@asteroidai/cli 1.9.11 → 1.9.27

package/dist/asteroid.js

@@ -124,7 +124,8 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: false
+    destructive: false,
+    capability: "run_execution"
   },
   {
     command: "context",
@@ -1030,7 +1031,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "execution resume",
@@ -1050,7 +1052,8 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: false
+    destructive: false,
+    capability: "run_execution"
   },
   {
     command: "insight get",
@@ -1898,7 +1901,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "schedule delete",
@@ -1924,7 +1928,8 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: true
+    destructive: true,
+    capability: "run_execution"
   },
   {
     command: "schedule get",
@@ -2105,7 +2110,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "scheduled-execution cancel",
@@ -2125,7 +2131,8 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: false
+    destructive: false,
+    capability: "run_execution"
   },
   {
     command: "scheduled-execution create",
@@ -2193,7 +2200,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "scheduled-execution list",
@@ -2295,7 +2303,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "schema validate",
@@ -3435,7 +3444,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "workflow execute-sync",
@@ -3534,112 +3544,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
-  },
-  {
-    command: "workflow file list",
-    tool: "workflow_files_list",
-    title: "List workflow files",
-    description: "List the workflow's editable head as a directory of files: the graph rendered as structural files (settings.yaml, per-node instructions.md, scripts) alongside the workflow's own files. Those files are referenced by fileId unless contents=all is set. Pass paths to read named files only, or contents=none for a manifest with no bodies. The returned rev is what you pass as baseRev to write.",
-    method: "GET",
-    path: "/agents/v2/workflows/{workflowId}/head/files",
-    args: [
-      {
-        name: "workflowId",
-        flag: "workflow-id",
-        type: "string",
-        required: true
-      }
-    ],
-    query: [
-      {
-        name: "contents",
-        flag: "contents",
-        type: "string",
-        required: false,
-        description: "Which contents come inline: none (a pure manifest), structural (the default), or all (structural plus file bytes within the response budget).",
-        enum: ["none", "structural", "all"]
-      },
-      {
-        name: "paths",
-        flag: "paths",
-        type: "string[]",
-        required: false,
-        description: "Return only the files at these exact tree paths. A path that names nothing yields no entry. The inline budget applies to the filtered set, so a narrow read can inline files a whole-tree read would have to skip."
-      },
-      {
-        name: "variants",
-        flag: "variants",
-        type: "string",
-        required: false,
-        description: `Narrow which variants/<key>/ files the tree carries: "none" strips every variant, a comma-separated list keeps only those variant keys. Files outside variants/ are always kept, and the response's variantKeys still names every variant. Ignored unless the workflow has variant mode enabled; absent keeps every variant.`
-      },
-      {
-        name: "maxFileBytes",
-        flag: "max-file-bytes",
-        type: "integer",
-        required: false,
-        description: "Per-file ceiling, in bytes, for inlined file contents. Clamped to the server maximum. Files above the ceiling stay references."
-      },
-      {
-        name: "maxTotalBytes",
-        flag: "max-total-bytes",
-        type: "integer",
-        required: false,
-        description: "Ceiling, in bytes, on the total inlined file contents in one response. Clamped to the server maximum. Files are admitted in path order until the ceiling is reached; the rest stay references."
-      }
-    ],
-    binary: false,
-    readOnly: true,
-    destructive: false
-  },
-  {
-    command: "workflow file patch",
-    tool: "workflow_files_patch",
-    title: "Write workflow files",
-    description: "Write and delete files on the workflow's editable head in one patch. Structural files re-derive the graph; the workflow's own files go to its file store, you just write paths. Pass the rev from `workflow_files_list` as baseRev; a stale value is rejected with 409, so re-read and retry. Editing a published or already-executed version forks a new one instead of rewriting it. Each write carries `contentBase64`: base64-encode the file content, plain text is rejected with 400.",
-    method: "PATCH",
-    path: "/agents/v2/workflows/{workflowId}/head/files",
-    args: [
-      {
-        name: "workflowId",
-        flag: "workflow-id",
-        type: "string",
-        required: true
-      }
-    ],
-    query: [],
-    binary: false,
-    readOnly: false,
-    destructive: true,
-    body: {
-      required: true,
-      contentType: "application/json",
-      fields: [
-        {
-          name: "baseRev",
-          flag: "base-rev",
-          type: "integer",
-          required: true,
-          description: "The revision this edit is based on. Agent-file-only patches overlay the current head even when this is stale. A structural-file patch is rejected with 409 when it does not match the stored head revision."
-        },
-        {
-          name: "writes",
-          flag: "writes",
-          type: "json",
-          required: true,
-          description: "Files to upsert."
-        },
-        {
-          name: "deletes",
-          flag: "deletes",
-          type: "string[]",
-          required: true
-        }
-      ],
-      files: [],
-      credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "workflow get",
@@ -3687,7 +3593,8 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: false
+    destructive: false,
+    capability: "publish"
   },
   {
     command: "workflow head revert",
@@ -3813,6 +3720,113 @@ var COMMANDS = [
     readOnly: true,
     destructive: false
   },
+  {
+    command: "workflow pull",
+    tool: "workflow_files_list",
+    title: "List workflow files",
+    description: "List the workflow's editable head as a directory of files: the graph rendered as structural files (settings.yaml, per-node instructions.md, scripts) alongside the workflow's own files. Those files are referenced by fileId unless contents=all is set. Pass paths to read named files only, or contents=none for a manifest with no bodies. The returned rev is what you pass as baseRev to write.",
+    method: "GET",
+    path: "/agents/v2/workflows/{workflowId}/head/files",
+    args: [
+      {
+        name: "workflowId",
+        flag: "workflow-id",
+        type: "string",
+        required: true
+      }
+    ],
+    query: [
+      {
+        name: "contents",
+        flag: "contents",
+        type: "string",
+        required: false,
+        description: "Which contents come inline: none (a pure manifest), structural (the default), or all (structural plus file bytes within the response budget).",
+        enum: ["none", "structural", "all"]
+      },
+      {
+        name: "paths",
+        flag: "paths",
+        type: "string[]",
+        required: false,
+        description: "Return only the files at these exact tree paths. A path that names nothing yields no entry. The inline budget applies to the filtered set, so a narrow read can inline files a whole-tree read would have to skip."
+      },
+      {
+        name: "variants",
+        flag: "variants",
+        type: "string",
+        required: false,
+        description: `Narrow which variants/<key>/ files the tree carries: "none" strips every variant, a comma-separated list keeps only those variant keys. Files outside variants/ are always kept, and the response's variantKeys still names every variant. Ignored unless the workflow has variant mode enabled; absent keeps every variant.`
+      },
+      {
+        name: "maxFileBytes",
+        flag: "max-file-bytes",
+        type: "integer",
+        required: false,
+        description: "Per-file ceiling, in bytes, for inlined file contents. Clamped to the server maximum. Files above the ceiling stay references."
