frely-cli 0.6.1 → 0.6.6

package/README.md

@@ -1,13 +1,22 @@
 # frely-cli
 
-设计与 ChatGPT MCP 用户流程见 [`docs/chatgpt-mcp.md`](docs/chatgpt-mcp.md)。
+设备 MCP 的产品定义与通用客户端接入见 [`docs/device-mcp.md`](docs/device-mcp.md)。
 
-`frely-cli` is Frely's local command-line client and MCP runtime. The target flow is:
+`frely-cli` includes FrelyMCP: let agents access your device from any location. Browser agents and command-line agents such as Codex and Claude Code use MCP to access the files, commands and processes on the computer you authorize. Invoking Frely-hosted Agents and sharing local model Providers are optional CLI features with their own setup and authorization.
+
+**Release boundary (checked 2026-09-17):** npm `frely-cli@latest` resolves to
+`0.6.2`. The published tarball includes device MCP, Provider commands,
+`frely skill install` and `frely agent invoke`. Agent examples below apply to that
+release. Package contents establish command availability; service deployment,
+account or API-key access and client connections need their own verification.
 
 ```text
-install -> frely login -> frely mcp setup -> add stable MCP URL to ChatGPT -> OAuth authorize
+Remote Agent Skill: install -> frely login -> frely skill install -> frely agent invoke
+Device MCP:  install on target computer -> frely login -> frely mcp -> add MCP URL to client -> OAuth authorize
 ```
 
+`frely skill install` installs a local trigger Skill. It does not install a model or change the user's current model Provider/Base URL. `frely mcp` provisions local file, shell, process, and workspace execution; consuming a remote Frely Agent does not require that local execution authorization.
+
 There is no separate `friday-local` project. Local MCP execution belongs to `frely-cli`.
 
 This repository contains the open-source Frely client and local MCP runtime.
@@ -15,6 +24,13 @@ The hosted Friday Relay control plane remains a separate service dependency.
 See [`CONTRIBUTING.md`](CONTRIBUTING.md) for development guidance and
 [`SECURITY.md`](SECURITY.md) for private vulnerability reporting.
 
+## Landing page
+
+The open-source CLI landing page lives in [`site/`](site/README.md), alongside
+the CLI under the same Apache-2.0 license and trademark policy. It is prepared
+for `cli.frely.cloud` and deploys independently as a static site. Website assets
+are excluded from the npm package.
+
 ## Quick install
 
 After the standalone artifacts and installer are released, Frely can serve `install.sh` as:
@@ -41,32 +57,57 @@ npm install --global frely-cli@0.3.6
 
 ## Update an existing installation
 
-If you installed `frely-cli` with the official installer, run the [Quick install](#quick-install) installer again. It replaces the global package with the latest `frely-cli` release. If you installed the package directly with npm, run one of the commands in [Install or update with npm](#install-or-update-with-npm) again.
-
-If multiple `frely` executables are installed, list the candidates and check the npm global installation:
-
-```sh
-type -a frely
-npm prefix --global
-"$(npm prefix --global)/bin/frely" --version
-```
-
-Your shell uses the first `frely` path in `PATH`. If that path is not the npm global bin directory, put `$(npm prefix --global)/bin` earlier in `PATH` and run `frely --version` again.
-
-If the background Device Relay service is running, restart it after the update so it loads the new CLI version:
-
 ```sh
-frely mcp service stop
-frely mcp service start
-```
-
-Verify the update:
-
-```sh
-frely --version
 frely doctor
+frely upgrade
 ```
 
