memoryhub-cli 0.3.0__tar.gz → 0.4.0__tar.gz

{memoryhub_cli-0.3.0 → memoryhub_cli-0.4.0}/.gitignore

@@ -34,3 +34,4 @@ seed-clients.json
 
 NEXT_SESSION_old.md
 NEXT_SESSION.md
+planning/rfe_draft.md

{memoryhub_cli-0.3.0 → memoryhub_cli-0.4.0}/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to the `memoryhub-cli` package.
 
+## [0.4.0] — 2026-04-14
+
+- **Admin subcommands (#186)**: Added `memoryhub admin` command group with
+  `create-agent`, `list-agents`, `rotate-secret`, and `disable-agent` for
+  self-serve agent provisioning via the auth service REST API.
+- **`--version` flag**: `memoryhub --version` now prints the installed version.
+
 ## [0.3.0] — 2026-04-09
 
 - **Campaign & domain parameter support (#164)**: Added `--project-id` flag to

{memoryhub_cli-0.3.0 → memoryhub_cli-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memoryhub-cli
-Version: 0.3.0
+Version: 0.4.0
 Summary: CLI client for MemoryHub — centralized, governed memory for AI agents
 Project-URL: Homepage, https://github.com/redhat-ai-americas/memory-hub
 Project-URL: Repository, https://github.com/redhat-ai-americas/memory-hub
@@ -18,6 +18,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Requires-Python: >=3.10
+Requires-Dist: httpx>=0.27
 Requires-Dist: memoryhub>=0.3.0
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: rich>=13.0
@@ -59,6 +60,12 @@ memoryhub write "Use vLLM for embeddings" --project-id my-project --domain ML
 # Set up project-level memory loading
 memoryhub config init
 memoryhub config regenerate
+
+# Admin: provision and manage agents
+memoryhub admin create-agent my-agent --scopes user,project
+memoryhub admin list-agents
+memoryhub admin rotate-secret my-agent
+memoryhub admin disable-agent my-agent
 ```
 
 The `--project-id` flag enables campaign-scoped memory access. When your project is enrolled in campaigns via `.memoryhub.yaml`, the CLI auto-loads the project identifier from config, so you can omit the flag in most cases. Use `--domain` to tag writes or boost domain-matching results in search.

{memoryhub_cli-0.3.0 → memoryhub_cli-0.4.0}/README.md

@@ -30,6 +30,12 @@ memoryhub write "Use vLLM for embeddings" --project-id my-project --domain ML
 # Set up project-level memory loading
 memoryhub config init
 memoryhub config regenerate
+
+# Admin: provision and manage agents
+memoryhub admin create-agent my-agent --scopes user,project
+memoryhub admin list-agents
+memoryhub admin rotate-secret my-agent
+memoryhub admin disable-agent my-agent
 ```
 
 The `--project-id` flag enables campaign-scoped memory access. When your project is enrolled in campaigns via `.memoryhub.yaml`, the CLI auto-loads the project identifier from config, so you can omit the flag in most cases. Use `--domain` to tag writes or boost domain-matching results in search.

{memoryhub_cli-0.3.0 → memoryhub_cli-0.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "memoryhub-cli"
-version = "0.3.0"
+version = "0.4.0"
 description = "CLI client for MemoryHub — centralized, governed memory for AI agents"
 readme = "README.md"
 license = "Apache-2.0"
@@ -18,6 +18,7 @@ dependencies = [
     "typer[all]>=0.15",
     "rich>=13.0",
     "pyyaml>=6.0",
+    "httpx>=0.27",
 ]
 classifiers = [
     "Development Status :: 3 - Alpha",

{memoryhub_cli-0.3.0 → memoryhub_cli-0.4.0}/src/memoryhub_cli/__init__.py

@@ -1,3 +1,3 @@
 """MemoryHub CLI client."""
 
