@agentage/cli 0.39.0 → 0.41.0

package/dist/commands/extension/secrets-prompt.js

@@ -0,0 +1,47 @@
+import { secretsFor } from '../../core/loader/secrets.js';
+const ENTER = ['\r', '\n', '\u0004'];
+const CTRL_C = '\u0003';
+const BACKSPACE = '\u007f';
+// One keypress: the answer so far, or null once Enter ends it.
+const typed = (answer, char) => {
+    if (ENTER.includes(char))
+        return null;
+    return char === BACKSPACE ? answer.slice(0, -1) : answer + char;
+};
+// Raw mode keeps the answer off the screen; Ctrl+C still interrupts once the terminal is restored.
+const readHidden = (question) => new Promise((resolve) => {
+    const { stdin, stderr } = process;
+    let answer = '';
+    const onData = (chunk) => {
+        for (const char of chunk.toString('utf-8')) {
+            const next = char === CTRL_C ? null : typed(answer, char);
+            if (next === null)
+                return finish(char === CTRL_C);
+            answer = next;
+        }
+    };
+    const finish = (interrupted) => {
+        stdin.off('data', onData).setRawMode(false).pause();
+        stderr.write('\n');
+        resolve(answer);
+        if (interrupted)
+            process.kill(process.pid, 'SIGINT');
+    };
+    stderr.write(question);
+    stdin.setRawMode(true).resume().on('data', onData);
+});
+const terminal = () => ({ isTTY: process.stdin.isTTY === true, prompt: readHidden });
+const nameOf = ({ id, key }) => `${id}.${key}`;
+// Before loading: a terminal is asked for each missing secret, anything else gets the list.
+export const askSecrets = async (missing, io = terminal()) => {
+    if (missing.length === 0)
+        return;
+    if (!io.isTTY)
+        return void console.log(`secrets to set: ${missing.map(nameOf).join(', ')}`);
+    for (const secret of missing) {
+        const described = secret.description === null ? '' : ` (${secret.description})`;
+        const value = await io.prompt(`${nameOf(secret)}${described}: `);
+        if (value !== '')
+            await secretsFor(secret.id).set(secret.key, value);
+    }
+};

package/dist/commands/extension/setup-cloud.d.ts

@@ -0,0 +1,6 @@
+import { type EditDeps } from './sync.js';
+export interface AccountSetupDeps extends EditDeps {
+    signOut: () => Promise<void>;
+}
+export declare const accountSetup: (deps: EditDeps) => Promise<void>;
+export declare const disconnect: (deps: AccountSetupDeps) => Promise<void>;

