xray-code 0.1.0

package/dist/auth.d.ts

@@ -0,0 +1,21 @@
+/**
+ * GitHub Device Flow authentication for XRay CLI.
+ *
+ * Flow:
+ *   1. POST /login/device/code → get device_code + user_code
+ *   2. User visits github.com/login/device, enters user_code
+ *   3. CLI polls /login/oauth/access_token until authorized
+ *   4. Token saved to ~/.xray/credentials.json
+ */
+export interface XRayCredentials {
+    access_token: string;
+    token_type: string;
+    scope: string;
+    refresh_token?: string;
+    expires_at?: string;
+    github_user?: string;
+    created_at: string;
+}
+export declare function loadCredentials(): XRayCredentials | null;
+export declare function login(): Promise<XRayCredentials>;
+export declare function logout(): void;

package/dist/auth.js

@@ -0,0 +1,166 @@
+"use strict";
+/**
+ * GitHub Device Flow authentication for XRay CLI.
+ *
+ * Flow:
+ *   1. POST /login/device/code → get device_code + user_code
+ *   2. User visits github.com/login/device, enters user_code
+ *   3. CLI polls /login/oauth/access_token until authorized
+ *   4. Token saved to ~/.xray/credentials.json
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadCredentials = loadCredentials;
+exports.login = login;
+exports.logout = logout;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
+const CLIENT_ID = "Iv23liunw4hec3mnVMwB";
+const GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
+const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
+const SCOPES = "repo";
+function credentialsPath() {
+    return (0, node_path_1.join)((0, node_os_1.homedir)(), ".xray", "credentials.json");
+}
+function loadCredentials() {
+    const path = credentialsPath();
+    if (!(0, node_fs_1.existsSync)(path))
+        return null;
+    try {
+        const creds = JSON.parse((0, node_fs_1.readFileSync)(path, "utf-8"));
+        // Check if expired
+        if (creds.expires_at && new Date(creds.expires_at) < new Date()) {
+            return null; // TODO: implement refresh
+        }
+        return creds;
+    }
+    catch {
+        return null;
+    }
+}
+function saveCredentials(creds) {
+    const dir = (0, node_path_1.join)((0, node_os_1.homedir)(), ".xray");
+    if (!(0, node_fs_1.existsSync)(dir))
+        (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    (0, node_fs_1.writeFileSync)(credentialsPath(), JSON.stringify(creds, null, 2), { mode: 0o600 });
+}
+async function requestDeviceCode() {
+    const res = await fetch(GITHUB_DEVICE_CODE_URL, {
+        method: "POST",
+        headers: {
+            "Accept": "application/json",
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ client_id: CLIENT_ID, scope: SCOPES }),
+    });
+    if (!res.ok) {
+        throw new Error(`GitHub device code request failed: ${res.status} ${res.statusText}`);
+    }
+    return res.json();
+}
+async function pollForToken(deviceCode, interval) {
+    const pollInterval = Math.max(interval, 5) * 1000; // GitHub minimum 5s
+    while (true) {
+        await new Promise(resolve => setTimeout(resolve, pollInterval));
+        const res = await fetch(GITHUB_TOKEN_URL, {
+            method: "POST",
+            headers: {
+                "Accept": "application/json",
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                client_id: CLIENT_ID,
+                device_code: deviceCode,
+                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+            }),
+        });
+        const data = await res.json();
+        if (data.access_token) {
+            return data;
+        }
+        if (data.error === "authorization_pending") {
+            process.stdout.write(".");
+            continue;
+        }
+        if (data.error === "slow_down") {
+            // GitHub wants us to slow down, add 5s
+            await new Promise(resolve => setTimeout(resolve, 5000));
+            continue;
+        }
+        if (data.error === "expired_token") {
+            throw new Error("Device code expired. Please try again.");
+        }
+        if (data.error === "access_denied") {
+            throw new Error("Authorization was denied.");
+        }
+        throw new Error(`Unexpected error: ${data.error} — ${data.error_description}`);
+    }
+}
+async function fetchGitHubUser(token) {
+    const res = await fetch("https://api.github.com/user", {
+        headers: {
+            "Authorization": `Bearer ${token}`,
+            "Accept": "application/json",
+        },
+    });
+    if (!res.ok)
+        return "unknown";
+    const data = await res.json();
+    return data.login;
+}
+async function login() {
+    // Check existing credentials
+    const existing = loadCredentials();
+    if (existing) {
+        console.log(`Already logged in as @${existing.github_user || "unknown"}`);
+        console.log("Use 'xray logout' to sign out first.");
+        return existing;
+    }
+    console.log("\n  XRay Code Intelligence — GitHub Login\n");
+    // Step 1: Get device code
+    const device = await requestDeviceCode();
+    // Step 2: Show user instructions
+    console.log(`  1. Open:  ${device.verification_uri}`);
+    console.log(`  2. Enter: ${device.user_code}\n`);
+    // Try to open browser automatically
+    try {
+        const { exec } = await import("node:child_process");
+        exec(`open "${device.verification_uri}"`);
+    }
+    catch {
+        // Ignore — user can open manually
+    }
+    // Step 3: Poll for authorization
+    process.stdout.write("  Waiting for authorization");
+    const token = await pollForToken(device.device_code, device.interval);
+    console.log(" done!\n");
+    // Step 4: Fetch user info
+    const username = await fetchGitHubUser(token.access_token);
+    console.log(`  Logged in as @${username}\n`);
+    // Step 5: Save credentials
+    const creds = {
+        access_token: token.access_token,
+        token_type: token.token_type || "bearer",
+        scope: token.scope || SCOPES,
+        refresh_token: token.refresh_token,
+        expires_at: token.expires_in
+            ? new Date(Date.now() + token.expires_in * 1000).toISOString()
+            : undefined,
+        github_user: username,
+        created_at: new Date().toISOString(),
+    };
+    saveCredentials(creds);
+    console.log(`  Credentials saved to ${credentialsPath()}`);
+    return creds;
+}
+function logout() {
+    const path = credentialsPath();
+    if ((0, node_fs_1.existsSync)(path)) {
+        const { unlinkSync } = require("node:fs");
+        unlinkSync(path);
+        console.log("Logged out. Credentials removed.");
+    }
+    else {
+        console.log("Not logged in.");
+    }
+}