-__version__ = "0.3.0"
+__version__ = "0.4.0"

memoryhub_cli-0.4.0/src/memoryhub_cli/admin.py

@@ -0,0 +1,307 @@
+"""Admin subcommands for managing agents and OAuth clients."""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+
+import httpx
+import typer
+from rich.console import Console
+from rich.table import Table
+
+from memoryhub_cli.config import CONFIG_DIR, load_config
+
+admin_app = typer.Typer(
+    name="admin",
+    help="Manage agents and OAuth clients.",
+    no_args_is_help=True,
+)
+console = Console()
+err_console = Console(stderr=True)
+
+
+def _run(coro):
+    """Run an async coroutine."""
+    return asyncio.run(coro)
+
+
+def _get_admin_key() -> str:
+    """Resolve the admin key from env var or config file."""
+    key = os.environ.get("MEMORYHUB_ADMIN_KEY")
+    if key:
+        return key
+
+    config = load_config()
+    key = config.get("admin_key")
+    if key:
+        return key
+
+    err_console.print(
+        "[red]No admin key found.[/red]\n"
+        "Set MEMORYHUB_ADMIN_KEY or add 'admin_key' to "
+        "~/.config/memoryhub/config.json."
+    )
+    raise typer.Exit(1)
+
+
+def _get_auth_url() -> str:
+    """Resolve the auth service base URL (without trailing slash)."""
+    url = os.environ.get("MEMORYHUB_AUTH_URL")
+    if url:
+        return url.rstrip("/")
+
+    config = load_config()
+    url = config.get("auth_url")
+    if url:
+        return url.rstrip("/")
+
+    url = config.get("url")
+    if url:
+        # Fall back to base MCP URL with /admin stripped — assume auth
+        # is co-located at the base URL.
+        return url.rstrip("/")
+
+    err_console.print(
+        "[red]No auth URL found.[/red]\n"
+        "Set MEMORYHUB_AUTH_URL, or add 'auth_url' to "
+        "~/.config/memoryhub/config.json."
+    )
+    raise typer.Exit(1)
+
+
+def _admin_headers(admin_key: str) -> dict[str, str]:
+    return {"X-Admin-Key": admin_key}
+
+
+# ── Commands ─────────────────────────────────────────────────────────────────
+
+
+@admin_app.command("create-agent")
+def create_agent(
+    name: str = typer.Argument(..., help="Agent name (used as client_id and client_name)"),
+    scopes: str = typer.Option(
+        "user,project",
+        "--scopes",
+        help="Comma-separated default scopes",
+    ),
+    project_id: str | None = typer.Option(
+        None, "--project-id", "-p", help="Project ID to associate with the agent",
+    ),
+    tenant_id: str = typer.Option(
+        "default", "--tenant-id", "-t", help="Tenant ID",
+    ),
+    write_config: bool = typer.Option(
+        False,
+        "--write-config",
+        help="Write the client_secret to ~/.config/memoryhub/api-key",
+    ),
+    json_output: bool = typer.Option(False, "--json", "-j", help="Output as JSON"),
+):
+    """Create a new agent (OAuth client).
+
+    The client_secret is shown only once. Save it immediately.
+    """
+    admin_key = _get_admin_key()
+    auth_url = _get_auth_url()
+    scope_list = [s.strip() for s in scopes.split(",") if s.strip()]
+
+    body = {
+        "client_id": name,
+        "client_name": name,
+        "default_scopes": scope_list,
+        "tenant_id": tenant_id,
+    }
+
+    async def _do():
+        async with httpx.AsyncClient() as client:
+            resp = await client.post(
+                f"{auth_url}/admin/clients",
+                json=body,
+                headers=_admin_headers(admin_key),
+                timeout=30,
+            )
+            resp.raise_for_status()
+            return resp.json()
+
+    try:
+        data = _run(_do())
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        return
+
+    if json_output:
+        console.print_json(json.dumps(data))
+        return
+
+    console.print("[green]Agent created successfully.[/green]\n")
+    console.print(f"  Client ID:     [bold]{data['client_id']}[/bold]")
+    console.print(f"  Client Name:   {data['client_name']}")
+    console.print(f"  Tenant:        {data['tenant_id']}")
+    console.print(f"  Scopes:        {', '.join(data['default_scopes'])}")
+    console.print(f"  Active:        {data['active']}")
+    console.print()
+    console.print(
+        f"  [yellow bold]Client Secret:   {data['client_secret']}[/yellow bold]"
+    )
+    console.print(
+        "\n  [dim]Save this secret now. It will not be shown again.[/dim]"
+    )
+
+    if write_config:
+        api_key_path = CONFIG_DIR / "api-key"
+        CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+        api_key_path.write_text(data["client_secret"])
