@aident-ai/cli 0.0.6 → 0.0.7-rc.0

package/README.md

@@ -1,119 +1,93 @@
 # @aident-ai/cli
 
-The Aident command-line interface — agent-friendly access to 1000+ integrations, automation playbooks, and the full Aident platform.
+Agent-friendly access to Aident Loadout by default, with Playbook and Intern available as packages.
 
 ```bash
 aident login
 aident capabilities search --query "send email"
+aident packages add playbook
 aident playbooks list --json
 ```
 
-This is the recommended way to use Aident from any coding agent (Claude Code, OpenClaw, HermesAgent, Cursor, …) or shell automation. The CLI is a thin wrapper around the Aident command engine — every command you run on the platform UI is available here, with the same semantics.
+The CLI is the only npm CLI package Aident ships. It is a thin wrapper around the public OpenAPI package APIs under
+`/api/openapi/...`, so CLI behavior stays aligned with API and MCP behavior.
 
 ## Install
 
-### One-line install (recommended)
-
-**macOS / Linux:**
-
-```bash
-curl -fsSL https://app.aident.ai/cli/install.sh | bash
-```
-
-**Windows (PowerShell, with Git Bash installed):**
-
-```powershell
-& "C:\Program Files\Git\bin\bash.exe" -c 'curl -fsSL https://app.aident.ai/cli/install.sh | bash'
-```
-
-The installer requires Node ≥ 18. If you don't have it, install via [nodejs.org](https://nodejs.org) or a version manager (`brew install node`, `nvm install --lts`, `fnm install --lts`) and re-run.
-
-### Manual install
-
 ```bash
-# One-off (no install)
 npx -y @aident-ai/cli <command>
-
-# Global
 npm install -g @aident-ai/cli
 ```
 
-## Get started
+## Get Started
 
 ```bash
-aident setup           # interactive: pick base URL + log in
-aident doctor          # validate installation
-aident --help          # discover packages and domains
+aident setup
+aident doctor
+aident --help
 ```
 
-The browser-based sign-in uses PKCE on a localhost loopback. If you can't bind a port (locked-down sandboxes, remote shells), pass `--oob`:
+Use `--oob` for browserless auth environments:
 
 ```bash
 aident login --oob
 ```
 
-That falls back to the OOB copy-paste flow.
+## Packages
 
-## Common commands
+Loadout is always enabled by default. Add Playbook only when an agent needs to create, execute, or manage playbooks.
+Intern is admin-gated and should be used only by authenticated admin users.
 
 ```bash
-aident capabilities --help                             # list commands in a domain
-aident capabilities search --help                      # show input schema and examples
-aident capabilities search --query "send email"        # run a command (TUI output)
-aident playbooks list --json                           # JSON output for piping
-aident playbooks execute --playbookId pb_123           # run a playbook
-aident integrations status                             # see connected integrations
-aident logout                                          # revoke and clear creds
+aident --help
+aident packages add playbook
+aident packages list
+aident --package playbook playbooks list --json
+aident --packages playbook playbooks execute --playbookId pb_123 --json
 ```
 
-Use `--json` for machine-readable output. The CLI auto-detects whether stdout is a TTY.
-
-## Configuration
-
-The CLI persists settings to `~/.aident/config.json` and credentials to `~/.aident/credentials.json` — the same `~/.aident/` directory used by the Aident skill, the desktop sandbox app, and any other Aident tooling.
+## Common Loadout Commands
 
 ```bash
-aident config show                       # print all config
-aident config get baseUrl                # print one value
-aident config set baseUrl https://...    # persist a value
-aident config unset baseUrl              # remove an override
-aident config path                       # print the config file path
+aident capabilities search --query "send email"
+aident capabilities get --name "gmail.send_email"
+aident capabilities execute --name "gmail.send_email" --input '{"to":"user@example.com"}'
+aident vault status --integrationId github_tools
+aident audit recent --limit 20
 ```
 
-| Key       | Default                 | Purpose                                                    |
-| --------- | ----------------------- | ---------------------------------------------------------- |
-| `baseUrl` | `https://app.aident.ai` | API host used for new logins. Save once, reuse everywhere. |
-
-### Resolution order for the API base URL
+## Configuration
 
-1. `AIDENT_BASE_URL` env var (per-invocation override)
-2. `aident login --base-url <url>` (only at login time)
-3. `~/.aident/config.json` `baseUrl`
-4. Active credentials file (after login carries its own host)
-5. Default `https://app.aident.ai`
+Settings live in `~/.aident/config.json`; OAuth credentials live in `~/.aident/credentials.json`.
 
