@catalyst-cloud/cli 0.13.1 → 0.14.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.14.1
+
+Legacy cleanup keeps all shared Catalyst config and data folders, including with the historical --data flag. It no longer removes ~/.catalyst/bin wholesale or recursively deletes directories. The onboarding skill keeps data and no longer offers data deletion.
+
+## 0.14.0
+
+The `catalyst onboard` command starts a resumable setup journal, migrates the installer receipt, and safely coordinates with the install script through an owner-token lock. It supports JSON plans, dry runs, step selection and resume validation. The first executable slice checks legacy local runtime files while preserving user data; provider and project steps remain staged for later releases.
+
 ## 0.13.1
 
 The Cloud pack now has eight skills. catalyst-onboard includes connection and setup, and whats-happening includes the guide to how Catalyst works. The guides use the catalyst command and call a tenant your cloud account. They explain asks, holds and the 48-hour fallback from the running code. Install and refresh remove retired Cloud-pack skills that carry the pack's provenance.

package/README.md

@@ -159,13 +159,13 @@ The replica is a Node process, not a service: the supported path is the plain co
 | `catalyst-linear` | "Show me the ticket, the history, what Catalyst wrote on it." | Reads a ticket with its comments, relations, labels, linked pull requests and agent sessions inline, from the replica when fresh and the API otherwise, always naming the source; writes comments, card moves, labels and new tickets as the app actor; knows what a ticket accumulates as Catalyst works it. | [`SKILL.md`](skills/catalyst-linear/SKILL.md) |
 | `catalyst-github` | "Show me the PR, the checks, the review, the queue." | A ticket's pull request with its checks, reviews and review threads; whether it is mergeable under the repository's policy; what a PR accumulates as the ticket moves (the branch, the draft, the rewrite, the force-pushes, the labels, the queue). | [`SKILL.md`](skills/catalyst-github/SKILL.md) |
 | `unstick` | "Why is this parked? Unpark it. Get things flowing again." | Reads why a ticket is not running and every park or hold on it, decides whether the recorded cause is fixed, previews the release and releases it the right way from your own login — or one failure class across a team — and raises an ask only for what a person has to do. | [`SKILL.md`](skills/unstick/SKILL.md) |
-| `what-this-repo-needs` | "What env vars does this repo need? What does catalyst.env.json mean?" | Scans a repository offline — no login, no network — and lists the environment variable names it needs, grouped build/test, deploy-only and bindings, each with where it was found, what uses it, and where a local value would come from. Never reads or prints a value. Also validates a `catalyst.env.json` file with the same rules the cloud applies. | [`SKILL.md`](skills/what-this-repo-needs/SKILL.md) |
+| `what-this-repo-needs` | "What env vars does this repo need? What belongs in its environment declaration?" | Scans a repository offline — no login, no network — and lists the environment variable names it needs, grouped build/test, deploy-only and bindings, each with where it was found, what uses it, and where a local value would come from. Never reads or prints a value. Also checks TOML syntax and the environment variable table in `.catalyst/catalyst.toml`. | [`SKILL.md`](skills/what-this-repo-needs/SKILL.md) |
 
 Some of these only read, and some write: a comment, a card move, an ask, a release. Your agent may pick any of them from what you ask. Picking a skill is not permission to write: each write goes through your own login, spends the daily write budget your account sets, and is recorded against your name, and the skills preview first where the product offers a preview (a release's dry run, a stage mapping's plan). Each skill's `agents/portability.yaml` says whether it writes. Every skill declares `allowed-tools` scoped to this package's own binary, so none of them needs a blanket shell grant.
