@kvell007/embed-labs-cli 0.1.0-alpha.97 → 0.1.0-alpha.99

package/README.md

@@ -1,40 +1,42 @@
-# @embed-labs/cli
+# EmbedLabs CLI
 
-Command-line interface for Embed Labs Cloud.
+Command-line interface for the EmbedLabs local-first embedded Native Agent.
 
 ## Package Status
 
-The experimental personal-scope CLI is published for integration testing as
-`@kvell007/embed-labs-cli`. The long-term `@embed-labs/cli` release is still
-pending organization scope ownership, license, support URLs, and release policy.
-The workspace manifest intentionally remains marked `private: true`; release
-scripts stage temporary public packages without changing the source package
-names.
+The public user-facing npm package is `embedlabs` and exposes the `embedlabs`
+binary. The internal workspace package is still named `@embed-labs/cli` for
+local monorepo builds and staged release scripts; do not document it as the
+normal public install package.
 
 ## What It Provides
 
 - `embedlabs` binary exposed by the npm `bin` entry after install.
-- `embed` remains exposed as a compatibility alias while existing scripts,
-  plugin bridges, and docs finish migrating.
-- First-run diagnostic command for CLI runtime, auth, Local Bridge, local scans,
-  and Cloud API readiness.
-- Local bridge startup and status commands.
-- Auth token login, logout, and status commands.
-- Account registration, API key issue/list, token usage metering, and billing
-  statement preview commands.
-- Board knowledge/method discovery through Cloud API, plus local-first
-  toolchain installation, validation, compile, and hardware handoff.
+- `embedlabs` is the documented user entrypoint. The shorter `embed` binary is
+  not part of the current public package surface and must not be used in new
+  public examples.
+- First-run diagnostic command for CLI runtime, local model config, Agent
+  installation identity, Local Bridge, local scans, and optional public-report
+  readiness.
+- Local model/provider configuration and local Agent chat/run/status/memory
+  commands.
+- Local bridge status and advanced diagnostic startup commands. Normal hardware
+  workflows should enter through Agent actions; the Agent may start or reach the
+  bridge as needed.
+- Local installation identity and redacted public-experience report commands.
+  These do not require an EmbedLabs platform API key for local Agent use.
+- Board knowledge/method discovery through BoardPack/registry metadata, plus
+  local-first toolchain installation, validation, compile, and hardware
+  handoff.
 - Debug tool, device, serial, SSH, and flash commands routed through the local
   bridge.
-- Project, task, artifact, and cloud status commands routed through the cloud
-  API.
-- Approval request, list, show, approve, and reject commands routed through the
-  cloud API.
+- BoardPack/download manifest, plugin release, redacted report, and cloud
+  status commands routed through the cloud API when needed.
 - Human-readable output by default and `--json` output for automation.
 
-The installed binary is the primary interface. Package and library APIs are
-secondary implementation details for now; do not treat `@embed-labs/cli` as a
-public SDK until a versioned API contract is approved.
+The installed `embedlabs` binary is the primary interface. Package and library
+APIs are secondary implementation details for now; do not treat the internal
+workspace package as a public SDK until a versioned API contract is approved.
 
 ## Install
 
@@ -44,11 +46,32 @@ Current experimental npm install:
 npm install -g embedlabs@latest
 embedlabs --help
 embedlabs help getting-started
-embedlabs local toolchain list
+embedlabs config set model <provider>/<model> && embedlabs config set <PROVIDER>_API_KEY <key>
+embedlabs config set providers.<provider>.base_url <openai-compatible-base-url>
+embedlabs config set profiles.spark.model <provider>/<model>
+embedlabs config set profiles.spark.base_url <openai-compatible-base-url>
+embedlabs config set profile spark
+embedlabs agent init
+embedlabs agent status
+embedlabs agent action run install_toolchain --operation list --json
 embedlabs plugin update check
 embedlabs plugin update
 ```
 
+Install or reinstall the IDE compatibility plugins through the CLI:
+
+```bash
+embedlabs plugin install codex
+embedlabs plugin install opencode
+embedlabs plugin install trae
+embedlabs plugin install all --force
+```
+
+These Codex, OpenCode, and Trae installers are retained IDE compatibility
+entrypoints into the local Native Agent. Removing old platform auth, billing,
+quota, or server-workspace flows must not remove these plugin install/update
+commands.
+
 Clean reinstall:
 
