@cargo-ai/cli 1.0.143 → 1.0.146

package/README.md

@@ -246,7 +246,7 @@ Other release verbs (`list`, `get <uuid>`, `get-deployed`, `get-draft`, `update-
 
 ## Agent Skills
 
-[Cargo Skills](https://github.com/getcargohq/cargo-skills) teaches AI coding agents (Claude Code, Codex, Cursor, Windsurf, GitHub Copilot, Hermes Agent, etc.) how to use this CLI — seventeen skills covering lead sourcing, enrichment, email verification, lead scoring, CRM sync, buying-signal monitoring, orchestration, storage, and projects (GTM as Code).
+[Cargo Skills](https://github.com/getcargohq/cargo-skills) teaches AI coding agents (Claude Code, Codex, Cursor, Windsurf, GitHub Copilot, Hermes Agent, etc.) how to use this CLI: the Cargo skills bundle covers lead sourcing, enrichment, email verification, lead scoring, CRM sync, buying-signal monitoring, orchestration, storage, and projects (GTM as Code).
 
 **Let your agent install everything.** Paste this into Claude Code, Codex, or Cursor and it handles the CLI, sign-in, and skills for its own platform:
 

package/build/agentMode.d.ts

@@ -0,0 +1,30 @@
+/// <reference types="node" resolution-mode="require"/>
+export type AgentContext = {
+    /** The harness that launched this process, e.g. `claude-code`. */
+    codingAgent: string | undefined;
+    ci: boolean;
+    stdoutIsTty: boolean;
+    stderrIsTty: boolean;
+    /**
+     * True whenever nobody can be expected to answer or watch: a coding agent
+     * (whose PTY can make every stream look like a terminal), CI, or a stdout
+     * that is not a terminal.
+     */
+    nonInteractive: boolean;
+};
+export declare function readAgentContext(env?: NodeJS.ProcessEnv, streams?: {
+    stdoutIsTty: boolean;
+    stderrIsTty: boolean;
+}): AgentContext;
+/**
+ * Whether stderr may carry terminal UI (colour, spinners, multi-line human
+ * errors). A coding agent's PTY reports a TTY, so the TTY alone cannot decide.
+ */
+export declare function canDrawOnStderr(context?: AgentContext): boolean;
+/**
+ * Whether this run may block on a person typing into the terminal. Unlike the
+ * pipe rule above, a piped stdout alone does not refuse: `cargo-ai login | jq`
+ * by hand still has someone at /dev/tty.
+ */
+export declare function mayWaitForPerson(context?: AgentContext): boolean;
+//# sourceMappingURL=agentMode.d.ts.map

package/build/agentMode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentMode.d.ts","sourceRoot":"","sources":["../src/agentMode.ts"],"names":[],"mappings":";AAgBA,MAAM,MAAM,YAAY,GAAG;IACzB,kEAAkE;IAClE,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,wBAAgB,gBAAgB,CAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE;IAAE,WAAW,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAGpD,GACA,YAAY,CAYd;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,OAAO,GAAE,YAAiC,GACzC,OAAO,CAMT;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,GAAE,YAAiC,GACzC,OAAO,CAET"}

package/build/agentMode.js

@@ -0,0 +1,45 @@
+// Who is on the other end of this process: a person at a terminal, or a coding
+// agent, CI job or pipe that can read output but never answer a question.
+//
+// Agent detection itself lives in `@cargo-ai/cdk/cli` (`detectCodingAgent`),
+// which already gates every clack prompt and names the harness to the backend;
+// this module only adds what the `cargo-ai` bin needs on top: the TTY facts,
+// and one answer to "may this run behave like a terminal UI" for the places
+// that do their own drawing (spinners, colour, the error format, /dev/tty
+// prompts, opening a browser).
+//
+// The rule, after trigger.dev's CLI: when an agent is detected, never prompt
+// (fail with the flag that answers the question), never animate, never open a
+// browser nobody asked for, and keep stderr to lines a model can parse.
+import { detectCodingAgent, isCiEnvironment } from "@cargo-ai/cdk/cli";
+export function readAgentContext(env = process.env, streams = {
+    stdoutIsTty: process.stdout.isTTY === true,
+    stderrIsTty: process.stderr.isTTY === true,
+}) {
+    const codingAgent = detectCodingAgent(env);
+    const ci = isCiEnvironment(env);
+    return {
+        codingAgent,
+        ci,
+        stdoutIsTty: streams.stdoutIsTty,
+        stderrIsTty: streams.stderrIsTty,
+        nonInteractive: codingAgent !== undefined || ci === true || streams.stdoutIsTty === false,
+    };
+}
+/**
+ * Whether stderr may carry terminal UI (colour, spinners, multi-line human
+ * errors). A coding agent's PTY reports a TTY, so the TTY alone cannot decide.
+ */
+export function canDrawOnStderr(context = readAgentContext()) {
+    return (context.stderrIsTty === true &&
+        context.codingAgent === undefined &&
+        context.ci === false);
+}
+/**
+ * Whether this run may block on a person typing into the terminal. Unlike the
+ * pipe rule above, a piped stdout alone does not refuse: `cargo-ai login | jq`
+ * by hand still has someone at /dev/tty.
+ */
+export function mayWaitForPerson(context = readAgentContext()) {
+    return context.codingAgent === undefined && context.ci === false;
+}

package/build/commands/auth/email.js

@@ -81,7 +81,7 @@ async function resolveCode(opts) {
     success(`Verification code sent to ${opts.email}.`);
     const promptInput = openPromptInput();
     if (promptInput === undefined) {
-        info(`No interactive terminal available. Re-run with the code: ${opts.resumeCommand}`);
+        info(`No interactive terminal to type the code into. Get the code from ${opts.email}'s inbox (ask the user if you are an agent), then run: ${opts.resumeCommand}`);
         return undefined;
     }
     try {

package/build/commands/auth/workspace.d.ts

@@ -15,6 +15,23 @@ export declare function resolveWorkspace(opts: {
     explicitUuid: string | undefined;
     explicitName: string | undefined;
 }): Promise<WorkspaceResolution>;
+/**
+ * Without a terminal nothing can be picked, so the error itself has to carry
+ * the choice: every workspace with its uuid, and the flag that selects one.
+ * The sign-in is not saved, and an emailed code works once, so the command is
+ * re-run from the start.
+ *
+ * Exported for tests; `resolveWorkspace` is the only production caller.
+ */
+export declare function describeWorkspaceChoice(workspaces: readonly Pick<WorkspaceManagement.Workspace, "uuid" | "name">[]): string;
+/**
+ * The free plan caps how many workspaces one person owns, so naming a new one
+ * can be refused. The fix is to use a workspace that already exists, which the
+ * message lists with the flag that picks it.
+ *
+ * Exported for tests; `createWorkspace` is the only production caller.
+ */
+export declare function describeFreeWorkspaceLimit(name: string, workspaces: readonly Pick<WorkspaceManagement.Workspace, "uuid" | "name">[]): string;
 export declare function findWorkspaceByName(workspaces: readonly WorkspaceManagement.Workspace[], name: string): ResolvedWorkspace | undefined;
 /**
  * The workspace the sign-in Action just created, when it is the account's only

