@agentage/cli 0.37.2 → 0.38.1

package/README.md

@@ -1,122 +1,92 @@
 # @agentage/cli
 
-[![CI](https://github.com/agentage/cli/actions/workflows/ci.yml/badge.svg)](https://github.com/agentage/cli/actions/workflows/ci.yml)
-[![npm version](https://badge.fury.io/js/%40agentage%2Fcli.svg)](https://badge.fury.io/js/%40agentage%2Fcli)
+![Connect this machine to agentage from the terminal](https://github.com/agentage/cli/raw/master/docs/banner.svg)
 
-Give every AI on your machine one shared memory - plain markdown you own, synced across your devices.
+Connect this machine to your [agentage](https://agentage.io) account from the terminal. One
+command signs you in through your browser, and from then on the machine is known to your account.
 
-Claude, Cursor, and your other AI tools each keep their own separate memory today. This
-CLI gives them a single shared one. It lives on your disk as ordinary markdown files
-you can open, edit, and back up like any other folder. Your AI tools read and write
-those same files, so they all remember the same things. Connect a free account and your
-memory follows you to every device - and nothing is locked in, because the files are
-always just markdown you can export.
+## What is this?
 
-## How it fits together
+agentage gives your AI tools a shared, account-backed home. Every machine you use needs to be
+connected to that account once: this package does that connection. It keeps your sign-in on
+the machine (OAuth 2.1 with PKCE, nothing typed into the terminal), tells you whether the
+machine is connected, and keeps itself up to date.
 
-![Architecture](https://github.com/agentage/cli/raw/master/docs/architecture.svg)
+It is intentionally **small**: sign-in, status and update. Everything else arrives as plugins
+that the CLI installs for you.
 
-## Quickstart
+## Get started
 
-Three steps from nothing to a shared memory your AI can use.
-
-**1. Install it.** Needs Node.js 22 or newer.
+Needs Node.js 22 or newer.
 
 ```bash
 npm install -g @agentage/cli
+agentage setup
 ```
 
-**2. Create a memory.** This makes a plain folder of markdown files at `~/vaults/notes`.
-No sign-in needed.
-
-```bash
-agentage vault add notes --local
-```
-
-**3. Connect your AI.** This example wires up Claude Code over MCP, the open protocol AI
-tools use to call tools. Any AI tool that speaks MCP connects the same way.
+`setup` opens your browser, you sign in, and the session is stored in `~/.agentage`. Then:
 
 ```bash
-claude mcp add --transport http agentage http://127.0.0.1:4243/mcp
+agentage status
 ```
 
-That's it. Ask your AI to remember something, and it lands in your `~/vaults/notes`
-folder as a markdown file you own.
-
-## What your AI can do
-
-Once connected, your AI can:
-
-- Remember things you tell it, saved as a note.
-- Find them again later by keyword.
-- Read back a specific note in full.
-- Update a note in place, or add to it.
-- Browse the folders your notes are organized into.
-- Remove a note it no longer needs (deletes are recoverable).
-
-You can do all of this from the terminal too - run `agentage memory --help` to see how.
-
-## Sync across devices
-
-Want the same memory on your laptop, desktop, and phone? Connect a free account:
+### On a server or in CI (no browser)
 
 ```bash
-agentage setup
+agentage setup --no-browser        # prints the sign-in URL to open elsewhere
+AGENTAGE_TOKEN=aga_... agentage status   # or use a personal access token
 ```
 
-This opens your browser for a one-time sign-in - no API key to copy or passwords in the
-terminal. After that, sync runs quietly in the background and the same memory follows
-you everywhere. Your files always stay yours: they remain plain markdown on your disk,
-and you can export them any time.
-
-Prefer to host it yourself? You can point a memory at your own git remote instead with
-`agentage vault add <name> --git <remote>` - see [`docs/reference.md`](docs/reference.md)
-for details.
+### Then
 
-## Token auth (CI / headless)
+- `agentage status --json` in scripts to check the machine is connected.
+- `agentage update` whenever a newer version is published; `status` tells you when.
 