 ```bash
@@ -57,23 +80,22 @@ npm install -g embedlabs@latest
 embedlabs plugin install all --force
 ```
 
-Trae users can install only the Trae MCP integration:
+Trae users can install only the Trae integration:
 
 ```bash
-embedlabs auth login --token <your_token>
 embedlabs plugin install trae
 ```
 
-The Trae installer writes Trae's `mcp.json`, configures
-`embedlabs mcp start`, copies the Embed Labs icon, and creates the local
-Gallery metadata Trae uses for MCP icons. Restart Trae after installation.
+The Trae installer writes Trae's technical `mcp.json`, configures the local
+compatibility transport, copies the EmbedLabs icon, and creates the local
+Gallery metadata Trae uses for plugin icons. Restart Trae after installation.
 
-For IDEs that support MCP but do not have an automatic installer yet, generate
-the correct manual MCP config:
+Maintainers can still generate MCP config snippets for diagnostics or new
+adapter development, but this is not the normal user install path and must not
+replace the retained Codex/OpenCode/Trae installers:
 
 ```bash
 embedlabs mcp config
-embedlabs mcp config --client cursor
 embedlabs mcp config --client trae
 ```
 
@@ -84,14 +106,6 @@ aliases once with:
 npm uninstall -g embedlabs-cli embedboard embedboard-cli
 ```
 
-Future organization-scope install after final release approval:
-
-```bash
-npm install -g @embed-labs/cli
-embedlabs --help
-embedlabs help getting-started
-```
-
 Local package testing before public npm publish:
 
 ```bash
@@ -115,76 +129,82 @@ node packages/cli/dist/index.js help getting-started
 embedlabs --help
 embedlabs help getting-started
 embedlabs doctor
-embedlabs auth login --token <token>
+embedlabs config set model <provider>/<model> && embedlabs config set <PROVIDER>_API_KEY <key>
+embedlabs agent init
+embedlabs agent status
 ```
 
-If a cloud or plugin command reaches a protected API before a token is
-configured, the CLI returns `auth_token_missing` with the registration URL and
-these setup options:
+Local Agent, Local Bridge, BoardPack, SDK install, compile, flash, deploy, and
+debug workflows do not require an EmbedLabs platform API key. Model provider
+keys are configured locally and must not be uploaded to EmbedLabs servers.
 
-```bash
-open https://api.embedboard.com/dashboard
-embedlabs auth login --token <your_token>
-# or for automation:
-export EMBED_API_TOKEN=<your_token>
-embedlabs auth status
-```
+If optional public-experience reporting is unavailable, the CLI should keep
+local Agent, Local Bridge, SDK, compile, flash, deploy, and debug workflows
+running and report the upload limitation separately. Public reports must be
+redacted and associated with the local installation identity rather than
+requiring a platform API key for normal local use.
 
-If `.embed-labs/auth.json` was copied from another computer, protected Cloud
-requests fail before network I/O with `tool_integrity_check_failed` and the
-message `工具完整性校验失败，请在当前电脑重新执行 embedlabs auth login --token <key>`.
+If an old or copied local identity file comes from another computer,
+identity-sensitive sync commands must fail before network I/O with
+`tool_integrity_check_failed` and tell the user to reinitialize EmbedLabs on the
+current computer. Legacy platform auth-token files are not accepted as a
+compatibility path.
 
 For the current public API plus local TaishanPi verification path, see
 `docs/runbooks/PUBLIC_CLI_USER_VERIFICATION.md`.
 
