@cargo-ai/cli 1.0.67 → 1.0.70

package/README.md

@@ -142,7 +142,6 @@ cargo-ai orchestration workflow --help
 
 | Domain                   | Description                                                       | Example commands                                                                                                              |
 | ------------------------ | ----------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| **init**                 | Workspace initialisation (user, workspace, datasets, etc.)        | `cargo-ai init`                                                                                                               |
 | **orchestration**        | Workflows, plays, runs, batches, tools, templates                 | `cargo-ai orchestration workflow list`, `cargo-ai orchestration run list --workflow-uuid <uuid>`                              |
 | **workspaceManagement**  | Workspaces, users, tokens, roles, folders                         | `cargo-ai workspaceManagement workspaces list`, `cargo-ai workspaceManagement token list`                                     |
 | **storage**              | Datasets, models, relationships, runs, records                    | `cargo-ai storage dataset list`, `cargo-ai storage model list`                                                                |

package/build/commands/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,OAAO,EAAU,MAAM,WAAW,CAAC;AAGjD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AA0BxD,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CA2GN;AAiGD,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,WAAW,GAAG,SAAS,EACpC,IAAI,EAAE,aAAa,GAClB,cAAc,CAchB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,OAAO,EAAU,MAAM,WAAW,CAAC;AAGjD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AA0BxD,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CAsIN;AAiGD,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,WAAW,GAAG,SAAS,EACpC,IAAI,EAAE,aAAa,GAClB,cAAc,CAchB"}

package/build/commands/auth/index.js

@@ -1,4 +1,4 @@
-import { revokeSession } from "@cargo-ai/cdk/cli";
+import { declarePrompt, revokeSession } from "@cargo-ai/cdk/cli";
 import { Option } from "commander";
 import { AGENT_SKILLS_NEXT_STEP } from "../../agentSkills.js";
 import { getConfig } from "../../config.js";
@@ -10,7 +10,7 @@ import { selectLoginChannel } from "./loginChannel.js";
 import { runOAuthDeviceFlow } from "./oauth.js";
 import { DEFAULT_BASE_URL, establishSession, resolveBaseUrl, } from "./session.js";
 export function registerAuthCommands(program, getApi) {
-    program
+    const login = program
         .command("login")
         .description("Sign in to Cargo with an emailed code (--email), via browser (--oauth), or with an existing API token (--token)")
         .option("--email <email>", "Sign in with a code emailed to this address; creates the account on first use")
@@ -53,6 +53,32 @@ Environment variables (CARGO_API_TOKEN, CARGO_WORKSPACE_UUID, CARGO_BASE_URL) ta
         .action(async (opts) => {
         await runLogin(opts);
     });
+    // Commander can say an option is required but not that exactly one of three
+    // must be present, so the palette saw a command with no inputs, ran it bare,
+    // and got the handler's own usage error back. The choice is declared here,
+    // beside the options it chooses between.
+    declarePrompt(login, {
+        message: "how do you want to sign in?",
+        choices: [
+            {
+                label: "Browser sign-in",
+                hint: "opens a browser; no code to copy",
+                flag: "--oauth",
+            },
+            {
+                label: "Emailed code",
+                hint: "no browser needed; signs you up on first use",
+                flag: "--email",
+                value: { name: "email", hint: "you@company.com" },
+            },
+            {
+                label: "Existing API token",
+                hint: "for CI, or a token you already hold",
+                flag: "--token",
+                value: { name: "token", hint: "", secret: true },
+            },
+        ],
+    });
     program
         .command("logout")
         .description("Sign out: revoke the saved credential and remove it locally")

package/build/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgKzC,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,MAAM,GACrB,IAAI,CAoDN"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiKzC,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,MAAM,GACrB,IAAI,CAyEN"}