-### Environment overrides
+| Key        | Default                 | Purpose                                               |
+| ---------- | ----------------------- | ----------------------------------------------------- |
+| `baseUrl`  | `https://app.aident.ai` | API host used for logins and command execution.       |
+| `packages` | `["loadout"]`           | Enabled packages. Loadout is always included locally. |
 
-| Variable          | Purpose                                                                   |
-| ----------------- | ------------------------------------------------------------------------- |
-| `AIDENT_TOKEN`    | Use this Bearer token directly; skips the credentials file. Useful in CI. |
-| `AIDENT_BASE_URL` | Override the default server for a single invocation.                      |
+```bash
+aident config show
+aident config set baseUrl https://app.aident.ai
+aident config set packages playbook
+aident config unset packages
+```
 
-## Where files live
+Environment overrides:
 
-| Path                                 | Owner               | Purpose                                      |
-| ------------------------------------ | ------------------- | -------------------------------------------- |
-| `~/.aident/config.json`              | CLI (this package)  | Persistent settings (`baseUrl`, …)           |
-| `~/.aident/credentials.json`         | CLI + Aident skill  | OAuth tokens for `aident` / agent skill REST |
-| `~/.aident/sandbox-credentials.json` | Sandbox desktop app | Tokens used by the local sandbox runtime     |
-| `~/.aident/sandbox-workspaces.json`  | Sandbox desktop app | Tracked workspace directories                |
-| `~/.aident/sandbox/`                 | Sandbox daemon      | Daemon PID, status, logs                     |
+| Variable          | Purpose                                                     |
+| ----------------- | ----------------------------------------------------------- |
+| `AIDENT_TOKEN`    | Use this Bearer token directly; skips the credentials file. |
+| `AIDENT_BASE_URL` | Override the API host for one invocation.                   |
+| `AIDENT_PACKAGE`  | Focus one package for one invocation.                       |
+| `AIDENT_PACKAGES` | Enable add-on packages for one invocation, e.g. `playbook`. |
 
-All Aident tooling shares this directory; nothing escapes outside `~/.aident/`.
+## How It Works
 
-## How it works
+Discovery fetches `/api/openapi/{package}.json` and reads the package command catalog embedded in the OpenAPI document.
+Execution calls `/api/openapi/{package}/{operationId}` with the command arguments as JSON.
 
-`aident <domain> <command> [args]` makes a `POST /api/cli/exec` request to the Aident server with `{ domain, command, args }`, the same shape used internally by the platform's CLI engine. Discovery (`--help`, schemas, examples) comes from `GET /api/cli`. The CLI is a thin layer — there is no Aident logic baked in. Anything you can do on the web app, you can do here.
+When multiple packages are enabled, the CLI fetches each package schema, merges the catalogs locally, and routes each
+command back to the package operation that contributed it. Unknown commands are not guessed across packages.
 