-For board knowledge and local toolchain work:
+For board knowledge, SDK/toolchain, build, flash, deploy, and capture work,
+use the Native Agent first:
 
 ```bash
-embed board registry list
-embed board methods taishanpi-1m-rk3566
-embed board knowledge search taishanpi-1m-rk3566 --query "UART pinout"
-embed local toolchain list
-embed local toolchain latest --board taishanpi-1m-rk3566
-embed local toolchain validate --board taishanpi-1m-rk3566 --mode minimal
-embed local compile taishanpi --source ./main.c --output ./.embed-labs/build/main
+embedlabs agent run --prompt "当前支持哪些开发板"
+embedlabs agent run --prompt "泰山派的 UART 引脚是什么"
+embedlabs agent action run manage_board_pack --operation list --json
+embedlabs agent action run manage_board_pack --operation show --template-id taishanpi-1m-rk3566 --json
+embedlabs agent action run install_toolchain --operation list --json
+embedlabs agent action run install_toolchain --operation install --board-id taishanpi-1m-rk3566 --mode compile --json
+embedlabs agent action run build_project --board-id taishanpi-1m-rk3566 --source ./main.c --json
+embedlabs agent action run flash_image --board-id <board_id> --artifact <image_or_uf2> --approve --json
+embedlabs agent action run deploy_app --board-id taishanpi-1m-rk3566 --artifact <local_file> --remote-dir /userdata/embed-labs/apps --approve --json
+embedlabs agent action run capture_signal --board-id pico2w-rp2350-monitor --device <local_device_id> --approve --json
 ```
 
 Server-side user workspaces and server Docker builds are disabled in the
-local-first product mode. The server remains responsible for accounts, API
-keys, model routing, billing, plugin releases, SDK/download metadata, and small
-image/DTB/logo package generation.
+local-first product mode. The server remains responsible for software downloads,
+version manifests, SDK/BoardPack/tool/plugin package metadata, public knowledge,
+redacted public-experience report intake, admin/owner review, Maintainer task
+handoff, and release evidence.
 
-For local hardware access:
+For local hardware access, the Agent reads GoLocalBridge inventory through
+high-level actions and returns board-level status:
 
 ```bash
-embed bridge start
-embed device list
-embed tool call wifi.scan --input-json '{"host":"198.19.77.2","user":"root"}'
-embed tool call rp2350.monitor.capabilities --json
-embed tool call rp2350.monitor.gpio.read --input-json '{"pins":[16,17],"pull":"none"}' --approve
-embed tool call rp2350.monitor.spi.transfer --input-json '{"hex":"a55a3cc3"}' --approve
-embed tool call rp2350.monitor.uart.write --input-json '{"baud":115200,"text":"hello","line_ending":"lf"}' --approve
-embed tool call rp2350.monitor.i2c.transfer --input-json '{"address":"0x50","write":"00","read_len":4}' --approve
-embed tool call rp2350.monitor.wifi.manage --input-json '{"action":"scan"}' --approve
-embed tool call rp2350.monitor.probe.debug --input-json '{"action":"status"}' --approve
-embed tool call chip.temperature --input-json '{"host":"198.19.77.2","user":"root"}'
-embed flash plan --board <rp2350|taishanpi> --artifact ./artifact.bin
+embedlabs agent run --prompt "查看当前开发板状态"
+embedlabs agent action run detect_board --json
 ```
 
+Low-level BoardPack catalog, local toolchain, bridge, task, and Cloud API commands
+exist for owner diagnostics, smoke tests, and compatibility adapters. They are
+not the normal user workflow and should not be the first examples shown to
+users or IDE agents.
+
 For local Cloud API development, override the production default:
 
 ```bash
-EMBED_CLOUD_API_URL=http://127.0.0.1:18100 embed cloud status
+EMBED_CLOUD_API_URL=http://127.0.0.1:18100 embedlabs cloud status
 ```
 
 ## Interaction Modes
 
-- Human terminal: run `embed` directly and read the default output.
-- Local scripts and CI: run `embed ... --json` and parse the response envelope.
-- Localhost tools: start `embed bridge start` and call the Local Bridge HTTP API
-  only from trusted same-host tools.
-- Remote AI: use Cloud API tasks, events, artifacts, and evidence instead of
-  direct local bridge or unrestricted hardware access.
+- Human terminal: run `embedlabs` directly and read the default output.
+- Local scripts and CI: run `embedlabs ... --json` and parse the response
+  envelope.
+- Localhost tools: use `embedlabs agent action run ...` for hardware-facing
+  work. Direct Local Bridge HTTP calls and manual bridge startup are reserved
+  for trusted same-host diagnostics and compatibility adapter development.
+- Remote/service-side analysis: consume redacted public-experience reports,
+  owner-reviewed Maintainer tasks, and release evidence. It must not create
+  normal-user Cloud tasks or call Local Bridge on the user's behalf.
 - Future IDE and Warp flows: wrap the same CLI, Local Bridge, and Cloud API
   boundaries rather than depending on internal package APIs.
 