-For CI or non-interactive machines, skip the browser sign-in and authenticate with a
-personal access token. Mint one in the dashboard under **Settings -> API tokens**
-(scopes `memory:read` / `memory:write`), then set it in the environment:
+## Commands
 
-```bash
-export AGENTAGE_TOKEN=aga_...
-agentage status
-```
+| Command                       | What it does                                                            |
+| ----------------------------- | ----------------------------------------------------------------------- |
+| `agentage setup`              | Sign in through your browser, then show status                          |
+| `agentage setup --no-browser` | Print the sign-in URL instead of opening a browser                      |
+| `agentage setup --reauth`     | Force a fresh sign-in                                                   |
+| `agentage setup --disconnect` | Sign out and remove local credentials                                   |
+| `agentage status`             | Version, update, target, sign-in state, endpoint (`--json` for scripts) |
+| `agentage update`             | Install the latest published version (`--check` only reports)           |
 
-The token is used as the bearer for memory (MCP) calls; `--token aga_...` works per command
-too. Account-channel provisioning still needs an interactive `agentage setup` session.
+Flags, exit codes and token auth are in [`docs/reference.md`](docs/reference.md).
 
-## Going deeper
+## How it works
 
-- [`docs/architecture.md`](docs/architecture.md) - how the CLI, the local helper, your
-  files, and sync fit together.
-- [`docs/reference.md`](docs/reference.md) - every command and flag, the full sync
-  options, MCP details, and environment variables.
+This is the **terminal client for an agentage account**. `setup` registers a one-off OAuth
+client, opens the authorization page in your browser and waits on a localhost callback; the
+tokens land in `~/.agentage/auth.json` with owner-only permissions and are refreshed
+automatically. `status` validates the session against the account's introspection endpoint
+and reports version, update, target host and connectivity. Nothing runs in the background and
+nothing is installed beyond this package.
 
-## Telemetry (off by default)
+## Configuration
 
-Nothing leaves your machine unless you ask for it. The CLI and its local helper ship with
-`@agentage/observability`, which stays inert until `OTEL_EXPORTER_OTLP_ENDPOINT` points at a
-collector you choose - then the CLI reports as `agentage-cli` and the helper as `agentage-daemon`
-(override with `OTEL_SERVICE_NAME`). Every line it writes goes to stderr, so `--json` output and the
-helper's MCP wire stay clean.
+| Env                   | Default       | Purpose                                            |
+| --------------------- | ------------- | -------------------------------------------------- |
+| `AGENTAGE_SITE_FQDN`  | `agentage.io` | Target host                                        |
+| `AGENTAGE_CONFIG_DIR` | `~/.agentage` | Config and credentials directory                   |
+| `AGENTAGE_TOKEN`      | -             | Personal access token for CI and headless machines |
+| `NO_COLOR`            | -             | Disable colored output                             |
 
-## Development
+## Develop
 
 ```bash
 npm ci
-npm run verify        # type-check + lint + format:check + unit tests + build
+npm run verify
+npm run build && npm run test:e2e -- --grep @offline
 ```
 
-End-to-end tests (Playwright) run in tiers - the offline tiers need no network or
-account. See [`docs/reference.md`](docs/reference.md) for more.
+## Release
 
-```bash
-npm run build && npm run test:e2e                      # all e2e tiers
-npm run build && npm run test:e2e -- --grep @offline   # offline tiers only
-```
+Releases publish to npm via GitHub Actions when a `chore(release): X.Y.Z` commit that touches
+`package.json` lands on `master` (the squash-merge subject of a release PR). The workflow skips
+any version already on npm.
 
