@catalyst-cloud/cli 0.9.3 → 0.9.5

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.9.5
+
+The CLI calls itself `catalyst` everywhere: usage lines, every verb's `--help`, hints, remedies and errors. `catalyst-skills` still works as a deprecated alias. The npx form is `npx -p @catalyst-cloud/cli catalyst …`, because bare `npx @catalyst-cloud/cli` cannot pick a binary. A replica read on the `node:sqlite` fallback no longer prints a notice every time; `CATALYST_DEBUG=1` still shows it.
+
+`catalyst team` sets up a Linear team as a Catalyst project from the terminal: `list`, `check`, `map`, `adopt`, `migrate` and `checklist`. Writes need a reviewed plan and the cloud's mapping, adoption or migration hash.
+
+`catalyst capabilities` lists what this CLI can do, the role each verb needs (member or admin), and whether this cloud serves the route. It reads only the cached contract, so it never touches the network.
+
+`/catalyst-onboard` runs `team check` and `team map` itself for an admin, where it used to send you to a page. It tells a member which role can run a step. With an older CLI or cloud it keeps the page, as before. A project whose readiness reads blocked is no longer counted as set up: the guide names the blocking checks and who fixes each.
+
+The how-catalyst-works and whats-happening skills explain the WIP limit as the code applies it. The limit is per Catalyst project (the project's setting, else the tenant-wide value, else 12; 0 holds every new start). It holds only new starts, and a ticket already in progress keeps getting phases. `catalyst explain` prints the `wip_limit` reason in words.
+
+## 0.9.4
+
+`/catalyst-onboard` walks a new member through setup one step at a time, in the order a person can act on it: coding account, Linear integration, project, GitHub App and repository, connected accounts, the repository's `.catalyst/catalyst.toml` declaration, then the host, ending with one ticket moving. Each turn asks one question, says why in a line, and checks the result after. A new reference covers choosing a coding account (a Claude setup token, a Codex `auth.json`, or a GLM or Qwen API key), and it says plainly that a plain Anthropic or OpenAI API key cannot be enrolled today. Accounts are named by their label. The skills use the product's own nouns (workspace, project, repository, integration, connected account).
+
+An ended or cancelled coding account is kept for reporting and not used. Onboarding no longer tells you to retire or delete it, and never to put another login's credential on it; reactivate it only if its subscription is live again. `catalyst accounts` marks it "subscription canceled — kept for reporting, not used".
+
+The onboarding step engine never names a next step it cannot back with a check, and it says when a newer CLI is announced but not yet published.
+
 ## 0.9.3
 
 A machine the Catalyst installer moved from `@catalyst-cloud/catalyst-skills` to `@catalyst-cloud/cli` works without logging in again. The recorded launcher pointed into the removed package, so `ready` failed its CLI-path check and skill scripts could not start the CLI; any command now repoints it at the launcher that is running. The CLI also leaves the installer's skills alone: it never writes through a symlinked skill folder, and when the installer owns skill placement it does not refresh skills at all. When a refresh does fail, it tells you to re-run the install command.

package/README.md

@@ -1,4 +1,4 @@
-# @catalyst-cloud/catalyst-skills
+# @catalyst-cloud/cli
 
 [![skills.sh](https://skills.sh/b/coalesce-labs/catalyst-cloud-skills)](https://skills.sh/coalesce-labs/catalyst-cloud-skills)
 
@@ -69,17 +69,17 @@ Without `--all` the installer asks which skills to take and which agents to inst
 The skills call one CLI, and the CLI holds your credential. Install it once and connect this machine — the keyless way logs you in as yourself, with nothing to mint or paste:
 
 ```sh
-npm install -g @catalyst-cloud/catalyst-skills
-catalyst-skills login
-catalyst-skills ready
+npm install -g @catalyst-cloud/cli
+catalyst login
+catalyst ready
 ```
 
-`catalyst-skills login` with no key opens a device-code login: it prints a short code and a URL, you approve it in your browser, and this machine is connected as you. On a machine with no browser (a remote box, a container) the code and URL still work — approve them from your phone. The short-lived session refreshes silently afterwards, so you log in about once a year. `npx @catalyst-cloud/catalyst-skills login` works without the global install, and `bunx` works in place of `npx`. A non-default cloud is set with `CATALYST_CLOUD_BASE_URL` or `--base-url <url>`.
+`catalyst login` with no key opens a device-code login: it prints a short code and a URL, you approve it in your browser, and this machine is connected as you. On a machine with no browser (a remote box, a container) the code and URL still work — approve them from your phone. The short-lived session refreshes silently afterwards, so you log in about once a year. `npx -p @catalyst-cloud/cli catalyst login` works without the global install, and `bunx` works in place of `npx`. A non-default cloud is set with `CATALYST_CLOUD_BASE_URL` or `--base-url <url>`.
 
