@aident-ai/cli 0.1.0 → 0.1.2

package/dist/cli.mjs

@@ -26,10 +26,20 @@ function logErr(text) {
 }
 
 // src/prompt.ts
-function readLine(prompt) {
-  return new Promise((resolve) => {
+function readLine(prompt, options = {}) {
+  return new Promise((resolve, reject) => {
     process.stdout.write(prompt);
     let data = "";
+    let timeout;
+    let active = true;
+    const cleanup = () => {
+      active = false;
+      process.stdin.removeListener("data", onData);
+      process.stdin.pause();
+      if (timeout)
+        clearTimeout(timeout);
+    };
+    const timeoutMs = options.timeoutMs;
     const onData = (chunk) => {
       const s = chunk.toString("utf-8");
       const newlineIdx = s.indexOf(`
@@ -39,10 +49,15 @@ function readLine(prompt) {
         return;
       }
       data += s.slice(0, newlineIdx);
-      process.stdin.removeListener("data", onData);
-      process.stdin.pause();
+      cleanup();
       resolve(data.replace(/\r$/, ""));
     };
+    if (timeoutMs) {
+      timeout = setTimeout(() => {
+        cleanup();
+        reject(new Error(options.timeoutMessage ?? `No input received within ${timeoutMs / 1000}s.`));
+      }, timeoutMs);
+    }
     process.stdin.resume();
     process.stdin.on("data", onData);
   });
@@ -50,6 +65,10 @@ function readLine(prompt) {
 
 // src/auth.ts
 var CLIENT_NAME = "aident-cli";
+var LOOPBACK_HOST = "127.0.0.1";
+var LOGIN_OPEN_TIMEOUT_MS = 90 * 1000;
+var LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS = 5 * 60 * 1000;
+var LOGIN_OPENED_MESSAGE = `User opened the Aident login window. They have ${LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS / 60000} minutes to finish; if it fails, run \`aident login --oob\`, share the URL, and ask for the verification code.`;
 async function login(options) {
   const baseUrl = options.baseUrl.replace(/\/+$/, "");
   if (options.oob)
@@ -97,24 +116,28 @@ async function loginLoopback(baseUrl) {
   const verifier = base64UrlEncode(randomBytes(48));
   const challenge = base64UrlEncode(createHash("sha256").update(verifier).digest());
   const state = base64UrlEncode(randomBytes(16));
-  const { server, port, codePromise } = await startCallbackServer(state);
-  const redirectUri = `http://localhost:${port}/callback`;
+  const { server, port, codePromise, setExpectedOpenRedirectUrl } = await startCallbackServer(state);
+  const redirectUri = `http://${LOOPBACK_HOST}:${port}/callback`;
   const clientId = await registerClient(baseUrl, [redirectUri]);
   const authorizeUrl = new URL(`${baseUrl}/api/mcp/oauth/authorize`);
   authorizeUrl.searchParams.set("response_type", "code");
   authorizeUrl.searchParams.set("client_id", clientId);
   authorizeUrl.searchParams.set("redirect_uri", redirectUri);
+  authorizeUrl.searchParams.set("redirect_uri_exact", base64UrlEncode(Buffer.from(redirectUri, "utf8")));
   authorizeUrl.searchParams.set("code_challenge", challenge);
   authorizeUrl.searchParams.set("code_challenge_method", "S256");
   authorizeUrl.searchParams.set("state", state);
+  const authorizeUrlString = authorizeUrl.toString();
+  setExpectedOpenRedirectUrl(authorizeUrlString);
+  const loginOpenUrl = buildLoginOpenUrl(port, state, authorizeUrlString);
   logInfo(`Opening browser for Aident login...`);
-  logInfo(`If the browser does not open, visit: ${authorizeUrl.toString()}`);
-  openBrowser(authorizeUrl.toString());
+  logInfo(`If the browser does not open, visit: ${authorizeUrlString}`);
+  openBrowser(shouldUseLoopbackBrowserHandoff() ? loginOpenUrl : authorizeUrlString);
   let code;
   try {
     code = await codePromise;
   } finally {
-    server.close();
+    closeServer(server);
   }
   const tok = await exchangeCode(baseUrl, clientId, code, redirectUri, verifier);
   return buildCreds(baseUrl, clientId, tok);
@@ -124,36 +147,54 @@ async function loginOob(baseUrl) {
   const verifier = base64UrlEncode(randomBytes(48));
   const challenge = base64UrlEncode(createHash("sha256").update(verifier).digest());
   const state = base64UrlEncode(randomBytes(16));
-  const clientId = await registerClient(baseUrl, [redirectUri]);
-  const authorizeUrl = new URL(`${baseUrl}/api/mcp/oauth/authorize`);
-  authorizeUrl.searchParams.set("response_type", "code");
-  authorizeUrl.searchParams.set("client_id", clientId);
-  authorizeUrl.searchParams.set("redirect_uri", redirectUri);
-  authorizeUrl.searchParams.set("code_challenge", challenge);
-  authorizeUrl.searchParams.set("code_challenge_method", "S256");
-  authorizeUrl.searchParams.set("state", state);
-  logInfo(`Opening browser for Aident login...`);
-  logInfo(`If the browser does not open, visit: ${authorizeUrl.toString()}`);
-  openBrowser(authorizeUrl.toString());
-  logInfo("After approving, paste the value shown on the Aident page below.");
-  logInfo("(It will be either an authorization code — preferred — or a raw access token.)");
-  const pasted = (await readLine("Paste here: ")).trim();
-  if (!pasted)
-    throw new Error("No token provided");
+  let clientId = "";
+  let valueToExchange = "";
   try {
-    const tok = await exchangeCode(baseUrl, clientId, pasted, redirectUri, verifier);
+    clientId = await registerClient(baseUrl, [redirectUri]);
+    const authorizeUrl = new URL(`${baseUrl}/api/mcp/oauth/authorize`);
+    authorizeUrl.searchParams.set("response_type", "code");
+    authorizeUrl.searchParams.set("client_id", clientId);
+    authorizeUrl.searchParams.set("redirect_uri", redirectUri);
+    authorizeUrl.searchParams.set("code_challenge", challenge);
+    authorizeUrl.searchParams.set("code_challenge_method", "S256");
+    authorizeUrl.searchParams.set("state", state);
+    const authorizeUrlString = authorizeUrl.toString();
+    logInfo(`Opening browser for Aident login...`);
+    logInfo(`If the browser does not open, visit: ${authorizeUrlString}`);
+    openBrowser(authorizeUrlString);
+    logInfo("After approving, paste the 8-digit verification code shown on the Aident page below.");
+    const pastedInput = await readLine("Paste 8-digit code here: ", {
+      timeoutMs: LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS,
+      timeoutMessage: `Verification code not received within ${LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS / 1000}s; aborting.`
+    });
+    valueToExchange = normalizeOobLoginInput(pastedInput);
+    if (!valueToExchange)
+      throw new Error("No verification code provided");
+    if (!/^\d{8}$/.test(valueToExchange) && !looksLikeAccessToken(valueToExchange)) {
+      throw new Error("Pasted value is not a valid 8-digit verification code. Please retry the login.");
+    }
+    const tok = await exchangeCode(baseUrl, clientId, valueToExchange, redirectUri, verifier);
     return buildCreds(baseUrl, clientId, tok);
   } catch (err) {
     if (err instanceof OAuthRejectedError) {
-      if (!looksLikeAccessToken(pasted)) {
-        throw new Error("Pasted value is neither a valid authorization code nor a recognizable access token. Please retry the login.");
+      if (!looksLikeAccessToken(valueToExchange)) {
+        throw new Error("Pasted verification code was rejected by the server. Please retry the login.");
       }
       logErr(`Server rejected the pasted value as an authorization code. Treating it as a raw access token. Note: token refresh is unavailable in this mode — when the token expires you'll need to run \`aident login\` again.`);
-      return { base_url: baseUrl, client_id: clientId, access_token: pasted };
+      return { base_url: baseUrl, client_id: clientId, access_token: valueToExchange };
     }
     throw err;
   }
 }
+function normalizeVerificationCodeInput(value) {
+  return value.trim().replace(/[\s-]+/g, "");
+}
+function normalizeOobLoginInput(value) {
+  const verificationCode = normalizeVerificationCodeInput(value);
+  if (/^\d{8}$/.test(verificationCode))
+    return verificationCode;
+  return value.trim().replace(/\s+/g, "");
+}
 function looksLikeAccessToken(value) {
   if (value.length < 20)
     return false;
@@ -232,7 +273,6 @@ function updateCredsFromToken(creds, tok) {
     expires_at: expiresAt
   };
 }
-var LOOPBACK_TIMEOUT_MS = 5 * 60 * 1000;
 function startCallbackServer(expectedState) {
   return new Promise((resolve, reject) => {
     let codeResolver = () => {
@@ -241,52 +281,155 @@ function startCallbackServer(expectedState) {
     let codeRejecter = () => {
       return;
     };
+    let opened = false;
+    let expectedOpenRedirectUrl = "";
+    let completeTimeout;
     const codePromise = new Promise((res, rej) => {
       codeResolver = res;
       codeRejecter = rej;
     });
-    const timeout = setTimeout(() => {
-      codeRejecter(new Error(`No callback received within ${LOOPBACK_TIMEOUT_MS / 1000}s; aborting.`));
-    }, LOOPBACK_TIMEOUT_MS);
-    codePromise.finally(() => clearTimeout(timeout));
-    const server = createServer((req, res) => {
-      if (!req.url) {
-        res.writeHead(400);
-        res.end("Bad request");
-        return;
-      }
-      const url = new URL(req.url, `http://localhost`);
-      if (url.pathname !== "/callback") {
-        res.writeHead(404);
-        res.end("Not found");
-        return;
-      }
-      const code = url.searchParams.get("code");
-      const state = url.searchParams.get("state");
-      const error = url.searchParams.get("error");
-      if (error) {
-        res.writeHead(400, { "Content-Type": "text/html" });
-        res.end(`<html><body><h2>Authentication error</h2><p>${escapeHtml(error)}</p></body></html>`);
-        codeRejecter(new Error(`OAuth error: ${error}`));
-        return;
+    const scheduleCompleteTimeout = (timeoutMs, message) => {
