@agent-team-foundation/first-tree-hub 0.12.9 → 0.13.0

package/dist/cli/index.mjs

@@ -1,20 +1,20 @@
 #!/usr/bin/env node
 import "../observability-BAScT_5S-BcW9HgkG.mjs";
-import { $ as formatStaleReason, A as checkDocker, B as isServiceSupported, C as createApiNameResolver, D as checkBackgroundService, E as checkAgentConfigs, F as checkWebSocket, H as restartClientService, I as printResults, J as stopPostgres, L as reconcileAgentConfigs, M as checkServerConfig, N as checkServerHealth, O as checkClientConfig, P as checkServerReachable, Q as findStaleAliases, R as getClientServiceStatus, S as runHomeMigration, T as runMigrations, U as startClientService, W as stopClientService, X as handleClientOrgMismatch, Y as ClientRuntime, _ as formatCheckReport, a as declineUpdate, at as fail, b as onboardCreate, c as detectInstallMode, ct as ClientUserMismatchError, d as startServer, dt as SessionRegistry, et as removeLocalAgent, f as reconcileLocalRuntimeProviders, ft as cleanWorkspaces, g as promptMissingFields, h as promptAddAgent, ht as configureClientLoggerForService, i as createExecuteUpdate, it as resolveSenderName, j as checkNodeVersion, k as checkDatabase, l as fetchLatestVersion, lt as FirstTreeHubSDK, m as isInteractive, mt as applyClientLoggerConfig, o as promptUpdate, ot as success, p as uploadClientCapabilities, pt as probeCapabilities, r as registerSaaSConnectCommand, rt as resolveReplyToFromEnv, s as PACKAGE_NAME, st as ClientOrgMismatchError, tt as createOwner, u as installGlobalLatest, ut as SdkError, v as loadOnboardState, w as migrateLocalAgentDirs, x as saveOnboardState, y as onboardCheck, z as installClientService } from "../saas-connect-CXZhK485.mjs";
+import { $ as formatStaleReason, A as checkDocker, B as isServiceSupported, C as createApiNameResolver, D as checkBackgroundService, E as checkAgentConfigs, F as checkWebSocket, H as restartClientService, I as printResults, J as stopPostgres, L as reconcileAgentConfigs, M as checkServerConfig, N as checkServerHealth, O as checkClientConfig, P as checkServerReachable, Q as findStaleAliases, R as getClientServiceStatus, S as runHomeMigration, T as runMigrations, U as startClientService, W as stopClientService, X as handleClientOrgMismatch, Y as ClientRuntime, _ as formatCheckReport, a as declineUpdate, at as fail, b as onboardCreate, c as detectInstallMode, ct as ClientUserMismatchError, d as startServer, dt as SessionRegistry, et as removeLocalAgent, f as reconcileLocalRuntimeProviders, ft as cleanWorkspaces, g as promptMissingFields, h as promptAddAgent, ht as configureClientLoggerForService, i as createExecuteUpdate, it as resolveSenderName, j as checkNodeVersion, k as checkDatabase, l as fetchLatestVersion, lt as FirstTreeHubSDK, m as isInteractive, mt as applyClientLoggerConfig, o as promptUpdate, ot as success, p as uploadClientCapabilities, pt as probeCapabilities, r as registerSaaSConnectCommand, rt as resolveReplyToFromEnv, s as PACKAGE_NAME, st as ClientOrgMismatchError, tt as createOwner, u as installGlobalLatest, ut as SdkError, v as loadOnboardState, w as migrateLocalAgentDirs, x as saveOnboardState, y as onboardCheck, z as installClientService } from "../saas-connect-Bb5LR4y6.mjs";
 import "../logger-core-BTmvdflj-DjW8FM4T.mjs";
-import { C as resetConfigMeta, E as setConfigValue, S as resetConfig, T as serverConfigSchema, _ as getConfigValue, a as ensureFreshAdminToken, c as resolveServerUrl, d as DEFAULT_CONFIG_DIR, f as DEFAULT_DATA_DIR, h as clientConfigSchema, i as ensureFreshAccessToken, l as saveAgentConfig, m as agentConfigSchema, o as loadCredentials, p as DEFAULT_HOME_DIR, u as saveCredentials, v as initConfig, w as resolveConfigReadonly, x as readConfigFile, y as loadAgents } from "../bootstrap-BCZC1ki6.mjs";
+import { C as resetConfigMeta, E as setConfigValue, S as resetConfig, T as serverConfigSchema, _ as getConfigValue, a as ensureFreshAdminToken, c as resolveServerUrl, d as DEFAULT_CONFIG_DIR, f as DEFAULT_DATA_DIR, h as clientConfigSchema, i as ensureFreshAccessToken, l as saveAgentConfig, m as agentConfigSchema, o as loadCredentials, p as DEFAULT_HOME_DIR, v as initConfig, w as resolveConfigReadonly, x as readConfigFile, y as loadAgents } from "../bootstrap-Cya2OoHz.mjs";
 import { a as print, n as CLI_USER_AGENT, o as setJsonMode, r as COMMAND_VERSION, t as cliFetch } from "../cli-fetch--tiwKm5S.mjs";
-import "../dist-CnjqakXS.mjs";
-import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-DrnBbl8T.mjs";
-import "../errors-CF5evtJt-B0NTIVPt.mjs";
+import "../dist-C8yStx2L.mjs";
+import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-D_vnqC6a.mjs";
+import "../errors-LPcARA4K-Dbrptiyz.mjs";
 import "../src-DNBS5Yjj.mjs";
-import "../client-OMwJMCQt-R1T06ZH6.mjs";
-import "../invitation-Bg0TRiyx-BsZH4GCS.mjs";
+import "../client-BH4CmUL0-CybE3kuP.mjs";
+import "../invitation-DZO4NX3P-BPxTeHf-.mjs";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync } from "node:fs";
 import * as semver from "semver";
 import { Command } from "commander";
-import { confirm, input, password, select } from "@inquirer/prompts";
+import { confirm, input, select } from "@inquirer/prompts";
 //#region src/commands/agent-config.ts
 async function resolveAgentRecord(serverUrl, adminToken, agentName) {
 	const res = await cliFetch(`${serverUrl}/api/v1/me/managed-agents`, {
@@ -78,7 +78,7 @@ function printConfig(cfg) {
 }
 function registerAgentConfigCommands(parent) {
 	const config = parent.command("config").description("Manage agent runtime configuration (Step 8)");
-	config.command("get <agent>").description("Print the current runtime config for an agent").action(async (agentName) => {
+	config.command("show <agent>").description("Show the current runtime config for an agent").action(async (agentName) => {
 		const serverUrl = resolveServerUrl(process.env.FIRST_TREE_HUB_SERVER_URL);
 		const adminToken = await ensureFreshAdminToken();
 		const { uuid } = await resolveAgentRecord(serverUrl, adminToken, agentName);
@@ -209,7 +209,7 @@ const DEFAULT_WORKSPACE_TTL_MS = 10080 * 60 * 1e3;
 * agents configured they must pick one with `--agent <name>` (next step of
 * CLI polish) or rely on a single entry.
