@agent-team-foundation/first-tree-hub 0.6.1 → 0.6.2

package/dist/cli/index.mjs

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { C as resetConfig, D as setConfigValue, E as serverConfigSchema, S as readConfigFile, _ as clientConfigSchema, b as initConfig, c as maskToken, d as saveAgentConfig, f as saveCredentials, g as agentConfigSchema, h as DEFAULT_HOME_DIR, i as ensureFreshAdminToken, l as resolveAgentToken, m as DEFAULT_DATA_DIR, p as DEFAULT_CONFIG_DIR, t as bootstrapToken, u as resolveServerUrl, w as resetConfigMeta, x as loadAgents, y as getConfigValue } from "../bootstrap-Dq_k_6ZD.mjs";
-import { A as FirstTreeHubSDK, D as ClientRuntime, E as stopPostgres, M as SessionRegistry, N as cleanWorkspaces, O as createOwner, _ as checkServerConfig, a as formatCheckReport, b as checkWebSocket, c as onboardCreate, d as checkAgentConfigs, f as checkAgentTokens, g as checkNodeVersion, h as checkDocker, i as promptMissingFields, j as SdkError, l as saveOnboardState, m as checkDatabase, n as isInteractive, o as loadOnboardState, p as checkClientConfig, r as promptAddAgent, s as onboardCheck, t as startServer, u as runMigrations, v as checkServerHealth, x as printResults, y as checkServerReachable } from "../core-Dt3yNBTm.mjs";
-import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-Y4m2zFc3.mjs";
+import { C as setConfigValue, S as serverConfigSchema, _ as loadAgents, b as resetConfigMeta, c as saveCredentials, f as agentConfigSchema, g as initConfig, h as getConfigValue, l as DEFAULT_CONFIG_DIR, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, r as ensureFreshAdminToken, s as saveAgentConfig, u as DEFAULT_DATA_DIR, v as readConfigFile, y as resetConfig } from "../bootstrap-DW7aIpmE.mjs";
+import { A as SdkError, D as createOwner, E as ClientRuntime, M as cleanWorkspaces, T as stopPostgres, _ as checkServerHealth, a as formatCheckReport, b as printResults, c as onboardCreate, d as checkAgentConfigs, f as checkClientConfig, g as checkServerConfig, h as checkNodeVersion, i as promptMissingFields, j as SessionRegistry, k as FirstTreeHubSDK, l as saveOnboardState, m as checkDocker, n as isInteractive, o as loadOnboardState, p as checkDatabase, r as promptAddAgent, s as onboardCheck, t as startServer, u as runMigrations, v as checkServerReachable, y as checkWebSocket } from "../core-RXUUKkCO.mjs";
+import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-BZ8pnMrQ.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
-import { existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { confirm, input, password, select } from "@inquirer/prompts";
 //#region src/cli/output.ts
@@ -27,28 +27,234 @@ function fail(code, message, exitCode = 1) {
 	process.exit(exitCode);
 }
 //#endregion
+//#region src/commands/agent-config.ts
+async function resolveAgentRecord(serverUrl, adminToken, agentName) {
+	const res = await fetch(`${serverUrl}/api/v1/admin/agents?limit=100`, {
+		headers: { Authorization: `Bearer ${adminToken}` },
+		signal: AbortSignal.timeout(1e4)
+	});
+	if (!res.ok) fail("FETCH_ERROR", `Failed to list agents: ${res.status}`, 1);
+	const found = (await res.json()).items.find((a) => a.name === agentName || a.uuid === agentName);
+	if (!found) fail("NOT_FOUND", `Agent "${agentName}" not found`, 1);
+	return found;
+}
+async function adminFetch(url, init) {
+	const { adminToken, headers, ...rest } = init;
+	const res = await fetch(url, {
+		...rest,
+		headers: {
+			Authorization: `Bearer ${adminToken}`,
+			...rest.body ? { "Content-Type": "application/json" } : {},
+			...headers
+		},
+		signal: AbortSignal.timeout(15e3)
+	});
+	if (!res.ok) {
+		const text = await res.text();
+		fail(`HTTP_${res.status}`, text || res.statusText, res.status === 401 ? 3 : 1);
+	}
+	return await res.json();
+}
+async function getCurrent(serverUrl, adminToken, agentId) {
+	return adminFetch(`${serverUrl}/api/v1/admin/agents/${agentId}/config`, {
+		method: "GET",
+		adminToken
+	});
+}
+async function patchConfig(serverUrl, adminToken, agentId, expectedVersion, patch) {
+	return adminFetch(`${serverUrl}/api/v1/admin/agents/${agentId}/config`, {
+		method: "PATCH",
+		adminToken,
+		body: JSON.stringify({
+			expectedVersion,
+			payload: patch
+		})
+	});
+}
+function printConfig(cfg) {
+	process.stdout.write(`Agent: ${cfg.agentId}\n`);
+	process.stdout.write(`Version: ${cfg.version} (updated ${cfg.updatedAt} by ${cfg.updatedBy})\n`);
+	process.stdout.write(`\nModel:    ${cfg.payload.model || "(unset)"}\n`);
+	process.stdout.write(`Prompt append: ${cfg.payload.prompt.append ? "(set)" : "(empty)"}\n`);
+	if (cfg.payload.prompt.append) process.stdout.write(`  > ${cfg.payload.prompt.append.replace(/\n/g, "\n  > ")}\n`);
+	process.stdout.write(`\nMCP servers (${cfg.payload.mcpServers.length}):\n`);
+	for (const s of cfg.payload.mcpServers) process.stdout.write(`  - ${s.name} [${s.transport}]\n`);