package/build/commands/doctor.js

@@ -1,45 +1,29 @@
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
 import { determineIfIsFetcherError } from "@cargo-ai/api";
+import { formatSetupIssues } from "@cargo-ai/cdk/cli";
 import { createApi } from "../api.js";
 import { getConfig } from "../config.js";
 import { getCredentialsPath } from "../credentials.js";
-import { fetchLatestVersion, isOutdated } from "../version.js";
-import { ExitCodes, outputJson } from "./runHandler.js";
-const SEMVER_PATTERN = /^\d+\.\d+\.\d+$/;
-function getSkillsPinCandidates() {
-    const home = os.homedir();
-    const envDir = process.env["CARGO_SKILLS_DIR"];
-    const candidates = [];
-    if (envDir !== undefined && envDir.length > 0) {
-        candidates.push(path.join(envDir, "cargo", "cli-version"));
-    }
-    candidates.push(path.join(home, ".claude", "skills", "cargo", "cli-version"), path.join(home, ".claude", "plugins", "marketplaces", "cargo", "cargo", "cli-version"), path.join(home, ".openclaw", "skills", "cargo", "cli-version"));
-    return candidates;
-}
-function readSkillsPin() {
-    for (const candidate of getSkillsPinCandidates()) {
-        try {
-            const raw = fs.readFileSync(candidate, "utf8").trim();
-            if (SEMVER_PATTERN.test(raw)) {
-                return { version: raw, path: candidate };
-            }
-        }
-        catch {
-            // Missing or unreadable — try the next candidate.
-        }
-    }
-    return undefined;
-}
+import { collectSetupIssues, readSkillsPin } from "../setupIssues.js";
+import { fetchLatestVersion, isOutdated, UPDATE_COMMAND } from "../version.js";
+import { colors, ExitCodes, outputJson } from "./runHandler.js";
+const LOGIN_COMMAND = "cargo-ai login --oauth";
+const STATUS_PAGE = "https://status.getcargo.io";
 function buildCliCheck(currentVersion, latestVersion) {
     if (latestVersion === undefined) {
         return { current: currentVersion, latest: null, upToDate: null };
     }
+    if (isOutdated(currentVersion, latestVersion)) {
+        return {
+            current: currentVersion,
+            latest: latestVersion,
+            upToDate: false,
+            fix: UPDATE_COMMAND,
+        };
+    }
     return {
         current: currentVersion,
         latest: latestVersion,
-        upToDate: !isOutdated(currentVersion, latestVersion),
+        upToDate: true,
     };
 }
 function buildSkillsPinCheck(currentVersion) {
@@ -47,11 +31,25 @@ function buildSkillsPinCheck(currentVersion) {
     if (pin === undefined) {
         return { found: false };
     }
+    if (pin.version === currentVersion) {
+        return {
+            found: true,
+            pinned: pin.version,
+            path: pin.path,
+            matchesCli: true,
+        };
+    }
     return {
         found: true,
         pinned: pin.version,
         path: pin.path,
-        matchesCli: pin.version === currentVersion,
+        matchesCli: false,
+        // Whichever side is behind is the side to update: an older CLI cannot run
+        // what the skills ask of it, and older skills describe commands this CLI
+        // has moved on from.
+        fix: isOutdated(currentVersion, pin.version)
+            ? UPDATE_COMMAND
+            : "npx skills add getcargohq/cargo-skills",
     };
 }
 async function checkApi(config) {