 
 ## What a key cannot see yet
 
-Your personal key reads everything the skills need — tickets, pull requests, the eligibility explainer, the dispatch queue, fleet activity, per-ticket execution history (`catalyst explain --history <ticket>`: phase attempts, remediation rounds, park state) and coding-account status (`catalyst accounts`: provider, declared and observed state, window usage, walls, quarantine — never a credential; enrolling or pausing one is `<your cloud>/settings/coding-accounts`). It also releases a parked or held ticket once its cause is fixed: `catalyst release <ticket> --because <what changed>` (the `unstick` skill runs it), recorded against your name and shown in the ticket's history. And it declares what your containers need: `catalyst environment` reads the account-wide declaration, `environment propose --file <path> --approve` proposes and approves it in one compare-and-set, and the values behind the names stay in the cloud — reading needs any active seat, proposing and approving need an admin or owner one. An admin or owner can put a repository's values in from the terminal. `catalyst secret import .env --repo owner/name` stores every name in the file and lists the declared names that still have no value. `catalyst secret set NAME --repo owner/name --command 'op read op://Vault/item/field'` runs the command on your machine and stores its output; with no `--command` it reads the value from stdin, or asks for it without echoing. No value is ever printed, and the cloud's audit records the command, not its output. That is the account's own declaration — a repository's own `.catalyst/catalyst.toml`, which `catalyst-onboard` already reports on, is a separate thing. `catalyst env inventory` lists the environment variable names a repository needs — never a value — and `env check` validates a `catalyst.env.json` file offline; neither needs a login (the `what-this-repo-needs` skill walks through both). Two things it cannot do, and the skills say so by name rather than guess:
+Your personal key reads everything the skills need — tickets, pull requests, the eligibility explainer, the dispatch queue, fleet activity, per-ticket execution history (`catalyst explain --history <ticket>`: phase attempts, remediation rounds, park state) and coding-account status (`catalyst accounts`: provider, declared and observed state, window usage, walls, quarantine — never a credential; enrolling or pausing one is `<your cloud>/settings/coding-accounts`). It also releases a parked or held ticket once its cause is fixed: `catalyst release <ticket> --because <what changed>` (the `unstick` skill runs it), recorded against your name and shown in the ticket's history. And it declares what your containers need: `catalyst environment` reads the account-wide declaration, `environment propose --file <path> --approve` proposes and approves it in one compare-and-set, and the values behind the names stay in the cloud — reading needs any active seat, proposing and approving need an admin or owner one. An admin or owner can put a repository's values in from the terminal. `catalyst secret import .env --repo owner/name` stores every name in the file and lists the declared names that still have no value. `catalyst secret set NAME --repo owner/name --command 'op read op://Vault/item/field'` runs the command on your machine and stores its output; with no `--command` it reads the value from stdin, or asks for it without echoing. No value is ever printed, and the cloud's audit records the command, not its output. That is the account's own declaration — a repository's own `.catalyst/catalyst.toml`, which `catalyst-onboard` already reports on, is a separate thing. `catalyst env inventory` lists the environment variable names a repository needs — never a value; `env check` checks the TOML syntax and environment variable table in `.catalyst/catalyst.toml` offline; `env migrate [catalyst.env.json]` prints a TOML environment table from a legacy declaration, with all names optional and values omitted. These commands need no login (the `what-this-repo-needs` skill walks through them). Two things it cannot do, and the skills say so by name rather than guess:
 
 - Read pull-request labels or the reviewer's reaction. The mirror does not carry them; GitHub's own page does.
 - Compute a flow number — cycle time, throughput, or how long pull requests have been open. Nothing serves those yet, so say they are not computed rather than counting something else and calling it that.

package/dist/args.js

@@ -4,23 +4,48 @@
 import { UsageError } from "./errors.js";
 const GLOBAL_FLAGS = {
     key: { value: true, help: "your personal key (or CATALYST_CLOUD_TOKEN)" },
-    "base-url": { value: true, help: "Catalyst Cloud origin (or CATALYST_CLOUD_BASE_URL)" },
-    "skills-dir": { value: true, help: "where the skills are copied (default ~/.claude/skills)" },
-    force: { value: false, help: "replace a skill directory this package did not install" },
+    "base-url": {
+        value: true,
+        help: "Catalyst Cloud origin (or CATALYST_CLOUD_BASE_URL)",
+    },
+    "skills-dir": {
+        value: true,
+        help: "where the skills are copied (default ~/.claude/skills)",
