@agentage/cli 0.0.3 → 0.25.0

package/dist/commands/memory/memory.js

@@ -0,0 +1,54 @@
+import chalk from 'chalk';
+import { translateEngineMessage } from '../../lib/memory/memory-client.js';
+import { runDelete, runEdit, runList, runRead, runSearch, runWrite, } from './memory-verbs.js';
+const guard = (fn) => fn().catch((err) => {
+    const message = translateEngineMessage(err instanceof Error ? err.message : String(err));
+    console.error(chalk.red(message));
+    process.exitCode = 1;
+});
+export const registerMemory = (program) => {
+    const memory = program.command('memory').description('Read + write memory, offline');
+    memory
+        .command('search <query...>')
+        .description('Search a vault (git grep)')
+        .option('--vault <name>', 'target vault')
+        .option('--limit <n>', 'max hits (default 20)')
+        .option('--json', 'machine-readable output')
+        .action((query, opts) => guard(() => runSearch(query.join(' '), opts)));
+    memory
+        .command('read <ref>')
+        .description('Print a document (@<vault>/<path> or <path> --vault)')
+        .option('--vault <name>', 'target vault')
+        .option('--json', 'machine-readable output')
+        .action((ref, opts) => guard(() => runRead(ref, opts)));
+    memory
+        .command('write <ref>')
+        .description('Create or overwrite a document (body from --body or stdin)')
+        .option('--vault <name>', 'target vault')
+        .option('--body <text>', 'document body (omit or "-" to read stdin)')
+        .option('--frontmatter <json>', 'frontmatter as a JSON object')
+        .option('--json', 'machine-readable output')
+        .action((ref, opts) => guard(() => runWrite(ref, opts)));
+    memory
+        .command('edit <ref>')
+        .description('Edit a document: str_replace (--old/--new) or --body (--append)')
+        .option('--vault <name>', 'target vault')
+        .option('--old <str>', 'exact, unique substring to replace')
+        .option('--new <str>', 'replacement (omit to delete the match)')
+        .option('--body <text>', 'replace the whole body')
+        .option('--append', 'append --body instead of replacing')
+        .option('--json', 'machine-readable output')
+        .action((ref, opts) => guard(() => runEdit(ref, opts)));
+    memory
+        .command('list [folder]')
+        .description('List documents in a vault (optionally under a folder)')
+        .option('--vault <name>', 'target vault')
+        .option('--json', 'machine-readable output')
+        .action((folder, opts) => guard(() => runList(folder, opts)));
+    memory
+        .command('delete <ref>')
+        .description('Delete a document (recoverable from git history)')
+        .option('--vault <name>', 'target vault')
+        .option('--json', 'machine-readable output')
+        .action((ref, opts) => guard(() => runDelete(ref, opts)));
+};

package/dist/commands/{status.d.ts → status/status.d.ts}

@@ -1,8 +1,8 @@
 import { type Command } from 'commander';
-import { type StatusReport } from '../lib/status-info.js';
+import { type StatusReport } from '../../lib/status/status-info.js';
 export declare const printStatus: (report: StatusReport) => void;
 export declare const runStatus: (opts?: {
     json?: boolean;
+    token?: string;
 }) => Promise<void>;
 export declare const registerStatus: (program: Command) => void;
-//# sourceMappingURL=status.d.ts.map

