@fulldivevr/workcord-cli 1.6.0 → 3.0.0

package/dist/commands/{hermes.js → hub.js}

@@ -1,8 +1,8 @@
-import { Option } from "commander";
+import { Help, Option } from "commander";
 import { randomUUID } from "node:crypto";
 import { readFile, stat, writeFile } from "node:fs/promises";
 import { Writable } from "node:stream";
-import { actingUserId, resolveHermesKey } from "../auth.js";
+import { actingUserId, isManagedHubMode, resolveHermesKey } from "../auth.js";
 import { hermesBinary, hermesCall, hermesStream, hermesUpload } from "../hermes-client.js";
 import { assertArchiveSize, flavorSetWarnings, guardOwnership, rolloutBody, } from "../hermes-guards.js";
 import { getOrCreateGroup } from "./_group.js";
@@ -23,7 +23,8 @@ function agentFlags(cmd) {
         .option("--room-agent <id>", "room agent id (resolved as workcord-room-agent:<id>)")
         .option("--marketplace-install <id>", "marketplace flavor install id or its room agent id")
         .option("--refresh", "re-reveal the tenant key instead of using the cached one")
-        .option("--no-cache", "do not read or write the local tenant-key cache");
+        .option("--no-cache", "do not read or write the local tenant-key cache")
+        .option("--managed", "managed mode: always reveal, no cache, no --as (also WORKCORD_HUB_MANAGED=1)");
 }
 function jsonOption(cmd, name, description) {
     return cmd.option(`--${name} <json>`, description);
@@ -44,16 +45,18 @@ function out(data) {
 export function hermesChatTextBody(text) {
     return { parts: [{ type: "text", text }] };
 }
-async function credentials(program, opts) {
+async function credentials(program, opts, deps) {
     return resolveHermesKey(agentRef(opts), {
         refresh: opts.refresh,
         cache: opts.cache,
+        managed: opts.managed || undefined,
         asUserId: actingUserId(program),
+        ...deps,
     });
 }
 function tenantPath(creds, suffix) {
     if (!creds.tenantId) {
-        throw new Error("No tenantId available for this agent. Re-run with --refresh, or set WORKCORD_HERMES_TENANT_ID alongside WORKCORD_HERMES_KEY.");
+        throw new Error("No tenantId available for this agent. Re-run with --refresh, or set WORKCORD_HUB_TENANT_ID alongside WORKCORD_HUB_KEY.");
     }
     return `/v1/tenants/${encodeURIComponent(creds.tenantId)}${suffix}`;
 }
@@ -102,54 +105,69 @@ async function readArchive(archivePath) {
     const buffer = await readFile(archivePath);
     return buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength);
 }
-export function registerHermes(program) {
-    const group = getOrCreateGroup(program, "hermes", "Advanced Hermes Hub diagnostics and recovery for an agent tenant");
-    agentFlags(group.command("key").description("Reveal (and cache) the Hermes Hub tenant key for an agent.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
+export function registerHub(program, deps = {}) {
+    // `hermes` is a hidden alias of `hub`, kept for one release. The help formatter
+    // below replaces only the exact `name|alias` token so the alias stays out of help output.