+`doctor` reports the installation path, distribution and latest stable version.
+Release lookup has a timeout; offline version checks do not fail other diagnostics.
+Use `doctor --json` for structured results. `upgrade` has no options and never
+changes to a different installer, edits PATH or downgrades a newer installation.
+
+On macOS/Linux, `upgrade` updates the current standalone, npm-global or Bun-global
+installation. Standalone downloads are checksum-checked and tested before the
+installed executable is replaced. npm/Bun keep their original global directory
+and run with `--ignore-scripts`. Unknown installations, local links, source
+checkouts and temporary runners are left unchanged.
+
+A matching, running Device Relay service is paused for maintenance, restarted
+and checked after installation. Credentials, device identity, MCP URL, workspace
+and authorization expiry are preserved. Stopped or uninstalled services stay
+that way. If requests or managed processes are still running, the upgrade exits
+without stopping them. Finish those tasks and run the command in a local terminal;
+an upgrade invoked inside the MCP service being upgraded is itself active work.
+The connection may disconnect during the service restart. Installation, runtime
+version and Relay connectivity are reported separately.
+
+On Windows, `upgrade` prints a PowerShell command for the detected installation.
+Run it in a local terminal after finishing Frely tasks, then run `frely doctor`.
+The CLI does not launch an update helper or schedule a background replacement.
+
+For an already-running macOS/Linux service with automatic refresh support,
+updating the same installation with npm, Bun or the standalone installer also
+loads the new version without manual service commands. The service checks local
+installation files every five seconds, waits for two stable observations and
+checks that the new CLI starts. Active calls, managed processes and buffered
+responses defer the switch; calls remain available while work finishes.
+It uses the existing service supervisor and does not download updates itself.
+The MCP address, credentials, workspace and authorization expiry stay unchanged.
+
+A service that is stopped or not installed is never started by this watcher.
+Foreground sessions, source/link installs, changes of installation path and
+Windows replacement remain outside automatic refresh. A short reconnection
+window is possible; failed or outcome-unknown calls are not replayed.
+
+Versions predating the upgrade/refresh support require a one-time transition;
+see [service maintenance and legacy upgrades](docs/service-maintenance.md).
+Manual pause/resume commands remain in maintenance help.
+
+If more than one `frely` is installed, check the path shown by `doctor` before
+upgrading. The CLI does not remove other installations or choose one by changing
+shell configuration. See [the self-upgrade contract](docs/self-upgrade.md).
+
 ## Install from a local checkout
 
 To install the current source checkout with Bun:
@@ -92,14 +133,69 @@ the lockfiles synchronized when changing dependencies.
 
 ## First use
 
+Sign in once when the consumer uses their own Frely account:
+
 ```sh
 frely login
-frely mcp setup --workspace /path/to/project
+```
+
+To choose another browser or Frely account, disable automatic browser opening:
+
+```sh
+frely login --no-browser
+```
+
+Open the printed URL only in the browser signed in to the account you want to use. Visiting a device authorization URL while signed in can bind that code to the account before you click Approve. If the default browser already opened it with another account, press Ctrl+C, run `frely login --no-browser` again, and use the **new URL**. Signing in again or reusing the old URL does not switch its account. Keep `--relay <url>` when using a custom Relay.
+
+`FRELY_NO_BROWSER=1` remains supported for scripts and existing setups. `frely login --help` lists the available options.
+
+### Invoke a Frely-hosted Agent
+
+The verified npm release `0.6.2` includes the Agent installation and invocation
+commands below. Use a published Agent with account or restricted API-key access.
+
+To install a published Frely Agent as a local trigger Skill:
+
+```sh
+frely skill install https://app.frely.cloud/api/public/virtual-models/<distribution-id> \
+  --host pi \
+  --scope global \
+  --json
+```
+
+A Creator can also provide an existing model-scoped, quota-limited API key for a sponsored/demo invocation. Pass it only on stdin so it never appears in argv or the generated Skill:
+
+```sh
+printf '%s' "$FRELY_AGENT_KEY" | \
+  frely skill install https://app.frely.cloud/api/public/virtual-models/<distribution-id> \
+    --host chatgpt \
+    --scope global \
+    --api-key-stdin \
+    --json
+```
+
+The CLI verifies the key against the target model-scoped MCP `tools/list` endpoint, stores it in the secure credential store, and records only `authMode=api-key` in managed Skill metadata. Use short-lived, single-model keys with bounded quota for sharing; do not paste a Creator master key.
+
+The generated Skill calls the published Agent through Frely's model-scoped MCP endpoint. Invoke the installed Agent from automation with the full task on stdin:
+
+```sh
+printf '%s' 'Your complete task' | \
+  frely agent invoke '<distribution-id>' --input-stdin --json
+```
+
+### Device MCP: control this computer from a remote client
+
+Frely CLI turns the target computer into a personal device MCP service. ChatGPT in a browser, Claude Code on another computer, and other remote HTTP MCP clients with OAuth use the same endpoint. Install and run Frely CLI on the computer to control; the calling computer only needs its MCP client.
+
+Enable file, shell and process access on the target computer:
+
+```sh
+frely mcp --workspace /path/to/project
 ```
 