 ## License
 

package/dist/cli.mjs

@@ -5,100 +5,6 @@ import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 
-// src/credentials.ts
-import { mkdir as mkdir2, readFile as readFile2, rm, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join2 } from "node:path";
-
-// src/config.ts
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { join } from "node:path";
-function getAidentDir() {
-  const home = process.env.HOME || process.env.USERPROFILE || homedir();
-  return join(home, ".aident");
-}
-function getConfigFile() {
-  return join(getAidentDir(), "config.json");
-}
-var DEFAULT_BASE_URL = "https://app.aident.ai";
-var CONFIG_KEYS = ["baseUrl"];
-async function readConfig() {
-  try {
-    const text = await readFile(getConfigFile(), "utf-8");
-    const parsed = JSON.parse(text);
-    if (!parsed || typeof parsed !== "object")
-      return {};
-    return parsed;
-  } catch {
-    return {};
-  }
-}
-async function writeConfig(config) {
-  await mkdir(getAidentDir(), { recursive: true, mode: 448 });
-  await writeFile(getConfigFile(), JSON.stringify(config, null, 2) + `
-`, { mode: 420 });
-}
-async function setConfigValue(key, value) {
-  const config = await readConfig();
-  config[key] = value;
-  await writeConfig(config);
-}
-async function unsetConfigValue(key) {
-  const config = await readConfig();
-  delete config[key];
-  await writeConfig(config);
-}
-async function resolveDefaultBaseUrl() {
-  const env = process.env.AIDENT_BASE_URL?.trim();
-  if (env)
-    return env;
-  const config = await readConfig();
-  if (typeof config.baseUrl === "string" && config.baseUrl.trim() !== "") {
-    return config.baseUrl.trim();
-  }
-  return DEFAULT_BASE_URL;
-}
-function isKnownConfigKey(key) {
-  return CONFIG_KEYS.includes(key);
-}
-function normalizeBaseUrl(url) {
-  let trimmed = url.trim();
-  if (!/^https?:\/\//i.test(trimmed))
-    trimmed = `https://${trimmed}`;
-  return trimmed.replace(/\/+$/, "");
-}
-
-// src/credentials.ts
-function getCredentialsFile() {
-  return join2(getAidentDir(), "credentials.json");
-}
-async function readCredentials() {
-  try {
-    const content = await readFile2(getCredentialsFile(), "utf-8");
-    const parsed = JSON.parse(content);
-    if (!parsed.access_token || !parsed.base_url)
-      return null;
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-async function writeCredentials(creds) {
-  await mkdir2(getAidentDir(), { recursive: true, mode: 448 });
-  await writeFile2(getCredentialsFile(), JSON.stringify(creds, null, 2), { mode: 384 });
-}
-async function clearCredentials() {
-  await rm(getCredentialsFile(), { force: true });
-}
-function isExpired(creds) {
-  if (!creds.expires_at)
-    return false;
-  const expiresAt = Date.parse(creds.expires_at);
-  if (Number.isNaN(expiresAt))
-    return false;
-  return Date.now() >= expiresAt - 60000;
-}
-
 // src/output.ts
 var isTTY = process.stdout.isTTY === true;
 var colors = {
@@ -218,7 +124,7 @@ async function loginOob(baseUrl) {
   const verifier = base64UrlEncode(randomBytes(48));
   const challenge = base64UrlEncode(createHash("sha256").update(verifier).digest());
   const state = base64UrlEncode(randomBytes(16));
-  const clientId = await reuseOrRegisterClient(baseUrl, [redirectUri]);
+  const clientId = await registerClient(baseUrl, [redirectUri]);
   const authorizeUrl = new URL(`${baseUrl}/api/mcp/oauth/authorize`);
   authorizeUrl.searchParams.set("response_type", "code");
   authorizeUrl.searchParams.set("client_id", clientId);
@@ -255,12 +161,6 @@ function looksLikeAccessToken(value) {
     return false;
   return /^[A-Za-z0-9._-]+$/.test(value);
 }
-async function reuseOrRegisterClient(baseUrl, redirectUris) {
-  const existing = await readCredentials();
-  if (existing && existing.client_id && existing.base_url === baseUrl)
-    return existing.client_id;
-  return registerClient(baseUrl, redirectUris);
-}
 async function registerClient(baseUrl, redirectUris) {
   const res = await fetch(`${baseUrl}/api/mcp/oauth/register`, {
     method: "POST",
@@ -402,25 +302,91 @@ function escapeHtml(s) {
 }
 
 // src/version.ts
-var VERSION = "0.0.6";
+var VERSION = "0.0.7-rc.0";
 