+      },
+      {
+        name: "maxTotalBytes",
+        flag: "max-total-bytes",
+        type: "integer",
+        required: false,
+        description: "Ceiling, in bytes, on the total inlined file contents in one response. Clamped to the server maximum. Files are admitted in path order until the ceiling is reached; the rest stay references."
+      }
+    ],
+    binary: false,
+    readOnly: true,
+    destructive: false,
+    files: "pull"
+  },
+  {
+    command: "workflow push",
+    tool: "workflow_files_patch",
+    title: "Write workflow files",
+    description: "Write and delete files on the workflow's editable head in one patch. Structural files re-derive the graph; the workflow's own files go to its file store, you just write paths. Pass the rev from `workflow_files_list` as baseRev; a stale value is rejected with 409, so re-read and retry. Editing a published or already-executed version forks a new one instead of rewriting it. Each write carries `contentBase64`: base64-encode the file content, plain text is rejected with 400.",
+    method: "PATCH",
+    path: "/agents/v2/workflows/{workflowId}/head/files",
+    args: [
+      {
+        name: "workflowId",
+        flag: "workflow-id",
+        type: "string",
+        required: true
+      }
+    ],
+    query: [],
+    binary: false,
+    readOnly: false,
+    destructive: true,
+    body: {
+      required: true,
+      contentType: "application/json",
+      fields: [
+        {
+          name: "baseRev",
+          flag: "base-rev",
+          type: "integer",
+          required: true,
+          description: "The revision this edit is based on. Agent-file-only patches overlay the current head even when this is stale. A structural-file patch is rejected with 409 when it does not match the stored head revision."
+        },
+        {
+          name: "writes",
+          flag: "writes",
+          type: "json",
+          required: true,
+          description: "Files to upsert."
+        },
+        {
+          name: "deletes",
+          flag: "deletes",
+          type: "string[]",
+          required: true
+        }
+      ],
+      files: [],
+      credentialOrganization: false
+    },
+    files: "push"
+  },
   {
     command: "workflow rename",
     tool: "workflow_rename",
@@ -4215,78 +4229,16 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
-    command: "workflow version file list",
-    tool: "workflow_version_files_list",
-    title: "List workflow version files",
-    description: "List a version's files, like `workflow_files_list` does for the editable head. Versions are immutable, so this is read-only.",
+    command: "workflow version file url",
+    tool: "workflow_version_file_signed_url",
+    title: "Get workflow version file signed URL",
+    description: "Get a short-lived signed URL for downloading one of a workflow version's files directly from storage. Prefer this over a redirect-based download when reading a file's contents.",
     method: "GET",
-    path: "/agents/v2/workflows/{workflowId}/versions/{versionId}/files",
-    args: [
-      {
-        name: "workflowId",
-        flag: "workflow-id",
-        type: "string",
-        required: true
-      },
-      {
-        name: "versionId",
-        flag: "version-id",
-        type: "string",
-        required: true
-      }
-    ],
-    query: [
-      {
-        name: "contents",
-        flag: "contents",
-        type: "string",
-        required: false,
-        description: "Which contents come inline: none (a pure manifest), structural (the default), or all (structural plus file bytes within the response budget).",
-        enum: ["none", "structural", "all"]
-      },
-      {
-        name: "paths",
-        flag: "paths",
-        type: "string[]",
-        required: false,
-        description: "Return only the files at these exact tree paths. A path that names nothing yields no entry. The inline budget applies to the filtered set, so a narrow read can inline files a whole-tree read would have to skip."
-      },
-      {
-        name: "variants",
-        flag: "variants",
-        type: "string",
-        required: false,
-        description: `Narrow which variants/<key>/ files the tree carries: "none" strips every variant, a comma-separated list keeps only those variant keys. Files outside variants/ are always kept, and the response's variantKeys still names every variant. Ignored unless the workflow has variant mode enabled; absent keeps every variant.`
-      },
-      {
-        name: "maxFileBytes",
-        flag: "max-file-bytes",
-        type: "integer",
-        required: false,
-        description: "Per-file ceiling, in bytes, for inlined file contents. Clamped to the server maximum. Files above the ceiling stay references."
-      },
-      {
-        name: "maxTotalBytes",
-        flag: "max-total-bytes",
-        type: "integer",
-        required: false,
-        description: "Ceiling, in bytes, on the total inlined file contents in one response. Clamped to the server maximum. Files are admitted in path order until the ceiling is reached; the rest stay references."
-      }
-    ],
-    binary: false,
-    readOnly: true,
-    destructive: false
-  },
-  {
-    command: "workflow version file url",
-    tool: "workflow_version_file_signed_url",
-    title: "Get workflow version file signed URL",
-    description: "Get a short-lived signed URL for downloading one of a workflow version's files directly from storage. Prefer this over a redirect-based download when reading a file's contents.",
-    method: "GET",
-    path: "/agents/v2/workflows/{workflowId}/versions/{versionId}/files/{fileId}/signed-url",
+    path: "/agents/v2/workflows/{workflowId}/versions/{versionId}/files/{fileId}/signed-url",
     args: [
       {
         name: "workflowId",
@@ -4434,7 +4386,72 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: false
+    destructive: false,
+    capability: "publish"
+  },
+  {
+    command: "workflow version pull",
+    tool: "workflow_version_files_list",
+    title: "List workflow version files",
+    description: "List a version's files, like `workflow_files_list` does for the editable head. Versions are immutable, so this is read-only.",
+    method: "GET",
+    path: "/agents/v2/workflows/{workflowId}/versions/{versionId}/files",
+    args: [
+      {
+        name: "workflowId",
+        flag: "workflow-id",
+        type: "string",
+        required: true
+      },
+      {
+        name: "versionId",
+        flag: "version-id",
+        type: "string",
+        required: true
+      }
+    ],
+    query: [
+      {
+        name: "contents",
+        flag: "contents",
+        type: "string",
+        required: false,
+        description: "Which contents come inline: none (a pure manifest), structural (the default), or all (structural plus file bytes within the response budget).",
+        enum: ["none", "structural", "all"]
+      },
+      {
+        name: "paths",
+        flag: "paths",
+        type: "string[]",
+        required: false,
+        description: "Return only the files at these exact tree paths. A path that names nothing yields no entry. The inline budget applies to the filtered set, so a narrow read can inline files a whole-tree read would have to skip."