 Prefer a key? Pass one instead — mint a **personal key** at Settings → API keys in the Catalyst Cloud app (every member can; no admin needed). The environment form keeps it out of your shell history:
 
 ```sh
-CATALYST_CLOUD_TOKEN=<your-personal-key> catalyst-skills login
+CATALYST_CLOUD_TOKEN=<your-personal-key> catalyst login
 ```
 
 `--key <your-personal-key>` is the third form, for a script.
@@ -87,20 +87,22 @@ CATALYST_CLOUD_TOKEN=<your-personal-key> catalyst-skills login
 After a tenant owner connects the tenant's Linear workspace, connect your personal Linear account. Connect your personal GitHub account only after the tenant's GitHub App is installed and its repository is registered. These personal grants are separate from the tenant's Linear connection and GitHub App installation. Your agent can start each connection and check whether it landed, but you approve each one in your browser:
 
 ```sh
-catalyst-skills connections personal linear start
-catalyst-skills connections personal linear status
+catalyst connections personal linear start
+catalyst connections personal linear status
 # First install the tenant's GitHub App and register its repository in Settings.
-catalyst-skills connections personal github start
-catalyst-skills connections personal github status
+catalyst connections personal github start
+catalyst connections personal github status
 ```
 
 Each `start` prints a short-lived URL and attempts to open your browser. On a remote machine, open the printed URL on your own device. `status --json` gives the same result to an agent; `start --wait 60` waits up to one minute for approval. A connected result is the proof that the grant landed. If a provider reports unavailable, retry status later rather than starting a second approval.
 
 The `catalyst-onboard` skill checks both grants before taking you through the rest of tenant setup and the first ticket.
 
+The command is `catalyst`. `catalyst-skills` still works as a deprecated alias, and `@catalyst-cloud/catalyst-skills` is the deprecated package name that forwards to this one.
+
 ## What this is
 
-A set of skills that let your coding agent run your own Catalyst Cloud tenant (https://staging.catalystcloud.dev) from your seat: what is happening, what needs you, and what to do about it. They read your tenant through the Catalyst Cloud SDK, write to it through the tenant's agent proxy, and never compose a URL or run a tool of their own; every read, write and subscription is a `catalyst-skills` verb with `--help`. Every skill is plain Markdown under `skills/<name>/SKILL.md` in this repository, and your own login — a keyless device-code session, or a personal key — is the only credential. Your agent acts as you: the asks it raises and the comments it posts carry your name, and "what needs me" means you.
+A set of skills that let your coding agent run your own Catalyst Cloud tenant (https://staging.catalystcloud.dev) from your seat: what is happening, what needs you, and what to do about it. They read your tenant through the Catalyst Cloud SDK, write to it through the tenant's agent proxy, and never compose a URL or run a tool of their own; every read, write and subscription is a `catalyst` verb with `--help`. Every skill is plain Markdown under `skills/<name>/SKILL.md` in this repository, and your own login — a keyless device-code session, or a personal key — is the only credential. Your agent acts as you: the asks it raises and the comments it posts carry your name, and "what needs me" means you.
 
 ## What connecting does
 
@@ -108,13 +110,13 @@ A set of skills that let your coding agent run your own Catalyst Cloud tenant (h
 
 A keyless session's access token is short-lived and rotates on its own: every request refreshes it within a minute of expiry and rewrites the config atomically, so you stay connected for months without logging in again. You only log in again if the session is revoked or you have been away long enough to lapse — then one clear line tells you to run `login`.
 
-`login` does not install skills; the install command above did that. Re-running `login` after a key rotation, or to switch rails, rewrites the config. `catalyst-skills status` prints which tenant this machine is connected to and as whom, `catalyst-skills ready` prints one READY or NOT READY verdict with the fix for each failure and who can apply it, and `catalyst-skills --version` prints the package version and its pinned tenant contract range.
+`login` does not install skills; the install command above did that. Re-running `login` after a key rotation, or to switch rails, rewrites the config. `catalyst status` prints which tenant this machine is connected to and as whom, `catalyst ready` prints one READY or NOT READY verdict with the fix for each failure and who can apply it, and `catalyst --version` prints the package version and its pinned tenant contract range.
 
