "red");
+      clearInterval(spinTimer);
+      console.log(`  ${paint.red("\u2717")}  Reload failed: ${e instanceof Error ? e.message : String(e)}
+`);
     } finally {
       isReloading = false;
+      refreshStatus();
     }
-    console.log();
   };
-  const printPrompt = () => process.stdout.write(`\r\x1B[K  ${paint.cyan("\u276F")} ${cmdBuf}`);
-  process.stdin.on("data", async (chunk) => {
-    if (chunk.startsWith("\x1B") && chunk.length > 1)
-      return;
-    for (const key of chunk)
-      await handleKey(key);
-  });
-  const handleKey = async (key) => {
-    if (key === "\x03") {
-      if (cmdBuf !== null) {
-        cmdBuf = null;
-        process.stdout.write("\r\x1B[K");
-        return;
-      }
-      process.emit("SIGINT");
-      return;
-    }
-    if (cmdBuf !== null) {
-      if (key === "\x1B") {
-        cmdBuf = null;
-        process.stdout.write("\r\x1B[K");
-        return;
-      }
-      if (key === "\x7F" || key === "\b") {
-        cmdBuf = cmdBuf.slice(0, -1);
-        if (!cmdBuf) {
-          cmdBuf = null;
-          process.stdout.write("\r\x1B[K");
+  const handler = async (input) => {
+    const cmd = input.trim();
+    if (cmd.length === 1) {
+      switch (cmd.toLowerCase()) {
+        case "r":
+          await reload();
           return;
-        }
-        printPrompt();
-        return;
-      }
-      if (key === "\r" || key === `
-`) {
-        const cmd = cmdBuf;
-        cmdBuf = null;
-        process.stdout.write("\r\x1B[K");
-        await runSlashCommand(cmd, ctx, reload);
-        return;
-      }
-      const printable = key.replace(/[^\x20-\x7E]/g, "");
-      if (printable) {
-        cmdBuf += printable;
-        printPrompt();
-      }
-      return;
-    }
-    if (key === "/") {
-      cmdBuf = "/";
-      printPrompt();
-      return;
-    }
-    switch (key.toLowerCase()) {
-      case "r":
-        await reload();
-        break;
-      case "b": {
-        process.stdin.setRawMode(false);
-        process.stdin.pause();
-        process.on("SIGHUP", () => {});
-        console.log(`
-  ${paint.green("\u2713")}  Detached  ${paint.dim(`PID ${process.pid}`)}`);
-        console.log(`  ${paint.dim("\u279C")}  ${paint.dim("wasper status")}  ${paint.dim("\xB7")}  ${paint.dim("wasper stop")}
+        case "s":
+          printInlineStatus(ctx);
+          return;
+        case "q":
+          process.emit("SIGINT");
+          return;
+        case "h":
+        case "?":
+          printInteractiveHelp();
+          return;
+        case "b": {
+          repl.stop();
+          process.on("SIGHUP", () => {});
+          console.log(`
+  ${paint.green("\u2713")}  Detached  ${paint.dim("PID " + process.pid)}`);
+          console.log(`  ${paint.dim("\u279C")}  ${paint.dim("wasper status")}  ${paint.dim("\xB7")}  ${paint.dim("wasper stop")}
 `);
-        break;
+          return;
+        }
       }
-      case "s":
-        printInlineStatus(ctx);
-        break;
-      case "?":
-      case "h":
-        printInteractiveHelp();
-        break;
-      case "q":
-        process.emit("SIGINT");
-        break;
     }
+    const slashCmd = cmd.startsWith("/") ? cmd : `/${cmd}`;
+    await runSlashCommand(slashCmd, ctx, reload);
+    refreshStatus();
+    refreshAuthSuggestions();