+      },
+      {
+        name: "variants",
+        flag: "variants",
+        type: "string",
+        required: false,
+        description: `Narrow which variants/<key>/ files the tree carries: "none" strips every variant, a comma-separated list keeps only those variant keys. Files outside variants/ are always kept, and the response's variantKeys still names every variant. Ignored unless the workflow has variant mode enabled; absent keeps every variant.`
+      },
+      {
+        name: "maxFileBytes",
+        flag: "max-file-bytes",
+        type: "integer",
+        required: false,
+        description: "Per-file ceiling, in bytes, for inlined file contents. Clamped to the server maximum. Files above the ceiling stay references."
+      },
+      {
+        name: "maxTotalBytes",
+        flag: "max-total-bytes",
+        type: "integer",
+        required: false,
+        description: "Ceiling, in bytes, on the total inlined file contents in one response. Clamped to the server maximum. Files are admitted in path order until the ceiling is reached; the rest stay references."
+      }
+    ],
+    binary: false,
+    readOnly: true,
+    destructive: false,
+    files: "pull"
   },
   {
     command: "workflow version validate",
@@ -4510,11 +4527,6 @@ var COMMANDS = [
 function option(name, type, description, extra = {}) {
   return { name, flag: name, type, required: false, description, ...extra };
 }
-var DIR = option(
-  "dir",
-  "string",
-  "Write here instead of `<workflow-name>/...` under the current directory."
-);
 var local = {
   method: "GET",
   path: "",
@@ -4523,46 +4535,6 @@ var local = {
   local: true
 };
 var SYNC_COMMANDS = [
-  {
-    ...local,
-    command: "workflow pull",
-    tool: "workflow_pull",
-    title: "Pull a workflow to disk",
-    description: "Write a workflow's editable head to `<workflow-name>/head/` as files: settings, per-node instructions and scripts, and the workflow's own files. Pass --version-id for a pinned version, written read-only to `<workflow-name>/.versions/`. Edit the head files, then run `asteroid workflow push` from that folder.",
-    readOnly: true,
-    args: [
-      {
-        name: "workflowId",
-        flag: "workflow-id",
-        type: "string",
-        required: true
-      }
-    ],
-    query: [
-      option(
-        "version-id",
-        "string",
-        "A workflow version ID. Omit for the editable head."
-      ),
-      DIR
-    ]
-  },
-  {
-    ...local,
-    command: "workflow push",
-    tool: "workflow_push",
-    title: "Push local edits to a workflow head",
-    description: "Send the edits in a pulled head folder to the workflow's editable head: changed and new files are written, removed files are deleted. Fails if the head changed since the pull; pull again and reapply. Push does not publish.",
-    readOnly: false,
-    args: [],
-    query: [
-      option(
-        "dir",
-        "string",
-        "The pulled head folder. Defaults to the current directory."
-      )
-    ]
-  },
   {
     ...local,
     command: "execution pull",
@@ -4644,8 +4616,8 @@ var HIDDEN = /^agent[A-Z]|Url$/;
 var MAX_COLUMNS = 6;
 var MAX_CELL = 60;
 var CONTROL = /\x1b\[[0-?]*[ -/]*[@-~]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?|\x1b[@-_]?|[\x00-\x08\x0b-\x1f\x7f-\x9f]/g;
-function clean(text2) {
-  return text2.replace(CONTROL, "");
+function clean(text3) {
+  return text3.replace(CONTROL, "");
 }
 function isObject(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
@@ -4653,8 +4625,8 @@ function isObject(value2) {
 function isScalar(value2) {
   return value2 === null || ["string", "number", "boolean"].includes(typeof value2);
 }
-function indent(text2) {
-  return text2.split("\n").map((line2) => `  ${line2}`).join("\n");
+function indent(text3) {
+  return text3.split("\n").map((line2) => `  ${line2}`).join("\n");
 }
 function text(value2) {
   return clean(isScalar(value2) ? String(value2) : JSON.stringify(value2));
@@ -4835,7 +4807,7 @@ function orgLabel(org) {
 }
 
 // src/program.ts
-import { Command, CommanderError } from "commander";
+import { Command, CommanderError, Option as Flag } from "commander";
 
 // src/args.ts
 var UsageError = class extends Error {
@@ -4866,7 +4838,17 @@ var BUILTINS = [
     usage: "asteroid use [org]",
     arg: "org",
     description: "Make an organization, by id or name, the default for later commands. Without one, pick from a list.",
-    args: 1
+    args: 1,
+    hiddenOptions: [
+      [
+        "--reason <why>",
+        "Staff only. Why you need access to an organization you are not a member of, such as a ticket id. It is audited. Asked for in a terminal."
+      ],
+      [
+        "--exit",
+        "Staff only. Revoke every staff token now and go back to your own organization."
+      ]
+    ]
   },
   {
     command: "complete",
@@ -4903,8 +4885,8 @@ function collect(value2, previous) {
   return [...previous ?? [], value2];
 }
 function optionText(option2) {
-  const text2 = option2.description?.replace(/\s+/g, " ").trim() ?? "";
-  const parts = [text2 && !/[.!?]$/.test(text2) ? `${text2}.` : text2];
+  const text3 = option2.description?.replace(/\s+/g, " ").trim() ?? "";
+  const parts = [text3 && !/[.!?]$/.test(text3) ? `${text3}.` : text3];
   if (option2.enum) parts.push(`One of: ${option2.enum.join(", ")}.`);
   if (option2.type.endsWith("[]")) parts.push("Repeatable.");
   if (option2.required) parts.push("Required.");
@@ -4952,6 +4934,16 @@ function leafOptions(leaf, command) {
   for (const file of command.body?.files ?? []) {
     leaf.option(`--${file} <path>`, "File to upload. Repeatable.", collect);
   }
+  if (command.files === "pull")
+    leaf.option(
+      "--out <dir>",
+      "Write here instead of ./<workflow-name>/head (a version: ./<workflow-name>/.versions/...). --json prints the file listing instead."
+    );
+  if (command.files === "push")
+    leaf.option(
+      "--from <dir>",
+      "The pulled head folder to push. Defaults to the current folder."
+    );
 }
 function toParsed(leaf, positionals, dotted) {
   const globals = leaf.optsWithGlobals();
@@ -4979,12 +4971,14 @@ function defineCommands(root, options, dotted = /* @__PURE__ */ new Map(), onInv
       "after",
       "\nRun `asteroid --version` to print the CLI version."