@@ -63,6 +61,7 @@ async function checkApi(config) {
                     status: "no-credentials",
                     message: 'Not authenticated. Run "cargo-ai login --email <email>" (no browser needed) or "cargo-ai login --oauth".',
                 },
+                fix: LOGIN_COMMAND,
             },
             exitCode: ExitCodes.NotAuthenticated,
         };
@@ -105,6 +104,9 @@ async function checkApi(config) {
                     status,
                     message: error instanceof Error ? error.message : String(error),
                 },
+                // A rejected or mis-scoped credential is fixed by signing in again;
+                // anything else is the service, not this machine, so point at status.
+                fix: status === 401 || status === 403 ? LOGIN_COMMAND : STATUS_PAGE,
             },
             exitCode,
         };
@@ -146,10 +148,67 @@ Examples:
             credentialsFile: getCredentialsPath(),
         };
         const { check: api, exitCode } = await checkApi(config);
+        // One list, most severe first, each entry carrying its own fix — the same
+        // shape the pre-command header renders, so a reader who has seen the
+        // amber line recognises it here rather than learning a second format.
+        const offline = collectSetupIssues({
+            currentVersion,
+            latestVersion,
+        });
+        const apiIssue = describeApiIssue(api);
+        const issues = apiIssue === undefined
+            ? offline
+            : [
+                apiIssue,
+                // The live call is authoritative about the credential, so it
+                // replaces the offline "is there a file" guess.
+                ...offline.filter((issue) => issue.key !== "not-signed-in"),
+            ];
         outputJson({
             ok: exitCode === ExitCodes.Success,
+            issues,
             checks: { cli, skillsPin, credentials, api },
         });
+        printReport(issues, api);
         process.exit(exitCode);
     });
 }
+function describeApiIssue(api) {
+    if (api.ok === true) {
+        return undefined;
+    }
+    if (api.error.status === "no-credentials") {
+        return { key: "not-signed-in", label: "not signed in", fix: api.fix };
+    }
+    if (api.error.status === 401) {
+        return {
+            key: "credential-rejected",
+            label: "credential rejected",
+            fix: api.fix,
+        };
+    }
+    if (api.error.status === 403) {
+        return {
+            key: "workspace-denied",
+            label: "no access to this workspace",
+            fix: api.fix,
+        };
+    }
+    return { key: "api-unreachable", label: "API unreachable", fix: api.fix };
+}
+/**
+ * The human half. stdout stays the JSON contract scripts and agents parse, so
+ * this goes to stderr and only when someone is watching.
+ */
+function printReport(issues, api) {
+    if (process.stderr.isTTY !== true) {
+        return;
+    }
+    const issueLine = formatSetupIssues(issues);
+    if (issueLine !== undefined) {
+        process.stderr.write(`${issueLine}\n`);
+        return;
+    }
+    const where = api.ok === true ? ` ${colors.dim("·")} ${api.workspace.name}` : "";
+    process.stderr.write(`${colors.green("✓")} Setup looks healthy${where}\n`);
+}