package/dist/commands/status/status.js

@@ -0,0 +1,88 @@
+import chalk from 'chalk';
+import { resolveAuth } from '../../lib/auth/credentials.js';
+import { siteFqdn } from '../../lib/net/origins.js';
+import { formatUptime } from '../../lib/status/format.js';
+import { gatherStatus, } from '../../lib/status/status-info.js';
+import { vaultLines } from '../../lib/status/vaults-format.js';
+import { INSTALL_HINT } from '../../lib/update/update-check.js';
+const mark = (good) => (good ? chalk.green('✓') : chalk.red('✗'));
+const row = (label, value) => {
+    console.log(`${label.padEnd(10)} ${value}`);
+};
+// The signed-in line never shows an absolute expiry: it is the short-lived, auto-refreshed
+// access-token expiry, which misreads as "yesterday" near midnight in positive-UTC zones.
+// Introspection already proved the session is active server-side.
+const authLine = (auth) => {
+    // Env mismatch: the credential is valid but for another target - neutral `!`, not the expired ✗.
+    if (auth.mismatch)
+        return `${chalk.yellow('!')} ${auth.note ?? 'signed in to another environment'}`;
+    const via = auth.pat ? ' via token' : '';
+    if (!auth.signedIn)
+        return `${mark(false)} ${auth.note ?? 'not signed in'}`;
+    // Transient: we hold a valid-looking token but could not re-verify - a non-terminal `~`, never ✗.
+    if (auth.transient)
+        return `${chalk.yellow('~')} ${auth.note ?? 'signed in'}${via}`;
+    return `${mark(true)} signed in${via} (session active)`;
+};
+const updateLine = (update) => {
+    switch (update.status.kind) {
+        case 'current':
+            return `${mark(true)} up to date`;
+        case 'update-available':
+            return chalk.yellow(`↑ ${update.status.latest} available - ${INSTALL_HINT}`);
+        case 'unsupported':
+            return chalk.red(`${mark(false)} unsupported, update required - ${INSTALL_HINT}`);
+        case 'unknown':
+            return chalk.dim('- update check unavailable');
+    }
+};
+const daemonLine = (d, cliVersion) => {
+    if (!d.running)
+        return `${mark(false)} stopped - run: agentage daemon start`;
+    const up = d.uptimeSeconds !== undefined ? `, up ${formatUptime(d.uptimeSeconds)}` : '';
+    const stale = d.daemonVersion && d.daemonVersion !== cliVersion
+        ? chalk.yellow(` (version ${d.daemonVersion} != cli ${cliVersion})`)
+        : '';
+    return `${mark(true)} running (pid ${d.pid ?? '?'}, port ${d.port}${up})${stale}`;
+};
+const mcpLine = (d) => d.mcp ? `${mark(true)} serving at http://127.0.0.1:${d.port}/mcp` : `${mark(false)} off`;
+// Daemon rows honor version-mismatch inline (appended to the daemon row) and print mcp only when
+// running; the per-vault sync breakdown now lives in its own `vaults` block (printStatus).
+const printDaemon = (d, cliVersion) => {
+    row('daemon', daemonLine(d, cliVersion));
+    if (!d.running)
+        return;
+    row('mcp', mcpLine(d));
+};
+export const printStatus = (report) => {
+    row('version', report.version);
+    row('update', updateLine(report.update));
+    const t = report.target;
+    const targetSuffix = t.reachable ? '' : ' - unreachable';
+    row('target', `${mark(t.reachable)} ${t.fqdn} (${t.env})${targetSuffix}`);
+    row('auth', authLine(report.auth));
+    row('endpoint', `${mark(report.endpoint.reachable)} ${report.endpoint.url} ` +
+        (report.endpoint.reachable ? 'reachable' : 'unreachable'));
+    if (report.daemon)
+        printDaemon(report.daemon, report.version);
+    for (const line of vaultLines(report.vaults))
+        console.log(line);
+    if (report.update.message)
+        console.log(chalk.yellow(`\n${report.update.message}`));
+};
+export const runStatus = async (opts = {}) => {
+    const report = await gatherStatus(resolveAuth({ token: opts.token }), siteFqdn());
+    if (opts.json) {
+        console.log(JSON.stringify(report, null, 2));
+        return;
+    }
+    printStatus(report);
+};
+export const registerStatus = (program) => {
+    program
+        .command('status')
+        .description('Show CLI, account, and endpoint status')
+        .option('--json', 'machine-readable output')
+        .option('--token <token>', 'authenticate with a personal access token (aga_...); or set AGENTAGE_TOKEN')
+        .action(runStatus);
+};