 */
-function resolveLocalAgent(agentName) {
+function resolveLocalAgent$1(agentName) {
 	const agentsDir = join(DEFAULT_CONFIG_DIR, "agents");
 	const agents = loadAgents({
 		schema: agentConfigSchema,
@@ -223,8 +223,8 @@ function resolveLocalAgent(agentName) {
 	let resolvedName;
 	if (resolution.kind === "ok") resolvedName = resolution.name;
 	else if (resolution.kind === "none") fail("MISSING_AGENT", "No agent configured. Run `first-tree-hub agent add` first.", 2);
-	else if (resolution.kind === "envMismatch") fail("ENV_AGENT_NOT_LOCAL", `FIRST_TREE_HUB_AGENT_ID="${resolution.envAgentId}" is not configured on this machine. Available local agents: ${resolution.available.join(", ")}. Pick one explicitly: \`first-tree-hub agent send --agent <senderName> <recipientName> "..."\`.`, 2);
-	else fail("AMBIGUOUS_AGENT", `Multiple agents are configured on this machine (${resolution.available.join(", ")}) and FIRST_TREE_HUB_AGENT_ID is not set, so the CLI can't tell which one is the sender. Specify it explicitly: \`first-tree-hub agent send --agent <senderName> <recipientName> "..."\` (--agent picks the SENDER; the recipient is the next positional argument).`, 2);
+	else if (resolution.kind === "envMismatch") fail("ENV_AGENT_NOT_LOCAL", `FIRST_TREE_HUB_AGENT_ID="${resolution.envAgentId}" is not configured on this machine. Available local agents: ${resolution.available.join(", ")}. Pick one explicitly with \`--agent <senderName>\`.`, 2);
+	else fail("AMBIGUOUS_AGENT", `Multiple agents are configured on this machine (${resolution.available.join(", ")}) and FIRST_TREE_HUB_AGENT_ID is not set, so the CLI can't tell which one is the sender. Specify it explicitly with \`--agent <senderName>\`.`, 2);
 	const cfg = agents.get(resolvedName);
 	if (!cfg) fail("UNKNOWN_AGENT", `Agent "${resolvedName}" not found in ${agentsDir}`, 2);
 	let serverUrl;
@@ -238,8 +238,8 @@ function resolveLocalAgent(agentName) {
 		agentId: cfg.agentId
 	};
 }
-function createSdk(agentName) {
-	const { serverUrl, agentId } = resolveLocalAgent(agentName);
+function createSdk$1(agentName) {
+	const { serverUrl, agentId } = resolveLocalAgent$1(agentName);
 	return new FirstTreeHubSDK({
 		serverUrl,
 		getAccessToken: (opts) => ensureFreshAccessToken(opts),
@@ -247,7 +247,7 @@ function createSdk(agentName) {
 		userAgent: CLI_USER_AGENT
 	});
 }
-function handleSdkError(error) {
+function handleSdkError$1(error) {
 	if (error instanceof SdkError) {
 		const exitCode = error.statusCode === 401 ? 3 : 1;
 		fail(`HTTP_${error.statusCode}`, error.message, exitCode);
@@ -255,31 +255,12 @@ function handleSdkError(error) {
 	if (error instanceof TypeError && "cause" in error) fail("CONNECTION_ERROR", `Cannot connect to server: ${error.message}`, 6);
 	fail("UNKNOWN_ERROR", error instanceof Error ? error.message : String(error), 1);
 }
-function parseLimit(value, max) {
+function parseLimit$1(value, max) {
 	const limit = Number.parseInt(value, 10);
 	if (Number.isNaN(limit) || limit < 1 || limit > max) fail("INVALID_LIMIT", `Limit must be between 1 and ${max}.`, 2);
 	return limit;
 }
-const MAX_STDIN_BYTES = 10 * 1024 * 1024;
-function readStdin() {
-	if (process.stdin.isTTY) return Promise.resolve(null);
-	return new Promise((resolve, reject) => {
-		const chunks = [];
-		let totalSize = 0;
-		process.stdin.on("data", (chunk) => {
-			totalSize += chunk.length;
-			if (totalSize > MAX_STDIN_BYTES) {
-				process.stdin.destroy();
-				reject(/* @__PURE__ */ new Error(`stdin exceeds ${MAX_STDIN_BYTES} bytes`));
-				return;
-			}
-			chunks.push(chunk);
-		});
-		process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
-		process.stdin.on("error", reject);
-	});
-}
-async function resolveAgent(serverUrl, adminToken, agentName) {
+async function resolveAgent$1(serverUrl, adminToken, agentName) {
 	const res = await cliFetch(`${serverUrl}/api/v1/me/managed-agents`, {
 		headers: { Authorization: `Bearer ${adminToken}` },
 		signal: AbortSignal.timeout(1e4)
@@ -293,7 +274,7 @@ async function resolveAgent(serverUrl, adminToken, agentName) {
 * Read the persisted `client.id` from `client.yaml`. Required by `agent
 * prune` to filter the user-scoped `listMyAgents` response down to "what
 * actually binds on THIS machine". `fail()` instead of throwing so the
-* "no client.yaml — run client connect first" path renders as a clean
+* "no client.yaml — run connect <token> first" path renders as a clean
 * CLI error rather than a stack trace.
 */
 function readClientId() {
@@ -430,7 +411,7 @@ function registerAgentCommands(program) {
 			fail("LIST_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
-	agent.command("create <name>").description("Create an agent on Hub and bind it locally").requiredOption("--type <type>", "Agent type (human, personal_assistant, autonomous_agent)").requiredOption("--client-id <id>", "Client (machine) that will run this agent — must be owned by you. Run `first-tree-hub client connect` on that machine first.").option("--runtime <runtime>", "Runtime handler (default: claude-code)", "claude-code").option("--display-name <name>", "Display name").option("--org <id>", "Target organization id (required when you belong to multiple orgs)").option("--server <url>", "Hub server URL").action(async (name, options) => {
+	agent.command("create <name>").description("Create an agent on Hub and bind it locally").requiredOption("--type <type>", "Agent type (human, personal_assistant, autonomous_agent)").requiredOption("--client-id <id>", "Client (machine) that will run this agent — must be owned by you. Run `first-tree-hub connect <token>` on that machine first.").option("--runtime <runtime>", "Runtime handler (default: claude-code)", "claude-code").option("--display-name <name>", "Display name").option("--org <id>", "Target organization id (required when you belong to multiple orgs)").option("--server <url>", "Hub server URL").action(async (name, options) => {
 		try {
 			const serverUrl = resolveServerUrl(options.server);
 			const adminToken = await ensureFreshAccessToken();
@@ -487,7 +468,7 @@ function registerAgentCommands(program) {
 			});
 			if (!meRes.ok) fail("ME_ERROR", `Failed to fetch current member (HTTP ${meRes.status})`, 1);
 			const me = await meRes.json();
-			const target = await resolveAgent(serverUrl, accessToken, agentName);
+			const target = await resolveAgent$1(serverUrl, accessToken, agentName);
 			const patchRes = await cliFetch(`${serverUrl}/api/v1/agents/${target.uuid}`, {
 				method: "PATCH",
 				headers: {
@@ -526,11 +507,11 @@ function registerAgentCommands(program) {
 		print.line(`  ${totalRemoved} workspace(s) cleaned.\n`);
 	});
 	const bind = agent.command("bind").description("Bind an agent to a client machine or external IM account");
-	bind.command("client <agentName>").description("Bind an unbound agent to a client machine (first-time bind only — ID is immutable once set)").requiredOption("--client-id <id>", "Client (machine) ID — must be owned by you. Run `first-tree-hub client connect` on that machine first.").option("--server <url>", "Hub server URL").action(async (agentName, options) => {