+      if (completeTimeout)
+        clearTimeout(completeTimeout);
+      completeTimeout = setTimeout(() => codeRejecter(new Error(message)), timeoutMs);
+    };
+    const openTimeout = setTimeout(() => {
+      if (!opened) {
+        logInfo(`Login window open signal not received within ${LOGIN_OPEN_TIMEOUT_MS / 1000}s; still waiting for login to finish.`);
       }
-      if (!code || state !== expectedState) {
-        res.writeHead(400, { "Content-Type": "text/html" });
-        res.end("<html><body><h2>Invalid callback</h2></body></html>");
-        codeRejecter(new Error("Invalid callback (missing code or bad state)"));
+    }, LOGIN_OPEN_TIMEOUT_MS);
+    scheduleCompleteTimeout(LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS, `Authorization callback not received within ${LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS / 1000}s; aborting.`);
+    codePromise.then(() => {
+      clearTimeout(openTimeout);
+      if (completeTimeout)
+        clearTimeout(completeTimeout);
+    }, () => {
+      clearTimeout(openTimeout);
+      if (completeTimeout)
+        clearTimeout(completeTimeout);
+    });
+    const markOpened = () => {
+      if (opened)
         return;
-      }
-      res.writeHead(200, { "Content-Type": "text/html" });
-      res.end(`<html><body style="font-family:system-ui;padding:40px;text-align:center"><h2>You're signed in.</h2><p>You can close this window and return to the terminal.</p></body></html>`);
-      codeResolver(code);
+      opened = true;
+      clearTimeout(openTimeout);
+      logInfo(LOGIN_OPENED_MESSAGE);
+      const timeoutMs = LOGIN_COMPLETE_TIMEOUT_AFTER_OPENED_MS;
+      scheduleCompleteTimeout(timeoutMs, `Login page opened but did not complete within ${timeoutMs / 1000}s; aborting.`);
+    };
+    const server = createServer((req, res) => {
+      runLocalCallbackHandler(req, res, () => {
+        if (!req.url) {
+          res.writeHead(400);
+          res.end("Bad request");
+          return;
+        }
+        const url = new URL(req.url, `http://${LOOPBACK_HOST}`);
+        if (handleOpenRedirect(url, res, expectedState, expectedOpenRedirectUrl, markOpened))
+          return;
+        if (url.pathname !== "/callback") {
+          res.writeHead(404);
+          res.end("Not found");
+          return;
+        }
+        const code = url.searchParams.get("code");
+        const state = url.searchParams.get("state");
+        const error = url.searchParams.get("error");
+        if (error) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(`<html><body><h2>Authentication error</h2><p>${escapeHtml(error)}</p></body></html>`);
+          codeRejecter(new Error(`OAuth error: ${error}`));
+          return;
+        }
+        if (!code || state !== expectedState) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end("<html><body><h2>Invalid callback</h2></body></html>");
+          codeRejecter(new Error("Invalid callback (missing code or bad state)"));
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(`<html><body style="font-family:system-ui;padding:40px;text-align:center"><h2>You're signed in.</h2><p>You can close this window and return to the terminal.</p></body></html>`);
+        codeResolver(code);
+      }, codeRejecter);
     });
     server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => {
+    server.listen(0, LOOPBACK_HOST, () => {
       const addr = server.address();
-      resolve({ server, port: addr.port, codePromise });
+      resolve({
+        server,
+        port: addr.port,
+        codePromise,
+        setExpectedOpenRedirectUrl: (url) => {
+          expectedOpenRedirectUrl = url;
+        }
+      });
     });
   });
 }
+function handleOpenRedirect(url, res, expectedState, expectedOpenRedirectUrl, onOpened) {
+  if (url.pathname !== "/open")
+    return false;
+  if (url.searchParams.get("state") !== expectedState) {
+    res.writeHead(400);
+    res.end("Bad request");
+    return true;
+  }
+  const nextUrl = url.searchParams.get("next");
+  if (!expectedOpenRedirectUrl || !nextUrl || nextUrl !== expectedOpenRedirectUrl) {
+    res.writeHead(400);
+    res.end("Bad request");
+    return true;
+  }
+  try {
+    onOpened();
+  } catch {
+    res.writeHead(500);
+    res.end("Internal callback error");
+    return true;
+  }
+  res.writeHead(302, { Location: nextUrl });
+  res.end();
+  return true;
+}
+function runLocalCallbackHandler(req, res, handle, onAuthCallbackError) {
+  try {
+    handle();
+  } catch (err) {
+    if (!res.writableEnded) {
+      if (!res.headersSent)
+        res.writeHead(500);
+      res.end("Internal callback error");
+    }
+    if (isAuthCallbackRequest(req.url))
+      onAuthCallbackError?.(toError(err));
+  }
+}
+function isAuthCallbackRequest(url) {
+  if (!url)
+    return false;
+  try {
+    return new URL(url, `http://${LOOPBACK_HOST}`).pathname === "/callback";
+  } catch {
+    return false;
+  }
+}
+function toError(err) {
+  return err instanceof Error ? err : new Error(String(err));
+}
+function closeServer(server) {
+  server.close();
+  server.closeIdleConnections?.();
+  server.closeAllConnections?.();
+}
+function buildLoginOpenUrl(port, state, authorizeUrl) {
+  const url = new URL(`http://${LOOPBACK_HOST}:${port}/open`);
+  url.searchParams.set("state", state);
+  url.searchParams.set("next", authorizeUrl);
+  return url.toString();
+}
+function shouldUseLoopbackBrowserHandoff(env = process.env) {
+  return !env.SSH_CONNECTION && !env.SSH_TTY && !env.CODESPACES && !env.REMOTE_CONTAINERS && !env.DEVCONTAINER;
+}
 function openBrowser(url) {
   const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   const args = process.platform === "win32" ? ["", url] : [url];
@@ -302,20 +445,22 @@ function escapeHtml(s) {
 }
 
 // src/version.ts
-var VERSION = "0.1.0";
+var VERSION = "0.1.2";
 
 // src/client.ts
 class CliClient {
   creds;
   credentialSource;
   packages;
+  installedSkillVersion;
   commandOperations = new Map;
-  constructor(creds, credentialSource = "stored", packages) {
+  constructor(creds, credentialSource = "stored", packages, installedSkillVersion = null) {
     this.creds = creds;
     this.credentialSource = credentialSource;
     if (packages.length === 0)
       throw new Error("CliClient packages must not be empty");
     this.packages = [...packages];
+    this.installedSkillVersion = installedSkillVersion;
   }
   get baseUrl() {
     return this.creds.base_url.replace(/\/+$/, "");
@@ -360,8 +505,12 @@ class CliClient {
     }
     return this.fetchJson("POST", this.operationPath(operation.packageName, operation.operationId), args);
   }
+  async execOperation(packageName, operationId, args) {
+    return this.fetchJson("POST", this.operationPath(packageName, operationId), args);
+  }
   async fetchOpenApiCatalog(packageName) {
-    const result = await this.fetchJson("GET", this.catalogPath(packageName));
+    const headers = packageName === "loadout" && this.installedSkillVersion ? { "x-aident-skill-version": this.installedSkillVersion } : undefined;
+    const result = await this.fetchJson("GET", this.catalogPath(packageName), undefined, headers);
     const catalog = result.body["x-aident-command-catalog"];
     if (result.status !== 200 || !catalog) {
       return {
@@ -369,6 +518,9 @@ class CliClient {
         body: invalidResponseFallback(JSON.stringify(result.body))
       };
     }
+    if (packageName === "loadout" && result.body["x-aident-loadout-skill"]) {
+      catalog.loadoutSkill = result.body["x-aident-loadout-skill"];
+    }
     return { status: result.status, body: catalog };
   }
   catalogPath(packageName) {
@@ -388,10 +540,11 @@ class CliClient {
       });
     }
   }
-  async fetchJson(method, path, body) {
+  async fetchJson(method, path, body, extraHeaders) {
     const headers = {
       Authorization: `Bearer ${this.creds.access_token}`,
-      "User-Agent": `@aident-ai/cli/${VERSION}`
+      "User-Agent": `@aident-ai/cli/${VERSION}`,
+      ...extraHeaders
     };
     if (body !== undefined)
       headers["Content-Type"] = "application/json";
@@ -441,10 +594,12 @@ function mergeCatalogs(catalogs, packages, onCommand) {
       }
     }
   });
+  const loadoutSkill = catalogs.find((catalog) => catalog.loadoutSkill)?.loadoutSkill;
   return {
     packages: [...packageMap.values()],
     domains: [...domainMap.values()],
-    commands: [...commandMap.values()]
+    commands: [...commandMap.values()],
+    ...loadoutSkill ? { loadoutSkill } : {}
   };
 }
 
@@ -488,7 +643,7 @@ function getAidentDir() {
 function getConfigFile() {
   return join(getAidentDir(), "config.json");
 }
-var DEFAULT_BASE_URL = "https://app.aident.ai";
+var DEFAULT_BASE_URL = "https://loadout.aident.ai";
 var CONFIG_KEYS = ["baseUrl", "packages"];
 async function readConfig() {
   try {
@@ -546,6 +701,7 @@ function normalizeBaseUrl(url) {
 // src/credentials.ts
 import { mkdir as mkdir2, readFile as readFile2, rm, writeFile as writeFile2 } from "node:fs/promises";
 import { join as join2 } from "node:path";
+var REFRESH_WINDOW_MS = 24 * 60 * 60 * 1000;
 function getCredentialsFile() {
   return join2(getAidentDir(), "credentials.json");
 }
@@ -573,7 +729,67 @@ function isExpired(creds) {
   const expiresAt = Date.parse(creds.expires_at);
   if (Number.isNaN(expiresAt))
     return false;
-  return Date.now() >= expiresAt - 60000;
+  return Date.now() >= expiresAt - REFRESH_WINDOW_MS;
+}
+
+// src/loadoutSkill.ts
+import { readFile as readFile3 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { join as join3 } from "node:path";
+async function fetchLoadoutSkillMetadata(baseUrl) {
+  const res = await fetch(`${baseUrl.replace(/\/+$/, "")}/.well-known/loadout-skill.json`, {