package/dist/cli.d.ts

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+/**
+ * xray — Code intelligence CLI.
+ * X-ray your codebase with instant cross-references.
+ *
+ * Usage:
+ *   xray login                    Authenticate with GitHub
+ *   xray logout                   Remove stored credentials
+ *   xray init [filter]            Set up a repo for code intelligence
+ *   xray search <query>           Fuzzy search for symbols
+ *   xray who-uses <symbol>        Find all usages of a symbol
+ *   xray impact <symbol>          What breaks if I change this?
+ *   xray symbols-in <file>        List symbols defined in a file
+ *   xray health                   Check server status
+ */
+export {};

package/dist/cli.js

@@ -0,0 +1,245 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * xray — Code intelligence CLI.
+ * X-ray your codebase with instant cross-references.
+ *
+ * Usage:
+ *   xray login                    Authenticate with GitHub
+ *   xray logout                   Remove stored credentials
+ *   xray init [filter]            Set up a repo for code intelligence
+ *   xray search <query>           Fuzzy search for symbols
+ *   xray who-uses <symbol>        Find all usages of a symbol
+ *   xray impact <symbol>          What breaks if I change this?
+ *   xray symbols-in <file>        List symbols defined in a file
+ *   xray health                   Check server status
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const commander_1 = require("commander");
+const auth_js_1 = require("./auth.js");
+const onboard_js_1 = require("./onboard.js");
+const client_js_1 = require("./client.js");
+const program = new commander_1.Command()
+    .name("xray")
+    .description("X-ray your codebase — instant cross-references and impact analysis")
+    .version("0.1.0");
+// ─── Auth commands ──────────────────────────────────────────────
+program
+    .command("login")
+    .description("Authenticate with GitHub via device flow")
+    .action(async () => {
+    try {
+        await (0, auth_js_1.login)();
+    }
+    catch (e) {
+        console.error(`Login failed: ${e}`);
+        process.exit(1);
+    }
+});
+program
+    .command("logout")
+    .description("Remove stored credentials")
+    .action(() => (0, auth_js_1.logout)());
+// ─── Activate ───────────────────────────────────────────────────
+program
+    .command("activate <invite-code>")
+    .description("Activate XRay with an invite code")
+    .action(async (inviteCode) => {
+    const { existsSync, mkdirSync, writeFileSync, readFileSync } = await import("node:fs");
+    const { join } = await import("node:path");
+    const { homedir } = await import("node:os");
+    console.log(`\n  Validating invite code...`);
+    // Redeem invite code via server
+    try {
+        const res = await fetch("https://xray.proven.dev/api/v1/redeem", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ code: inviteCode.trim().toUpperCase() }),
+        });
+        if (!res.ok) {
+            // Fallback: check local invite file (for offline/testing)
+            const localPath = join(homedir(), ".xray", "invites.json");
+            if (existsSync(localPath)) {
+                const invites = JSON.parse(readFileSync(localPath, "utf-8"));
+                const entry = invites[inviteCode.trim().toUpperCase()];
+                if (entry) {
+                    const dir = join(homedir(), ".xray");
+                    if (!existsSync(dir))
+                        mkdirSync(dir, { recursive: true });
+                    writeFileSync(join(dir, "config.json"), JSON.stringify({ server: entry.server, apiKey: entry.apiKey }, null, 2), { mode: 0o600 });
+                    console.log(`  XRay activated!`);
+                    console.log(`  Config saved to ~/.xray/config.json\n`);
+                    const client = new client_js_1.XRayClient(entry.server, entry.apiKey);
+                    const health = await client.health();
+                    console.log(`  Connected: ${health.symbols.toLocaleString()} symbols, ${health.uses.toLocaleString()} refs`);
+                    console.log(`  You're good to go! Try: xray search <symbol>\n`);
+                    return;
+                }
+            }
+            console.error(`  Invalid invite code. Check your code and try again.\n`);
+            process.exit(1);
+        }
+        const data = await res.json();
+        const dir = join(homedir(), ".xray");
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        writeFileSync(join(dir, "config.json"), JSON.stringify({ server: data.server, apiKey: data.api_key }, null, 2), { mode: 0o600 });
+        console.log(`  XRay activated!`);
+        console.log(`  Config saved to ~/.xray/config.json`);
+        console.log(`  Space: ${data.space}\n`);
+        const client = new client_js_1.XRayClient(data.server, data.api_key);
+        const health = await client.health();