 The setup skill Catalyst seeds into your repository ends by pointing at this same command. That served skill lives in the Catalyst Cloud application, not here; this is the only connect step a customer runs. The tenant's **account key** (Settings → Account keys, admin-minted) is a different credential — for a host or daemon that runs unattended — and is not what a person connects their own agent with: it would strip your name from everything your agent writes, and `login` says so if you use one.
 
 ## Requirements
 
-- Node 22.15 or newer (Node 26 works), or bun 1.4 or newer. The bundle uses Node's built-in SQLite module (and, on bun, bun's own `node:sqlite`) for the optional local replica, so there is no native dependency to build; if `better-sqlite3` resolves on the machine it is used instead. `catalyst-skills ready` names the exact reason when the runtime is too old, and `catalyst-skills runtime install` installs a pinned Node under this CLI's own cache — without touching your machine's default Node — if you would rather not upgrade it.
+- Node 22.15 or newer (Node 26 works), or bun 1.4 or newer. The bundle uses Node's built-in SQLite module (and, on bun, bun's own `node:sqlite`) for the optional local replica, so there is no native dependency to build; if `better-sqlite3` resolves on the machine it is used instead. `catalyst ready` names the exact reason when the runtime is too old, and `catalyst runtime install` installs a pinned Node under this CLI's own cache — without touching your machine's default Node — if you would rather not upgrade it.
 - Your personal key, minted by you at Settings → API keys. The key is the only tenant selector: you never type a tenant or account id. If your Linear identity is not matched yet, `login` says so; an admin matches it in Settings → Members, and until then "what needs me" shows everyone's asks.
 - An agent that discovers skills. Claude Code loads the plugin; Codex, Cursor, OpenCode and the rest read the `skills/<name>/SKILL.md` files the `npx skills` installer writes.
 - Bun is optional, only if you prefer `bunx` over `npx` — bun 1.4 or newer, which is when `node:sqlite` arrives; older bun cannot run this CLI at all.
@@ -128,6 +130,8 @@ Open a new session and ask about your own tenant. The skills read the config `lo
 - Run this project for me until it closes.
 - Am I set up?
 
+`catalyst team list` inventories visible teams without running readiness checks. `team check ENG` prints readiness for one team; `team check --all` runs checks for every team. `team map ENG`, `team adopt ENG`, and `team migrate ENG` print a plan and exit 3 before changing configuration; review the plan and rerun the chosen command with `--yes --plan-hash <hash>` from that preview. `team adopt ENG --undo` previews the exact previously created stages, and `team migrate ENG --retire` requires its own confirmation after the ticket move. `team checklist ENG` prints the same manual setup lines as the browser. These commands use the member's own login; an admin or owner seat is required for setup, and Adopt and Migrate also need that member's personal Linear connection.
+
 ## What has to be running
 
 Nothing, by default. After `login`, every read, write, ask and explanation goes to the cloud's origin-fresh API with the config file and the cached contract on disk. Two optional processes exist for people who want them:
@@ -135,12 +139,12 @@ Nothing, by default. After `login`, every read, write, ask and explanation goes
 | process | needed for | what it holds on disk | lifetime |
 | --- | --- | --- | --- |
 | none | every read, write, ask and explain | `customer.json` and `contract.json` | the default after login |
-| `catalyst-skills replica start` | local SQL, cheap repeated reads, and local event `tail`, `wait-for`, and `query` | one SQLite file plus a bounded event cache under `$XDG_STATE_HOME/catalyst/events/` (fallback `~/.local/state/catalyst/events/`) | one long-running process; foreground by default, `--detach` writes a pidfile beside the database and returns; `login --start-replica` does the same at the end of login |
-| `catalyst-skills watch` | a project owner reacting to its scope | one cursor file (`~/.config/catalyst-cloud/watch-cursor.json`) stamped with the tenant | lives inside the session that armed it; exits with it |
+| `catalyst replica start` | local SQL, cheap repeated reads, and local event `tail`, `wait-for`, and `query` | one SQLite file plus a bounded event cache under `$XDG_STATE_HOME/catalyst/events/` (fallback `~/.local/state/catalyst/events/`) | one long-running process; foreground by default, `--detach` writes a pidfile beside the database and returns; `login --start-replica` does the same at the end of login |
+| `catalyst watch` | a project owner reacting to its scope | one cursor file (`~/.config/catalyst-cloud/watch-cursor.json`) stamped with the tenant | lives inside the session that armed it; exits with it |
 