package/dist/commands/update/update.d.ts

@@ -0,0 +1,23 @@
+import { type Command } from 'commander';
+import { type SpawnOutcome } from '../../lib/daemon/daemon-client.js';
+import { type UpdateInfo } from '../../lib/update/update-check.js';
+export type RestartOutcome = 'restarted' | 'failed' | 'not-running';
+export interface RestartDeps {
+    running?: () => boolean;
+    stop?: () => Promise<boolean>;
+    start?: (port: number) => Promise<SpawnOutcome>;
+}
+export declare const restartDaemonIfRunning: (deps?: RestartDeps) => Promise<RestartOutcome>;
+export interface UpdateDeps {
+    check: (installed: string) => Promise<UpdateInfo>;
+    install: () => Promise<void>;
+    restartDaemon: () => Promise<RestartOutcome>;
+    acquireLock: () => boolean;
+    releaseLock: () => void;
+    log: (msg: string) => void;
+}
+export interface UpdateOptions {
+    check?: boolean;
+}
+export declare const runUpdate: (opts: UpdateOptions, deps?: UpdateDeps) => Promise<void>;
+export declare const registerUpdate: (program: Command) => void;

package/dist/commands/update/update.js

@@ -0,0 +1,89 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import chalk from 'chalk';
+import { isDaemonRunning, resolvePort, stopDaemonAndWait } from '../../daemon/lifecycle.js';
+import { spawnDaemon } from '../../lib/daemon/daemon-client.js';
+import { checkForUpdate, INSTALL_HINT } from '../../lib/update/update-check.js';
+import { acquireUpdateLock, releaseUpdateLock } from '../../lib/update/update-lock.js';
+import { VERSION } from '../../utils/version.js';
+const pexec = promisify(execFile);
+// Restart a running daemon so it picks up the freshly installed binary; a stopped daemon is left
+// stopped. Waits for the old process to exit (port free) before spawning, and reports honestly
+// when the new daemon did not come up.
+export const restartDaemonIfRunning = async (deps = {}) => {
+    const running = deps.running ?? isDaemonRunning;
+    if (!running())
+        return 'not-running';
+    await (deps.stop ?? stopDaemonAndWait)();
+    const up = await (deps.start ?? spawnDaemon)(resolvePort());
+    return up.ok ? 'restarted' : 'failed';
+};
+const defaultDeps = {
+    check: checkForUpdate,
+    install: async () => {
+        await pexec('npm', ['install', '-g', '@agentage/cli@latest']);
+    },
+    restartDaemon: () => restartDaemonIfRunning(),
+    acquireLock: () => acquireUpdateLock(),
+    releaseLock: releaseUpdateLock,
+    log: (msg) => console.log(msg),
+};
+const describe = (info) => {
+    const s = info.status;
+    switch (s.kind) {
+        case 'current':
+            return chalk.green(`Already on the latest version (${VERSION}).`);
+        case 'update-available':
+            return chalk.yellow(`Update available: ${VERSION} -> ${s.latest}.`);
+        case 'unsupported':
+            return chalk.red(`Unsupported version ${VERSION} - update required (latest ${s.latest ?? '?'}).`);
+        case 'unknown':
+            return chalk.yellow(`Couldn't reach the registry - try again later. ${INSTALL_HINT}`);
+    }
+};
+// Install, then restart a running daemon so its in-process engine runs the new version.
+const install = async (deps) => {
+    deps.log('Installing the latest @agentage/cli...');
+    await deps.install();
+    deps.log(chalk.green('Updated. Run `agentage status` to confirm.'));
+    const outcome = await deps.restartDaemon();
+    if (outcome === 'restarted')
+        deps.log(chalk.green('Restarted the daemon on the new version.'));
+    if (outcome === 'failed')
+        deps.log(chalk.yellow('Daemon did not restart cleanly - run `agentage daemon start`.'));
+};
+// --check reports the verdict and never installs. Otherwise, install only when the registry says
+// we're behind (available/unsupported), guarded by a single-writer lock; current/unreachable just
+// report.
+export const runUpdate = async (opts, deps = defaultDeps) => {
+    const info = await deps.check(VERSION);
+    deps.log(describe(info));
+    const behind = info.status.kind === 'update-available' || info.status.kind === 'unsupported';
+    if (opts.check || !behind)
+        return;
+    if (!deps.acquireLock()) {
+        deps.log(chalk.yellow('Another update is already in progress; skipping.'));
+        return;
+    }
+    try {
+        await install(deps);
+    }
+    finally {
+        deps.releaseLock();
+    }
+};
+export const registerUpdate = (program) => {
+    program
+        .command('update')
+        .description('Update @agentage/cli to the latest published version')
+        .option('--check', 'report whether an update is available, without installing')
+        .action(async (opts) => {
+        try {
+            await runUpdate(opts);
+        }
+        catch (err) {
+            console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+            process.exitCode = 1;
+        }
+    });
+};