@@ -194,138 +214,72 @@ remain local and approval-gated.
 
 ## Common Commands
 
-`embed --help` is intentionally a short first-run guide. Use
-`embed help getting-started` for the guided workflow or `embed help commands`
+`embedlabs --help` is intentionally a short first-run guide. Use
+`embedlabs help getting-started` for the guided workflow or `embedlabs help commands`
 for the full command reference.
 
 ```bash
-embed doctor [--json]
-
-embed auth login --token <token> [--profile default]
-embed auth status
-embed auth logout
-
-embed account create --email <email> [--display-name <name>] [--json]
-embed account show <account_id> [--json]
-embed account keys create --account <account_id> [--name <name>] [--json]
-embed account keys list --account <account_id> [--json]
-embed account keys revoke <api_key_id> [--json]
-
-embed usage record --api-key <key>|--api-key-id <api_key_id> --model <model> --input-tokens <n> --output-tokens <n> [--provider <name>] [--operation <name>] [--task <task_id>] [--request-id <id>] [--json]
-embed usage summary --account <account_id>|--api-key-id <api_key_id> [--from <iso>] [--to <iso>] [--json]
-embed usage events --account <account_id> [--api-key-id <api_key_id>] [--from <iso>] [--to <iso>] [--limit 100] [--json]
-embed billing statement --account <account_id> [--from <iso>] [--to <iso>] [--json]
-embed billing balance --account <account_id> [--json]
-embed billing recharge create --account <account_id> --amount-usd <amount> [--provider mock|stripe|onchain] [--chain <chain>] [--token <symbol>] [--qr] [--json]
-embed billing recharge submit-tx <recharge_session_id> --tx-hash <hash> [--json]
-embed billing recharge list --account <account_id> [--json]
-embed billing recharge show <recharge_session_id> [--json]
-embed billing snapshot create --account <account_id> [--from <iso>] [--to <iso>] [--json]
-embed billing snapshot list --account <account_id> [--json]
-embed billing snapshot show <billing_snapshot_id> [--json]
-
-embed board registry list [--json]
-embed board methods <template_id> [--json]
-embed board knowledge <template_id> [--json]
-embed board knowledge search <template_id> --query <text> [--json]
-embed build template list [--json]
-embed build template show <template_id> [--json]
-embed local toolchain list [--board <board_id>] [--json]
-embed local toolchain installed [--board <board_id>] [--json]
-embed local toolchain latest [--board <board_id>] [--json]
-embed local toolchain current [--json]
-embed local toolchain install [--board <board_id>] [--mode minimal|runtime|compile|qt|firmware|full|images] [--json]
-embed local toolchain validate [--board <board_id>] [--mode minimal|runtime|compile|qt|firmware|full|images] [--json]
-embed local compile taishanpi --source <main.c|main.cpp> --output <artifact> [--json]
-embed local build qt-smoke --build-dir <build_dir> [--source <qt-cmake-dir>] [--target-name <executable>] [--json]
+embedlabs doctor [--json]
+
+embedlabs config set model <provider>/<model> && embedlabs config set <PROVIDER>_API_KEY <key>
+embedlabs config set providers.<provider>.base_url <openai-compatible-base-url>
+embedlabs config set profiles.<profile>.model <provider>/<model>
+embedlabs config set profiles.<profile>.base_url <openai-compatible-base-url>
+embedlabs config set profile <profile>
+embedlabs config show [--json]
+embedlabs agent init [--json]
+embedlabs agent status [--json]
+embedlabs agent run --prompt <request> [--json]
+embedlabs agent chat --prompt <request> [--json]
+embedlabs agent memory [show|search|export|clear|refine] [--json]
+embedlabs agent report [list|submit] [--limit <n>] [--offset <n>] [--all] [--status pending|uploaded|failed] [--category <category>] [--severity low|medium|high|critical] [--component <component>] [--board <board_id>] [--variant <variant_id>] [--action <action_id>] [--capability <capability_id>] [--error-code <code>] [--json]
+embedlabs agent sync [--limit <n>] [--timeout-ms <ms>] [--json]
+
+embedlabs agent action list [--json]
+embedlabs agent action describe detect_board [--json]
+embedlabs agent action run detect_board [--json]
+embedlabs agent action run query_board_knowledge --board-id <board_id> --query <text> [--json]