-The check every skill runs first is `catalyst-skills replica status`, which needs no network: is the pidfile's process alive, is the writer-lock heartbeat younger than the staleness threshold, and is the cursor non-empty. It exits `0` for fresh, `1` for present but stale, `2` for not connected, `3` for absent, and prints one line either way (`--json` for scripts). A fresh replica is used; anything else falls back to the API and the skill says so in its answer. A skill never refuses to work because the replica is down and never silently reads a stale one. `replica status --probe` compares the local cursor against the cloud's head for the honest "how far behind" number; that is the only form that touches the network. `catalyst-skills replica stop` stops a detached writer.
+The check every skill runs first is `catalyst replica status`, which needs no network: is the pidfile's process alive, is the writer-lock heartbeat younger than the staleness threshold, and is the cursor non-empty. It exits `0` for fresh, `1` for present but stale, `2` for not connected, `3` for absent, and prints one line either way (`--json` for scripts). A fresh replica is used; anything else falls back to the API and the skill says so in its answer. A skill never refuses to work because the replica is down and never silently reads a stale one. `replica status --probe` compares the local cursor against the cloud's head for the honest "how far behind" number; that is the only form that touches the network. `catalyst replica stop` stops a detached writer.
 
-`catalyst-skills events status --probe` checks the event cache's own cursor and compares it with the cloud head; `replica status --probe` checks the separate entity-replica cursor. A fresh replica does not prove event freshness. `events tail` follows new cached events, `events wait-for --ticket ... --timeout ...` performs a bounded wait, and `events query` reads retained history. Those three commands only read the cache; `events status --probe` makes the cloud comparison. The replica process is the single writer and reports an event-sync failure without terminating a healthy entity replica. The event cache keeps closed daily segments for at most seven days or 256 MiB per tenant and reports an explicit gap when a requested sequence has retired.
+`catalyst events status --probe` checks the event cache's own cursor and compares it with the cloud head; `replica status --probe` checks the separate entity-replica cursor. A fresh replica does not prove event freshness. `events tail` follows new cached events, `events wait-for --ticket ... --timeout ...` performs a bounded wait, and `events query` reads retained history. Those three commands only read the cache; `events status --probe` makes the cloud comparison. The replica process is the single writer and reports an event-sync failure without terminating a healthy entity replica. The event cache keeps closed daily segments for at most seven days or 256 MiB per tenant and reports an explicit gap when a requested sequence has retired.
 
 The replica is a Node process, not a service: the supported path is the plain command, and `skills/connect-me/references/keeping-the-replica-running.md` gives launchd and systemd examples for people who want the writer to survive a reboot.
 
@@ -163,7 +167,7 @@ Some of these only read; the ones that write anything — or that drive you thro
 
 ## What a key cannot see yet
 
-Your personal key reads everything the skills need — tickets, pull requests, the eligibility explainer, the dispatch queue, fleet activity, per-ticket execution history (`catalyst-skills explain --history <ticket>`: phase attempts, remediation rounds, park state) and coding-account status (`catalyst-skills accounts`: provider, declared and observed state, window usage, walls, quarantine — never a credential; enrolling or pausing one is `<your cloud>/settings/coding-accounts`). It also releases a parked or held ticket once its cause is fixed: `catalyst-skills release <ticket> --because <what changed>` (the `unstick` skill runs it), recorded against your name and shown in the ticket's history. And it declares what your containers need: `catalyst-skills environment` reads the tenant-wide declaration, `environment propose --file <path> --approve` proposes and approves it in one compare-and-set, and the values behind the names stay in the cloud — reading needs any active seat, proposing and approving need an admin or owner one. An admin or owner can put a repository's values in from the terminal. `catalyst-skills secret import .env --repo owner/name` stores every name in the file and lists the declared names that still have no value. `catalyst-skills secret set NAME --repo owner/name --command 'op read op://Vault/item/field'` runs the command on your machine and stores its output; with no `--command` it reads the value from stdin, or asks for it without echoing. No value is ever printed, and the cloud's audit records the command, not its output. That is the account's own declaration — a repository's own `.catalyst/catalyst.toml`, which `catalyst-setup` already reports on, is a separate thing. One thing it cannot do, and the skills say so by name rather than guess:
+Your personal key reads everything the skills need — tickets, pull requests, the eligibility explainer, the dispatch queue, fleet activity, per-ticket execution history (`catalyst explain --history <ticket>`: phase attempts, remediation rounds, park state) and coding-account status (`catalyst accounts`: provider, declared and observed state, window usage, walls, quarantine — never a credential; enrolling or pausing one is `<your cloud>/settings/coding-accounts`). It also releases a parked or held ticket once its cause is fixed: `catalyst release <ticket> --because <what changed>` (the `unstick` skill runs it), recorded against your name and shown in the ticket's history. And it declares what your containers need: `catalyst environment` reads the tenant-wide declaration, `environment propose --file <path> --approve` proposes and approves it in one compare-and-set, and the values behind the names stay in the cloud — reading needs any active seat, proposing and approving need an admin or owner one. An admin or owner can put a repository's values in from the terminal. `catalyst secret import .env --repo owner/name` stores every name in the file and lists the declared names that still have no value. `catalyst secret set NAME --repo owner/name --command 'op read op://Vault/item/field'` runs the command on your machine and stores its output; with no `--command` it reads the value from stdin, or asks for it without echoing. No value is ever printed, and the cloud's audit records the command, not its output. That is the account's own declaration — a repository's own `.catalyst/catalyst.toml`, which `catalyst-setup` already reports on, is a separate thing. One thing it cannot do, and the skills say so by name rather than guess:
 
