feat: add portable NexusOS CLI and packaging

management/__init__.py

@@ -0,0 +1 @@
+"""NexusOS command-line and desktop management helpers."""

management/cli.py

@@ -0,0 +1,710 @@
+"""Portable NexusOS command line used by the ``nexus`` and ``ncp`` scripts."""
+from __future__ import annotations
+
+import argparse
+import importlib.util
+import json
+import os
+import shutil
+import subprocess
+import sys
+import time
+import urllib.error
+import urllib.request
+import webbrowser
+from pathlib import Path
+from urllib.parse import urlparse
+
+from synapse import nexus_config as config
+from synapse.nexus_config import settings
+
+from . import ncp as services
+
+
+CONFIG_SCHEMA = {
+    "api_url": "url",
+    "memory_url": "url",
+    "bind_host": "text",
+    "backend_port": "port",
+    "memory_port": "port",
+    "provider": "provider",
+    "provider_url": "url",
+    "provider_timeout": "positive_int",
+    "data_dir": "path",
+    "models_dir": "path",
+    "runtime_dir": "path",
+    "memory_dir": "path",
+    "memory_db": "path",
+}
+
+LEGACY_TARGETS = {
+    "-m": "memory",
+    "--memory": "memory",
+    "-b": "backend",
+    "--backend": "backend",
+    "-f": "frontend",
+    "--frontend": "frontend",
+    "-a": "ai",
+    "--ai": "ai",
+}
+
+
+def _emit(payload, json_output: bool = False) -> None:
+    if json_output:
+        print(json.dumps(payload, indent=2, sort_keys=True))
+    elif isinstance(payload, str):
+        print(payload)
+    else:
+        for key, value in payload.items():
+            print(f"{key}: {value}")
+
+
+def _http_ok(url: str, timeout: float = 1.0) -> bool:
+    try:
+        urllib.request.urlopen(url, timeout=timeout).read(1)
+        return True
+    except urllib.error.HTTPError:
+        return True
+    except Exception:
+        return False
+
+
+def _is_termux() -> bool:
+    prefix = os.getenv("PREFIX", "")
+    return "com.termux" in prefix or bool(os.getenv("TERMUX_VERSION"))
+
+
+def _validate_config(key: str, raw: str):
+    kind = CONFIG_SCHEMA[key]
+    value = raw.strip()
+    if kind == "url":
+        parsed = urlparse(value)
+        if parsed.scheme not in ("http", "https") or not parsed.netloc:
+            raise ValueError(f"{key} must be an http(s) URL")
+        return value.rstrip("/")
+    if kind == "port":
+        number = int(value)
+        if not 1 <= number <= 65535:
+            raise ValueError(f"{key} must be between 1 and 65535")
+        return number
+    if kind == "positive_int":
+        number = int(value)
+        if number <= 0:
+            raise ValueError(f"{key} must be greater than zero")
+        return number
+    if kind == "provider":
+        if value not in ("ollama", "ollama-remote"):
+            raise ValueError("provider must be ollama or ollama-remote")
+        return value
+    if kind == "path":
+        return str(Path(value).expanduser().resolve())
+    if not value:
+        raise ValueError(f"{key} cannot be empty")
+    return value
+
+
+def cmd_init(args) -> int:
+    config.CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    copied = list(config.INITIALIZED_FILES) + config.init_state()
+    payload = {
+        "status": "initialized",
+        "state_dir": str(settings.state_dir),
+        "config_file": str(settings.config_file),
+        "data_dir": str(settings.data_dir),
+        "models_dir": str(settings.models_dir),
+        "runtime_dir": str(settings.runtime_dir),
+        "seeded_playbooks": len(copied),
+    }
+    _emit(payload, args.json)
+    return 0
+
+
+def cmd_paths(args) -> int:
+    payload = {
+        "install_mode": "checkout" if settings.source_checkout else "wheel",
+        "project_root": str(settings.project_root),
+        "resource_root": str(settings.resource_root),
+        "state_dir": str(settings.state_dir),
+        "config_file": str(settings.config_file),
+        "data_dir": str(settings.data_dir),
+        "memory_db": str(settings.memory_db),
+        "models_dir": str(settings.models_dir),
+        "runtime_dir": str(settings.runtime_dir),
+        "web_dist_dir": str(settings.web_dist_dir),
+    }
+    _emit(payload, args.json)
+    return 0
+
+
+def cmd_config(args) -> int:
+    values = config.read_user_config()
+    if args.action == "path":
+        print(config.CONFIG_FILE)
+        return 0
+    if args.action == "list":
+        _emit(values, args.json)
+        return 0
+    if args.action == "get":
+        if args.key not in CONFIG_SCHEMA:
+            print(f"Unknown configuration key: {args.key}", file=sys.stderr)
+            return 2
+        value = values.get(args.key, getattr(settings, args.key, None))
+        _emit({args.key: value}, args.json)
+        return 0
+    if args.action == "set":
+        if args.key not in CONFIG_SCHEMA:
+            print(f"Unknown configuration key: {args.key}", file=sys.stderr)
+            print("Known keys: " + ", ".join(CONFIG_SCHEMA), file=sys.stderr)
+            return 2
+        try:
+            values[args.key] = _validate_config(args.key, args.value)
+        except (TypeError, ValueError) as exc:
+            print(f"Invalid value: {exc}", file=sys.stderr)
+            return 2
+        config.write_user_config(values)
+        _emit({"updated": args.key, "value": values[args.key], "restart_required": True}, args.json)
+        return 0
+    if args.action == "unset":
+        if args.key not in CONFIG_SCHEMA:
+            print(f"Unknown configuration key: {args.key}", file=sys.stderr)
+            return 2
+        values.pop(args.key, None)