package/dist/commands/vault/vault-sync.d.ts

@@ -0,0 +1,15 @@
+import { type VaultsConfig } from '@agentage/memory-core';
+import { type SyncRunResult } from '../../lib/daemon/daemon-client.js';
+import { type SyncResult } from '../../sync/git/cycle.js';
+import { type CouchSyncResult } from '../../sync/couch/manager.js';
+import { type SyncTarget } from '../../sync/git/planner.js';
+export interface VaultSyncDeps {
+    loadConfig: () => VaultsConfig;
+    daemonPort: () => Promise<number | null>;
+    runViaDaemon: (port: number, vault: string) => Promise<SyncRunResult>;
+    runGitInProcess: (target: SyncTarget) => Promise<SyncResult>;
+    runCouchInProcess: (vault: string) => Promise<CouchSyncResult>;
+    log: (msg: string) => void;
+}
+export declare const runVaultSync: (name: string | undefined, deps: VaultSyncDeps) => Promise<void>;
+export declare const defaultVaultSyncDeps: () => VaultSyncDeps;

package/dist/commands/vault/vault-sync.js

@@ -0,0 +1,100 @@
+import chalk from 'chalk';
+import { health, syncRun } from '../../lib/daemon/daemon-client.js';
+import { daemonDisabled } from '../../lib/daemon/daemon-pref.js';
+import { loadVaultsConfig } from '../../lib/vault/vaults.js';
+import { resolvePort } from '../../daemon/lifecycle.js';
+import { runSyncCycle } from '../../sync/git/cycle.js';
+import { createCouchSyncManager } from '../../sync/couch/manager.js';
+import { couchTargets } from '../../sync/couch/targets.js';
+import { syncTargets } from '../../sync/git/planner.js';
+import { redactRemoteUrl } from '../../sync/git/remote-url.js';
+const isCouch = (r) => 'channel' in r && r.channel === 'couch';
+const describeGit = (r) => {
+    if (!r.ok)
+        return chalk.red(`failed (${r.reason ?? 'error'})${r.error ? `: ${r.error}` : ''}`);
+    if (r.skipped)
+        return chalk.yellow(`skipped (${r.skipped})`);
+    const bits = [];
+    if (r.committed)
+        bits.push('committed');
+    if (r.conflicts.length)
+        bits.push(`${r.conflicts.length} conflict copy(ies)`);
+    if (r.pushed)
+        bits.push('pushed');
+    return chalk.green(bits.length ? bits.join(', ') : 'up to date');
+};
+const describeCouch = (r) => {
+    if (r.paused)
+        return chalk.yellow(`paused (${r.paused})`);
+    if (!r.ok)
+        return chalk.red(`failed${r.error ? `: ${r.error}` : ''}`);
+    const bits = [];
+    if (r.committed)
+        bits.push('committed');
+    if (r.pulled)
+        bits.push('pulled');
+    if (r.pendingCount)
+        bits.push(`${r.pendingCount} pending`);
+    return chalk.green(bits.length ? bits.join(', ') : 'up to date');
+};
+const report = (log, r) => {
+    if (isCouch(r)) {
+        log(`${r.vault} (account): ${describeCouch(r)}`);
+        return;
+    }
+    log(`${r.vault} -> ${redactRemoteUrl(r.remote)}: ${describeGit(r)}`);
+    for (const c of r.conflicts)
+        log(`  kept remote copy: ${c}`);
+};
+// `agentage vault sync [name]`: sync one vault (or every syncable vault). Git-origin vaults
+// commit + push + pull-rebase; account (agentage) vaults sync the couch channel. Prefers a running
