@agentage/cli 0.0.4 → 0.25.0

package/README.md

@@ -73,6 +73,20 @@ Prefer to host it yourself? You can point a memory at your own git remote instea
 `agentage vault add <name> --git <remote>` - see [`docs/reference.md`](docs/reference.md)
 for details.
 
+## Token auth (CI / headless)
+
+For CI or non-interactive machines, skip the browser sign-in and authenticate with a
+personal access token. Mint one in the dashboard under **Settings -> API tokens**
+(scopes `memory:read` / `memory:write`), then set it in the environment:
+
+```bash
+export AGENTAGE_TOKEN=aga_...
+agentage status
+```
+
+The token is used as the bearer for memory (MCP) calls; `--token aga_...` works per command
+too. Account-channel provisioning still needs an interactive `agentage setup` session.
+
 ## Going deeper
 
 - [`docs/architecture.md`](docs/architecture.md) - how the CLI, the local helper, your

package/dist/commands/status/status.d.ts

@@ -3,5 +3,6 @@ import { type StatusReport } from '../../lib/status/status-info.js';
 export declare const printStatus: (report: StatusReport) => void;
 export declare const runStatus: (opts?: {
     json?: boolean;
+    token?: string;
 }) => Promise<void>;
 export declare const registerStatus: (program: Command) => void;

package/dist/commands/status/status.js

@@ -1,5 +1,5 @@
 import chalk from 'chalk';
-import { readAuth } from '../../lib/fs/config.js';
+import { resolveAuth } from '../../lib/auth/credentials.js';
 import { siteFqdn } from '../../lib/net/origins.js';
 import { formatUptime } from '../../lib/status/format.js';
 import { gatherStatus, } from '../../lib/status/status-info.js';
@@ -16,12 +16,13 @@ const authLine = (auth) => {
     // Env mismatch: the credential is valid but for another target - neutral `!`, not the expired ✗.
     if (auth.mismatch)
         return `${chalk.yellow('!')} ${auth.note ?? 'signed in to another environment'}`;
+    const via = auth.pat ? ' via token' : '';
     if (!auth.signedIn)
         return `${mark(false)} ${auth.note ?? 'not signed in'}`;
     // Transient: we hold a valid-looking token but could not re-verify - a non-terminal `~`, never ✗.
     if (auth.transient)
-        return `${chalk.yellow('~')} ${auth.note ?? 'signed in'}`;
-    return `${mark(true)} signed in (session active)`;
+        return `${chalk.yellow('~')} ${auth.note ?? 'signed in'}${via}`;
+    return `${mark(true)} signed in${via} (session active)`;
 };
 const updateLine = (update) => {
     switch (update.status.kind) {
@@ -70,7 +71,7 @@ export const printStatus = (report) => {
         console.log(chalk.yellow(`\n${report.update.message}`));
 };
 export const runStatus = async (opts = {}) => {
-    const report = await gatherStatus(readAuth(), siteFqdn());
+    const report = await gatherStatus(resolveAuth({ token: opts.token }), siteFqdn());
     if (opts.json) {
         console.log(JSON.stringify(report, null, 2));
         return;
@@ -82,5 +83,6 @@ export const registerStatus = (program) => {
         .command('status')
         .description('Show CLI, account, and endpoint status')
         .option('--json', 'machine-readable output')
+        .option('--token <token>', 'authenticate with a personal access token (aga_...); or set AGENTAGE_TOKEN')
         .action(runStatus);
 };

package/dist/lib/auth/api.js

@@ -9,6 +9,8 @@ const cliHeaders = () => requestHeaders({ component: 'cli' });
 // throws: AuthRequiredError when the grant is dead (401/invalid_grant/invalid_client), else
 // TransientAuthError (429/5xx/network/timeout) - a blip that must not be read as a dead session.
 export const refreshOrThrow = async (auth, links) => {
+    if (auth.kind === 'pat')
+        throw new AuthRequiredError('personal access token expired or revoked - mint a new one in the dashboard (Settings -> API tokens)');
     if (!auth.tokens.refreshToken)
         throw new AuthRequiredError('no refresh token');
     let fresh;

package/dist/lib/auth/credentials.d.ts

@@ -0,0 +1,12 @@
+import { type AuthState } from '../fs/config.js';
+export declare const PAT_PREFIX = "aga_";
+export declare const TOKEN_ENV_VAR = "AGENTAGE_TOKEN";
+export interface PatOptions {
+    token?: string;
+}
+export declare const isPatShape: (value: string) => boolean;
+export declare const assertPatShape: (value: string) => string;
+export declare const rawPatToken: (opts?: PatOptions) => string | undefined;
+export declare const patAuthState: (token: string, fqdn?: string) => AuthState;
+export declare const isPatAuth: (auth: AuthState | null) => boolean;
+export declare const resolveAuth: (opts?: PatOptions, read?: () => AuthState | null) => AuthState | null;