package/dist/commands/extension/setup-cloud.js

@@ -0,0 +1,98 @@
+import chalk from 'chalk';
+import { localProfile, NotPushedError, pullProfile, } from '../../core/profile/cloud.js';
+import { forgetAccount, loadMachine, readMachine, setAccount, setCloud, } from '../../core/profile/machine.js';
+import { defaultProfile, mutateProfile, readProfile } from '../../core/profile/profile.js';
+import { pushWithReplay } from '../../core/profile/push.js';
+import { disconnectMachine, registerMachine } from '../../core/profile/register.js';
+import {} from '../../core/profile/schema.js';
+import { installAndLoad, line } from './install-load.js';
+import { applying, checkAccount } from './sync.js';
+const FILE_NOTE = 'from a file (setup --profile), not synced with your account';
+// profile.json: null when absent; an invalid one stops setup naming each problem.
+const localCopy = () => {
+    const parsed = readProfile();
+    if (parsed === null)
+        return null;
+    if (parsed.ok)
+        return parsed.profile;
+    throw new Error(`profile.json is invalid:\n${parsed.errors.map((e) => `  ${e}`).join('\n')}`);
+};
+// The etag profile.json still mirrors: sent as If-None-Match, so an unchanged profile is a 304.
+const mirroredEtag = (machine) => machine.profileSource === 'cloud' && readProfile()?.ok === true ? machine.profileEtag : null;
+// Without the account: the local profile.json; with none, nothing to install, and setup goes on.
+const fromLocalCopy = async (reason, deps) => {
+    const local = localCopy();
+    const unavailable = 'cloud profile unavailable';
+    if (local === null)
+        return console.error(chalk.dim(`${unavailable} and no local profile.json, nothing installed (${reason})`));
+    console.error(chalk.dim(`${unavailable}, using local profile.json (${reason})`));
+    await installAndLoad(local, deps.npm);
+};
+const installPulled = async (doc, deps) => {
+    await mutateProfile(() => doc.profile);
+    console.log(line('profile', `pulled from your account (etag ${doc.etag})`));
+    await installAndLoad({ ...doc.profile, lock: doc.lock }, deps.npm, () => setCloud(doc.etag));
+};
+// A create the account did not take fails nothing: the next setup creates it.
+const notCreated = (err) => {
+    if (!(err instanceof NotPushedError))
+        throw err;
+    console.error(chalk.dim(`${err.message}; the next agentage setup tries again`));
+    return null;
+};
+// No profile in the account yet: this machine's own, or the default, becomes it once it loaded.
+const createIn = async (account, deps) => {
+    const base = localProfile(localCopy() ?? defaultProfile());
+    const apply = applying((profile) => profile, deps);
+    const done = await pushWithReplay(account.fetch, base, apply).catch(notCreated);
+    if (done === null)
+        return;
+    await setCloud(done.etag);
+    const where = done.pushed ? 'created in' : 'already in';
+    console.log(line('profile', `${where} your account (etag ${done.etag})`));
+};
+// Plain setup pulls and never pushes, except to create the account's first profile.
+const profileFrom = async (account, machine, deps) => {
+    if (machine.profileSource === 'file') {
+        console.log(line('profile', FILE_NOTE));
+        return installAndLoad(localCopy() ?? defaultProfile(), deps.npm);
+    }
+    const pulled = await pullProfile(account.fetch, mirroredEtag(machine));
+    if (pulled.kind === 'found')
+        return installPulled(pulled.doc, deps);
+    if (pulled.kind === 'none')
+        return createIn(account, deps);
+    if (pulled.kind === 'current')
+        return installAndLoad(localCopy() ?? defaultProfile(), deps.npm);
+    return fromLocalCopy(pulled.reason, deps);
+};
+// The first signed-in setup records the account; another account is refused until --disconnect.
+const connect = async (account) => {
+    const machine = await loadMachine();
+    const userId = await checkAccount(account, machine);
+    return userId === null || machine.accountId !== null ? machine : setAccount(userId);
+};
+// Registration runs alongside the profile, so it never delays setup by more than its 2 s.
+export const accountSetup = async (deps) => {
+    const account = deps.account();
+    if (account === null)
+        return fromLocalCopy('not signed in', deps);
+    const machine = await connect(account);
+    const registered = registerMachine(account.fetch, machine);
+    try {
+        await profileFrom(account, machine, deps);
+    }
+    finally {
+        await registered;
+    }
+};
+// setup --disconnect: the account marks this machine disconnected, then it forgets the account.
+export const disconnect = async (deps) => {
+    const machine = readMachine();
+    const account = deps.account();
+    if (machine !== null && account !== null)
+        await disconnectMachine(account.fetch, machine.id);
+    await deps.signOut();
+    if (machine !== null)
+        await forgetAccount();
+};

package/dist/commands/extension/setup.d.ts

@@ -0,0 +1,5 @@
+import { type SetupDeps, type SetupOptions } from '../auth/setup.js';
+import { type EditDeps } from './sync.js';
+export interface ExtensionSetupDeps extends SetupDeps, EditDeps {
+}
+export declare const runExtensionSetup: (opts: SetupOptions, deps: ExtensionSetupDeps) => Promise<void>;