+	bind.command("client <agentName>").description("Bind an unbound agent to a client machine (first-time bind only — ID is immutable once set)").requiredOption("--client-id <id>", "Client (machine) ID — must be owned by you. Run `first-tree-hub connect <token>` on that machine first.").option("--server <url>", "Hub server URL").action(async (agentName, options) => {
 		try {
 			const serverUrl = resolveServerUrl(options.server);
 			const accessToken = await ensureFreshAccessToken();
-			const target = await resolveAgent(serverUrl, accessToken, agentName);
+			const target = await resolveAgent$1(serverUrl, accessToken, agentName);
 			const patchRes = await cliFetch(`${serverUrl}/api/v1/agents/${target.uuid}`, {
 				method: "PATCH",
 				headers: {
@@ -554,7 +535,7 @@ function registerAgentCommands(program) {
 		try {
 			if (options.platform !== "feishu") fail("UNSUPPORTED_PLATFORM", `Platform "${options.platform}" is not supported. Use "feishu".`);
 			const serverUrl = resolveServerUrl(options.server);
-			const { agentId } = resolveLocalAgent(options.agent);
+			const { agentId } = resolveLocalAgent$1(options.agent);
 			await bindFeishuBot(serverUrl, await ensureFreshAccessToken(), agentId, options.appId, options.appSecret);
 			print.line("Feishu bot bound successfully.\n");
 			success({
@@ -569,7 +550,7 @@ function registerAgentCommands(program) {
 		try {
 			if (options.platform !== "feishu") fail("UNSUPPORTED_PLATFORM", `Platform "${options.platform}" is not supported. Use "feishu".`);
 			const serverUrl = resolveServerUrl(options.server);
-			const { agentId } = resolveLocalAgent(options.agent);
+			const { agentId } = resolveLocalAgent$1(options.agent);
 			await bindFeishuUser(serverUrl, await ensureFreshAccessToken(), agentId, humanAgentId, options.feishuId);
 			print.line(`Feishu user ${options.feishuId} bound to ${humanAgentId}.\n`);
 			success({
@@ -581,62 +562,6 @@ function registerAgentCommands(program) {
 			fail("BIND_USER_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
-	agent.command("send <target> [message]").description("Send a message to an agent or chat").option("-f, --format <format>", "Message format (text|markdown|card)", "text").option("--chat", "Treat target as chat ID instead of agent ID").option("-m, --metadata <json>", "JSON metadata to attach").option("--reply-to <messageId>", "Message ID to reply to").option("--reply-to-inbox <inboxId>", "Cross-chat reply target inbox").option("--reply-to-chat <chatId>", "Cross-chat reply target chat").option("--agent <name>", "Agent name on the Hub (default: first configured on this client)").action(async (target, message, options) => {
-		try {
-			const content = message ?? await readStdin();
-			if (!content) fail("NO_MESSAGE", "No message provided. Pass as argument or pipe via stdin.", 2);
-			let metadata;
-			if (options.metadata) try {
-				metadata = JSON.parse(options.metadata);
-			} catch {
-				fail("INVALID_METADATA", "Metadata must be valid JSON.", 2);
-			}
-			const { replyToInbox, replyToChat } = resolveReplyToFromEnv(process.env, {
-				replyToInbox: options.replyToInbox,
-				replyToChat: options.replyToChat
-			});
-			const sdk = createSdk(options.agent);
-			if (options.chat) success(await sdk.sendMessage(target, {
-				format: options.format,
-				content,
-				metadata,
-				inReplyTo: options.replyTo,
-				replyToInbox,
-				replyToChat
-			}));
-			else success(await sdk.sendToAgent(target, {
-				format: options.format,
-				content,
-				metadata,
-				replyToInbox,
-				replyToChat
-			}));
-		} catch (error) {
-			handleSdkError(error);
-		}
-	});
-	agent.command("chats").description("List chats this agent participates in").option("-l, --limit <number>", "Maximum chats to return (1-100)", "20").option("--cursor <cursor>", "Pagination cursor from previous response").option("--agent <name>", "Agent name on the Hub (default: first configured on this client)").action(async (options) => {
-		try {
-			const limit = parseLimit(options.limit, 100);
-			success(await createSdk(options.agent).listChats({
-				limit,
-				cursor: options.cursor
-			}));
-		} catch (error) {
-			handleSdkError(error);
-		}
-	});
-	agent.command("history <chatId>").description("View message history in a chat").option("-l, --limit <number>", "Maximum messages to return (1-100)", "20").option("--cursor <cursor>", "Pagination cursor from previous response").option("--agent <name>", "Agent name on the Hub (default: first configured on this client)").action(async (chatId, options) => {
-		try {
-			const limit = parseLimit(options.limit, 100);
-			success(await createSdk(options.agent).listMessages(chatId, {
-				limit,
-				cursor: options.cursor
-			}));
-		} catch (error) {
-			handleSdkError(error);
-		}
-	});
 	agent.command("status [name]").description("Show agent runtime status from Hub server").option("--server <url>", "Hub server URL").action(async (name, options) => {
 		try {
 			const serverUrl = resolveServerUrl(options?.server);
@@ -720,11 +645,12 @@ function registerAgentCommands(program) {
 			fail("RESET_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
-	agent.command("sessions <agent-name>").description("List sessions for an agent").option("--server <url>", "Hub server URL").option("--state <state>", "Filter by session state (active/suspended/evicted)").action(async (agentName, options) => {
+	const sessionCmd = agent.command("session").description("Session lifecycle commands");
+	sessionCmd.command("list <agent-name>").description("List sessions for an agent").option("--server <url>", "Hub server URL").option("--state <state>", "Filter by session state (active/suspended/evicted)").action(async (agentName, options) => {
 		try {
 			const serverUrl = resolveServerUrl(options.server);
 			const adminToken = await ensureFreshAccessToken();
-			const agentId = (await resolveAgent(serverUrl, adminToken, agentName)).uuid;
+			const agentId = (await resolveAgent$1(serverUrl, adminToken, agentName)).uuid;
 			const response = await cliFetch(`${serverUrl}/api/v1/agents/${agentId}/sessions${options.state ? `?state=${options.state}` : ""}`, {
 				headers: { Authorization: `Bearer ${adminToken}` },
 				signal: AbortSignal.timeout(1e4)
@@ -748,12 +674,11 @@ function registerAgentCommands(program) {
 			fail("SESSIONS_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
-	const sessionCmd = agent.command("session").description("Session lifecycle commands");
 	for (const [cmd, desc] of [["suspend", "Suspend a session"], ["terminate", "Terminate a session"]]) sessionCmd.command(`${cmd} <agent-name> <chat-id>`).description(desc).option("--server <url>", "Hub server URL").action(async (agentName, chatId, options) => {
 		try {
 			const serverUrl = resolveServerUrl(options.server);
 			const adminToken = await ensureFreshAccessToken();
-			const agentId = (await resolveAgent(serverUrl, adminToken, agentName)).uuid;
+			const agentId = (await resolveAgent$1(serverUrl, adminToken, agentName)).uuid;
 			const response = await cliFetch(`${serverUrl}/api/v1/agents/${agentId}/sessions/${chatId}/${cmd}`, {
 				method: "POST",
 				headers: { Authorization: `Bearer ${adminToken}` },
@@ -768,7 +693,167 @@ function registerAgentCommands(program) {