+    method: "GET",
+    headers: { "User-Agent": `@aident-ai/cli/${VERSION}` }
+  });
+  if (res.status !== 200)
+    return null;
+  const body = await res.json();
+  return isLoadoutSkillMetadata(body) ? body : null;
+}
+function isLoadoutSkillMetadata(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const body = value;
+  return body.product === "loadout" && typeof body.skillUrl === "string" && typeof body.skillVersion === "string" && typeof body.updatedAt === "string" && typeof body.setupPrompt === "string" && typeof body.updatePrompt === "string" && typeof body.minCliVersion === "string" && typeof body.recommendedCliVersion === "string" && (body.localIntegrationMigrationPromptEnabled === undefined || typeof body.localIntegrationMigrationPromptEnabled === "boolean") && Array.isArray(body.notices) && body.notices.every(isLoadoutSkillNotice);
+}
+function isLocalIntegrationMigrationPromptEnabled(metadata) {
+  return metadata?.localIntegrationMigrationPromptEnabled === true;
+}
+function getInstalledLoadoutSkillCandidates(cwd = process.cwd(), home = homedir2()) {
+  const skillFile = join3("skills", "aident-skill", "SKILL.md");
+  return [
+    join3(cwd, ".claude", skillFile),
+    join3(cwd, ".agents", skillFile),
+    join3(home, ".claude", skillFile),
+    join3(home, ".codex", skillFile),
+    join3(home, ".cursor", skillFile),
+    join3(home, ".agents", skillFile),
+    join3(home, ".gemini", "extensions", "aident-skill", "SKILL.md")
+  ];
+}
+function formatLoadoutSkillWarnings(metadata) {
+  const warnings = metadata?.notices.filter((notice) => notice.severity === "warning") ?? [];
+  return warnings.map((notice) => `${colors.yellow}Warning:${colors.reset} ${notice.message}`);
+}
+async function findInstalledLoadoutSkillVersion(candidates = getInstalledLoadoutSkillCandidates()) {
+  for (const candidate of candidates) {
+    let content;
+    try {
+      content = await readFile3(candidate, "utf-8");
+    } catch {
+      continue;
+    }
+    const match = /^version:\s*(\d+\.\d+\.\d+)\s*$/m.exec(content);
+    if (match)
+      return match[1];
+  }
+  return null;
+}
+function isLoadoutSkillNotice(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const body = value;
+  return typeof body.id === "string" && (body.severity === "info" || body.severity === "warning") && typeof body.message === "string";
 }
 
 // src/doctor.ts
@@ -583,9 +799,20 @@ async function runDoctor(opts) {
   checks.push(await checkConfig());
   checks.push(await checkCredentials(opts.baseUrl));
   checks.push(await checkServerReachable(opts.baseUrl));
+  checks.push(await checkLoadoutSkillMetadata(opts.baseUrl));
   const ok = checks.every((c) => c.ok);
   return { ok, checks, ...opts };
 }
+async function checkLoadoutSkillMetadata(baseUrl) {
+  const metadata = await fetchLoadoutSkillMetadata(baseUrl);
+  if (!metadata)
+    return { name: "Loadout skill", ok: true, detail: "freshness metadata unavailable" };
+  return {
+    name: "Loadout skill",
+    ok: true,
+    detail: `v${metadata.skillVersion}; ${metadata.updatePrompt}`
+  };
+}
 function checkNodeVersion() {
   const version = process.versions.node;
   const major = Number(version.split(".")[0]);
@@ -633,7 +860,7 @@ async function checkServerReachable(baseUrl) {
       return {
         name: "Server reachable",
         ok: false,
-        detail: `${baseUrl} requires @aident-ai/cli ≥ ${minVersion} — run \`npm install -g @aident-ai/cli@latest\``
+        detail: `${baseUrl} requires @aident-ai/cli ≥ ${minVersion} — run \`curl -fsSL https://loadout.aident.ai/cli/install.sh | bash\``
       };
     }
     if (res.status === 401 || res.status === 200) {
@@ -650,6 +877,54 @@ async function checkServerReachable(baseUrl) {
 }
 
 // src/help.ts
+var LOCAL_HELP_COMMANDS = [
+  { command: "login", description: "Authenticate with Aident" },
+  { command: "logout", description: "Revoke the current token" },
+  { command: "whoami", description: "Show current user" },
+  { command: "config show", description: "Print persistent config" },
+  { command: "config set <key> <value>", description: "Persist a config value" },
+  { command: "config get <key>", description: "Read a single value" },
+  { command: "packages add <playbook|intern>", description: "Enable an add-on package" },
+  { command: "doctor", description: "Validate installation" },
+  { command: "setup", description: "Interactive setup wizard" },
+  { command: "integrations migrate-local", description: "Plan migration from local MCP configs to Loadout" },
+  { command: "<domain> <command> [--flag value ...] [--json]", description: "Run a catalog command after login" }
+];
+function getLocalHelp(version) {
+  return {
+    version,
+    authenticated: false,
+    usage: [
+      "aident login [--oob] [--base-url <url>]",
+      "aident logout",
+      "aident whoami",
+      "aident config show",
+      "aident config set <key> <value>",
+      "aident config get <key>",
+      "aident packages add <playbook|intern>",
+      "aident doctor",
+      "aident setup",
+      "aident integrations migrate-local",
+      "aident <domain> <command> [--flag value ...] [--json]"
+    ],
+    commands: LOCAL_HELP_COMMANDS,
+    note: "Run `aident login` to authenticate. Authenticated help includes the live command catalog."
+  };
+}
+function renderLocalHelp(version) {
+  const help = getLocalHelp(version);
+  const lines = [];
+  lines.push(`${colors.bold}Aident CLI v${version}${colors.reset}`);
+  lines.push("");
+  lines.push(help.note);
+  lines.push("");
+  lines.push("USAGE:");
+  for (const usage of help.usage) {
+    lines.push(`  ${usage}`);
+  }
+  return lines.join(`
+`);
+}
 function renderHelp(catalog) {
   const lines = [];
   lines.push(`${colors.bold}AIDENT — Platform Feature CLI${colors.reset}`);
@@ -674,6 +949,13 @@ function renderHelp(catalog) {
     const display = d.isAdmin ? `admin ${d.name.replace("admin:", "")}` : d.name;
     lines.push(`  ${display.padEnd(28)} ${d.description} ${colors.dim}(${d.commandCount})${colors.reset}`);
   }
+  if (catalog.loadoutSkill?.notices.length) {
+    lines.push("");
+    lines.push("LOADOUT SKILL:");
+    for (const notice of catalog.loadoutSkill.notices) {
+      lines.push(`  ${notice.message}`);
+    }
+  }
   return lines.join(`
 `);
 }
@@ -754,6 +1036,459 @@ function renderCommandHelp(catalog, domain, command) {
 `);
 }
 
+// src/localIntegrationMigration.ts
+import { createHash as createHash2 } from "node:crypto";
+import { readFile as readFile4 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import { basename, join as join4 } from "node:path";
+var LOCAL_INTEGRATION_MIGRATION_PROMPTED_AT_KEY = "localIntegrationMigrationPromptedAt";
+var LOCAL_INTEGRATION_MIGRATION_SKIPPED_AT_KEY = "localIntegrationMigrationSkippedAt";
+var LOCAL_INTEGRATION_MIGRATION_COMPLETED_AT_KEY = "localIntegrationMigrationCompletedAt";
+var SECRET_KEY_PATTERN = /(^|[^a-z0-9])(bearer|pat|token|secret|password|authorization|api[_-]?key|x[_-]?api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|client[_-]?secret|cookie|private[_-]?key|key[_-]?file|keyfile)(?=[^a-z0-9]|$)/i;
+var SECRET_ASSIGNMENT_PATTERN = /(bearer|pat|token|secret|password|authorization|api[_-]?key|x[_-]?api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|client[_-]?secret|cookie|private[_-]?key|key[_-]?file|keyfile)=([^,\s]+)/gi;
+var ASSIGNMENT_VALUE_PATTERN = /([A-Za-z0-9_.-]{2,}=)([^,\s]+)/g;
+var HIGH_ENTROPY_TOKEN_PATTERN = /[A-Za-z0-9_+=.-]{20,}/g;
+var HIGH_ENTROPY_MIN_LENGTH = 20;
+var HIGH_ENTROPY_MIN_BITS_PER_CHAR = 3.5;
+var MAX_JSON_CONFIG_DEPTH = 10;
+var MIN_INTEGRATION_MATCH_SCORE = 10;
+var MATCH_STOP_WORDS = new Set([
+  "api",
+  "app",
+  "cli",
+  "command",
+  "config",
+  "desktop",
+  "http",
+  "https",
+  "io",
+  "json",
+  "local",
+  "mcp",
+  "modelcontextprotocol",
+  "npx",
+  "package",
+  "server",
+  "tools",
+  "tool",
+  "url",
+  "www"
+]);
+function shouldOfferLocalIntegrationMigration(config, options = {}) {
+  if (options.stdinIsTTY !== true || options.stdoutIsTTY !== true)
+    return false;
+  return typeof config[LOCAL_INTEGRATION_MIGRATION_PROMPTED_AT_KEY] !== "string";
+}
+function parseLocalIntegrationSelection(input, plan) {
+  const trimmed = input.trim();
+  if (!trimmed)
+    return [];
+  const connectable = plan.candidates.filter((candidate) => isConnectableCandidate(candidate));
+  if (trimmed.toLowerCase() === "all") {
+    return uniqueStrings(connectable.map((candidate) => candidate.loadoutIntegrationId).filter(isString));
+  }
+  const selected = new Set;
+  for (const token of trimmed.split(/[,\s]+/).filter(Boolean)) {
+    const asNumber = Number(token);
+    const byIndex = Number.isInteger(asNumber) ? plan.candidates[asNumber - 1] : undefined;
+    if (byIndex && isConnectableCandidate(byIndex) && byIndex.loadoutIntegrationId) {
+      selected.add(byIndex.loadoutIntegrationId);
+      continue;
+    }
+    const byId = connectable.find((candidate) => candidate.loadoutIntegrationId === token || candidate.candidateId === token);
+    if (byId?.loadoutIntegrationId)
+      selected.add(byId.loadoutIntegrationId);
+  }
+  return [...selected];
+}
+function formatLocalIntegrationSelectionFailure(input, plan) {
+  if (!input.trim())
+    return "No Loadout connections started.";
+  if (!plan.candidates.some(isConnectableCandidate)) {
+    return "No connectable Loadout integrations were available in the migration plan.";
+  }
+  return [
+    "Selection did not include any connectable integrations.",
+    "Use `all`, a listed supported candidate number, candidate ID, or Loadout integration ID from the plan."