+        config.write_user_config(values)
+        _emit({"removed": args.key, "restart_required": True}, args.json)
+        return 0
+    return 2
+
+
+def _provider_payload() -> dict:
+    url = settings.ollama_host.rstrip("/")
+    return {
+        "provider": settings.provider,
+        "url": url,
+        "managed_by_nexus": settings.manage_ollama,
+        "reachable": _http_ok(url + "/api/tags", timeout=2.0),
+    }
+
+
+def cmd_provider(args) -> int:
+    if args.action == "show":
+        _emit(_provider_payload(), args.json)
+        return 0
+
+    values = config.read_user_config()
+    if args.mode == "local":
+        values["provider"] = "ollama"
+        try:
+            values["provider_url"] = _validate_config(
+                "provider_url", args.url or "http://127.0.0.1:11434"
+            )
+        except ValueError as exc:
+            print(f"Invalid value: {exc}", file=sys.stderr)
+            return 2
+    else:
+        if not args.url:
+            print("Remote provider setup requires --url", file=sys.stderr)
+            return 2
+        try:
+            values["provider_url"] = _validate_config("provider_url", args.url)
+        except ValueError as exc:
+            print(f"Invalid value: {exc}", file=sys.stderr)
+            return 2
+        values["provider"] = "ollama-remote"
+    config.write_user_config(values)
+    _emit({
+        "provider": values["provider"],
+        "url": values["provider_url"],
+        "restart_required": True,
+    }, args.json)
+    return 0
+
+
+def _check_import(module: str) -> bool:
+    return importlib.util.find_spec(module) is not None
+
+
+def _writable(path: Path) -> bool:
+    try:
+        path.mkdir(parents=True, exist_ok=True)
+        probe = path / ".nexus-write-test"
+        probe.write_text("ok", encoding="utf-8")
+        probe.unlink()
+        return True
+    except OSError:
+        return False
+
+
+def diagnostics() -> dict:
+    checks: list[dict] = []
+
+    def add(name: str, ok: bool, detail: str, required: bool = True):
+        checks.append({
+            "name": name,
+            "status": "pass" if ok else ("fail" if required else "warn"),
+            "detail": detail,
+            "required": required,
+        })
+
+    add("python", sys.version_info >= (3, 11), sys.version.split()[0])
+    add("state", _writable(settings.state_dir), str(settings.state_dir))
+    add("database directory", _writable(settings.memory_db.parent), str(settings.memory_db.parent))
+    add("web assets", (settings.web_dist_dir / "index.html").is_file(), str(settings.web_dist_dir))
+    add(
+        "provider mode",
+        settings.provider in ("ollama", "ollama-remote"),
+        settings.provider,
+    )
+    add(
+        "service ports",
+        all(1 <= port <= 65535 for port in (settings.backend_port, settings.memory_port)),
+        f"backend={settings.backend_port}, memory={settings.memory_port}",
+    )
+    for module in ("fastapi", "uvicorn", "httpx", "pydantic", "yaml"):
+        add(f"import:{module}", _check_import(module), module)
+
+    add("backend", _http_ok(settings.api_url + "/status"), settings.api_url, required=False)
+    add("memory service", _http_ok(settings.memory_url + "/"), settings.memory_url, required=False)
+    provider = _provider_payload()
+    add("provider", provider["reachable"], provider["url"], required=False)
+    if settings.manage_ollama:
+        add("ollama executable", bool(services.ollama_bin()), services.ollama_bin() or "not on PATH", required=False)
+
+    for label, module in (
+        ("process control", "psutil"),
+        ("vector search", "sqlite_vec"),
+        ("voice transcription", "faster_whisper"),
+        ("PDF documents", "pypdf"),
+        ("Word documents", "docx"),
+    ):
+        add(label, _check_import(module), module, required=False)
+
+    return {
+        "ok": not any(c["status"] == "fail" for c in checks),
+        "version": settings.version,
+        "install_mode": "checkout" if settings.source_checkout else "wheel",
+        "platform": sys.platform,
+        "termux": _is_termux(),
+        "checks": checks,
+    }
+
+
+def _doctor_fix() -> None:
+    config.CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    config.init_state()
+    index = settings.web_dist_dir / "index.html"
+    npm = shutil.which("npm.cmd" if os.name == "nt" else "npm")
+    if settings.source_checkout and not index.exists() and npm:
+        subprocess.run([npm, "run", "build"], cwd=str(settings.frontend_source_dir), check=False)
+
+
+def cmd_doctor(args) -> int:
+    if args.fix:
+        _doctor_fix()
+    result = diagnostics()
+    if args.json:
+        _emit(result, True)
+    else:
+        print(f"NexusOS {result['version']} diagnostics ({result['install_mode']})\n")
+        marks = {"pass": "OK", "warn": "WARN", "fail": "FAIL"}
+        for check in result["checks"]:
+            print(f"  {marks[check['status']]:<4} {check['name']:<20} {check['detail']}")
+        print("\nCore runtime is ready." if result["ok"] else "\nCore runtime has required failures.")
+    return 0 if result["ok"] else 1
+
+
+def service_status() -> dict:
+    payload = {}
+    for key in ("backend", "memory", "frontend"):
+        svc = services.SERVICES[key]
+        pid = services.read_pid(svc)
+        payload[key] = {
+            "running": services.alive(pid) or _http_ok(svc.url),
+            "pid": pid if services.alive(pid) else None,
+            "url": svc.url,
+        }
+    payload["provider"] = _provider_payload()
+    return payload
+
+