 			fail("SESSION_CMD_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
-	agent.command("chat <agent-name>").description("Open an interactive chat with an agent (as the current member's human agent)").option("--server <url>", "Hub server URL").action(async (agentName, options) => {
+	const debugCmd = agent.command("debug", { hidden: true }).description("Low-level SDK debug commands");
+	debugCmd.command("register").description("Register this agent and return identity info").option("--agent <name>", "Agent name on the Hub (default: first configured on this client)").action(async (options) => {
+		try {
+			success(await createSdk$1(options.agent).register());
+		} catch (error) {
+			handleSdkError$1(error);
+		}
+	});
+	debugCmd.command("pull").description("Pull pending messages from inbox").option("-l, --limit <number>", "Maximum entries to return", "10").option("-a, --ack", "Automatically ACK entries after pulling").option("--agent <name>", "Agent name on the Hub (default: first configured on this client)").action(async (options) => {
+		try {
+			const sdk = createSdk$1(options.agent);
+			const limit = parseLimit$1(options.limit, 50);
+			const result = await sdk.pull(limit);
+			if (options.ack && result.entries.length > 0) await Promise.all(result.entries.map((entry) => sdk.ack(entry.id)));
+			success(result);
+		} catch (error) {
+			handleSdkError$1(error);
+		}
+	});
+}
+//#endregion
+//#region src/commands/chat.ts
+function resolveLocalAgent(agentName) {
+	const agentsDir = join(DEFAULT_CONFIG_DIR, "agents");
+	const agents = loadAgents({
+		schema: agentConfigSchema,
+		agentsDir
+	});
+	const resolution = resolveSenderName({
+		override: agentName,
+		envAgentId: process.env.FIRST_TREE_HUB_AGENT_ID,
+		agents
+	});
+	let resolvedName;
+	if (resolution.kind === "ok") resolvedName = resolution.name;
+	else if (resolution.kind === "none") fail("MISSING_AGENT", "No agent configured. Run `first-tree-hub agent add` first.", 2);
+	else if (resolution.kind === "envMismatch") fail("ENV_AGENT_NOT_LOCAL", `FIRST_TREE_HUB_AGENT_ID="${resolution.envAgentId}" is not configured on this machine. Available local agents: ${resolution.available.join(", ")}. Pick one explicitly: \`first-tree-hub chat send --agent <senderName> <recipientName> "..."\`.`, 2);
+	else fail("AMBIGUOUS_AGENT", `Multiple agents are configured on this machine (${resolution.available.join(", ")}) and FIRST_TREE_HUB_AGENT_ID is not set, so the CLI can't tell which one is the sender. Specify it explicitly: \`first-tree-hub chat send --agent <senderName> <recipientName> "..."\` (--agent picks the SENDER; the recipient is the next positional argument).`, 2);
+	const cfg = agents.get(resolvedName);
+	if (!cfg) fail("UNKNOWN_AGENT", `Agent "${resolvedName}" not found in ${agentsDir}`, 2);
+	let serverUrl;
+	try {
+		serverUrl = resolveServerUrl(process.env.FIRST_TREE_HUB_SERVER_URL);
+	} catch (error) {
+		fail("MISSING_SERVER_URL", error instanceof Error ? error.message : String(error), 2);
+	}
+	return {
+		serverUrl,
+		agentId: cfg.agentId
+	};
+}
+function createSdk(agentName) {
+	const { serverUrl, agentId } = resolveLocalAgent(agentName);
+	return new FirstTreeHubSDK({
+		serverUrl,
+		getAccessToken: (opts) => ensureFreshAccessToken(opts),
+		agentId,
+		userAgent: CLI_USER_AGENT
+	});
+}
+function handleSdkError(error) {
+	if (error instanceof SdkError) {
+		const exitCode = error.statusCode === 401 ? 3 : 1;
+		fail(`HTTP_${error.statusCode}`, error.message, exitCode);
+	}
+	if (error instanceof TypeError && "cause" in error) fail("CONNECTION_ERROR", `Cannot connect to server: ${error.message}`, 6);
+	fail("UNKNOWN_ERROR", error instanceof Error ? error.message : String(error), 1);
+}
+function parseLimit(value, max) {
+	const limit = Number.parseInt(value, 10);
+	if (Number.isNaN(limit) || limit < 1 || limit > max) fail("INVALID_LIMIT", `Limit must be between 1 and ${max}.`, 2);
+	return limit;
+}
+const MAX_STDIN_BYTES = 10 * 1024 * 1024;
+function readStdin() {
+	if (process.stdin.isTTY) return Promise.resolve(null);
+	return new Promise((resolve, reject) => {
+		const chunks = [];
+		let totalSize = 0;
+		process.stdin.on("data", (chunk) => {
+			totalSize += chunk.length;
+			if (totalSize > MAX_STDIN_BYTES) {
+				process.stdin.destroy();
+				reject(/* @__PURE__ */ new Error(`stdin exceeds ${MAX_STDIN_BYTES} bytes`));
+				return;
+			}
+			chunks.push(chunk);
+		});
+		process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
+		process.stdin.on("error", reject);
+	});
+}
+async function resolveAgent(serverUrl, adminToken, agentName) {
+	const res = await cliFetch(`${serverUrl}/api/v1/me/managed-agents`, {
+		headers: { Authorization: `Bearer ${adminToken}` },
+		signal: AbortSignal.timeout(1e4)
+	});
+	if (!res.ok) fail("FETCH_ERROR", `Failed to list agents: ${res.status}`, 1);
+	const found = (await res.json()).find((a) => a.name === agentName || a.uuid === agentName);
+	if (!found) fail("NOT_FOUND", `Agent "${agentName}" not found`, 1);
+	return found;
+}
+function registerChatCommands(program) {
+	const chat = program.command("chat").description("Chats and messaging — list, history, send, open");
+	chat.command("send <target> [message]").description("Send a message to an agent or chat").option("-f, --format <format>", "Message format (text|markdown|card)", "text").option("--chat", "Treat target as chat ID instead of agent ID").option("-m, --metadata <json>", "JSON metadata to attach").option("--reply-to <messageId>", "Message ID to reply to").option("--reply-to-inbox <inboxId>", "Cross-chat reply target inbox").option("--reply-to-chat <chatId>", "Cross-chat reply target chat").option("--agent <name>", "Agent name on the Hub (default: first configured on this client)").action(async (target, message, options) => {
+		try {
+			const content = message ?? await readStdin();
+			if (!content) fail("NO_MESSAGE", "No message provided. Pass as argument or pipe via stdin.", 2);
+			let metadata;
+			if (options.metadata) try {
+				metadata = JSON.parse(options.metadata);
+			} catch {
+				fail("INVALID_METADATA", "Metadata must be valid JSON.", 2);
+			}
+			const { replyToInbox, replyToChat } = resolveReplyToFromEnv(process.env, {
+				replyToInbox: options.replyToInbox,
+				replyToChat: options.replyToChat
+			});
+			const sdk = createSdk(options.agent);
+			if (options.chat) success(await sdk.sendMessage(target, {
+				format: options.format,
+				content,
+				metadata,
+				inReplyTo: options.replyTo,
+				replyToInbox,
+				replyToChat
+			}));
+			else success(await sdk.sendToAgent(target, {
+				format: options.format,
+				content,
+				metadata,
+				replyToInbox,
+				replyToChat
+			}));
+		} catch (error) {
+			handleSdkError(error);
+		}
+	});
+	chat.command("list").description("List chats this agent participates in").option("-l, --limit <number>", "Maximum chats to return (1-100)", "20").option("--cursor <cursor>", "Pagination cursor from previous response").option("--agent <name>", "Agent name on the Hub (default: first configured on this client)").action(async (options) => {
+		try {
+			const limit = parseLimit(options.limit, 100);
+			success(await createSdk(options.agent).listChats({
+				limit,