+  ].join(" ");
+}
+function isConnectableCandidate(candidate) {
+  return candidate.status !== "unsupported" && candidate.status !== "already_connected" && typeof candidate.loadoutIntegrationId === "string";
+}
+async function buildLocalIntegrationMigrationPlan(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const homeDir = options.homeDir ?? process.env.HOME ?? process.env.USERPROFILE ?? homedir3();
+  const files = localConfigFiles(cwd, homeDir);
+  const rawCandidates = [];
+  const scannedFiles = [];
+  for (const file of files) {
+    const text = await readOptionalText(file.path);
+    if (text === null)
+      continue;
+    scannedFiles.push(file.path);
+    if (file.kind === "json") {
+      const parsed = parseJsonObject(text);
+      if (!parsed)
+        continue;
+      rawCandidates.push(...extractJsonMcpCandidates(parsed, file.source, file.path));
+    }
+  }
+  const candidates = dedupeRawCandidates(rawCandidates);
+  const catalogIntegrations = options.catalogIntegrations ?? (options.catalogIntegrationResolver ? await options.catalogIntegrationResolver(buildCatalogSearchQueries(candidates)) : []);
+  return {
+    candidates: candidates.map((candidate) => resolveCandidate(candidate, catalogIntegrations)),
+    scannedFiles
+  };
+}
+function formatLocalIntegrationMigrationPlan(plan) {
+  if (plan.candidates.length === 0)
+    return "No local integration configs found.";
+  return plan.candidates.map((candidate, index) => {
+    const target = candidate.loadoutIntegrationId ? ` -> ${candidate.loadoutIntegrationId}` : "";
+    const match = ` match:${candidate.matchConfidence}${candidate.matchReasons.length > 0 ? `:${candidate.matchReasons.join("+")}` : ""}`;
+    const identity = candidate.platformCredentialSummary ? ` identity:${candidate.platformCredentialSummary}` : "";
+    const reason = candidate.reason ? ` (${candidate.reason})` : "";
+    return `${index + 1}. ${candidate.localLabel} id:${candidate.candidateId}${target} [${candidate.status}] ${candidate.redactedLocator}${match}${identity}${reason}`;
+  }).join(`
+`);
+}
+function localConfigFiles(cwd, homeDir) {
+  return [
+    { path: join4(cwd, ".mcp.json"), source: "mcp_config", kind: "json" },
+    {
+      path: join4(cwd, ".cursor", "mcp.json"),
+      source: "mcp_config",
+      kind: "json"
+    },
+    {
+      path: join4(cwd, ".vscode", "mcp.json"),
+      source: "mcp_config",
+      kind: "json"
+    },
+    {
+      path: join4(homeDir, ".claude.json"),
+      source: "agent_config",
+      kind: "json"
+    },
+    {
+      path: join4(homeDir, "Library", "Application Support", "Claude", "claude_desktop_config.json"),
+      source: "agent_config",
+      kind: "json"
+    },
+    {
+      path: join4(homeDir, "AppData", "Roaming", "Claude", "claude_desktop_config.json"),
+      source: "agent_config",
+      kind: "json"
+    },
+    {
+      path: join4(homeDir, ".config", "Claude", "claude_desktop_config.json"),
+      source: "agent_config",
+      kind: "json"
+    },
+    {
+      path: join4(homeDir, ".cursor", "mcp.json"),
+      source: "mcp_config",
+      kind: "json"
+    },
+    {
+      path: join4(homeDir, ".aident", "config.json"),
+      source: "aident_cli_config",
+      kind: "aident-config"
+    }
+  ];
+}
+async function readOptionalText(path) {
+  try {
+    return await readFile4(path, "utf-8");
+  } catch {
+    return null;
+  }
+}
+function parseJsonObject(text) {
+  try {
+    const parsed = JSON.parse(text);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function extractJsonMcpCandidates(root, source, path) {
+  const candidates = [];
+  const seenObjects = new Set;
+  const visit = (value, depth) => {
+    if (depth > MAX_JSON_CONFIG_DEPTH)
+      return;
+    if (!value || typeof value !== "object" || Array.isArray(value) || seenObjects.has(value))
+      return;
+    seenObjects.add(value);
+    const obj = value;
+    for (const key of ["mcpServers", "servers"]) {
+      const serverMap = obj[key];
+      if (serverMap && typeof serverMap === "object" && !Array.isArray(serverMap)) {
+        candidates.push(...extractServerMap(serverMap, source, path));
+      }
+    }
+    for (const nested of Object.values(obj))
+      visit(nested, depth + 1);
+  };
+  visit(root, 0);
+  return candidates;
+}
+function extractServerMap(serverMap, source, path) {
+  return Object.entries(serverMap).filter(([, entry]) => entry && typeof entry === "object" && !Array.isArray(entry)).map(([label, entry]) => {
+    const url = typeof entry.url === "string" ? entry.url : undefined;
+    const command = typeof entry.command === "string" ? entry.command : undefined;
+    const args = Array.isArray(entry.args) ? entry.args.filter((arg) => typeof arg === "string") : [];
+    return {
+      localSource: source,
+      localLabel: label,
+      detectedKind: "mcp_server",
+      redactedLocator: buildRedactedLocator({ url, command, args, path }),
+      matchText: [label, url ?? "", command ?? "", ...args]
+    };
+  });
+}
+function buildRedactedLocator(params) {
+  const parts = [`config:${basename(params.path)}`];
+  if (params.url)
+    parts.push(`url:${redactedUrlOrigin(params.url)}`);
+  if (params.command)
+    parts.push(`command:${basename(params.command)}`);
+  const packageName = firstPackageLikeArg(params.args);
+  if (packageName)
+    parts.push(`package:${redactSecretLike(packageName)}`);
+  return parts.join(" ");
+}
+function redactedUrlOrigin(raw) {
+  try {
+    const url = new URL(raw);
+    return url.origin;
+  } catch {
+    return "[invalid-url]";
+  }
+}
+function firstPackageLikeArg(args) {
+  let previousWasSecretFlag = false;
+  for (const arg of args) {
+    if (previousWasSecretFlag) {
+      previousWasSecretFlag = false;
+      continue;
+    }
+    if (!arg)
+      continue;
+    if (arg.startsWith("-")) {
+      if (SECRET_KEY_PATTERN.test(arg) && !arg.includes("="))
+        previousWasSecretFlag = true;
+      continue;
+    }
+    if (/^https?:\/\//i.test(arg))
+      continue;
+    if (SECRET_KEY_PATTERN.test(arg))
+      continue;
+    return arg;
+  }
+  return;
+}
+function redactSecretLike(value) {
+  if (SECRET_KEY_PATTERN.test(value))
+    return "[redacted]";
+  const redacted = value.replace(SECRET_ASSIGNMENT_PATTERN, "$1=[redacted]").replace(ASSIGNMENT_VALUE_PATTERN, (match, prefix, rawValue) => isHighEntropySecretLike(rawValue) ? `${prefix}[redacted]` : match);
+  if (!/^[A-Za-z0-9_.-]{2,}=/.test(redacted) && isHighEntropySecretLike(redacted))
+    return "[redacted]";
+  return redacted.replace(HIGH_ENTROPY_TOKEN_PATTERN, (token) => isHighEntropySecretLike(token) ? "[redacted]" : token);
+}
+function resolveCandidate(candidate, catalogIntegrations) {
+  const matchResult = findBestIntegrationMatch(candidate, catalogIntegrations);
+  if (matchResult.kind === "ambiguous") {
+    return {
+      ...withoutMatchText(candidate),
+      matchConfidence: "ambiguous",
+      matchReasons: matchResult.matchReasons,
+      status: "unsupported",
+      reason: "Multiple Loadout integrations matched local evidence."
+    };
+  }
+  if (matchResult.kind === "none") {
+    return {
+      ...withoutMatchText(candidate),
+      matchConfidence: "none",
+      matchReasons: [],
+      status: "unsupported",
+      reason: "No matching Loadout integration found."