 `frely login` requests a restricted account session through browser device authorization. Basic sessions use private plaintext files, not the OS credential store. Legacy account cookies do not migrate to this store. Basic features and Network commands do not initialize MCP credentials.
 
-`frely mcp setup` initializes a separate secure MCP key, requests browser approval for this device and workspace, and installs the user-level Device Relay service. The default authorization is 90 days; `--days 1..180` selects a duration. `frely mcp renew --days 180` requires a new approval and rotates the MCP execution key. The MCP URL remains bound to the device. Login refresh, OAuth refresh, restart and repeated setup do not extend authorization.
+`frely mcp` initializes a separate secure MCP key, requests browser approval for this device and workspace, and installs the user-level Device Relay service. The default authorization is 90 days; `--days 1..180` selects a duration. `frely mcp renew --days 180` requires a new approval and rotates the MCP execution key. The MCP URL remains bound to the device. Login refresh, OAuth refresh, restart and repeated setup do not extend authorization.
 
 Services use macOS LaunchAgents, Linux systemd user units, or Windows Task Scheduler for the logged-on user. Windows implementation needs native acceptance testing. Linux MCP secure storage can require Secret Service or an injected key; basic installation does not.
 
@@ -109,12 +205,28 @@ You can print the URL again with:
 frely mcp url
 ```
 
-Or show ChatGPT-oriented instructions with:
+If MCP has not been configured, `frely mcp url` automatically runs the equivalent of `frely mcp setup --workspace ~`: it requests browser approval for your home directory (90 days by default), then installs the background service and prints the URL. Run `frely login` first. To select a project directory instead, run `frely mcp --workspace /path/to/project` before requesting the URL. Existing workspaces are preserved; expired authorization still requires `frely mcp renew`. Setup prompts go to stderr, so stdout remains a single URL or, with `--json`, a JSON object. No URL is printed if approval or service installation fails.
+
+Add the exact printed URL to a remote MCP client with OAuth support, choose
+OAuth and complete authorization. Keep the computer online. Ask the client to
+list the top-level names in your selected workspace, without writing files or
+running shell commands. A returned result that matches the folder verifies the
+first connection. `frely doctor` shows whether the running relay has a recent heartbeat; it does not complete client OAuth authorization or execute a tool through that client.
+
+Use `frely doctor` for a quick overview. If a call fails, run `frely doctor -v` for detailed diagnostics.
+
+For Claude Code on the calling computer, replace the placeholder with the URL printed on the target computer:
 