package/dist/commands/extension/setup.js

@@ -0,0 +1,68 @@
+import { readFileSync } from 'node:fs';
+import { loadMachine, setProfileSource } from '../../core/profile/machine.js';
+import { keepMachine } from '../../core/profile/merge.js';
+import { defaultProfile, mutateProfile, parseProfileText, readProfile, } from '../../core/profile/profile.js';
+import {} from '../../core/profile/schema.js';
+import {} from '../auth/setup.js';
+import { installAndLoad } from './install-load.js';
+import { runSetupLatest } from './latest.js';
+import { printDryRun, runSetupCheck } from './plan.js';
+import { printWarnings } from './row-lines.js';
+import { accountSetup, disconnect } from './setup-cloud.js';
+import {} from './sync.js';
+const sourceOf = (label, parsed) => {
+    if (!parsed.ok)
+        throw new Error(`${label} is invalid:\n${parsed.errors.map((e) => `  ${e}`).join('\n')}`);
+    return { profile: parsed.profile, warnings: parsed.warnings };
+};
+const fileSource = (file) => {
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(file))
+        throw new Error(`${file}: profile URLs are not supported; pass a file path`);
+    let raw;
+    try {
+        raw = readFileSync(file, 'utf-8');
+    }
+    catch (err) {
+        throw new Error(`cannot read profile ${file}: ${err.message}`);
+    }
+    return sourceOf(file, parseProfileText(raw));
+};
+// For --check and --dry-run: the local profile.json, else the built-in default.
+const localSource = () => {
+    const parsed = readProfile();
+    if (parsed !== null)
+        return sourceOf('profile.json', parsed);
+    return { profile: defaultProfile(), warnings: [] };
+};
+// --check and --dry-run read only and never sign in.
+const readOnly = (source, opts) => {
+    printWarnings(source.warnings);
+    if (opts.check)
+        runSetupCheck(source.profile, opts);
+    else
+        printDryRun(source.profile, opts);
+};
+// `--profile` never signs in nor calls the account; this machine's own entry is kept.
+const fromFile = async (source, deps) => {
+    const machine = await loadMachine();
+    await mutateProfile((current) => keepMachine(source.profile, current, machine.id));
+    await setProfileSource('file');
+    await installAndLoad(source.profile, deps.npm);
+};
+export const runExtensionSetup = async (opts, deps) => {
+    if (opts.disconnect)
+        return disconnect(deps);
+    const file = opts.profile === undefined ? null : fileSource(opts.profile);
+    if (opts.check || opts.dryRun)
+        return readOnly(file ?? localSource(), opts);
+    if (file)
+        return fromFile(file, deps);
+    if (opts.latest)
+        return runSetupLatest(deps);
+    await deps.ensureSignedIn({ reauth: opts.reauth, browser: opts.browser });
+    const token = process.env['AGENTAGE_TOKEN'];
+    const failure = await accountSetup(deps).then(() => null, (error) => error);
+    await deps.printStatus({ token });
+    if (failure)
+        throw failure;
+};

package/dist/commands/extension/sync.d.ts

@@ -0,0 +1,22 @@
+import { type Npm } from '../../core/installer/npm.js';
+import { type Account, type CloudFetch, type CloudProfile } from '../../core/profile/cloud.js';
+import { type MachineFile } from '../../core/profile/machine.js';
+import { type Apply, type LockPair, type Pushed, type ReplayOptions } from '../../core/profile/push.js';
+import { type Profile } from '../../core/profile/schema.js';
+import { type AccountOf } from './account.js';
+export interface EditDeps {
+    npm: () => Promise<Npm>;
+    npmMajor: () => Promise<number>;
+    account: AccountOf;
+}
+export type Change = (profile: Profile) => Profile;
+export interface Synced {
+    fetch: CloudFetch;
+    base: CloudProfile;
+}
+export declare const checkAccount: (account: Account, machine: MachineFile) => Promise<string | null>;
+export declare const pullForEdit: (deps: EditDeps) => Promise<Synced | null>;
+export declare const localLock: (deps: EditDeps) => Promise<LockPair>;
+export declare const applying: (change: Change, deps: EditDeps, note?: string | null) => Apply;
+export declare const pushApplied: (synced: Synced, apply: Apply, opts?: ReplayOptions) => Promise<Pushed>;
+export declare const finishEdit: (synced: Synced | null, change: Change, deps: EditDeps, note?: string | null) => Promise<void>;