+    };
+  }
+  const match = matchResult.integration;
+  const status = getMatchedStatus(match);
+  return {
+    ...withoutMatchText(candidate),
+    loadoutIntegrationId: match.id,
+    matchConfidence: matchResult.matchConfidence,
+    matchReasons: matchResult.matchReasons,
+    platformCredentialSummary: match.platformCredentialSummary,
+    status,
+    reason: getMatchedReason(match, status)
+  };
+}
+function getMatchedStatus(match) {
+  if (match.readiness === "ready" && match.platformCredentialSummary)
+    return "already_connected";
+  if (match.readiness === "needs_user_setup" || match.readiness === "ready")
+    return "needs_user_connection";
+  return "supported";
+}
+function getMatchedReason(match, status) {
+  if (match.readiness === "ready" && status === "needs_user_connection") {
+    return "Connected Loadout credential needs user-confirmable identity.";
+  }
+  return;
+}
+function findBestIntegrationMatch(candidate, catalogIntegrations) {
+  const localTokens = new Set(candidate.matchText.flatMap(tokenizeForMatch));
+  let best = null;
+  let tied = false;
+  for (const integration of catalogIntegrations) {
+    const catalogTokens = new Set([integration.id, integration.name ?? "", ...getDeclaredCatalogEvidence(integration)].flatMap(tokenizeForMatch));
+    const score = scoreTokenMatch(localTokens, catalogTokens);
+    if (score < MIN_INTEGRATION_MATCH_SCORE)
+      continue;
+    const matchConfidence = getMatchConfidence(candidate, integration, score);
+    const matchReasons = getMatchReasons(candidate, integration);
+    if (!best || score > best.score) {
+      best = { integration, score, matchConfidence, matchReasons };
+      tied = false;
+      continue;
+    }
+    if (score === best.score)
+      tied = true;
+  }
+  if (!best)
+    return { kind: "none" };
+  if (tied)
+    return { kind: "ambiguous", matchReasons: best.matchReasons };
+  return {
+    kind: "matched",
+    integration: best.integration,
+    matchConfidence: best.matchConfidence,
+    matchReasons: best.matchReasons
+  };
+}
+function scoreTokenMatch(localTokens, catalogTokens) {
+  let score = 0;
+  for (const token of localTokens) {
+    if (catalogTokens.has(token))
+      score += 10;
+    for (const catalogToken of catalogTokens) {
+      if (token.length >= 4 && catalogToken.length >= 4 && token.includes(catalogToken))
+        score += 3;
+      else if (token.length >= 4 && catalogToken.length >= 4 && catalogToken.includes(token))
+        score += 2;
+    }
+  }
+  return score;
+}
+function getMatchConfidence(candidate, integration, score) {
+  const declaredEvidence = getDeclaredCatalogEvidence(integration);
+  if (hasExactDeclaredCatalogEvidence(candidate, declaredEvidence))
+    return "exact";
+  if (declaredEvidence.length > 0 && score >= MIN_INTEGRATION_MATCH_SCORE)
+    return "high";
+  return "suggested";
+}
+function getMatchReasons(candidate, integration) {
+  const reasons = new Set;
+  const catalogValues = [integration.id, integration.name].filter(isString).map(normalizeForDirectMatch);
+  if (candidate.matchText.map(normalizeForDirectMatch).some((value) => catalogValues.includes(value))) {
+    reasons.add("catalog_alias");
+  }
+  if (candidate.redactedLocator.includes("package:"))
+    reasons.add("mcp_package");
+  if (candidate.redactedLocator.includes("command:"))
+    reasons.add("command");
+  if (candidate.redactedLocator.includes("url:"))
+    reasons.add("host");
+  return [...reasons];
+}
+function getDeclaredCatalogEvidence(integration) {
+  return [
+    ...integration.providerAliases ?? [],
+    ...integration.mcpPackages ?? [],
+    ...integration.commandAliases ?? [],
+    ...integration.hostAllowlist ?? []
+  ];
+}
+function hasExactDeclaredCatalogEvidence(candidate, evidence) {
+  if (evidence.length === 0)
+    return false;
+  const normalizedEvidence = new Set(evidence.map(normalizeForDirectMatch));
+  return candidate.matchText.map(normalizeForDirectMatch).some((value) => normalizedEvidence.has(value));
+}
+function tokenizeForMatch(value) {
+  const normalized = value.toLowerCase().replace(/^(@?modelcontextprotocol\/)?server[-_/]/, "").replace(/^(api|cli|mcp):/, "").replace(/(_tools|_mcp|_api)$/, "");
+  return uniqueStrings(normalized.split(/[^a-z0-9]+/).map((token) => token.replace(/(_tools|_mcp|_api)$/, "")).filter((token) => token.length >= 2 && !MATCH_STOP_WORDS.has(token)));
+}
+function normalizeForDirectMatch(value) {
+  return value.trim().toLowerCase();
+}
+function withoutMatchText(candidate) {
+  return {
+    candidateId: buildCandidateId(candidate),
+    localSource: candidate.localSource,
+    localLabel: candidate.localLabel,
+    detectedKind: candidate.detectedKind,
+    redactedLocator: candidate.redactedLocator
+  };
+}
+function buildCandidateId(candidate) {
+  return `local_${createHash2("sha256").update([candidate.localSource, candidate.localLabel, candidate.redactedLocator].join("\x00")).digest("hex").slice(0, 12)}`;
+}
+function dedupeRawCandidates(candidates) {
+  const byKey = new Map;
+  for (const candidate of candidates) {
+    byKey.set(`${candidate.localSource}:${candidate.localLabel}:${candidate.redactedLocator}`, candidate);
+  }
+  return [...byKey.values()];
+}
+function buildCatalogSearchQueries(candidates) {
+  return uniqueStrings(candidates.map((candidate) => {
+    const tokens = tokenizeForMatch(`${candidate.localLabel} ${candidate.redactedLocator}`);
+    return tokens.join(" ");
+  }).filter(isString));
+}
+function uniqueStrings(values) {
+  return [...new Set(values)];
+}
+function isString(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function isHighEntropySecretLike(value) {
+  if (value.length < HIGH_ENTROPY_MIN_LENGTH)
+    return false;
+  const classes = [/[a-z]/.test(value), /[A-Z]/.test(value), /\d/.test(value), /[_+=.-]/.test(value)].filter(Boolean).length;
+  if (classes < 3)
+    return false;
+  return shannonEntropy(value) >= HIGH_ENTROPY_MIN_BITS_PER_CHAR;
+}
+function shannonEntropy(value) {
+  const counts = new Map;
+  for (const char of value)
+    counts.set(char, (counts.get(char) ?? 0) + 1);
+  return [...counts.values()].reduce((sum, count) => {
+    const probability = count / value.length;
+    return sum - probability * Math.log2(probability);
+  }, 0);
+}
+
+// src/localIntegrationValidation.ts
+var READ_ONLY_VALIDATION_CAPABILITY_PATTERN = /(^|[._:-])(me|whoami|authenticated[-_]?user|get[-_]?authenticated[-_]?user|current[-_]?user|user[-_]?info|account[-_]?info|account[-_]?metadata|profile|get[-_]?profile|workspace[-_]?info|team[-_]?info|token[-_]?introspect|auth[-_]?test)($|[._:-])/i;
+var READ_ONLY_VALIDATION_DESCRIPTION_PATTERN = /\b(current user|authenticated user|account metadata|workspace metadata|team metadata|token introspection|profile)\b/i;
+var UNSAFE_VALIDATION_CAPABILITY_PATTERN = /\b(create|delete|update|send|post|write|modify|invite|remove|upload|charge|payment|transfer)\b/i;
+function isReadOnlyValidationCapability(capability) {
+  const haystack = `${capability.name} ${capability.description}`;
+  if (UNSAFE_VALIDATION_CAPABILITY_PATTERN.test(haystack))
+    return false;
+  return READ_ONLY_VALIDATION_CAPABILITY_PATTERN.test(capability.name) || READ_ONLY_VALIDATION_DESCRIPTION_PATTERN.test(capability.description);
+}
+
 // src/parser.ts
 var RESERVED_CLI_FLAGS = ["base-url", "json", "tui", "help", "oob", "version", "package", "packages"];
 function parseArgs(argv) {
@@ -901,10 +1636,28 @@ async function callWithRefresh(client, call, deps = defaultDeps) {
 }
 function extractUpgradeMessage(body) {
   const err = body?.error;
-  return err?.message ?? `This @aident-ai/cli version is no longer supported. Run \`npm install -g @aident-ai/cli@latest\` to upgrade.`;
+  return err?.message ?? `This @aident-ai/cli version is no longer supported. Run \`curl -fsSL https://loadout.aident.ai/cli/install.sh | bash\` to upgrade.`;
 }
 
 // src/cli.ts
+var LOADOUT_CAPABILITIES_SEARCH_OPERATION = "loadout_capabilities_search";
+var LOADOUT_CAPABILITIES_EXECUTE_OPERATION = "loadout_capabilities_execute";
+var LOADOUT_CAPABILITIES_FEEDBACK_OPERATION = "loadout_capabilities_feedback";
+var LOADOUT_VAULT_STATUS_OPERATION = "loadout_vault_status";
+var LOADOUT_VAULT_CONNECT_OPERATION = "loadout_vault_connect";
+var LOADOUT_LOCAL_MIGRATION_EVENT_OPERATION = "loadout_vault_local_migration_event";
+var LOCAL_MIGRATION_SEARCH_BATCH_SIZE = 10;
+var LOCAL_MIGRATION_SEARCH_RESULT_MAX_DEPTH = 4;
+var LOCAL_MIGRATION_VALIDATION_SEARCH_QUERIES = [
+  "current user",
+  "authenticated user",
+  "profile",
+  "account info",
+  "workspace info",
+  "team info",
+  "token introspect",
+  "auth test"
+];
 async function main() {
   const argv = process.argv.slice(2);
   const parsed = parseArgs(argv);
@@ -931,11 +1684,18 @@ async function main() {
       await runDoctorCmd(parsed.format);
       return;
     case "setup":
-      await runSetup();
+      await runSetup(parsed);
       return;
     case "config":
       await runConfigCmd(parsed);
       return;
+    case "integrations":
+      if (parsed.positional[1] === "migrate-local") {
+        await runLocalIntegrationMigrationCmd(parsed);
+        return;
+      }
+      await runCommand(parsed);
+      return;
     case "packages":
     case "package":
       await runPackagesCmd(parsed);
@@ -950,30 +1710,15 @@ async function main() {
 async function runHelp(parsed) {
   const client = await getAuthenticatedClient(await getRequestedPackages(parsed));
   if (!client) {
-    if (parsed.format === "json") {
-      logInfo(JSON.stringify({ error: "not-authenticated", message: "Run `aident login` first." }));
-    } else {
-      logInfo(`${colors.bold}Aident CLI v${VERSION}${colors.reset}`);
-      logInfo("");
-      logInfo("Run `aident login` to authenticate, then `aident --help` to list commands.");
-      logInfo("");
-      logInfo("USAGE:");
-      logInfo("  aident login [--oob] [--base-url <url>]   Authenticate with Aident");
-      logInfo("  aident logout                             Revoke the current token");
-      logInfo("  aident whoami                             Show current user");
-      logInfo("  aident config show                        Print persistent config");
-      logInfo("  aident config set <key> <value>           Persist a config value");
-      logInfo("  aident config get <key>                   Read a single value");
-      logInfo("  aident packages add <playbook|intern>     Enable an add-on package");