   };
+  refreshAuthSuggestions();
+  repl.setStatus(buildStatus());
+  repl.start(handler);
 }
 function printInlineStatus(ctx) {
   const state = hasState() ? getState() : null;
   const f = getFeatures();
   const cfg = getServerConfig();
-  const flag = (on) => on ? paint.green("on") : paint.red("off");
+  const on = (v) => v ? paint.green("on") : paint.dim("off");
+  const dot = paint.dim("\xB7");
   console.log(`
-  ${paint.dim("\u25CF")}  ${paint.bold("OpenAPI Agent")}  PID ${process.pid}  port ${ctx.PORT}`);
+  ${paint.green("\u25CF")}  ${paint.bold("wasper")}  ${paint.dim("PID " + process.pid)}  ${dot}  ${paint.dim(":" + ctx.PORT)}`);
   if (state) {
-    console.log(`     ${paint.bold(state.spec.title)} v${state.spec.version} \xB7 ${state.operations.length} endpoints`);
+    console.log(`     ${paint.bold(state.spec.title)}  ${paint.dim("v" + state.spec.version)}  ${dot}  ${paint.green(state.operations.length + " endpoints")}`);
+  } else {
+    console.log(`     ${paint.dim("no spec loaded")}`);
   }
-  console.log(`     mcp ${flag(f.mcp)}  ${paint.dim("\xB7")}  proxy ${flag(f.proxy)}  ${paint.dim("\xB7")}  ai ${flag(f.ai)}  ${paint.dim("\xB7")}  readonly ${flag(f.readonly)}  ${paint.dim("\xB7")}  token ${cfg.token ? paint.green("set") : paint.dim("none")}`);
+  console.log(`     mcp ${on(f.mcp)}  ${dot}  proxy ${on(f.proxy)}  ${dot}  ai ${on(f.ai)}  ${dot}  readonly ${on(f.readonly)}  ${dot}  token ${cfg.token ? paint.green("set") : paint.dim("none")}`);
   const active = dbQueries.getActiveProfile();
-  if (active)
-    console.log(`     auth role: ${paint.bold(active.name)} ${paint.dim(`(${active.type})`)}`);
+  console.log(`     auth ${active ? paint.bold(active.name) + "  " + paint.dim("(" + active.type + ")") : paint.dim("none")}`);
   console.log();
 }
 async function runSlashCommand(input, ctx, reload) {
@@ -6224,6 +7300,7 @@ async function runSlashCommand(input, ctx, reload) {
     const cur = getFeatures()[name];
     const next = arg === "on" ? true : arg === "off" ? false : !cur;
     setFeatures({ [name]: next });
+    persistAndBroadcastFeatures();
     console.log(`  ${next ? paint.green("\u2713") : paint.yellow("\u25CB")}  ${label} ${next ? paint.green("enabled") : paint.yellow("disabled")}
 `);
   };
@@ -6368,40 +7445,48 @@ async function runSlashCommand(input, ctx, reload) {
   }
 }
 function printInteractiveHelp() {
+  const k = (s) => paint.bold(s);
+  const d = (s) => paint.dim(s);
+  const hr = d("\u2500".repeat(50));
   console.log(`
-  ${paint.bold("Keys")}
-  ${paint.dim("\u2500".repeat(46))}
-  ${paint.bold("r")}   Hot-reload OpenAPI spec from URL
-  ${paint.bold("s")}   Print current status
-  ${paint.bold("b")}   Detach to background (survive terminal close)
-  ${paint.bold("q")}   Quit gracefully
-  ${paint.bold("/")}   Type a slash command  ${paint.dim("(Esc cancels)")}
+  ${paint.bold("Keys")}  ${d("(when input is empty)")}
+  ${hr}
+  ${k("r")}   Hot-reload spec          ${k("b")}   Detach to background
+  ${k("s")}   Print status             ${k("q")}   Quit
+  ${k("/")}   Start a command          ${k("?")}   This help
+
+  ${d("\u2191 / \u2193")} cycle command history  \xB7  ${d("\u2192 or Tab")} accept autocomplete
+  ${d("Ctrl+L")} clear screen  \xB7  ${d("Ctrl+U")} clear input  \xB7  ${d("Esc")} cancel
 