package/dist/commands/extension/sync.js

@@ -0,0 +1,81 @@
+import { join } from 'node:path';
+import { parseLock } from '../../core/installer/compare-lock.js';
+import {} from '../../core/installer/npm.js';
+import { LOCK_FILE, readText } from '../../core/installer/tree.js';
+import { extensionsDir } from '../../core/paths.js';
+import { localProfile, NotPushedError, pullProfile, } from '../../core/profile/cloud.js';
+import { changeProfile } from '../../core/profile/edit.js';
+import { accountMismatch, loadMachine, setCloud, } from '../../core/profile/machine.js';
+import { editableProfile, mutateProfile } from '../../core/profile/profile.js';
+import { pushBody, pushWithReplay, } from '../../core/profile/push.js';
+import {} from '../../core/profile/schema.js';
+import {} from './account.js';
+import { installAndLoad, line } from './install-load.js';
+const NOT_SIGNED_IN = 'not signed in - run: agentage setup (this machine syncs its profile with your account)';
+const REPLAY = 'changed in your account meanwhile, replaying this change on it';
+// The signed-in account's id, refused when this machine is connected to another account.
+export const checkAccount = async (account, machine) => {
+    const userId = await account.id();
+    const mismatch = accountMismatch(machine, userId);
+    if (mismatch)
+        throw mismatch;
+    return userId;
+};
+// Pulled whole, before anything changes, so the edit applies to the account's newest document.
+export const pullForEdit = async (deps) => {
+    const machine = await loadMachine();
+    if (machine.profileSource !== 'cloud')
+        return null;
+    const account = deps.account();
+    if (account === null)
+        throw new Error(NOT_SIGNED_IN);
+    await checkAccount(account, machine);
+    const pulled = await pullProfile(account.fetch, null);
+    if (pulled.kind === 'unavailable')
+        throw new Error(`cloud profile unavailable (${pulled.reason}); nothing changed`);
+    const base = pulled.kind === 'found' ? pulled.doc : localProfile(editableProfile());
+    return { fetch: account.fetch, base };
+};
+// extensions/package-lock.json and the npm major that wrote it, pushed with the profile.
+export const localLock = async (deps) => {
+    const lock = parseLock(readText(join(extensionsDir(), LOCK_FILE)));
+    return { lock, npmMajor: lock === null ? null : await deps.npmMajor() };
+};
+// Nothing is pushed unless the new tree installed and loaded: installAndLoad throws otherwise.
+export const applying = (change, deps, note = null) => {
+    let calls = 0;
+    return async (base) => {
+        const next = change(base.profile);
+        await mutateProfile(() => next);
+        const text = calls++ === 0 ? note : line('profile', REPLAY);
+        if (text !== null)
+            console.log(text);
+        await installAndLoad({ ...next, lock: base.lock }, deps.npm);
+        return pushBody(next, base, await localLock(deps));
+    };
+};
+const onThisMachine = async (change, deps, note) => {
+    await changeProfile(change);
+    if (note !== null)
+        console.log(note);
+    await installAndLoad(editableProfile(), deps.npm);
+};
+const installedHere = (err) => {
+    if (!(err instanceof NotPushedError))
+        throw err;
+    throw new Error(`${err.message}; installed here only, run the command again to push it`);
+};
+// `apply` installs and loads before it returns the body: a failed load pushes nothing.
+export const pushApplied = async (synced, apply, opts = {}) => {
+    const done = await pushWithReplay(synced.fetch, synced.base, apply, opts).catch(installedHere);
+    await setCloud(done.etag);
+    return done;
+};
+// install, remove and --off end here; the account gets the change only after the tree loaded.
+export const finishEdit = async (synced, change, deps, note = null) => {
+    if (synced === null)
+        return onThisMachine(change, deps, note);
+    const done = await pushApplied(synced, applying(change, deps, note));
+    const where = done.pushed ? 'pushed to' : 'already in';
+    console.log(line('profile', `${where} your account (etag ${done.etag})`));
+};

package/dist/commands/extension/up.d.ts

@@ -0,0 +1,22 @@
+import { type Command } from 'commander';
+import { type LoadKitTool } from './kit-tool.js';
+export interface ExtensionUpOptions {
+    dir?: string;
+}
+export interface ExtensionDownOptions extends ExtensionUpOptions {
+    keepData?: boolean;
+}
+export interface ExtensionTokenOptions {
+    scope: string;
+    issuer?: string;
+}
+export declare const runExtensionUp: (opts?: ExtensionUpOptions, tool?: LoadKitTool) => Promise<void>;
+export declare const runExtensionDown: (opts?: ExtensionDownOptions, tool?: LoadKitTool) => Promise<void>;
+export declare const runExtensionToken: (opts: ExtensionTokenOptions, tool?: LoadKitTool) => Promise<void>;
+export declare const issuerUrl: (value: string) => string;
+export interface KitActions {
+    up: (opts: ExtensionUpOptions) => Promise<void>;
+    down: (opts: ExtensionDownOptions) => Promise<void>;
+    token: (opts: ExtensionTokenOptions) => Promise<void>;
+}
+export declare const addKitTools: (group: Command, actions: KitActions) => void;