+				cursor: options.cursor
+			}));
+		} catch (error) {
+			handleSdkError(error);
+		}
+	});
+	chat.command("history <chatId>").description("View message history in a chat").option("-l, --limit <number>", "Maximum messages to return (1-100)", "20").option("--cursor <cursor>", "Pagination cursor from previous response").option("--agent <name>", "Agent name on the Hub (default: first configured on this client)").action(async (chatId, options) => {
+		try {
+			const limit = parseLimit(options.limit, 100);
+			success(await createSdk(options.agent).listMessages(chatId, {
+				limit,
+				cursor: options.cursor
+			}));
+		} catch (error) {
+			handleSdkError(error);
+		}
+	});
+	chat.command("open <agent-name>").description("Open an interactive chat with an agent (as the current member's human agent)").option("--server <url>", "Hub server URL").action(async (agentName, options) => {
 		try {
 			const serverUrl = resolveServerUrl(options.server);
 			const adminToken = await ensureFreshAccessToken();
@@ -857,277 +942,6 @@ function registerAgentCommands(program) {
 			fail("CHAT_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
-	agent.command("register").description("Register this agent and return identity info").option("--agent <name>", "Agent name on the Hub (default: first configured on this client)").action(async (options) => {
-		try {
-			success(await createSdk(options.agent).register());
-		} catch (error) {
-			handleSdkError(error);
-		}
-	});
-	agent.command("pull").description("Pull pending messages from inbox").option("-l, --limit <number>", "Maximum entries to return", "10").option("-a, --ack", "Automatically ACK entries after pulling").option("--agent <name>", "Agent name on the Hub (default: first configured on this client)").action(async (options) => {
-		try {
-			const sdk = createSdk(options.agent);
-			const limit = parseLimit(options.limit, 50);
-			const result = await sdk.pull(limit);
-			if (options.ack && result.entries.length > 0) await Promise.all(result.entries.map((entry) => sdk.ack(entry.id)));
-			success(result);
-		} catch (error) {
-			handleSdkError(error);
-		}
-	});
-}
-//#endregion
-//#region src/commands/connect.ts
-/** Decode a JWT payload without signature verification. For UI purposes only. */
-function decodeJwtPayload(token) {
-	try {
-		const parts = token.split(".");
-		if (parts.length !== 3 || !parts[1]) return null;
-		const raw = Buffer.from(parts[1], "base64url").toString();
-		const obj = JSON.parse(raw);
-		if (typeof obj !== "object" || obj === null) return null;
-		return obj;
-	} catch {
-		return null;
-	}
-}
-/**
-* Detect if the current home already holds a setup for a *different* account,
-* and give the operator a chance to back out before we overwrite credentials.
-*
-* Why this gate exists: running `client connect` implicitly overwrites
-* `~/.first-tree/hub/config/credentials.json`. Without this prompt, someone
-* onboarding a second account on their own machine silently logs themselves
-* out of the first account — they'd only notice when their "main" agents
-* appeared offline later. We treat single-account-per-machine as the product
-* default; the `FIRST_TREE_HUB_HOME` env var remains the advanced escape
-* hatch for power users who want parallel setups.
-*
-* The caller passes the *new* memberId directly so this gate can run BEFORE
-* auth. That matters for the `--token` path: connect tokens are single-use;
-* if we auth first and the user picks Cancel, the token is burned even
-* though nothing changed on disk. Decoding the connect token locally lets
-* us return early without spending it.
-*
-* Behavior:
-*   - No existing credentials → proceed silently (first-time install).
-*   - Existing credentials, same memberId → proceed silently (reconnect /
-*     token refresh — common + safe).
-*   - Existing credentials, memberId indeterminate → prompt with
-*     "unknown account" label so the user can decide.
-*   - Existing credentials, different memberId → prompt [Replace / Cancel].
-*     Cancel prints the isolation guide and returns "cancel".
-*/
-async function promptReplaceOrCancel(newMemberId, newServerUrl) {
-	const existing = loadCredentials();
-	if (!existing) return "proceed";
-	const existingPayload = decodeJwtPayload(existing.accessToken);
-	const existingMemberId = typeof existingPayload?.memberId === "string" ? existingPayload.memberId : null;
-	if (existingMemberId && existingMemberId === newMemberId) return "proceed";
-	const existingMember = existingMemberId ? `member ${existingMemberId.slice(0, 8)}` : "unknown account";
-	const existingOrg = typeof existingPayload?.organizationId === "string" ? existingPayload.organizationId : null;
-	const serviceStatus = getClientServiceStatus();
-	const serviceLine = serviceStatus.state === "active" ? `running (${serviceStatus.detail ?? "live"})` : serviceStatus.state === "inactive" ? `installed but not running${serviceStatus.detail ? ` — ${serviceStatus.detail}` : ""}` : "not installed";
-	print.line("\n");
-	print.line("  ⚠️  This computer is already connected to the Hub under another account.\n\n");
-	print.line(`       Existing account:  ${existingMember}\n`);
-	if (existingOrg) print.line(`       Organization:      ${existingOrg.slice(0, 8)}\n`);
-	print.line(`       Server:            ${existing.serverUrl}\n`);
-	print.line(`       Background service: ${serviceLine}\n\n`);
-	print.line("     Replacing only affects THIS computer. Your agents, messages, and\n");
-	print.line("     settings on the Hub itself are untouched.\n\n");
-	if (await select({
-		message: "How would you like to continue?",
-		choices: [{
-			name: "Replace — log out the other account and set up this one",
-			value: "replace"
-		}, {
-			name: "Cancel  — keep the existing setup on this computer",
-			value: "cancel"
-		}]
-	}) === "cancel") {
-		printIsolationGuide(newServerUrl);
-		return "cancel";
-	}
-	return "proceed";
-}
-function printIsolationGuide(newServerUrl) {
-	print.line("\n  Cancelled. The existing account on this computer is untouched.\n\n");
-	print.line("  To run this new account alongside it (advanced — no background service):\n\n");
-	print.line("    export FIRST_TREE_HUB_HOME=\"$HOME/.first-tree/hub-<label>\"\n");
-	print.line(`    first-tree-hub client connect ${newServerUrl} --token <token>\n`);
-	print.line("    first-tree-hub client start\n\n");
-	print.line("  Notes:\n");
-	print.line("    - Run the commands in a FRESH terminal (the isolated home must be set first).\n");
-	print.line("    - In isolated mode the client stays online only while that terminal runs.\n");
-	print.line("    - The main account's background service is not affected.\n\n");
-}
-/**
-* Authenticate via connect token — exchange for full JWT credentials.
-*/
-async function authenticateWithToken(url, token) {
-	const res = await cliFetch(`${url}/api/v1/auth/connect-token`, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({ token }),
-		signal: AbortSignal.timeout(1e4)
-	});
-	if (!res.ok) fail("AUTH_ERROR", (await res.json().catch(() => ({}))).error ?? `Token exchange failed (HTTP ${res.status})`, 1);
-	return await res.json();
-}
-/**
-* Authenticate via interactive username/password login.