+        console.log(`  Connected: ${health.symbols.toLocaleString()} symbols, ${health.uses.toLocaleString()} refs`);
+        console.log(`  You're good to go! Try: xray search <symbol>\n`);
+    }
+    catch (e) {
+        console.error(`  Activation failed: ${e}\n`);
+        process.exit(1);
+    }
+});
+// ─── Onboarding ─────────────────────────────────────────────────
+program
+    .command("init [filter]")
+    .description("Set up a repo for XRay code intelligence")
+    .action(async (filter) => {
+    try {
+        await (0, onboard_js_1.onboard)(filter);
+    }
+    catch (e) {
+        console.error(`Setup failed: ${e}`);
+        process.exit(1);
+    }
+});
+// ─── Query commands ─────────────────────────────────────────────
+function getClient(opts) {
+    return new client_js_1.XRayClient(opts.server, opts.key);
+}
+function queryOpts(cmd) {
+    return cmd
+        .option("--server <url>", "Server URL (env: XRAY_SERVER)")
+        .option("--key <key>", "API key (env: XRAY_API_KEY)");
+}
+queryOpts(program
+    .command("search <query>")
+    .description("Fuzzy search for symbols across the codebase")
+    .option("-n, --limit <n>", "Max results", "10")
+    .option("--json", "Output as JSON"))
+    .action(async (query, opts) => {
+    try {
+        const client = getClient(opts);
+        const res = await client.search(query, parseInt(opts.limit));
+        if (opts.json) {
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        if (res.count === 0) {
+            console.log(`No symbols matching '${query}'`);
+            return;
+        }
+        console.log(`\n  ${res.count} symbols matching '${query}':\n`);
+        res.results.forEach((r) => {
+            console.log(`    ${r.name.padEnd(40)} ${r.file}:${r.line}`);
+        });
+        console.log("");
+    }
+    catch (e) {
+        console.error(`Search failed: ${e}`);
+        process.exit(1);
+    }
+});
+queryOpts(program
+    .command("who-uses <symbol>")
+    .description("Find all usages of a symbol across the codebase")
+    .option("-n, --limit <n>", "Max results", "20")
+    .option("--json", "Output as JSON"))
+    .action(async (symbol, opts) => {
+    try {
+        const client = getClient(opts);
+        const res = await client.whoUses(symbol, parseInt(opts.limit));
+        if (opts.json) {
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        if (res.count === 0) {
+            console.log(`No usages found for '${symbol}'`);
+            return;
+        }
+        console.log(`\n  ${res.count} usages of '${symbol}':\n`);
+        res.hits.forEach((h) => {
+            console.log(`    ${h.source_file}:${h.source_line} (${h.symbol_name})`);
+        });
+        console.log("");
+    }
+    catch (e) {
+        console.error(`Query failed: ${e}`);
+        process.exit(1);
+    }
+});
+queryOpts(program
+    .command("impact <symbol>")
+    .description("What breaks if I change this symbol?")
+    .option("--json", "Output as JSON"))
+    .action(async (symbol, opts) => {
+    try {
+        const client = getClient(opts);
+        const res = await client.impact(symbol);
+        if (opts.json) {
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        console.log(JSON.stringify(res, null, 2));
+    }
+    catch (e) {
+        console.error(`Impact analysis failed: ${e}`);
+        process.exit(1);
+    }
+});
+queryOpts(program
+    .command("symbols-in <file>")
+    .description("List all symbols defined in a file")
+    .option("--json", "Output as JSON"))
+    .action(async (file, opts) => {
+    try {
+        const client = getClient(opts);
+        const res = await client.symbolsIn(file);
+        if (opts.json) {
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        if (res.count === 0) {
+            console.log(`No symbols found in '${file}'`);
+            return;
+        }
+        console.log(`\n  ${res.count} symbols in ${file}:\n`);
+        res.symbols.forEach((s) => {
+            console.log(`    :${String(s.line).padStart(5)}  ${s.name} (${s.kind})`);
+        });
+        console.log("");
+    }
+    catch (e) {
+        console.error(`Query failed: ${e}`);
+        process.exit(1);
+    }
+});
+queryOpts(program
+    .command("health")
+    .description("Check XRay server status"))
+    .action(async (opts) => {
+    try {
+        const client = getClient(opts);
+        const res = await client.health();
+        console.log(`\n  XRay Server Status`);
+        console.log(`  ──────────────────────`);
+        console.log(`  Status:  ${res.status}`);
+        console.log(`  Symbols: ${res.symbols.toLocaleString()}`);
+        console.log(`  Refs:    ${res.uses.toLocaleString()}`);
+        console.log(`  Files:   ${res.files.toLocaleString()}`);
+        console.log(`  Stale:   ${res.stale ? "YES — rebuild recommended" : "no"}`);
+        console.log("");
+    }
+    catch (e) {
+        console.error(`Health check failed: ${e}`);
+        process.exit(1);
+    }
+});
+program.parse();