+    },
+    force: {
+        value: false,
+        help: "replace a skill directory this package did not install",
+    },
     json: { value: false, help: "machine-readable output" },
 };
 /** Per-verb flag tables. A verb absent here accepts only the global flags. */
 export const FLAG_TABLES = {
     login: {
-        "start-replica": { value: false, help: "run `replica start --detach` after connecting" },
+        "start-replica": {
+            value: false,
+            help: "run `replica start --detach` after connecting",
+        },
     },
     mcp: {
         url: { value: true, help: "add: the upstream HTTPS endpoint" },
         auth: { value: true, help: "add: none for an unauthenticated upstream" },
-        bearer: { value: true, help: "add: vault secret NAME for a bearer token, never its value" },
-        header: { value: true, repeat: true, help: "add: HEADER_NAME=VAULT_SECRET_NAME (repeatable)" },
+        bearer: {
+            value: true,
+            help: "add: vault secret NAME for a bearer token, never its value",
+        },
+        header: {
+            value: true,
+            repeat: true,
+            help: "add: HEADER_NAME=VAULT_SECRET_NAME (repeatable)",
+        },
     },
     install: {},
+    onboard: {
+        "resume-from": { value: true, help: "resume at a verified onboarding step" },
+        only: { value: true, help: "run only the named onboarding step" },
+        yes: { value: false, help: "accept the plan's default choices" },
+        "dry-run": { value: false, help: "print the plan without taking the lock or changing files" },
+    },
     status: {},
     notice: {},
     me: {},
@@ -32,63 +57,148 @@ export const FLAG_TABLES = {
         team: { value: true, help: "team key filter" },
         project: { value: true, help: "project id filter" },
         state: { value: true, help: "state name filter" },
-        limit: { value: true, help: "max rows (default 50); one page only unless --all" },
+        limit: {
+            value: true,
+            help: "max rows (default 50); one page only unless --all",
+        },
         since: { value: true, help: "changes: the cursor to read after" },
-        source: { value: true, help: "replica | api (default: replica when fresh, else api)" },
+        source: {
+            value: true,
+            help: "replica | api (default: replica when fresh, else api)",
+        },
         ticket: { value: true, help: "pulls: only PRs linked to this ticket" },
-        all: { value: false, help: "issues/pulls: follow the cloud's page cursor to the end of the scope" },
+        all: {
+            value: false,
+            help: "issues/pulls: follow the cloud's page cursor to the end of the scope",
+        },
     },
     replica: {
-        detach: { value: false, help: "start: run the writer in the background and write a pidfile" },
+        detach: {
+            value: false,
+            help: "start: run the writer in the background and write a pidfile",
+        },
         db: { value: true, help: "replica file path (default from customer.json)" },
-        probe: { value: false, help: "status: also fetch the cloud head and print the lag" },
-        "stale-ms": { value: true, help: "status: heartbeat age that counts as stale (default 15000)" },
+        probe: {
+            value: false,
+            help: "status: also fetch the cloud head and print the lag",
+        },
+        "stale-ms": {
+            value: true,
+            help: "status: heartbeat age that counts as stale (default 15000)",
+        },
     },
     events: {
-        probe: { value: false, help: "status: compare the local event cursor with the cloud event head" },
+        probe: {
+            value: false,
+            help: "status: compare the local event cursor with the cloud event head",
+        },
         type: { value: true, help: "exact event type" },
-        ticket: { value: true, help: "ticket identifier found in the event payload" },
-        after: { value: true, help: "event sequence to read after (tail/wait default to local head)" },
+        ticket: {
+            value: true,
+            help: "ticket identifier found in the event payload",
+        },
+        after: {
+            value: true,
+            help: "event sequence to read after (tail/wait default to local head)",
+        },
         limit: { value: true, help: "query: maximum matching events (default 50)" },
-        timeout: { value: true, help: "wait-for: bounded wait in seconds (default 300)" },
-        directory: { value: true, help: "event cache directory (default: SDK XDG path)" },
+        timeout: {
+            value: true,
+            help: "wait-for: bounded wait in seconds (default 300)",
+        },
+        directory: {
+            value: true,
+            help: "event cache directory (default: SDK XDG path)",
+        },
     },
     explain: {
-        history: { value: false, help: "per-ticket execution history instead of the eligibility reason" },
+        history: {
+            value: false,
+            help: "per-ticket execution history instead of the eligibility reason",