+        api_key_path.chmod(0o600)
+        console.print(f"\n  [green]Secret written to {api_key_path}[/green]")
+
+
+@admin_app.command("list-agents")
+def list_agents(
+    json_output: bool = typer.Option(False, "--json", "-j", help="Output as JSON"),
+):
+    """List all registered agents (OAuth clients)."""
+    admin_key = _get_admin_key()
+    auth_url = _get_auth_url()
+
+    async def _do():
+        async with httpx.AsyncClient() as client:
+            resp = await client.get(
+                f"{auth_url}/admin/clients",
+                headers=_admin_headers(admin_key),
+                timeout=30,
+            )
+            resp.raise_for_status()
+            return resp.json()
+
+    try:
+        data = _run(_do())
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        return
+
+    if json_output:
+        console.print_json(json.dumps(data))
+        return
+
+    if not data:
+        console.print("[dim]No agents registered.[/dim]")
+        return
+
+    table = Table(title="Registered Agents")
+    table.add_column("Client ID", style="bold")
+    table.add_column("Name")
+    table.add_column("Active", justify="center")
+    table.add_column("Scopes")
+    table.add_column("Created", style="dim")
+
+    for agent in data:
+        active = "[green]Yes[/green]" if agent.get("active") else "[red]No[/red]"
+        scopes = ", ".join(agent.get("default_scopes", []))
+        created = str(agent.get("created_at", "-"))[:19]
+        table.add_row(
+            agent["client_id"],
+            agent.get("client_name", "-"),
+            active,
+            scopes,
+            created,
+        )
+
+    console.print(table)
+
+
+@admin_app.command("rotate-secret")
+def rotate_secret(
+    client_id: str = typer.Argument(..., help="Client ID of the agent"),
+    json_output: bool = typer.Option(False, "--json", "-j", help="Output as JSON"),
+):
+    """Rotate the client secret for an agent.
+
+    The new secret is shown only once. Save it immediately.
+    """
+    admin_key = _get_admin_key()
+    auth_url = _get_auth_url()
+
+    async def _do():
+        async with httpx.AsyncClient() as client:
+            resp = await client.post(
+                f"{auth_url}/admin/clients/{client_id}/rotate-secret",
+                headers=_admin_headers(admin_key),
+                timeout=30,
+            )
+            resp.raise_for_status()
+            return resp.json()
+
+    try:
+        data = _run(_do())
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        return
+
+    if json_output:
+        console.print_json(json.dumps(data))
+        return
+
+    console.print(f"[green]Secret rotated for {data['client_id']}.[/green]\n")
+    console.print(
+        f"  [yellow bold]New Secret:   {data['client_secret']}[/yellow bold]"
+    )
+    console.print(
+        "\n  [dim]Save this secret now. It will not be shown again.[/dim]"
+    )
+
+
+@admin_app.command("disable-agent")
+def disable_agent(
+    client_id: str = typer.Argument(..., help="Client ID of the agent to disable"),
+):
+    """Disable an agent (set active=false)."""
+    admin_key = _get_admin_key()
+    auth_url = _get_auth_url()
+
+    async def _do():
+        async with httpx.AsyncClient() as client:
+            resp = await client.patch(
+                f"{auth_url}/admin/clients/{client_id}",
+                json={"active": False},
+                headers=_admin_headers(admin_key),
+                timeout=30,
+            )
+            resp.raise_for_status()
+            return resp.json()
+
+    try:
+        data = _run(_do())
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        return
+
+    console.print(
+        f"[green]Agent '{data['client_id']}' has been disabled.[/green]"
+    )
+
+
+# ── Helpers ──────────────────────────────────────────────────────────────────
+
+
+def _handle_http_error(exc: httpx.HTTPStatusError) -> None:
+    """Print a user-friendly error for HTTP failures."""
+    status = exc.response.status_code
+    try:
+        detail = exc.response.json().get("detail", exc.response.text)
+    except Exception:
+        detail = exc.response.text
+
+    if status == 401:
+        err_console.print(
+            "[red]Authentication failed.[/red] Check your admin key."
+        )
+    elif status == 404:
+        err_console.print(f"[red]Not found:[/red] {detail}")
+    elif status == 409:
+        err_console.print(f"[red]Conflict:[/red] {detail}")
+    else:
+        err_console.print(f"[red]HTTP {status}:[/red] {detail}")
+
+    raise typer.Exit(1)