package/build/commands/orchestration/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/commands/orchestration/run.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAgBxC,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI,CAsqB5E"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/commands/orchestration/run.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAgBxC,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI,CA+rB5E"}

package/build/commands/orchestration/run.js

@@ -1,3 +1,4 @@
+import { declarePrompt } from "@cargo-ai/cdk/cli";
 import { parseBooleanOption } from "../../utils/booleanOption.js";
 import { loadCompiledWorkflow, resolveCompiledWorkflowFromState, } from "../../utils/loadCompiledWorkflow.js";
 import { ExitCodes, failWith, handleApiCall, info, outputJson, parseJson, pollRunUntilFinished, } from "../runHandler.js";
@@ -5,10 +6,10 @@ export function registerRunCommands(parent, getApi) {
     const run = parent
         .command("run")
         .description("Manage workflow runs (list, get, create, cancel, count, download)");
-    run
+    const listRuns = run
         .command("list")
         .description("List runs")
-        .requiredOption("--workflow-uuid <uuid>", "Workflow UUID (string, required)")
+        .option("--workflow-uuid <uuid>", "Workflow UUID (string). Omit to list the runs of every play and tool, which the API allows only alongside --created-after inside a 30-day window")
         .option("--batch-uuid <uuid>", "Filter by batch UUID (string)")
         .option("--release-uuid <uuid>", "Filter by release UUID (string)")
         .option("--statuses <list>", "Filter by statuses (comma-separated: idle,pending,running,success,error,cancelling,cancelled,skipped)")
@@ -32,7 +33,8 @@ export function registerRunCommands(parent, getApi) {
 Examples:
   $ cargo-ai orchestration run list --workflow-uuid 550e8400-...
   $ cargo-ai orchestration run list --workflow-uuid 550e8400-... --statuses running,pending --limit 50
-  $ cargo-ai orchestration run list --workflow-uuid 550e8400-... --created-after 2025-01-01T00:00:00Z`)
+  $ cargo-ai orchestration run list --workflow-uuid 550e8400-... --created-after 2025-01-01T00:00:00Z
+  $ cargo-ai orchestration run list --created-after 2025-01-01T00:00:00Z   # every play and tool`)
         .action(async (opts) => {
         const api = getApi();
         const result = await handleApiCall(() => api.orchestration.run.list({
@@ -141,10 +143,10 @@ Examples:
         await handleApiCall(() => api.orchestration.run.cancel(payload));
         outputJson({ ok: true });
     });
-    run
+    const countRuns = run
         .command("count")
         .description("Count runs matching the given filters")
-        .requiredOption("--workflow-uuid <uuid>", "Workflow UUID (string, required)")
+        .option("--workflow-uuid <uuid>", "Workflow UUID (string). Omit to count the runs of every play and tool, which the API allows only alongside --created-after inside a 30-day window")
         .option("--batch-uuid <uuid>", "Filter by batch UUID (string)")
         .option("--release-uuid <uuid>", "Filter by release UUID (string)")
         .option("--statuses <list>", "Filter by statuses (comma-separated: idle,pending,running,success,error,cancelling,cancelled,skipped)")
@@ -188,6 +190,29 @@ Examples:
         }));
         outputJson(result);
     });
+    // Both of these take the option or go without it, and going without it is
+    // only legal alongside --created-after. Commander cannot express that, so the
+    // palette would offer a command that fails on the server's own message. The
+    // choice is declared here instead, beside the option it chooses between.
+    for (const command of [listRuns, countRuns]) {
+        declarePrompt(command, {
+            message: "which runs?",
+            choices: [
+                {
+                    label: "One workflow",
+                    hint: "a single play or tool",
+                    flag: "--workflow-uuid",
+                    value: { name: "workflow-uuid", hint: "550e8400-e29b-41d4-a716-…" },
+                },
+                {
+                    label: "Every play and tool",
+                    hint: "needs a start date; the API allows at most a 30-day window",
+                    flag: "--created-after",
+                    value: { name: "created-after", hint: "2026-08-01T00:00:00Z" },
+                },
+            ],
+        });
+    }
     run
         .command("download")
         .description("Download run results as JSON")

package/build/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
-import { registerCommands as registerCdkCommands, registerManifestCommands, SessionExpiredError, } from "@cargo-ai/cdk/cli";
+import { BRAND, canRunPalette, fetchCreditsLeft, fetchWorkspaceName, formatWorkspaceSuffix, printSetupIssues, registerCommands as registerCdkCommands, runPalette, SessionExpiredError, } from "@cargo-ai/cdk/cli";
 import { Command } from "commander";
 import { AGENT_SKILLS_HINT } from "./agentSkills.js";
 import { createApi } from "./api.js";
@@ -13,7 +13,6 @@ import { registerContextCommands } from "./commands/context/index.js";
 import { registerDoctorCommand } from "./commands/doctor.js";
 import { registerExpressionCommands } from "./commands/expression/index.js";
 import { registerHostingCommands } from "./commands/hosting/index.js";
-import { registerInitCommand } from "./commands/init.js";
 import { registerMailboxManagementCommands } from "./commands/mailboxManagement/index.js";
 import { registerMcpCommand } from "./commands/mcp.js";
 import { registerObservabilityCommands } from "./commands/observability/index.js";
@@ -27,7 +26,8 @@ import { registerUserManagementCommands } from "./commands/userManagement/index.
 import { registerVersionCommand } from "./commands/version.js";
 import { registerWorkspaceManagementCommands } from "./commands/workspaceManagement/index.js";
 import { getConfig } from "./config.js";
-import { maybeNotifyUpdate } from "./updateNotifier.js";
+import { collectSetupIssues, isSignedIn } from "./setupIssues.js";
+import { cachedLatestVersion, maybeRefreshUpdateCache, } from "./updateNotifier.js";
 const require = createRequire(import.meta.url);
 const { version } = require("../package.json");
 const program = new Command();
@@ -71,6 +71,40 @@ Exit codes:
 