 // src/client.ts
 class CliClient {
   creds;
-  constructor(creds) {
+  credentialSource;
+  packages;
+  commandOperations = new Map;
+  constructor(creds, credentialSource = "stored", packages) {
     this.creds = creds;
+    this.credentialSource = credentialSource;
+    if (packages.length === 0)
+      throw new Error("CliClient packages must not be empty");
+    this.packages = [...packages];
   }
   get baseUrl() {
     return this.creds.base_url.replace(/\/+$/, "");
   }
+  get canRefresh() {
+    return this.credentialSource === "stored";
+  }
+  get activePackages() {
+    return this.packages;
+  }
   updateCredentials(creds) {
     this.creds = creds;
   }
   async getCatalog() {
-    return this.fetchJson("GET", "/api/cli");
+    if (this.packages.length === 1) {
+      const packageName = this.packages[0];
+      const result = await this.fetchOpenApiCatalog(packageName);
+      if (result.status === 200)
+        this.indexCatalogCommands(result.body, packageName);
+      return result;
+    }
+    const results = await Promise.all(this.packages.map((packageName) => this.fetchOpenApiCatalog(packageName)));
+    const failed = results.find((result) => result.status !== 200);
+    if (failed)
+      return failed;
+    const catalog = mergeCatalogs(results.map((result) => result.body), this.packages, (domain, command, packageName, operationId) => this.commandOperations.set(commandKey(domain, command), { packageName, operationId }));
+    return { status: 200, body: catalog };
   }
   async exec(domain, command, args) {
-    return this.fetchJson("POST", "/api/cli/exec", { domain, command, args });
+    const operation = this.resolveOperation(domain, command);
+    if (operation === null) {
+      return {
+        status: 404,
+        body: {
+          success: false,
+          error: {
+            code: "unknown-command",
+            message: `Unknown command: ${domain} ${command}. Run \`aident --help\` to refresh the command catalog.`
+          }
+        }
+      };
+    }
+    return this.fetchJson("POST", this.operationPath(operation.packageName, operation.operationId), args);
+  }
+  async fetchOpenApiCatalog(packageName) {
+    const result = await this.fetchJson("GET", this.catalogPath(packageName));
+    const catalog = result.body["x-aident-command-catalog"];
+    if (result.status !== 200 || !catalog) {
+      return {
+        status: result.status,
+        body: invalidResponseFallback(JSON.stringify(result.body))
+      };
+    }
+    return { status: result.status, body: catalog };
+  }
+  catalogPath(packageName) {
+    return `/api/openapi/${encodeURIComponent(packageName)}.json`;
+  }
+  operationPath(packageName, operationId) {
+    return `/api/openapi/${encodeURIComponent(packageName)}/${encodeURIComponent(operationId)}`;
+  }
+  resolveOperation(domain, command) {
+    return this.commandOperations.get(commandKey(domain, command)) ?? null;
+  }
+  indexCatalogCommands(catalog, packageName) {
+    for (const command of catalog.commands) {
+      this.commandOperations.set(commandKey(command.domain, command.command), {
+        packageName,
+        operationId: command.operationId
+      });
+    }
   }
   async fetchJson(method, path, body) {
     const headers = {
@@ -445,6 +411,170 @@ class CliClient {
 function invalidResponseFallback(text) {
   return { success: false, error: { code: "invalid-response", message: text } };
 }
+function commandKey(domain, command) {
+  return `${domain}\x00${command}`;
+}
+function mergeCatalogs(catalogs, packages, onCommand) {
+  const packageMap = new Map;
+  const domainMap = new Map;
+  const commandMap = new Map;
+  catalogs.forEach((catalog, index) => {
+    const packageName = packages[index];
+    for (const pkg of catalog.packages) {
+      packageMap.set(pkg.name, {
+        ...pkg,
+        domainCount: (packageMap.get(pkg.name)?.domainCount ?? 0) + pkg.domainCount
+      });
+    }
+    for (const domain of catalog.domains) {
+      const existing = domainMap.get(domain.name);
+      domainMap.set(domain.name, {
+        ...domain,
+        commandCount: (existing?.commandCount ?? 0) + domain.commandCount
+      });
+    }
+    for (const command of catalog.commands) {
+      const key = commandKey(command.domain, command.command);
+      if (!commandMap.has(key)) {