 ```sh
-frely mcp chatgpt
+claude mcp add --transport http frely-computer "<MCP_URL>"
 ```
 
+Open `/mcp` in Claude Code to complete OAuth authorization. Use a distinct server name per device. Ask the Agent to use Frely tools for remote work; its built-in shell still runs on the calling computer. Clients of the same device share its workspace and managed processes. Unknown-outcome writes must not be replayed.
+
+Manage your devices in Frely → **Device MCP** (`/user/account/connections`). The page shows execution permission and connection history, not a live online indicator. Client OAuth authorization and device execution permission have separate lifecycles.
+
+`frely mcp setup` and `frely mcp chatgpt` remain compatibility aliases. The latter prints the same connection details; it does not create a ChatGPT-specific service. A bare `frely mcp` uses the current directory.
+
 ## Local model sharing
 
 `frely-cli` can publish a loopback OpenAI-compatible runtime as a Frely personal Provider. Ollama is the default driver.
@@ -148,23 +260,30 @@ frely provider finalize <provider-id>
 
 `finalize` resumes CPA setup for a Provider left in a prepared state.
 
+## Frely Cloud
+
+Use `frely cloud` to discover and call cloud business operations. See [Cloud commands and authorization](docs/cloud.md).
+
 ## Commands
 
 ```text
-frely login [--relay <https-url>]
+frely login [--relay <https-url>] [--no-browser]
 frely logout
 frely whoami
-frely status [--json]
-frely doctor [--json]
+frely doctor [-v] [--json]
+frely upgrade
+frely skill install <manifest-url> [--host chatgpt|codex|claude-code|pi|generic] [--scope global|project] [--api-key-stdin] [--json]
+frely skill status <distribution-id> [--json]
+frely skill remove <distribution-id> [--json]
+frely agent invoke <distribution-id> (--input <text>|--input-stdin) [--json]
 frely provider share [ollama|openai-compatible] [--url <loopback-v1-url>] [--models <a,b>] [--slot <slot-id>] [--name <name>]
 frely provider list [--json]
 frely provider finalize <provider-id>
-frely mcp setup [--workspace <path>]
+frely mcp [--workspace <path>] [--days 1..180]
+frely mcp renew [--days 1..180]
 frely mcp url [--json]
-frely mcp status [--json]
-frely mcp chatgpt
 frely mcp serve [--workspace <path>]
-frely mcp service status|start|stop|uninstall [--json]
+frely mcp service start|stop|uninstall
 frely mcp revoke
 frely mcp stdio [--workspace <path>]
 ```
@@ -191,7 +310,9 @@ Enrollment returns:
 }
 ```
 
-The public MCP URL has the stable form `https://app.frely.cloud/mcp/<device-id>`. The URL contains no bearer secret. Remote MCP clients use OAuth 2.1 Authorization Code + PKCE. OAuth access tokens bind to the exact MCP resource URL and do not extend the 90/180-day local execution authorization. Relay OAuth requirements are defined in [`docs/mcp-oauth-relay-contract.md`](docs/mcp-oauth-relay-contract.md).
+The public MCP URL is the canonical resource returned by Relay, for example
+`https://connect.frely.cloud/mcp/<device-id>`. Use `frely mcp url`; do not derive the URL
+from the control-plane hostname. The URL contains no bearer secret. Remote MCP clients use OAuth 2.1 Authorization Code + PKCE. OAuth access tokens bind to the exact MCP resource URL and do not extend the 90/180-day local execution authorization. Relay OAuth requirements are defined in [`docs/mcp-oauth-relay-contract.md`](docs/mcp-oauth-relay-contract.md).
 
 A Device Relay connection request uses the enrolled Ed25519 device key and returns a short-lived connection grant:
 
@@ -225,7 +346,31 @@ MCP secrets use AES-256-GCM files with a master key in macOS Keychain, Windows C
 
 The stable MCP URL contains no credential. Remote clients hold OAuth credentials; the CLI holds the MCP execution private key. The Relay checks OAuth resource binding and the current MCP execution lease. Expiry blocks requests and queued work and cancels managed execution. It does not undo writes or create a sandbox around arbitrary shell programs.
 