 Run "cargo-ai <command> --help" for details on a specific command group.
 Run "cargo-ai <command> <subcommand> --help" for details on a subcommand.`);
+// Commands that are themselves the fix, or that already say all of this
+// better: the header would either duplicate their output or nag someone who is
+// mid-repair.
+const SETUP_HEADER_SKIP = ["login", "logout", "doctor", "version", "mcp"];
+/**
+ * Say what is wrong before the command runs rather than after it fails, and
+ * name the fix. Every check behind this is a file read (see `setupIssues.ts`)
+ * and the line only renders for a TTY, so scripts and agents pay nothing.
+ *
+ * A one-shot CLI has no session to show this once per, so someone who has
+ * decided to live with a mismatch would otherwise see it before every command
+ * forever. Give them the same opt-out the update notifier has.
+ */
+program.hook("preAction", (_program, action) => {
+    const suppressed = process.env["CARGO_NO_SETUP_HEADER"];
+    if (suppressed === "1" || suppressed === "true") {
+        return;
+    }
+    if (SETUP_HEADER_SKIP.includes(rootCommandName(action))) {
+        return;
+    }
+    printSetupIssues(collectSetupIssues({
+        currentVersion: version,
+        latestVersion: cachedLatestVersion(),
+    }));
+});
+/** The top-level group a subcommand belongs to (`connection`, not `list`). */
+function rootCommandName(command) {
+    const parent = command.parent;
+    if (parent === null || parent.parent === null) {
+        return command.name();
+    }
+    return rootCommandName(parent);
+}
 const getApi = () => {
     const { baseUrl, getAccessToken, workspaceUuid } = getConfig();
     if (getAccessToken === undefined) {
@@ -81,7 +115,6 @@ const getApi = () => {
 registerAuthCommands(program, getApi);
 registerVersionCommand(program, version);
 registerDoctorCommand(program, version);
-registerInitCommand(program, getApi);
 registerObservabilityCommands(program, getApi);
 registerOrchestrationCommands(program, getApi);
 registerWorkspaceManagementCommands(program, getApi);
@@ -102,12 +135,43 @@ registerMcpCommand(program, getApi);
 registerCdkCommands(program
     .command("cdk")
     .description("Cargo CDK — define resources in code and deploy them (plan/deploy)"), getApi);
-registerManifestCommands(program
-    .command("manifest")
-    .description("Manifest — scaffold a GTM repo (context, infra, skills, evals, outputs)"));
-program
-    .parseAsync()
-    .then(() => maybeNotifyUpdate(version))
+// Bare `cargo-ai` in a terminal opens the palette instead of printing the help
+// wall: twenty command groups is a list to navigate, not one to read. Anything
+// non-interactive (a pipe, CI, an agent) keeps the help it has always had.
+const bare = process.argv.slice(2).length === 0 && canRunPalette();
+const start = bare ? openPalette() : program.parseAsync();
+async function openPalette() {
+    const [title, latestVersion] = await Promise.all([
+        paletteTitle(),
+        maybeRefreshUpdateCache(),
+    ]);
+    await runPalette({
+        program,
+        binPath: process.argv[1] === undefined ? "cargo-ai" : process.argv[1],
+        title,
+        issues: collectSetupIssues({ currentVersion: version, latestVersion }),
+    });
+}
+/**
+ * `🧱 cargo-ai 1.0.66 · Acme · 9,657.48 credits`. The two lookups behind the
+ * second half are the same best-effort, time-boxed ones `cargo-cdk` uses, so a
+ * bare invocation still opens promptly when the network does not answer — and
+ * they are skipped entirely when there is no credential to make them with.
+ */
+async function paletteTitle() {
+    const base = `${BRAND} cargo-ai ${version}`;
+    if (isSignedIn() === false) {
+        return base;
+    }
+    const api = getApi();
+    const [name, creditsLeft] = await Promise.all([
+        fetchWorkspaceName(api),
+        fetchCreditsLeft(api),
+    ]);
+    return `${base}${formatWorkspaceSuffix(name, creditsLeft)}`;
+}
+start
+    .then(() => maybeRefreshUpdateCache())
     .catch((err) => {
     // An expired session is the ordinary way to lose authentication, so it has
     // to carry the documented exit code rather than the generic one.