+        },
     },
     history: {},
     running: {
-        ticket: { value: true, help: "with --phase: also the lease attributions for this (ticket, phase)" },
-        phase: { value: true, help: "with --ticket: the phase whose lease attributions to read" },
+        ticket: {
+            value: true,
+            help: "with --phase: also the lease attributions for this (ticket, phase)",
+        },
+        phase: {
+            value: true,
+            help: "with --ticket: the phase whose lease attributions to read",
+        },
     },
     queue: {
-        team: { value: true, help: "team key (default: every team the tenant contract names)" },
+        team: {
+            value: true,
+            help: "team key (default: every team the tenant contract names)",
+        },
     },
     watch: {
         team: { value: true, help: "scope: a team key" },
-        ticket: { value: true, repeat: true, help: "scope: a ticket identifier (repeatable)" },
+        ticket: {
+            value: true,
+            repeat: true,
+            help: "scope: a ticket identifier (repeatable)",
+        },
         project: { value: true, help: "scope: a project id" },
-        exec: { value: true, help: "run this shell command per frame with the frame on stdin" },
-        "cursor-file": { value: true, help: "cursor file path (default ~/.config/catalyst-cloud/watch-cursor.json)" },
+        exec: {
+            value: true,
+            help: "run this shell command per frame with the frame on stdin",
+        },
+        "cursor-file": {
+            value: true,
+            help: "cursor file path (default ~/.config/catalyst-cloud/watch-cursor.json)",
+        },
         from: { value: true, help: "cursor | head (default cursor)" },
     },
     write: {
         body: { value: true, help: "comment: the body text" },
-        stdin: { value: false, help: "comment: read the body from stdin; create: read the description from stdin" },
+        stdin: {
+            value: false,
+            help: "comment: read the body from stdin; create: read the description from stdin",
+        },
         parent: { value: true, help: "comment: reply under this comment id" },
-        bookkeeping: { value: false, help: "comment: prefix the contract's bookkeeping marker" },
-        "as-user": { value: false, help: "post with the personal identity instead of the app actor" },
+        bookkeeping: {
+            value: false,
+            help: "comment: prefix the contract's bookkeeping marker",
+        },
+        "as-user": {
+            value: false,
+            help: "post with the personal identity instead of the app actor",
+        },
         slot: { value: true, help: "state: the workflow slot to move to" },
         "state-id": { value: true, help: "state: an explicit Linear state id" },
-        "state-type": { value: true, help: "state: the first state of this type on the ticket's team (e.g. backlog)" },
-        add: { value: true, repeat: true, help: "label: label name or id to add (repeatable)" },
-        remove: { value: true, repeat: true, help: "label: label name or id to remove (repeatable)" },
+        "state-type": {
+            value: true,
+            help: "state: the first state of this type on the ticket's team (e.g. backlog)",
+        },
+        add: {
+            value: true,
+            repeat: true,
+            help: "label: label name or id to add (repeatable)",
+        },
+        remove: {
+            value: true,
+            repeat: true,
+            help: "label: label name or id to remove (repeatable)",
+        },
         team: { value: true, help: "create: team key" },
         title: { value: true, help: "create/attachment/session: title" },
-        description: { value: true, help: "create: the ticket description (markdown)" },
-        label: { value: true, repeat: true, help: "create: label name or id (repeatable)" },
+        description: {
+            value: true,
+            help: "create: the ticket description (markdown)",
+        },
+        label: {
+            value: true,
+            repeat: true,
+            help: "create: label name or id (repeatable)",
+        },
         priority: { value: true, help: "create: Linear priority 0-4" },
-        comment: { value: true, help: "reaction: react to this comment id instead of the ticket" },
+        comment: {
+            value: true,
+            help: "reaction: react to this comment id instead of the ticket",
+        },
         emoji: { value: true, help: "reaction: the emoji" },
         url: { value: true, help: "attachment/session: the URL" },
         "plan-file": { value: true, help: "session: a JSON file holding the plan" },
@@ -98,78 +208,187 @@ export const FLAG_TABLES = {
         team: { value: true, help: "raise: team key" },
         title: { value: true, help: "raise: the question" },
         context: { value: true, help: "raise: context paragraph" },
-        option: { value: true, repeat: true, help: "raise: an option (repeatable)" },
+        option: {
+            value: true,
+            repeat: true,
+            help: "raise: an option (repeatable)",