     );
-  for (const [flags, text2] of GLOBAL_FLAGS) {
-    if (!flags.startsWith("-h")) root.option(flags, text2);
+  for (const [flags, text3] of GLOBAL_FLAGS) {
+    if (!flags.startsWith("-h")) root.option(flags, text3);
   }
   for (const builtin of options.builtins ?? []) {
     const leaf = root.command(builtin.command).description(builtin.description);
     if (builtin.arg) leaf.argument(`[${builtin.arg}]`);
+    for (const [flags, text3] of builtin.hiddenOptions ?? [])
+      leaf.addOption(new Flag(flags, text3).hideHelp());
     leaf.action((...args) => {
       const cmd = args.at(-1);
       onInvocation({
@@ -5073,8 +5067,8 @@ async function parseInvocation(argv2, options) {
   }
   const { argv: rest, dotted } = splitDotted(argv2);
   const root = new Command("asteroid").exitOverride().helpCommand(false).configureOutput({
-    writeOut: (text2) => stdout += text2,
-    writeErr: (text2) => stderr += text2
+    writeOut: (text3) => stdout += text3,
+    writeErr: (text3) => stderr += text3
   });
   defineCommands(root, options, dotted, (invocation) => {
     result = invocation;
@@ -5228,11 +5222,12 @@ function tokenClaims(token) {
 var SERVICE = "asteroid-cli";
 var LOCK_STALE_MS = 3e4;
 var ACCOUNT = "refresh-token";
-async function keyring() {
+var STAFF_ACCOUNT = "staff-tokens";
+async function keyring(account = ACCOUNT) {
   if (process.env.ASTEROID_NO_KEYCHAIN) return void 0;
   try {
     const { Entry } = await import("@napi-rs/keyring");
-    const entry = new Entry(SERVICE, ACCOUNT);
+    const entry = new Entry(SERVICE, account);
     entry.getPassword();
     return {
       get: () => entry.getPassword() ?? null,
@@ -5272,6 +5267,9 @@ var CredentialStore = class {
   get tokenFile() {
     return join2(this.env.configDir, "tokens.json");
   }
+  get staffFile() {
+    return join2(this.env.configDir, "staff-tokens.json");
+  }
   async readLogin() {
     const ring = await keyring();
     const raw = ring ? tryGet(ring).value : null;
@@ -5300,22 +5298,95 @@ var CredentialStore = class {
     const cleared = current.ok && (!current.value || trySet(ring, null));
     rmSync(this.loginFile, { force: true });
     rmSync(this.tokenFile, { force: true });
-    return cleared;
+    const staffCleared = await this.withStaffLock(
+      () => this.writeStaffTokens({})
+    );
+    return staffCleared && cleared;
+  }
+  /** Every staff token held, expired ones included. */
+  async staffTokens() {
+    const ring = await keyring(STAFF_ACCOUNT);
+    const raw = ring ? tryGet(ring).value : null;
+    const tokens = raw ? JSON.parse(raw) : readJson(this.staffFile, {});
+    return Object.values(tokens);
+  }
+  /** The staff token for an org, matched by WorkOS id, id or name. */
+  async staffToken(ref) {
+    const lower = ref.toLowerCase();
+    return (await this.staffTokens()).find(
+      ({ org }) => org.workosId.toLowerCase() === lower || org.id?.toLowerCase() === lower || org.name?.toLowerCase() === lower
+    );
+  }
+  /** Saves a staff token and drops expired ones. `replaces` is dropped too. */
+  async saveStaffToken(token, replaces) {
+    await this.withStaffLock(async () => {
+      const tokens = {};
+      for (const held of await this.staffTokens())
+        if (held.expiresAt > Date.now() && held.grantId !== replaces)
+          tokens[held.org.workosId] = held;
+      tokens[token.org.workosId] = token;
+      if (!await this.writeStaffTokens(tokens))
+        throw new WorkosError(
+          "keychain",
+          "could not save the staff token in the OS keychain. Unlock it and try again."
+        );
+    });
+  }
+  async dropStaffToken(grantId) {
+    await this.withStaffLock(async () => {
+      const tokens = {};
+      for (const held of await this.staffTokens())
+        if (held.grantId !== grantId) tokens[held.org.workosId] = held;
+      if (!await this.writeStaffTokens(tokens))
+        throw new WorkosError(
+          "keychain",
+          "could not remove the staff token from the OS keychain. Unlock it and try again."
+        );
+    });
+  }
+  async writeStaffTokens(tokens) {
+    const empty = Object.keys(tokens).length === 0;
+    const ring = await keyring(STAFF_ACCOUNT);
+    if (ring && trySet(ring, empty ? null : JSON.stringify(tokens))) {
+      rmSync(this.staffFile, { force: true });
+      return true;
+    }
+    const stale = ring ? tryGet(ring) : { ok: true, value: null };
+    if (!stale.ok || stale.value && !trySet(ring, null)) return false;
+    if (empty) rmSync(this.staffFile, { force: true });
+    else writePrivateJson(this.staffFile, tokens);
+    return true;
   }
   async withRefreshLock(work) {
+    return this.withLock(
+      "refresh",
+      "another asteroid command is refreshing the sign-in.",
+      work
+    );
+  }
+  /** Two commands at once must not lose a grant they could still revoke. */
+  async withStaffLock(work) {
+    return this.withLock(
+      "staff",
+      "another asteroid command is saving staff access.",
+      work
+    );
+  }
+  async withLock(name, busy, work) {
     mkdirSync2(this.env.configDir, { recursive: true, mode: 448 });
-    const lockfilePath = join2(this.env.configDir, "refresh.lock");
+    const lockfilePath = join2(this.env.configDir, `${name}.lock`);
     let release;
     try {
-      release = await lockfile.lock(this.env.configDir, {
+      release = await lockfile.lock(join2(this.env.configDir, name), {
         lockfilePath,
+        realpath: false,
         stale: LOCK_STALE_MS,
         retries: { retries: 60, minTimeout: 100, maxTimeout: 500 }
       });
     } catch {
       throw new WorkosError(
         "locked",
-        `another asteroid command is refreshing the sign-in. Try again, or delete ${lockfilePath} if none is running.`
+        `${busy} Try again, or delete ${lockfilePath} if none is running.`
       );
     }
     try {
@@ -5342,8 +5413,25 @@ var CredentialStore = class {
 // src/auth/credentials.ts
 var AuthError = class extends Error {
 };
+var NotMemberError = class extends AuthError {
+};
 var API_KEY_OVERRIDES = "ASTEROID_API_KEY is set, so the CLI uses that key and ignores `asteroid login`.";
 var UNSET_API_KEY = "Run `unset ASTEROID_API_KEY` to use your login instead.";
+function isStaffLogin(login2) {
+  return login2?.email?.toLowerCase().endsWith("@asteroid.ai") ?? false;
+}
+function staffHint(ref, staff) {
+  return staff ? ` Asteroid staff: run \`asteroid use ${clean(ref)} --reason <why>\`.` : "";
+}
+function staffAuth(held) {
+  return {
+    kind: "bearer",
+    headers: { Authorization: `Bearer ${held.token}` },
+    org: held.org,
+    expiresAt: held.expiresAt,
+    staff: { grantId: held.grantId, reason: held.reason }
+  };
+}
 function orgFromToken(token) {
   const claims = tokenClaims(token);
   if (!claims.org_id) return void 0;
@@ -5370,7 +5458,7 @@ function bearer(token, expiresAt) {
   };
 }
 var SSO_OR_MFA = /^(sso_required|mfa_.*|organization_authentication_methods_required)$/;
-function refreshError(error, org) {
+function refreshError(error, org, login2) {
   if (error.code === "invalid_grant") {
     return new AuthError("your sign-in has expired. Run `asteroid login`.");
   }
@@ -5380,8 +5468,8 @@ function refreshError(error, org) {
     );
   }
   if (error.code === "organization_membership_not_found") {
-    return new AuthError(
-      `you are not a member of ${orgLabel(org)}. Staff access to other organizations is not available yet.`
+    return new NotMemberError(
+      `you are not a member of ${orgLabel(org)}.${staffHint(org.id ?? org.workosId, isStaffLogin(login2))}`
     );
   }
   return new AuthError(
@@ -5392,15 +5480,24 @@ async function resolveAuth(env, config, orgRef, fetchImpl = fetch) {
   if (env.apiKey)
     return { kind: "api-key", headers: { "X-Api-Key": env.apiKey } };
   const store = new CredentialStore(env);
-  if (!await store.readLogin()) {
+  const login2 = await store.readLogin();
+  if (!login2) {
     throw new AuthError(
       "not signed in. Run `asteroid login`, or set ASTEROID_API_KEY."