package/dist/commands/extension/up.js

@@ -0,0 +1,76 @@
+import { InvalidArgumentError } from 'commander';
+import { loadKitTool } from './kit-tool.js';
+const print = (line) => console.log(line);
+// Each step's line as the kit reports it, the ready line last.
+export const runExtensionUp = async (opts = {}, tool = loadKitTool) => {
+    const { up } = await tool();
+    await up({ ...opts, onLine: print });
+};
+export const runExtensionDown = async (opts = {}, tool = loadKitTool) => {
+    const { down } = await tool();
+    await down({ ...opts, onLine: print });
+};
+// The token alone on stdout, so a script can take it as it is.
+export const runExtensionToken = async (opts, tool = loadKitTool) => {
+    const { token } = await tool();
+    console.log(await token(opts));
+};
+// A usage error (exit 2) before the kit is asked: the issuer is an http: or https: URL.
+export const issuerUrl = (value) => {
+    let protocol;
+    try {
+        protocol = new URL(value).protocol;
+    }
+    catch {
+        throw new InvalidArgumentError('not a URL.');
+    }
+    if (protocol === 'http:' || protocol === 'https:')
+        return value;
+    throw new InvalidArgumentError('not an http: or https: URL.');
+};
+const UP_HELP = `
+Runs the extension package in --dir (default: the current folder) on this machine with Docker
+only, the way a deployment runs it: the part images built with the release recipe, the store
+with its migrations and seeds, a dev token issuer and a local gateway. Prints one line per step
+as the kit reports it, the last one once every part is healthy. Needs docker. Exits 1 when a
+step fails, with the kit's message.`;
+const DOWN_HELP = `
+Removes what agentage extension up started for the package in --dir: its containers, network
+and the store's volume; --keep-data keeps the volume. Exits 1 when that fails.`;
+const TOKEN_HELP = `
+Prints a token from the dev issuer agentage extension up started, alone on stdout, for calling
+/api/v1/ and /mcp by hand or from tests. Only up trusts it. Exits 1 when the issuer refuses.`;
+const DIR = '--dir <path>';
+const DIR_TEXT = 'the extension package folder (default: the current folder)';
+const addUp = (group, up) => {
+    group
+        .command('up')
+        .description('Run the extension package on this machine: images, store, issuer, gateway')
+        .option(DIR, DIR_TEXT)
+        .addHelpText('after', UP_HELP)
+        .action(up);
+};
+const addDown = (group, down) => {
+    group
+        .command('down')
+        .description('Remove what extension up started; --keep-data keeps the store')
+        .option(DIR, DIR_TEXT)
+        .option('--keep-data', "keep the store's volume")
+        .addHelpText('after', DOWN_HELP)
+        .action(down);
+};
+const addToken = (group, token) => {
+    group
+        .command('token')
+        .description('Print a token from the dev issuer extension up started')
+        .requiredOption('--scope <scope>', 'the scope the token carries, e.g. probe:write')
+        .option('--issuer <url>', 'the dev issuer (default: http://localhost:4281)', issuerUrl)
+        .addHelpText('after', TOKEN_HELP)
+        .action(token);
+};
+// up, down and token: thin commands over the kit's tool library, for extension authors.
+export const addKitTools = (group, actions) => {
+    addUp(group, actions.up);
+    addDown(group, actions.down);
+    addToken(group, actions.token);
+};

package/dist/commands/status/account-status.d.ts

@@ -0,0 +1,3 @@
+import { type Account } from '../../core/profile/cloud.js';
+import { type ExtensionsGather } from '../extension/rows.js';
+export declare const gatherWithAccount: (account: Account | null) => Promise<ExtensionsGather>;