-*/
-async function authenticateInteractive(url) {
-	print.line("\n  Log in to Hub:\n");
-	const username = await input({ message: "  Username:" });
-	const pw = await password({ message: "  Password:" });
-	const loginRes = await cliFetch(`${url}/api/v1/auth/login`, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({
-			username,
-			password: pw
-		}),
-		signal: AbortSignal.timeout(1e4)
-	});
-	if (!loginRes.ok) fail("AUTH_ERROR", (await loginRes.json().catch(() => ({}))).error ?? `Login failed (HTTP ${loginRes.status})`, 1);
-	return await loginRes.json();
-}
-function registerConnectCommand(parent) {
-	parent.command("connect <server-url>").description("Connect to a Hub server — configure, authenticate, and install the background service").option("--token <token>", "Connect token (from Hub web console) — skips interactive login").option("--no-service", "Skip background service install (runs inline until Ctrl+C)").action(async (serverUrl, options) => {
-		try {
-			const url = serverUrl.replace(/\/+$/, "");
-			let preAuthDecided = false;
-			if (options.token) {
-				const connectPayload = decodeJwtPayload(options.token);
-				const newMemberId = typeof connectPayload?.memberId === "string" ? connectPayload.memberId : null;
-				if (newMemberId !== null) {
-					if (await promptReplaceOrCancel(newMemberId, url) === "cancel") return;
-					preAuthDecided = true;
-				}
-			}
-			const tokens = options.token ? await authenticateWithToken(url, options.token) : await authenticateInteractive(url);
-			if (!preAuthDecided) {
-				const newPayload = decodeJwtPayload(tokens.accessToken);
-				const newMemberId = typeof newPayload?.memberId === "string" ? newPayload.memberId : null;
-				if (newMemberId !== null) {
-					if (await promptReplaceOrCancel(newMemberId, url) === "cancel") return;
-				}
-			}
-			setConfigValue(join(DEFAULT_CONFIG_DIR, "client.yaml"), "server.url", url);
-			print.line(`\n  \u2713 Server configured: ${url}\n`);
-			saveCredentials({
-				...tokens,
-				serverUrl: url
-			});
-			print.line("  ✓ Authenticated\n");
-			resetConfig();
-			resetConfigMeta();
-			const config = await initConfig({
-				schema: clientConfigSchema,
-				role: "client"
-			});
-			print.line(`  \u2713 Connected as this computer (id: ${config.client.id})\n`);
-			if (options.service !== false && isServiceSupported()) {
-				const info = installClientService();
-				print.line(`  \u2713 Installed as a background service (${info.platform}) — you can close this terminal\n\n`);
-				print.line(`    Unit:  ${info.unitPath}\n`);
-				print.line(`    Logs:  ${info.logDir}\n`);
-				if (info.state === "active" && info.detail) print.line(`    State: running (${info.detail})\n`);
-				print.line("\n");
-				return;
-			}
-			if (options.service === false) print.line("  (--no-service) running inline — Ctrl+C to stop\n");
-			else print.line(`  Background service not supported on ${process.platform}; running inline.\n`);
-			const agentsDir = join(DEFAULT_CONFIG_DIR, "agents");
-			try {
-				await migrateLocalAgentDirs({
-					agentsDir,
-					workspacesDir: join(DEFAULT_DATA_DIR, "workspaces"),
-					sessionsDir: join(DEFAULT_DATA_DIR, "sessions"),
-					resolver: createApiNameResolver(config.server.url, () => ensureFreshAccessToken())
-				});
-			} catch (err) {
-				const msg = err instanceof Error ? err.message : String(err);
-				print.status("⚠️", `agent-dir migration skipped: ${msg}`);
-			}
-			let probedCapabilities = null;
-			try {
-				const accessToken = await ensureFreshAccessToken();
-				probedCapabilities = await probeCapabilities();
-				await reconcileLocalRuntimeProviders({
-					serverUrl: config.server.url,
-					accessToken,
-					agentsDir,
-					log: (level, msg) => print.status(level === "warn" ? "⚠️" : "•", msg)
-				});
-			} catch (err) {
-				const msg = err instanceof Error ? err.message : String(err);
-				print.status("⚠️", `runtime-provider reconcile skipped: ${msg}`);
-			}
-			const agents = loadAgents({
-				schema: agentConfigSchema,
-				agentsDir
-			});
-			const runtime = new ClientRuntime(config.server.url, config.client.id, {
-				currentVersion: COMMAND_VERSION,
-				update: {
-					updateConfig: config.update,
-					prompt: promptUpdate,
-					executeUpdate: createExecuteUpdate({ managed: false })
-				}
-			});
-			for (const [name, agentConfig] of agents) runtime.addAgent(name, agentConfig);
-			await runtime.start();
-			if (probedCapabilities) try {
-				const accessToken = await ensureFreshAccessToken();
-				await uploadClientCapabilities({
-					serverUrl: config.server.url,
-					accessToken,
-					clientId: config.client.id,
-					capabilities: probedCapabilities
-				});
-			} catch (err) {
-				const msg = err instanceof Error ? err.message : String(err);
-				print.status("⚠️", `capabilities upload skipped: ${msg}`);
-			}
-			runtime.watchAgentsDir(agentsDir);
-			const shutdown = async () => {
-				print.line("\n  Shutting down...\n");
-				runtime.unwatchAgentsDir();
-				await runtime.stop();
-				process.exit(0);
-			};
-			process.on("SIGINT", () => void shutdown());
-			process.on("SIGTERM", () => void shutdown());
-			await new Promise(() => {});
-		} catch (error) {
-			if (error.name === "ExitPromptError") {
-				print.line("\n  Cancelled.\n");
-				return;
-			}
-			if (error instanceof ClientUserMismatchError) {
-				print.line("\n");
-				print.line("  ⚠️  This client.yaml is owned by a different user.\n");
-				print.line("  Run `first-tree-hub client claim --confirm` to transfer ownership\n");
-				print.line("  to your account. The previous owner's agents will be unpinned\n");
-				print.line("  from this machine.\n\n");
-				process.exit(1);
-			}
-			if (error instanceof ClientOrgMismatchError) await handleClientOrgMismatch(error, {
-				managed: false,
-				configDir: DEFAULT_CONFIG_DIR,
-				rerunCommand: `first-tree-hub client connect ${serverUrl}${options.token ? " --token <token>" : ""}${options.service === false ? " --no-service" : ""}`
-			});
-			const msg = error instanceof Error ? error.message : String(error);
-			print.line(`  Error: ${msg}\n`);
-			process.exit(1);
-		} finally {
-			resetConfig();
-			resetConfigMeta();
-		}
-	});
 }
 //#endregion
 //#region src/commands/client.ts
@@ -1142,7 +956,6 @@ function isWslDbusOvermount(reason) {
 }
 function registerClientCommands(program) {
 	const client = program.command("client").description("Client runtime — connect agents to the server");
-	registerConnectCommand(client);
 	client.command("start").description("Start client — connect all configured agents to the server").option("--no-interactive", "Skip interactive prompts (for Docker/CI)").option("--foreground", "Run inline instead of delegating to the background service (for debugging)").action(async (options) => {
 		try {
 			const isSupervisorChild = options.interactive === false && process.env.FIRST_TREE_HUB_SERVICE_MODE === "1";
@@ -1362,7 +1175,7 @@ function registerClientCommands(program) {
 		}
 		if (getClientServiceStatus().state === "not-installed") {
 			print.line("\n  No background service installed.\n");