 - Read pull-request labels or the reviewer's reaction. The mirror does not carry them; GitHub's own page does.
 
@@ -182,35 +186,35 @@ The skill files themselves are written by whichever install command you ran, in
 
 ## Updating
 
-A plugin install updates when we ship. Skills copied by `npx skills add` do not. After the source and destination check in Install, re-run the Cloud add command to refresh existing skills and pick up new ones. Update the CLI with `npm install -g @catalyst-cloud/catalyst-skills@latest && catalyst-skills login` — the re-login rewrites the CLI path the skills spawn, so they stop running the old bundle. To run one command against the latest publish without installing, use `npx @catalyst-cloud/catalyst-skills@latest login`. The next `catalyst-skills` run prints a one-line notice:
+A plugin install updates when we ship. Skills copied by `npx skills add` do not. After the source and destination check in Install, re-run the Cloud add command to refresh existing skills and pick up new ones. Update the CLI with `npm install -g @catalyst-cloud/cli@latest && catalyst login` — the re-login rewrites the CLI path the skills spawn, so they stop running the old bundle. To run one command against the latest publish without installing, use `npx -p @catalyst-cloud/cli@latest catalyst login`. The next `catalyst` run prints a one-line notice:
 
 ```
-[catalyst-skills] updated 0.1.1 → 0.2.0: <that version's CHANGELOG.md summary> · update with: npm install -g @catalyst-cloud/catalyst-skills@latest && catalyst-skills login
+[catalyst] updated 0.1.1 → 0.2.0: <that version's CHANGELOG.md summary> · update with: npm install -g @catalyst-cloud/cli@latest && catalyst login
 ```
 
-A `customer.json` written by an older bundle is still read unchanged; it gains the CLI path and the cached contract the next time you run `catalyst-skills login`.
+A `customer.json` written by an older bundle is still read unchanged; it gains the CLI path and the cached contract the next time you run `catalyst login`.
 
-`catalyst-skills ready` also says when either the installed skills or the CLI is behind the latest publish, naming both versions and the command for each; it is a note, never a failure, and `--offline` (or `CATALYST_SKILLS_OFFLINE=1`) skips the lookup.
+`catalyst ready` also says when either the installed skills or the CLI is behind the latest publish, naming both versions and the command for each; it is a note, never a failure, and `--offline` (or `CATALYST_SKILLS_OFFLINE=1`) skips the lookup.
 
 ## Uninstalling
 
 Remove the skills the way you installed them: `/plugin uninstall catalyst@catalyst-cloud` in Claude Code, or delete the skill directories (`catalyst-github`, `catalyst-linear`, `catalyst-onboard`, `catalyst-setup`, `connect-me`, `how-catalyst-works`, `run-this-project`, `unstick`, `what-needs-me`, `whats-happening`) from wherever `npx skills add` wrote them. Then remove what the CLI wrote:
 
 ```sh
-catalyst-skills replica stop
+catalyst replica stop
 rm -f ~/.config/catalyst-cloud/customer.json ~/.config/catalyst-cloud/contract.json ~/.config/catalyst-cloud/published.json ~/.config/catalyst-cloud/watch-cursor.json
 rm -f ~/.config/catalyst-cloud/replica.db ~/.config/catalyst-cloud/replica.db.pid ~/.config/catalyst-cloud/replica.db.writer.lock ~/.config/catalyst-cloud/replica.db.writer.state
 rm -rf "${XDG_STATE_HOME:-$HOME/.local/state}/catalyst/events"
-npm uninstall -g @catalyst-cloud/catalyst-skills
+npm uninstall -g @catalyst-cloud/cli
 ```
 