package/build/commands/auth/workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/workspace.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAGzD,OAAO,EAAE,KAAK,GAAG,EAAa,MAAM,cAAc,CAAC;AAUnD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,iBAAiB,CAAC;IAC7B,mFAAmF;IACnF,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAuBF,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAwH/B;AAED,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,SAAS,mBAAmB,CAAC,SAAS,EAAE,EACpD,IAAI,EAAE,MAAM,GACX,iBAAiB,GAAG,SAAS,CAY/B;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,SAAS,IAAI,CACvB,mBAAmB,CAAC,SAAS,EAC7B,MAAM,GAAG,MAAM,GAAG,WAAW,CAC9B,EAAE,EACH,GAAG,EAAE,IAAI,GACR,iBAAiB,GAAG,SAAS,CAkB/B;AAsHD;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ7D"}
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/workspace.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAGzD,OAAO,EAAE,KAAK,GAAG,EAAa,MAAM,cAAc,CAAC;AAUnD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,iBAAiB,CAAC;IAC7B,mFAAmF;IACnF,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAuBF,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAwH/B;AAUD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,SAAS,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,EAAE,GAC1E,MAAM,CASR;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,SAAS,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,EAAE,GAC1E,MAAM,CAsBR;AAED,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,SAAS,mBAAmB,CAAC,SAAS,EAAE,EACpD,IAAI,EAAE,MAAM,GACX,iBAAiB,GAAG,SAAS,CAY/B;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,SAAS,IAAI,CACvB,mBAAmB,CAAC,SAAS,EAC7B,MAAM,GAAG,MAAM,GAAG,WAAW,CAC9B,EAAE,EACH,GAAG,EAAE,IAAI,GACR,iBAAiB,GAAG,SAAS,CAkB/B;AAqJD;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ7D"}

package/build/commands/auth/workspace.js

@@ -55,7 +55,7 @@ export async function resolveWorkspace(opts) {
             }
         }
         return {
-            workspace: await createWorkspace(api, opts.explicitName),
+            workspace: await createWorkspace(api, opts.explicitName, workspaces),
             wasCreated: true,
         };
     }
@@ -92,7 +92,10 @@ export async function resolveWorkspace(opts) {
     }
     const promptInput = openPromptInput();
     if (promptInput === undefined) {
-        failWith("Multiple workspaces available and no interactive terminal; pass --workspace-uuid <uuid> (or set CARGO_WORKSPACE_UUID) to select one.", { code: ExitCodes.InvalidUsage });
+        failWith(describeWorkspaceChoice(workspaces), {
+            code: ExitCodes.InvalidUsage,
+            extra: { workspaces: listWorkspaceChoices(workspaces) },
+        });
     }
     let selectedWorkspace;
     try {
@@ -106,6 +109,49 @@ export async function resolveWorkspace(opts) {
     }
     return { workspace: selectedWorkspace, wasCreated: false };
 }
+function listWorkspaceChoices(workspaces) {
+    return workspaces.map((workspace) => {
+        return { uuid: workspace.uuid, name: workspace.name };
+    });
+}
+/**
+ * Without a terminal nothing can be picked, so the error itself has to carry
+ * the choice: every workspace with its uuid, and the flag that selects one.
+ * The sign-in is not saved, and an emailed code works once, so the command is
+ * re-run from the start.
+ *
+ * Exported for tests; `resolveWorkspace` is the only production caller.
+ */
+export function describeWorkspaceChoice(workspaces) {
+    return [
+        `You have ${String(workspaces.length)} workspaces and there is no interactive terminal to pick one, so this sign-in was not saved.`,
+        "Run the same login command again with --workspace-uuid <uuid> (or set CARGO_WORKSPACE_UUID). With --email, request a new code first: a code works only once.",
+        "Your workspaces:",
+        ...workspaces.map((workspace) => {
+            return `  --workspace-uuid ${workspace.uuid}  (${workspace.name})`;
+        }),
+    ].join("\n");
+}
+/**
+ * The free plan caps how many workspaces one person owns, so naming a new one
+ * can be refused. The fix is to use a workspace that already exists, which the
+ * message lists with the flag that picks it.
+ *
+ * Exported for tests; `createWorkspace` is the only production caller.
+ */
+export function describeFreeWorkspaceLimit(name, workspaces) {
+    const lines = [
+        `Cannot create workspace "${name}": you have reached the free plan's workspace limit.`,
+    ];
+    if (workspaces.length === 0) {
+        lines.push("Upgrade a workspace, or ask a teammate to invite you to theirs.");
+        return lines.join("\n");
+    }
+    lines.push("Use an existing workspace instead: re-run the login command with --workspace-uuid <uuid> in place of --workspace-name. Or upgrade one of them to create more.", "Your workspaces:", ...workspaces.map((workspace) => {
+        return `  --workspace-uuid ${workspace.uuid}  (${workspace.name})`;
+    }));
+    return lines.join("\n");
+}
 export function findWorkspaceByName(workspaces, name) {
     const wanted = name.trim().toLowerCase();
     const matched = workspaces.find((workspace) => {
@@ -142,7 +188,7 @@ async function chooseWorkspace(api, workspaces) {
     if (workspaces.length === 0) {
         info("You don't have any workspaces yet. Let's create one.");
         return {
-            workspace: await createWorkspace(api, await askWorkspaceName()),
+            workspace: await createWorkspace(api, await askWorkspaceName(), workspaces),
             wasCreated: true,
         };
     }
@@ -169,7 +215,7 @@ async function chooseWorkspace(api, workspaces) {
     });
     if (chosen === CREATE) {
         return {
-            workspace: await createWorkspace(api, await askWorkspaceName()),
+            workspace: await createWorkspace(api, await askWorkspaceName(), workspaces),
             wasCreated: true,
         };
     }
@@ -212,12 +258,33 @@ async function createWorkspaceByAsking(api) {
             code: ExitCodes.InvalidUsage,
         });
     }
-    const workspace = await createWorkspace(api, name);
+    // Only reached with no workspaces, so the limit message has none to list.
+    const workspace = await createWorkspace(api, name, []);
     success(`Created workspace: ${workspace.name} (${workspace.uuid})`);
     return { workspace, wasCreated: true };
 }
-async function createWorkspace(api, name) {
-    const result = await handleApiCall(() => api.workspaceManagement.workspace.create({ name }), { spinner: "Creating workspace..." });
+async function createWorkspace(api, name, 
+// Required, not defaulted: the free-plan-limit message lists these as the
+// way out, and a caller that forgot them printed "you have none" to someone
+// who has several.
+existingWorkspaces) {
+    const result = await handleApiCall(async () => {
+        try {
+            return await api.workspaceManagement.workspace.create({ name });
+        }
+        catch (error) {
+            if (error.reason === "freeWorkspaceLimitReached") {
+                failWith(describeFreeWorkspaceLimit(name, existingWorkspaces), {
+                    code: ExitCodes.InvalidUsage,
+                    extra: {
+                        reason: "freeWorkspaceLimitReached",
+                        workspaces: listWorkspaceChoices(existingWorkspaces),
+                    },
+                });
+            }
+            throw error;
+        }
+    }, { spinner: "Creating workspace..." });
     return { uuid: result.workspace.uuid, name: result.workspace.name };
 }
 /**

package/build/commands/authHints.d.ts

@@ -0,0 +1,8 @@
+/** Sends a code to the address; creates the account on first use. */
+export declare const LOGIN_EMAIL_COMMAND = "cargo-ai login --email you@company.com";
+/** What a new account starts with (#6543): stated once, here. */
+export declare const SIGNUP_OFFER = "100 free credits for your first month, no card";
+/** What works with no account, so a signed-out agent can keep going. */
+export declare const SIGNED_OUT_WORKS = "Browsing the catalog (`cargo-ai orchestration action list <query>`, `cargo-ai connection integration list`) and `--dry-run` work signed out.";
+export declare const NOT_SIGNED_IN_MESSAGE = "Not signed in. Run `cargo-ai login --email you@company.com`: it emails a code (no browser) and creates the account if it is new, with 100 free credits for your first month, no card. Browsing the catalog (`cargo-ai orchestration action list <query>`, `cargo-ai connection integration list`) and `--dry-run` work signed out.";
+//# sourceMappingURL=authHints.d.ts.map