+// daemon (single writer), else runs the cycle in-process. Works for interval-0 (manual-only) vaults
+// and with the daemon down. Failures are surfaced, not thrown (V6: never a crash).
+export const runVaultSync = async (name, deps) => {
+    const config = deps.loadConfig();
+    // A named vault that is not registered is an error (mirrors `vault remove`), not a silent no-op.
+    if (name && !(config.vaults ?? {})[name])
+        throw new Error(`vault '${name}' not found`);
+    const gitTargets = syncTargets(config).filter((t) => !name || t.vault === name);
+    const couchVaults = couchTargets(config)
+        .filter((t) => !name || t.vault === name)
+        .map((t) => t.vault);
+    if (gitTargets.length === 0 && couchVaults.length === 0) {
+        deps.log(name
+            ? `No syncable origin configured for vault '${name}'.`
+            : 'No syncable vaults. Add one with `agentage vault add <name>`.');
+        return;
+    }
+    const vaults = [...new Set([...gitTargets.map((t) => t.vault), ...couchVaults])];
+    deps.log(`Syncing ${vaults.length} vault(s)...`);
+    const port = await deps.daemonPort();
+    if (port !== null) {
+        for (const vault of vaults) {
+            deps.log(`${vault}...`);
+            report(deps.log, await deps.runViaDaemon(port, vault));
+        }
+        return;
+    }
+    for (const target of gitTargets) {
+        deps.log(`${target.vault}...`);
+        report(deps.log, await deps.runGitInProcess(target));
+    }
+    for (const vault of couchVaults) {
+        deps.log(`${vault}...`);
+        report(deps.log, await deps.runCouchInProcess(vault));
+    }
+};
+const resolveDaemonPort = async () => {
+    if (daemonDisabled())
+        return null;
+    const port = resolvePort();
+    return (await health(port)) ? port : null;
+};
+export const defaultVaultSyncDeps = () => ({
+    loadConfig: () => loadVaultsConfig().config,
+    daemonPort: resolveDaemonPort,
+    runViaDaemon: syncRun,
+    runGitInProcess: runSyncCycle,
+    runCouchInProcess: (vault) => createCouchSyncManager().runNow(vault),
+    log: (msg) => console.log(msg),
+});

package/dist/commands/vault/vault.d.ts

@@ -0,0 +1,22 @@
+import { type Command } from 'commander';
+import { type VaultsConfig } from '@agentage/memory-core';
+import { type ProvisionResult } from '../../lib/auth/provision.js';
+import { type LoadedVaults } from '../../lib/vault/vaults.js';
+export interface VaultDeps {
+    load: () => LoadedVaults;
+    mutate: (fn: (config: VaultsConfig) => VaultsConfig | null | void) => Promise<VaultsConfig>;
+    ensureDir: (path: string) => void;
+    provision: (name: string) => Promise<ProvisionResult>;
+    log: (msg: string) => void;
+}
+export interface VaultAddOptions {
+    local?: string | boolean;
+    git?: string;
+    path?: string;
+}
+export declare const runVaultAdd: (name: string, opts: VaultAddOptions, deps?: VaultDeps) => Promise<void>;
+export declare const runVaultRemove: (name: string, deps?: VaultDeps) => Promise<void>;
+export declare const runVaultList: (opts: {
+    json?: boolean;
+}, deps?: VaultDeps) => void;
+export declare const registerVault: (program: Command) => void;