-`frely doctor` treats unconfigured MCP as optional. `frely doctor --mcp` checks the secure credential and server. `frely mcp status` displays local metadata; it is not server revocation proof.
+`frely doctor` is the single diagnostic entry point. It reports the installation
+path and distribution, checks the latest stable release with a deadline, and reads
+local account, MCP authorization, service and connection state. It does not access
+the MCP keyring in summary mode. An unavailable release source is informational;
+unconfigured account/MCP features remain optional.
+
+`frely doctor -v` (also `--verbose`) adds configuration paths, runtime details,
+service state, authorization expiry, last received heartbeat and sanitized last
+connection error. It also checks session storage, the account session and any
+configured MCP secure key/server authorization. Add `--json` to either view for
+structured output. Confirmed failures and unknown connectivity for a configured
+relay return a nonzero exit code.
+
+A running process is not proof of connectivity. Connected means the matching
+account/device process has received a WebSocket heartbeat within 75 seconds.
+The MCP authorization and workspace must also match the running relay. Missing,
+stale or old-runtime observations are reported as unknown. Verbose diagnostics
+include the running CLI version, entry path and start time. Diagnostics never
+restart the service or open a second relay connection. Neither mode claims
+to test client OAuth or an end-to-end tool call.
+
+Legacy `frely status`, `frely mcp status`, `frely mcp service status` and
+`frely doctor --mcp` remain compatible for existing scripts, but are no longer
+listed as recommended diagnostic entry points. The legacy status output shapes
+are unchanged; `doctor --mcp` requests verbose checks and requires MCP setup.
 
 Storage, migration, service injection, release requirements and threat boundaries: [`docs/credential-storage.md`](docs/credential-storage.md).
 