package/build/commands/authHints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authHints.d.ts","sourceRoot":"","sources":["../../src/commands/authHints.ts"],"names":[],"mappings":"AAGA,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,2CAA2C,CAAC;AAE5E,iEAAiE;AACjE,eAAO,MAAM,YAAY,mDAAmD,CAAC;AAE7E,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,iJACmH,CAAC;AAEjJ,eAAO,MAAM,qBAAqB,uUAAiK,CAAC"}

package/build/commands/authHints.js

@@ -0,0 +1,9 @@
+// The commands a signed-out caller is pointed at. Kept free of imports so the
+// error path (`runHandler.ts`) and the notices can share them without a cycle.
+/** Sends a code to the address; creates the account on first use. */
+export const LOGIN_EMAIL_COMMAND = "cargo-ai login --email you@company.com";
+/** What a new account starts with (#6543): stated once, here. */
+export const SIGNUP_OFFER = "100 free credits for your first month, no card";
+/** What works with no account, so a signed-out agent can keep going. */
+export const SIGNED_OUT_WORKS = "Browsing the catalog (`cargo-ai orchestration action list <query>`, `cargo-ai connection integration list`) and `--dry-run` work signed out.";
+export const NOT_SIGNED_IN_MESSAGE = `Not signed in. Run \`${LOGIN_EMAIL_COMMAND}\`: it emails a code (no browser) and creates the account if it is new, with ${SIGNUP_OFFER}. ${SIGNED_OUT_WORKS}`;

package/build/commands/connection/connector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connector.d.ts","sourceRoot":"","sources":["../../../src/commands/connection/connector.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAcxC,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CAgUN"}
+{"version":3,"file":"connector.d.ts","sourceRoot":"","sources":["../../../src/commands/connection/connector.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAcxC,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CAgUN"}

package/build/commands/connection/connector.js

@@ -1,4 +1,4 @@
-import { awaitBrowserStep, buildCliConnectorCreateUrl, buildCliConnectorEditUrl, isCodingAgent, openBrowser, resolveUserUuid, shouldWaitForPerson, } from "@cargo-ai/cdk/cli";
+import { awaitBrowserStep, buildCliConnectorCreateUrl, buildCliConnectorEditUrl, isCiEnvironment, isCodingAgent, openBrowser, resolveUserUuid, shouldWaitForPerson, } from "@cargo-ai/cdk/cli";
 import { getConfig } from "../../config.js";
 import { parseBooleanOption } from "../../utils/booleanOption.js";
 import { openPromptInput } from "../../utils/prompt.js";
@@ -212,7 +212,7 @@ async function runCreateHandoff(input) {
     // refuses coding agents, whose stdin often looks like a TTY.
     if (shouldWaitForPerson({
         isCodingAgent: isCodingAgent(),
-        isCi: process.env["CI"] === "true",
+        isCi: isCiEnvironment(),
         hasPromptInput: openPromptInput() !== undefined,
     }) === false) {
         outputJson({
@@ -249,7 +249,11 @@ function openConnectorEditForm(connectorUuid) {
         connectorUuid,
     });
     info(["", "Re-authorize the connector here:", `  ${colors.cyan(url)}`, ""].join("\n"));
-    openBrowser(url);
+    // Nobody asked for a browser here: an agent gets the URL above and in the
+    // JSON, and opening a tab on the person's screen mid-session is a surprise.
+    if (isCodingAgent() === false) {
+        openBrowser(url);
+    }
     outputJson({
         ok: true,
         status: "actionRequired",

package/build/commands/doctor.d.ts

@@ -1,3 +1,16 @@
 import type { Command } from "commander";
+import { type ExitCode } from "./runHandler.js";
 export declare function registerDoctorCommand(program: Command, currentVersion: string): void;
+/**
+ * The API result decides first; `--strict` only turns a healthy run with an
+ * outdated CLI into exit 7. An unknown latest version (offline registry) is
+ * not "outdated": the check could not tell.
+ *
+ * Exported for tests.
+ */
+export declare function resolveDoctorExitCode(input: {
+    apiExitCode: ExitCode;
+    cliUpToDate: boolean | null;
+    strict: boolean;
+}): ExitCode;
 //# sourceMappingURL=doctor.d.ts.map

package/build/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+KzC,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,MAAM,GACrB,IAAI,CAkFN"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAazC,OAAO,EAAU,KAAK,QAAQ,EAAyB,MAAM,iBAAiB,CAAC;AAsK/E,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,MAAM,GACrB,IAAI,CA6FN;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,WAAW,EAAE,QAAQ,CAAC;IACtB,WAAW,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,QAAQ,CAUX"}

package/build/commands/doctor.js

@@ -1,12 +1,15 @@
 import { determineIfIsFetcherError } from "@cargo-ai/api";
-import { formatSetupIssues } from "@cargo-ai/cdk/cli";
+import { formatSetupIssues, isCodingAgent, } from "@cargo-ai/cdk/cli";
 import { createApi } from "../api.js";
 import { getConfig } from "../config.js";
 import { getCredentialsPath } from "../credentials.js";
 import { collectSetupIssues, readSkillsPin } from "../setupIssues.js";
 import { fetchLatestSkillsPin, fetchLatestVersion, isOutdated, UPDATE_COMMAND, } from "../version.js";
+import { LOGIN_EMAIL_COMMAND } from "./authHints.js";
 import { colors, ExitCodes, outputJson } from "./runHandler.js";
-const LOGIN_COMMAND = "cargo-ai login --oauth";
+// An agent cannot click through a browser sign-in, but can relay an emailed
+// code: point it at the channel it can finish.
+const LOGIN_COMMAND = isCodingAgent() === true ? LOGIN_EMAIL_COMMAND : "cargo-ai login --oauth";
 const STATUS_PAGE = "https://status.getcargo.io";
 function buildCliCheck(currentVersion, latestVersion) {
     if (latestVersion === undefined) {
@@ -130,13 +133,16 @@ most severe failure:
   1  API unreachable or returned an unexpected error
   3  not authenticated (no credentials, or the API rejected them)
   4  permission denied for the configured workspace
+  7  with --strict only: the CLI is behind the latest npm release (checked
+     after the failures above, so a more severe one still wins)
 
 Scripts and agents should branch on the exit code and read the JSON for details.
 
 Examples:
   $ cargo-ai doctor
-  $ cargo-ai doctor || echo "exit: $?"`)
-        .action(async () => {
+  $ cargo-ai doctor --strict || echo "exit: $?"`)
+        .option("--strict", "Also fail (exit 7) when the CLI is behind the latest release")
+        .action(async (opts) => {
         let latestVersion;
         try {
             latestVersion = await fetchLatestVersion();
@@ -160,7 +166,12 @@ Examples:
             workspaceUuid: config.workspaceUuid !== undefined ? config.workspaceUuid : null,
             credentialsFile: getCredentialsPath(),
         };
-        const { check: api, exitCode } = await checkApi(config);
+        const { check: api, exitCode: apiExitCode } = await checkApi(config);
+        const exitCode = resolveDoctorExitCode({
+            apiExitCode,
+            cliUpToDate: cli.upToDate,
+            strict: opts.strict === true,
+        });
         // One list, most severe first, each entry carrying its own fix — the same
         // shape the pre-command header renders, so a reader who has seen the
         // amber line recognises it here rather than learning a second format.
@@ -188,6 +199,22 @@ Examples:
         process.exit(exitCode);
     });
 }
+/**
+ * The API result decides first; `--strict` only turns a healthy run with an
+ * outdated CLI into exit 7. An unknown latest version (offline registry) is
+ * not "outdated": the check could not tell.
+ *
+ * Exported for tests.
+ */
+export function resolveDoctorExitCode(input) {
+    if (input.apiExitCode !== ExitCodes.Success) {
+        return input.apiExitCode;
+    }
+    if (input.strict === true && input.cliUpToDate === false) {
+        return ExitCodes.Outdated;
+    }
+    return ExitCodes.Success;
+}
 function describeApiIssue(api) {
     if (api.ok === true) {
         return undefined;