package/dist/commands/vault/vault.js

@@ -0,0 +1,128 @@
+import chalk from 'chalk';
+import { isAccountVault } from '@agentage/memory-core';
+import { addVault, appendDiscoverIgnore, ensureVaultDir, formatVaultLine, redactEntry, removeVault, vaultType, } from '../../lib/vault/vault-registry.js';
+import { defaultProvisionDeps, provisionAccountVault, } from '../../lib/auth/provision.js';
+import { loadVaultsConfig, mutateVaultsConfig } from '../../lib/vault/vaults.js';
+import { assertSafeRemoteUrl, redactRemoteUrl } from '../../sync/git/remote-url.js';
+import { defaultVaultSyncDeps, runVaultSync } from './vault-sync.js';
+const defaultDeps = {
+    load: loadVaultsConfig,
+    mutate: mutateVaultsConfig,
+    ensureDir: ensureVaultDir,
+    provision: (name) => provisionAccountVault(name, defaultProvisionDeps()),
+    log: (msg) => console.log(msg),
+};
+const buildEntry = (name, opts) => {
+    const hasLocal = opts.local !== undefined;
+    if (hasLocal && opts.git)
+        throw new Error('choose one of --local or --git, not both');
+    if (opts.path !== undefined && (hasLocal || opts.git))
+        throw new Error('--path applies only to an account vault (drop --local and --git)');
+    // A --git vault is a local working copy that syncs to an external git remote (path + origin);
+    // the daemon commits/pushes and pulls it per its interval.
+    if (opts.git) {
+        assertSafeRemoteUrl(opts.git);
+        return { path: `~/vaults/${name}`, origin: [{ remote: opts.git }], mcp: ['local'] };
+    }
+    if (hasLocal) {
+        const path = typeof opts.local === 'string' ? opts.local : `~/vaults/${name}`;
+        return { path, mcp: ['local'] };
+    }
+    // No --local/--git: an account vault - a local mirror synced to the account (agentage) channel.
+    return { path: opts.path ?? `~/vaults/${name}`, origin: [{ remote: 'agentage' }] };
+};
+export const runVaultAdd = async (name, opts, deps = defaultDeps) => {
+    const entry = buildEntry(name, opts);
+    // The dup check + save run together under the lock, against the FRESH on-disk config.
+    await deps.mutate((config) => addVault(config, name, entry));
+    if (entry.path)
+        deps.ensureDir(entry.path);
+    const kind = vaultType(entry);
+    const where = entry.path ?? entry.origin?.[0]?.remote ?? '';
+    const via = kind === 'git' && entry.origin?.length ? ` <- ${redactRemoteUrl(entry.origin[0].remote)}` : '';
+    deps.log(chalk.green(`Added vault '${name}' (${kind}) -> ${where}${via}`));
+    // Offline-first: the local entry is saved first; provisioning the account channel is never fatal.
+    if (isAccountVault(entry))
+        deps.log((await deps.provision(name)).message);
+};
+export const runVaultRemove = async (name, deps = defaultDeps) => {
+    let wasDefault = false;
+    let ignoredRoot = null;
+    // The removal and the discover-ignore append run as one locked read-modify-write, against the
+    // FRESH on-disk config, else a concurrent writer's update is lost or the next scan re-adds the folder.
+    const next = await deps.mutate((config) => {
+        wasDefault = config.default === name;
+        const path = config.vaults?.[name]?.path;
+        let updated = removeVault(config, name);
+        const ignored = path ? appendDiscoverIgnore(updated, name, path) : null;
+        if (ignored) {
+            updated = ignored.config;
+            ignoredRoot = ignored.root;
+        }
+        return updated;
+    });
+    deps.log(`Removed vault '${name}' (files left on disk).`);
+    if (ignoredRoot)
+        deps.log(`Added '${name}' to ${ignoredRoot} ignore so it is not re-discovered.`);
+    if (wasDefault && next.default)
+        deps.log(`Default vault is now '${next.default}'.`);
+};
+export const runVaultList = (opts, deps = defaultDeps) => {
+    const { config } = deps.load();
+    const vaults = config.vaults ?? {};
+    const names = Object.keys(vaults);
+    if (opts.json) {
+        // Backward-compatible: still the name-keyed map, each entry annotated with its honest type.
+        // Origin remotes are redacted so a credentialed URL never leaks into machine output.
+        const out = Object.fromEntries(names.map((n) => [n, { ...redactEntry(vaults[n]), type: vaultType(vaults[n]) }]));
+        deps.log(JSON.stringify(out, null, 2));
+        return;
+    }
+    if (names.length === 0) {
+        deps.log('No vaults registered. Add one with `agentage vault add <name> --local`.');
+        return;
+    }
+    for (const name of names) {
+        const suffix = name === config.default ? '  (default)' : '';
+        deps.log(formatVaultLine(name, vaults[name]) + suffix);
+    }
+};
+const guard = (fn) => {
+    try {
+        fn();
+    }
+    catch (err) {
+        console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+        process.exitCode = 1;
+    }
+};
+const guardAsync = (fn) => fn().catch((err) => {
+    console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+    process.exitCode = 1;
+});
+export const registerVault = (program) => {
+    const vault = program.command('vault').description('Manage local memory vaults');
+    vault
+        .command('list')
+        .description('List registered vaults')
+        .option('--json', 'machine-readable output')
+        .action((opts) => guard(() => runVaultList(opts)));
+    vault
+        .command('add <name>')
+        .description('Register a vault (account by default; --local or --git for a self-hosted one)')
+        .option('--local [path]', 'a local folder (default ~/vaults/<name>)')
+        .option('--git <remote>', 'a vault synced to an external git remote')
+        .option('--path <dir>', 'account vault local mirror dir (default ~/vaults/<name>)')
+        .action((name, opts) => guardAsync(() => runVaultAdd(name, opts)));
+    vault
+        .command('remove <name>')
+        .description('Unregister a vault (files stay on disk)')
+        .action((name) => guardAsync(() => runVaultRemove(name)));
+    vault
+        .command('sync [name]')
+        .description('Sync vaults now (git commit/push/pull, or the account channel)')
+        .action((name) => runVaultSync(name, defaultVaultSyncDeps()).catch((err) => {
+        console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+        process.exitCode = 1;
+    }));
+};