-			print.line("  Run `first-tree-hub client connect <url>` first.\n\n");
+			print.line("  Run `first-tree-hub connect <token>` first.\n\n");
 			process.exit(1);
 		}
 		const res = restartClientService();
@@ -1381,7 +1194,7 @@ function registerClientCommands(program) {
 			const tail = svc.platform === "systemd" ? `  (logs: journalctl --user -u ${svc.label.replace(/\.service$/, "")} -f)` : "";
 			if (svc.state === "active") print.line(`  Service:  ✓ running (${svc.platform}${svc.detail ? `, ${svc.detail}` : ""})${tail}\n`);
 			else if (svc.state === "inactive") print.line(`  Service:  ✗ stopped (${svc.platform}${svc.detail ? `, ${svc.detail}` : ""})\n`);
-			else if (svc.state === "not-installed") print.line("  Service:  not installed — run `first-tree-hub client connect <url>`\n");
+			else if (svc.state === "not-installed") print.line("  Service:  not installed — run `first-tree-hub connect <token>`\n");
 			else print.line(`  Service:  unknown (${svc.platform}${svc.detail ? `, ${svc.detail}` : ""})\n`);
 		} else print.line(`  Service:  not supported on ${process.platform} (runs inline)\n`);
 		const clientYaml = join(DEFAULT_CONFIG_DIR, "client.yaml");
@@ -1395,7 +1208,7 @@ function registerClientCommands(program) {
 			const msg = err instanceof Error ? err.message : String(err);
 			print.line(`  Hub:      (could not read ${clientYaml}: ${msg.slice(0, 60)})\n`);
 		}
-		else print.line("  Hub:      (not configured — run `first-tree-hub client connect <url>`)\n");
+		else print.line("  Hub:      (not configured — run `first-tree-hub connect <token>`)\n");
 		const creds = loadCredentials();
 		if (creds) {
 			const exp = decodeJwtExpSeconds(creds.refreshToken);
@@ -1413,7 +1226,7 @@ function registerClientCommands(program) {
 					print.line(`  Auth:     ✓ refresh token valid for ~${days}d\n`);
 				}
 			}
-		} else print.line("  Auth:     (no credentials — run `first-tree-hub client connect <url>`)\n");
+		} else print.line("  Auth:     (no credentials — run `first-tree-hub connect <token>`)\n");
 		const agentsDir = join(DEFAULT_CONFIG_DIR, "agents");
 		try {
 			const agents = loadAgents({
@@ -1431,7 +1244,7 @@ function registerClientCommands(program) {
 			print.line("  Agents:   (no agents directory)\n\n");
 		}
 	});
-	client.command("hub-list").description("List clients on the Hub server").option("--server <url>", "Hub server URL").action(async (options) => {
+	client.command("list").description("List clients on the Hub server").option("--server <url>", "Hub server URL").action(async (options) => {
 		try {
 			const serverUrl = resolveServerUrl(options.server);
 			const token = await ensureFreshAccessToken();
@@ -1556,7 +1369,7 @@ function registerClientCommands(program) {
 			resetConfigMeta();
 		}
 	});
-	client.command("hub-disconnect <clientId>").description("Force-disconnect a client from the Hub server").option("--server <url>", "Hub server URL").action(async (clientId, options) => {
+	client.command("disconnect <clientId>").description("Force-disconnect a client from the Hub server").option("--server <url>", "Hub server URL").action(async (clientId, options) => {
 		try {
 			const serverUrl = resolveServerUrl(options.server);
 			const token = await ensureFreshAccessToken();
@@ -1571,109 +1384,47 @@ function registerClientCommands(program) {
 			fail("DISCONNECT_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
-}
-function timeSince(isoDate) {
-	const ms = Date.now() - new Date(isoDate).getTime();
-	const seconds = Math.floor(ms / 1e3);
-	if (seconds < 60) return `${seconds}s`;
-	const minutes = Math.floor(seconds / 60);
-	if (minutes < 60) return `${minutes}m`;
-	const hours = Math.floor(minutes / 60);
-	if (hours < 24) return `${hours}h ${minutes % 60}m`;
-	return `${Math.floor(hours / 24)}d ${hours % 24}h`;
-}
-/** Read a `dot.path.like.this` from a parsed YAML object, returning string | null. */
-function getNested(obj, path) {
-	let cur = obj;
-	for (const part of path.split(".")) {
-		if (cur === null || cur === void 0 || typeof cur !== "object") return null;
-		cur = cur[part];
-	}
-	return typeof cur === "string" ? cur : null;
-}
-/**
-* Pull the `exp` claim (in seconds since epoch) out of a JWT without
-* verifying the signature — the `client status` auth-health line just
-* needs the wall-clock countdown, not a trust decision. Returns null
-* for malformed tokens so the caller can render a friendly fallback
-* instead of crashing.
-*/
-function decodeJwtExpSeconds(token) {
-	const parts = token.split(".");
-	if (parts.length < 2 || !parts[1]) return null;
-	try {
-		const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-		const pad = b64.length % 4 === 0 ? "" : "=".repeat(4 - b64.length % 4);
-		const payload = JSON.parse(Buffer.from(b64 + pad, "base64").toString("utf-8"));
-		return typeof payload.exp === "number" ? payload.exp : null;
-	} catch {
-		return null;
-	}
-}
-//#endregion
-//#region src/commands/config.ts
-function resolveConfigPath(flags) {
-	if (flags.agent) return {
-		path: join(DEFAULT_CONFIG_DIR, "agents", flags.agent, "agent.yaml"),
-		schema: agentConfigSchema
-	};
-	if (flags.client) return {
-		path: join(DEFAULT_CONFIG_DIR, "client.yaml"),
-		schema: clientConfigSchema
-	};
-	return {
-		path: join(DEFAULT_CONFIG_DIR, "server.yaml"),
-		schema: serverConfigSchema
-	};
-}
-function addScopeOptions(cmd) {
-	return cmd.option("-s, --server", "Server config scope (default)").option("-c, --client", "Client config scope").option("-a, --agent <name>", "Agent config scope");
-}
-function registerConfigCommands(program) {
-	const config = program.command("config").description("Configuration management");
-	config.command("setup").description("Interactive configuration wizard").option("-s, --server", "Configure server (default)").option("-c, --client", "Configure client").action(async (flags) => {
-		try {
-			await promptMissingFields({
-				schema: flags.client ? clientConfigSchema : serverConfigSchema,
-				role: flags.client ? "client" : "server"
-			});
-			print.line("\n  Configuration saved.\n");
-		} catch (error) {
-			if (error.name === "ExitPromptError") {
-				print.line("\n  Cancelled.\n");
+	const config = client.command("config").description("View and modify this machine's client.yaml");
+	const clientYamlPath = () => join(DEFAULT_CONFIG_DIR, "client.yaml");
+	const clientSchema = clientConfigSchema;
+	config.command("show [key]").description("Show client.yaml — print all values, or a single key with dot-notation").option("--show-secrets", "Show secret values in plaintext").action((key, flags) => {
+		const path = clientYamlPath();
+		if (key) {
+			const value = getConfigValue(path, key);
+			if (value === void 0) {
+				print.line(`  ${key}: (not set)\n`);
 				return;
 			}
-			throw error;
+			const display = isSecretField(clientSchema, key) && !flags.showSecrets ? "***" : String(value);
+			print.line(`  ${key}: ${display}\n`);
+			return;
 		}
+		const values = readConfigFile(path);
+		if (Object.keys(values).length === 0) {
+			print.line(`  No config found at ${path}\n`);
+			return;
+		}
+		print.line(`\n  Config: ${path}\n\n`);