+	process.stdout.write(`\nEnv (${cfg.payload.env.length}):\n`);
+	for (const e of cfg.payload.env) process.stdout.write(`  - ${e.key}=${e.value} ${e.sensitive ? "(sensitive)" : ""}\n`);
+	process.stdout.write(`\nGit repos (${cfg.payload.gitRepos.length}):\n`);
+	for (const r of cfg.payload.gitRepos) {
+		const ref = r.ref ? `@${r.ref}` : "";
+		const path = r.localPath ? ` → ${r.localPath}` : "";
+		process.stdout.write(`  - ${r.url}${ref}${path}\n`);
+	}
+}
+function registerAgentConfigCommands(parent) {
+	const config = parent.command("config").description("Manage agent runtime configuration (Step 8)");
+	config.command("get <agent>").description("Print the current runtime config for an agent").action(async (agentName) => {
+		const serverUrl = resolveServerUrl(process.env.FIRST_TREE_HUB_SERVER_URL);
+		const adminToken = await ensureFreshAdminToken();
+		const { uuid } = await resolveAgentRecord(serverUrl, adminToken, agentName);
+		printConfig(await getCurrent(serverUrl, adminToken, uuid));
+	});
+	config.command("set-model <agent> <model>").description("Replace the model field (e.g. claude-opus-4-6)").action(async (agentName, model) => {
+		const serverUrl = resolveServerUrl(process.env.FIRST_TREE_HUB_SERVER_URL);
+		const adminToken = await ensureFreshAdminToken();
+		const { uuid } = await resolveAgentRecord(serverUrl, adminToken, agentName);
+		const updated = await patchConfig(serverUrl, adminToken, uuid, (await getCurrent(serverUrl, adminToken, uuid)).version, { model });
+		success({
+			agentId: updated.agentId,
+			version: updated.version,
+			model: updated.payload.model
+		});
+	});
+	config.command("append-prompt <agent>").description("Replace the systemPrompt append text — reads from -f file or stdin").option("-f, --file <path>", "Read prompt text from this file").action(async (agentName, opts) => {
+		const serverUrl = resolveServerUrl(process.env.FIRST_TREE_HUB_SERVER_URL);
+		const adminToken = await ensureFreshAdminToken();
+		const { uuid } = await resolveAgentRecord(serverUrl, adminToken, agentName);
+		let text;
+		if (opts.file) text = readFileSync(opts.file, "utf-8");
+		else if (!process.stdin.isTTY) text = await new Promise((resolve, reject) => {
+			const chunks = [];
+			process.stdin.on("data", (c) => chunks.push(c));
+			process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
+			process.stdin.on("error", reject);
+		});
+		else fail("MISSING_INPUT", "Provide -f <file> or pipe prompt text via stdin", 2);
+		const updated = await patchConfig(serverUrl, adminToken, uuid, (await getCurrent(serverUrl, adminToken, uuid)).version, { prompt: { append: text } });
+		success({
+			agentId: updated.agentId,
+			version: updated.version,
+			append_length: text.length
+		});
+	});
+	config.command("add-mcp <agent>").description("Add or replace an MCP server (replace-by-name semantics)").requiredOption("--name <name>", "MCP server name").requiredOption("--transport <transport>", "stdio | http | sse").option("--command <command>", "stdio command").option("--args <args...>", "stdio command args").option("--url <url>", "http/sse URL").action(async (agentName, opts) => {
+		const serverUrl = resolveServerUrl(process.env.FIRST_TREE_HUB_SERVER_URL);
+		const adminToken = await ensureFreshAdminToken();
+		const { uuid } = await resolveAgentRecord(serverUrl, adminToken, agentName);
+		const current = await getCurrent(serverUrl, adminToken, uuid);
+		let server;
+		if (opts.transport === "stdio") {
+			if (!opts.command) fail("MISSING_COMMAND", "stdio transport requires --command", 2);
+			server = {
+				name: opts.name,
+				transport: "stdio",
+				command: opts.command,
+				args: opts.args
+			};
+		} else if (opts.transport === "http" || opts.transport === "sse") {
+			if (!opts.url) fail("MISSING_URL", `${opts.transport} transport requires --url`, 2);
+			server = {
+				name: opts.name,
+				transport: opts.transport,
+				url: opts.url
+			};
+		} else fail("BAD_TRANSPORT", `transport must be stdio|http|sse, got ${opts.transport}`, 2);
+		const remaining = current.payload.mcpServers.filter((s) => s.name !== opts.name);
+		const updated = await patchConfig(serverUrl, adminToken, uuid, current.version, { mcpServers: [...remaining, server] });
+		success({
+			agentId: updated.agentId,
+			version: updated.version,
+			mcpServer: opts.name
+		});
+	});
+	config.command("set-env <agent> <kv>").description("Set an env variable: KEY=VALUE. Use --sensitive for secrets.").option("--sensitive", "Mark this value as sensitive (encrypted at rest, masked in echo)").action(async (agentName, kv, opts) => {
+		const serverUrl = resolveServerUrl(process.env.FIRST_TREE_HUB_SERVER_URL);
+		const adminToken = await ensureFreshAdminToken();
+		const { uuid } = await resolveAgentRecord(serverUrl, adminToken, agentName);