package/build/setupIssues.d.ts

@@ -0,0 +1,37 @@
+import type { SetupIssue } from "@cargo-ai/cdk/cli";
+export type SkillsPin = {
+    version: string;
+    path: string;
+};
+export type SetupIssueInput = {
+    currentVersion: string;
+    /**
+     * A version from the update cache (or a live fetch). Passing one opts this
+     * caller in to reporting an outdated CLI, so the version sits with the
+     * other setup issues rather than as a footer after the command. The
+     * palette and the pre-command header pass the cache; `doctor` fetches live.
+     */
+    latestVersion?: string;
+};
+/**
+ * The two facts this reads off the machine. Injected so the rules — which side
+ * of a pin mismatch to update, when an outdated CLI is this line's business at
+ * all — can be tested without a home directory.
+ */
+export type SetupIssueDeps = {
+    isSignedIn: () => boolean;
+    readSkillsPin: () => SkillsPin | undefined;
+};
+export declare function collectSetupIssues(input: SetupIssueInput, deps?: SetupIssueDeps): SetupIssue[];
+/**
+ * The CLI version the installed skills bundle was written against, from
+ * whichever agent's skills directory holds one.
+ */
+export declare function readSkillsPin(): SkillsPin | undefined;
+/**
+ * Deliberately not `getConfig()`: that resolves the whole auth config and exits
+ * the process on a workspace conflict, which a header printed before every
+ * command must never do. Presence of a credential is all this line needs.
+ */
+export declare function isSignedIn(): boolean;
+//# sourceMappingURL=setupIssues.d.ts.map

package/build/setupIssues.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupIssues.d.ts","sourceRoot":"","sources":["../src/setupIssues.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAWpD,MAAM,MAAM,SAAS,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,MAAM,MAAM,eAAe,GAAG;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,MAAM,OAAO,CAAC;IAC1B,aAAa,EAAE,MAAM,SAAS,GAAG,SAAS,CAAC;CAC5C,CAAC;AAIF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,IAAI,GAAE,cAA4B,GACjC,UAAU,EAAE,CAyCd;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,SAAS,GAAG,SAAS,CAcrD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,IAAI,OAAO,CAYpC"}

