fix(cli): include auth on demo REST calls

src/cli.ts

@@ -43,6 +43,10 @@ import { isFirstRun, readPrefs, resetPrefs, writePrefs } from "./cli/preferences
 import { runOnboarding } from "./cli/onboarding.js";
 import { setBootVerbose } from "./logger.js";
 import { VERSION } from "./version.js";
+import {
+  agentmemoryAuthHeaders,
+  agentmemoryJsonHeaders,
+} from "./cli/http-auth.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const args = process.argv.slice(2);
@@ -1067,12 +1071,9 @@ async function main() {
 
 async function apiFetch<T = unknown>(base: string, path: string, timeoutMs = 5000): Promise<T | null> {
   try {
-    const headers: Record<string, string> = {};
-    const secret = process.env["AGENTMEMORY_SECRET"];
-    if (secret) headers["Authorization"] = `Bearer ${secret}`;
     const res = await fetch(`${base}/agentmemory/${path}`, {
       signal: AbortSignal.timeout(timeoutMs),
-      headers,
+      headers: agentmemoryAuthHeaders(),
     });
     return (await res.json()) as T;
   } catch {
@@ -1691,7 +1692,7 @@ async function postJson<T = unknown>(
   try {
     const res = await fetch(url, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: agentmemoryJsonHeaders(),
       body: JSON.stringify(body),
       signal: AbortSignal.timeout(timeoutMs),
     });
@@ -1709,7 +1710,7 @@ async function postJsonStrict<T = unknown>(
 ): Promise<T | null> {
   const res = await fetch(url, {
     method: "POST",
-    headers: { "Content-Type": "application/json" },
+    headers: agentmemoryJsonHeaders(),
     body: JSON.stringify(body),
     signal: AbortSignal.timeout(timeoutMs),
   });
@@ -1751,7 +1752,7 @@ async function seedDemoSession(
     try {
       const res = await fetch(url, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: agentmemoryJsonHeaders(),
         body: JSON.stringify(payload),
         signal: AbortSignal.timeout(5000),
       });

src/cli/http-auth.ts

@@ -0,0 +1,15 @@
+export function agentmemoryAuthHeaders(
+  env: NodeJS.ProcessEnv = process.env,
+): Record<string, string> {
+  const secret = env["AGENTMEMORY_SECRET"]?.trim();
+  return secret ? { Authorization: `Bearer ${secret}` } : {};
+}
+
+export function agentmemoryJsonHeaders(
+  env: NodeJS.ProcessEnv = process.env,
+): Record<string, string> {
+  return {
+    "Content-Type": "application/json",
+    ...agentmemoryAuthHeaders(env),
+  };
+}

test/cli-http-auth.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, it } from "vitest";
+import {
+  agentmemoryAuthHeaders,
+  agentmemoryJsonHeaders,
+} from "../src/cli/http-auth.js";
+
+describe("CLI HTTP auth headers", () => {
+  it("omits Authorization when AGENTMEMORY_SECRET is unset", () => {
+    expect(agentmemoryAuthHeaders({})).toEqual({});
+    expect(agentmemoryJsonHeaders({})).toEqual({
+      "Content-Type": "application/json",
+    });
+  });
+
+  it("adds Bearer auth when AGENTMEMORY_SECRET is configured", () => {
+    const env = { AGENTMEMORY_SECRET: "secret-token" };
+
+    expect(agentmemoryAuthHeaders(env)).toEqual({
+      Authorization: "Bearer secret-token",
+    });
+    expect(agentmemoryJsonHeaders(env)).toEqual({
+      "Content-Type": "application/json",
+      Authorization: "Bearer secret-token",
+    });
+  });
+});