+		const eqIdx = kv.indexOf("=");
+		if (eqIdx <= 0) fail("BAD_KV", "Expected KEY=VALUE", 2);
+		const key = kv.slice(0, eqIdx);
+		const value = kv.slice(eqIdx + 1);
+		const current = await getCurrent(serverUrl, adminToken, uuid);
+		const remaining = current.payload.env.filter((e) => e.key !== key);
+		const updated = await patchConfig(serverUrl, adminToken, uuid, current.version, { env: [...remaining, {
+			key,
+			value,
+			sensitive: opts.sensitive ?? false
+		}] });
+		success({
+			agentId: updated.agentId,
+			version: updated.version,
+			env: key
+		});
+	});
+	config.command("add-repo <agent> <url>").description("Add a Git repo to the agent's worktree set").option("--ref <ref>", "branch / tag / commit (defaults to repo HEAD)").option("--path <path>", "local path relative to session cwd").action(async (agentName, url, opts) => {
+		const serverUrl = resolveServerUrl(process.env.FIRST_TREE_HUB_SERVER_URL);
+		const adminToken = await ensureFreshAdminToken();
+		const { uuid } = await resolveAgentRecord(serverUrl, adminToken, agentName);
+		const current = await getCurrent(serverUrl, adminToken, uuid);
+		const remaining = current.payload.gitRepos.filter((r) => r.url !== url);
+		const updated = await patchConfig(serverUrl, adminToken, uuid, current.version, { gitRepos: [...remaining, {
+			url,
+			ref: opts.ref,
+			localPath: opts.path
+		}] });
+		success({
+			agentId: updated.agentId,
+			version: updated.version,
+			repo: url
+		});
+	});
+	config.command("dry-run <agent>").description("Validate a JSON patch and print the diff without persisting").requiredOption("-f, --file <path>", "JSON file with the partial payload to apply").action(async (agentName, opts) => {
+		const serverUrl = resolveServerUrl(process.env.FIRST_TREE_HUB_SERVER_URL);
+		const adminToken = await ensureFreshAdminToken();
+		const { uuid } = await resolveAgentRecord(serverUrl, adminToken, agentName);
+		const patch = JSON.parse(readFileSync(opts.file, "utf-8"));
+		const result = await adminFetch(`${serverUrl}/api/v1/admin/agents/${uuid}/config/dry-run`, {
+			method: "POST",
+			adminToken,
+			body: JSON.stringify({ payload: patch })
+		});
+		process.stdout.write(`Diff (${result.diff.length} change${result.diff.length === 1 ? "" : "s"}):\n`);
+		for (const d of result.diff) process.stdout.write(`  ${d.op} ${d.path}\n`);
+	});
+}
+//#endregion
 //#region src/commands/agent.ts
 const DEFAULT_WORKSPACE_TTL_MS = 10080 * 60 * 1e3;
-function resolveAgentConfig() {
-	let token;
-	try {
-		token = resolveAgentToken();
-	} catch (error) {
-		fail("MISSING_TOKEN", error instanceof Error ? error.message : String(error), 2);
-	}
+/**
+* Resolve the agent this CLI invocation should act on. We read the local
+* `agents/<name>/agent.yaml` file to find the agentId, then pair it with the
+* user's current member JWT (refreshed on demand) at call time.
+*
+* Only one agent is expected per command invocation — if the user has many
+* agents configured they must pick one with `--agent <name>` (next step of
+* CLI polish) or rely on a single entry.
+*/
+function resolveLocalAgent(agentName) {
+	const agentsDir = join(DEFAULT_CONFIG_DIR, "agents");
+	const agents = loadAgents({
+		schema: agentConfigSchema,
+		agentsDir
+	});
+	if (agents.size === 0) fail("MISSING_AGENT", "No agent configured. Run `first-tree-hub agent add` first.", 2);
+	let resolvedName;
+	if (agentName) resolvedName = agentName;
+	else if (agents.size === 1) {
+		const [only] = [...agents.keys()];
+		if (!only) fail("MISSING_AGENT", "No agent configured. Run `first-tree-hub agent add` first.", 2);
+		resolvedName = only;
+	} else fail("AMBIGUOUS_AGENT", `Multiple agents configured — specify --agent <name>. Available: ${[...agents.keys()].join(", ")}`, 2);
+	const cfg = agents.get(resolvedName);
+	if (!cfg) fail("UNKNOWN_AGENT", `Agent "${resolvedName}" not found in ${agentsDir}`, 2);
 	let serverUrl;
 	try {
 		serverUrl = resolveServerUrl(process.env.FIRST_TREE_HUB_SERVER_URL);
-	} catch {
-		serverUrl = "http://localhost:8000";
+	} catch (error) {
+		fail("MISSING_SERVER_URL", error instanceof Error ? error.message : String(error), 2);
 	}
 	return {
 		serverUrl,
-		token
+		agentId: cfg.agentId
 	};
 }
-function createSdk() {
-	return new FirstTreeHubSDK(resolveAgentConfig());
+function createSdk(agentName) {
+	const { serverUrl, agentId } = resolveLocalAgent(agentName);
+	return new FirstTreeHubSDK({
+		serverUrl,
+		getAccessToken: () => ensureFreshAccessToken(),
+		agentId
+	});
 }
 function handleSdkError(error) {
 	if (error instanceof SdkError) {
@@ -82,10 +288,6 @@ function readStdin() {
 		process.stdin.on("error", reject);
 	});
 }
-/**
-* Resolve an agent name (or UUID) to its record via the admin agents API.
-* Accepts either a name or a UUID; throws via fail() if not found.