package/build/commands/insufficientCredits.d.ts

@@ -0,0 +1,31 @@
+declare const CODES: {
+    readonly notEnoughCredits: "insufficient_credits";
+    readonly userCreditsLimitReached: "user_credits_limit_reached";
+};
+export type InsufficientCreditsCode = (typeof CODES)[keyof typeof CODES];
+export type InsufficientCreditsFix = {
+    kind: string;
+    description: string;
+    url?: string;
+    command?: string;
+};
+export type InsufficientCredits = {
+    code: InsufficientCreditsCode;
+    errorMessage: string | undefined;
+    creditsBalance: number | null;
+    estimatedCreditsCost: number | null;
+    billingUrl: string | null;
+    fixes: InsufficientCreditsFix[];
+};
+/** The error, when `body` is one; undefined for every other API error. */
+export declare function readInsufficientCredits(body: unknown): InsufficientCredits | undefined;
+/**
+ * One line for the message, the fixes as fields. The JSON form (non-TTY or a
+ * coding agent) carries every field verbatim beside `body`.
+ */
+export declare function describeInsufficientCredits(error: InsufficientCredits): {
+    message: string;
+    extra: Record<string, unknown>;
+};
+export {};
+//# sourceMappingURL=insufficientCredits.d.ts.map

package/build/commands/insufficientCredits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"insufficientCredits.d.ts","sourceRoot":"","sources":["../../src/commands/insufficientCredits.ts"],"names":[],"mappings":"AAQA,QAAA,MAAM,KAAK;;;CAGD,CAAC;AAEX,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,OAAO,KAAK,CAAC,CAAC;AAEzE,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,sBAAsB,EAAE,CAAC;CACjC,CAAC;AA8BF,0EAA0E;AAC1E,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,OAAO,GACZ,mBAAmB,GAAG,SAAS,CA8BjC;AAgED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,mBAAmB,GAAG;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC,CAwCA"}

package/build/commands/insufficientCredits.js

@@ -0,0 +1,137 @@
+// The API's out-of-credits error, read back and said in one line a person or
+// an agent can act on.
+//
+// The backend answers `{ reason: "notEnoughCredits" | "userCreditsLimitReached" }`
+// and, since the structured error, also `code`, `errorMessage`,
+// `creditsBalance`, `estimatedCreditsCost`, `billingUrl` and `fixes`. Both
+// shapes are read, so a CLI talking to an older backend still names the fix.
+const CODES = {
+    notEnoughCredits: "insufficient_credits",
+    userCreditsLimitReached: "user_credits_limit_reached",
+};
+// Named when the backend sent no fixes of its own (an older backend).
+const FALLBACK_FIXES = {
+    insufficient_credits: [
+        {
+            kind: "upgradePlan",
+            description: "Buy more credits by raising the plan's allotment",
+            command: "cargo-ai billing subscription update-plan --credits-count <n> --cadence monthly",
+        },
+        {
+            kind: "enableTopup",
+            description: "Top up automatically when credits run low",
+            command: "cargo-ai billing subscription update-topup --enabled --credits-count <n> --threshold <n>",
+        },
+    ],
+    user_credits_limit_reached: [
+        {
+            kind: "askAdmin",
+            description: "Ask a workspace admin to raise or remove your monthly credits limit",
+        },
+    ],
+};
+/** The error, when `body` is one; undefined for every other API error. */
+export function readInsufficientCredits(body) {
+    if (body === null || typeof body !== "object") {
+        return undefined;
+    }
+    const record = body;
+    const code = resolveCode(record);
+    if (code === undefined) {
+        return undefined;
+    }
+    return {
+        code,
+        errorMessage: typeof record["errorMessage"] === "string"
+            ? record["errorMessage"]
+            : undefined,
+        creditsBalance: typeof record["creditsBalance"] === "number"
+            ? record["creditsBalance"]
+            : null,
+        estimatedCreditsCost: typeof record["estimatedCreditsCost"] === "number"
+            ? record["estimatedCreditsCost"]
+            : null,
+        billingUrl: typeof record["billingUrl"] === "string" ? record["billingUrl"] : null,
+        fixes: readFixes(record["fixes"], code),
+    };
+}
+function resolveCode(record) {
+    const code = record["code"];
+    if (code === CODES.notEnoughCredits ||
+        code === CODES.userCreditsLimitReached) {
+        return code;
+    }
+    const reason = record["reason"];
+    if (reason === "notEnoughCredits") {
+        return CODES.notEnoughCredits;
+    }
+    if (reason === "userCreditsLimitReached") {
+        return CODES.userCreditsLimitReached;
+    }
+    return undefined;
+}
+function readFixes(value, code) {
+    if (Array.isArray(value) === false) {
+        return FALLBACK_FIXES[code];
+    }
+    const fixes = value.flatMap((entry) => {
+        if (entry === null || typeof entry !== "object") {
+            return [];
+        }
+        const fix = entry;
+        if (typeof fix["kind"] !== "string" ||
+            typeof fix["description"] !== "string") {
+            return [];
+        }
+        return [
+            {
+                kind: fix["kind"],
+                description: fix["description"],
+                ...(typeof fix["url"] === "string" ? { url: fix["url"] } : {}),
+                ...(typeof fix["command"] === "string"
+                    ? { command: fix["command"] }
+                    : {}),
+            },
+        ];
+    });
+    return fixes.length > 0 ? fixes : FALLBACK_FIXES[code];
+}
+/**
+ * One line for the message, the fixes as fields. The JSON form (non-TTY or a
+ * coding agent) carries every field verbatim beside `body`.
+ */
+export function describeInsufficientCredits(error) {
+    const headline = error.code === CODES.userCreditsLimitReached
+        ? "You have reached your monthly credits limit in this workspace"
+        : "This workspace is out of credits";
+    const balance = error.creditsBalance !== null
+        ? ` (balance: ${formatCredits(error.creditsBalance)}`
+        : "";
+    const cost = error.estimatedCreditsCost !== null
+        ? `${balance === "" ? " (" : ", "}estimated cost: ${formatCredits(error.estimatedCreditsCost)}`
+        : "";
+    const closing = balance !== "" || cost !== "" ? ")" : "";
+    const firstFix = error.fixes[0];
+    const fixHint = firstFix === undefined
+        ? ""
+        : ` ${firstFix.description}${firstFix.command !== undefined
+            ? `: ${firstFix.command}`
+            : firstFix.url !== undefined
+                ? `: ${firstFix.url}`
+                : error.billingUrl !== null
+                    ? `: ${error.billingUrl}`
+                    : ""}.`;
+    return {
+        message: `${headline}${balance}${cost}${closing}.${fixHint}`,
+        extra: {
+            code: error.code,
+            creditsBalance: error.creditsBalance,
+            estimatedCreditsCost: error.estimatedCreditsCost,
+            billingUrl: error.billingUrl,
+            fixes: error.fixes,
+        },
+    };
+}
+function formatCredits(count) {
+    return count.toLocaleString("en-US", { maximumFractionDigits: 2 });
+}