     );
   }
+  const target = orgRef ?? config.org?.workosId;
+  const held = target ? await store.staffToken(target) : void 0;
+  if (held) {
+    if (held.expiresAt - 3e4 > Date.now()) return staffAuth(held);
+    throw new AuthError(
+      `your staff access to ${orgLabel(held.org)} has expired.${staffHint(held.org.id ?? held.org.workosId, true)}`
+    );
+  }
   const org = orgRef ? findOrg(orgRef, config.orgs ?? []) : config.org;
   if (orgRef && !org) {
     throw new AuthError(
-      `unknown organization ${orgRef}. Run \`asteroid orgs\` to list yours.`
+      `unknown organization ${clean(orgRef)}. Run \`asteroid orgs\` to list yours.${staffHint(orgRef, isStaffLogin(login2))}`
     );
   }
   if (!org) {
@@ -5413,8 +5510,8 @@ async function resolveAuth(env, config, orgRef, fetchImpl = fetch) {
   return store.withRefreshLock(async () => {
     const fresh = store.cachedToken(org.workosId);
     if (fresh) return bearer(fresh.accessToken, fresh.expiresAt);
-    const login2 = await store.readLogin();
-    if (!login2) {
+    const login3 = await store.readLogin();
+    if (!login3) {
       throw new AuthError("not signed in. Run `asteroid login`.");
     }
     try {
@@ -5424,10 +5521,10 @@ async function resolveAuth(env, config, orgRef, fetchImpl = fetch) {
           apiUrl: env.workosApiUrl,
           fetch: fetchImpl
         },
-        login2.refreshToken,
+        login3.refreshToken,
         org.workosId
       );
-      await store.writeLogin({ ...login2, refreshToken: session2.refreshToken });
+      await store.writeLogin({ ...login3, refreshToken: session2.refreshToken });
       const expiresAt = (tokenClaims(session2.accessToken).exp ?? 0) * 1e3 || Date.now() + 6e4;
       const auth = bearer(session2.accessToken, expiresAt);
       store.cacheToken(auth.org?.workosId ?? org.workosId, {
@@ -5437,7 +5534,7 @@ async function resolveAuth(env, config, orgRef, fetchImpl = fetch) {
       rememberOrg(env, config, auth.org);
       return auth;
     } catch (error) {
-      if (error instanceof WorkosError) throw refreshError(error, org);
+      if (error instanceof WorkosError) throw refreshError(error, org, login3);
       throw error;
     }
   });
@@ -5453,7 +5550,7 @@ var ApiError = class extends Error {
   status;
   body;
 };
-var VERSION = "1.9.11";
+var VERSION = "1.9.27";
 function problem(status, body, fallback) {
   if (body && typeof body === "object") {
     const record2 = body;
@@ -5513,14 +5610,14 @@ async function send(apiUrl, auth, request, binary, fetchImpl = fetch) {
   }
   const contentType = response.headers.get("content-type") ?? "";
   if (!response.ok) {
-    const text2 = await response.text();
-    let parsed = text2;
+    const text3 = await response.text();
+    let parsed = text3;
     try {
-      parsed = JSON.parse(text2);
+      parsed = JSON.parse(text3);
     } catch {
-      parsed = text2;
+      parsed = text3;
     }
-    let message = problem(response.status, parsed, text2.slice(0, 200));
+    let message = problem(response.status, parsed, text3.slice(0, 200));
     const sentKey = "X-Api-Key" in hopHeaders;
     if (sentKey && response.status === 401)
       message = `ASTEROID_API_KEY was rejected: ${message}. Check the key. ${UNSET_API_KEY}`;
@@ -5632,11 +5729,21 @@ async function orgs(deps, flagOrg, json) {
     deps.fetch
   );
   const list = loadConfig(deps.env).orgs ?? [];
+  const staff = (await new CredentialStore(deps.env).staffTokens()).filter(
+    (held) => held.expiresAt > Date.now()
+  );
   const active = auth.org?.workosId;
   if (json) {
     deps.stdout(
       `${JSON.stringify(
-        list.map((org) => ({ ...org, active: org.workosId === active })),
+        [
+          ...list.map((org) => ({ ...org, active: org.workosId === active })),
+          ...staff.map((held) => ({
+            ...held.org,
+            active: held.org.workosId === active,
+            staff: { reason: held.reason, expiresAt: held.expiresAt }
+          }))
+        ],
         null,
         2
       )}
@@ -5647,13 +5754,204 @@ async function orgs(deps, flagOrg, json) {
   for (const org of list)
     deps.stdout(`${org.workosId === active ? "*" : " "} ${orgLabel(org)}
 `);
+  for (const held of staff)
+    deps.stdout(
+      `${held.org.workosId === active ? "*" : " "} ${orgLabel(held.org)}  staff access, ${timeLeft(held.expiresAt)} left
+`
+    );
   return 0;
 }
-async function use(deps, ref) {
+function timeLeft(expiresAt) {
+  const minutes = Math.max(0, Math.round((expiresAt - Date.now()) / 6e4));
+  return minutes >= 60 ? `${Math.floor(minutes / 60)}h${String(minutes % 60).padStart(2, "0")}m` : `${minutes}m`;
+}
+function isMember(config, org) {
+  return (config.orgs ?? []).some((o) => o.workosId === org.workosId);
+}
+function homeOrg(config) {
+  const org = config.org && isMember(config, config.org) ? config.org : config.orgs?.[0];
+  if (!org)
+    throw new AuthError(
+      "staff access needs a sign-in to one of your own organizations. Run `asteroid login`."