-*/
 async function resolveAgent(serverUrl, adminToken, agentName) {
 	const res = await fetch(`${serverUrl}/api/v1/admin/agents?limit=100`, {
 		headers: { Authorization: `Bearer ${adminToken}` },
@@ -97,22 +299,24 @@ async function resolveAgent(serverUrl, adminToken, agentName) {
 	return found;
 }
 function registerAgentCommands(program) {
-	const agent = program.command("agent").description("Agent management — config, tokens, bindings, messaging");
-	agent.command("add [name]").description("Add an agent instance").option("-t, --token <token>", "Agent token").action(async (name, options) => {
+	const agent = program.command("agent").description("Agent management — config, bindings, messaging");
+	registerAgentConfigCommands(agent);
+	agent.command("add [name]").description("Register a local alias for an existing Hub agent (stores agentId)").option("--agent-id <id>", "Agent UUID on the Hub").action(async (name, options) => {
 		try {
 			let agentName = name;
-			let agentToken = options?.token;
-			if (!agentName || !agentToken) {
+			let agentId = options?.agentId;
+			if (!agentName || !agentId) {
 				const result = await promptAddAgent();
 				agentName = agentName ?? result.name;
-				agentToken = agentToken ?? result.token;
+				agentId = agentId ?? result.agentId;
 			}
+			if (!agentName || !agentId) fail("MISSING_AGENT_ARGS", "Both agent name and agent-id are required.", 2);
 			const agentDir = join(DEFAULT_CONFIG_DIR, "agents", agentName);
 			mkdirSync(agentDir, {
 				recursive: true,
 				mode: 448
 			});
-			setConfigValue(join(agentDir, "agent.yaml"), "token", agentToken);
+			setConfigValue(join(agentDir, "agent.yaml"), "agentId", agentId);
 			process.stderr.write(`  Agent "${agentName}" added.\n`);
 			process.stderr.write(`  Config: ${join(agentDir, "agent.yaml")}\n`);
 		} catch (error) {
@@ -125,7 +329,7 @@ function registerAgentCommands(program) {
 			process.exit(1);
 		}
 	});
-	agent.command("remove <name>").description("Remove an agent instance and its runtime data").action((name) => {
+	agent.command("remove <name>").description("Remove a local agent alias and its runtime data").action((name) => {
 		const agentDir = join(DEFAULT_CONFIG_DIR, "agents", name);
 		if (!existsSync(agentDir)) {
 			process.stderr.write(`  Agent "${name}" not found.\n`);
@@ -142,7 +346,7 @@ function registerAgentCommands(program) {
 		rmSync(join(DEFAULT_DATA_DIR, "sessions", `${name}.json`), { force: true });
 		process.stderr.write(`  Agent "${name}" removed.\n`);
 	});
-	agent.command("list").description("List configured agents").action(() => {
+	agent.command("list").description("List locally-configured agents").action(() => {
 		const agentsDir = join(DEFAULT_CONFIG_DIR, "agents");
 		try {
 			const agents = loadAgents({
@@ -153,21 +357,22 @@ function registerAgentCommands(program) {
 				process.stderr.write("  No agents configured.\n");
 				return;
 			}
-			for (const [name, config] of agents) process.stderr.write(`  ${name.padEnd(20)} runtime: ${config.runtime.padEnd(14)} token: ${maskToken(config.token)}\n`);
+			for (const [name, config] of agents) process.stderr.write(`  ${name.padEnd(20)} runtime: ${config.runtime.padEnd(14)} agentId: ${config.agentId}\n`);
 		} catch {
 			process.stderr.write("  No agents configured.\n");
 		}
 	});
-	agent.command("create <name>").description("Create an agent on Hub and bind it locally (CLI-first)").requiredOption("--type <type>", "Agent type (human, personal_assistant, autonomous_agent)").option("--runtime <runtime>", "Runtime handler (default: claude-code)", "claude-code").option("--display-name <name>", "Display name").option("--server <url>", "Hub server URL").action(async (name, options) => {
+	agent.command("create <name>").description("Create an agent on Hub and bind it locally").requiredOption("--type <type>", "Agent type (human, personal_assistant, autonomous_agent)").requiredOption("--client-id <id>", "Client (machine) that will run this agent — must be owned by you. Run `first-tree-hub connect` on that machine first.").option("--runtime <runtime>", "Runtime handler (default: claude-code)", "claude-code").option("--display-name <name>", "Display name").option("--server <url>", "Hub server URL").action(async (name, options) => {
 		try {
 			const serverUrl = resolveServerUrl(options.server);
 			const headers = {
-				Authorization: `Bearer ${await ensureFreshAdminToken()}`,
+				Authorization: `Bearer ${await ensureFreshAccessToken()}`,
 				"Content-Type": "application/json"
 			};
 			const createBody = {
 				name,
-				type: options.type
+				type: options.type,
+				clientId: options.clientId
 			};
 			if (options.displayName) createBody.displayName = options.displayName;
 			const createRes = await fetch(`${serverUrl}/api/v1/admin/agents`, {
@@ -177,20 +382,39 @@ function registerAgentCommands(program) {
 				signal: AbortSignal.timeout(1e4)
 			});
 			if (!createRes.ok) fail("CREATE_ERROR", (await createRes.json().catch(() => ({}))).error ?? `Failed to create agent (HTTP ${createRes.status})`, 1);
-			const agent = await createRes.json();
-			process.stderr.write(`  \u2713 Agent created: ${agent.name ?? agent.uuid}\n`);
-			const tokenRes = await fetch(`${serverUrl}/api/v1/admin/agents/${agent.uuid}/tokens`, {
-				method: "POST",
-				headers,
-				body: JSON.stringify({ name: "default" }),
+			const created = await createRes.json();
+			process.stderr.write(`  \u2713 Agent created: ${created.name ?? created.uuid}\n`);
+			const agentDir = saveAgentConfig(name, created.uuid, options.runtime);
+			process.stderr.write(`  \u2713 Config saved: ${agentDir}/agent.yaml\n`);
+			process.stderr.write("  ✓ Agent ready — start the client on that machine to bind\n");