 ## If login fails
 
-- `catalyst-skills: GET /me failed (401): credential not accepted — mint a personal key at Settings → API keys and log in again` — the key is stale, mistyped or revoked. Mint a new one, then run `login` again.
-- `catalyst-skills: GET /me failed (403): account-not-operational` — the tenant is suspended. This is an admin conversation on the tenant, not a local fix.
-- `catalyst-skills: could not reach <url>: <detail>` — the machine cannot reach the cloud. The URL is named in the message; check `CATALYST_CLOUD_BASE_URL` or `--base-url`.
+- `catalyst: GET /me failed (401): credential not accepted — mint a personal key at Settings → API keys and log in again` — the key is stale, mistyped or revoked. Mint a new one, then run `login` again.
+- `catalyst: GET /me failed (403): account-not-operational` — the tenant is suspended. This is an admin conversation on the tenant, not a local fix.
+- `catalyst: could not reach <url>: <detail>` — the machine cannot reach the cloud. The URL is named in the message; check `CATALYST_CLOUD_BASE_URL` or `--base-url`.
 - A line naming two contract versions after `Connected to` — the tenant serves a contract outside this bundle's `1.x || 2.x` range. The config is written; update the bundle before using the other skills.
-- `[catalyst-skills] GET /api/v1/agent/contract refused (403): this cloud is older than the bundle …` on stderr — the cloud has not yet deployed personal-key access to the contract. Update the cloud, or connect with the tenant's account key until it has.
+- `[catalyst] GET /api/v1/agent/contract refused (403): this cloud is older than the bundle …` on stderr — the cloud has not yet deployed personal-key access to the contract. Update the cloud, or connect with the tenant's account key until it has.
 
 ## License
 
@@ -221,9 +225,9 @@ MIT — see [LICENSE](LICENSE). How to contribute and how releases happen are de
 Personal Linear consent normally binds the provider viewer automatically. For an unmatched identity, inspect your choices and explicitly select yourself:
 
 ```sh
-catalyst-skills identity linear status
-catalyst-skills identity linear options --json
-catalyst-skills identity linear set <linearUserId>
+catalyst identity linear status
+catalyst identity linear options --json
+catalyst identity linear set <linearUserId>
 ```
 
 The command uses your personal credential and reads the result back after selection. It cannot change another member, replace an automatic match, or take an already-claimed identity. A missing options field means no choice was offered, which can include a temporarily unreadable roster. This command depends on the pending SDK 0.12.0 release with identity support.

package/dist/args.js

@@ -111,6 +111,15 @@ export const FLAG_TABLES = {
         offline: { value: false, help: "skip the published-release check (no network)" },
     },
     accounts: {},
+    team: {
+        all: { value: false, help: "check every team, one request at a time" },
+        stage: { value: true, repeat: true, help: "map a role to a live Linear state name (role=StateName)" },
+        choice: { value: true, repeat: true, help: "migrate a source state to a destination (sourceId=destinationId)" },
+        yes: { value: false, help: "apply the plan you have reviewed with the person" },
+        "plan-hash": { value: true, help: "apply only the exact preview hash the person reviewed" },
+        undo: { value: false, help: "adopt: preview or archive stages a prior adoption created" },
+        retire: { value: false, help: "migrate: separately preview or retire emptied source stages" },
+    },
     environment: {
         file: { value: true, help: "propose: a JSON file holding the declaration" },
         stdin: { value: false, help: "propose: read the declaration from stdin" },
@@ -125,6 +134,7 @@ export const FLAG_TABLES = {
         rotate: { value: true, repeat: true, help: "import: replace this name if it is already set (repeatable)" },
     },
     identity: {},
+    capabilities: {},
     connections: {
         wait: { value: true, help: "start: wait up to this many seconds for browser approval (0-600)" },
     },
@@ -158,9 +168,11 @@ export const VERB_USAGE = {
     ready: "ready [--json] [--offline]",
     accounts: "accounts [--json]",
     mcp: "mcp <add <name> --url URL <--auth none|--bearer SECRET_NAME|--header NAME=SECRET_NAME...>|list|remove <name>> [--json]",
+    team: "team <list|check <KEY>|check --all|map <KEY> [--stage role=StateName]... [--yes --plan-hash H]|adopt <KEY> [--undo] [--yes --plan-hash H]|migrate <KEY> [--choice sourceId=destinationId]... [--retire] [--yes --plan-hash H]|checklist <KEY>> [--json]",
     environment: "environment [read] [--json] | environment propose --file <path>|--stdin [--expect-revision N] [--approve] [--json] | environment approve [--revision N --hash H] [--json]",
     secret: "secret set <NAME> --repo <owner/name> [--command '<cmd>'] [--json]   (value from --command, stdin, or a hidden prompt) | secret import <file> --repo <owner/name> [--rotate NAME]... [--json]",
     identity: "identity linear <status|options|set> [<linearUserId>] [--json]",
+    capabilities: "capabilities [--json]",
     connections: "connections personal <linear|github> <start|status> [--wait <seconds>] [--json]",
     release: "release <ticket> --because <what changed> [--retry-unchanged] [--dry-run] [--json] | release --class <failure-class> --team <K> --because <what changed> [--retry-unchanged] [--dry-run] [--limit N] [--json]",
 };
@@ -277,7 +289,7 @@ export function flagInt(args, name, fallback) {
 }
 /** The help text for one verb: usage line, then every flag in its table and the global ones. */
 export function verbHelp(verb) {
-    const lines = [`Usage: catalyst-skills ${VERB_USAGE[verb] ?? verb}`, ""];
+    const lines = [`Usage: catalyst ${VERB_USAGE[verb] ?? verb}`, ""];
     const table = FLAG_TABLES[verb] ?? {};
     const names = Object.keys(table);
     if (names.length > 0) {