+    const help = new Help();
+    const withoutAlias = (cmd, term) => {
+        const alias = cmd.aliases()[0];
+        return alias ? term.replace(`${cmd.name()}|${alias}`, cmd.name()) : term;
+    };
+    program.configureHelp({
+        subcommandTerm: (cmd) => withoutAlias(cmd, help.subcommandTerm(cmd)),
+        commandUsage: (cmd) => withoutAlias(cmd, help.commandUsage(cmd)),
+    });
+    const group = getOrCreateGroup(program, "hub", "Advanced Autoworker Hub diagnostics and recovery for an agent tenant").alias("hermes");
+    agentFlags(group.command("key").description("Reveal (and cache) the Autoworker Hub tenant key for an agent. In managed mode the key is not printed.")).action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        if (opts.managed || isManagedHubMode()) {
+            out({ tenantId: creds.tenantId, hubBaseUrl: creds.hubBaseUrl, managed: true });
+            return;
+        }
         out({ key: creds.key, tenantId: creds.tenantId, hubBaseUrl: creds.hubBaseUrl });
     });
-    agentFlags(group.command("whoami").description("Show the Hermes Hub tenant this agent's key belongs to.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
+    agentFlags(group.command("whoami").description("Show the Autoworker Hub tenant this agent's key belongs to.")).action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant" }));
     });
     agentFlags(group.command("runtime").description("Show the tenant runtime.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/runtime" }));
     });
     const agent = group.command("agent").description("Tenant agent lifecycle");
     agentFlags(agent.command("status").description("Show the tenant agent.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/agent" }));
     });
     for (const verb of ["start", "stop", "restart"]) {
         agentFlags(agent.command(verb).description(`${verb[0].toUpperCase()}${verb.slice(1)} the tenant agent.`)).action(async (opts) => {
-            const creds = await credentials(program, opts);
+            const creds = await credentials(program, opts, deps);
             out(await hermesCall({ ...creds, method: "POST", path: `/v1/tenant-api/tenant/agent/${verb}` }));
         });
     }
     agentFlags(agent.command("card").description("Show the tenant agent card.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/agent-card" }));
     });
     const chat = group.command("chat").description("Tenant chats and chat messages");
     jsonOption(agentFlags(chat.command("list").description("List chats.")), "query", "query parameters as JSON").action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: tenantPath(creds, "/chats"), query: parseJson(opts.query, "--query") }));
     });
     jsonOption(agentFlags(chat.command("create").description("Create a chat.")), "body", "request body as JSON").action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, method: "POST", path: tenantPath(creds, "/chats"), body: parseJson(opts.body, "--body") ?? {} }));
     });
     agentFlags(chat.command("get").description("Get one chat."))
         .requiredOption("--chat <chatId>", "chat id")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: tenantPath(creds, `/chats/${encodeURIComponent(opts.chat)}`) }));
     });
     jsonOption(agentFlags(chat.command("messages").description("List messages in a chat.")), "query", "query parameters as JSON")
         .requiredOption("--chat <chatId>", "chat id")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({
             ...creds,
             path: tenantPath(creds, `/chats/${encodeURIComponent(opts.chat)}/messages`),
@@ -161,7 +179,7 @@ export function registerHermes(program) {
         .option("--text <text>", "message text")
         .option("--idempotency-key <key>", "Idempotency-Key header (generated when omitted)")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         const body = parseJson(opts.body, "--body") ?? (opts.text !== undefined ? hermesChatTextBody(opts.text) : undefined);
         if (body === undefined) {
             throw new Error("One of --text or --body is required.");
@@ -179,7 +197,7 @@ export function registerHermes(program) {
         .option("--after-revision <n>", "only return when the revision is newer than this")
         .option("--wait-seconds <n>", "long-poll for up to this many seconds")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({
             ...creds,
             path: tenantPath(creds, `/chat-messages/${encodeURIComponent(opts.message)}`),
@@ -190,7 +208,7 @@ export function registerHermes(program) {
         .requiredOption("--message <messageId>", "chat message id")
         .option("--last-event-id <id>", "resume from this event id")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         await hermesStream({
             ...creds,
             path: tenantPath(creds, `/chat-messages/${encodeURIComponent(opts.message)}/events`),
@@ -200,13 +218,13 @@ export function registerHermes(program) {
     agentFlags(chat.command("stop").description("Stop a chat message."))
         .requiredOption("--message <messageId>", "chat message id")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, method: "POST", path: tenantPath(creds, `/chat-messages/${encodeURIComponent(opts.message)}/stop`) }));
     });
     jsonOption(agentFlags(chat.command("approve").description("Answer a chat message's approval request.")), "body", "request body as JSON")
         .requiredOption("--message <messageId>", "chat message id")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({
             ...creds,
             method: "POST",
@@ -216,32 +234,32 @@ export function registerHermes(program) {
     });
     const run = group.command("run").description("Tenant runs");
     jsonOption(agentFlags(run.command("create").description("Create a run.")), "body", "request body as JSON").action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, method: "POST", path: tenantPath(creds, "/runs"), body: parseJson(opts.body, "--body") ?? {} }));
     });
     agentFlags(run.command("get").description("Get one run."))
         .requiredOption("--run <runId>", "run id")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: tenantPath(creds, `/runs/${encodeURIComponent(opts.run)}`) }));
     });
     agentFlags(run.command("stream").description("Stream a run's events (SSE)."))
         .requiredOption("--run <runId>", "run id")
         .option("--last-event-id <id>", "resume from this event id")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         await hermesStream({ ...creds, path: tenantPath(creds, `/runs/${encodeURIComponent(opts.run)}/events`), lastEventId: opts.lastEventId });
     });
     agentFlags(run.command("stop").description("Stop a run."))