@@ -274,3 +419,8 @@ node dist/index.js network help --json
 ```
 
 CLI unit tests use a fake credential store and temporary home directories. They do not verify the user's OS credential-store permissions or a deployed Network.
+
+The planned unified MCP entry will support wallet-funded capability use without
+a Frely account. Current device MCP authorization and demo Network calls do not
+implement that complete flow. See [Wallet access plan](docs/mcp-wallet-access-plan.md)
+for the accepted product boundary and remaining work.

package/dist/agent-help.d.ts

@@ -0,0 +1,287 @@
+export declare const COMMANDS: readonly [{
+    readonly id: "cloud";
+    readonly usage: "frely cloud list|describe|call|login|logout [--help]";
+    readonly auth: "cloud-oauth";
+    readonly effect: "subcommand-dependent";
+    readonly purpose: "Discover and call Frely cloud business operations at app.frely.cloud/mcp. Use describe before call; parameters and results are JSON.";
+}, {
+    readonly id: "upgrade";
+    readonly usage: "frely upgrade";
+    readonly auth: "none";
+    readonly effect: "local-write";
+    readonly purpose: "Upgrade the current installation to the latest stable release. Windows prints a manual command; doctor checks versions.";
+}, {
+    readonly id: "help";
+    readonly usage: "frely help --agent --json";
+    readonly auth: "none";
+    readonly effect: "read";
+    readonly purpose: "Read this installed CLI's current Agent instructions.";
+}, {
+    readonly id: "key.budget";
+    readonly usage: "frely key budget (--api-key-stdin [--relay <url>]|--distribution <distribution-id>) [--json]";
+    readonly auth: "api-key";
+    readonly effect: "read";
+    readonly purpose: "Read the Key's self usage and each funding source's limits without account login.";
+}, {
+    readonly id: "skill.install";
+    readonly usage: "frely skill install <manifest-url> [--host chatgpt|codex|claude-code|pi|generic] [--scope global|project] [--api-key-stdin] [--json]";
+    readonly auth: "optional-api-key";
+    readonly effect: "local-write";
+    readonly purpose: "Install the public Agent's trigger Skill; an API key goes only through stdin to secure storage.";
+}, {
+    readonly id: "skill.status";
+    readonly usage: "frely skill status <distribution-id> [--json]";
+    readonly auth: "none";
+    readonly effect: "read";
+    readonly purpose: "Inspect a managed Agent Skill.";
+}, {
+    readonly id: "skill.remove";
+    readonly usage: "frely skill remove <distribution-id> [--json]";
+    readonly auth: "none";
+    readonly effect: "local-write";
+    readonly purpose: "Remove a managed Agent Skill and its saved API key.";
+}, {
+    readonly id: "agent.invoke";
+    readonly usage: "frely agent invoke <distribution-id> (--input <text>|--input-stdin) [--json]";
+    readonly auth: "installed-api-key-or-account";
+    readonly effect: "remote-call";
+    readonly purpose: "Send the complete relevant user request to the installed Agent through model-scoped MCP. Usage may be billed.";
+}, {
+    readonly id: "login";
+    readonly usage: "frely login [--relay <url>] [--no-browser]";
+    readonly auth: "browser";
+    readonly effect: "authorization";
+    readonly purpose: "Authorize the CLI for the user's Frely account.";
+}, {
+    readonly id: "logout";
+    readonly usage: "frely logout";
+    readonly auth: "none";
+    readonly effect: "local-write";
+    readonly purpose: "Remove login and stop the MCP background service.";
+}, {
+    readonly id: "whoami";
+    readonly usage: "frely whoami";
+    readonly auth: "account";
+    readonly effect: "read";
+    readonly purpose: "Read the signed-in account.";
+}, {
+    readonly id: "doctor";
+    readonly usage: "frely doctor [-v] [--json]";
+    readonly auth: "optional-account";
+    readonly effect: "diagnostic";
+    readonly purpose: "Show installation, available upgrades, account, MCP and connection status; -v runs detailed diagnostics.";
+}, {
+    readonly id: "provider.share";
+    readonly usage: "frely provider share [ollama|openai-compatible] [--url <loopback-v1-url>] [--models <a,b>] [--slot <slot-id>] [--name <name>]";
+    readonly auth: "account";
+    readonly effect: "remote-write";
+    readonly purpose: "Publish a local model Provider.";
+}, {
+    readonly id: "provider.list";
+    readonly usage: "frely provider list [--json]";
+    readonly auth: "account";
+    readonly effect: "read";
+    readonly purpose: "List configured local Providers.";
+}, {
+    readonly id: "provider.finalize";
+    readonly usage: "frely provider finalize <provider-id>";
+    readonly auth: "account";
+    readonly effect: "remote-write";
+    readonly purpose: "Finish a prepared local Provider.";
+}, {
+    readonly id: "mcp.setup";
+    readonly usage: "frely mcp [--workspace <path>] [--days 1..180]";