package/build/setupIssues.js

@@ -0,0 +1,93 @@
+// What is wrong with this machine's Cargo setup, and the command that fixes
+// each one.
+//
+// This runs before every command, so every check here is a small file read or
+// cheaper — no network. `cargo-ai doctor` is the same list with the online
+// checks added.
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { loadCredentials } from "./credentials.js";
+import { isOutdated, UPDATE_COMMAND } from "./version.js";
+const SEMVER_PATTERN = /^\d+\.\d+\.\d+$/;
+const SKILLS_UPDATE_COMMAND = "npx skills add getcargohq/cargo-skills";
+const LOGIN_COMMAND = "cargo-ai login --oauth";
+const machineDeps = { isSignedIn, readSkillsPin };
+export function collectSetupIssues(input, deps = machineDeps) {
+    const issues = [];
+    if (deps.isSignedIn() === false) {
+        issues.push({
+            key: "not-signed-in",
+            label: "not signed in",
+            fix: LOGIN_COMMAND,
+        });
+    }
+    const latest = input.latestVersion;
+    if (latest !== undefined &&
+        isOutdated(input.currentVersion, latest) === true) {
+        issues.push({
+            key: "cli-outdated",
+            label: `CLI ${input.currentVersion} → ${latest}`,
+            fix: UPDATE_COMMAND,
+        });
+    }
+    const pin = deps.readSkillsPin();
+    if (pin !== undefined && pin.version !== input.currentVersion) {
+        // The pin records the CLI the installed skills were written against. Which
+        // side is behind decides the fix: an older CLI cannot run what the skills
+        // ask of it, and older skills describe commands this CLI has moved on from.
+        issues.push({
+            key: "skills-pin-mismatch",
+            label: `skills expect CLI ${pin.version}`,
+            fix: isOutdated(input.currentVersion, pin.version) === true
+                ? UPDATE_COMMAND
+                : SKILLS_UPDATE_COMMAND,
+        });
+    }
+    return issues;
+}
+/**
+ * The CLI version the installed skills bundle was written against, from
+ * whichever agent's skills directory holds one.
+ */
+export function readSkillsPin() {
+    for (const candidate of skillsPinCandidates()) {
+        try {
+            const raw = fs.readFileSync(candidate, "utf8").trim();
+            if (SEMVER_PATTERN.test(raw)) {
+                return { version: raw, path: candidate };
+            }
+        }
+        catch {
+            // Missing or unreadable — try the next candidate.
+        }
+    }
+    return undefined;
+}
+/**
+ * Deliberately not `getConfig()`: that resolves the whole auth config and exits
+ * the process on a workspace conflict, which a header printed before every
+ * command must never do. Presence of a credential is all this line needs.
+ */
+export function isSignedIn() {
+    const token = process.env["CARGO_API_TOKEN"];
+    if (token !== undefined && token.trim() !== "") {
+        return true;
+    }
+    try {
+        return loadCredentials() !== undefined;
+    }
+    catch {
+        return false;
+    }
+}
+function skillsPinCandidates() {
+    const home = os.homedir();
+    const envDir = process.env["CARGO_SKILLS_DIR"];
+    const candidates = [];
+    if (envDir !== undefined && envDir.length > 0) {
+        candidates.push(path.join(envDir, "cargo", "cli-version"));
+    }
+    candidates.push(path.join(home, ".claude", "skills", "cargo", "cli-version"), path.join(home, ".claude", "plugins", "marketplaces", "cargo", "cargo", "cli-version"), path.join(home, ".openclaw", "skills", "cargo", "cli-version"));
+    return candidates;
+}

package/build/updateNotifier.d.ts

@@ -1,9 +1,18 @@
 /**
- * Best-effort "update available" nudge, printed to stderr after a command's
- * own output. The registry is checked at most once per 24h (result cached in
- * the config dir). Stays silent on non-TTY stderr (scripts/CI), when disabled
- * via CARGO_NO_UPDATE_NOTIFIER, and on any network/parse failure — it must
+ * Latest version already sitting in the on-disk cache. No network. Undefined
+ * when the check is disabled or nothing has been fetched yet — the header
+ * then simply omits the outdated-CLI issue rather than guessing.
+ */
+export declare function cachedLatestVersion(): string | undefined;
+/**
+ * Refresh the registry cache at most once per 24h. Returns the latest version
+ * we now know about, so a caller that is about to render setup issues (the
+ * palette) can put an outdated CLI in that list instead of printing a footer
+ * after the fact.
+ *
+ * Stays silent on non-TTY stderr (scripts/CI), when disabled via
+ * `CARGO_NO_UPDATE_NOTIFIER`, and on any network/parse failure — it must
  * never block, delay, or break the command that triggered it.
  */
-export declare function maybeNotifyUpdate(currentVersion: string): Promise<void>;
+export declare function maybeRefreshUpdateCache(): Promise<string | undefined>;
 //# sourceMappingURL=updateNotifier.d.ts.map

package/build/updateNotifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"updateNotifier.d.ts","sourceRoot":"","sources":["../src/updateNotifier.ts"],"names":[],"mappings":"AAmBA;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B7E"}
+{"version":3,"file":"updateNotifier.d.ts","sourceRoot":"","sources":["../src/updateNotifier.ts"],"names":[],"mappings":"AAgBA;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAYxD;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAwB3E"}