-      logInfo("  aident doctor                             Validate installation");
-      logInfo("  aident setup                              Interactive setup wizard");
-      logInfo("  aident <domain> <command> [--flag value ...] [--json]");
-    }
+    emitLocalHelp(parsed.format);
     return;
   }
-  const catalog = await fetchCatalog(client);
-  if (!catalog)
+  const catalog = await fetchCatalog(client, { suppressAuthError: true });
+  if (!catalog) {
+    if (!process.exitCode)
+      emitLocalHelp(parsed.format);
     return;
+  }
   if (parsed.format === "json") {
     logInfo(JSON.stringify(catalog));
   } else {
@@ -1192,7 +1937,7 @@ async function runDoctorCmd(format) {
   if (!report.ok)
     process.exitCode = 1;
 }
-async function runSetup() {
+async function runSetup(parsed) {
   logInfo(`${colors.bold}Aident CLI setup${colors.reset}`);
   logInfo("");
   const current = await resolveDefaultBaseUrl();
@@ -1216,9 +1961,122 @@ async function runSetup() {
       logInfo("Skipped login. Run `aident login` whenever you want.");
     }
   }
+  await maybeOfferLocalIntegrationMigration(parsed);
   logInfo("");
   logInfo(`Done. Try ${colors.cyan}aident --help${colors.reset} or ${colors.cyan}aident doctor${colors.reset}.`);
 }
+async function maybeOfferLocalIntegrationMigration(parsed) {
+  if (parsed.format !== "tui")
+    return;
+  const config = await readConfig();
+  if (!shouldOfferLocalIntegrationMigration(config, {
+    stdinIsTTY: process.stdin.isTTY === true,
+    stdoutIsTTY: process.stdout.isTTY === true
+  })) {
+    return;
+  }
+  const client = await getAuthenticatedClient(["loadout"]);
+  if (!client)
+    return;
+  if (!await genIsLocalIntegrationMigrationPromptEnabled(client))
+    return;
+  logInfo("");
+  logInfo(`${colors.bold}Local integration migration${colors.reset}`);
+  await tryRecordLocalMigrationEvent(client, "prompt_shown" /* PromptShown */);
+  const answer = (await readLine("Scan local agent/MCP integration configs and offer supported Loadout connections? [y/N]: ")).trim().toLowerCase();
+  const promptedAt = new Date().toISOString();
+  await setConfigValue(LOCAL_INTEGRATION_MIGRATION_PROMPTED_AT_KEY, promptedAt);
+  if (!isAffirmative(answer)) {
+    await tryRecordLocalMigrationEvent(client, "declined" /* Declined */);
+    await setConfigValue(LOCAL_INTEGRATION_MIGRATION_SKIPPED_AT_KEY, promptedAt);
+    logInfo("Skipped local integration migration.");
+    return;
+  }
+  await tryRecordLocalMigrationEvent(client, "accepted" /* Accepted */);
+  const plan = await genLoadoutLocalIntegrationMigrationPlan(client);
+  await tryRecordLocalMigrationEvent(client, "scan_completed" /* ScanCompleted */, getLocalMigrationPlanTelemetry(plan));
+  logInfo(formatLocalIntegrationMigrationPlan(plan));
+  const connectable = plan.candidates.filter(isConnectableCandidate);
+  if (connectable.length === 0) {
+    await tryRecordLocalMigrationEvent(client, "migration_completed" /* MigrationCompleted */, {
+      ...getLocalMigrationPlanTelemetry(plan),
+      selectedCount: 0,
+      connectedCount: 0,
+      failedCount: 0,
+      skippedCount: 0
+    });
+    await setConfigValue(LOCAL_INTEGRATION_MIGRATION_COMPLETED_AT_KEY, new Date().toISOString());
+    return;
+  }
+  logInfo("");
+  logInfo("Enter `all`, selected numbers, or selected integration IDs to connect now. Press Enter to skip.");
+  const selection = await readLine("Connect selection: ");
+  const selectedIntegrationIds = parseLocalIntegrationSelection(selection, plan);
+  if (selectedIntegrationIds.length === 0) {
+    await tryRecordLocalMigrationEvent(client, "migration_completed" /* MigrationCompleted */, {
+      ...getLocalMigrationPlanTelemetry(plan),
+      selectedCount: 0,
+      connectedCount: 0,
+      failedCount: 0,
+      skippedCount: connectable.length
+    });
+    await setConfigValue(LOCAL_INTEGRATION_MIGRATION_SKIPPED_AT_KEY, new Date().toISOString());
+    logInfo(formatLocalIntegrationSelectionFailure(selection, plan));
+    return;
+  }
+  await tryRecordLocalMigrationEvent(client, "migration_started" /* MigrationStarted */, {
+    ...getLocalMigrationPlanTelemetry(plan),
+    selectedCount: selectedIntegrationIds.length
+  });
+  const result = await genApplyLocalIntegrationMigration(client, plan, selectedIntegrationIds);
+  renderLocalMigrationApplyResult(result, "tui");
+  await genRecordLocalMigrationApplyTelemetry(client, result);
+  await setConfigValue(LOCAL_INTEGRATION_MIGRATION_COMPLETED_AT_KEY, new Date().toISOString());
+}
+async function genIsLocalIntegrationMigrationPromptEnabled(client) {
+  const result = await callWithRefresh(client, (c) => c.getCatalog());
+  if (result.status !== 200)
+    return false;
+  return isLocalIntegrationMigrationPromptEnabled(result.body.loadoutSkill);
+}
+async function runLocalIntegrationMigrationCmd(parsed) {
+  if (parsed.isHelp) {
+    logInfo(renderLocalIntegrationMigrationHelp());
+    return;
+  }
+  const client = await getAuthenticatedClient(["loadout"]);
+  if (!client) {
+    emitLocalCommandResult(parsed.format, false, undefined, "not-authenticated", "Run `aident login` before planning local integration migration.");
+    return;
+  }
+  const plan = await genLoadoutLocalIntegrationMigrationPlan(client);
+  await tryRecordLocalMigrationEvent(client, "scan_completed" /* ScanCompleted */, getLocalMigrationPlanTelemetry(plan));
+  const apply = parsed.flags["apply"] === true;
+  if (!apply) {
+    renderLocalMigrationPlan(plan, parsed.format);
+    return;
+  }
+  const selectedIntegrationIds = parseIntegrationIdsFlag(parsed, plan);
+  if (selectedIntegrationIds.length === 0) {
+    await tryRecordLocalMigrationEvent(client, "migration_completed" /* MigrationCompleted */, {
+      ...getLocalMigrationPlanTelemetry(plan),
+      selectedCount: 0,
+      connectedCount: 0,
+      failedCount: 0,
+      skippedCount: 0,
+      status: "failure"
+    });
+    emitLocalCommandResult(parsed.format, false, undefined, "selection-required", getLocalMigrationSelectionRequiredMessage(parsed, plan));
+    return;
+  }
+  await tryRecordLocalMigrationEvent(client, "migration_started" /* MigrationStarted */, {
+    ...getLocalMigrationPlanTelemetry(plan),
+    selectedCount: selectedIntegrationIds.length
+  });
+  const result = await genApplyLocalIntegrationMigration(client, plan, selectedIntegrationIds);
+  renderLocalMigrationApplyResult(result, parsed.format);
+  await genRecordLocalMigrationApplyTelemetry(client, result);
+}
 async function runCatalog(parsed) {
   const client = await getAuthenticatedClient(await getRequestedPackages(parsed));
   if (!client) {
@@ -1230,9 +2088,460 @@ async function runCatalog(parsed) {
     return;
   logInfo(JSON.stringify(catalog, null, parsed.format === "json" ? 0 : 2));
 }
+async function genLoadoutLocalIntegrationMigrationPlan(client) {
+  return buildLocalIntegrationMigrationPlan({
+    catalogIntegrationResolver: (queries) => genFetchLoadoutIntegrations(client, queries)
+  });
+}
+async function genFetchLoadoutIntegrations(client, queries) {
+  const byId = new Map;
+  for (const queryBatch of chunkStrings(queries, LOCAL_MIGRATION_SEARCH_BATCH_SIZE)) {
+    const result = await callWithRefresh(client, (c) => c.execOperation("loadout", LOADOUT_CAPABILITIES_SEARCH_OPERATION, {
+      queries: queryBatch,
+      types: ["integration"],
+      mode: "keyword",
+      limit: 10
+    }));
+    if (!result.body.success)
+      continue;
+    for (const integration of getLocalMigrationIntegrationsFromSearch(result.body.data)) {
+      byId.set(integration.id, integration);
+    }
+  }
+  return genEnrichLoadoutIntegrationsWithVaultStatus(client, [...byId.values()]);
+}
+async function genEnrichLoadoutIntegrationsWithVaultStatus(client, integrations) {
+  if (integrations.length === 0)
+    return integrations;
+  const result = await callWithRefresh(client, (c) => c.execOperation("loadout", LOADOUT_VAULT_STATUS_OPERATION, {
+    integrationIds: integrations.map((integration) => integration.id)
+  }));
+  if (!result.body.success)
+    return integrations;
+  const status = getLocalMigrationVaultStatus(result.body.data);
+  return integrations.map((integration) => {
+    const state = getLocalMigrationVaultIntegrationState(status, integration.id);
+    const connected = getLocalMigrationVaultIntegrationIds(status, integration.id).some((id) => status.connectionStatus?.[id] === true);
+    return {
+      ...integration,
+      readiness: getLocalMigrationReadiness(state?.readiness) ?? (connected ? "ready" : integration.readiness),
+      setupMode: state?.setupMode ?? integration.setupMode
+    };
+  });
+}
+async function genApplyLocalIntegrationMigration(client, plan, selectedIntegrationIds) {
+  const connectableIds = new Set(plan.candidates.filter(isConnectableCandidate).map((candidate) => candidate.loadoutIntegrationId).filter((value) => typeof value === "string"));
+  const connectResults = [];
+  for (const integrationId of selectedIntegrationIds) {
+    if (!connectableIds.has(integrationId)) {
+      connectResults.push({ integrationId, skipped: "not-connectable" });
+      continue;
+    }
+    const result = await callWithRefresh(client, (c) => c.execOperation("loadout", LOADOUT_VAULT_CONNECT_OPERATION, { integrationId }));
+    const entry = { integrationId, result: result.body };
+    if (result.body.success) {
+      entry.validation = await genValidateLocalIntegrationConnection(client, integrationId);
+      if (!entry.validation.success) {
+        await trySubmitLocalMigrationFeedback(client, integrationId, formatLocalMigrationValidationFeedback(entry));
+      }
+    }
+    connectResults.push(entry);
+  }
+  return { plan, selectedIntegrationIds, connectResults };
+}
+async function tryRecordLocalMigrationEvent(client, action, properties = {}) {
+  try {
+    await callWithRefresh(client, (c) => c.execOperation("loadout", LOADOUT_LOCAL_MIGRATION_EVENT_OPERATION, {
+      action,
+      ...properties
+    }));
+  } catch (error) {
+    if (process.env.AIDENT_CLI_DEBUG === "1") {
+      logErr(`Telemetry skipped: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+}
+async function genValidateLocalIntegrationConnection(client, integrationId) {
+  const result = await callWithRefresh(client, (c) => c.execOperation("loadout", LOADOUT_VAULT_STATUS_OPERATION, { integrationId }));
+  if (!result.body.success) {
+    return {
+      success: false,
+      result: result.body,
+      message: result.body.error?.message ?? "Vault status validation failed."