 ## License
 
-MIT
+MIT - see [LICENSE](./LICENSE).

package/dist/cli.js

@@ -1,15 +1,12 @@
 #!/usr/bin/env node
-// The bin is a loader, nothing else. @agentage/observability instruments node:http, fetch and MCP
-// tool registration through module hooks, and a hook only sees a module imported after it is
-// registered - so the bootstrap runs first and the program is imported dynamically behind it.
 // Dependency-free guard so the message survives even if deps fail to parse on old Node.
 const nodeMajor = Number(process.versions.node.split('.')[0]);
 if (nodeMajor < 22) {
     process.stderr.write(`agentage requires Node.js >= 22 (you have v${process.versions.node})\n`);
-    process.exit(1);
+    process.exitCode = 1;
+}
+else {
+    const { run } = await import('./program.js');
+    process.exitCode = await run();
 }
-const { CLI_SERVICE, startObservability } = await import('./observability.js');
-await startObservability(CLI_SERVICE);
-const { run } = await import('./program.js');
-await run();
 export {};

package/dist/commands/auth/setup.d.ts

@@ -1,22 +1,12 @@
 import { type Command } from 'commander';
-import { startCallbackServer } from '../../lib/auth/callback-server.js';
-import { ensureDaemon } from '../../lib/daemon/daemon-client.js';
-import { introspectToken } from '../../lib/auth/api.js';
-import { exchangeCode, registerClient, revokeToken } from '../../lib/auth/oauth.js';
-export interface SetupOptions {
+import { type SignInOptions, type SignInResult } from '../../lib/auth/sign-in.js';
+export interface SetupOptions extends SignInOptions {
     disconnect?: boolean;
-    reauth?: boolean;
-    browser?: boolean;
 }
 export interface SetupDeps {
-    register: typeof registerClient;
-    exchange: typeof exchangeCode;
-    revoke: typeof revokeToken;
-    startServer: typeof startCallbackServer;
-    openBrowser: (url: string) => Promise<void>;
+    ensureSignedIn: (opts: SignInOptions) => Promise<SignInResult>;
+    signOut: () => Promise<void>;
     printStatus: () => Promise<void>;
-    ensureDaemon: typeof ensureDaemon;
-    introspect: typeof introspectToken;
 }
-export declare const runSetup: (opts: SetupOptions, deps?: SetupDeps) => Promise<void>;
-export declare const registerSetup: (program: Command) => void;
+export declare const runSetup: (opts: SetupOptions, deps: SetupDeps) => Promise<void>;
+export declare const registerSetup: (program: Command, action: (opts: SetupOptions) => Promise<void>) => void;