package/dist/client.d.ts

@@ -0,0 +1,36 @@
+/**
+ * XRay API client — queries the foxref server.
+ */
+export declare class XRayClient {
+    private server;
+    private apiKey;
+    constructor(server?: string, apiKey?: string);
+    private request;
+    health(): Promise<{
+        status: string;
+        symbols: number;
+        uses: number;
+        files: number;
+        stale: boolean;
+    }>;
+    search(query: string, limit?: number): Promise<{
+        query: string;
+        count: number;
+        results: Array<{
+            name: string;
+            file: string;
+            line: number;
+        }>;
+    }>;
+    whoUses(symbol: string, limit?: number): Promise<{
+        symbol: string;
+        count: number;
+        hits: unknown[];
+    }>;
+    impact(symbol: string): Promise<unknown>;
+    symbolsIn(file: string): Promise<{
+        file: string;
+        count: number;
+        symbols: unknown[];
+    }>;
+}

package/dist/client.js

@@ -0,0 +1,70 @@
+"use strict";
+/**
+ * XRay API client — queries the foxref server.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XRayClient = void 0;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
+function loadProjectConfig() {
+    // Check .xray/config.json in cwd first, then home
+    for (const base of [process.cwd(), (0, node_os_1.homedir)()]) {
+        const path = (0, node_path_1.join)(base, ".xray", "config.json");
+        if ((0, node_fs_1.existsSync)(path)) {
+            try {
+                return JSON.parse((0, node_fs_1.readFileSync)(path, "utf-8"));
+            }
+            catch {
+                continue;
+            }
+        }
+    }
+    return {};
+}
+class XRayClient {
+    server;
+    apiKey;
+    constructor(server, apiKey) {
+        const config = loadProjectConfig();
+        this.server = server
+            || process.env.XRAY_SERVER
+            || config.server
+            || "https://xray.proven.dev";
+        this.apiKey = apiKey
+            || process.env.XRAY_API_KEY
+            || config.apiKey
+            || "";
+    }
+    async request(path, params = {}) {
+        const url = new URL(`/api/v1${path}`, this.server);
+        for (const [k, v] of Object.entries(params)) {
+            url.searchParams.set(k, v);
+        }
+        const headers = { "Accept": "application/json" };
+        if (this.apiKey) {
+            headers["X-FoxRef-Key"] = this.apiKey;
+        }
+        const res = await fetch(url.toString(), { headers });
+        if (!res.ok) {
+            throw new Error(`XRay API error: ${res.status} ${res.statusText}`);
+        }
+        return res.json();
+    }
+    async health() {
+        return this.request("/health");
+    }
+    async search(query, limit = 10) {
+        return this.request("/search", { q: query, limit: String(limit) });
+    }
+    async whoUses(symbol, limit = 20) {
+        return this.request("/who-uses", { symbol, limit: String(limit) });
+    }
+    async impact(symbol) {
+        return this.request("/impact", { symbol });
+    }
+    async symbolsIn(file) {
+        return this.request("/symbols-in", { file });
+    }
+}
+exports.XRayClient = XRayClient;

package/dist/onboard.d.ts

@@ -0,0 +1,6 @@
+/**
+ * XRay onboarding — clone a repo, build the index, provision the endpoint.
+ *
+ * Called by `xray init` after authentication.
+ */
+export declare function onboard(repoFilter?: string): Promise<void>;