+    readonly auth: "account-and-browser";
+    readonly effect: "authorization";
+    readonly purpose: "Enable this computer as a device MCP service for remote HTTP MCP clients with OAuth; install its background service.";
+}, {
+    readonly id: "mcp.renew";
+    readonly usage: "frely mcp renew [--days 1..180]";
+    readonly auth: "account-and-browser";
+    readonly effect: "authorization";
+    readonly purpose: "Renew this device's execution authorization without changing its MCP URL.";
+}, {
+    readonly id: "mcp.url";
+    readonly usage: "frely mcp url [--json]";
+    readonly auth: "account-and-mcp-or-browser";
+    readonly effect: "authorization-if-unconfigured";
+    readonly purpose: "Read this device's stable MCP URL. If unconfigured, set up the user home directory with browser approval and install the background service. --json includes HTTP transport and OAuth connection details; setup prompts go to stderr.";
+}, {
+    readonly id: "mcp.serve";
+    readonly usage: "frely mcp serve [--workspace <path>]";
+    readonly auth: "account-and-mcp";
+    readonly effect: "local-execution";
+    readonly purpose: "Serve authorized local workspace tools.";
+}, {
+    readonly id: "mcp.service";
+    readonly usage: "frely mcp service start|stop|uninstall";
+    readonly auth: "none";
+    readonly effect: "local-service";
+    readonly purpose: "Pause, resume or remove the local MCP background service for maintenance. Supported upgrades restore running services without these commands.";
+}, {
+    readonly id: "mcp.revoke";
+    readonly usage: "frely mcp revoke";
+    readonly auth: "account";
+    readonly effect: "remote-write";
+    readonly purpose: "Revoke device MCP execution authorization for every connected client.";
+}, {
+    readonly id: "mcp.stdio";
+    readonly usage: "frely mcp stdio [--workspace <path>]";
+    readonly auth: "mcp";
+    readonly effect: "local-execution";
+    readonly purpose: "Serve authorized local tools over stdio.";
+}, {
+    readonly id: "network";
+    readonly usage: "frely network setup|status|find|use|logout [--json]";
+    readonly auth: "network";
+    readonly effect: "subcommand-dependent";
+    readonly purpose: "Access Frely Network using its separate setup and credentials.";
+}];
+export declare function agentHelp(): {
+    schemaVersion: string;
+    cliVersion: string;
+    bootstrapVersion: number;
+    skill_update_required: boolean;
+    instructions: string[];
+    commands: readonly [{
+        readonly id: "cloud";
+        readonly usage: "frely cloud list|describe|call|login|logout [--help]";
+        readonly auth: "cloud-oauth";
+        readonly effect: "subcommand-dependent";
+        readonly purpose: "Discover and call Frely cloud business operations at app.frely.cloud/mcp. Use describe before call; parameters and results are JSON.";
+    }, {
+        readonly id: "upgrade";
+        readonly usage: "frely upgrade";
+        readonly auth: "none";
+        readonly effect: "local-write";
+        readonly purpose: "Upgrade the current installation to the latest stable release. Windows prints a manual command; doctor checks versions.";
+    }, {
+        readonly id: "help";
+        readonly usage: "frely help --agent --json";
+        readonly auth: "none";
+        readonly effect: "read";
+        readonly purpose: "Read this installed CLI's current Agent instructions.";
+    }, {
+        readonly id: "key.budget";
+        readonly usage: "frely key budget (--api-key-stdin [--relay <url>]|--distribution <distribution-id>) [--json]";
+        readonly auth: "api-key";
+        readonly effect: "read";
+        readonly purpose: "Read the Key's self usage and each funding source's limits without account login.";
+    }, {
+        readonly id: "skill.install";
+        readonly usage: "frely skill install <manifest-url> [--host chatgpt|codex|claude-code|pi|generic] [--scope global|project] [--api-key-stdin] [--json]";
+        readonly auth: "optional-api-key";
+        readonly effect: "local-write";
+        readonly purpose: "Install the public Agent's trigger Skill; an API key goes only through stdin to secure storage.";
+    }, {
+        readonly id: "skill.status";
+        readonly usage: "frely skill status <distribution-id> [--json]";
+        readonly auth: "none";
+        readonly effect: "read";
+        readonly purpose: "Inspect a managed Agent Skill.";
+    }, {
+        readonly id: "skill.remove";
+        readonly usage: "frely skill remove <distribution-id> [--json]";
+        readonly auth: "none";
+        readonly effect: "local-write";
+        readonly purpose: "Remove a managed Agent Skill and its saved API key.";
+    }, {
+        readonly id: "agent.invoke";
+        readonly usage: "frely agent invoke <distribution-id> (--input <text>|--input-stdin) [--json]";