{memoryhub_cli-0.3.0 → memoryhub_cli-0.4.0}/src/memoryhub_cli/main.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import asyncio
 import sys
+from importlib.metadata import version as pkg_version
 from pathlib import Path
 
 import typer
@@ -11,6 +12,7 @@ from memoryhub import CONFIG_FILENAME, ConfigError, load_project_config
 from rich.console import Console
 from rich.table import Table
 
+from memoryhub_cli.admin import admin_app
 from memoryhub_cli.config import get_connection_params, save_config
 from memoryhub_cli.project_config import (
     InitChoices,
@@ -22,17 +24,36 @@ from memoryhub_cli.project_config import (
     write_init_files,
 )
 
+
+def _version_callback(value: bool) -> None:
+    if value:
+        print(f"memoryhub {pkg_version('memoryhub-cli')}")
+        raise typer.Exit()
+
+
 app = typer.Typer(
     name="memoryhub",
-    help="CLI client for MemoryHub — centralized, governed memory for AI agents.",
     no_args_is_help=True,
 )
+
+
+@app.callback()
+def main(
+    version: bool = typer.Option(
+        False, "--version", "-V", callback=_version_callback, is_eager=True,
+        help="Show version and exit.",
+    ),
+) -> None:
+    """CLI client for MemoryHub — centralized, governed memory for AI agents."""
+
+
 config_app = typer.Typer(
     name="config",
     help="Manage project-level MemoryHub configuration (.memoryhub.yaml).",
     no_args_is_help=True,
 )
 app.add_typer(config_app, name="config")
+app.add_typer(admin_app, name="admin", help="Manage agents and OAuth clients")
 console = Console()
 err_console = Console(stderr=True)
 