+        commandMap.set(key, command);
+        onCommand(command.domain, command.command, packageName, command.operationId);
+      }
+    }
+  });
+  return {
+    packages: [...packageMap.values()],
+    domains: [...domainMap.values()],
+    commands: [...commandMap.values()]
+  };
+}
+
+// src/config.ts
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// src/packages.ts
+var CLI_PACKAGES = ["loadout", "playbook", "intern"];
+var DEFAULT_CLI_PACKAGES = ["loadout"];
+function parseCliPackage(value) {
+  if (typeof value !== "string")
+    throw new Error(`Unsupported Aident package: ${String(value)}`);
+  const normalized = value.trim().toLowerCase();
+  if (!CLI_PACKAGES.includes(normalized))
+    throw new Error(`Unsupported Aident package: ${value}`);
+  return normalized;
+}
+function normalizeCliPackages(value) {
+  const rawPackages = value === undefined || value === null || value === "" ? [] : Array.isArray(value) ? value : String(value).split(/[,\s]+/);
+  const packages = ["loadout"];
+  for (const rawPackage of rawPackages) {
+    if (rawPackage === undefined || rawPackage === null || rawPackage === "")
+      continue;
+    const cliPackage = parseCliPackage(rawPackage);
+    if (!packages.includes(cliPackage))
+      packages.push(cliPackage);
+  }
+  return packages;
+}
+function formatCliPackages(packages) {
+  return packages.join(",");
+}
+
+// src/config.ts
+function getAidentDir() {
+  const home = process.env.HOME || process.env.USERPROFILE || homedir();
+  return join(home, ".aident");
+}
+function getConfigFile() {
+  return join(getAidentDir(), "config.json");
+}
+var DEFAULT_BASE_URL = "https://app.aident.ai";
+var CONFIG_KEYS = ["baseUrl", "packages"];
+async function readConfig() {
+  try {
+    const text = await readFile(getConfigFile(), "utf-8");
+    const parsed = JSON.parse(text);
+    if (!parsed || typeof parsed !== "object")
+      return {};
+    return parsed;
+  } catch {
+    return {};
+  }
+}
+async function writeConfig(config) {
+  await mkdir(getAidentDir(), { recursive: true, mode: 448 });
+  await writeFile(getConfigFile(), JSON.stringify(config, null, 2) + `
+`, { mode: 420 });
+}
+async function setConfigValue(key, value) {
+  const config = await readConfig();
+  config[key] = value;
+  await writeConfig(config);
+}
+async function unsetConfigValue(key) {
+  const config = await readConfig();
+  delete config[key];
+  await writeConfig(config);
+}
+async function resolveDefaultBaseUrl() {
+  const env = process.env.AIDENT_BASE_URL?.trim();
+  if (env)
+    return env;
+  const config = await readConfig();
+  if (typeof config.baseUrl === "string" && config.baseUrl.trim() !== "") {
+    return config.baseUrl.trim();
+  }
+  return DEFAULT_BASE_URL;
+}
+async function resolveDefaultPackages() {
+  const env = process.env.AIDENT_PACKAGES?.trim() || process.env.AIDENT_PACKAGE?.trim();
+  if (env)
+    return normalizeCliPackages(env);
+  const config = await readConfig();
+  return normalizeCliPackages(config.packages ?? DEFAULT_CLI_PACKAGES);
+}
+function isKnownConfigKey(key) {
+  return CONFIG_KEYS.includes(key);
+}
+function normalizeBaseUrl(url) {
+  let trimmed = url.trim();
+  if (!/^https?:\/\//i.test(trimmed))
+    trimmed = `https://${trimmed}`;
+  return trimmed.replace(/\/+$/, "");
+}
+
+// src/credentials.ts
+import { mkdir as mkdir2, readFile as readFile2, rm, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join2 } from "node:path";
+function getCredentialsFile() {
+  return join2(getAidentDir(), "credentials.json");
+}
+async function readCredentials() {
+  try {
+    const content = await readFile2(getCredentialsFile(), "utf-8");
+    const parsed = JSON.parse(content);
+    if (!parsed.access_token || !parsed.base_url)
+      return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+async function writeCredentials(creds) {
+  await mkdir2(getAidentDir(), { recursive: true, mode: 448 });
+  await writeFile2(getCredentialsFile(), JSON.stringify(creds, null, 2), { mode: 384 });
+}
+async function clearCredentials() {
+  await rm(getCredentialsFile(), { force: true });
+}
+function isExpired(creds) {
+  if (!creds.expires_at)
+    return false;
+  const expiresAt = Date.parse(creds.expires_at);
+  if (Number.isNaN(expiresAt))
+    return false;
+  return Date.now() >= expiresAt - 60000;
+}
 