package/dist/daemon/actions.d.ts

@@ -0,0 +1,5 @@
+import { type MemoryClient } from '../lib/memory/memory-client.js';
+export declare const MEMORY_VERBS: readonly ["search", "read", "write", "edit", "list", "delete"];
+export type MemoryVerb = (typeof MEMORY_VERBS)[number];
+export declare const isMemoryVerb: (v: string) => v is MemoryVerb;
+export declare const dispatchMemory: (client: MemoryClient, verb: MemoryVerb, body: unknown) => Promise<unknown>;

package/dist/daemon/actions.js

@@ -0,0 +1,22 @@
+export const MEMORY_VERBS = ['search', 'read', 'write', 'edit', 'list', 'delete'];
+export const isMemoryVerb = (v) => MEMORY_VERBS.includes(v);
+// Map one wire payload to the matching MemoryClient call. The daemon and the CLI share this verb
+// set so a daemon request runs the exact method a DirectClient would run in-process (DO2).
+export const dispatchMemory = (client, verb, body) => {
+    const p = (body ?? {});
+    switch (verb) {
+        case 'search':
+            return client.search(p['query'], p['opts']);
+        case 'read':
+            return client.read(p['ref'], p['opts']);
+        case 'write':
+            return client.write(p['ref'], p['body'], p['opts']);
+        case 'edit':
+            return client.edit(p['ref'], p['op'], p['opts']);
+        case 'list':
+            return client.list(p['folder'], p['opts']);
+        case 'delete':
+            return client.delete(p['ref'], p['opts']);
+    }
+    throw new Error(`unknown verb: ${verb}`);
+};