memoryhub_cli-0.4.0/tests/test_admin.py

@@ -0,0 +1,329 @@
+"""Tests for memoryhub_cli.admin — admin subcommands."""
+
+from __future__ import annotations
+
+import json
+from unittest.mock import AsyncMock, patch
+
+import httpx
+from typer.testing import CliRunner
+
+from memoryhub_cli.main import app
+
+runner = CliRunner()
+
+# ── Fixtures ─────────────────────────────────────────────────────────────────
+
+SAMPLE_CLIENT = {
+    "client_id": "test-agent",
+    "client_name": "test-agent",
+    "identity_type": "user",
+    "tenant_id": "default",
+    "default_scopes": ["user", "project"],
+    "redirect_uris": None,
+    "public": False,
+    "active": True,
+    "created_at": "2026-04-14T12:00:00",
+    "updated_at": "2026-04-14T12:00:00",
+}
+
+SAMPLE_CREATED = {**SAMPLE_CLIENT, "client_secret": "super-secret-value"}
+
+SAMPLE_ROTATED = {
+    "client_id": "test-agent",
+    "client_secret": "new-secret-value",
+}
+
+
+def _mock_response(data, status_code=200):
+    """Build a mock httpx.Response."""
+    resp = httpx.Response(
+        status_code=status_code,
+        json=data,
+        request=httpx.Request("GET", "http://test"),
+    )
+    return resp
+
+
+def _mock_error_response(status_code, detail="error"):
+    """Build a mock httpx.Response that triggers raise_for_status."""
+    resp = httpx.Response(
+        status_code=status_code,
+        json={"detail": detail},
+        request=httpx.Request("GET", "http://test"),
+    )
+    return resp
+
+
+def _env_with_admin_key(**extra):
+    """Base env vars for tests that need an admin key and auth URL."""
+    env = {
+        "MEMORYHUB_ADMIN_KEY": "test-admin-key",
+        "MEMORYHUB_AUTH_URL": "http://auth.test",
+    }
+    env.update(extra)
+    return env
+
+
+# ── create-agent ─────────────────────────────────────────────────────────────
+
+
+class TestCreateAgent:
+    def test_happy_path(self):
+        mock_client = AsyncMock()
+        mock_client.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_client.__aexit__ = AsyncMock(return_value=False)
+        mock_client.post = AsyncMock(return_value=_mock_response(SAMPLE_CREATED, 201))
+
+        with patch.dict("os.environ", _env_with_admin_key(), clear=False):
+            with patch("memoryhub_cli.admin.httpx.AsyncClient", return_value=mock_client):
+                result = runner.invoke(app, ["admin", "create-agent", "test-agent"])
+
+        assert result.exit_code == 0
+        assert "test-agent" in result.output
+        assert "super-secret-value" in result.output
+        assert "Save this secret" in result.output
+
+    def test_json_output(self):
+        mock_client = AsyncMock()
+        mock_client.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_client.__aexit__ = AsyncMock(return_value=False)
+        mock_client.post = AsyncMock(return_value=_mock_response(SAMPLE_CREATED, 201))
+
+        with patch.dict("os.environ", _env_with_admin_key(), clear=False):
+            with patch("memoryhub_cli.admin.httpx.AsyncClient", return_value=mock_client):
+                result = runner.invoke(
+                    app, ["admin", "create-agent", "test-agent", "--json"]
+                )
+
+        assert result.exit_code == 0
+        parsed = json.loads(result.output)
+        assert parsed["client_id"] == "test-agent"
+        assert parsed["client_secret"] == "super-secret-value"
+
+    def test_write_config(self, tmp_path):
+        mock_client = AsyncMock()
+        mock_client.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_client.__aexit__ = AsyncMock(return_value=False)
+        mock_client.post = AsyncMock(return_value=_mock_response(SAMPLE_CREATED, 201))
+
+        with patch.dict("os.environ", _env_with_admin_key(), clear=False):
+            with patch("memoryhub_cli.admin.httpx.AsyncClient", return_value=mock_client):
+                with patch("memoryhub_cli.admin.CONFIG_DIR", tmp_path):
+                    result = runner.invoke(
+                        app,
+                        ["admin", "create-agent", "test-agent", "--write-config"],
+                    )
+
+        assert result.exit_code == 0
+        api_key_file = tmp_path / "api-key"
+        assert api_key_file.exists()
+        assert api_key_file.read_text() == "super-secret-value"