package/dist/commands/status/account-status.js

@@ -0,0 +1,27 @@
+import { pullProfile } from '../../core/profile/cloud.js';
+import { seenMachine } from '../../core/profile/register.js';
+import { gatherExtensions } from '../extension/rows.js';
+const STATUS_TIMEOUT_MS = 2_000;
+// The account's profile when it moved past the local copy; null when the same or not known.
+const accountProfile = async (fetch, profile) => {
+    if (profile.state !== 'ok' || profile.etag === null)
+        return null;
+    const pulled = await pullProfile(fetch, profile.etag, STATUS_TIMEOUT_MS);
+    if (pulled.kind !== 'found')
+        return null;
+    return { version: pulled.doc.profile.version, etag: pulled.doc.etag };
+};
+// `status`: marks this machine seen (does the account know it?) and compares the profile copies.
+export const gatherWithAccount = async (account) => {
+    const gathered = await gatherExtensions();
+    const { machine, profile } = gathered.status;
+    const [registered, cloud] = account === null
+        ? [null, null]
+        : await Promise.all([
+            seenMachine(account.fetch, machine.id),
+            accountProfile(account.fetch, profile),
+        ]);
+    const compared = cloud !== null && profile.state === 'ok' ? { ...profile, cloud } : profile;
+    const status = { ...gathered.status, machine: { ...machine, registered }, profile: compared };
+    return { ...gathered, status };
+};

package/dist/commands/status/status.d.ts

@@ -1,6 +1,6 @@
 import { type Command } from 'commander';
 import { type StatusReport } from '../../lib/status/status-info.js';
-import { type PluginsGather } from '../plugins/status-rows.js';
+import { type ExtensionsGather } from '../extension/rows.js';
 export declare const printStatus: (report: StatusReport) => void;
 export interface StatusOptions {
     json?: boolean;
@@ -8,7 +8,8 @@ export interface StatusOptions {
 }
 export interface StatusDeps {
     gather: (opts: StatusOptions) => Promise<StatusReport>;
-    plugins: () => Promise<PluginsGather | null>;
+    extensions: (opts: StatusOptions) => Promise<ExtensionsGather>;
 }
+export declare const statusDeps: (account?: boolean) => StatusDeps;
 export declare const runStatus: (opts?: StatusOptions, deps?: StatusDeps) => Promise<void>;
 export declare const registerStatus: (program: Command, action: (opts: StatusOptions) => Promise<void>) => void;