package/build/commands/runHandler.d.ts

@@ -5,6 +5,10 @@ export declare const ExitCodes: {
     readonly NotAuthenticated: 3;
     readonly PermissionDenied: 4;
     readonly NotFound: 5;
+    /** The workspace is out of credits, or the member is over their limit. */
+    readonly InsufficientCredits: 6;
+    /** Only `doctor --strict`: the CLI is behind the latest npm release. */
+    readonly Outdated: 7;
 };
 export type ExitCode = (typeof ExitCodes)[keyof typeof ExitCodes];
 export declare const colorize: (text: string, code: string) => string;
@@ -54,6 +58,18 @@ type HandleApiCallOpts = {
     notAuthenticatedHint?: string;
 };
 export declare function handleApiCall<T>(fn: () => Promise<T>, opts?: HandleApiCallOpts): Promise<T>;
+/**
+ * The message, exit code and machine-readable fields for a failed API call.
+ * `extra` is lifted to the top of the JSON error so an agent can branch on
+ * `code` without digging into `body`.
+ *
+ * Exported for tests.
+ */
+export declare function describeApiError(status: number | undefined, body: unknown, notAuthenticatedHint: string | undefined): {
+    message: string;
+    code: ExitCode;
+    extra?: Record<string, unknown>;
+};
 export declare function sleep(ms: number): Promise<void>;
 /**
  * Poll until the thing reports a `finishedAt`.

package/build/commands/runHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runHandler.d.ts","sourceRoot":"","sources":["../../src/commands/runHandler.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,SAAS;;;;;;;CAOZ,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAOlE,eAAO,MAAM,QAAQ,SAAU,MAAM,QAAQ,MAAM,KAAG,MAKrD,CAAC;AAEF,eAAO,MAAM,MAAM;aACR,MAAM,KAAG,MAAM;eACb,MAAM,KAAG,MAAM;gBACd,MAAM,KAAG,MAAM;cACjB,MAAM,KAAG,MAAM;aAChB,MAAM,KAAG,MAAM;cACd,MAAM,KAAG,MAAM;CAC1B,CAAC;AAEF,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAM/C;AAED,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1C;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE7C;AAID,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUhE;AAED,KAAK,YAAY,GAAG;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,KAAK,CAgCpE;AAQD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAmBlE;AAED,MAAM,MAAM,OAAO,GAAG;IAEpB,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAGlC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAU5B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB,CAAC;AAIF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAwBrD;AAgED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,GAAG,CAQhE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAQ1E;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,OAAO,EAAE,CAAC,EAAE,EACZ,KAAK,EAAE,MAAM,GACZ;IAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CASxD;AAKD,KAAK,iBAAiB,GAAG;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACzB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,wBAAsB,aAAa,CAAC,CAAC,EACnC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,CAAC,CAAC,CAgEZ;AA0ED,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,aAAa,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,IAAI,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EAC9D,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,CAAC,CAyBZ"}
+{"version":3,"file":"runHandler.d.ts","sourceRoot":"","sources":["../../src/commands/runHandler.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,SAAS;;;;;;;IAOpB,0EAA0E;;IAE1E,wEAAwE;;CAEhE,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAMlE,eAAO,MAAM,QAAQ,SAAU,MAAM,QAAQ,MAAM,KAAG,MAKrD,CAAC;AAEF,eAAO,MAAM,MAAM;aACR,MAAM,KAAG,MAAM;eACb,MAAM,KAAG,MAAM;gBACd,MAAM,KAAG,MAAM;cACjB,MAAM,KAAG,MAAM;aAChB,MAAM,KAAG,MAAM;cACd,MAAM,KAAG,MAAM;CAC1B,CAAC;AAEF,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAM/C;AAED,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1C;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE7C;AAKD,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAYhE;AAED,KAAK,YAAY,GAAG;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,KAAK,CA2CpE;AAsBD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAmBlE;AAED,MAAM,MAAM,OAAO,GAAG;IAEpB,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAGlC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAU5B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB,CAAC;AAIF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAwBrD;AAiED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,GAAG,CAQhE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAQ1E;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,OAAO,EAAE,CAAC,EAAE,EACZ,KAAK,EAAE,MAAM,GACZ;IAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CASxD;AAKD,KAAK,iBAAiB,GAAG;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACzB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,wBAAsB,aAAa,CAAC,CAAC,EACnC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,CAAC,CAAC,CAoEZ;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,OAAO,EACb,oBAAoB,EAAE,MAAM,GAAG,SAAS,GACvC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CA8DtE;AAwBD,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,aAAa,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,IAAI,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EAC9D,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,CAAC,CAyBZ"}