+def cmd_status(args) -> int:
+    payload = service_status()
+    if args.json:
+        _emit(payload, True)
+        return 0
+    print("Nexus Service Status:\n")
+    for key in ("backend", "memory", "frontend"):
+        info = payload[key]
+        suffix = f" (PID {info['pid']})" if info["pid"] else ""
+        print(f"  {key:<10} {'RUNNING' if info['running'] else 'STOPPED'}{suffix}  {info['url']}")
+    p = payload["provider"]
+    print(f"  provider   {'RUNNING' if p['reachable'] else 'STOPPED'}  {p['provider']} @ {p['url']}")
+    return 0
+
+
+def _target_flag(target: str | None):
+    return {
+        "memory": "--memory",
+        "backend": "--backend",
+        "frontend": "--frontend",
+        "ai": "--ai",
+    }.get(target or "all")
+
+
+def cmd_start(args) -> int:
+    services.cmd_start(_target_flag(args.target))
+    return 0
+
+
+def cmd_stop(args) -> int:
+    services.cmd_stop(_target_flag(args.target))
+    return 0
+
+
+def cmd_refresh(args) -> int:
+    services.cmd_stop(None)
+    services.cmd_start(None)
+    return 0
+
+
+def cmd_serve(args) -> int:
+    host = args.host or settings.bind_host
+    if host not in ("127.0.0.1", "localhost", "::1") and not args.allow_lan:
+        print("Refusing an unauthenticated LAN bind. Add --allow-lan to acknowledge the exposure.", file=sys.stderr)
+        return 2
+    if _http_ok(f"http://127.0.0.1:{args.port}/"):
+        print(f"Port {args.port} is already serving HTTP.", file=sys.stderr)
+        return 2
+
+    settings.backend_port = args.port
+    settings.memory_port = args.memory_port
+    settings.bind_host = host
+    settings.api_url = f"http://127.0.0.1:{args.port}"
+    settings.memory_url = f"http://127.0.0.1:{args.memory_port}"
+    os.environ["NEXUS_BACKEND_PORT"] = str(args.port)
+    os.environ["NEXUS_MEMORY_PORT"] = str(args.memory_port)
+    os.environ["NEXUS_BIND_HOST"] = host
+    for origin_host in ("localhost", "127.0.0.1"):
+        for port in (args.port, args.memory_port):
+            origin = f"http://{origin_host}:{port}"
+            if origin not in config.ALLOWED_ORIGINS:
+                config.ALLOWED_ORIGINS.append(origin)
+    if args.allow_lan:
+        os.environ.setdefault("NEXUS_ALLOWED_HOSTS", "*")
+        os.environ.setdefault("NEXUS_ALLOWED_ORIGINS", "*")
+        config.ALLOWED_HOSTS[:] = ["*"]
+        config.ALLOWED_ORIGINS[:] = ["*"]
+
+    memory_proc = None
+    memory_log = None
+    try:
+        if not args.no_memory and not _http_ok(settings.memory_url + "/"):
+            log_path = settings.runtime_dir / "memory.log"
+            log_path.parent.mkdir(parents=True, exist_ok=True)
+            memory_log = open(log_path, "ab")
+            memory_proc = subprocess.Popen(
+                [sys.executable, "-m", "uvicorn", "synapse.memory.service:app",
+                 "--host", host, "--port", str(args.memory_port)],
+                stdout=memory_log, stderr=subprocess.STDOUT, stdin=subprocess.DEVNULL,
+            )
+            print(f"Memory service starting on {host}:{args.memory_port} (log: {log_path})")
+        print(f"NexusOS serving on http://{host}:{args.port}")
+        import uvicorn
+        uvicorn.run(
+            "synapse.main:sio_app", host=host, port=args.port,
+            reload=bool(args.reload and settings.source_checkout),
+            log_level=args.log_level,
+        )
+    finally:
+        if memory_proc is not None and memory_proc.poll() is None:
+            memory_proc.terminate()
+            try:
+                memory_proc.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                memory_proc.kill()
+        if memory_log is not None:
+            memory_log.close()
+    return 0
+
+
+def cmd_open(args) -> int:
+    if not _http_ok(settings.api_url + "/status") and not args.no_start:
+        services.cmd_start(None)
+    url = args.url or settings.api_url
+    opener = shutil.which("termux-open-url") if _is_termux() else None
+    opened = False
+    if opener:
+        opened = subprocess.run([opener, url], check=False).returncode == 0
+    else:
+        opened = webbrowser.open(url)
+    print(f"{'Opened' if opened else 'NexusOS is available at'} {url}")
+    return 0
+
+
+def cmd_web(args) -> int:
+    """Preserve ``ncp web`` for desktop checkouts; wheels use the browser UI."""
+    if settings.source_checkout:
+        return services.cmd_web()
+    return cmd_open(argparse.Namespace(url=None, no_start=False))
+
+
+def cmd_panel(_args) -> int:
+    if not settings.source_checkout:
+        print("The legacy Tk control panel is only available in a desktop source install.", file=sys.stderr)
+        return 2
+    return services.main(["panel"])
+
+
+def cmd_backup(args) -> int:
+    if not settings.source_checkout:
+        print("Backup is a source-checkout command; wheel state should be backed up from nexus paths.", file=sys.stderr)
+        return 2
+    if args.check:
+        return services.sync_py("backup", "--check")
+    if args.full:
+        return services.sync_py("backup", "--full")
+    return services.sync_py("backup")
+
+
+def cmd_restore(args) -> int:
+    if not settings.source_checkout:
+        print("Restore is a source-checkout command; reinstall the wheel and restore its state directory.", file=sys.stderr)
+        return 2
+    return services.cmd_restore("--check" if args.check else None)
+
+
+def cmd_nvidia_reqs(_args) -> int:
+    if not settings.source_checkout:
+        print("nvidia-reqs is only available in a desktop source install.", file=sys.stderr)
+        return 2