+        },
         default: { value: true, help: "raise: the default if silent" },
-        blocks: { value: true, repeat: true, help: "raise: a ticket this decision blocks (repeatable)" },
-        "nothing-to-block": { value: false, help: "raise: declare that nothing is blocked" },
-        anyone: { value: false, help: "list: every open ask in the tenant, not only the ones assigned to you" },
+        blocks: {
+            value: true,
+            repeat: true,
+            help: "raise: a ticket this decision blocks (repeatable)",
+        },
+        "nothing-to-block": {
+            value: false,
+            help: "raise: declare that nothing is blocked",
+        },
+        anyone: {
+            value: false,
+            help: "list: every open ask in the tenant, not only the ones assigned to you",
+        },
         "ask-key": { value: true, help: "raise: idempotency key" },
         answer: { value: true, help: "accept: the answering comment id" },
         role: { value: true, help: "accept: the role recording the answer" },
     },
     ready: {
-        offline: { value: false, help: "skip the published-release check (no network)" },
+        offline: {
+            value: false,
+            help: "skip the published-release check (no network)",
+        },
     },
     accounts: {},
-    env: {},
+    env: {
+        root: { value: true, help: "draft: repository directory (default: current directory)" },
+        write: { value: false, help: "draft: write a new .catalyst/catalyst.toml; refuse to overwrite" },
+        diff: { value: false, help: "draft: show the generated TOML as an additions-only diff" },
+    },
+    var: {
+        repo: { value: true, help: "repository scope (owner/name); omit for tenant scope" },
+        names: { value: true, repeat: true, help: "import: only send these names (repeatable or comma-separated)" },
+    },
     team: {
         all: { value: false, help: "check every team, one request at a time" },
-        stage: { value: true, repeat: true, help: "map a role to a live Linear state name (role=StateName)" },
-        choice: { value: true, repeat: true, help: "migrate a source state to a destination (sourceId=destinationId)" },
-        yes: { value: false, help: "apply the plan you have reviewed with the person" },
-        "plan-hash": { value: true, help: "apply only the exact preview hash the person reviewed" },
-        undo: { value: false, help: "adopt: preview or archive stages a prior adoption created" },
-        retire: { value: false, help: "migrate: separately preview or retire emptied source stages" },
+        stage: {
+            value: true,
+            repeat: true,
+            help: "map a role to a live Linear state name (role=StateName)",
+        },
+        choice: {
+            value: true,
+            repeat: true,
+            help: "migrate a source state to a destination (sourceId=destinationId)",
+        },
+        yes: {
+            value: false,
+            help: "apply the plan you have reviewed with the person",
+        },
+        "plan-hash": {
+            value: true,
+            help: "apply only the exact preview hash the person reviewed",
+        },
+        undo: {
+            value: false,
+            help: "adopt: preview or archive stages a prior adoption created",
+        },
+        retire: {
+            value: false,
+            help: "migrate: separately preview or retire emptied source stages",
+        },
     },
     environment: {
         file: { value: true, help: "propose: a JSON file holding the declaration" },
         stdin: { value: false, help: "propose: read the declaration from stdin" },
-        "expect-revision": { value: true, help: "propose: refuse unless the stored declaration is still at this revision" },
-        approve: { value: false, help: "propose: approve exactly the revision the propose returned" },
-        revision: { value: true, help: "approve: the revision to approve (with --hash; default is whatever read returns)" },
-        hash: { value: true, help: "approve: the canonical hash to approve (with --revision)" },
+        "expect-revision": {
+            value: true,
+            help: "propose: refuse unless the stored declaration is still at this revision",
+        },
+        approve: {
+            value: false,
+            help: "propose: approve exactly the revision the propose returned",
+        },
+        revision: {
+            value: true,
+            help: "approve: the revision to approve (with --hash; default is whatever read returns)",
+        },
+        hash: {
+            value: true,
+            help: "approve: the canonical hash to approve (with --revision)",
+        },
     },
     secret: {
         repo: { value: true, help: "the repository, as owner/name (required)" },
-        command: { value: true, help: "set: run this command on this machine and store its output (e.g. 'op read op://Vault/item/field'); the command text is audited, so never put a value in it" },
-        rotate: { value: true, repeat: true, help: "import: replace this name if it is already set (repeatable)" },
+        command: {