         .requiredOption("--run <runId>", "run id")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, method: "POST", path: tenantPath(creds, `/runs/${encodeURIComponent(opts.run)}/stop`) }));
     });
     jsonOption(agentFlags(run.command("approve").description("Answer a run's approval request.")), "body", "request body as JSON")
         .requiredOption("--run <runId>", "run id")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({
             ...creds,
             method: "POST",
@@ -253,20 +271,20 @@ export function registerHermes(program) {
     agentFlags(files.command("ls").description("List files under the tenant's virtual roots."))
         .option("--path <path>", "directory path (empty means root)")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/files", query: { path: opts.path } }));
     });
     agentFlags(files.command("cat").description("Read one tenant-visible file."))
         .requiredOption("--path <path>", "file path")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/files/content", query: { path: opts.path } }));
     });
     agentFlags(files.command("download").description("Download one tenant-visible file (raw bytes)."))
         .requiredOption("--path <path>", "file path")
         .option("--out <file>", "write to this file instead of stdout")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         const path = "/v1/tenant-api/tenant/files/download";
         const query = { path: opts.path };
         if (opts.out) {
@@ -277,7 +295,7 @@ export function registerHermes(program) {
     });
     const share = group.command("share").description("Share-group filesystem");
     agentFlags(share.command("groups").description("List share groups visible to this tenant.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/shares" }));
     });
     const shareGroupFlags = (cmd) => agentFlags(cmd).requiredOption("--group <groupId>", "share group id");
@@ -285,7 +303,7 @@ export function registerHermes(program) {
     shareGroupFlags(share.command("ls").description("List one share-group directory."))
         .option("--path <path>", "path relative to the share root")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: sharePath(opts.group, "list"), query: { path: opts.path } }));
     });
     shareGroupFlags(share.command("read").description("Read one file from a share group."))
@@ -293,7 +311,7 @@ export function registerHermes(program) {
         .option("--offset <n>", "leading lines to skip")
         .option("--limit <n>", "maximum lines to return")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({
             ...creds,
             path: sharePath(opts.group, "read"),
@@ -303,7 +321,7 @@ export function registerHermes(program) {
     shareGroupFlags(share.command("stat").description("Stat one share-group path."))
         .requiredOption("--path <path>", "path relative to the share root")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: sharePath(opts.group, "stat"), query: { path: opts.path } }));
     });
     shareGroupFlags(share.command("grep").description("Search share-group file contents."))
@@ -312,7 +330,7 @@ export function registerHermes(program) {
         .option("--ignore-case", "case-insensitive match")
         .option("--max <n>", "maximum results")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({
             ...creds,
             path: sharePath(opts.group, "grep"),
@@ -324,7 +342,7 @@ export function registerHermes(program) {
         .option("--path <path>", "path relative to the share root")
         .option("--max <n>", "maximum results")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({
             ...creds,
             path: sharePath(opts.group, "find"),
@@ -336,7 +354,7 @@ export function registerHermes(program) {
         .option("--content <text>", "file contents", "")
         .addOption(new Option("--mode <mode>", "write mode").choices(["overwrite", "append"]))
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({
             ...creds,
             method: "POST",
@@ -347,21 +365,21 @@ export function registerHermes(program) {
     shareGroupFlags(share.command("mkdir").description("Create a share-group directory."))
         .requiredOption("--path <path>", "directory path relative to the share root")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, method: "POST", path: sharePath(opts.group, "mkdir"), body: { path: opts.path } }));
     });
     shareGroupFlags(share.command("move").description("Move a share-group path."))
         .requiredOption("--from <path>", "source path relative to the share root")
         .requiredOption("--to <path>", "destination path relative to the share root")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, method: "POST", path: sharePath(opts.group, "move"), body: { from: opts.from, to: opts.to } }));
     });
     shareGroupFlags(share.command("rm").description("Remove a share-group path."))