+		} catch (error) {
+			fail("CREATE_ERROR", error instanceof Error ? error.message : String(error));
+		}
+	});
+	agent.command("claim <agentName>").description("Become the manager of an agent (admin-only, or self-claim an unmanaged agent)").option("--server <url>", "Hub server URL").action(async (agentName, options) => {
+		try {
+			const serverUrl = resolveServerUrl(options.server);
+			const accessToken = await ensureFreshAccessToken();
+			const meRes = await fetch(`${serverUrl}/api/v1/me`, {
+				headers: { Authorization: `Bearer ${accessToken}` },
 				signal: AbortSignal.timeout(1e4)
 			});
-			if (!tokenRes.ok) fail("TOKEN_ERROR", `Failed to generate token (HTTP ${tokenRes.status})`, 1);
-			const agentDir = saveAgentConfig(name, (await tokenRes.json()).token, options.runtime);
-			process.stderr.write(`  \u2713 Token saved: ${agentDir}/agent.yaml\n`);
-			process.stderr.write(`  \u2713 Agent ready — running client will auto-bind\n`);
+			if (!meRes.ok) fail("ME_ERROR", `Failed to fetch current member (HTTP ${meRes.status})`, 1);
+			const me = await meRes.json();
+			const target = await resolveAgent(serverUrl, accessToken, agentName);
+			const patchRes = await fetch(`${serverUrl}/api/v1/admin/agents/${target.uuid}`, {
+				method: "PATCH",
+				headers: {
+					Authorization: `Bearer ${accessToken}`,
+					"Content-Type": "application/json"
+				},
+				body: JSON.stringify({ managerId: me.memberId }),
+				signal: AbortSignal.timeout(1e4)
+			});
+			if (!patchRes.ok) fail("CLAIM_ERROR", (await patchRes.json().catch(() => ({}))).error ?? `Claim failed (HTTP ${patchRes.status})`, 1);
+			process.stderr.write(`  Claimed "${target.name ?? target.uuid}" — now managed by you.\n`);
 		} catch (error) {
-			fail("CREATE_ERROR", error instanceof Error ? error.message : String(error));
+			fail("CLAIM_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
 	agent.command("workspace").description("Manage agent workspaces").command("clean [agent-name]").description("Remove stale workspace directories (older than TTL with no active session)").option("--ttl <days>", "TTL in days", String(DEFAULT_WORKSPACE_TTL_MS / (1440 * 60 * 1e3))).action((agentName, options) => {
@@ -215,24 +439,13 @@ function registerAgentCommands(program) {
 		}
 		process.stderr.write(`  ${totalRemoved} workspace(s) cleaned.\n`);
 	});
-	agent.command("token").description("Agent token management").command("bootstrap <agentName>").description("Bootstrap a token using GitHub identity (requires gh CLI)").option("--save-to <target>", "Save token to: \"agent\" (default) or a file path", "agent").option("--server <url>", "Hub server URL").action(async (agentName, options) => {
-		try {
-			const result = await bootstrapToken(resolveServerUrl(options.server), agentName, { saveTo: options.saveTo });
-			if (options.saveTo === "agent") process.stderr.write(`Token saved to ${DEFAULT_HOME_DIR}/config/agents/${agentName}/agent.yaml\n`);
-			else process.stderr.write(`Token saved to ${options.saveTo}\n`);
-			success({
-				agentId: result.agentId,
-				tokenSaved: true
-			});
-		} catch (error) {
-			fail("BOOTSTRAP_ERROR", error instanceof Error ? error.message : String(error));
-		}
-	});
 	const bind = agent.command("bind").description("Bind external IM accounts to agents");
-	bind.command("bot").description("Bind a Feishu bot to this agent (self-service)").requiredOption("--platform <platform>", "Platform: feishu").requiredOption("--app-id <id>", "Feishu bot App ID").requiredOption("--app-secret <secret>", "Feishu bot App Secret").option("--server <url>", "Hub server URL").action(async (options) => {
+	bind.command("bot").description("Bind a Feishu bot to this agent (self-service)").requiredOption("--platform <platform>", "Platform: feishu").requiredOption("--app-id <id>", "Feishu bot App ID").requiredOption("--app-secret <secret>", "Feishu bot App Secret").option("--agent <name>", "Local agent alias (default: first configured)").option("--server <url>", "Hub server URL").action(async (options) => {
 		try {
 			if (options.platform !== "feishu") fail("UNSUPPORTED_PLATFORM", `Platform "${options.platform}" is not supported. Use "feishu".`);
-			await bindFeishuBot(resolveServerUrl(options.server), resolveAgentToken(), options.appId, options.appSecret);
+			const serverUrl = resolveServerUrl(options.server);
+			const { agentId } = resolveLocalAgent(options.agent);
+			await bindFeishuBot(serverUrl, await ensureFreshAccessToken(), agentId, options.appId, options.appSecret);
 			process.stderr.write("Feishu bot bound successfully.\n");
 			success({
 				platform: "feishu",
@@ -242,10 +455,12 @@ function registerAgentCommands(program) {
 			fail("BIND_BOT_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
-	bind.command("user <humanAgentId>").description("Bind a Feishu user to a human agent (via delegate_mention)").requiredOption("--platform <platform>", "Platform: feishu").requiredOption("--feishu-id <id>", "Feishu user ID (ou_xxx)").option("--server <url>", "Hub server URL").action(async (humanAgentId, options) => {
+	bind.command("user <humanAgentId>").description("Bind a Feishu user to a human agent (via delegate_mention)").requiredOption("--platform <platform>", "Platform: feishu").requiredOption("--feishu-id <id>", "Feishu user ID (ou_xxx)").option("--agent <name>", "Local agent alias (default: first configured)").option("--server <url>", "Hub server URL").action(async (humanAgentId, options) => {
 		try {
 			if (options.platform !== "feishu") fail("UNSUPPORTED_PLATFORM", `Platform "${options.platform}" is not supported. Use "feishu".`);
-			await bindFeishuUser(resolveServerUrl(options.server), resolveAgentToken(), humanAgentId, options.feishuId);