+    };
+  }
+  const status = getLocalMigrationVaultStatus(result.body.data);
+  const ids = getLocalMigrationVaultIntegrationIds(status, integrationId);
+  const connected = ids.some((id) => status.connectionStatus?.[id] === true);
+  const ready = ids.some((id) => status.integrationStates?.[id]?.readiness === "ready");
+  const success = connected || ready;
+  if (!success) {
+    return {
+      success: false,
+      result: result.body,
+      message: "Vault status did not confirm a connected or ready integration."
+    };
+  }
+  const providerValidation = await genTryValidateLocalIntegrationWithReadOnlyCapability(client, integrationId);
+  if (providerValidation.available) {
+    return {
+      success: providerValidation.result.success,
+      result: providerValidation.result,
+      providerCapabilityName: providerValidation.capabilityName,
+      message: providerValidation.result.success ? undefined : providerValidation.result.error?.message ?? "Read-only provider validation failed."
+    };
+  }
+  return {
+    success: true,
+    result: result.body,
+    message: providerValidation.reason
+  };
+}
+async function genTryValidateLocalIntegrationWithReadOnlyCapability(client, integrationId) {
+  const capabilities = await genListLocalMigrationValidationCapabilities(client, integrationId);
+  const capability = capabilities.find(isReadOnlyValidationCapability);
+  if (!capability) {
+    return {
+      available: false,
+      reason: "No low-risk read-only validation capability was available; Vault status confirmed the connection."
+    };
+  }
+  const result = await callWithRefresh(client, (c) => c.execOperation("loadout", LOADOUT_CAPABILITIES_EXECUTE_OPERATION, {
+    name: capability.name,
+    input: {}
+  }));
+  return { available: true, capabilityName: capability.name, result: result.body };
+}
+async function genListLocalMigrationValidationCapabilities(client, integrationId) {
+  const result = await callWithRefresh(client, (c) => c.execOperation("loadout", LOADOUT_CAPABILITIES_SEARCH_OPERATION, {
+    queries: LOCAL_MIGRATION_VALIDATION_SEARCH_QUERIES,
+    types: ["action"],
+    scope: { integrationId },
+    mode: "keyword",
+    limit: 5
+  }));
+  if (!result.body.success)
+    return [];
+  return getLocalMigrationCapabilitiesFromSearch(result.body.data);
+}
+function getLocalMigrationIntegrationsFromSearch(data) {
+  return getLocalMigrationSearchResults(data).map((entry) => {
+    const result = asRecord(entry);
+    if (result?.type !== "integration")
+      return null;
+    const integration = asRecord(result.data);
+    if (!integration)
+      return null;
+    const id = integration?.id;
+    if (typeof id !== "string")
+      return null;
+    const catalogEntry = { id };
+    if (typeof integration.name === "string")
+      catalogEntry.name = integration.name;
+    catalogEntry.providerAliases = getStringArray(integration.providerAliases);
+    catalogEntry.mcpPackages = getStringArray(integration.mcpPackages);
+    catalogEntry.commandAliases = getStringArray(integration.commandAliases);
+    catalogEntry.hostAllowlist = getStringArray(integration.hostAllowlist);
+    if (integration.readiness === "ready" || integration.readiness === "needs_user_setup") {
+      catalogEntry.readiness = integration.readiness;
+    }
+    if (typeof integration.setupMode === "string")
+      catalogEntry.setupMode = integration.setupMode;
+    if (typeof integration.platformCredentialSummary === "string") {
+      catalogEntry.platformCredentialSummary = integration.platformCredentialSummary;
+    }
+    return catalogEntry;
+  }).filter((entry) => entry !== null);
+}
+function getLocalMigrationCapabilitiesFromSearch(data) {
+  return getLocalMigrationSearchResults(data).map((entry) => {
+    const result = asRecord(entry);
+    const capability = asRecord(result?.data);
+    const name = capability?.capabilityName ?? capability?.name;
+    const description = capability?.description;
+    if (typeof name !== "string" || typeof description !== "string")
+      return null;
+    return { name, description };
+  }).filter((entry) => entry !== null);
+}
+function getLocalMigrationSearchResults(data, depth = 0) {
+  if (depth > LOCAL_MIGRATION_SEARCH_RESULT_MAX_DEPTH)
+    return [];
+  const root = asRecord(data);
+  if (Array.isArray(root?.results))
+    return root.results;
+  const resultsByQuery = asRecord(root?.resultsByQuery);
+  if (!resultsByQuery)
+    return [];
+  return Object.values(resultsByQuery).flatMap((entry) => getLocalMigrationSearchResults(entry, depth + 1));
+}
+function asRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function getStringArray(value) {
+  if (!Array.isArray(value))
+    return;
+  const items = value.filter((item) => typeof item === "string" && item.trim() !== "");
+  return items.length > 0 ? items : undefined;
+}
+function chunkStrings(values, size) {
+  const chunks = [];
+  for (let index = 0;index < values.length; index += size) {
+    chunks.push(values.slice(index, index + size));
+  }
+  return chunks;
+}
+async function trySubmitLocalMigrationFeedback(client, integrationId, comment) {
+  try {
+    const result = await callWithRefresh(client, (c) => c.execOperation("loadout", LOADOUT_CAPABILITIES_FEEDBACK_OPERATION, {
+      targetType: "capability",
+      capabilityId: integrationId,
+      capabilityType: "integration",
+      tags: ["auth-failed"],
+      comment: redactSecretLike(comment),
+      surface: "aident-cli-local-migration"
+    }));
+    if (result.body.success) {
+      await tryRecordLocalMigrationEvent(client, "feedback_submitted" /* FeedbackSubmitted */, {
+        integrationId,
+        status: "success"
+      });
+    }
+  } catch (error) {
+    if (process.env.AIDENT_CLI_DEBUG === "1") {
+      logErr(`Feedback skipped: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+}
+function formatLocalMigrationValidationFeedback(entry) {
+  const validation = entry.validation;
+  const validationMethod = validation?.providerCapabilityName ? "read_only_capability" : "vault_status";
+  const parts = [
+    "Local integration migration validation failed.",
+    `integrationId=${entry.integrationId}`,
+    `validationMethod=${validationMethod}`
+  ];
+  if (validation?.providerCapabilityName)
+    parts.push(`providerCapability=${validation.providerCapabilityName}`);
+  if (validation?.result?.error?.code)
+    parts.push(`errorCode=${validation.result.error.code}`);
+  return parts.join(" ");
+}
+function getLocalMigrationVaultStatus(data) {
+  const root = asRecord(data);
+  return {
+    connectionStatus: getBooleanRecord(root?.connectionStatus),
+    integrationStates: getIntegrationStateRecord(root?.integrationStates),
+    normalizedIntegrationIds: getStringRecord(root?.normalizedIntegrationIds)
+  };
+}
+function getBooleanRecord(value) {
+  const record = asRecord(value);
+  if (!record)
+    return;
+  const result = {};
+  for (const [key, item] of Object.entries(record)) {
+    if (typeof item === "boolean")
+      result[key] = item;
+  }
+  return result;
+}
+function getStringRecord(value) {
+  const record = asRecord(value);
+  if (!record)
+    return;
+  const result = {};
+  for (const [key, item] of Object.entries(record)) {
+    if (typeof item === "string")
+      result[key] = item;
+  }
+  return result;
+}
+function getIntegrationStateRecord(value) {
+  const record = asRecord(value);
+  if (!record)
+    return;
+  const result = {};
+  for (const [key, item] of Object.entries(record)) {
+    const state = asRecord(item);
+    if (!state)
+      continue;
+    result[key] = {
+      readiness: typeof state.readiness === "string" ? state.readiness : undefined,
+      setupMode: typeof state.setupMode === "string" ? state.setupMode : undefined
+    };
+  }
+  return result;
+}
+function getLocalMigrationVaultIntegrationIds(status, integrationId) {
+  return [integrationId, status.normalizedIntegrationIds?.[integrationId]].filter(isString2);
+}
+function getLocalMigrationVaultIntegrationState(status, integrationId) {
+  return getLocalMigrationVaultIntegrationIds(status, integrationId).map((id) => status.integrationStates?.[id]).find((state) => state !== undefined);
+}
+function getLocalMigrationReadiness(value) {
+  if (value === "ready" || value === "needs_user_setup")
+    return value;
+  return;
+}
+async function genRecordLocalMigrationApplyTelemetry(client, result) {
+  for (const entry of result.connectResults) {
+    if (entry.skipped)
+      continue;
+    await tryRecordLocalMigrationEvent(client, "candidate_connected" /* CandidateConnected */, {
+      integrationId: entry.integrationId,
+      status: entry.result?.success ? "success" : "failure"
+    });
+    if (entry.validation) {
+      await tryRecordLocalMigrationEvent(client, entry.validation.success ? "validation_succeeded" /* ValidationSucceeded */ : "validation_failed" /* ValidationFailed */, {
+        integrationId: entry.integrationId,
+        status: entry.validation.success ? "success" : "failure"
+      });
+    }
+  }