         .requiredOption("--path <path>", "path relative to the share root")
         .option("--recursive", "required to remove a non-empty directory")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({
             ...creds,
             method: "POST",
@@ -371,14 +389,14 @@ export function registerHermes(program) {
     });
     const skills = group.command("skills").description("Skills installed on this tenant");
     agentFlags(skills.command("list").description("List this tenant's skills.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/skills" }));
     });
     for (const [verb, enabled] of [["enable", true], ["disable", false]]) {
         agentFlags(skills.command(verb).description(`${verb[0].toUpperCase()}${verb.slice(1)} one skill on this tenant.`))
             .requiredOption("--skill <name>", "skill name")
             .action(async (opts) => {
-            const creds = await credentials(program, opts);
+            const creds = await credentials(program, opts, deps);
             out(await hermesCall({
                 ...creds,
                 method: "PUT",
@@ -391,28 +409,28 @@ export function registerHermes(program) {
         .requiredOption("--category <category>", "skill category")
         .requiredOption("--skill <skill>", "skill name")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: `/v1/tenant-api/tenant/skills/${seg(opts.category)}/${seg(opts.skill)}/files` }));
     });
     agentFlags(skills.command("cat").description("Read one skill file."))
         .requiredOption("--path <skillPath>", "slash-delimited path relative to $HERMES_HOME/skills")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: `/v1/tenant-api/tenant/skill-files/${segments(opts.path)}` }));
     });
     const flavor = group.command("flavor").description("Flavor marketplace and this tenant's flavor pin");
     agentFlags(flavor.command("current").description("Show this tenant's current flavor pin.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: "/v1/tenant-api/flavors/current" }));
     });
     agentFlags(flavor.command("catalog").description("List the flavor catalog.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: "/v1/tenant-api/flavors" }));
     });
     agentFlags(flavor.command("get").description("Get one catalog flavor."))
         .requiredOption("--flavor <flavorId>", "flavor id")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: `/v1/tenant-api/flavors/${seg(opts.flavor)}` }));
     });
     agentFlags(flavor.command("set").description("Re-pin this tenant to another version of its flavor."))
@@ -420,7 +438,7 @@ export function registerHermes(program) {
         .option("--flavor <flavorId>", "flavor id (defaults to the current pin)")
         .option("--force", "proceed despite a downgrade or deprecated target")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         const current = await currentFlavor(creds);
         const flavorId = opts.flavor ?? current?.id;
         if (!flavorId) {
@@ -446,7 +464,7 @@ export function registerHermes(program) {
     agentFlags(flavor.command("subscribe").description("Set this tenant's flavor update policy."))
         .addOption(new Option("--policy <policy>", "update policy").choices(["pinned", "stable", "canary", "auto_patch"]).makeOptionMandatory())
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({
             ...creds,
             method: "PUT",
@@ -459,7 +477,7 @@ export function registerHermes(program) {
         .requiredOption("--out <file>", "write the gzipped tarball here")
         .option("--flavor <flavorId>", "flavor id (defaults to the current pin)")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         const flavorId = await resolveFlavorId(creds, opts.flavor);
         const bytes = await downloadToFile(creds, `/v1/tenant-api/flavors/${seg(flavorId)}/versions/${seg(opts.flavorVersion)}/source`, opts.out);
         out({ path: opts.out, bytes });
@@ -468,7 +486,7 @@ export function registerHermes(program) {
         .requiredOption("--archive <file>", "gzipped flavor package built beforehand")
         .option("--flavor <flavorId>", "flavor id (defaults to the current pin)")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         const flavorId = await resolveFlavorId(creds, opts.flavor);
         const data = await readArchive(opts.archive);
         out(await guardOwnership("flavor", flavorId, creds.tenantId, () => hermesUpload({
@@ -487,7 +505,7 @@ export function registerHermes(program) {
         .option("--force", "accept the blast radius of --all-matching")
         .action(async (opts) => {
         const body = rolloutBody(opts);
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         const flavorId = await resolveFlavorId(creds, opts.flavor);
         const result = (await guardOwnership("flavor", flavorId, creds.tenantId, () => hermesCall({
             ...creds,
@@ -500,13 +518,13 @@ export function registerHermes(program) {
     });
     const skill = group.command("skill").description("Skill marketplace (owner-gated for publish)");
     agentFlags(skill.command("catalog").description("List the skill catalog.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: "/v1/tenant-api/skills" }));
     });
     agentFlags(skill.command("get").description("Get one catalog skill."))
         .requiredOption("--skill <skillId>", "skill id")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: `/v1/tenant-api/skills/${seg(opts.skill)}` }));
     });
     agentFlags(skill.command("checkout").description("Download one skill version's source tarball."))