package/dist/commands/auth/setup.js

@@ -1,147 +1,17 @@
-import chalk from 'chalk';
-import { startCallbackServer } from '../../lib/auth/callback-server.js';
-import { ensureDaemon } from '../../lib/daemon/daemon-client.js';
-import { daemonDisabled } from '../../lib/daemon/daemon-pref.js';
-import { deleteAuth, ensureConfigDir, mutateAuth, readAuth, } from '../../lib/fs/config.js';
-import { AuthRequiredError, introspectToken } from '../../lib/auth/api.js';
-import { detectEnvMismatch } from '../../lib/auth/env-match.js';
-import { buildAuthorizeUrl, exchangeCode, pkcePair, randomState, registerClient, revokeToken, } from '../../lib/auth/oauth.js';
-import { links, siteFqdn } from '../../lib/net/origins.js';
-import { ensureVaultsConfig } from '../../lib/vault/vaults.js';
-import { runStatus } from '../status/status.js';
-const defaultDeps = {
-    register: registerClient,
-    exchange: exchangeCode,
-    revoke: revokeToken,
-    startServer: startCallbackServer,
-    openBrowser: async (url) => {
-        const { default: open } = await import('open');
-        await open(url);
-    },
-    printStatus: () => runStatus({}),
-    ensureDaemon,
-    introspect: introspectToken,
+import {} from 'commander';
+import {} from '../../lib/auth/sign-in.js';
+export const runSetup = async (opts, deps) => {
+    if (opts.disconnect)
+        return deps.signOut();
+    await deps.ensureSignedIn({ reauth: opts.reauth, browser: opts.browser });
+    await deps.printStatus();
 };
-const toAuthState = (fqdn, clientId, tokens) => ({
-    siteFqdn: fqdn,
-    clientId,
-    tokens: {
-        accessToken: tokens.access_token,
-        refreshToken: tokens.refresh_token,
-        expiresAt: tokens.expires_in ? Date.now() + tokens.expires_in * 1000 : undefined,
-    },
-});
-// After sign-in, bring the daemon up so account sync starts immediately; ensureDaemon reuses a
-// live daemon and starts a stopped one (idempotent). Honor the --no-daemon / AGENTAGE_NO_DAEMON
-// disable switches.
-const startDaemon = async (deps) => {
-    if (daemonDisabled()) {
-        console.log('Daemon disabled - account sync will run in-process on demand.');
-        return;
-    }
-    const client = await deps.ensureDaemon();
-    const fail = 'Could not start the daemon - run: agentage daemon start';
-    console.log(client ? 'Daemon running.' : fail);
-};
-const disconnect = async (deps) => {
-    const auth = readAuth();
-    if (!auth) {
-        console.log('Nothing to disconnect.');
-        return;
-    }
-    await deps.revoke(links(auth.siteFqdn).auth, auth.tokens.accessToken);
-    await deleteAuth();
-    console.log('Disconnected - local credentials removed.');
-};
-// Validate the stored session instead of trusting mere token presence. Returns true to short-circuit
-// (valid or a transient blip - creds intact), false to proceed into a fresh sign-in (truly expired or
-// the credential belongs to a different target than the current run).
-const alreadySignedIn = async (auth, deps) => {
-    const mismatch = detectEnvMismatch(auth, siteFqdn());
-    if (mismatch) {
-        console.log(`Signed in to ${mismatch.credentialFqdn} (${mismatch.credentialEnv}), but this run targets ` +
-            `${mismatch.targetFqdn} (${mismatch.targetEnv}) - signing you into ${mismatch.targetEnv}.\n`);
-        return false; // proceed to a fresh sign-in against the current target
-    }
-    try {
-        await deps.introspect(auth, links(auth.siteFqdn));
-        console.log(`Already signed in. Run ${chalk.white('agentage setup --reauth')} to sign in again.\n`);
-        await deps.printStatus();
-        return true;
-    }
-    catch (err) {
-        if (err instanceof AuthRequiredError) {
-            console.log('Session expired - signing you in again.\n');
-            return false; // fall through to the sign-in flow, no --reauth needed
-        }
-        // Transient: do not force reauth on a blip; keep credentials and show status.
-        console.log('You appear signed in (could not fully verify - temporary).\n');
-        await deps.printStatus();
-        return true;
-    }
-};
-export const runSetup = async (opts, deps = defaultDeps) => {
-    if (opts.disconnect) {
-        await disconnect(deps);
-        return;
-    }
-    const stored = readAuth();
-    if (stored && !opts.reauth && (await alreadySignedIn(stored, deps)))
-        return;
-    const fqdn = siteFqdn();
-    const target = links(fqdn);
-    ensureConfigDir();
-    ensureVaultsConfig();
-    const { verifier, challenge } = pkcePair();
-    const state = randomState();
-    const server = await deps.startServer(state);
-    try {
-        const clientId = await deps.register(target.auth, server.redirectUri);
-        const url = buildAuthorizeUrl(target.auth, {
-            clientId,
-            redirectUri: server.redirectUri,
-            challenge,
-            state,
-        });
-        console.log(`\nSign in to agentage (${fqdn}):\n\n  ${url}\n`);
-        if (opts.browser === false)
-            console.log('Open the URL above in a browser to continue.');
-        else
-            await deps
-                .openBrowser(url)
-                .catch(() => console.log('Could not open a browser - use the URL above.'));
-        console.log('Waiting for sign-in to complete...');
-        const code = await server.waitForCode();
-        const tokens = await deps.exchange(target.auth, {
-            clientId,
-            code,
-            redirectUri: server.redirectUri,
-            verifier,
-        });
-        await mutateAuth(() => toAuthState(fqdn, clientId, tokens));
-        console.log(chalk.green('\nSigned in.\n'));
-        await startDaemon(deps);
-        await deps.printStatus();
-    }
-    finally {
-        server.close();
-    }
-};
-export const registerSetup = (program) => {
+export const registerSetup = (program, action) => {
     program
         .command('setup')
         .description('Sign in and connect this machine to your agentage account')
         .option('--disconnect', 'sign out and remove local credentials')
         .option('--reauth', 'force a fresh sign-in')
         .option('--no-browser', 'print the sign-in URL instead of opening a browser')
-        .action(async (opts) => {
-        try {
-            await runSetup(opts);
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            console.error(chalk.red(`Setup failed: ${message}`));
-            process.exitCode = 1;
-        }
-    });
+        .action(action);
 };