package/dist/onboard.js

@@ -0,0 +1,217 @@
+"use strict";
+/**
+ * XRay onboarding — clone a repo, build the index, provision the endpoint.
+ *
+ * Called by `xray init` after authentication.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.onboard = onboard;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
+const auth_js_1 = require("./auth.js");
+const progress_js_1 = require("./progress.js");
+async function fetchRepos(token) {
+    const repos = [];
+    let page = 1;
+    while (true) {
+        const res = await fetch(`https://api.github.com/user/repos?per_page=100&page=${page}&sort=updated&affiliation=owner,collaborator,organization_member`, {
+            headers: {
+                Authorization: `Bearer ${token}`,
+                Accept: "application/json",
+            },
+        });
+        if (!res.ok)
+            break;
+        const data = (await res.json());
+        if (data.length === 0)
+            break;
+        repos.push(...data);
+        page++;
+        if (data.length < 100)
+            break;
+    }
+    return repos;
+}
+function promptSelect(items) {
+    return new Promise((resolve) => {
+        const readline = require("node:readline");
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        rl.question("\n  Select repo number: ", (answer) => {
+            rl.close();
+            const idx = parseInt(answer, 10) - 1;
+            resolve(idx >= 0 && idx < items.length ? idx : -1);
+        });
+    });
+}
+function cloneRepo(url, dest, token) {
+    // Inject token into HTTPS URL for private repos
+    const authedUrl = url.replace("https://", `https://x-access-token:${token}@`);
+    (0, node_child_process_1.execSync)(`git clone --depth 1 "${authedUrl}" "${dest}"`, {
+        stdio: ["pipe", "pipe", "pipe"],
+    });
+}
+function runCommand(cmd, args, cwd) {
+    return new Promise((resolve) => {
+        const proc = (0, node_child_process_1.spawn)(cmd, args, { cwd, stdio: ["pipe", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        proc.stdout.on("data", (d) => (stdout += d.toString()));
+        proc.stderr.on("data", (d) => (stderr += d.toString()));
+        proc.on("close", (code) => resolve({ stdout, stderr, code: code ?? 1 }));
+    });
+}
+async function onboard(repoFilter) {
+    const creds = (0, auth_js_1.loadCredentials)();
+    if (!creds) {
+        console.error("  Not logged in. Run 'xray login' first.");
+        process.exit(1);
+    }
+    console.log("\n  XRay Code Intelligence — Setup\n");
+    // ─── Step 1: List & select repo ───────────────────────────────
+    const listSpin = (0, progress_js_1.spinner)("Fetching your repositories");
+    const repos = await fetchRepos(creds.access_token);
+    listSpin.stop(`${repos.length} repos found`);
+    if (repos.length === 0) {
+        console.error("  No repositories found. Check your GitHub permissions.");
+        process.exit(1);
+    }
+    // Filter if provided
+    let filtered = repos;
+    if (repoFilter) {
+        filtered = repos.filter((r) => r.full_name.toLowerCase().includes(repoFilter.toLowerCase()));
+        if (filtered.length === 0) {
+            console.error(`  No repos matching '${repoFilter}'. Try without a filter.`);
+            process.exit(1);
+        }
+    }
+    // Show top 20