+			const serverUrl = resolveServerUrl(options.server);
+			const { agentId } = resolveLocalAgent(options.agent);
+			await bindFeishuUser(serverUrl, await ensureFreshAccessToken(), agentId, humanAgentId, options.feishuId);
 			process.stderr.write(`Feishu user ${options.feishuId} bound to ${humanAgentId}.\n`);
 			success({
 				platform: "feishu",
@@ -256,7 +471,7 @@ function registerAgentCommands(program) {
 			fail("BIND_USER_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
-	agent.command("send <target> [message]").description("Send a message to an agent or chat").option("-f, --format <format>", "Message format (text|markdown|card)", "text").option("--chat", "Treat target as chat ID instead of agent ID").option("-m, --metadata <json>", "JSON metadata to attach").option("--reply-to <messageId>", "Message ID to reply to").option("--reply-to-inbox <inboxId>", "Cross-chat reply target inbox").option("--reply-to-chat <chatId>", "Cross-chat reply target chat").action(async (target, message, options) => {
+	agent.command("send <target> [message]").description("Send a message to an agent or chat").option("-f, --format <format>", "Message format (text|markdown|card)", "text").option("--chat", "Treat target as chat ID instead of agent ID").option("-m, --metadata <json>", "JSON metadata to attach").option("--reply-to <messageId>", "Message ID to reply to").option("--reply-to-inbox <inboxId>", "Cross-chat reply target inbox").option("--reply-to-chat <chatId>", "Cross-chat reply target chat").option("--agent <name>", "Local agent alias (default: first configured)").action(async (target, message, options) => {
 		try {
 			const content = message ?? await readStdin();
 			if (!content) fail("NO_MESSAGE", "No message provided. Pass as argument or pipe via stdin.", 2);
@@ -266,7 +481,7 @@ function registerAgentCommands(program) {
 			} catch {
 				fail("INVALID_METADATA", "Metadata must be valid JSON.", 2);
 			}
-			const sdk = createSdk();
+			const sdk = createSdk(options.agent);
 			if (options.chat) success(await sdk.sendMessage(target, {
 				format: options.format,
 				content,
@@ -286,10 +501,10 @@ function registerAgentCommands(program) {
 			handleSdkError(error);
 		}
 	});
-	agent.command("chats").description("List chats this agent participates in").option("-l, --limit <number>", "Maximum chats to return (1-100)", "20").option("--cursor <cursor>", "Pagination cursor from previous response").action(async (options) => {
+	agent.command("chats").description("List chats this agent participates in").option("-l, --limit <number>", "Maximum chats to return (1-100)", "20").option("--cursor <cursor>", "Pagination cursor from previous response").option("--agent <name>", "Local agent alias (default: first configured)").action(async (options) => {
 		try {
 			const limit = parseLimit(options.limit, 100);
-			success(await createSdk().listChats({
+			success(await createSdk(options.agent).listChats({
 				limit,
 				cursor: options.cursor
 			}));
@@ -297,10 +512,10 @@ function registerAgentCommands(program) {
 			handleSdkError(error);
 		}
 	});
-	agent.command("history <chatId>").description("View message history in a chat").option("-l, --limit <number>", "Maximum messages to return (1-100)", "20").option("--cursor <cursor>", "Pagination cursor from previous response").action(async (chatId, options) => {
+	agent.command("history <chatId>").description("View message history in a chat").option("-l, --limit <number>", "Maximum messages to return (1-100)", "20").option("--cursor <cursor>", "Pagination cursor from previous response").option("--agent <name>", "Local agent alias (default: first configured)").action(async (chatId, options) => {
 		try {
 			const limit = parseLimit(options.limit, 100);
-			success(await createSdk().listMessages(chatId, {
+			success(await createSdk(options.agent).listMessages(chatId, {
 				limit,
 				cursor: options.cursor
 			}));
@@ -312,22 +527,22 @@ function registerAgentCommands(program) {
 		try {
 			const serverUrl = resolveServerUrl(options?.server);
 			const response = await fetch(`${serverUrl}/api/v1/admin/agents/activity`, {
-				headers: { Authorization: `Bearer ${await ensureFreshAdminToken()}` },
+				headers: { Authorization: `Bearer ${await ensureFreshAccessToken()}` },
 				signal: AbortSignal.timeout(1e4)
 			});
 			if (!response.ok) fail("FETCH_ERROR", `Server returned ${response.status}`, 1);
 			const data = await response.json();
 			if (name) {
-				const agent = data.agents.find((a) => a.agentId === name);
-				if (!agent) {
+				const ag = data.agents.find((a) => a.agentId === name);
+				if (!ag) {
 					process.stderr.write(`\n  Agent "${name}" is not running.\n\n`);
 					return;
 				}
-				process.stderr.write(`\n  Agent: ${agent.agentId}\n`);
-				process.stderr.write(`  Runtime: ${agent.runtimeType ?? "—"}\n`);
-				process.stderr.write(`  State: ${agent.runtimeState ?? "—"}\n`);
-				if (agent.activeSessions !== null) process.stderr.write(`  Sessions: ${agent.activeSessions} active / ${agent.totalSessions ?? 0} total\n`);
-				if (agent.clientId) process.stderr.write(`  Client: ${agent.clientId}\n`);
+				process.stderr.write(`\n  Agent: ${ag.agentId}\n`);
+				process.stderr.write(`  Runtime: ${ag.runtimeType ?? "—"}\n`);
+				process.stderr.write(`  State: ${ag.runtimeState ?? "—"}\n`);
+				if (ag.activeSessions !== null) process.stderr.write(`  Sessions: ${ag.activeSessions} active / ${ag.totalSessions ?? 0} total\n`);
+				if (ag.clientId) process.stderr.write(`  Client: ${ag.clientId}\n`);
 				process.stderr.write("\n");
 				return;
 			}
@@ -346,17 +561,6 @@ function registerAgentCommands(program) {
 				process.stderr.write("\n");
 			}