 // src/doctor.ts
 async function runDoctor(opts) {
@@ -494,7 +624,7 @@ async function checkCredentials(baseUrl) {
 }
 async function checkServerReachable(baseUrl) {
   try {
-    const res = await fetch(`${baseUrl}/api/cli`, {
+    const res = await fetch(`${baseUrl}/api/openapi/loadout.json`, {
       method: "GET",
       headers: { "User-Agent": `@aident-ai/cli/${VERSION}` }
     });
@@ -533,7 +663,7 @@ function renderHelp(catalog) {
   lines.push("  aident <domain> <command> help    Show input schema and examples");
   lines.push("");
   if (catalog.packages.length > 0) {
-    lines.push("PACKAGES:");
+    lines.push("COMMAND GROUPS:");
     for (const pkg of catalog.packages) {
       lines.push(`  ${pkg.name.padEnd(10)} ${pkg.description}`);
     }
@@ -612,7 +742,7 @@ function renderCommandHelp(catalog, domain, command) {
 }
 
 // src/parser.ts
-var RESERVED_CLI_FLAGS = ["base-url", "json", "tui", "help", "oob", "version"];
+var RESERVED_CLI_FLAGS = ["base-url", "json", "tui", "help", "oob", "version", "package", "packages"];
 function parseArgs(argv) {
   const positional = [];
   const flags = {};
@@ -694,7 +824,7 @@ function coerceArgsToSchema(args, schema) {
       } else {
         out[key] = [value];
       }
-    } else if (types.includes("string") && !types.includes("number") && typeof value === "number") {
+    } else if (types.includes("string") && !types.includes("number") && !types.includes("boolean") && (typeof value === "number" || typeof value === "boolean")) {
       out[key] = String(value);
     }
   }
@@ -740,6 +870,8 @@ async function callWithRefresh(client, call, deps = defaultDeps) {
   }
   if (first.status !== 401)
     return first;
+  if (!client.canRefresh)
+    return first;
   const creds = await deps.readCredentials();
   if (!creds)
     return first;
@@ -769,7 +901,7 @@ async function main() {
     return;
   }
   if (!first || parsed.isHelp && parsed.positional.length === 0) {
-    await runHelp(parsed.format);
+    await runHelp(parsed);
     return;
   }
   switch (first) {
@@ -780,7 +912,7 @@ async function main() {
       await runLogout();
       return;
     case "whoami":
-      await runWhoami(parsed.format);
+      await runWhoami(parsed);
       return;
     case "doctor":
       await runDoctorCmd(parsed.format);
@@ -791,17 +923,21 @@ async function main() {
     case "config":
       await runConfigCmd(parsed);
       return;
+    case "packages":
+    case "package":
+      await runPackagesCmd(parsed);
+      return;
     case "catalog":
-      await runCatalog(parsed.format);
+      await runCatalog(parsed);
       return;
     default:
       await runCommand(parsed);
   }
 }
-async function runHelp(format) {
-  const client = await getAuthenticatedClient();
+async function runHelp(parsed) {
+  const client = await getAuthenticatedClient(await getRequestedPackages(parsed));
   if (!client) {
-    if (format === "json") {
+    if (parsed.format === "json") {
       logInfo(JSON.stringify({ error: "not-authenticated", message: "Run `aident login` first." }));
     } else {
       logInfo(`${colors.bold}Aident CLI v${VERSION}${colors.reset}`);
@@ -815,6 +951,7 @@ async function runHelp(format) {
       logInfo("  aident config show                        Print persistent config");
       logInfo("  aident config set <key> <value>           Persist a config value");
       logInfo("  aident config get <key>                   Read a single value");
+      logInfo("  aident packages add <playbook|intern>     Enable an add-on package");
       logInfo("  aident doctor                             Validate installation");
       logInfo("  aident setup                              Interactive setup wizard");
       logInfo("  aident <domain> <command> [--flag value ...] [--json]");
@@ -824,7 +961,7 @@ async function runHelp(format) {
   const catalog = await fetchCatalog(client);
   if (!catalog)
     return;
-  if (format === "json") {
+  if (parsed.format === "json") {
     logInfo(JSON.stringify(catalog));
   } else {
     logInfo(renderHelp(catalog));
@@ -850,10 +987,10 @@ async function runLogout() {
   await clearCredentials();
   logInfo(`${colors.green}Signed out.${colors.reset}`);
 }
-async function runWhoami(format) {
-  const client = await getAuthenticatedClient();
+async function runWhoami(parsed) {
+  const client = await getAuthenticatedClient(["loadout"]);
   if (!client) {
-    if (format === "json") {
+    if (parsed.format === "json") {
       logInfo(JSON.stringify({ authenticated: false }));
     } else {
       logInfo("Not signed in. Run `aident login`.");
@@ -861,8 +998,11 @@ async function runWhoami(format) {
     process.exitCode = 1;
     return;
   }
+  const catalog = await fetchCatalog(client);
+  if (!catalog)
+    return;
   const result = await callWithRefresh(client, (c) => c.exec("account", "auth status", {}));
-  if (format === "json") {
+  if (parsed.format === "json") {
     logInfo(JSON.stringify(result.body));
     if (!result.body.success)
       process.exitCode = 1;
@@ -874,7 +1014,7 @@ async function runWhoami(format) {
     return;
   }
   const err = result.body.error;