+    const shown = filtered.slice(0, 20);
+    console.log("");
+    shown.forEach((r, i) => {
+        const lang = r.language ? ` (${r.language})` : "";
+        const priv = r.private ? " [private]" : "";
+        console.log(`  ${String(i + 1).padStart(3)}. ${r.full_name}${lang}${priv}`);
+    });
+    if (filtered.length > 20) {
+        console.log(`  ... and ${filtered.length - 20} more. Use 'xray init <filter>' to narrow.`);
+    }
+    const selection = await promptSelect(shown.map((r) => r.full_name));
+    if (selection < 0) {
+        console.error("  Invalid selection.");
+        process.exit(1);
+    }
+    const repo = shown[selection];
+    console.log(`\n  Selected: ${repo.full_name}\n`);
+    // ─── Step 2: Clone ────────────────────────────────────────────
+    const repoName = (0, node_path_1.basename)(repo.full_name);
+    const cloneDir = (0, node_path_1.join)((0, node_os_1.homedir)(), "Code", repoName);
+    if ((0, node_fs_1.existsSync)(cloneDir)) {
+        console.log(`  Repo already exists at ${cloneDir} — pulling latest...`);
+        try {
+            (0, node_child_process_1.execSync)("git pull --ff-only", { cwd: cloneDir, stdio: "pipe" });
+        }
+        catch {
+            console.log("  Pull failed, using existing state.");
+        }
+    }
+    else {
+        const cloneSpin = (0, progress_js_1.spinner)(`Cloning ${repo.full_name}`);
+        try {
+            cloneRepo(repo.clone_url, cloneDir, creds.access_token);
+            cloneSpin.stop("done");
+        }
+        catch (e) {
+            cloneSpin.stop("FAILED");
+            console.error(`  Clone failed: ${e}`);
+            process.exit(1);
+        }
+    }
+    // ─── Step 3: Build codegraph references ───────────────────────
+    const space = repoName.replace(/[^a-zA-Z0-9-]/g, "-").toLowerCase();
+    console.log("");
+    const cgSpin = (0, progress_js_1.spinner)("Extracting code references (Stage 1 — may take a few minutes)");
+    const codegraphBin = (0, node_path_1.join)((0, node_os_1.homedir)(), "Code", "FoxFlow", "crates", "fox-codegraph");
+    const cgResult = await runCommand("cargo", ["run", "--", "references", cloneDir, "--space", space, "--write-db"], codegraphBin);
+    if (cgResult.code !== 0) {
+        cgSpin.stop("FAILED");
+        console.error("  Codegraph extraction failed:");
+        // Show last few lines of stderr
+        const lines = cgResult.stderr.split("\n").filter(Boolean).slice(-5);
+        lines.forEach((l) => console.error(`    ${l}`));
+        process.exit(1);
+    }
+    // Parse results from output
+    const refsMatch = cgResult.stdout.match(/Total references:\s+(\d+)/);
+    const symbolsMatch = cgResult.stdout.match(/Symbols queried:\s+(\d+)/);
+    cgSpin.stop(`${symbolsMatch?.[1] || "?"} symbols, ${refsMatch?.[1] || "?"} references`);
+    // ─── Step 4: Build foxref index ───────────────────────────────
+    const foxrefBin = (0, node_path_1.join)((0, node_os_1.homedir)(), "bin", "foxref");
+    const buildSpin = (0, progress_js_1.spinner)("Building search index (Stage 2)");
+    const buildResult = await runCommand(foxrefBin, ["build", "--space", space], cloneDir);
+    if (buildResult.code !== 0) {
+        buildSpin.stop("FAILED");
+        console.error("  Index build failed:", buildResult.stderr);