+    );
+  return org;
+}
+var STAFF_TOKEN_PATH = "/users/v2/staff-tokens";
+async function mintStaffToken(deps, config, ref, reason) {
+  const home = await resolveAuth(
+    deps.env,
+    config,
+    homeOrg(config).workosId,
+    deps.fetch
+  );
+  let minted;
+  try {
+    const response = await send(
+      deps.env.apiUrl,
+      home,
+      {
+        method: "POST",
+        path: STAFF_TOKEN_PATH,
+        query: new URLSearchParams(),
+        json: { organization: ref, reason }
+      },
+      false,
+      deps.fetch
+    );
+    minted = response.json;
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 403)
+      throw new AuthError(
+        `you are not a member of ${clean(ref)}, and staff access is for Asteroid staff only.`
+      );
+    if (error instanceof ApiError && error.status === 404)
+      throw new UsageError(
+        `unknown organization ${clean(ref)}. Pass its id or its WorkOS id (org_...).`
+      );
+    throw error;
+  }
+  return {
+    token: minted.token,
+    grantId: minted.grantId,
+    org: {
+      workosId: minted.workosOrganizationId ?? minted.organizationId,
+      id: minted.organizationId,
+      name: minted.organizationName
+    },
+    reason: minted.reason,
+    expiresAt: Date.parse(minted.expiresAt)
+  };
+}
+async function revokeStaffToken(deps, home, held) {
+  try {
+    await send(
+      deps.env.apiUrl,
+      home,
+      {
+        method: "DELETE",
+        path: `${STAFF_TOKEN_PATH}/${encodeURIComponent(held.grantId)}`,
+        query: new URLSearchParams()
+      },
+      false,
+      deps.fetch
+    );
+    return true;
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 404) return true;
+    deps.stderr(
+      `Could not revoke staff access to ${orgLabel(held.org)}: ${clean(error instanceof Error ? error.message : String(error))}. It ends at ${new Date(held.expiresAt).toISOString()}.
+`
+    );
+    return false;
+  }
+}
+async function exitStaff(deps) {
+  const store = new CredentialStore(deps.env);
+  const held = await store.staffTokens();
+  const config = loadConfig(deps.env);
+  if (held.length === 0) {
+    deps.stderr("No staff access to leave.\n");
+    return 0;
+  }
+  const home = await resolveAuth(
+    deps.env,
+    config,
+    homeOrg(config).workosId,
+    deps.fetch
+  );
+  const left = [];
+  const kept = [];
+  for (const token of held) {
+    const ended = token.expiresAt <= Date.now() || await revokeStaffToken(deps, home, token);
+    if (!ended) {
+      kept.push(token);
+      continue;
+    }
+    await store.dropStaffToken(token.grantId);
+    left.push(token);
+  }
+  const back = held.find((t) => t.from)?.from ?? homeOrg(config);
+  saveConfig(deps.env, { ...loadConfig(deps.env), org: back });
+  if (left.length > 0)
+    deps.stderr(
+      `Left staff access to ${left.map((t) => orgLabel(t.org)).join(", ")}.
+`
+    );
+  if (kept.length > 0)
+    deps.stderr(
+      `Still holding staff access to ${kept.map((t) => orgLabel(t.org)).join(", ")}. Run \`asteroid use --exit\` again to retry.
+`
+    );
+  deps.stderr(`Now using ${orgLabel(back)}.
+`);
+  return kept.length === 0 ? 0 : 1;
+}
+async function askReason(deps, org) {
+  if (!deps.ui) return void 0;
+  const reason = await deps.ui.text(
+    `You are not a member of ${clean(org)}. Why do you need staff access? This is audited.`
+  );
+  return reason?.trim() || void 0;
+}
+async function useAsStaff(deps, config, ref, reason, staff) {
+  const store = new CredentialStore(deps.env);
+  const held = await store.staffToken(ref);
+  if (held && held.expiresAt - 3e4 > Date.now() && !reason) {
+    saveConfig(deps.env, { ...config, org: held.org });
+    deps.stderr(
+      `Now using ${orgLabel(held.org)} with staff access, ${timeLeft(held.expiresAt)} left.
+`
+    );
+    return 0;
+  }
+  if (!reason && staff) reason = await askReason(deps, ref);
+  if (!reason)
+    throw new UsageError(
+      `you are not a member of ${clean(ref)}.${staffHint(ref, staff)}${staff ? " The reason is audited." : ""}`
+    );
+  const minted = await mintStaffToken(
+    deps,
+    config,
+    held?.org.id ?? ref,
+    reason
+  );
+  const previous = config.org ? isMember(config, config.org) ? config.org : (await store.staffToken(config.org.workosId))?.from : void 0;
+  try {
+    await store.saveStaffToken(
+      { ...minted, from: previous ?? held?.from },
+      held?.grantId
+    );
+  } catch (error) {
+    const home = await resolveAuth(
+      deps.env,
+      config,
+      homeOrg(config).workosId,
+      deps.fetch
+    );
+    await revokeStaffToken(deps, home, minted);
+    throw error;
+  }
+  saveConfig(deps.env, { ...loadConfig(deps.env), org: minted.org });
+  deps.stderr(
+    `Staff access to ${orgLabel(minted.org)} for ${timeLeft(minted.expiresAt)}, until ${new Date(minted.expiresAt).toLocaleTimeString()}. Reason: ${clean(minted.reason)}. This is audited. Run \`asteroid use --exit\` to leave.