-  logErr(`${colors.red}✗ ${err?.code ?? "error"}:${colors.reset} ${err?.message ?? "Unable to fetch user info."}`);
+  logErr(`${colors.red}x ${err?.code ?? "error"}:${colors.reset} ${err?.message ?? "Unable to fetch user info."}`);
   process.exitCode = 1;
 }
 async function runConfigCmd(parsed) {
@@ -887,8 +1027,9 @@ async function runConfigCmd(parsed) {
     }
     logInfo(`${colors.bold}Aident config${colors.reset}  ${colors.dim}(${getConfigFile()})${colors.reset}`);
     if (Object.keys(config).length === 0) {
-      logInfo(`  ${colors.dim}(empty — using defaults)${colors.reset}`);
+      logInfo(`  ${colors.dim}(empty, using defaults)${colors.reset}`);
       logInfo(`  ${colors.dim}baseUrl${colors.reset}        ${colors.dim}default: ${DEFAULT_BASE_URL}${colors.reset}`);
+      logInfo(`  ${colors.dim}packages${colors.reset}       ${colors.dim}default: loadout${colors.reset}`);
       return;
     }
     for (const [key, val] of Object.entries(config)) {
@@ -934,14 +1075,18 @@ async function runConfigCmd(parsed) {
       process.exitCode = 1;
       return;
     }
-    const value = key === "baseUrl" ? normalizeBaseUrl(rawValue) : rawValue;
-    await setConfigValue(key, value);
-    logInfo(`${colors.green}Set${colors.reset} ${key} = ${value}`);
     if (key === "baseUrl") {
+      const value = normalizeBaseUrl(rawValue);
+      await setConfigValue(key, value);
+      logInfo(`${colors.green}Set${colors.reset} ${key} = ${value}`);
       const creds = await readCredentials();
       if (creds && creds.base_url !== value) {
         logInfo(`${colors.yellow}Note:${colors.reset} existing credentials are for ${creds.base_url}. Run \`aident login\` to authenticate against ${value}.`);
       }
+    } else {
+      const value = normalizeCliPackages(rawValue);
+      await setConfigValue(key, value);
+      logInfo(`${colors.green}Set${colors.reset} ${key} = ${formatConfigValue(value)}`);
     }
     return;
   }
@@ -960,6 +1105,54 @@ async function runConfigCmd(parsed) {
   logErr("Usage: aident config [show | get <key> | set <key> <value> | unset <key> | path]");
   process.exitCode = 1;
 }
+async function runPackagesCmd(parsed) {
+  const sub = parsed.positional[1] ?? "list";
+  if (sub === "list" || sub === "show") {
+    const packages = await resolveDefaultPackages();
+    if (parsed.format === "json") {
+      logInfo(JSON.stringify({ packages, defaultPackage: "loadout" }));
+    } else {
+      logInfo(`${colors.bold}Aident packages${colors.reset}`);
+      logInfo(`  ${formatCliPackages(packages)}`);
+      logInfo("");
+      logInfo(`Loadout is always enabled. Add-ons: ${CLI_PACKAGES.filter((p) => p !== "loadout").join(", ")}`);
+    }
+    return;
+  }
+  if (sub === "add" || sub === "enable") {
+    const packageName = parsed.positional[2];
+    if (!packageName) {
+      logErr("Usage: aident packages add <playbook|intern>");
+      process.exitCode = 1;
+      return;
+    }
+    const packages = normalizeCliPackages([...await readConfiguredPackages(), parseCliPackage(packageName)]);
+    await setConfigValue("packages", packages);
+    logInfo(`${colors.green}Enabled packages:${colors.reset} ${formatCliPackages(packages)}`);
+    return;
+  }
+  if (sub === "remove" || sub === "disable") {
+    const packageName = parsed.positional[2];
+    if (!packageName) {
+      logErr("Usage: aident packages remove <playbook|intern>");
+      process.exitCode = 1;
+      return;
+    }
+    const target = parseCliPackage(packageName);
+    if (target === "loadout") {
+      logErr("Loadout is the default package and cannot be removed.");
+      process.exitCode = 1;
+      return;
+    }
+    const packages = normalizeCliPackages((await readConfiguredPackages()).filter((p) => p !== target));
+    await setConfigValue("packages", packages);
+    logInfo(`${colors.green}Enabled packages:${colors.reset} ${formatCliPackages(packages)}`);
+    return;
+  }
+  logErr(`Unknown packages subcommand: ${sub}`);
+  logErr("Usage: aident packages [list | add <playbook|intern> | remove <playbook|intern>]");
+  process.exitCode = 1;
+}
 async function runDoctorCmd(format) {
   const baseUrl = await resolveDefaultBaseUrl();
   const report = await runDoctor({ baseUrl, configFile: getConfigFile(), credentialsFile: getCredentialsFile() });
@@ -972,7 +1165,7 @@ async function runDoctorCmd(format) {
   logInfo(`${colors.bold}Aident CLI doctor${colors.reset}`);
   logInfo("");
   for (const c of report.checks) {
-    const mark = c.ok ? `${colors.green}✓${colors.reset}` : `${colors.red}✗${colors.reset}`;
+    const mark = c.ok ? `${colors.green}ok${colors.reset}` : `${colors.red}x${colors.reset}`;
     logInfo(`  ${mark} ${c.name.padEnd(22)} ${colors.dim}${c.detail}${colors.reset}`);
   }
   logInfo("");
@@ -1009,8 +1202,8 @@ async function runSetup() {
   logInfo("");
   logInfo(`Done. Try ${colors.cyan}aident --help${colors.reset} or ${colors.cyan}aident doctor${colors.reset}.`);
 }
-async function runCatalog(format) {
-  const client = await getAuthenticatedClient();
+async function runCatalog(parsed) {
+  const client = await getAuthenticatedClient(await getRequestedPackages(parsed));