+        process.exit(1);
+    }
+    // Parse build output
+    const symCount = buildResult.stdout.match(/Symbols:\s+(\d+)/);
+    const usesCount = buildResult.stdout.match(/Uses:\s+(\d+)/);
+    buildSpin.stop(`${symCount?.[1] || "?"} symbols, ${usesCount?.[1] || "?"} cross-references`);
+    // ─── Step 5: Create snapshot ──────────────────────────────────
+    const snapSpin = (0, progress_js_1.spinner)("Creating snapshot for incremental rebuilds");
+    await runCommand(foxrefBin, ["snapshot", "--repo", ".", "--out", ".fox/foxref/snapshot.json"], cloneDir);
+    snapSpin.stop("done");
+    // ─── Step 6: Save project config ──────────────────────────────
+    const apiKey = (0, node_child_process_1.execSync)("openssl rand -hex 32").toString().trim();
+    const webhookSecret = (0, node_child_process_1.execSync)("openssl rand -hex 32").toString().trim();
+    const configDir = (0, node_path_1.join)(cloneDir, ".xray");
+    if (!(0, node_fs_1.existsSync)(configDir))
+        (0, node_fs_1.mkdirSync)(configDir, { recursive: true });
+    const projectConfig = {
+        tenant: space,
+        repo: repo.full_name,
+        hostname: `xray.proven.dev`,
+        api_key: apiKey,
+        webhook_secret: webhookSecret,
+        clone_dir: cloneDir,
+        space,
+        created_at: new Date().toISOString(),
+    };
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(configDir, "credentials.json"), JSON.stringify(projectConfig, null, 2), { mode: 0o600 });
+    // Also save as active project in ~/.xray/
+    const homeXray = (0, node_path_1.join)((0, node_os_1.homedir)(), ".xray");
+    if (!(0, node_fs_1.existsSync)(homeXray))
+        (0, node_fs_1.mkdirSync)(homeXray, { recursive: true });
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(homeXray, "config.json"), JSON.stringify({
+        server: `https://xray.proven.dev`,
+        apiKey,
+        space,
+        repoDir: cloneDir,
+    }, null, 2));
+    // ─── Summary ──────────────────────────────────────────────────
+    console.log("\n  ══════════════════════════════════════════════════");
+    console.log(`  XRay is ready for ${repo.full_name}!`);
+    console.log("  ══════════════════════════════════════════════════\n");
+    console.log(`  Endpoint:   https://xray.proven.dev/api/v1/`);
+    console.log(`  API Key:    ${apiKey}`);
+    console.log(`  Header:     X-FoxRef-Key: ${apiKey}`);
+    console.log(`  Space:      ${space}`);
+    console.log(`  Index:      ${cloneDir}/.fox/foxref/`);
+    console.log("");
+    console.log("  Quick test:");
+    console.log(`    xray search <symbol-name>`);
+    console.log(`    xray who-uses <symbol-name>`);
+    console.log(`    xray impact <symbol-name>`);
+    console.log("");
+    console.log("  To set up auto-rebuild on push, add this webhook in GitHub:");
+    console.log(`    URL:    https://xray.proven.dev/api/v1/webhook/push`);
+    console.log(`    Secret: ${webhookSecret}`);
+    console.log(`    Events: Push`);
+    console.log("");
+    // ─── Note: server setup is manual for now ─────────────────────
+    console.log("  NOTE: Server provisioning requires admin setup.");
+    console.log(`  Admin: run 'foxref-add-tenant.sh' with space='${space}' port=<next>`);
+    console.log("");
+}