+`
+  );
+  return 0;
+}
+async function use(deps, ref, options = {}) {
   if (deps.env.apiKey)
     throw new UsageError(
       `${API_KEY_OVERRIDES} \`use\` only switches the login's organization. ${UNSET_API_KEY}`
     );
+  if (options.exit) {
+    if (ref || options.reason)
+      throw new UsageError("usage: asteroid use --exit");
+    return exitStaff(deps);
+  }
+  if (options.reason?.startsWith("-"))
+    throw new UsageError(
+      `--reason needs a value, not ${clean(options.reason)}. Give the reason without a leading -.`
+    );
   const config = loadConfig(deps.env);
   if (!ref && deps.ui && (config.orgs?.length ?? 0) > 0) {
     ref = await deps.ui.select(
@@ -5666,12 +5964,20 @@ async function use(deps, ref) {
     if (!ref) return 1;
   }
   if (!ref) throw new UsageError("usage: asteroid use <org>");
+  const login2 = await new CredentialStore(deps.env).readLogin();
+  if (!login2) throw new AuthError("not signed in. Run `asteroid login`.");
+  const staff = isStaffLogin(login2);
   const org = findOrg(ref, config.orgs ?? []);
-  if (!org)
-    throw new UsageError(
-      `unknown organization ${ref}. Run \`asteroid orgs\` to list yours.`
-    );
-  const auth = await resolveAuth(deps.env, config, org.workosId, deps.fetch);
+  if (!org || !isMember(config, org) && options.reason)
+    return useAsStaff(deps, config, ref, options.reason, staff);
+  let auth;
+  try {
+    auth = await resolveAuth(deps.env, config, org.workosId, deps.fetch);
+  } catch (error) {
+    if (error instanceof NotMemberError)
+      return useAsStaff(deps, config, ref, options.reason, staff);
+    throw error;
+  }
   const updated = loadConfig(deps.env);
   updated.org = updated.orgs?.find((o) => o.workosId === org.workosId) ?? auth.org ?? org;
   saveConfig(deps.env, updated);
@@ -5703,6 +6009,7 @@ async function whoami(deps, flagOrg, json) {
     );
     return 0;
   }
+  const grant = body.staffGrant;
   const person = body.person;
   const orgId = body.organizationId;
   const organization = auth.org ? orgLabel(auth.org) : orgId ?? "none";
@@ -5711,9 +6018,10 @@ async function whoami(deps, flagOrg, json) {
       as: person?.email ?? body.id,
       kind: body.kind,
       credential: body.credential,
-      source: auth.kind === "api-key" ? "ASTEROID_API_KEY" : "asteroid login",
+      source: auth.kind === "api-key" ? "ASTEROID_API_KEY" : auth.staff ? "asteroid use (staff access)" : "asteroid login",
       organization,
-      ...minutes === void 0 ? {} : { tokenExpiresIn: `${minutes}m` }
+      ...grant ? { staffReason: grant.reason } : {},
+      ...auth.expiresAt === void 0 ? {} : { tokenExpiresIn: timeLeft(auth.expiresAt) }
     })}
 `
   );
@@ -6107,8 +6415,8 @@ function executionDir(options, execution) {
   );
   return join3(root, "executions", executionDirName(execution.id));
 }
-async function writeText(sync, path, text2) {
-  await sync.files.write(path, Buffer.from(text2, "utf8"));
+async function writeText(sync, path, text3) {
+  await sync.files.write(path, Buffer.from(text3, "utf8"));
 }
 async function writeActivities(sync, dir, execution) {
   try {
@@ -6308,16 +6616,10 @@ function nodeFiles(cwd) {
 
 // src/sync/workflow-pull.ts
 var CONCURRENCY = 16;
-function treeRequest(options) {
-  const base = `/agents/v2/workflows/${options.workflowId}`;
-  const path = options.versionId ? `${base}/versions/${options.versionId}/files` : `${base}/head/files`;
-  return get(path, { contents: "all" });
-}
-function pullDir(options, tree) {
-  if (options.dir) return options.dir;
-  const root = workflowRoot(options.root, tree.workflowName);
-  if (!options.versionId) return join3(root, "head");
-  return join3(root, ".versions", workflowDirName(tree.versionId, tree.version));
+function pullDir(root, tree, head) {
+  const base = workflowRoot(root, tree.workflowName);
+  if (head) return join3(base, "head");
+  return join3(base, ".versions", workflowDirName(tree.versionId, tree.version));
 }
 async function agentFileBytes(sync, workflowId, tree, entry) {
   const path = `/agents/v2/workflows/${workflowId}/versions/${tree.versionId}/files/${entry.fileId}/signed-url`;
@@ -6362,13 +6664,19 @@ async function removeStale(sync, dir, keep) {
   }
 }
 async function writeManifest(sync, dir, manifest) {
-  const text2 = `${JSON.stringify(manifest, null, 2)}
+  const text3 = `${JSON.stringify(manifest, null, 2)}
 `;
-  await sync.files.write(join3(dir, MANIFEST), Buffer.from(text2, "utf8"));
+  await sync.files.write(join3(dir, MANIFEST), Buffer.from(text3, "utf8"));
 }
 async function pullWorkflow(sync, options) {
-  const tree = await sync.remote.json(treeRequest(options));
-  const dir = pullDir(options, tree);
+  const request = {
+    ...options.request,
+    query: new URLSearchParams(options.request.query)
+  };
+  request.query.set("contents", "all");
+  const tree = await sync.remote.json(request);
+  const head = request.path.endsWith("/head/files");
+  const dir = options.dir ?? pullDir(options.root ?? "", tree, head);
   const { hashes, skipped, shared } = await writeEntries(
     sync,
     options,
@@ -6380,7 +6688,7 @@ async function pullWorkflow(sync, options) {
     await writeManifest(sync, dir, {
       workflowId: options.workflowId,
       versionId: tree.versionId,
-      head: !options.versionId,
+      head,
       rev: tree.rev,
       files: hashes
     });
@@ -6392,6 +6700,7 @@ async function pullWorkflow(sync, options) {
     version: tree.version,
     rev: tree.rev,
     dir,
+    head,
     written: Object.keys(hashes).length,
     shared,
     skipped
@@ -6406,7 +6715,8 @@ function formatWorkflowPull(result) {
     `Written to: ${result.dir}/`,
     files,
     result.skipped.length > 0 ? `Skipped:
-${result.skipped.map((s) => `  - ${s}`).join("\n")}` : null
+${result.skipped.map((s) => `  - ${s}`).join("\n")}` : null,
+    result.head ? `Edit the files, then run \`asteroid workflow push\` from ${result.dir}/.` : "This is a pinned version. It is read-only."