@@ -514,7 +532,7 @@ export function registerHermes(program) {
         .requiredOption("--skill-version <version>", "skill version")
         .requiredOption("--out <file>", "write the gzipped tarball here")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         const bytes = await downloadToFile(creds, `/v1/tenant-api/skills/${seg(opts.skill)}/versions/${seg(opts.skillVersion)}/source`, opts.out);
         out({ path: opts.out, bytes });
     });
@@ -522,7 +540,7 @@ export function registerHermes(program) {
         .requiredOption("--skill <skillId>", "skill id")
         .requiredOption("--archive <file>", "gzipped skill package built beforehand")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         const data = await readArchive(opts.archive);
         out(await guardOwnership("skill", opts.skill, creds.tenantId, () => hermesUpload({
             ...creds,
@@ -533,13 +551,13 @@ export function registerHermes(program) {
     });
     const evals = group.command("eval").description("Flavor eval suites and runs");
     agentFlags(evals.command("suites").description("List eval suites for this tenant's flavor.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/flavor/eval-suites" }));
     });
     agentFlags(evals.command("run").description("Start an eval run."))
         .requiredOption("--suite <suiteId>", "eval suite id")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, method: "POST", path: "/v1/tenant-api/tenant/flavor/eval-runs", body: { suiteId: opts.suite } }));
     });
     agentFlags(evals.command("list").description("List this tenant's eval runs."))
@@ -547,7 +565,7 @@ export function registerHermes(program) {
         .option("--status <status>", "filter by status")
         .option("--limit <n>", "maximum runs to return")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({
             ...creds,
             path: "/v1/tenant-api/tenant/eval-runs",
@@ -557,24 +575,24 @@ export function registerHermes(program) {
     agentFlags(evals.command("get").description("Get one eval run."))
         .requiredOption("--run <evalRunId>", "eval run id")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: `/v1/tenant-api/tenant/eval-runs/${seg(opts.run)}` }));
     });
     agentFlags(evals.command("cancel").description("Cancel one eval run."))
         .requiredOption("--run <evalRunId>", "eval run id")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, method: "POST", path: `/v1/tenant-api/tenant/eval-runs/${seg(opts.run)}:cancel` }));
     });
     const peers = group.command("peers").description("A2A peers");
     agentFlags(peers.command("list").description("List this tenant's A2A peers.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: "/v1/tenant-api/peers" }));
     });
     agentFlags(peers.command("get").description("Get one peer."))
         .requiredOption("--peer <peerId>", "peer id")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: `/v1/tenant-api/peers/${seg(opts.peer)}` }));
     });
     jsonOption(agentFlags(peers.command("call").description("Send a message to a peer.")), "body", "request body as JSON (overrides the other flags)")
@@ -585,7 +603,7 @@ export function registerHermes(program) {
         .option("--wait-seconds <n>", "seconds to wait for a reply")
         .option("--idempotency-key <key>", "idempotency key (generated when omitted)")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         const body = parseJson(opts.body, "--body") ??
             (opts.message !== undefined
                 ? {
@@ -607,7 +625,7 @@ export function registerHermes(program) {
         .option("--exclude-capability <name>", "capability the peer must not have (repeatable)", collect)
         .option("--limit <n>", "maximum peers to return")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         const body = parseJson(opts.body, "--body") ?? {
             ...(opts.query ? { query: opts.query } : {}),
             ...(opts.requiredCapability?.length ? { requiredCapabilities: opts.requiredCapability } : {}),
@@ -618,19 +636,19 @@ export function registerHermes(program) {
     });
     const conversations = group.command("conversations").description("A2A conversations");
     agentFlags(conversations.command("list").description("List conversations.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: "/v1/tenant-api/conversations" }));
     });
     agentFlags(conversations.command("get").description("Get one conversation."))
         .requiredOption("--context <contextId>", "conversation context id")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: `/v1/tenant-api/conversations/${seg(opts.context)}` }));
     });
     agentFlags(conversations.command("messages").description("List one conversation's messages."))
         .requiredOption("--context <contextId>", "conversation context id")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: `/v1/tenant-api/conversations/${seg(opts.context)}/messages` }));
     });
     const sessions = group.command("sessions").description("Tenant agent sessions");
@@ -638,12 +656,12 @@ export function registerHermes(program) {
         .option("--limit <n>", "maximum sessions to return")
         .option("--source <source>", "filter by source")
         .action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/sessions", query: { limit: opts.limit, source: opts.source } }));
     });
     agentFlags(group.command("artifacts").description("List this tenant's artifacts.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
+        const creds = await credentials(program, opts, deps);
         out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/artifacts" }));
     });
 }
-//# sourceMappingURL=hermes.js.map
+//# sourceMappingURL=hub.js.map