package/dist/commands/status/status.d.ts

@@ -1,8 +1,9 @@
 import { type Command } from 'commander';
 import { type StatusReport } from '../../lib/status/status-info.js';
 export declare const printStatus: (report: StatusReport) => void;
-export declare const runStatus: (opts?: {
+export interface StatusOptions {
     json?: boolean;
     token?: string;
-}) => Promise<void>;
-export declare const registerStatus: (program: Command) => void;
+}
+export declare const runStatus: (opts?: StatusOptions) => Promise<void>;
+export declare const registerStatus: (program: Command, action: (opts: StatusOptions) => Promise<void>) => void;

package/dist/commands/status/status.js

@@ -1,9 +1,8 @@
 import chalk from 'chalk';
+import {} from 'commander';
 import { resolveAuth } from '../../lib/auth/credentials.js';
 import { siteFqdn } from '../../lib/net/origins.js';
-import { formatUptime } from '../../lib/status/format.js';
-import { gatherStatus, } from '../../lib/status/status-info.js';
-import { vaultLines } from '../../lib/status/vaults-format.js';
+import { gatherStatus } from '../../lib/status/status-info.js';
 import { INSTALL_HINT } from '../../lib/update/update-check.js';
 const mark = (good) => (good ? chalk.green('✓') : chalk.red('✗'));
 const row = (label, value) => {
@@ -36,24 +35,6 @@ const updateLine = (update) => {
             return chalk.dim('- update check unavailable');
     }
 };
-const daemonLine = (d, cliVersion) => {
-    if (!d.running)
-        return `${mark(false)} stopped - run: agentage daemon start`;
-    const up = d.uptimeSeconds !== undefined ? `, up ${formatUptime(d.uptimeSeconds)}` : '';
-    const stale = d.daemonVersion && d.daemonVersion !== cliVersion
-        ? chalk.yellow(` (version ${d.daemonVersion} != cli ${cliVersion})`)
-        : '';
-    return `${mark(true)} running (pid ${d.pid ?? '?'}, port ${d.port}${up})${stale}`;
-};
-const mcpLine = (d) => d.mcp ? `${mark(true)} serving at http://127.0.0.1:${d.port}/mcp` : `${mark(false)} off`;
-// Daemon rows honor version-mismatch inline (appended to the daemon row) and print mcp only when
-// running; the per-vault sync breakdown now lives in its own `vaults` block (printStatus).
-const printDaemon = (d, cliVersion) => {
-    row('daemon', daemonLine(d, cliVersion));
-    if (!d.running)
-        return;
-    row('mcp', mcpLine(d));
-};
 export const printStatus = (report) => {
     row('version', report.version);
     row('update', updateLine(report.update));
@@ -63,10 +44,6 @@ export const printStatus = (report) => {
     row('auth', authLine(report.auth));
     row('endpoint', `${mark(report.endpoint.reachable)} ${report.endpoint.url} ` +
         (report.endpoint.reachable ? 'reachable' : 'unreachable'));
-    if (report.daemon)
-        printDaemon(report.daemon, report.version);
-    for (const line of vaultLines(report.vaults))
-        console.log(line);
     if (report.update.message)
         console.log(chalk.yellow(`\n${report.update.message}`));
 };
@@ -78,11 +55,11 @@ export const runStatus = async (opts = {}) => {
     }
     printStatus(report);
 };
-export const registerStatus = (program) => {
+export const registerStatus = (program, action) => {
     program
         .command('status')
         .description('Show CLI, account, and endpoint status')
         .option('--json', 'machine-readable output')
         .option('--token <token>', 'authenticate with a personal access token (aga_...); or set AGENTAGE_TOKEN')
-        .action(runStatus);
+        .action(action);
 };