+    return subprocess.run(
+        [sys.executable, str(settings.project_root / "bin" / "gen-nvidia-reqs.py")]
+    ).returncode
+
+
+def cmd_logs(args) -> int:
+    keys = ("backend", "memory", "frontend") if args.target == "all" else (args.target,)
+    paths = [services.SERVICES[key].log_file for key in keys]
+    for path in paths:
+        print(f"=== {path.name} ===")
+        services._tail(path, args.lines)
+    if not args.follow:
+        return 0
+    offsets = {path: path.stat().st_size if path.exists() else 0 for path in paths}
+    try:
+        while True:
+            for path in paths:
+                if not path.exists():
+                    continue
+                size = path.stat().st_size
+                if size < offsets[path]:
+                    offsets[path] = 0
+                if size > offsets[path]:
+                    with open(path, encoding="utf-8", errors="replace") as stream:
+                        stream.seek(offsets[path])
+                        sys.stdout.write(stream.read())
+                        sys.stdout.flush()
+                        offsets[path] = stream.tell()
+            time.sleep(0.5)
+    except KeyboardInterrupt:
+        print()
+        return 130
+
+
+def cmd_clean(args) -> int:
+    for path in (settings.runtime_dir / "pids", settings.runtime_dir / "logs"):
+        if path.is_dir():
+            for file in path.glob("*"):
+                if file.is_file():
+                    file.unlink(missing_ok=True)
+    for pattern in ("*.log", "*.pid"):
+        for file in settings.runtime_dir.glob(pattern):
+            file.unlink(missing_ok=True)
+    print(f"Cleaned runtime files under {settings.runtime_dir}")
+    return 0
+
+
+def cmd_update(args) -> int:
+    if settings.source_checkout:
+        services.cmd_update()
+        return 0
+    command = [sys.executable, "-m", "pip", "install", "--upgrade", "nexusos-ai"]
+    if args.pre:
+        command.append("--pre")
+    return subprocess.run(command).returncode
+
+
+def cmd_models(args) -> int:
+    import httpx
+
+    base = settings.ollama_host.rstrip("/")
+    try:
+        if args.action == "list":
+            response = httpx.get(base + "/api/tags", timeout=5.0)
+            response.raise_for_status()
+            models = response.json().get("models", [])
+            if args.json:
+                _emit(models, True)
+            elif not models:
+                print("No models installed.")
+            else:
+                for model in models:
+                    print(f"{model.get('name', ''):<36} {model.get('size', 0) / 1024**3:5.1f} GB")
+        elif args.action == "available":
+            services.cmd_models("available", None)
+        elif args.action in ("pull", "install"):
+            with httpx.stream("POST", base + "/api/pull", json={"name": args.name}, timeout=None) as response:
+                response.raise_for_status()
+                for line in response.iter_lines():
+                    if line:
+                        try:
+                            item = json.loads(line)
+                            status = item.get("status") or item.get("error")
+                            if status:
+                                print(status)
+                        except ValueError:
+                            print(line)
+        elif args.action in ("remove", "rm"):
+            response = httpx.request("DELETE", base + "/api/delete", json={"name": args.name}, timeout=30.0)
+            response.raise_for_status()
+            print(f"Removed {args.name}")
+        return 0
+    except httpx.HTTPError as exc:
+        print(f"Provider request failed at {base}: {exc}", file=sys.stderr)
+        return 1
+
+
+def cmd_api(args) -> int:
+    from . import nexus_api
+    nexus_api.BASE = args.api_url or settings.api_url
+    rest = list(args.rest)
+    if args.command == "chat" and rest[:1] == ["send"]:
+        rest.pop(0)
+    if args.command == "history" and rest[:1] == ["list"]:
+        rest.pop(0)
+    return nexus_api.main([args.command, *rest], prog=f"nexus {args.command}")
+
+
+def _add_json(parser) -> None:
+    parser.add_argument("--json", action="store_true", help="emit machine-readable JSON")
+
+
+def _port(value: str) -> int:
+    try:
+        return _validate_config("backend_port", value)
+    except (TypeError, ValueError) as exc:
+        raise argparse.ArgumentTypeError(str(exc)) from exc
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="nexus", description="NexusOS local AI runtime and API client")
+    parser.add_argument("--version", action="version", version=f"NexusOS {settings.version}")
+    parser.add_argument("--api-url", help="override the NexusOS backend URL for this command")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    p = sub.add_parser("init", help="create user state and seed default playbooks"); _add_json(p); p.set_defaults(fn=cmd_init)
+    p = sub.add_parser("paths", help="show resolved package and writable paths"); _add_json(p); p.set_defaults(fn=cmd_paths)
+
+    p = sub.add_parser("config", help="manage persistent CLI/runtime configuration")
+    p.add_argument("action", choices=["list", "get", "set", "unset", "path"])
+    p.add_argument("key", nargs="?"); p.add_argument("value", nargs="?"); _add_json(p); p.set_defaults(fn=cmd_config)
+
+    p = sub.add_parser("provider", help="configure the Ollama-compatible model provider")
+    provider_sub = p.add_subparsers(dest="action", required=True)
+    show = provider_sub.add_parser("show"); _add_json(show); show.set_defaults(fn=cmd_provider)