package/dist/ask.js

@@ -146,10 +146,10 @@ async function list(args, ctx, doc, api, cfg) {
         return 0;
     }
     if (scope.kind === "unmatched") {
-        ctx.stderr(`[catalyst-skills] your Linear identity is not matched yet (an admin matches it in Settings → Members), so this is every open ask, not only yours`);
+        ctx.stderr(`[catalyst] your Linear identity is not matched yet (an admin matches it in Settings → Members), so this is every open ask, not only yours`);
     }
     else if (scope.kind === "no-person") {
-        ctx.stderr(`[catalyst-skills] connected with the tenant's account key, which names no person — this is every open ask; log in with your personal key to see only yours`);
+        ctx.stderr(`[catalyst] connected with the tenant's account key, which names no person — this is every open ask; log in with your personal key to see only yours`);
     }
     if (ranked.length === 0) {
         ctx.stdout(scope.kind === "mine" ? `no open asks assigned to ${scope.label} (${all.length} open in the tenant — add --anyone to see them)` : "no open asks");

package/dist/capabilities.js

@@ -0,0 +1,70 @@
+import { readManifest } from "./config.js";
+import { readContractCache } from "./contract.js";
+const agent = (method, name) => ({ method, path: `/api/v1/agent/${name}` });
+/** ⭐ THE ONE PLACE THIS CLI SAYS WHAT IT CAN DO. Keep it in the order a setup walks: the machine,
+ *  the person, the workspace, the project, the repository, then work. A new verb is a new row here
+ *  in the same change, or `catalyst capabilities` lies to every guide that reads it. */
+export const CAPABILITIES = [
+    { verb: "status", does: "say whether this machine is connected, as whom, and to which cloud", needs: "member", routes: [], since: "0.1.0" },
+    { verb: "me", does: "read the person's seat, role and Linear identity", needs: "member", routes: [], since: "0.1.0" },
+    { verb: "ready", does: "read the machine and the workspace's per-project readiness in one verdict", needs: "member", routes: [], since: "0.1.0" },
+    { verb: "contract", does: "read the workspace contract this cloud serves", needs: "member", routes: [agent("GET", "contract")], since: "0.1.0" },
+    { verb: "capabilities", does: "list what this CLI can do, the role each needs, and whether this cloud serves it", needs: "member", routes: [], since: "0.9.5" },
+    { verb: "connections personal linear start|status", does: "start and confirm the person's own Linear connected account (the consent itself is theirs, in a browser)", needs: "member", routes: [], since: "0.9.0" },
+    { verb: "connections personal github start|status", does: "start and confirm the person's own GitHub connected account (the consent itself is theirs, in a browser)", needs: "member", routes: [], since: "0.9.0" },
+    { verb: "identity linear status|options|set", does: "match the person's Linear identity from the roster", needs: "member", routes: [], since: "0.9.0" },
+    { verb: "team list", does: "list the workspace's Linear teams and which are mapped as projects", needs: "member", routes: [agent("GET", "teams")], since: "0.9.5" },
+    { verb: "team check", does: "run a project's readiness check now", needs: "admin", routes: [agent("POST", "team-workflow/check")], since: "0.9.5" },
+    { verb: "team map", does: "map a project's stages, from a preview the person approves", needs: "admin", routes: [agent("GET", "team-workflow"), agent("POST", "team-workflow/save")], since: "0.9.5" },
+    { verb: "team adopt", does: "create Catalyst's stages in a Linear team, from a preview the person approves", needs: "admin", routes: [agent("POST", "team-workflow/adopt")], since: "0.9.5" },
+    { verb: "team migrate", does: "move tickets between stages, from a preview the person approves", needs: "admin", routes: [agent("POST", "team-workflow/migrate")], since: "0.9.5" },
+    { verb: "team checklist", does: "print what adopting the workflow would do to a team", needs: "admin", routes: [agent("GET", "team-workflow")], since: "0.9.5" },