+
+    def test_conflict_409(self):
+        error_resp = _mock_error_response(
+            409, "Client with client_id 'test-agent' already exists"
+        )
+        mock_client = AsyncMock()
+        mock_client.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_client.__aexit__ = AsyncMock(return_value=False)
+        mock_client.post = AsyncMock(
+            side_effect=httpx.HTTPStatusError(
+                "conflict", request=error_resp.request, response=error_resp
+            )
+        )
+
+        with patch.dict("os.environ", _env_with_admin_key(), clear=False):
+            with patch("memoryhub_cli.admin.httpx.AsyncClient", return_value=mock_client):
+                result = runner.invoke(app, ["admin", "create-agent", "test-agent"])
+
+        assert result.exit_code == 1
+        assert "Conflict" in result.output
+
+
+# ── list-agents ──────────────────────────────────────────────────────────────
+
+
+class TestListAgents:
+    def test_happy_path(self):
+        mock_client = AsyncMock()
+        mock_client.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_client.__aexit__ = AsyncMock(return_value=False)
+        mock_client.get = AsyncMock(
+            return_value=_mock_response([SAMPLE_CLIENT])
+        )
+
+        with patch.dict("os.environ", _env_with_admin_key(), clear=False):
+            with patch("memoryhub_cli.admin.httpx.AsyncClient", return_value=mock_client):
+                result = runner.invoke(app, ["admin", "list-agents"])
+
+        assert result.exit_code == 0
+        assert "test-agent" in result.output
+        assert "Yes" in result.output  # active
+
+    def test_json_output(self):
+        mock_client = AsyncMock()
+        mock_client.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_client.__aexit__ = AsyncMock(return_value=False)
+        mock_client.get = AsyncMock(
+            return_value=_mock_response([SAMPLE_CLIENT])
+        )
+
+        with patch.dict("os.environ", _env_with_admin_key(), clear=False):
+            with patch("memoryhub_cli.admin.httpx.AsyncClient", return_value=mock_client):
+                result = runner.invoke(app, ["admin", "list-agents", "--json"])
+
+        assert result.exit_code == 0
+        parsed = json.loads(result.output)
+        assert len(parsed) == 1
+        assert parsed[0]["client_id"] == "test-agent"
+
+    def test_empty_list(self):
+        mock_client = AsyncMock()
+        mock_client.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_client.__aexit__ = AsyncMock(return_value=False)
+        mock_client.get = AsyncMock(return_value=_mock_response([]))
+
+        with patch.dict("os.environ", _env_with_admin_key(), clear=False):
+            with patch("memoryhub_cli.admin.httpx.AsyncClient", return_value=mock_client):
+                result = runner.invoke(app, ["admin", "list-agents"])
+
+        assert result.exit_code == 0
+        assert "No agents registered" in result.output
+
+
+# ── rotate-secret ────────────────────────────────────────────────────────────
+
+
+class TestRotateSecret:
+    def test_happy_path(self):
+        mock_client = AsyncMock()
+        mock_client.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_client.__aexit__ = AsyncMock(return_value=False)
+        mock_client.post = AsyncMock(
+            return_value=_mock_response(SAMPLE_ROTATED)
+        )
+
+        with patch.dict("os.environ", _env_with_admin_key(), clear=False):
+            with patch("memoryhub_cli.admin.httpx.AsyncClient", return_value=mock_client):
+                result = runner.invoke(
+                    app, ["admin", "rotate-secret", "test-agent"]
+                )
+
+        assert result.exit_code == 0
+        assert "new-secret-value" in result.output
+        assert "rotated" in result.output.lower()
+
+    def test_json_output(self):
+        mock_client = AsyncMock()
+        mock_client.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_client.__aexit__ = AsyncMock(return_value=False)
+        mock_client.post = AsyncMock(
+            return_value=_mock_response(SAMPLE_ROTATED)
+        )
+
+        with patch.dict("os.environ", _env_with_admin_key(), clear=False):
+            with patch("memoryhub_cli.admin.httpx.AsyncClient", return_value=mock_client):