+    use = provider_sub.add_parser("use"); use.add_argument("mode", choices=["local", "remote"])
+    use.add_argument("--url"); _add_json(use); use.set_defaults(fn=cmd_provider)
+
+    p = sub.add_parser("doctor", help="check the core runtime and optional capabilities")
+    p.add_argument("--fix", action="store_true"); _add_json(p); p.set_defaults(fn=cmd_doctor)
+    p = sub.add_parser("status", help="show service and provider status"); _add_json(p); p.set_defaults(fn=cmd_status)
+
+    p = sub.add_parser("serve", help="run NexusOS in the foreground")
+    p.add_argument("--host"); p.add_argument("--port", type=_port, default=settings.backend_port)
+    p.add_argument("--memory-port", type=_port, default=settings.memory_port)
+    p.add_argument("--no-memory", action="store_true"); p.add_argument("--allow-lan", action="store_true")
+    p.add_argument("--reload", action="store_true"); p.add_argument("--log-level", default="info")
+    p.set_defaults(fn=cmd_serve)
+
+    for name, fn, help_text in (
+        ("start", cmd_start, "start services in the background"),
+        ("stop", cmd_stop, "stop background services"),
+    ):
+        p = sub.add_parser(name, help=help_text)
+        p.add_argument("target", nargs="?", choices=["all", "backend", "memory", "frontend", "ai"], default="all")
+        p.set_defaults(fn=fn)
+    sub.add_parser("restart", aliases=["refresh"], help="restart all services").set_defaults(fn=cmd_refresh)
+    sub.add_parser("kill", help="force-stop NexusOS-owned processes").set_defaults(fn=lambda _a: services.cmd_kill() or 0)
+
+    p = sub.add_parser("open", help="open the web interface")
+    p.add_argument("--url"); p.add_argument("--no-start", action="store_true"); p.set_defaults(fn=cmd_open)
+    sub.add_parser("web", help="legacy desktop alias for open").set_defaults(fn=cmd_web)
+    sub.add_parser("panel", help="launch the legacy desktop control panel").set_defaults(fn=cmd_panel)
+    p = sub.add_parser("logs", help="read or follow service logs")
+    p.add_argument("target", nargs="?", choices=["all", "backend", "memory", "frontend"], default="all")
+    p.add_argument("--lines", type=int, choices=range(1, 10001), default=50, metavar="1..10000")
+    p.add_argument("--follow", "-f", action="store_true"); p.set_defaults(fn=cmd_logs)
+    sub.add_parser("clean", help="remove runtime logs and stale PID files").set_defaults(fn=cmd_clean)
+    p = sub.add_parser("update", help="update dependencies or the installed wheel"); p.add_argument("--pre", action="store_true"); p.set_defaults(fn=cmd_update)
+
+    p = sub.add_parser("backup", help="back up a desktop source checkout")
+    p.add_argument("--full", "-f", action="store_true"); p.add_argument("--check", "-c", action="store_true")
+    p.set_defaults(fn=cmd_backup)
+    p = sub.add_parser("restore", help="restore a desktop source checkout")
+    p.add_argument("--check", "-c", action="store_true"); p.set_defaults(fn=cmd_restore)
+    sub.add_parser("nvidia-reqs", help="regenerate source-checkout NVIDIA requirements").set_defaults(fn=cmd_nvidia_reqs)
+
+    p = sub.add_parser("models", help="list, pull, and remove provider models")
+    model_sub = p.add_subparsers(dest="action", required=True)
+    item = model_sub.add_parser("list"); _add_json(item); item.set_defaults(fn=cmd_models)
+    model_sub.add_parser("available", aliases=["search"]).set_defaults(fn=cmd_models, action="available")
+    item = model_sub.add_parser("pull", aliases=["install"]); item.add_argument("name"); item.set_defaults(fn=cmd_models, action="pull")
+    item = model_sub.add_parser("remove", aliases=["rm"]); item.add_argument("name"); item.set_defaults(fn=cmd_models, action="remove")
+
+    for command in ("chat", "memory", "playbook", "history"):
+        p = sub.add_parser(command, add_help=False, help=f"use the {command} API from the terminal")
+        p.add_argument("rest", nargs=argparse.REMAINDER)
+        p.set_defaults(fn=cmd_api)
+    return parser
+
+
+def _normalize_legacy_argv(argv) -> list[str]:
+    """Translate the old shell CLI spelling before argparse sees it."""
+    normalized = list(argv or [])
+    if normalized == ["help"]:
+        return ["--help"]
+    if normalized and normalized[0] in ("start", "stop", "logs"):
+        normalized[1:] = [LEGACY_TARGETS.get(value, value) for value in normalized[1:]]
+    if normalized[:2] == ["backup", "full"]:
+        normalized[1] = "--full"
+    elif len(normalized) > 1 and normalized[0] == "backup" and normalized[1] in ("check", "--claude"):
+        normalized[1] = "--check"
+    elif len(normalized) > 1 and normalized[0] == "restore":
+        if normalized[1] in ("check", "--claude"):
+            normalized[1] = "--check"
+        elif normalized[1] in ("full", "-f", "--full"):
+            normalized.pop(1)
+    return normalized
+
+
+def main(argv=None) -> int:
+    parser = build_parser()
+    args = parser.parse_args(_normalize_legacy_argv(argv))
+    if args.command == "config":
+        if args.action in ("get", "unset") and not args.key:
+            parser.error(f"config {args.action} requires KEY")
+        if args.action == "set" and (not args.key or args.value is None):
+            parser.error("config set requires KEY VALUE")
+    try:
+        result = args.fn(args)
+        return result if isinstance(result, int) else 0
+    except KeyboardInterrupt:
+        print()
+        return 130
+
+
+def entrypoint() -> int:
+    return main(sys.argv[1:])
+
+
+if __name__ == "__main__":
+    raise SystemExit(entrypoint())