package/dist/commands/update/update.d.ts

@@ -1,17 +1,10 @@
 import { type Command } from 'commander';
-import { type SpawnOutcome } from '../../lib/daemon/daemon-client.js';
+import { requireNpm10, runNpm } from '../../lib/npm/npm-cli.js';
 import { type UpdateInfo } from '../../lib/update/update-check.js';
-export type RestartOutcome = 'restarted' | 'failed' | 'not-running';
-export interface RestartDeps {
-    running?: () => boolean;
-    stop?: () => Promise<boolean>;
-    start?: (port: number) => Promise<SpawnOutcome>;
-}
-export declare const restartDaemonIfRunning: (deps?: RestartDeps) => Promise<RestartOutcome>;
+export declare const installLatest: (run?: typeof runNpm, check?: typeof requireNpm10) => Promise<void>;
 export interface UpdateDeps {
     check: (installed: string) => Promise<UpdateInfo>;
     install: () => Promise<void>;
-    restartDaemon: () => Promise<RestartOutcome>;
     acquireLock: () => boolean;
     releaseLock: () => void;
     log: (msg: string) => void;
@@ -20,4 +13,4 @@ export interface UpdateOptions {
     check?: boolean;
 }
 export declare const runUpdate: (opts: UpdateOptions, deps?: UpdateDeps) => Promise<void>;
-export declare const registerUpdate: (program: Command) => void;
+export declare const registerUpdate: (program: Command, action: (opts: UpdateOptions) => Promise<void>) => void;