package/build/commands/runHandler.js

@@ -1,5 +1,8 @@
 import { determineIfIsFetcherError } from "@cargo-ai/api";
+import { canDrawOnStderr, mayWaitForPerson } from "../agentMode.js";
 import { clipToCells } from "../utils/textWidth.js";
+import { LOGIN_EMAIL_COMMAND } from "./authHints.js";
+import { describeInsufficientCredits, readInsufficientCredits, } from "./insufficientCredits.js";
 export const ExitCodes = {
     Success: 0,
     GenericError: 1,
@@ -7,10 +10,14 @@ export const ExitCodes = {
     NotAuthenticated: 3,
     PermissionDenied: 4,
     NotFound: 5,
+    /** The workspace is out of credits, or the member is over their limit. */
+    InsufficientCredits: 6,
+    /** Only `doctor --strict`: the CLI is behind the latest npm release. */
+    Outdated: 7,
 };
-const useColor = process.stderr.isTTY === true &&
-    process.env["NO_COLOR"] === undefined &&
-    process.env["CI"] !== "true";
+// A coding agent's PTY reports a TTY, and escape codes in what it reads back
+// are noise it has to strip, so colour follows the same rule as the spinner.
+const useColor = canDrawOnStderr() && process.env["NO_COLOR"] === undefined;
 export const colorize = (text, code) => {
     if (useColor !== true) {
         return text;
@@ -39,10 +46,12 @@ export function success(message) {
     console.error(`${colors.green("✓")} ${message}`);
 }
 // Ask a yes/no question on stderr (stdout stays reserved for JSON). Resolves
-// false on a non-TTY stdin (callers should require an explicit --yes there).
+// false on a non-TTY stdin, and for a coding agent or CI whatever stdin looks
+// like (callers should require an explicit --yes there).
 export async function confirm(question) {
-    if (process.stdin.isTTY !== true)
+    if (process.stdin.isTTY !== true || mayWaitForPerson() === false) {
         return false;
+    }
     const { createInterface } = await import("node:readline/promises");
     const rl = createInterface({ input: process.stdin, output: process.stderr });
     try {
@@ -64,10 +73,21 @@ export function failWith(message, opts) {
     if (activeSpinner !== undefined) {
         activeSpinner.stop();
     }
-    if (process.stderr.isTTY === true) {
+    // A person gets the coloured line; anything else (a pipe, CI, a coding
+    // agent even on a PTY) gets one JSON object it can parse.
+    if (canDrawOnStderr() === true) {
         process.stderr.write(`${colors.red("✗")} ${message}\n`);
         if (extra !== undefined) {
             for (const [key, value] of Object.entries(extra)) {
+                if (value === null || value === undefined) {
+                    continue;
+                }
+                if (key === "fixes" && Array.isArray(value)) {
+                    for (const fix of value) {
+                        process.stderr.write(`  ${colors.dim("fix:")} ${formatFix(fix)}\n`);
+                    }
+                    continue;
+                }
                 const valueStr = typeof value === "string" ? value : JSON.stringify(value);
                 process.stderr.write(`  ${colors.dim(`${key}:`)} ${valueStr}\n`);
             }
@@ -82,6 +102,16 @@ export function failWith(message, opts) {
     }
     process.exit(code);
 }
+/** `Top up automatically: cargo-ai billing …`, for the human error format. */
+function formatFix(fix) {
+    const description = typeof fix["description"] === "string" ? fix["description"] : "";
+    const target = typeof fix["command"] === "string"
+        ? colors.cyan(fix["command"])
+        : typeof fix["url"] === "string"
+            ? colors.cyan(fix["url"])
+            : undefined;
+    return target === undefined ? description : `${description}: ${target}`;
+}
 const SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
 const SPINNER_INTERVAL_MS = 80;
 /** Assumed width when the terminal will not say — the conventional default. */
@@ -130,9 +160,10 @@ export function startSpinner(message) {
     return tracked;
 }
 function createSpinner(message) {
-    if (process.stderr.isTTY !== true) {
-        // Non-TTY (CI, piped): no animation — just emit each line so progress is
-        // still visible in logs.
+    if (canDrawOnStderr() === false) {
+        // Non-TTY (CI, piped) or a coding agent: no animation, whose redraws an
+        // agent reads back as a wall of escape codes. Just emit each line so
+        // progress is still visible in logs.
         process.stderr.write(`${message}\n`);
         return {
             update: (m) => process.stderr.write(`${m}\n`),
@@ -254,25 +285,50 @@ export async function handleApiCall(fn, opts) {
                 : parsedError.body !== undefined
                     ? parsedError.body
                     : String(error);
-            const { message, code } = describeApiError(status, body, opts !== undefined ? opts.notAuthenticatedHint : undefined);
+            const { message, code, extra } = describeApiError(status, body, opts !== undefined ? opts.notAuthenticatedHint : undefined);
             failWith(message, {
                 code,
-                extra: { status: status !== undefined ? status : "unknown", body },
+                extra: {
+                    ...extra,
+                    status: status !== undefined ? status : "unknown",
+                    body,
+                },
             });
         }
         throw error;
     }
 }
-function describeApiError(status, body, notAuthenticatedHint) {
+/**
+ * The message, exit code and machine-readable fields for a failed API call.
+ * `extra` is lifted to the top of the JSON error so an agent can branch on
+ * `code` without digging into `body`.
+ *
+ * Exported for tests.
+ */
+export function describeApiError(status, body, notAuthenticatedHint) {
     const detail = extractApiErrorDetail(body);
     const detailSuffix = detail !== undefined ? `: ${detail}` : "";
+    // Checked before the status: the orchestration routes answer it as a 400
+    // and the newer ones as a 402, and either way the fix is the same.
+    const insufficientCredits = readInsufficientCredits(body);
+    if (insufficientCredits !== undefined) {
+        const described = describeInsufficientCredits(insufficientCredits);
+        return {
+            message: described.message,
+            code: ExitCodes.InsufficientCredits,
+            extra: described.extra,
+        };
+    }
     if (status === 401) {
         const hint = notAuthenticatedHint !== undefined
             ? notAuthenticatedHint
-            : "Run `cargo-ai login` to refresh credentials.";
+            : `Sign in again with \`${LOGIN_EMAIL_COMMAND}\` (emails a code, no browser needed).`;
         return {
             message: `Not authenticated${detailSuffix}. ${hint}`,
             code: ExitCodes.NotAuthenticated,
+            extra: notAuthenticatedHint !== undefined
+                ? undefined
+                : { code: "not_authenticated", fix: LOGIN_EMAIL_COMMAND },
         };
     }
     if (status === 403) {

package/build/commands/signedOutNotice.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signedOutNotice.d.ts","sourceRoot":"","sources":["../../src/commands/signedOutNotice.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,eAAe,2CAA2C,CAAC;AAExE,eAAO,MAAM,iBAAiB,gMAA8K,CAAC;AAE7M,wBAAgB,aAAa,IAAI,IAAI,CAIpC"}
+{"version":3,"file":"signedOutNotice.d.ts","sourceRoot":"","sources":["../../src/commands/signedOutNotice.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,eAAe,2CAAsB,CAAC;AAEnD,eAAO,MAAM,iBAAiB,gMAA+I,CAAC;AAE9K,wBAAgB,aAAa,IAAI,IAAI,CAIpC"}

package/build/commands/signedOutNotice.js

@@ -1,9 +1,10 @@
 // What a signed-out caller of a command that reads the public routes is told,
 // once, on stderr: stdout stays the JSON the command was asked for.
 import { isSignedIn } from "@cargo-ai/cdk/cli";
+import { LOGIN_EMAIL_COMMAND, SIGNUP_OFFER } from "./authHints.js";
 import { info } from "./runHandler.js";
-export const SIGN_UP_COMMAND = "cargo-ai login --email you@company.com";
-export const SIGNED_OUT_NOTICE = `Not signed in: reading the official integrations and their actions only. Sign up with \`${SIGN_UP_COMMAND}\` (100 free credits for your first month, no card) to run one.`;
+export const SIGN_UP_COMMAND = LOGIN_EMAIL_COMMAND;
+export const SIGNED_OUT_NOTICE = `Not signed in: reading the official integrations and their actions only. Sign up with \`${SIGN_UP_COMMAND}\` (${SIGNUP_OFFER}) to run one.`;
 export function noteSignedOut() {
     if (isSignedIn() === false) {
         info(SIGNED_OUT_NOTICE);

package/build/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
-import { availableCodingAgents, BRAND, canRunPalette, creditsLeftOf, declareSources, fetchStateConnected, fetchSubscription, fetchWorkspaceName, findProjectDir, formatWorkspaceSuffix, isInteractive, isUnpaidPlan, printSetupIssues, registerCommands as registerCdkCommands, runPalette, SessionExpiredError, skillsInstalledFor, } from "@cargo-ai/cdk/cli";
+import { availableCodingAgents, BRAND, canRunPalette, creditsLeftOf, declareSources, fetchStateConnected, fetchSubscription, fetchWorkspaceName, findProjectDir, formatWorkspaceSuffix, isCodingAgent, isInteractive, isUnpaidPlan, printSetupIssues, registerCommands as registerCdkCommands, runPalette, SessionExpiredError, skillsInstalledFor, } from "@cargo-ai/cdk/cli";
 import { Command } from "commander";
 import { AGENT_SKILLS_HINT } from "./agentSkills.js";
 import { createApi } from "./api.js";
@@ -9,6 +9,7 @@ import { pinAskBooleanFlags } from "./commands/ask/argvFlags.js";
 import { registerAskCommand } from "./commands/ask/index.js";
 import { rewriteChatFlag } from "./commands/ask/rewriteChatFlag.js";
 import { registerAuthCommands } from "./commands/auth/index.js";
+import { LOGIN_EMAIL_COMMAND, NOT_SIGNED_IN_MESSAGE, } from "./commands/authHints.js";
 import { registerBillingCommands } from "./commands/billing/index.js";
 import { registerBookDemoCommand } from "./commands/bookDemo.js";
 import { registerConnectionCommands } from "./commands/connection/index.js";
@@ -37,7 +38,7 @@ import { getConfig } from "./config.js";
 import { removeLegacySessionHooks } from "./legacySessionHooks.js";
 import { buildPaletteLayout } from "./paletteLayout.js";
 import { collectSetupIssues, isSignedIn } from "./setupIssues.js";
-import { cachedLatestSkillsPin, cachedLatestVersion, maybeRefreshUpdateCache, } from "./updateNotifier.js";
+import { cachedLatestSkillsPin, cachedLatestVersion, maybeNoticeOutdatedForAgent, maybeRefreshUpdateCache, } from "./updateNotifier.js";
 const require = createRequire(import.meta.url);
 const { version } = require("../package.json");
 const program = new Command();
@@ -90,9 +91,15 @@ Exit codes:
   0  Success
   1  Generic error
   2  Invalid usage (missing/conflicting flags)
-  3  Not authenticated (run \`cargo-ai login\`)
+  3  Not authenticated (run \`cargo-ai login --email you@company.com\`)
   4  Permission denied
   5  Not found
+  6  Out of credits, or over your monthly credits limit (the error names the fix)
+  7  CLI behind the latest release (\`cargo-ai doctor --strict\` only)
+
+Coding agents (Claude Code, Cursor, Codex, Gemini CLI, Copilot, OpenCode, or
+any harness setting AI_AGENT) and CI get no prompts, spinners or colour, errors
+as one JSON line on stderr, and the exact flag to pass instead of a question.
 