 		} catch (error) {
-			if (error instanceof Error && error.message.includes("ADMIN_TOKEN")) {
-				try {
-					const me = await createSdk().register();
-					process.stderr.write(`\n  Agent: ${me.agentId} (${me.displayName ?? "no name"})\n`);
-					process.stderr.write(`  Type: ${me.type}\n`);
-					process.stderr.write(`  Status: ${me.status}\n\n`);
-				} catch (sdkError) {
-					handleSdkError(sdkError);
-				}
-				return;
-			}
 			fail("STATUS_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
@@ -365,7 +569,7 @@ function registerAgentCommands(program) {
 			const serverUrl = resolveServerUrl(options.server);
 			const response = await fetch(`${serverUrl}/api/v1/admin/agents/activity/${name}/reset-activity`, {
 				method: "POST",
-				headers: { Authorization: `Bearer ${await ensureFreshAdminToken()}` },
+				headers: { Authorization: `Bearer ${await ensureFreshAccessToken()}` },
 				signal: AbortSignal.timeout(1e4)
 			});
 			if (!response.ok) fail("RESET_ERROR", `Server returned ${response.status}`, 1);
@@ -377,7 +581,7 @@ function registerAgentCommands(program) {
 	agent.command("sessions <agent-name>").description("List sessions for an agent").option("--server <url>", "Hub server URL").option("--state <state>", "Filter by session state (active/suspended/evicted)").action(async (agentName, options) => {
 		try {
 			const serverUrl = resolveServerUrl(options.server);
-			const adminToken = await ensureFreshAdminToken();
+			const adminToken = await ensureFreshAccessToken();
 			const agentId = (await resolveAgent(serverUrl, adminToken, agentName)).uuid;
 			const qs = options.state ? `?state=${options.state}` : "";
 			const response = await fetch(`${serverUrl}/api/v1/admin/sessions/agents/${agentId}${qs}`, {
@@ -411,7 +615,7 @@ function registerAgentCommands(program) {
 	]) sessionCmd.command(`${cmd} <agent-name> <chat-id>`).description(desc).option("--server <url>", "Hub server URL").action(async (agentName, chatId, options) => {
 		try {
 			const serverUrl = resolveServerUrl(options.server);
-			const adminToken = await ensureFreshAdminToken();
+			const adminToken = await ensureFreshAccessToken();
 			const agentId = (await resolveAgent(serverUrl, adminToken, agentName)).uuid;
 			const response = await fetch(`${serverUrl}/api/v1/admin/sessions/agents/${agentId}/${chatId}/${cmd}`, {
 				method: "POST",
@@ -427,10 +631,10 @@ function registerAgentCommands(program) {
 			fail("SESSION_CMD_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
-	agent.command("chat <agent-name>").description("Open an interactive chat with an agent (as admin human agent)").option("--server <url>", "Hub server URL").action(async (agentName, options) => {
+	agent.command("chat <agent-name>").description("Open an interactive chat with an agent (as the current member's human agent)").option("--server <url>", "Hub server URL").action(async (agentName, options) => {
 		try {
 			const serverUrl = resolveServerUrl(options.server);
-			const adminToken = await ensureFreshAdminToken();
+			const adminToken = await ensureFreshAccessToken();
 			const headers = {
 				Authorization: `Bearer ${adminToken}`,
 				"Content-Type": "application/json"
@@ -516,16 +720,16 @@ function registerAgentCommands(program) {
 			fail("CHAT_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
-	agent.command("register").description("Register this agent and return identity info").action(async () => {
+	agent.command("register").description("Register this agent and return identity info").option("--agent <name>", "Local agent alias (default: first configured)").action(async (options) => {
 		try {
-			success(await createSdk().register());
+			success(await createSdk(options.agent).register());
 		} catch (error) {
 			handleSdkError(error);
 		}
 	});
-	agent.command("pull").description("Pull pending messages from inbox").option("-l, --limit <number>", "Maximum entries to return", "10").option("-a, --ack", "Automatically ACK entries after pulling").action(async (options) => {
+	agent.command("pull").description("Pull pending messages from inbox").option("-l, --limit <number>", "Maximum entries to return", "10").option("-a, --ack", "Automatically ACK entries after pulling").option("--agent <name>", "Local agent alias (default: first configured)").action(async (options) => {
 		try {
-			const sdk = createSdk();
+			const sdk = createSdk(options.agent);
 			const limit = parseLimit(options.limit, 50);
 			const result = await sdk.pull(limit);
 			if (options.ack && result.entries.length > 0) await Promise.all(result.entries.map((entry) => sdk.ack(entry.id)));
@@ -585,7 +789,6 @@ function registerClientCommands(program) {
 			checkClientConfig(),
 			await checkServerReachable(),
 			checkAgentConfigs(),
-			await checkAgentTokens(),
 			await checkWebSocket()
 		]);
 	});
@@ -605,7 +808,7 @@ function registerClientCommands(program) {
 				return;
 			}
 			process.stderr.write("\n  Configured agents:\n\n");
-			for (const [name, config] of agents) process.stderr.write(`  ${name.padEnd(20)} runtime: ${config.runtime.padEnd(14)} token: ${maskToken(config.token)}\n`);
+			for (const [name, config] of agents) process.stderr.write(`  ${name.padEnd(20)} runtime: ${config.runtime.padEnd(14)} agentId: ${config.agentId}\n`);
 			process.stderr.write("\n");
 		} catch {
 			process.stderr.write("  No agents directory found.\n");
@@ -614,7 +817,7 @@ function registerClientCommands(program) {
 	client.command("hub-list").description("List connected clients on the Hub server").option("--server <url>", "Hub server URL").action(async (options) => {
 		try {
 			const serverUrl = resolveServerUrl(options.server);
-			const token = await ensureFreshAdminToken();