+        readonly auth: "installed-api-key-or-account";
+        readonly effect: "remote-call";
+        readonly purpose: "Send the complete relevant user request to the installed Agent through model-scoped MCP. Usage may be billed.";
+    }, {
+        readonly id: "login";
+        readonly usage: "frely login [--relay <url>] [--no-browser]";
+        readonly auth: "browser";
+        readonly effect: "authorization";
+        readonly purpose: "Authorize the CLI for the user's Frely account.";
+    }, {
+        readonly id: "logout";
+        readonly usage: "frely logout";
+        readonly auth: "none";
+        readonly effect: "local-write";
+        readonly purpose: "Remove login and stop the MCP background service.";
+    }, {
+        readonly id: "whoami";
+        readonly usage: "frely whoami";
+        readonly auth: "account";
+        readonly effect: "read";
+        readonly purpose: "Read the signed-in account.";
+    }, {
+        readonly id: "doctor";
+        readonly usage: "frely doctor [-v] [--json]";
+        readonly auth: "optional-account";
+        readonly effect: "diagnostic";
+        readonly purpose: "Show installation, available upgrades, account, MCP and connection status; -v runs detailed diagnostics.";
+    }, {
+        readonly id: "provider.share";
+        readonly usage: "frely provider share [ollama|openai-compatible] [--url <loopback-v1-url>] [--models <a,b>] [--slot <slot-id>] [--name <name>]";
+        readonly auth: "account";
+        readonly effect: "remote-write";
+        readonly purpose: "Publish a local model Provider.";
+    }, {
+        readonly id: "provider.list";
+        readonly usage: "frely provider list [--json]";
+        readonly auth: "account";
+        readonly effect: "read";
+        readonly purpose: "List configured local Providers.";
+    }, {
+        readonly id: "provider.finalize";
+        readonly usage: "frely provider finalize <provider-id>";
+        readonly auth: "account";
+        readonly effect: "remote-write";
+        readonly purpose: "Finish a prepared local Provider.";
+    }, {
+        readonly id: "mcp.setup";
+        readonly usage: "frely mcp [--workspace <path>] [--days 1..180]";
+        readonly auth: "account-and-browser";
+        readonly effect: "authorization";
+        readonly purpose: "Enable this computer as a device MCP service for remote HTTP MCP clients with OAuth; install its background service.";
+    }, {
+        readonly id: "mcp.renew";
+        readonly usage: "frely mcp renew [--days 1..180]";
+        readonly auth: "account-and-browser";
+        readonly effect: "authorization";
+        readonly purpose: "Renew this device's execution authorization without changing its MCP URL.";
+    }, {
+        readonly id: "mcp.url";
+        readonly usage: "frely mcp url [--json]";
+        readonly auth: "account-and-mcp-or-browser";
+        readonly effect: "authorization-if-unconfigured";
+        readonly purpose: "Read this device's stable MCP URL. If unconfigured, set up the user home directory with browser approval and install the background service. --json includes HTTP transport and OAuth connection details; setup prompts go to stderr.";
+    }, {
+        readonly id: "mcp.serve";
+        readonly usage: "frely mcp serve [--workspace <path>]";
+        readonly auth: "account-and-mcp";
+        readonly effect: "local-execution";
+        readonly purpose: "Serve authorized local workspace tools.";
+    }, {
+        readonly id: "mcp.service";
+        readonly usage: "frely mcp service start|stop|uninstall";
+        readonly auth: "none";
+        readonly effect: "local-service";
+        readonly purpose: "Pause, resume or remove the local MCP background service for maintenance. Supported upgrades restore running services without these commands.";
+    }, {
+        readonly id: "mcp.revoke";
+        readonly usage: "frely mcp revoke";
+        readonly auth: "account";
+        readonly effect: "remote-write";
+        readonly purpose: "Revoke device MCP execution authorization for every connected client.";
+    }, {
+        readonly id: "mcp.stdio";
+        readonly usage: "frely mcp stdio [--workspace <path>]";
+        readonly auth: "mcp";
+        readonly effect: "local-execution";
+        readonly purpose: "Serve authorized local tools over stdio.";
+    }, {
+        readonly id: "network";
+        readonly usage: "frely network setup|status|find|use|logout [--json]";
+        readonly auth: "network";
+        readonly effect: "subcommand-dependent";
+        readonly purpose: "Access Frely Network using its separate setup and credentials.";
+    }];
+};
+export declare function cliUsage(): string;
+export declare function mcpUsage(): string;