management/ncp.cmd

@@ -12,17 +12,20 @@ REM exactly what this file exists to avoid.
 REM
 REM ASCII only, same rule as the .ps1 files - a test in tests/test_smoke.py enforces it.
 setlocal
-REM ncp.py pins its stdout to UTF-8 (it prints check marks and em-dashes, and a
+REM The CLI pins its stdout to UTF-8 (it prints check marks and em-dashes, and a
 REM redirected stdout would otherwise raise UnicodeEncodeError). A console still
 REM on codepage 437 renders those bytes as mojibake, so switch it to UTF-8 here.
 REM ponytail: chcp changes the calling console's codepage and does not restore
 REM it on exit. Harmless in practice; if that ever matters, set the console CP
-REM from inside ncp.py with ctypes SetConsoleOutputCP instead.
+REM from inside the CLI with ctypes SetConsoleOutputCP instead.
 chcp 65001 >nul 2>&1
 set "ROOT=%~dp0.."
 REM System Python fallback so backup/restore work before the venv exists; those
 REM delegate to the stdlib-only bin/sync.py. Mirrors the same fallback in ncp.ps1.
 set "PY=%ROOT%\Promethean\Scripts\python.exe"
 if not exist "%PY%" set "PY=python"
-"%PY%" "%ROOT%\management\ncp.py" %*
-exit /b %ERRORLEVEL%
+pushd "%ROOT%"
+"%PY%" -m management.cli %*
+set "NEXUS_EXIT=%ERRORLEVEL%"
+popd
+exit /b %NEXUS_EXIT%

management/ncp.py

@@ -28,15 +28,20 @@ import urllib.request
 from dataclasses import dataclass, field
 from pathlib import Path
 
-ROOT = Path(__file__).resolve().parent.parent
-PID_DIR = ROOT / "runtime" / "pids"
-LOG_DIR = ROOT / "runtime"
-FRONTEND_DIR = ROOT / "interface" / "web"
+from synapse.nexus_config import SOURCE_CHECKOUT, settings
+
+ROOT = settings.project_root
+PID_DIR = settings.runtime_dir / "pids"
+LOG_DIR = settings.runtime_dir
+FRONTEND_DIR = settings.frontend_source_dir
 OLLAMA_BIN = ROOT / "ollama" / "bin" / ("ollama.exe" if os.name == "nt" else "ollama")
-OLLAMA_MODELS_DIR = ROOT / "models"
+OLLAMA_MODELS_DIR = settings.models_dir
 
 WINDOWS = os.name == "nt"
-PYTHON = ROOT / "Promethean" / ("Scripts/python.exe" if WINDOWS else "bin/python3")
+_VENV_PYTHON = ROOT / "Promethean" / ("Scripts/python.exe" if WINDOWS else "bin/python3")
+PYTHON = Path(os.getenv("NEXUS_PYTHON", "")) if os.getenv("NEXUS_PYTHON") else (
+    _VENV_PYTHON if _VENV_PYTHON.exists() else Path(sys.executable)
+)
 
 PID_DIR.mkdir(parents=True, exist_ok=True)
 LOG_DIR.mkdir(parents=True, exist_ok=True)
@@ -93,7 +98,7 @@ def _psutil():
         import psutil
         return psutil
     except ImportError:
-        sys.exit("psutil is missing - run ./install.sh (or install-windows.ps1) to rebuild the venv.")
+        return None
 
 
 # -- services ------------------------------------------------------------------
@@ -124,7 +129,7 @@ class Service:
 # Bind loopback by default: the backend REST API is unauthenticated, so
 # binding 0.0.0.0 handed the full admin+data plane to any host on the LAN. Set
 # NEXUS_BIND_HOST=0.0.0.0 to opt into LAN exposure once real auth is in place.
-BIND_HOST = os.environ.get("NEXUS_BIND_HOST", "127.0.0.1")
+BIND_HOST = settings.bind_host
 
 
 def _uvicorn(app: str, port: int):
@@ -140,9 +145,12 @@ def _uvicorn(app: str, port: int):
 
 
 SERVICES = {
-    "backend": Service("backend", "NEXUS BACKEND SERVICE", 8000, ROOT,
+    "memory": Service("memory", "NEXUS MEMORY SERVICE", settings.memory_port, settings.state_dir,
+                      ["uvicorn synapse.memory"],
+                      lambda: _uvicorn("synapse.memory.service:app", settings.memory_port)),
+    "backend": Service("backend", "NEXUS BACKEND SERVICE", settings.backend_port, settings.state_dir,
                        ["uvicorn synapse.main"],
-                       lambda: _uvicorn("synapse.main:sio_app", 8000)),
+                       lambda: _uvicorn("synapse.main:sio_app", settings.backend_port)),
     "frontend": Service("frontend", "NEXUS FRONTEND SERVICE", 5173, FRONTEND_DIR,
                         ["vite --host", "npm run dev"],
                         lambda: [npm(), "run", "dev", "--", "--host", "0.0.0.0"]),
@@ -158,7 +166,15 @@ def read_pid(svc: Service):
 
 def alive(pid) -> bool:
     ps = _psutil()
-    return pid is not None and ps.pid_exists(pid)
+    if pid is None:
+        return False
+    if ps is not None:
+        return ps.pid_exists(pid)
+    try:
+        os.kill(pid, 0)
+        return True
+    except (OSError, ValueError):
+        return False
 