+embedlabs agent action run install_toolchain --operation install --board-id <board_id> [--json]
+embedlabs agent action run build_project --board-id taishanpi-1m-rk3566 --source <main.c|main.cpp> [--json]
+embedlabs agent action run flash_image --board-id <board_id> --artifact <image_or_uf2> --approve [--json]
+embedlabs agent action run deploy_app --board-id taishanpi-1m-rk3566 --artifact <local_file> --remote-dir /userdata/embed-labs/apps --approve [--json]
+embedlabs agent action run debug_board --board-id <board_id> --device <local_device_id> [--json]
+embedlabs agent action run capture_signal --board-id pico2w-rp2350-monitor --device <local_device_id> --approve [--json]
+```
+
+Advanced diagnostics and compatibility commands are available for maintainers:
+
+```bash
+embedlabs board pack list [--json]
+embedlabs board methods <template_id> [--json]
+embedlabs board knowledge search <template_id> --query <text> [--json]
+embedlabs local toolchain list [--board <board_id>] [--json]
+embedlabs local toolchain validate [--board <board_id>] [--mode minimal|runtime|compile|qt|firmware|full|images] [--json]
+embedlabs local compile taishanpi --source <main.c|main.cpp> --output <artifact> [--json]
+embedlabs bridge start [--host 127.0.0.1] [--port 18083]
+embedlabs bridge status [--json]
+embedlabs mcp start [--bridge-path <path>]
+embedlabs mcp config [--client generic|trae] [--absolute-command] [--cloud-url <url>] [--json]
+```
 
 The `qt-smoke` subcommand name is kept for compatibility. When `--source` and
 `--target-name` are supplied, it builds the supplied TaishanPi Qt/CMake
 application, including official board-pack examples such as
 `board-packs/taishanpi/examples/modbus-loop-demo/taishanpi`.
 
-embed bridge start [--host 127.0.0.1] [--port 18083]
-embed bridge status [--json]
-
-embed debug tools [--json]
-
-embed device list [--json]
-embed device probe --host <host> --ports 22,15301 [--serial-path <path>] [--timeout-ms 1000] [--json]
-embed tool list [--json]
-embed tool call wifi.scan --input-json '{"host":"198.19.77.2","user":"root"}' [--json]
-embed tool call bluetooth.scan --input-json '{"host":"198.19.77.2","user":"root","duration_seconds":8}' [--json]
-embed tool call chip.cpu.frequency --input-json '{"host":"198.19.77.2","user":"root"}' [--json]
-embed tool call chip.temperature --input-json '{"host":"198.19.77.2","user":"root"}' [--json]
-embed tool call qml.runtime.status --input-json '{"host":"198.19.77.2","user":"root","port":18130}' [--json]
-embed tool call qml.runtime.start --input-json '{"host":"198.19.77.2","user":"root","port":18130}' [--json]
-embed tool call rp2350.monitor.capabilities [--json]
-embed tool call rp2350.monitor.gpio.read --input-json '{"pins":[16,17]}' --approve [--json]
-embed tool call rp2350.monitor.spi.transfer --input-json '{"hex":"a55a3cc3"}' --approve [--json]
-embed tool call rp2350.monitor.uart.write --input-json '{"baud":115200,"text":"hello","line_ending":"lf"}' --approve [--json]
-embed tool call rp2350.monitor.i2c.transfer --input-json '{"address":"0x50","write":"00","read_len":4}' --approve [--json]
-embed tool call rp2350.monitor.wifi.manage --input-json '{"action":"scan"}' --approve [--json]
-embed tool call rp2350.monitor.probe.debug --input-json '{"action":"status"}' --approve [--json]
-embed tool call rp2350.monitor.operation --input-json '{"action":"logic.stop","params":{}}' --approve [--json]
-
-embed serial list [--json]
-embed serial capture --path <port> [--baud 115200] [--duration 5] [--json]
-embed ssh run --host <host> [--user root] -- <command> [--json]
-
-embed flash plan --board <rp2350|taishanpi> [--artifact file.uf2] [--image-dir dir] [--json]
-embed flash run --board <rp2350|taishanpi> --approve [--artifact file.uf2] [--image-dir dir] [--json]
-embed task list [--json]
-embed task status <local_job_id> [--json]
-
-embed project create <name> [--board <board_id>] [--workspace <path>] [--json]
-embed project list [--json]
-embed project status <project_id> [--json]
-
-embed ask --prompt <request> [--project <project_id>] [--board <board_id>] [--json]
-embed cloud status [--json]
-embed cloud task create [--kind build.firmware] [--progress-text "Task created."] [--json]
-embed cloud task list [--json]
-embed cloud task status <task_id> [--json]