 Run "cargo-ai <command> --help" for details on a specific command group.
 Run "cargo-ai <command> <subcommand> --help" for details on a subcommand.`);
@@ -130,6 +137,13 @@ program.hook("preAction", (_program, action) => {
     if (SETUP_HEADER_SKIP.includes(rootCommandName(action))) {
         return;
     }
+    // A coding agent can run on a PTY, so the TTY check behind the header does
+    // not keep it out. Agents get the one line they can act on instead, and
+    // stderr stays a single parseable JSON error when a command fails.
+    if (isCodingAgent() === true) {
+        maybeNoticeOutdatedForAgent(version);
+        return;
+    }
     printSetupIssues(collectSetupIssues({
         currentVersion: version,
         latestVersion: cachedLatestVersion(),
@@ -147,7 +161,13 @@ function rootCommandName(command) {
 const getApi = () => {
     const { baseUrl, getAccessToken, workspaceUuid } = getConfig();
     if (getAccessToken === undefined) {
-        failWith("Not authenticated. Run 'cargo-ai login --email <email>' (no browser needed) or 'cargo-ai login --oauth'.", { code: ExitCodes.NotAuthenticated });
+        failWith(NOT_SIGNED_IN_MESSAGE, {
+            code: ExitCodes.NotAuthenticated,
+            extra: {
+                code: "not_authenticated",
+                fix: LOGIN_EMAIL_COMMAND,
+            },
+        });
     }
     return createApi({ baseUrl, getAccessToken, workspaceUuid });
 };

package/build/updateNotifier.d.ts

@@ -16,9 +16,29 @@ export declare function cachedLatestSkillsPin(): string | undefined;
  * palette) can put an outdated CLI in that list instead of printing a footer
  * after the fact.
  *
- * Stays silent on non-TTY stderr (scripts/CI), when disabled via
- * `CARGO_NO_UPDATE_NOTIFIER`, and on any network/parse failure — it must
- * never block, delay, or break the command that triggered it.
+ * Skipped on non-TTY stderr (scripts/CI), when disabled via
+ * `CARGO_NO_UPDATE_NOTIFIER`, and silent on any network/parse failure — it
+ * must never block, delay, or break the command that triggered it. A coding
+ * agent is the exception to the TTY rule: it runs without one, and an agent
+ * whose CLI never refreshes this cache would never learn it is behind. The
+ * cost is the same as a person's: one 1.5s-capped fetch a day, after the
+ * command has finished.
  */
 export declare function maybeRefreshUpdateCache(): Promise<string | undefined>;
+/**
+ * The one line a coding agent is told when its CLI is behind, or undefined.
+ * Pure, for tests; `maybeNoticeOutdatedForAgent` is the caller.
+ */
+export declare function formatAgentUpdateNotice(input: {
+    currentVersion: string;
+    latestVersion: string | undefined;
+    lastNoticeAt: number | undefined;
+    now: number;
+}): string | undefined;
+/**
+ * Agents never see the amber setup header (index.ts skips it for them), so the outdated
+ * CLI is said to them as one stderr line instead, at most hourly, from the
+ * cache alone: no network on the command's path.
+ */
+export declare function maybeNoticeOutdatedForAgent(currentVersion: string): void;
 //# sourceMappingURL=updateNotifier.d.ts.map

package/build/updateNotifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"updateNotifier.d.ts","sourceRoot":"","sources":["../src/updateNotifier.ts"],"names":[],"mappings":"AAiBA;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAYxD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAY1D;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAwC3E"}
+{"version":3,"file":"updateNotifier.d.ts","sourceRoot":"","sources":["../src/updateNotifier.ts"],"names":[],"mappings":"AAqBA;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAYxD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAY1D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA2C3E;AAID;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,MAAM,GAAG,SAAS,CAiBrB;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAyBxE"}

package/build/updateNotifier.js

@@ -1,4 +1,5 @@
-import { fetchLatestSkillsPin, fetchLatestVersion, readUpdateCache, writeUpdateCache, } from "./version.js";
+import { isCodingAgent } from "@cargo-ai/cdk/cli";
+import { fetchLatestSkillsPin, fetchLatestVersion, isOutdated, readUpdateCache, UPDATE_COMMAND, writeUpdateCache, } from "./version.js";
 const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // once per day
 const NOTIFY_FETCH_TIMEOUT_MS = 1500;
 const isDisabled = () => {
@@ -41,12 +42,16 @@ export function cachedLatestSkillsPin() {
  * palette) can put an outdated CLI in that list instead of printing a footer
  * after the fact.
  *
- * Stays silent on non-TTY stderr (scripts/CI), when disabled via
- * `CARGO_NO_UPDATE_NOTIFIER`, and on any network/parse failure — it must
- * never block, delay, or break the command that triggered it.
+ * Skipped on non-TTY stderr (scripts/CI), when disabled via
+ * `CARGO_NO_UPDATE_NOTIFIER`, and silent on any network/parse failure — it
+ * must never block, delay, or break the command that triggered it. A coding
+ * agent is the exception to the TTY rule: it runs without one, and an agent
+ * whose CLI never refreshes this cache would never learn it is behind. The
+ * cost is the same as a person's: one 1.5s-capped fetch a day, after the
+ * command has finished.
  */
 export async function maybeRefreshUpdateCache() {
-    if (process.stderr.isTTY !== true) {
+    if (process.stderr.isTTY !== true && isCodingAgent() === false) {
         return cachedLatestVersion();
     }
     if (isDisabled() === true) {
@@ -72,6 +77,9 @@ export async function maybeRefreshUpdateCache() {
                 lastCheck: now,
                 latestVersion,
                 ...(latestSkillsPin !== undefined ? { latestSkillsPin } : {}),
+                ...(cache !== undefined && cache.agentNoticeAt !== undefined
+                    ? { agentNoticeAt: cache.agentNoticeAt }
+                    : {}),
             };
             writeUpdateCache(cache);
         }
@@ -82,3 +90,47 @@ export async function maybeRefreshUpdateCache() {
         return cachedLatestVersion();
     }
 }
+const AGENT_NOTICE_INTERVAL_MS = 60 * 60 * 1000; // once per hour
+/**
+ * The one line a coding agent is told when its CLI is behind, or undefined.
+ * Pure, for tests; `maybeNoticeOutdatedForAgent` is the caller.
+ */
+export function formatAgentUpdateNotice(input) {
+    if (input.latestVersion === undefined) {
+        return undefined;
+    }
+    if (isOutdated(input.currentVersion, input.latestVersion) === false) {
+        return undefined;
+    }
+    if (input.lastNoticeAt !== undefined &&
+        input.now - input.lastNoticeAt < AGENT_NOTICE_INTERVAL_MS) {
+        return undefined;
+    }
+    return `cargo-ai ${input.currentVersion} is behind the latest release ${input.latestVersion}. Update with: ${UPDATE_COMMAND}`;
+}
+/**
+ * Agents never see the amber setup header (index.ts skips it for them), so the outdated
+ * CLI is said to them as one stderr line instead, at most hourly, from the
+ * cache alone: no network on the command's path.
+ */
+export function maybeNoticeOutdatedForAgent(currentVersion) {
+    if (isDisabled() === true || isCodingAgent() === false) {
+        return;
+    }
+    const cache = readUpdateCache();
+    if (cache === undefined) {
+        return;
+    }
+    const now = Date.now();
+    const line = formatAgentUpdateNotice({
+        currentVersion,
+        latestVersion: cache.latestVersion,
+        lastNoticeAt: cache.agentNoticeAt,
+        now,
+    });
+    if (line === undefined) {
+        return;
+    }
+    process.stderr.write(`${line}\n`);
+    writeUpdateCache({ ...cache, agentNoticeAt: now });
+}