 
 def pid_is_ours(pid, patterns) -> bool:
@@ -168,7 +184,13 @@ def pid_is_ours(pid, patterns) -> bool:
     is not enough. TERMing a recycled PID can log the user out."""
     ps = _psutil()
     try:
-        cmd = " ".join(ps.Process(pid).cmdline())
+        if ps is not None:
+            cmd = " ".join(ps.Process(pid).cmdline())
+        elif os.name != "nt":
+            cmd = (Path(f"/proc/{pid}/cmdline").read_bytes()
+                   .replace(b"\0", b" ").decode(errors="replace"))
+        else:
+            return False
     except Exception:
         return False
     return any(p in cmd for p in patterns)
@@ -255,6 +277,20 @@ def kill_matching(patterns, force=False) -> int:
     ps = _psutil()
     me = os.getpid()
     hit = 0
+    if ps is None:
+        if os.name == "nt":
+            return 0
+        for entry in Path("/proc").iterdir():
+            if not entry.name.isdigit() or int(entry.name) == me:
+                continue
+            try:
+                cmd = (entry / "cmdline").read_bytes().replace(b"\0", b" ").decode(errors="replace")
+                if any(pattern in cmd for pattern in patterns):
+                    os.kill(int(entry.name), 9 if force else 15)
+                    hit += 1
+            except (OSError, ValueError):
+                pass
+        return hit
     for proc in ps.process_iter(["pid", "cmdline"]):
         if proc.info["pid"] == me:
             continue
@@ -272,6 +308,8 @@ def kill_port(port: int) -> bool:
     """Whatever holds the port IS the service - this is the backstop that makes
     stop reliable regardless of process-tree shape or PID-file accuracy."""
     ps = _psutil()
+    if ps is None:
+        return False
     killed = False
     try:
         conns = ps.net_connections(kind="inet")
@@ -295,13 +333,16 @@ def stop_service(svc: Service) -> bool:
         if alive(pid) and pid_is_ours(pid, svc.patterns):
             ps = _psutil()
             try:
-                proc = ps.Process(pid)
-                for child in proc.children(recursive=True):
-                    try:
-                        child.terminate()
-                    except Exception:
-                        pass
-                proc.terminate()
+                if ps is not None:
+                    proc = ps.Process(pid)
+                    for child in proc.children(recursive=True):
+                        try:
+                            child.terminate()
+                        except Exception:
+                            pass
+                    proc.terminate()
+                elif os.name != "nt":
+                    os.kill(pid, 15)
             except Exception:
                 pass
         svc.pid_file.unlink(missing_ok=True)
@@ -332,8 +373,15 @@ def start_ollama(background: bool = False) -> None:
     background=False (`ncp start --ai`): blocks until the model is warmed - weights
     read off disk into RAM/VRAM, routinely about a minute - so "started" means the
     AI can actually answer."""
+    if not settings.manage_ollama:
+        running = http_ok(settings.ollama_host.rstrip("/") + "/api/tags", timeout=3)
+        print(
+            f"REMOTE OLLAMA {'REACHABLE' if running else 'UNREACHABLE'} "
+            f"({settings.ollama_host})"
+        )
+        return
     print("Starting OLLAMA...")
-    url = "http://localhost:8000/ollama/start" + ("?background=true" if background else "")
+    url = settings.api_url + "/ollama/start" + ("?background=true" if background else "")
     req = urllib.request.Request(url, method="POST")
     try:
         urllib.request.urlopen(req, timeout=180).read(1)
@@ -346,7 +394,10 @@ def stop_ollama() -> None:
     """Prefer the backend endpoint for a clean OllamaManager shutdown; if the
     backend is already down, kill `ollama serve` directly so it never lingers
     holding VRAM/RAM. Must run BEFORE the backend is torn down."""
-    req = urllib.request.Request("http://localhost:8000/ollama/stop", method="POST")
+    if not settings.manage_ollama:
+        print(f"REMOTE OLLAMA IS EXTERNALLY MANAGED ({settings.ollama_host})")
+        return
+    req = urllib.request.Request(settings.api_url + "/ollama/stop", method="POST")
     try:
         urllib.request.urlopen(req, timeout=5).read(1)
         print("NEXUS OLLAMA STOPPED")
@@ -367,6 +418,9 @@ def cmd_start(target) -> None:
         launch(SERVICES["backend"]); wait_for_port(SERVICES["backend"])
         start_ollama()
     elif target in ("--frontend", "-f"):
+        if not SOURCE_CHECKOUT:
+            print("Vite source is unavailable in wheel installs; the backend serves the bundled UI.")
+            return
         launch(SERVICES["frontend"]); wait_for_port(SERVICES["frontend"])
     elif target in ("--ai", "-a"):
         start_ollama()
@@ -389,7 +443,7 @@ def cmd_start(target) -> None:
         wait_for_port(SERVICES["backend"])
         t_services = time.perf_counter()
         start_ollama(background=True)
-        if not WINDOWS:
+        if SOURCE_CHECKOUT and not WINDOWS:
             launch(SERVICES["frontend"])
         t_bg = time.perf_counter()
         print("\nBoot timing:")
@@ -405,6 +459,8 @@ def cmd_stop(target) -> None:
         stop_ollama(); stop_service(SERVICES["backend"])
     elif target in ("--frontend", "-f"):
         stop_service(SERVICES["frontend"])
+    elif target in ("--ai", "-a"):
+        stop_ollama()
     elif target in (None, "", "all"):
         stop_ollama()
         stop_service(SERVICES["backend"])
@@ -415,14 +471,21 @@ def cmd_stop(target) -> None:
 