-embed cloud task events <task_id> [--json]
-embed cloud task artifacts <task_id> [--json]
-embed cloud task evidence <task_id> [--json]
-embed cloud task event append <task_id> [--state <state>] [--progress-stage <stage>|--stage <stage>] [--progress-text <text>|--message <text>] [--progress-percent 0-100] [--severity info|warning|error] [--type <event_type>] [--artifact-json '<json>'] [--evidence-json '<json>'] [--json]
-embed artifact status <artifact_id> [--json]
-
-embed approval request --task <task_id> --action <action> --risk <low|medium|high|destructive> --plan-summary <summary> [--affected-device <id>] [--affected-artifact <id>] [--expires-at <iso>] [--json]
-embed approval list --task <task_id> [--json]
-embed approval show <approval_id> [--json]
-embed approval approve <approval_id> [--decided-by <name>] [--json]
-embed approval reject <approval_id> [--decided-by <name>] [--json]
-```
+Account, usage, billing, recharge, quota, and platform-token login commands are
+not part of the current EmbedLabs CLI. Native Agent setup uses local model
+configuration plus the local installation identity.
+
+Advanced/internal diagnostics exist for owner maintenance and compatibility
+tests, but normal users should go through `embedlabs agent run`, `embedlabs
+agent chat`, or the high-level `embedlabs agent action run ...` surface.
+Hidden diagnostic commands are intentionally omitted from this user reference
+and must not be selected before the high-level Agent action layer.
 
-`embed approval request` creates a task-scoped approval record with the Cloud
-API. Repeat `--affected-artifact` to attach multiple artifact IDs. Approval
-commands record request and decision state in the Cloud API only. They do not
-execute Local Bridge actions; any future local runner must re-check the approval
-record before running one bounded localhost action.
-
-`embed account keys create` returns the raw API key only in the creation
-response. Store it in a secret manager or environment variable; future list and
-summary commands show metadata, key prefix, and usage totals but never the raw
-key. `embed usage record` is the current metering ingestion path used by smoke
-tests and future billing reports. Reusing the same `request_id` for the same
-API key returns the original usage record so callers can safely retry without
-double counting. `embed account keys revoke` marks a key unusable for future
-usage ingestion while preserving historical usage and billing evidence.
-`embed usage events` lists the account's raw usage records for audit and
-settlement investigation without exposing raw API key material. Event reads are
-bounded; the server default is 100 and the current maximum is 500.
-
-`embed billing statement` reads the account's recorded token usage and applies
-the Cloud API's configured input/output micro USD per-token rates. It is a
-preview for product and settlement validation, not an invoice or payment action.
-`embed billing recharge create --provider onchain --qr` creates a wallet payment
-session and renders the payment URI as a terminal QR. After paying from a wallet,
-`embed billing recharge submit-tx <recharge_session_id> --tx-hash <hash>` sends
-the payment evidence to the server for confirmation and crediting.
-`embed billing snapshot create` freezes one statement preview result so later
-queries can compare against a stable settlement input. Snapshots are still MVP
-preview records; they are not invoices and do not collect payment.
+The upstream architecture audit command is owner-maintainer only and requires
+`EMBEDLABS_ENABLE_UPSTREAM_AUDIT=1`; it is not part of normal user onboarding
+or ordinary embedded development workflows.
 
 ## Environment
 
@@ -333,18 +287,22 @@ preview records; they are not invoices and do not collect payment.
   `http://127.0.0.1:18083`.
 - `EMBED_CLOUD_API_URL`: cloud API URL used by cloud-backed commands. Default:
   `https://api.embedboard.com`.
-- `EMBED_API_TOKEN`: auth token source for non-interactive sessions.
-- `EMBED_AUTH_PROFILE`: profile name used with `EMBED_API_TOKEN`.
-- `EMBED_AUTH_FILE`: token file path for `embed auth login`. Default:
-  `.embed-labs/auth.json`.
-- `EMBED_BILLING_INPUT_MICROUSD_PER_TOKEN` and