+  await tryRecordLocalMigrationEvent(client, "migration_completed" /* MigrationCompleted */, {
+    ...getLocalMigrationPlanTelemetry(result.plan),
+    selectedCount: result.selectedIntegrationIds.length,
+    connectedCount: result.connectResults.filter((entry) => entry.validation?.success === true).length,
+    failedCount: result.connectResults.filter(isFailedLocalMigrationConnectResult).length,
+    skippedCount: result.connectResults.filter((entry) => entry.skipped).length,
+    status: result.connectResults.some(isFailedLocalMigrationConnectResult) ? "failure" : "success"
+  });
+}
+function isFailedLocalMigrationConnectResult(entry) {
+  return entry.result?.success === false || entry.validation?.success === false;
+}
+function isString2(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function getLocalMigrationPlanTelemetry(plan) {
+  return {
+    candidateCount: plan.candidates.length,
+    supportedCount: countCandidates(plan.candidates, "supported"),
+    alreadyConnectedCount: countCandidates(plan.candidates, "already_connected"),
+    needsUserConnectionCount: countCandidates(plan.candidates, "needs_user_connection"),
+    unsupportedCount: countCandidates(plan.candidates, "unsupported")
+  };
+}
+function countCandidates(candidates, status) {
+  return candidates.filter((candidate) => candidate.status === status).length;
+}
+function renderLocalMigrationPlan(plan, format) {
+  if (format === "json") {
+    logInfo(JSON.stringify({ success: true, data: plan }));
+    return;
+  }
+  logInfo(`${colors.bold}Local integration migration plan${colors.reset}`);
+  logInfo(formatLocalIntegrationMigrationPlan(plan));
+  const connectableIds = plan.candidates.filter(isConnectableCandidate).map((candidate) => candidate.loadoutIntegrationId).filter((value) => typeof value === "string");
+  if (connectableIds.length > 0) {
+    logInfo("");
+    logInfo(`Connect selected integrations with ${colors.cyan}aident integrations migrate-local --apply --integrationIds ${connectableIds.join(",")}${colors.reset}`);
+  }
+}
+function renderLocalMigrationApplyResult(result, format) {
+  const failed = result.connectResults.some(isFailedLocalMigrationConnectResult);
+  if (format === "json") {
+    logInfo(JSON.stringify({ success: !failed, data: result }));
+    if (failed)
+      process.exitCode = 1;
+    return;
+  }
+  logInfo(`${colors.bold}Loadout connection results${colors.reset}`);
+  for (const entry of result.connectResults) {
+    if (entry.skipped) {
+      logInfo(`  ${colors.yellow}-${colors.reset} ${entry.integrationId}: skipped (${entry.skipped})`);
+      continue;
+    }
+    if (entry.result?.success) {
+      const validation = entry.validation?.success === true ? ` ${colors.dim}(${getLocalMigrationValidationLabel(entry.validation)})${colors.reset}` : "";
+      logInfo(`  ${colors.green}ok${colors.reset} ${entry.integrationId}${validation}`);
+      if (entry.result.data !== undefined)
+        logInfo(JSON.stringify(entry.result.data, null, 2));
+      if (entry.validation?.success === true && entry.validation.message) {
+        logInfo(`  ${colors.dim}${entry.validation.message}${colors.reset}`);
+      }
+      if (entry.validation?.success === false) {
+        logErr(`  ${colors.red}x${colors.reset} ${entry.integrationId}: ${entry.validation.message ?? "Validation failed"}`);
+      }
+    } else {
+      logErr(`  ${colors.red}x${colors.reset} ${entry.integrationId}: ${entry.result?.error?.message ?? "Unable to connect"}`);
+    }
+  }
+  if (failed)
+    process.exitCode = 1;
+}
+function getLocalMigrationValidationLabel(validation) {
+  if (validation.providerCapabilityName)
+    return "provider validated";
+  if (validation.message)
+    return "provider validation skipped";
+  return "connection confirmed";
+}
+function parseIntegrationIdsFlag(parsed, plan) {
+  const raw = parsed.flags["integrationIds"];
+  const parseValues = (values) => {
+    const tokens = values.flatMap((value) => value.split(",")).map((value) => value.trim()).filter(Boolean);
+    if (tokens.some((token) => token.toLowerCase() === "all"))
+      return parseLocalIntegrationSelection("all", plan);
+    return tokens;
+  };
+  if (typeof raw === "string") {
+    return parseValues([raw]);
+  }
+  if (Array.isArray(raw)) {
+    return parseValues(raw.filter((value) => typeof value === "string"));
+  }
+  return [];
+}
+function getLocalMigrationSelectionRequiredMessage(parsed, plan) {
+  const raw = parsed.flags["integrationIds"];
+  if (typeof raw === "string")
+    return formatLocalIntegrationSelectionFailure(raw, plan);
+  if (Array.isArray(raw))
+    return formatLocalIntegrationSelectionFailure(raw.join(","), plan);
+  return "Pass --integrationIds with comma-separated integration IDs, or --integrationIds all.";
+}
+function emitLocalCommandResult(format, success, data, code, message) {
+  if (format === "json") {
+    logInfo(JSON.stringify({
+      success,
+      data,
+      error: success ? undefined : { code, message }
+    }));
+  } else if (success) {
+    logInfo(JSON.stringify(data, null, 2));
+  } else {
+    logErr(`${colors.red}x ${code}:${colors.reset} ${message}`);
+  }
+  if (!success)
+    process.exitCode = 1;
+}
+function renderLocalIntegrationMigrationHelp() {
+  return [
+    `${colors.bold}aident integrations migrate-local${colors.reset}`,
+    "",
+    "Plan or start migration from local MCP/agent integration configs into Aident Loadout.",
+    "",
+    "USAGE:",
+    "  aident integrations migrate-local [--json]",
+    "  aident integrations migrate-local --apply --integrationIds <ids|all> [--json]",
+    "",
+    "The command scans known local MCP config files, redacts secret-like values, maps supported providers to Loadout,",
+    "and uses existing Vault/OAuth connect flows. Applying a migration requires an explicit selected subset or all."
+  ].join(`
+`);
+}
+function isAffirmative(value) {
+  return value === "y" || value === "yes";
+}
 async function runCommand(parsed) {
   const client = await getAuthenticatedClient(await getRequestedPackages(parsed));
   if (!client) {
+    if (parsed.isHelp) {
+      emitLocalHelp(parsed.format);
+      return;
+    }
     if (parsed.format === "json") {
       logInfo(JSON.stringify({ success: false, error: { code: "not-authenticated", message: "Run `aident login` first." } }));
     } else {
@@ -1241,9 +2550,12 @@ async function runCommand(parsed) {
     process.exitCode = 1;
     return;
   }
-  const catalog = await fetchCatalog(client);
-  if (!catalog)
+  const catalog = await fetchCatalog(client, { suppressAuthError: parsed.isHelp });
+  if (!catalog) {
+    if (parsed.isHelp && !process.exitCode)
+      emitLocalHelp(parsed.format);
     return;
+  }
   const resolved = resolveCommand(parsed.positional, catalog.commands);
   if (!resolved?.command) {
     if (resolved && (parsed.isHelp || parsed.format === "tui")) {
@@ -1334,6 +2646,7 @@ async function getRequestedPackages(parsed) {
 }
 async function getAuthenticatedClient(packages) {
   const activePackages = packages ?? await resolveDefaultPackages();
+  const installedSkillVersion = await findInstalledLoadoutSkillVersion();
   const envToken = process.env.AIDENT_TOKEN;
   const envBaseUrl = process.env.AIDENT_BASE_URL?.trim();
   if (envToken) {
@@ -1342,7 +2655,7 @@ async function getAuthenticatedClient(packages) {
       base_url: normalizeBaseUrl(baseUrl),
       client_id: "",
       access_token: envToken
-    }, "env", activePackages);
+    }, "env", activePackages, installedSkillVersion);
   }
   let creds = await readCredentials();
   if (!creds)
@@ -1357,17 +2670,19 @@ async function getAuthenticatedClient(packages) {
       creds = refreshed;
     }
   }
-  return new CliClient(creds, "stored", activePackages);
+  return new CliClient(creds, "stored", activePackages, installedSkillVersion);
 }
 var catalogCache = null;
-async function fetchCatalog(client) {
+async function fetchCatalog(client, options = {}) {
   const packagesKey = client.activePackages.join(",");
   if (catalogCache && catalogCache.packagesKey === packagesKey)
     return catalogCache.catalog;
   const res = await callWithRefresh(client, (c) => c.getCatalog());
   if (res.status === 401) {
-    logErr(`Not authenticated (HTTP ${res.status}). Run \`aident login\`.`);
-    process.exitCode = 1;
+    if (!options.suppressAuthError) {
+      logErr(`Not authenticated (HTTP ${res.status}). Run \`aident login\`.`);
+      process.exitCode = 1;
+    }
     return null;
   }
   if (res.status !== 200 || !isCommandCatalog(res.body)) {
@@ -1376,8 +2691,18 @@ async function fetchCatalog(client) {
     return null;
   }
   catalogCache = { packagesKey, catalog: res.body };
+  for (const warning of formatLoadoutSkillWarnings(res.body.loadoutSkill)) {
+    logErr(warning);
+  }
   return catalogCache.catalog;
 }
+function emitLocalHelp(format) {
+  if (format === "json") {
+    logInfo(JSON.stringify(getLocalHelp(VERSION)));
+    return;
+  }
+  logInfo(renderLocalHelp(VERSION));
+}
 function formatConfigValue(value) {
   return Array.isArray(value) ? value.join(",") : String(value);
 }