   ${paint.bold("Slash commands")}
-  ${paint.dim("\u2500".repeat(46))}
-  ${paint.bold("/mcp")} ${paint.dim("[on|off]")}        Toggle the MCP endpoint
-  ${paint.bold("/proxy")} ${paint.dim("[on|off]")}      Toggle the HTTP proxy
-  ${paint.bold("/ai")} ${paint.dim("[on|off]")}         Toggle the AI chat endpoint
-  ${paint.bold("/readonly")} ${paint.dim("[on|off]")}   Block non-GET upstream requests
-  ${paint.bold("/auth")}                List auth roles
-  ${paint.bold("/auth use")} ${paint.dim("<name>")}     Switch active auth role
-  ${paint.bold("/auth none")}           Disable auth
-  ${paint.bold("/token")} ${paint.dim("[new|off|<v>]")} Show / rotate / set the access token
-  ${paint.bold("/spec")} ${paint.dim("<url>")}          Load a different OpenAPI spec
-  ${paint.bold("/tail")} ${paint.dim("[on|off]")}       Live request log in this terminal
-  ${paint.bold("/open")}                Open the studio in a browser
-  ${paint.bold("/status")} ${paint.dim("\xB7")} ${paint.bold("/reload")} ${paint.dim("\xB7")} ${paint.bold("/help")} ${paint.dim("\xB7")} ${paint.bold("/quit")}
+  ${hr}
+  ${k("/spec")} ${d("<url>")}          Load a different OpenAPI spec
+  ${k("/mcp")} ${d("[on|off]")}        Toggle the MCP endpoint
+  ${k("/proxy")} ${d("[on|off]")}      Toggle the HTTP proxy
+  ${k("/ai")} ${d("[on|off]")}         Toggle the AI chat endpoint
+  ${k("/readonly")} ${d("[on|off]")}   Block non-GET upstream requests
+  ${k("/auth")}                List saved auth profiles
+  ${k("/auth use")} ${d("<name>")}     Switch active auth profile
+  ${k("/auth none")}           Disable auth
+  ${k("/token")} ${d("[new|off|<v>]")} Show / rotate / set the access token
+  ${k("/tail")} ${d("[on|off]")}       Live request log in this terminal
+  ${k("/open")}                Open the studio in a browser
+  ${k("/update")}              Update wasper to the latest version
+  ${k("/status")}  ${k("/reload")}  ${k("/help")}  ${k("/quit")}
 `);
 }
 function printHelp() {
   console.log(`
 Usage: wasper [start] [options]
 
-  openapi-agent [--url <spec-url>] [--port <port>]   Start in foreground
+  wasper [--url <spec-url>] [--port <port>]    Start in foreground (auto-resumes last spec)
   wasper start --background                   Start in background
   wasper stop                                 Stop background server
   wasper status                               Show server status
   wasper reload                               Hot-reload the spec
+  wasper ls                                   List saved specs (history)
+  wasper use <number|url>                     Start with a saved spec
+  wasper rm  <number|url>                     Remove a spec from history
 
 Options:
   --url, -u        OpenAPI spec URL or local path
@@ -6520,9 +7605,11 @@ async function runFirstTimeSetup(port, origin) {
   ${paint.dim("Skip future prompts: set WASPER_NO_FIRST_RUN=1")}
 `);
 }
+var SPIN_FRAMES;
 var init_start = __esm(() => {
   init_server();
   init_handler();
+  init_capture();
   init_routes();
   init_bus();
   init_db();
@@ -6531,6 +7618,9 @@ var init_start = __esm(() => {
   init_config();
   init_update();
   init_ui();
+  init_repl();
+  init_routes();
+  SPIN_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 });
 
 // index.ts