-  `EMBED_BILLING_OUTPUT_MICROUSD_PER_TOKEN`: Cloud API server-side statement
-  preview rates. These are read by the Cloud API process, not by the CLI.
-
-`embed doctor --json` is safe to run before services are started. Missing Local
-Bridge or Cloud API services are reported inside the structured doctor result as
-`unreachable` or `not_ready`; the command does not start services or mutate
-hardware or Cloud API state.
+- `EMBED_AGENT_HOME`: optional Agent home override. Default:
+  `~/.embedlabs/agent`.
+  The Agent installation identity is stored below this directory as
+  `installation.json`.
+- `EMBEDLABS_ENABLE_UPSTREAM_AUDIT`: owner-maintainer source-checkout gate for
+  upstream architecture audits. Leave unset for normal user flows.
+
+`embedlabs doctor --json` is safe to run before services are started. It checks
+Node.js, the local installation identity, Local Bridge, and optional Cloud API
+health. Missing or copied installation identity is reported as a local readiness
+problem with `embedlabs agent identity init --reset` as the repair command.
+Missing Local Bridge is also reported as a local readiness problem because
+hardware actions use the bridge. Missing Cloud API is reported as a warning only:
+local Agent workflows can still run, while downloads, update checks, and public
+report upload may be unavailable. The command does not start services, create
+platform accounts, mutate hardware, or mutate Cloud API state.
 
 ## Hardware Support Boundary
 
@@ -353,15 +311,15 @@ perform direct hardware access itself.
 
 Current local workflows are intentionally guarded:
 
-- Device commands can report local detection and probe evidence.
-- `embed debug tools` reports local debug tool availability and version/help
-  evidence without opening probes or starting debug sessions.
-- RP2350 UF2 flashing requires a mounted UF2 volume, a `.uf2` artifact, a ready
-  flash plan, and explicit `--approve`.
-- TaishanPi initialization image flashing resolves the installed local SDK
-  image set by default. `embed flash run --board taishanpi --approve` writes
-  through Local Bridge only after the ready plan validates `rkdeveloptool`,
-  `parameter.txt`, and all required images.
+- Board detection uses the Agent `detect_board` action, which reads the current
+  GoLocalBridge inventory and filters it to supported development boards.
+- RP2350 and TaishanPi flashing should go through `embedlabs agent action run
+  flash_image ... --approve`; the Agent resolves the board, validates the local
+  SDK artifact, asks for explicit approval, and delegates the bounded operation
+  to GoLocalBridge.
+- Protocol capture, board debug, and deployment should go through the matching
+  Agent actions so BoardPack knowledge, target selection, approval checks, and
+  recovery guidance stay in one layer.
 
 These commands should be treated as current local evidence and planning tools,
 not broad hardware support claims.
@@ -369,15 +327,18 @@ not broad hardware support claims.
 ## Runtime Requirements
 
 - Node.js 20 or newer.
-- A running local bridge for debug tool, device, serial, SSH, flash, and local task
-  commands. Start it with `embed bridge start`.
-- A running Embed Labs Cloud API for account, usage, billing statement, project,
-  cloud task, artifact, approval, and ask commands.
+- A reachable local bridge for board detection, protocol capture, deploy,
+  flash, and local task commands. High-level Agent actions should reach or
+  auto-start the bridge for normal local URLs; manual `embedlabs bridge start`
+  is an advanced diagnostic and release-smoke command, not ordinary onboarding.
+- A running EmbedLabs Cloud API only for download metadata, BoardPack/package
+  release metadata, plugin/package downloads, redacted public-experience report
+  uploads, and admin/owner review.
 
 ## Publish Readiness
 
 Before public publish, confirm the runbook checklist in
 `docs/runbooks/CLI_NPM_PACKAGING.md`, including approved SPDX license metadata,
 repository, issue tracker, homepage, support metadata, changelog or release
-notes, final npm scope ownership, executable verification for `embed`, and
+notes, final npm scope ownership, executable verification for `embedlabs`, and
 removal of `private: true` only in an approved metadata task.