+		printFlat(values, clientSchema, "", flags.showSecrets ?? false);
+		print.line("\n");
 	});
-	addScopeOptions(config.command("set").description("Set a config value")).argument("<key>", "Config key (dot notation, e.g. database.url)").argument("<value>", "Config value").action((key, value, flags) => {
-		const { path } = resolveConfigPath(flags);
+	config.command("set <key> <value>").description("Set a value in client.yaml (dot-notation)").action((key, value) => {
 		let parsed = value;
 		if (value === "true") parsed = true;
 		else if (value === "false") parsed = false;
 		else if (/^\d+$/.test(value)) parsed = Number(value);
+		const path = clientYamlPath();
 		setConfigValue(path, key, parsed);
 		print.line(`  Set ${key} in ${path}\n`);
 	});
-	addScopeOptions(config.command("get").description("Get a config value")).argument("<key>", "Config key (dot notation)").option("--show-secrets", "Show secret values in plaintext").action((key, flags) => {
-		const { path, schema } = resolveConfigPath(flags);
-		const value = getConfigValue(path, key);
-		if (value === void 0) print.line(`  ${key}: (not set)\n`);
-		else {
-			const display = isSecretField(schema, key) && !flags.showSecrets ? "***" : String(value);
-			print.line(`  ${key}: ${display}\n`);
-		}
-	});
-	addScopeOptions(config.command("list").description("List all config values")).option("--show-secrets", "Show secret values in plaintext").action((flags) => {
-		const { path, schema } = resolveConfigPath(flags);
-		const values = readConfigFile(path);
-		if (Object.keys(values).length === 0) {
-			print.line(`  No config found at ${path}\n`);
+	config.command("get <key>").description("Get a value from client.yaml (alias for `show <key>`)").option("--show-secrets", "Show secret values in plaintext").action((key, flags) => {
+		const value = getConfigValue(clientYamlPath(), key);
+		if (value === void 0) {
+			print.line(`  ${key}: (not set)\n`);
 			return;
 		}
-		print.line(`\n  Config: ${path}\n\n`);
-		printFlat(values, schema, "", flags.showSecrets ?? false);
-		print.line("\n");
+		const display = isSecretField(clientSchema, key) && !flags.showSecrets ? "***" : String(value);
+		print.line(`  ${key}: ${display}\n`);
 	});
 }
 function printFlat(obj, schema, prefix, showSecrets) {
@@ -1686,7 +1437,6 @@ function printFlat(obj, schema, prefix, showSecrets) {
 		}
 	}
 }
-/** Check if a dot-path corresponds to a secret field in the schema. */
 function isSecretField(schema, dotPath) {
 	const parts = dotPath.split(".");
 	let current = schema;
@@ -1703,18 +1453,56 @@ function isSecretField(schema, dotPath) {
 	}
 	return false;
 }
+function timeSince(isoDate) {
+	const ms = Date.now() - new Date(isoDate).getTime();
+	const seconds = Math.floor(ms / 1e3);
+	if (seconds < 60) return `${seconds}s`;
+	const minutes = Math.floor(seconds / 60);
+	if (minutes < 60) return `${minutes}m`;
+	const hours = Math.floor(minutes / 60);
+	if (hours < 24) return `${hours}h ${minutes % 60}m`;
+	return `${Math.floor(hours / 24)}d ${hours % 24}h`;
+}
+/** Read a `dot.path.like.this` from a parsed YAML object, returning string | null. */
+function getNested(obj, path) {
+	let cur = obj;
+	for (const part of path.split(".")) {
+		if (cur === null || cur === void 0 || typeof cur !== "object") return null;
+		cur = cur[part];
+	}
+	return typeof cur === "string" ? cur : null;
+}
+/**
+* Pull the `exp` claim (in seconds since epoch) out of a JWT without
+* verifying the signature — the `client status` auth-health line just
+* needs the wall-clock countdown, not a trust decision. Returns null
+* for malformed tokens so the caller can render a friendly fallback
+* instead of crashing.
+*/
+function decodeJwtExpSeconds(token) {
+	const parts = token.split(".");
+	if (parts.length < 2 || !parts[1]) return null;
+	try {
+		const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+		const pad = b64.length % 4 === 0 ? "" : "=".repeat(4 - b64.length % 4);
+		const payload = JSON.parse(Buffer.from(b64 + pad, "base64").toString("utf-8"));
+		return typeof payload.exp === "number" ? payload.exp : null;
+	} catch {
+		return null;
+	}
+}
 //#endregion
 //#region src/commands/onboard.ts
 async function promptMissing(args) {
 	if (!args.server) try {
-		const { resolveServerUrl } = await import("../bootstrap-BCZC1ki6.mjs").then((n) => n.r);
+		const { resolveServerUrl } = await import("../bootstrap-Cya2OoHz.mjs").then((n) => n.r);
 		resolveServerUrl();
 	} catch {
 		args.server = await input({ message: "Hub server URL:" });
 		saveOnboardState(args);
 	}
-	const { loadCredentials } = await import("../bootstrap-BCZC1ki6.mjs").then((n) => n.r);
-	if (!loadCredentials()) throw new Error("No saved credentials. Run `first-tree-hub client connect <server-url>` before onboarding.");
+	const { loadCredentials } = await import("../bootstrap-Cya2OoHz.mjs").then((n) => n.r);
+	if (!loadCredentials()) throw new Error("No saved credentials. Run `first-tree-hub connect <token>` before onboarding.");
 	if (!args.id) {
 		args.id = await input({ message: "Agent ID:" });
 		saveOnboardState(args);
@@ -1947,7 +1735,7 @@ function registerServerCommands(program) {
 			process.exit(1);
 		}
 	});
-	server.command("db:migrate").description("Run database migrations").action(async () => {
+	server.command("migrate").description("Run database migrations").action(async () => {
 		try {
 			const tableCount = await runMigrations((await initConfig({
 				schema: serverConfigSchema,
@@ -1960,7 +1748,7 @@ function registerServerCommands(program) {
 			process.exit(1);
 		}
 	});
-	server.command("admin:create").description("Create an admin user with organization").option("-u, --username <name>", "Admin username", "admin").option("-n, --name <name>", "Display name", "Admin").option("-o, --org <org>", "Organization slug", "default").option("-p, --password <pass>", "Password (auto-generated if omitted)").action(async (options) => {
+	server.command("admin").description("Admin user management").command("create").description("Create an admin user with organization").option("-u, --username <name>", "Admin username", "admin").option("-n, --name <name>", "Display name", "Admin").option("-o, --org <org>", "Organization slug", "default").option("-p, --password <pass>", "Password (auto-generated if omitted)").action(async (options) => {
 		try {
 			const result = await createOwner((await initConfig({
 				schema: serverConfigSchema,
@@ -2039,7 +1827,7 @@ function registerUpdateCommand(program) {
 		const svc = getClientServiceStatus();
 		if (svc.state === "not-installed") {
 			print.line("  No background service installed — nothing to restart.\n");
-			print.line("  Run `first-tree-hub client connect <url>` to set one up.\n\n");
+			print.line("  Run `first-tree-hub connect <token>` to set one up.\n\n");
 			return;
 		}
 		try {
@@ -2085,7 +1873,7 @@ registerSaaSConnectCommand(program);
 registerServerCommands(program);
 registerClientCommands(program);
 registerAgentCommands(program);
-registerConfigCommands(program);
+registerChatCommands(program);
 registerUpdateCommand(program);
 registerOnboardCommand(program);
 registerOrgCommands(program);