package/dist/commands/update/update.js

@@ -1,31 +1,30 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
+import { join } from 'node:path';
 import chalk from 'chalk';
-import { isDaemonRunning, resolvePort, stopDaemonAndWait } from '../../daemon/lifecycle.js';
-import { spawnDaemon } from '../../lib/daemon/daemon-client.js';
+import {} from 'commander';
+import { getConfigDir } from '../../lib/fs/config.js';
+import { acquireFileLock, releaseFileLock } from '../../lib/fs/file-lock.js';
+import { requireNpm10, runNpm } from '../../lib/npm/npm-cli.js';
 import { checkForUpdate, INSTALL_HINT } from '../../lib/update/update-check.js';
-import { acquireUpdateLock, releaseUpdateLock } from '../../lib/update/update-lock.js';
 import { VERSION } from '../../utils/version.js';
-const pexec = promisify(execFile);
-// Restart a running daemon so it picks up the freshly installed binary; a stopped daemon is left
-// stopped. Waits for the old process to exit (port free) before spawning, and reports honestly
-// when the new daemon did not come up.
-export const restartDaemonIfRunning = async (deps = {}) => {
-    const running = deps.running ?? isDaemonRunning;
-    if (!running())
-        return 'not-running';
-    await (deps.stop ?? stopDaemonAndWait)();
-    const up = await (deps.start ?? spawnDaemon)(resolvePort());
-    return up.ok ? 'restarted' : 'failed';
+const INSTALL_TIMEOUT_MS = 5 * 60_000;
+const NPM_TAIL_LINES = 10;
+// An install takes minutes, so the crashed-holder ages scale up from the config-write defaults.
+const UPDATE_LOCK = { ttlMs: 10 * 60_000, hardStaleMs: 30 * 60_000 };
+const updateLockTarget = () => join(getConfigDir(), 'update');
+const tail = (text) => text.trimEnd().split('\n').slice(-NPM_TAIL_LINES).join('\n');
+export const installLatest = async (run = runNpm, check = requireNpm10) => {
+    await check(run);
+    const res = await run(['install', '-g', '@agentage/cli@latest'], {
+        timeoutMs: INSTALL_TIMEOUT_MS,
+    });
+    if (res.code !== 0)
+        throw new Error(`npm install failed (exit ${res.code}):\n${tail(res.stderr || res.stdout)}`);
 };
 const defaultDeps = {
     check: checkForUpdate,
-    install: async () => {
-        await pexec('npm', ['install', '-g', '@agentage/cli@latest']);
-    },
-    restartDaemon: () => restartDaemonIfRunning(),
-    acquireLock: () => acquireUpdateLock(),
-    releaseLock: releaseUpdateLock,
+    install: () => installLatest(),
+    acquireLock: () => acquireFileLock(updateLockTarget(), Date.now(), UPDATE_LOCK),
+    releaseLock: () => releaseFileLock(updateLockTarget()),
     log: (msg) => console.log(msg),
 };
 const describe = (info) => {
@@ -41,20 +40,12 @@ const describe = (info) => {
             return chalk.yellow(`Couldn't reach the registry - try again later. ${INSTALL_HINT}`);
     }
 };
-// Install, then restart a running daemon so its in-process engine runs the new version.
 const install = async (deps) => {
     deps.log('Installing the latest @agentage/cli...');
     await deps.install();
     deps.log(chalk.green('Updated. Run `agentage status` to confirm.'));
-    const outcome = await deps.restartDaemon();
-    if (outcome === 'restarted')
-        deps.log(chalk.green('Restarted the daemon on the new version.'));
-    if (outcome === 'failed')
-        deps.log(chalk.yellow('Daemon did not restart cleanly - run `agentage daemon start`.'));
 };
-// --check reports the verdict and never installs. Otherwise, install only when the registry says
-// we're behind (available/unsupported), guarded by a single-writer lock; current/unreachable just
-// report.
+// --check never installs; otherwise install only when behind, under a single-writer lock.
 export const runUpdate = async (opts, deps = defaultDeps) => {
     const info = await deps.check(VERSION);
     deps.log(describe(info));
@@ -72,18 +63,10 @@ export const runUpdate = async (opts, deps = defaultDeps) => {
         deps.releaseLock();
     }
 };
-export const registerUpdate = (program) => {
+export const registerUpdate = (program, action) => {
     program
         .command('update')
         .description('Update @agentage/cli to the latest published version')
         .option('--check', 'report whether an update is available, without installing')
-        .action(async (opts) => {
-        try {
-            await runUpdate(opts);
-        }
-        catch (err) {
-            console.error(chalk.red(err instanceof Error ? err.message : String(err)));
-            process.exitCode = 1;
-        }
-    });
+        .action(action);
 };

package/dist/core/flag.d.ts

@@ -0,0 +1 @@
+export declare const pluginsEnabled: () => boolean;

package/dist/core/flag.js

@@ -0,0 +1 @@
+export const pluginsEnabled = () => process.env['AGENTAGE_PLUGINS'] === '1';

package/dist/lib/auth/api.d.ts

@@ -1,7 +1,8 @@
 import { type AuthState } from '../fs/config.js';
+import { type CliRequestInit } from '../net/fetch.js';
 import { type Links } from '../net/origins.js';
 export { AuthRequiredError, TransientAuthError } from './auth-errors.js';
 export declare const refreshOrThrow: (auth: AuthState, links: Links) => Promise<void>;
-export declare const authedGet: <T>(auth: AuthState, links: Links, url: string) => Promise<T>;
-export declare const authedPost: (auth: AuthState, links: Links, url: string, body: unknown) => Promise<Response>;
+export declare const authedFetch: (auth: AuthState, links: Links, url: string, init?: CliRequestInit) => Promise<Response>;
+export declare const authedJson: <T>(auth: AuthState, links: Links, url: string, init?: CliRequestInit) => Promise<T>;
 export { introspectToken, type TokenSession } from './introspect.js';