package/dist/daemon/client-provider.d.ts

@@ -0,0 +1,2 @@
+import { type MemoryClient } from '../lib/memory/memory-client.js';
+export declare const createClientProvider: () => (() => MemoryClient);

package/dist/daemon/client-provider.js

@@ -0,0 +1,16 @@
+import { existsSync, statSync } from 'node:fs';
+import { createDirectClient } from '../lib/memory/memory-client.js';
+import { loadVaultsConfig, vaultsJsonPath } from '../lib/vault/vaults.js';
+// One in-process engine per daemon, rebuilt only when vaults.json changes on disk, so a
+// `vault add` between requests is picked up without a daemon restart.
+export const createClientProvider = () => {
+    let cached;
+    return () => {
+        const path = vaultsJsonPath();
+        const mtime = existsSync(path) ? statSync(path).mtimeMs : 0;
+        if (!cached || cached.mtime !== mtime) {
+            cached = { client: createDirectClient(loadVaultsConfig().config), mtime };
+        }
+        return cached.client;
+    };
+};

package/dist/daemon/guards.d.ts

@@ -0,0 +1,3 @@
+export declare const loopbackHosts: (port: number) => string[];
+export declare const isAllowedHost: (host: string | undefined, port: number) => boolean;
+export declare const isAllowedOrigin: (origin: string | undefined) => boolean;

package/dist/daemon/guards.js

@@ -0,0 +1,13 @@
+// Web-origin defense for the loopback daemon: a Host allow-list blocks DNS-rebinding (an attacker
+// domain that later resolves to 127.0.0.1 still sends its own Host), and an Origin allow-list blocks
+// a browser page from POSTing to the daemon. Both are pure so they unit-test without a socket.
+// The only Host values a genuine loopback client sends, pinned to the actually-bound port.
+export const loopbackHosts = (port) => [
+    `127.0.0.1:${port}`,
+    `localhost:${port}`,
+    `[::1]:${port}`,
+];
+export const isAllowedHost = (host, port) => host !== undefined && loopbackHosts(port).includes(host);
+// A missing Origin is fine (non-browser clients omit it); a present one must be loopback (any port).
+const LOOPBACK_ORIGIN = /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/;
+export const isAllowedOrigin = (origin) => origin === undefined || LOOPBACK_ORIGIN.test(origin);

package/dist/daemon/lifecycle.d.ts

@@ -0,0 +1,17 @@
+export declare const DEFAULT_DAEMON_PORT = 4243;
+export declare const EADDRINUSE_EXIT_CODE = 3;
+export declare const writePidFile: (pid: number) => void;
+export declare const writePortFile: (port: number) => void;
+export declare const generateDaemonToken: () => string;
+export declare const writeTokenFile: (token: string) => void;
+export declare const readDaemonToken: () => string | null;
+export declare const removePidFile: () => void;
+export declare const removePortFile: () => void;
+export declare const removeTokenFile: () => void;
+export declare const resolvePort: () => number;
+export declare const isProcessAlive: (pid: number) => boolean;
+export declare const signalPid: (pid: number) => boolean;
+export declare const isDaemonRunning: () => boolean;
+export declare const stopDaemon: () => boolean;
+export declare const stopDaemonSafely: (probe?: (port: number) => Promise<number | null>) => Promise<boolean>;
+export declare const stopDaemonAndWait: (timeoutMs?: number) => Promise<boolean>;