   if (!client) {
     process.exitCode = 1;
     return;
@@ -1018,10 +1211,10 @@ async function runCatalog(format) {
   const catalog = await fetchCatalog(client);
   if (!catalog)
     return;
-  logInfo(JSON.stringify(catalog, null, format === "json" ? 0 : 2));
+  logInfo(JSON.stringify(catalog, null, parsed.format === "json" ? 0 : 2));
 }
 async function runCommand(parsed) {
-  const client = await getAuthenticatedClient();
+  const client = await getAuthenticatedClient(await getRequestedPackages(parsed));
   if (!client) {
     if (parsed.format === "json") {
       logInfo(JSON.stringify({ success: false, error: { code: "not-authenticated", message: "Run `aident login` first." } }));
@@ -1097,17 +1290,33 @@ function emitResult(result, format, resolved) {
     return;
   }
   if (body.success) {
-    logInfo(`${colors.green}✓${colors.reset} ${resolved.domain} ${resolved.command}`);
+    logInfo(`${colors.green}ok${colors.reset} ${resolved.domain} ${resolved.command}`);
     if (body.data !== undefined)
       logInfo(JSON.stringify(body.data, null, 2));
     if (body.meta)
       logInfo(`${colors.cyan}meta:${colors.reset} ${JSON.stringify(body.meta)}`);
   } else {
-    logErr(`${colors.red}✗ ${body.error?.code ?? "error"}:${colors.reset} ${body.error?.message ?? "Unknown error"}`);
+    logErr(`${colors.red}x ${body.error?.code ?? "error"}:${colors.reset} ${body.error?.message ?? "Unknown error"}`);
     process.exitCode = 1;
   }
 }
-async function getAuthenticatedClient() {
+async function getRequestedPackages(parsed) {
+  const rawPackage = parsed.flags["package"] ?? process.env.AIDENT_PACKAGE;
+  if (rawPackage !== undefined && rawPackage !== null && rawPackage !== false) {
+    if (rawPackage !== true)
+      return [parseCliPackage(rawPackage)];
+    throw new Error("--package requires a value: loadout, playbook, or intern");
+  }
+  const rawPackages = parsed.flags["packages"] ?? process.env.AIDENT_PACKAGES;
+  if (rawPackages !== undefined && rawPackages !== null && rawPackages !== false) {
+    if (rawPackages !== true)
+      return normalizeCliPackages(rawPackages);
+    throw new Error("--packages requires a comma-separated package list");
+  }
+  return resolveDefaultPackages();
+}
+async function getAuthenticatedClient(packages) {
+  const activePackages = packages ?? await resolveDefaultPackages();
   const envToken = process.env.AIDENT_TOKEN;
   const envBaseUrl = process.env.AIDENT_BASE_URL?.trim();
   if (envToken) {
@@ -1116,7 +1325,7 @@ async function getAuthenticatedClient() {
       base_url: normalizeBaseUrl(baseUrl),
       client_id: "",
       access_token: envToken
-    });
+    }, "env", activePackages);
   }
   let creds = await readCredentials();
   if (!creds)
@@ -1131,12 +1340,13 @@ async function getAuthenticatedClient() {
       creds = refreshed;
     }
   }
-  return new CliClient(creds);
+  return new CliClient(creds, "stored", activePackages);
 }
 var catalogCache = null;
 async function fetchCatalog(client) {
-  if (catalogCache)
-    return catalogCache;
+  const packagesKey = client.activePackages.join(",");
+  if (catalogCache && catalogCache.packagesKey === packagesKey)
+    return catalogCache.catalog;
   const res = await callWithRefresh(client, (c) => c.getCatalog());
   if (res.status === 401) {
     logErr(`Not authenticated (HTTP ${res.status}). Run \`aident login\`.`);
@@ -1148,8 +1358,15 @@ async function fetchCatalog(client) {
     process.exitCode = 1;
     return null;
   }
-  catalogCache = res.body;
-  return catalogCache;
+  catalogCache = { packagesKey, catalog: res.body };
+  return catalogCache.catalog;
+}
+function formatConfigValue(value) {
+  return Array.isArray(value) ? value.join(",") : String(value);
+}
+async function readConfiguredPackages() {
+  const config = await readConfig();
+  return normalizeCliPackages(config.packages);
 }
 function isCommandCatalog(body) {
   if (!body || typeof body !== "object")

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aident-ai/cli",
-  "version": "0.0.6",
-  "description": "Aident CLI — agent-friendly access to 1000+ integrations, playbooks, and the Aident automation platform.",
+  "version": "0.0.7-rc.0",
+  "description": "Aident CLI — umbrella access to Loadout integrations, Playbook automation, Intern tools, and the Aident platform.",
   "homepage": "https://aident.ai",
   "repository": {
     "type": "git",
@@ -28,14 +28,16 @@
   "scripts": {
     "build": "bun run scripts/build.ts",
     "dev": "bun run src/cli.ts",
-    "test": "bun test",
+    "test": "bun test src/__tests__",
+    "test:e2e": "bun test integration",
     "typecheck": "tsc --noEmit",
     "format": "pnpm exec prettier . --write",
-    "lint": "pnpm exec eslint ./src --cache --cache-location ../../.eslintcache",
+    "lint": "pnpm exec eslint ./src ./integration --cache --cache-location ../../.eslintcache",
     "prepublishOnly": "pnpm run build"
   },
   "imports": {
-    "~cli/*": "./src/*"
+    "~cli/*": "./src/*",
+    "~e2e/*": "./integration/*"
   },
   "devDependencies": {
     "@aident/eslint-config": "workspace:*",