+                result = runner.invoke(
+                    app, ["admin", "rotate-secret", "test-agent", "--json"]
+                )
+
+        assert result.exit_code == 0
+        parsed = json.loads(result.output)
+        assert parsed["client_secret"] == "new-secret-value"
+
+    def test_not_found(self):
+        error_resp = _mock_error_response(404, "Client 'ghost' not found")
+        mock_client = AsyncMock()
+        mock_client.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_client.__aexit__ = AsyncMock(return_value=False)
+        mock_client.post = AsyncMock(
+            side_effect=httpx.HTTPStatusError(
+                "not found", request=error_resp.request, response=error_resp
+            )
+        )
+
+        with patch.dict("os.environ", _env_with_admin_key(), clear=False):
+            with patch("memoryhub_cli.admin.httpx.AsyncClient", return_value=mock_client):
+                result = runner.invoke(app, ["admin", "rotate-secret", "ghost"])
+
+        assert result.exit_code == 1
+        assert "Not found" in result.output
+
+
+# ── disable-agent ────────────────────────────────────────────────────────────
+
+
+class TestDisableAgent:
+    def test_happy_path(self):
+        disabled = {**SAMPLE_CLIENT, "active": False}
+        mock_client = AsyncMock()
+        mock_client.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_client.__aexit__ = AsyncMock(return_value=False)
+        mock_client.patch = AsyncMock(return_value=_mock_response(disabled))
+
+        with patch.dict("os.environ", _env_with_admin_key(), clear=False):
+            with patch("memoryhub_cli.admin.httpx.AsyncClient", return_value=mock_client):
+                result = runner.invoke(
+                    app, ["admin", "disable-agent", "test-agent"]
+                )
+
+        assert result.exit_code == 0
+        assert "disabled" in result.output.lower()
+
+
+# ── Missing admin key ────────────────────────────────────────────────────────
+
+
+class TestMissingAdminKey:
+    def test_no_admin_key_errors(self):
+        """When no admin key is available, commands should fail with a clear message."""
+        env = {"MEMORYHUB_AUTH_URL": "http://auth.test"}
+        with patch.dict("os.environ", env, clear=False):
+            # Ensure config file returns no admin_key either
+            with patch("memoryhub_cli.admin.load_config", return_value={}):
+                result = runner.invoke(app, ["admin", "list-agents"])
+
+        assert result.exit_code == 1
+        assert "admin key" in result.output.lower()
+
+
+# ── HTTP error handling ──────────────────────────────────────────────────────
+
+
+class TestHttpErrors:
+    def test_401_auth_failed(self):
+        error_resp = _mock_error_response(401, "Invalid or missing admin key")
+        mock_client = AsyncMock()
+        mock_client.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_client.__aexit__ = AsyncMock(return_value=False)
+        mock_client.get = AsyncMock(
+            side_effect=httpx.HTTPStatusError(
+                "unauthorized", request=error_resp.request, response=error_resp
+            )
+        )
+
+        with patch.dict("os.environ", _env_with_admin_key(), clear=False):
+            with patch("memoryhub_cli.admin.httpx.AsyncClient", return_value=mock_client):
+                result = runner.invoke(app, ["admin", "list-agents"])
+
+        assert result.exit_code == 1
+        assert "Authentication failed" in result.output
+
+    def test_generic_http_error(self):
+        error_resp = _mock_error_response(500, "Internal server error")
+        mock_client = AsyncMock()
+        mock_client.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_client.__aexit__ = AsyncMock(return_value=False)
+        mock_client.get = AsyncMock(
+            side_effect=httpx.HTTPStatusError(
+                "server error", request=error_resp.request, response=error_resp
+            )
+        )
+
+        with patch.dict("os.environ", _env_with_admin_key(), clear=False):
+            with patch("memoryhub_cli.admin.httpx.AsyncClient", return_value=mock_client):
+                result = runner.invoke(app, ["admin", "list-agents"])
+
+        assert result.exit_code == 1
+        assert "HTTP 500" in result.output