package/dist/progress.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Simple terminal progress bar — zero dependencies.
+ */
+export declare class ProgressBar {
+    private label;
+    private total;
+    private current;
+    private width;
+    private startTime;
+    constructor(label: string, total?: number, width?: number);
+    update(current: number): void;
+    increment(amount?: number): void;
+    complete(message?: string): void;
+    private render;
+}
+export declare function spinner(label: string): {
+    stop: (message?: string) => void;
+};

package/dist/progress.js

@@ -0,0 +1,63 @@
+"use strict";
+/**
+ * Simple terminal progress bar — zero dependencies.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProgressBar = void 0;
+exports.spinner = spinner;
+class ProgressBar {
+    label;
+    total;
+    current;
+    width;
+    startTime;
+    constructor(label, total = 100, width = 30) {
+        this.label = label;
+        this.total = total;
+        this.current = 0;
+        this.width = width;
+        this.startTime = Date.now();
+    }
+    update(current) {
+        this.current = Math.min(current, this.total);
+        this.render();
+    }
+    increment(amount = 1) {
+        this.update(this.current + amount);
+    }
+    complete(message) {
+        this.current = this.total;
+        this.render();
+        const elapsed = ((Date.now() - this.startTime) / 1000).toFixed(1);
+        process.stdout.write(` ${elapsed}s`);
+        if (message)
+            process.stdout.write(` — ${message}`);
+        process.stdout.write("\n");
+    }
+    render() {
+        const pct = this.total > 0 ? this.current / this.total : 0;
+        const filled = Math.round(this.width * pct);
+        const empty = this.width - filled;
+        const bar = "\u2588".repeat(filled) + "\u2591".repeat(empty);
+        const pctStr = `${Math.round(pct * 100)}%`.padStart(4);
+        process.stdout.write(`\r  ${this.label.padEnd(30)} ${bar} ${pctStr}`);
+    }
+}
+exports.ProgressBar = ProgressBar;
+function spinner(label) {
+    const frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+    let i = 0;
+    const interval = setInterval(() => {
+        process.stdout.write(`\r  ${frames[i % frames.length]} ${label}`);
+        i++;
+    }, 80);
+    return {
+        stop(message) {
+            clearInterval(interval);
+            process.stdout.write(`\r  \u2713 ${label}`);
+            if (message)
+                process.stdout.write(` — ${message}`);
+            process.stdout.write("\n");
+        },
+    };
+}

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "xray-code",
+  "version": "0.1.0",
+  "description": "XRay — code intelligence CLI. X-ray your codebase with instant cross-references.",
+  "bin": {
+    "xray": "dist/cli.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx src/cli.ts"
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "commander": "^12.0.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.4.0",
+    "tsx": "^4.0.0",
+    "@types/node": "^20.0.0"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "license": "MIT",
+  "author": "Proven Dev <hello@proven.dev>"
+}