 def cmd_kill() -> None:
     print("Force-killing all Nexus processes...")
-    for port, name in ((8000, "SYNAPSE"),
-                       (5173, "INTERFACE"), (11434, "OLLAMA")):
+    targets = [
+        (settings.backend_port, "SYNAPSE"),
+        (settings.memory_port, "MEMORY"),
+        (5173, "INTERFACE"),
+    ]
+    patterns = ["uvicorn synapse", "npm run dev", "vite --host"]
+    if settings.manage_ollama:
+        targets.append((11434, "OLLAMA"))
+        patterns.append("ollama serve")
+    for port, name in targets:
         if kill_port(port):
             print(f"  KILLED:      {name} (:{port})")
         else:
             print(f"  NOT RUNNING: {name} (:{port})")
-    kill_matching(["uvicorn synapse", "npm run dev", "vite --host", "ollama serve"],
-                  force=True)
+    kill_matching(patterns, force=True)
     for pid_file in PID_DIR.glob("*.pid"):
         pid_file.unlink(missing_ok=True)
     print("Done.")
@@ -445,8 +508,9 @@ def cmd_status() -> None:
     print("\nFrontend:")
     one("Vite          ", SERVICES["frontend"])
     print("\nModel server:")
-    running = http_ok("http://localhost:11434/api/tags")
-    print(f"  Ollama        : {'RUNNING (:11434)' if running else 'STOPPED'}")
+    running = http_ok(settings.ollama_host.rstrip("/") + "/api/tags")
+    mode = "remote" if not settings.manage_ollama else "local"
+    print(f"  Ollama ({mode}) : {'RUNNING' if running else 'STOPPED'} ({settings.ollama_host})")
 
 
 def _tail(path: Path, n: int) -> None:
@@ -687,10 +751,10 @@ MODEL_CATALOG = [
 
 def cmd_models(action, name) -> None:
     if action == "list":
-        if not http_ok("http://localhost:11434/api/tags"):
+        if not http_ok(settings.ollama_host.rstrip("/") + "/api/tags"):
             print("Ollama is not running. Start the backend first with: ncp start -b")
             return
-        raw = urllib.request.urlopen("http://localhost:11434/api/tags", timeout=5).read()
+        raw = urllib.request.urlopen(settings.ollama_host.rstrip("/") + "/api/tags", timeout=5).read()
         models = json.loads(raw).get("models", [])
         print("Installed models:\n")
         if not models:

management/nexus-cli.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# ncp - Linux entry point. The CLI itself is management/ncp.py, which runs
+# ncp - Linux entry point. The CLI itself is management/cli.py, which runs
 # unchanged on Windows too (see management/ncp.cmd); this stays a shell script
 # because ~/.bashrc, launch_nexus.sh, bin/restore-linux.sh, controlpanel.py,
 # bin/panel/nexus-popup.py and management/nexus-app.sh all invoke this path.
@@ -8,9 +8,10 @@
 # directory drives itself instead of reaching into the real install.
 NEXUS_ROOT="$(cd "$(dirname "$(realpath "$0")")/.." && pwd)"
 
-# ncp.py needs psutil (venv), but its backup/restore path delegates to the
-# stdlib-only bin/sync.py and must work before the venv is built.
+# Prefer the project venv for the full desktop dependency set. The portable CLI
+# falls back to system Python when the package is installed without that venv.
 PY="$NEXUS_ROOT/Promethean/bin/python3"
 [ -x "$PY" ] || PY=python3
 
-exec "$PY" "$NEXUS_ROOT/management/ncp.py" "$@"
+cd "$NEXUS_ROOT"
+exec "$PY" -m management.cli "$@"

management/nexus_api.py

@@ -11,7 +11,9 @@ import sys
 
 import httpx
 
-BASE = __import__("os").environ.get("NEXUS_API", "http://localhost:8000")
+from synapse.nexus_config import settings
+
+BASE = settings.api_url
 
 
 def _client():
@@ -118,8 +120,8 @@ def cmd_history(args):
         _die_if_down(e)
 
 
-def main():
-    p = argparse.ArgumentParser(prog="ncp")
+def main(argv=None, prog="nexus"):
+    p = argparse.ArgumentParser(prog=prog)
     sub = p.add_subparsers(dest="cmd", required=True)
 
     c = sub.add_parser("chat"); c.add_argument("message", nargs="+")
@@ -135,8 +137,9 @@ def main():
     h = sub.add_parser("history"); h.add_argument("query", nargs="?")
     h.add_argument("--limit", type=int, default=20); h.set_defaults(fn=cmd_history)
 
-    args = p.parse_args()
-    args.fn(args)
+    args = p.parse_args(argv)
+    result = args.fn(args)
+    return result if isinstance(result, int) else 0
 
 
 if __name__ == "__main__":

management/test_controlpanel_close.py

@@ -11,7 +11,10 @@ import pytest
 
 pytest.importorskip("tkinter", reason="controlpanel is a Tk GUI; headless boxes lack python3-tk")
 
-from controlpanel import NexusControlPanel  # noqa: E402
+try:
+    from management.controlpanel import NexusControlPanel  # noqa: E402
+except ModuleNotFoundError:  # direct: python management/test_controlpanel_close.py
+    from controlpanel import NexusControlPanel  # type: ignore[no-redef]  # noqa: E402
 
 
 def _fake(closing, after_raises):

management/test_nexus_api.py

@@ -1,7 +1,10 @@
 """Pin the SSE parser in nexus_api. Run: python management/test_nexus_api.py"""
 import sys, os
 sys.path.insert(0, os.path.dirname(__file__))
-from nexus_api import iter_chunks
+try:
+    from management.nexus_api import iter_chunks
+except ModuleNotFoundError:  # direct: python management/test_nexus_api.py
+    from nexus_api import iter_chunks
 
 # A realistic /chat/stream frame: two token chunks, a meta block, then done.
 lines = [