+            value: true,
+            help: "set: run this command on this machine and store its output (e.g. 'op read op://Vault/item/field'); the command text is audited, so never put a value in it",
+        },
+        rotate: {
+            value: true,
+            repeat: true,
+            help: "import: replace this name if it is already set (repeatable)",
+        },
+        names: {
+            value: true,
+            repeat: true,
+            help: "import: only send these names from the local file (repeatable or comma-separated)",
+        },
     },
     identity: {},
     capabilities: {},
     project: {
-        team: { value: true, help: "the project's team key (default: the only mapped project)" },
+        team: {
+            value: true,
+            help: "the project's team key (default: the only mapped project)",
+        },
     },
     legacy: {
-        remove: { value: false, help: "remove what was found, after one question (or --yes)" },
-        data: { value: false, help: "with --remove: delete the old runtime's data folders too" },
-        yes: { value: false, help: "with --remove: answer the question yes (a run with no terminal only reports otherwise)" },
+        remove: {
+            value: false,
+            help: "remove what was found, after one question (or --yes)",
+        },
+        data: {
+            value: false,
+            help: "historical flag; shared data folders are always kept",
+        },
+        yes: {
+            value: false,
+            help: "with --remove: answer the question yes (a run with no terminal only reports otherwise)",
+        },
     },
     repo: {
-        write: { value: false, help: "agents-block: write or update the block in AGENTS.md (working tree only)" },
-        apply: { value: false, help: "agent-setup: perform the portable-layout plan in the working tree" },
-        "with-check": { value: false, help: "agent-setup: also write scripts/agents-md-check.mjs, a CI check for the layout" },
+        write: {
+            value: false,
+            help: "agents-block: write or update the block in AGENTS.md (working tree only)",
+        },
+        apply: {
+            value: false,
+            help: "agent-setup: perform the portable-layout plan in the working tree",
+        },
+        "with-check": {
+            value: false,
+            help: "agent-setup: also write scripts/agents-md-check.mjs, a CI check for the layout",
+        },
     },
     connections: {
-        wait: { value: true, help: "start: wait up to this many seconds for browser approval (0-600)" },
+        wait: {
+            value: true,
+            help: "start: wait up to this many seconds for browser approval (0-600)",
+        },
     },
     release: {
-        because: { value: true, help: "what changed since the ticket was held (required unless --dry-run)" },
-        "retry-unchanged": { value: false, help: "release even though nothing the mirror can see changed (say what did in --because)" },
-        "dry-run": { value: false, help: "show what a release would clear and refuse, and change nothing" },
-        class: { value: true, help: "release every ticket on --team parked under this failure class" },
+        because: {
+            value: true,
+            help: "what changed since the ticket was held (required unless --dry-run)",
+        },
+        "retry-unchanged": {
+            value: false,
+            help: "release even though nothing the mirror can see changed (say what did in --because)",
+        },
+        "dry-run": {
+            value: false,
+            help: "show what a release would clear and refuse, and change nothing",
+        },
+        class: {
+            value: true,
+            help: "release every ticket on --team parked under this failure class",
+        },
         team: { value: true, help: "with --class: the team key" },
-        limit: { value: true, help: "with --class: at most this many tickets (the cloud caps it at 25)" },
+        limit: {
+            value: true,
+            help: "with --class: at most this many tickets (the cloud caps it at 25)",
+        },
     },
 };
 export const VERB_USAGE = {
     login: "login [--base-url <url>] [--start-replica]   (keyless; or --key <personal-key> / CATALYST_CLOUD_TOKEN)",
+    onboard: "onboard [--resume-from <step>] [--only <step>] [--yes] [--dry-run] [--json]",
     install: "install [--skills-dir <dir>] [--force]",
     status: "status",
     notice: "notice",
     me: "me [--json]",
     contract: "contract [--refresh] [--path <a.b.c>] [--json]",
     query: "query <issues|issue <id>|pulls|pull <id>|projects|cycles|search <terms>|changes --since <cursor|head>> [--team K] [--project P] [--state S] [--limit N] [--all] [--source replica|api] [--json]",
-    replica: "replica <start [--detach]|stop|status [--probe] [--json]|sql \"<select>\"|schema [table]> [--db <path>]",
+    replica: 'replica <start [--detach]|stop|status [--probe] [--json]|sql "<select>"|schema [table]> [--db <path>]',
     runtime: "runtime <status [--json]|install|path|uninstall>",