+			const token = await ensureFreshAccessToken();
 			const response = await fetch(`${serverUrl}/api/v1/admin/clients`, {
 				headers: { Authorization: `Bearer ${token}` },
 				signal: AbortSignal.timeout(1e4)
@@ -641,7 +844,7 @@ function registerClientCommands(program) {
 	client.command("hub-disconnect <clientId>").description("Force-disconnect a client from the Hub server").option("--server <url>", "Hub server URL").action(async (clientId, options) => {
 		try {
 			const serverUrl = resolveServerUrl(options.server);
-			const token = await ensureFreshAdminToken();
+			const token = await ensureFreshAccessToken();
 			const response = await fetch(`${serverUrl}/api/v1/admin/clients/${clientId}/disconnect`, {
 				method: "POST",
 				headers: { Authorization: `Bearer ${token}` },
@@ -845,32 +1048,16 @@ function registerConnectCommand(program) {
 //#region src/commands/onboard.ts
 async function promptMissing(args) {
 	if (!args.server) try {
-		const { resolveServerUrl } = await import("../bootstrap-Dq_k_6ZD.mjs").then((n) => n.n);
+		const { resolveServerUrl } = await import("../bootstrap-DW7aIpmE.mjs").then((n) => n.t);
 		resolveServerUrl();
 	} catch {
 		args.server = await input({ message: "Hub server URL:" });
 		saveOnboardState(args);
 	}
-	const { resolveServerUrl } = await import("../bootstrap-Dq_k_6ZD.mjs").then((n) => n.n);
-	const serverUrl = resolveServerUrl(args.server).replace(/\/+$/, "");
-	try {
-		const res = await fetch(`${serverUrl}/api/v1/bootstrap/config`);
-		if (res.ok) {
-			if (!(await res.json()).allowedOrg) throw new Error("Server does not have FIRST_TREE_HUB_GITHUB_ALLOWED_ORG configured.\n  Ask the server admin to set this before onboarding.");
-		}
-	} catch (err) {
-		if (err instanceof Error && err.message.includes("FIRST_TREE_HUB_GITHUB_ALLOWED_ORG")) throw err;
-	}
-	let ghUsername = null;
-	try {
-		const { getGitHubUsername } = await import("../bootstrap-Dq_k_6ZD.mjs").then((n) => n.n);
-		ghUsername = getGitHubUsername();
-	} catch {}
+	const { loadCredentials } = await import("../bootstrap-DW7aIpmE.mjs").then((n) => n.t);
+	if (!loadCredentials()) throw new Error("No saved credentials. Run `first-tree-hub connect <server-url>` before onboarding.");
 	if (!args.id) {
-		args.id = await input({
-			message: "Agent ID:",
-			default: ghUsername ?? void 0
-		});
+		args.id = await input({ message: "Agent ID:" });
 		saveOnboardState(args);
 	}
 	if (!args.type) {
@@ -893,6 +1080,13 @@ async function promptMissing(args) {
 		});
 		saveOnboardState(args);
 	}
+	if (args.type !== "human" && !args.clientId) {
+		args.clientId = await input({
+			message: "Client ID (machine that will run this agent — must be owned by you):",
+			validate: (v) => v.length > 0 ? true : "clientId is required for non-human agents"
+		});
+		saveOnboardState(args);
+	}
 	if (!args.role) {
 		const role = await input({ message: "Role (optional, Enter to skip):" });
 		if (role) {
@@ -923,6 +1117,10 @@ async function promptMissing(args) {
 				message: "Assistant ID:",
 				default: `${args.id}-assistant`
 			});
+			if (!args.clientId) args.clientId = await input({
+				message: "Client ID for the assistant (must be owned by you):",
+				validate: (v) => v.length > 0 ? true : "clientId is required"
+			});
 			saveOnboardState(args);
 		}
 	}
@@ -938,16 +1136,16 @@ async function promptMissing(args) {
 	}
 }
 function registerOnboardCommand(program) {
-	program.command("onboard").description("Onboard a new agent to First Tree Hub").option("--id <id>", "Agent ID").option("--type <type>", "Agent type: human | personal_assistant | autonomous_agent").option("--display-name <name>", "Display name (defaults to id)").option("--role <role>", "Role description").option("--domains <domains>", "Comma-separated domains").option("--profile <text>", "Agent profile (markdown)").option("--assistant <id>", "Also create a personal_assistant with this ID").option("--delegate-mention <id>", "Set delegate_mention field").option("--server <url>", "Hub server URL").option("--feishu-bot-app-id <id>", "Feishu bot App ID").option("--feishu-bot-app-secret <secret>", "Feishu bot App Secret").option("--check", "Dry-run: show readiness checklist without executing").action(async (options) => {
+	program.command("onboard").description("Onboard a new agent to First Tree Hub").option("--id <id>", "Agent ID").option("--type <type>", "Agent type: human | personal_assistant | autonomous_agent").option("--client-id <id>", "Client (machine) to pin a non-human agent to").option("--display-name <name>", "Display name (defaults to id)").option("--role <role>", "Role description").option("--domains <domains>", "Comma-separated domains").option("--assistant <id>", "Also create a personal_assistant with this ID").option("--delegate-mention <id>", "Set delegate_mention field").option("--server <url>", "Hub server URL").option("--feishu-bot-app-id <id>", "Feishu bot App ID").option("--feishu-bot-app-secret <secret>", "Feishu bot App Secret").option("--check", "Dry-run: show readiness checklist without executing").action(async (options) => {
 		try {
 			const args = {
 				...loadOnboardState() ?? {},
 				...options.id && { id: options.id },
 				...options.type && { type: options.type },
+				...options.clientId && { clientId: options.clientId },
 				...options.displayName && { displayName: options.displayName },
 				...options.role && { role: options.role },
 				...options.domains && { domains: options.domains },
-				...options.profile && { profile: options.profile },
 				...options.assistant && { assistant: options.assistant },
 				...options.delegateMention && { delegateMention: options.delegateMention },
 				...options.server && { server: options.server },