package/build/utils/openBrowser.d.ts

@@ -1,7 +1,21 @@
+/// <reference types="node" resolution-mode="require"/>
 /**
  * Best-effort browser launch. Every caller also prints the URL, so a failure
  * here is never fatal: headless boxes and sandboxes simply fall back to the
  * user opening the link themselves.
  */
 export declare function openBrowser(url: string): void;
+/**
+ * The command that hands `url` to the default browser.
+ *
+ * Windows goes through rundll32 rather than `cmd /c start`: cmd parses its
+ * command line, so every `&` in a query string ends the command there and the
+ * browser opens a truncated URL. rundll32 takes the URL as a plain argument.
+ *
+ * Exported for tests.
+ */
+export declare function buildOpenCommand(os: NodeJS.Platform, url: string): {
+    command: string;
+    args: string[];
+};
 //# sourceMappingURL=openBrowser.d.ts.map

package/build/utils/openBrowser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openBrowser.d.ts","sourceRoot":"","sources":["../../src/utils/openBrowser.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAc7C"}
+{"version":3,"file":"openBrowser.d.ts","sourceRoot":"","sources":["../../src/utils/openBrowser.ts"],"names":[],"mappings":";AAGA;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAa7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,CAAC,QAAQ,EACnB,GAAG,EAAE,MAAM,GACV;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CASrC"}

package/build/utils/openBrowser.js

@@ -6,8 +6,7 @@ import { platform } from "node:process";
  * user opening the link themselves.
  */
 export function openBrowser(url) {
-    const command = pickOpenCommand();
-    const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+    const { command, args } = buildOpenCommand(platform, url);
     try {
         const child = spawn(command, args, {
             detached: true,
@@ -20,10 +19,23 @@ export function openBrowser(url) {
         // Intentionally ignored — see above.
     }
 }
-function pickOpenCommand() {
-    if (platform === "darwin")
-        return "open";
-    if (platform === "win32")
-        return "cmd";
-    return "xdg-open";
+/**
+ * The command that hands `url` to the default browser.
+ *
+ * Windows goes through rundll32 rather than `cmd /c start`: cmd parses its
+ * command line, so every `&` in a query string ends the command there and the
+ * browser opens a truncated URL. rundll32 takes the URL as a plain argument.
+ *
+ * Exported for tests.
+ */
+export function buildOpenCommand(os, url) {
+    if (os === "darwin")
+        return { command: "open", args: [url] };
+    if (os === "win32") {
+        return {
+            command: "rundll32",
+            args: ["url.dll,FileProtocolHandler", url],
+        };
+    }
+    return { command: "xdg-open", args: [url] };
 }

package/build/utils/prompt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../../src/utils/prompt.ts"],"names":[],"mappings":";AAIA,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB,CAAC;AAMF,wBAAgB,eAAe,IAAI,WAAW,GAAG,SAAS,CAYzD;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,CAAC,cAAc,EAC5B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkB7B"}
+{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../../src/utils/prompt.ts"],"names":[],"mappings":";AAMA,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB,CAAC;AAWF,wBAAgB,eAAe,IAAI,WAAW,GAAG,SAAS,CAgBzD;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,CAAC,cAAc,EAC5B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkB7B"}

package/build/utils/prompt.js

@@ -1,11 +1,20 @@
 import * as fs from "node:fs";
 import * as readline from "node:readline/promises";
 import * as tty from "node:tty";
+import { mayWaitForPerson } from "../agentMode.js";
 // Interactive prompts must not assume stdin is a terminal: `curl | sh`
 // installers and agent-driven shells pipe stdin while the controlling
 // terminal stays reachable via /dev/tty. Prefer stdin when it is a TTY,
 // otherwise fall back to opening /dev/tty directly.
+//
+// Never for a coding agent or CI: their shells often still reach /dev/tty (the
+// person's terminal, behind the agent), so a prompt there waits for an answer
+// the agent cannot type and the command hangs until the harness kills it.
+// Every caller already has a non-interactive path that names the flag to pass.
 export function openPromptInput() {
+    if (mayWaitForPerson() === false) {
+        return undefined;
+    }
     if (process.stdin.isTTY === true) {
         return { stream: process.stdin, close: () => undefined };
     }

package/build/version.d.ts

@@ -9,6 +9,11 @@ export type UpdateCache = {
      * caches written before it existed, and when that fetch failed.
      */
     latestSkillsPin?: string;
+    /**
+     * Epoch milliseconds of the last time a coding agent was told the CLI is
+     * behind, so the line is repeated hourly rather than on every command.
+     */
+    agentNoticeAt?: number;
 };
 /**
  * Fetch the latest published version of the CLI from the npm registry.

package/build/version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,cAAc,wCAAwC,CAAC;AAEpE,MAAM,MAAM,WAAW,GAAG;IACxB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,GAAE,MAAiC,GAC3C,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,GAAE,MAAiC,GAC3C,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED,wBAAgB,eAAe,IAAI,WAAW,GAAG,SAAS,CAyBzD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAOzD"}
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,cAAc,wCAAwC,CAAC;AAEpE,MAAM,MAAM,WAAW,GAAG;IACxB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,GAAE,MAAiC,GAC3C,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,GAAE,MAAiC,GAC3C,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED,wBAAgB,eAAe,IAAI,WAAW,GAAG,SAAS,CA4BzD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAOzD"}

package/build/version.js

@@ -95,6 +95,9 @@ export function readUpdateCache() {
                 ...(typeof parsed.latestSkillsPin === "string"
                     ? { latestSkillsPin: parsed.latestSkillsPin }
                     : {}),
+                ...(typeof parsed.agentNoticeAt === "number"
+                    ? { agentNoticeAt: parsed.agentNoticeAt }
+                    : {}),
             };
         }
         return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cargo-ai/cli",
-  "version": "1.0.143",
+  "version": "1.0.146",
   "mcpName": "io.github.getcargohq/cargo",
   "private": false,
   "license": "UNLICENSED",
@@ -75,9 +75,9 @@
     "@ai-sdk/harness": "1.0.144",
     "@ai-sdk/harness-claude-code": "1.0.148",
     "@cargo-ai/api": "^1.0.107",
-    "@cargo-ai/app-sdk": "^1.0.11",
-    "@cargo-ai/cdk": "^1.0.137",
-    "@cargo-ai/types": "^1.0.106",
+    "@cargo-ai/app-sdk": "^1.0.12",
+    "@cargo-ai/cdk": "^1.0.140",
+    "@cargo-ai/types": "^1.0.108",
     "@cargo-ai/utils": "^1.0.37",
     "@cargo-ai/worker-sdk": "^1.0.21",
     "@modelcontextprotocol/sdk": "^1.32.0",