package/build/updateNotifier.js

@@ -1,5 +1,4 @@
-import { colors, info } from "./commands/runHandler.js";
-import { fetchLatestVersion, isOutdated, readUpdateCache, UPDATE_COMMAND, writeUpdateCache, } from "./version.js";
+import { fetchLatestVersion, readUpdateCache, writeUpdateCache, } from "./version.js";
 const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // once per day
 const NOTIFY_FETCH_TIMEOUT_MS = 1500;
 const isDisabled = () => {
@@ -7,18 +6,37 @@ const isDisabled = () => {
     return (flag === "1" || flag === "true" || process.env["NO_UPDATE_NOTIFIER"] === "1");
 };
 /**
- * Best-effort "update available" nudge, printed to stderr after a command's
- * own output. The registry is checked at most once per 24h (result cached in
- * the config dir). Stays silent on non-TTY stderr (scripts/CI), when disabled
- * via CARGO_NO_UPDATE_NOTIFIER, and on any network/parse failure — it must
+ * Latest version already sitting in the on-disk cache. No network. Undefined
+ * when the check is disabled or nothing has been fetched yet — the header
+ * then simply omits the outdated-CLI issue rather than guessing.
+ */
+export function cachedLatestVersion() {
+    if (isDisabled() === true) {
+        return undefined;
+    }
+    const cache = readUpdateCache();
+    if (cache === undefined) {
+        return undefined;
+    }
+    return cache.latestVersion;
+}
+/**
+ * Refresh the registry cache at most once per 24h. Returns the latest version
+ * we now know about, so a caller that is about to render setup issues (the
+ * palette) can put an outdated CLI in that list instead of printing a footer
+ * after the fact.
+ *
+ * Stays silent on non-TTY stderr (scripts/CI), when disabled via
+ * `CARGO_NO_UPDATE_NOTIFIER`, and on any network/parse failure — it must
  * never block, delay, or break the command that triggered it.
  */
-export async function maybeNotifyUpdate(currentVersion) {
-    // Only nudge interactive users; never pollute scripted/CI stderr.
-    if (process.stderr.isTTY !== true)
-        return;
-    if (isDisabled())
-        return;
+export async function maybeRefreshUpdateCache() {
+    if (process.stderr.isTTY !== true) {
+        return cachedLatestVersion();
+    }
+    if (isDisabled() === true) {
+        return undefined;
+    }
     try {
         let cache = readUpdateCache();
         const now = Date.now();
@@ -27,12 +45,10 @@ export async function maybeNotifyUpdate(currentVersion) {
             cache = { lastCheck: now, latestVersion };
             writeUpdateCache(cache);
         }
-        if (isOutdated(currentVersion, cache.latestVersion)) {
-            info(`${colors.yellow("⚠")} A new version of cargo-ai is available: ${colors.dim(currentVersion)} → ${colors.green(cache.latestVersion)}`);
-            info(`  Update with: ${colors.cyan(UPDATE_COMMAND)}`);
-        }
+        return cache.latestVersion;
     }
     catch {
         // Fail open: an update check must never get in the way of the command.
+        return cachedLatestVersion();
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cargo-ai/cli",
-  "version": "1.0.67",
+  "version": "1.0.70",
   "private": false,
   "license": "UNLICENSED",
   "homepage": "https://getcargo.ai",
@@ -66,7 +66,7 @@
   "dependencies": {
     "@cargo-ai/api": "^1.0.69",
     "@cargo-ai/app-sdk": "^1.0.9",
-    "@cargo-ai/cdk": "^1.0.53",
+    "@cargo-ai/cdk": "^1.0.56",
     "@cargo-ai/types": "^1.0.66",
     "@cargo-ai/worker-sdk": "^1.0.17",
     "@modelcontextprotocol/sdk": "1.29.0",

package/build/commands/init.d.ts

@@ -1,4 +0,0 @@
-import type { Command } from "commander";
-import type { Api } from "../api.js";
-export declare function registerInitCommand(parent: Command, getApi: () => Api): void;
-//# sourceMappingURL=init.d.ts.map

package/build/commands/init.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGrC,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI,CAW5E"}

package/build/commands/init.js

@@ -1,11 +0,0 @@
-import { handleApiCall, outputJson } from "./runHandler.js";
-export function registerInitCommand(parent, getApi) {
-    parent
-        .command("init")
-        .description("Fetch workspace initialisation (user, workspace, datasets, etc.)")
-        .action(async () => {
-        const api = getApi();
-        const result = await handleApiCall(() => api.getInitialisation());
-        outputJson(result);
-    });
-}