package/dist/commands/status/status.js

@@ -1,12 +1,13 @@
 import chalk from 'chalk';
 import {} from 'commander';
-import { pluginsEnabled } from '../../core/flag.js';
 import { resolveAuth } from '../../lib/auth/credentials.js';
 import { siteFqdn } from '../../lib/net/origins.js';
 import { gatherStatus } from '../../lib/status/status-info.js';
 import { INSTALL_HINT } from '../../lib/update/update-check.js';
-import { pluginStatusLines } from '../plugins/status-print.js';
-import { gatherPluginStatus } from '../plugins/status-rows.js';
+import { signedInAccount } from '../extension/account.js';
+import { printWarnings, summaryLines } from '../extension/row-lines.js';
+import { gatherExtensions, invalidProfileError } from '../extension/rows.js';
+import { gatherWithAccount } from './account-status.js';
 const mark = (good) => (good ? chalk.green('✓') : chalk.red('✗'));
 const row = (label, value) => {
     console.log(`${label.padEnd(10)} ${value}`);
@@ -50,60 +51,59 @@ export const printStatus = (report) => {
     if (report.update.message)
         console.log(chalk.yellow(`\n${report.update.message}`));
 };
-const defaultDeps = {
+// `account` false: the report that closes setup, which reached the account already.
+export const statusDeps = (account = true) => ({
     gather: (opts) => gatherStatus(resolveAuth({ token: opts.token }), siteFqdn()),
-    plugins: () => (pluginsEnabled() ? gatherPluginStatus() : Promise.resolve(null)),
-};
-const settle = async (deps) => {
+    extensions: (opts) => account ? gatherWithAccount(signedInAccount({ token: opts.token })) : gatherExtensions(),
+});
+const settle = async (deps, opts) => {
     try {
-        return { gathered: await deps.plugins(), error: null };
+        return { gathered: await deps.extensions(opts), error: null };
     }
     catch (error) {
         return { gathered: null, error };
     }
 };
+// `--json` adds machine, profile, the extension count and the plan after the report's own keys;
+// when the extension side failed, the report alone.
+const jsonOf = (report, gathered) => {
+    if (!gathered)
+        return report;
+    const { machine, profile, extensions, plan } = gathered.status;
+    return { ...report, machine, profile, extensions: extensions.length, plan };
+};
 const emit = (report, gathered, json) => {
-    if (json) {
-        console.log(JSON.stringify(gathered ? { ...report, ...gathered.status } : report, null, 2));
-        return;
-    }
+    if (json)
+        return console.log(JSON.stringify(jsonOf(report, gathered), null, 2));
     printStatus(report);
-    for (const text of gathered ? pluginStatusLines(gathered.status) : [])
+    for (const text of gathered ? summaryLines(gathered.status) : [])
         console.log(text);
 };
-const profileFailure = (gathered) => {
-    const profile = gathered?.status.profile;
-    if (profile?.state !== 'invalid')
-        return null;
-    return new Error(`profile.json is invalid:\n${profile.errors.map((e) => `  ${e}`).join('\n')}`);
-};
-// The report always prints; a plugin-side failure then fails the step (exit 1) on stderr.
-export const runStatus = async (opts = {}, deps = defaultDeps) => {
+// The report always prints; an extension-side failure then fails the step (exit 1) on stderr.
+export const runStatus = async (opts = {}, deps = statusDeps()) => {
     const report = await deps.gather(opts);
-    const { gathered, error } = await settle(deps);
+    const { gathered, error } = await settle(deps, opts);
     emit(report, gathered, opts.json);
-    for (const warning of gathered?.warnings ?? [])
-        console.error(chalk.yellow(`warning: ${warning}`));
+    printWarnings(gathered?.warnings ?? []);
     if (error)
         throw error;
-    const failure = profileFailure(gathered);
+    const failure = gathered && invalidProfileError(gathered.status.profile);
     if (failure)
         throw failure;
 };
-const PLUGINS_HELP = `
-Plugins: one row per plugin in the profile or a dev path: id, state (installed, off,
-blocked, invalid, missing), package, installed version, wanted range, contributed commands,
-the last run from state/<id>.json, and the reason when it cannot load. Plugin code is never
-loaded; the only file written is machine.json.`;
+const EXTENSIONS_HELP = `
+Extensions: adds this machine's id and name (machine.json), the local profile version
+(profile.json) with its source and, for a profile from your account, its etag and the
+account's when that moved on, and the number of extensions, with what setup would change, e.g.
+(1 to add); agentage extension list shows one row per extension. Signed in, it also marks this
+machine seen in your account (--json: machine.registered). Extension code is never loaded; the
+only file written is machine.json.`;
 export const registerStatus = (program, action) => {
-    const command = program
+    program
         .command('status')
-        .description(pluginsEnabled()
-        ? 'Show CLI, account, endpoint, machine, profile, and plugin status'
-        : 'Show CLI, account, and endpoint status')
+        .description('Show CLI, account, endpoint, machine, profile, and extension status')
         .option('--json', 'machine-readable output')
         .option('--token <token>', 'authenticate with a personal access token (aga_...); or set AGENTAGE_TOKEN')
+        .addHelpText('after', EXTENSIONS_HELP)
         .action(action);
-    if (pluginsEnabled())
-        command.addHelpText('after', PLUGINS_HELP);
 };

package/dist/core/installer/compare-lock.d.ts

@@ -0,0 +1,8 @@
+type Doc = Record<string, unknown>;
+export declare const parseLock: (raw: string | null) => Doc | null;
+export declare const lockEntries: (lock: Doc) => string[];
+export declare const rootDependencies: (lock: Doc) => Record<string, string>;
+export declare const lockedVersion: (lock: Doc | null, name: string) => string | null;
+export declare const lockAgrees: (lock: Doc, dependencies: Record<string, string>) => boolean;
+export declare const integrityDrift: (a: Doc, b: Doc) => string[];
+export {};