package/dist/lib/auth/credentials.js

@@ -0,0 +1,50 @@
+import { readAuth } from '../fs/config.js';
+import { siteFqdn } from '../net/origins.js';
+// Personal access tokens (PATs) are opaque platform tokens minted in the dashboard (Settings ->
+// API tokens). They are `oauthAccessToken` rows, so the cloud memory MCP + the OAuth introspection
+// endpoint validate them exactly like an OAuth access token - anywhere the CLI sends a stored
+// access token, a PAT works as the bearer. They carry no refresh token and are non-interactive:
+// they are the CI / headless credential.
+export const PAT_PREFIX = 'aga_';
+// Env var (CI-friendly, primary) and the per-command flag name for the PAT.
+export const TOKEN_ENV_VAR = 'AGENTAGE_TOKEN';
+// A PAT is opaque; we only assert the `aga_` shape and non-empty tail so a copy-paste slip fails
+// with a clear message instead of a raw 401 later. The server is the real validator.
+export const isPatShape = (value) => value.startsWith(PAT_PREFIX) && value.length > PAT_PREFIX.length;
+export const assertPatShape = (value) => {
+    const token = value.trim();
+    if (!isPatShape(token))
+        throw new Error(`token must be a personal access token starting with "${PAT_PREFIX}" ` +
+            `(mint one in the dashboard: Settings -> API tokens)`);
+    return token;
+};
+// The raw PAT from flag > env, or undefined when neither is set. An empty/whitespace env value is
+// treated as unset so a stray `export AGENTAGE_TOKEN=` never shadows a stored OAuth session.
+export const rawPatToken = (opts = {}) => {
+    if (opts.token !== undefined && opts.token.trim() !== '')
+        return opts.token.trim();
+    const env = process.env[TOKEN_ENV_VAR];
+    if (env !== undefined && env.trim() !== '')
+        return env.trim();
+    return undefined;
+};
+// A synthesized AuthState backed by a PAT: the token rides through as the bearer everywhere an
+// OAuth access token would. `kind: 'pat'` marks it so refresh / OAuth-session-only paths can fail
+// with a clear message instead of attempting an impossible refresh. siteFqdn is pinned to the
+// current target so the env-mismatch guard never fires (a PAT is not tied to a stored environment).
+export const patAuthState = (token, fqdn = siteFqdn()) => ({
+    siteFqdn: fqdn,
+    clientId: 'pat',
+    kind: 'pat',
+    tokens: { accessToken: assertPatShape(token) },
+});
+export const isPatAuth = (auth) => auth?.kind === 'pat';
+// Resolve the active credential with precedence flag > env PAT > stored OAuth. When a PAT is
+// present the OAuth/DCR flow is skipped entirely and the PAT is the bearer; otherwise fall back to
+// the stored OAuth session on disk (null when signed out).
+export const resolveAuth = (opts = {}, read = readAuth) => {
+    const pat = rawPatToken(opts);
+    if (pat !== undefined)
+        return patAuthState(pat);
+    return read();
+};

package/dist/lib/auth/provision.js

@@ -26,6 +26,15 @@ export const provisionAccountVault = async (name, deps = defaultProvisionDeps())
             message: registeredLocally(name, ' - run `agentage setup` to sync.'),
         };
     }
+    // A PAT is an MCP-surface credential; the backend REST provisioning endpoint rejects plain
+    // bearers (only session cookies), so it cannot provision an account channel. Fail clearly.
+    if (auth.kind === 'pat') {
+        return {
+            status: 'unauthenticated',
+            message: registeredLocally(name, ' - account-channel provisioning needs an interactive session (run `agentage setup`); ' +
+                'a personal access token only authorizes memory (MCP) calls.'),
+        };
+    }
     const links = deps.links();
     let res;
     try {

package/dist/lib/fs/config.d.ts

@@ -11,6 +11,7 @@ export interface AuthState {
         id: string;
         email: string;
     };
+    kind?: 'pat';
 }
 export declare const getConfigDir: () => string;
 export declare const ensureConfigDir: () => string;

package/dist/lib/status/status-info.d.ts

@@ -32,6 +32,7 @@ export interface StatusReport {
         tokenExpiresAt?: string;
         note?: string;
         transient?: boolean;
+        pat?: boolean;
         mismatch?: AuthEnvMismatch;
     };
     endpoint: {

package/dist/lib/status/status-info.js

@@ -96,12 +96,14 @@ export const gatherStatus = async (auth, fqdn) => {
         report.auth = mismatchAuth(mismatch);
         return report;
     }
+    // Only carry `pat: true`; omit it for OAuth so existing exact-match reports stay unchanged.
+    const patFlag = auth.kind === 'pat' ? { pat: true } : {};
     try {
         const session = await introspectToken(auth, target);
-        report.auth = { signedIn: true, tokenExpiresAt: session.expiresAt };
+        report.auth = { signedIn: true, tokenExpiresAt: session.expiresAt, ...patFlag };
     }
     catch (err) {
-        report.auth = classifyAuthError(err);
+        report.auth = { ...classifyAuthError(err), ...patFlag };
     }
     return report;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentage/cli",
-  "version": "0.0.4",
+  "version": "0.25.0",
   "description": "The agentage CLI - connect this machine to agentage from the terminal",
   "type": "module",
   "main": "./dist/index.js",
@@ -41,14 +41,14 @@
   },
   "dependencies": {
     "@agentage/memory-core": "^0.3.2",
-    "@agentage/server-memory": "^0.0.3",
+    "@agentage/server-memory": "^0.1.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "open": "^11.0.0"
   },
   "devDependencies": {
-    "@anthropic-ai/sdk": "0.110.0",
+    "@anthropic-ai/sdk": "0.112.1",
     "@playwright/test": "latest",
     "@types/node": "latest",
     "@typescript-eslint/eslint-plugin": "latest",