     events: "events <tail|wait-for|query|status [--probe] [--json]> [--type NAME] [--ticket CTC-N] [--after SEQUENCE] [--limit N] [--timeout SECONDS] [--directory PATH]",
     explain: "explain <ticket> [--history] [--json]",
@@ -183,12 +402,13 @@ export const VERB_USAGE = {
     accounts: "accounts [--json]",
     mcp: "mcp <add <name> --url URL <--auth none|--bearer SECRET_NAME|--header NAME=SECRET_NAME...>|list|remove <name>> [--json]",
     team: "team <list|check <KEY>|check --all|map <KEY> [--stage role=StateName]... [--yes --plan-hash H]|adopt <KEY> [--undo] [--yes --plan-hash H]|migrate <KEY> [--choice sourceId=destinationId]... [--retire] [--yes --plan-hash H]|checklist <KEY>> [--json]",
-    env: "env <inventory [path] | check <file>> [--json]   (THIS repository, offline — no login, no network)",
+    env: "env <inventory [path] | check <file> | migrate [catalyst.env.json] | draft [--root DIR] [--diff] [--write]> [--json]   (THIS repository, offline — no login, no network)",
     environment: "environment [read] [--json] | environment propose --file <path>|--stdin [--expect-revision N] [--approve] [--json] | environment approve [--revision N --hash H] [--json]   (your ACCOUNT's declaration; needs login)",
-    secret: "secret set <NAME> --repo <owner/name> [--command '<cmd>'] [--json]   (value from --command, stdin, or a hidden prompt) | secret import <file> --repo <owner/name> [--rotate NAME]... [--json]",
+    secret: "secret set <NAME> --repo <owner/name> [--command '<cmd>'] [--json]   (value from --command, stdin, or a hidden prompt) | secret import <file> --repo <owner/name> [--names NAME[,NAME...]] [--rotate NAME]... [--json]",
+    var: "var <set NAME|import <file>> [--repo <owner/name>] [--names NAME[,NAME...]] [--json]   (plain environment variables; set reads stdin or a hidden prompt)",
     identity: "identity linear <status|options|set> [<linearUserId>] [--json]",
     capabilities: "capabilities [--json]",
-    project: "project wip-limit <get|set <n>|set default> [--team K] [--json]",
+    project: "project <list [--json] | wip-limit <get|set <n>|set default> [--team K] [--json]>",
     repo: "repo <agents-block <path> [--write]|agent-setup <path> [--apply] [--with-check]> [--json]",
     legacy: "legacy [--remove [--data] [--yes]] [--json]",
     connections: "connections personal <linear|github> <start|status> [--wait <seconds>] [--json]",
@@ -233,7 +453,9 @@ export function parseArgs(argv) {
             }
             const spec = table[name];
             if (!spec) {
-                throw new UsageError(out.command ? `unknown option for ${out.command}: --${name}` : `unknown option: --${name}`);
+                throw new UsageError(out.command
+                    ? `unknown option for ${out.command}: --${name}`
+                    : `unknown option: --${name}`);
             }
             if (spec.value) {
                 const v = inlineValue ?? requireValue(argv, ++i, `--${name}`);

package/dist/capabilities.js

@@ -5,6 +5,7 @@ const agent = (method, name) => ({ method, path: `/api/v1/agent/${name}` });
  *  the person, the workspace, the project, the repository, then work. A new verb is a new row here
  *  in the same change, or `catalyst capabilities` lies to every guide that reads it. */
 export const CAPABILITIES = [
+    { verb: "onboard", does: "run and resume Catalyst setup with a saved step record", needs: "member", routes: [], since: "0.14.0", bootstrapHandoff: true },
     { verb: "status", does: "say whether this machine is connected, as whom, and to which cloud", needs: "member", routes: [], since: "0.1.0" },
     { verb: "me", does: "read the person's seat, role and Linear identity", needs: "member", routes: [], since: "0.1.0" },
     { verb: "ready", does: "read the machine and the workspace's per-project readiness in one verdict", needs: "member", routes: [], since: "0.1.0" },
@@ -28,6 +29,7 @@ export const CAPABILITIES = [
     { verb: "environment propose", does: "propose the workspace-wide environment declaration (names only)", needs: "admin", routes: [agent("POST", "account-environment/propose")], since: "0.8.0" },
     { verb: "environment approve", does: "approve the workspace-wide environment declaration", needs: "admin", routes: [agent("POST", "account-environment/approve")], since: "0.8.0" },
     { verb: "secret set|import", does: "enter a repository secret's value from this terminal, never echoed", needs: "admin", routes: [], since: "0.8.0" },
+    { verb: "var set|import", does: "enter plain environment variable values from this terminal, never echoed", needs: "admin", routes: [], since: "0.13.2" },
     { verb: "accounts", does: "read the workspace's coding accounts and which can take work", needs: "member", routes: [], since: "0.5.0" },
     { verb: "explain|running|queue|history", does: "read why a ticket runs or waits, what runs now, and what is queued", needs: "member", routes: [], since: "0.1.0" },
     { verb: "write comment|state|label|create|reaction|attachment|session", does: "act on a ticket as the person, through the agent proxy", needs: "member", routes: [agent("POST", "issue-comment"), agent("POST", "issue-state"), agent("POST", "issue-label"), agent("POST", "issue-create")], since: "0.1.0" },