   ].filter(Boolean).join("\n");
 }
 
@@ -6488,8 +6798,13 @@ async function refresh2(sync, dir, manifest, pushed) {
   await writeManifest(sync, dir, next);
   return next;
 }
-async function pushWorkflow(sync, dir) {
+async function pushWorkflow(sync, dir, workflowId) {
   const manifest = await readManifest(sync, dir);
+  if (workflowId !== void 0 && manifest.workflowId !== workflowId) {
+    throw new UsageError(
+      `${dir} holds workflow ${manifest.workflowId}, not ${workflowId}.`
+    );
+  }
   const { writes, deletes } = await localChanges(sync, dir, manifest);
   const result = {
     workflowId: manifest.workflowId,
@@ -6550,42 +6865,64 @@ function executionOptions(parsed) {
     dir: dir ? () => dir : void 0
   };
 }
+function withoutFlag(parsed, name) {
+  const flags = new Map(parsed.flags);
+  flags.delete(name);
+  return { ...parsed, flags };
+}
+function runsLocally(command, parsed) {
+  if (command.local) return true;
+  if (command.files === "pull") return !parsed.json;
+  if (command.files === "push") return parsed.body === void 0;
+  return false;
+}
+var PARTIAL = ["paths", "variants"];
+function rejectPartial(parsed) {
+  const used = PARTIAL.filter((name) => parsed.flags.has(name));
+  if (used.length === 0) return;
+  throw new UsageError(
+    `pull writes the whole tree, so it cannot take ${used.map((name) => `--${name}`).join(" or ")}. Add --json to list those files instead.`
+  );
+}
+async function pull(command, parsed, sync, deps) {
+  rejectPartial(parsed);
+  const result = await pullWorkflow(sync, {
+    workflowId: parsed.positionals[0],
+    request: await buildRequest(command, withoutFlag(parsed, "out"), {
+      io: deps.io
+    }),
+    dir: flag(parsed, "out"),
+    root: deps.root ?? "",
+    ...deps.workflowPull
+  });
+  return { result, text: formatWorkflowPull(result) };
+}
 async function execute(command, parsed, sync, deps) {
-  const root = deps.root ?? "";
-  switch (command.command) {
-    case "workflow pull": {
-      const result = await pullWorkflow(sync, {
-        workflowId: parsed.positionals[0],
-        versionId: flag(parsed, "version-id"),
-        dir: flag(parsed, "dir"),
-        root,
-        ...deps.workflowPull
-      });
-      return { result, text: formatWorkflowPull(result) };
-    }
-    case "workflow push": {
-      const result = await pushWorkflow(sync, flag(parsed, "dir") ?? ".");
-      return { result, text: formatWorkflowPush(result) };
-    }
-    case "execution pull": {
-      const result = await pullExecution(sync, {
-        ...executionOptions(parsed),
-        root,
-        ...deps.executionPull
-      });
-      return { result, text: formatExecutionPull(result) };
-    }
-    default:
-      throw new UsageError(`unknown command ${command.command}`);
+  if (command.files === "pull") return pull(command, parsed, sync, deps);
+  if (command.files === "push") {
+    const result2 = await pushWorkflow(
+      sync,
+      flag(parsed, "from") ?? ".",
+      parsed.positionals[0] || void 0
+    );
+    return { result: result2, text: formatWorkflowPush(result2) };
   }
+  if (command.command !== "execution pull")
+    throw new UsageError(`unknown command ${command.command}`);
+  const result = await pullExecution(sync, {
+    ...executionOptions(parsed),
+    root: deps.root ?? "",
+    ...deps.executionPull
+  });
+  return { result, text: formatExecutionPull(result) };
 }
 async function runSync(command, parsed, deps) {
   const sync = {
     remote: deps.remote,
     files: deps.files ?? nodeFiles(deps.cwd)
   };
-  const { result, text: text2 } = await execute(command, parsed, sync, deps);
-  deps.stdout(`${parsed.json ? JSON.stringify(result, null, 2) : text2}
+  const { result, text: text3 } = await execute(command, parsed, sync, deps);
+  deps.stdout(`${parsed.json ? JSON.stringify(result, null, 2) : text3}
 `);
   return 0;
 }
@@ -6613,7 +6950,10 @@ async function runBuiltin(name, parsed, deps) {
         "run `asteroid complete <shell>` to print a completion script"
       );
     case "use":
-      return use(deps, parsed.positionals[0]);
+      return use(deps, parsed.positionals[0], {
+        reason: parsed.flags.get("reason")?.[0],
+        exit: parsed.flags.has("exit")
+      });
     default:
       return whoami(deps, parsed.org, parsed.json);
   }
@@ -6642,7 +6982,8 @@ async function authFor(parsed, deps) {
 function announce(command, auth, deps) {
   if (command.readOnly) return;
   const org = auth.kind === "api-key" ? "the API key's organization" : auth.org ? orgLabel(auth.org) : "your default organization";
-  deps.stderr(`Acting in ${org}.
+  const staff = auth.staff ? ` with staff access (${clean(auth.staff.reason)})` : "";
+  deps.stderr(`Acting in ${org}${staff}.
 `);
 }
 async function runCommand(command, parsed, deps) {
@@ -6710,7 +7051,9 @@ async function run(argv2, deps) {
       commands: ALL_COMMANDS,
       builtins: BUILTINS,
       version: VERSION,
-      description: DESCRIPTION
+      description: DESCRIPTION,
+      defaultArg: (command, arg) => command.files === "push" && arg.name === "workflowId" ? "" : void 0,
+      defaultArgNote: "<workflow-id> defaults to the workflow the pushed folder was pulled from."
     });
     if (invocation.kind === "exit") {
       if (invocation.stdout) deps.stdout(invocation.stdout);
@@ -6720,7 +7063,7 @@ async function run(argv2, deps) {
     if (invocation.kind === "builtin") {
       return await runBuiltin(invocation.name, invocation.parsed, deps);
     }
-    if (invocation.command.local) {
+    if (runsLocally(invocation.command, invocation.parsed)) {
       const auth = await authFor(invocation.parsed, deps);
       announce(invocation.command, auth, deps);
       return await runSync(invocation.command, invocation.parsed, {
@@ -6756,6 +7099,10 @@ var clackUi = {
     const value2 = await clack.select({ message, options: choices });
     return clack.isCancel(value2) ? void 0 : value2;
   },
+  async text(message) {
+    const value2 = await clack.text({ message });
+    return clack.isCancel(value2) ? void 0 : value2;
+  },
   async wait(message, done, work) {
     const spinner2 = clack.spinner();
     spinner2.start(message);
@@ -6790,8 +7137,8 @@ var code = await run(argv, {
   env: readEnv(),
   cwd: process.cwd(),
   fetch,
-  stdout: (text2) => process.stdout.write(text2),
-  stderr: (text2) => process.stderr.write(text2),
+  stdout: (text3) => process.stdout.write(text3),
+  stderr: (text3) => process.stderr.write(text3),
   writeBytes: (bytes) => process.stdout.write(bytes),
   ui: process.stdin.isTTY && process.stderr.isTTY ? clackUi : void 0,
   stdoutIsTTY: process.stdout.isTTY === true,