+    { verb: "environment read", does: "read the workspace-wide environment declaration", needs: "member", routes: [agent("GET", "account-environment")], since: "0.8.0" },
+    { verb: "environment propose", does: "propose the workspace-wide environment declaration (names only)", needs: "admin", routes: [agent("POST", "account-environment/propose")], since: "0.8.0" },
+    { verb: "environment approve", does: "approve the workspace-wide environment declaration", needs: "admin", routes: [agent("POST", "account-environment/approve")], since: "0.8.0" },
+    { verb: "secret set|import", does: "enter a repository secret's value from this terminal, never echoed", needs: "admin", routes: [], since: "0.8.0" },
+    { verb: "accounts", does: "read the workspace's coding accounts and which can take work", needs: "member", routes: [], since: "0.5.0" },
+    { verb: "explain|running|queue|history", does: "read why a ticket runs or waits, what runs now, and what is queued", needs: "member", routes: [], since: "0.1.0" },
+    { verb: "write comment|state|label|create|reaction|attachment|session", does: "act on a ticket as the person, through the agent proxy", needs: "member", routes: [agent("POST", "issue-comment"), agent("POST", "issue-state"), agent("POST", "issue-label"), agent("POST", "issue-create")], since: "0.1.0" },
+    { verb: "ask raise|accept|list", does: "raise a decision to a human, or answer one", needs: "member", routes: [agent("POST", "ask"), agent("POST", "ask-accept")], since: "0.1.0" },
+    { verb: "release", does: "release a parked ticket or a whole failure class back to work", needs: "admin", routes: [agent("POST", "ticket-release"), agent("POST", "ticket-release-class")], since: "0.6.0" },
+    { verb: "mcp add|list|remove", does: "register an MCP server for the workspace by vault-secret name", needs: "admin", routes: [agent("POST", "mcp")], since: "0.9.0" },
+];
+/** Judge each capability against the routes a contract serves. `null` means no contract is cached,
+ *  so nothing that rides a route can be called available; local and read-plane verbs still are. */
+export function reportCapabilities(routes) {
+    return CAPABILITIES.map((c) => {
+        if (c.routes.length === 0)
+            return { ...c, availability: "available", missing: [] };
+        if (routes === null)
+            return { ...c, availability: "cloud_unread", missing: [] };
+        const missing = c.routes.filter((r) => !routes.some((s) => s.method === r.method && s.path === r.path));
+        return { ...c, availability: missing.length === 0 ? "available" : "needs_newer_cloud", missing };
+    });
+}
+export async function cmdCapabilities(args, ctx) {
+    const manifest = readManifest();
+    const cache = readContractCache(ctx.home);
+    const report = reportCapabilities(cache === null ? null : cache.doc.routes);
+    if (args.json) {
+        ctx.stdout(JSON.stringify({
+            cli: { name: "catalyst", version: manifest.version },
+            contract: cache === null ? null : { version: cache.contractVersion, fetchedAt: cache.fetchedAt },
+            capabilities: report,
+        }));
+        return 0;
+    }
+    ctx.stdout(cache === null
+        ? `catalyst ${manifest.version}; no contract cached yet, so nothing that rides a cloud route can be called available: run \`catalyst contract\` after connecting`
+        : `catalyst ${manifest.version} against contract ${cache.contractVersion} (cached ${cache.fetchedAt})`);
+    const width = Math.max(...report.map((r) => r.verb.length));
+    for (const r of report) {
+        const why = r.availability === "needs_newer_cloud"
+            ? ` — this cloud does not serve ${r.missing.map((m) => `${m.method} ${m.path}`).join(", ")}`
+            : r.availability === "cloud_unread"
+                ? " — rides a cloud route; no contract cached"
+                : "";
+        ctx.stdout(`${r.verb.padEnd(width)}  ${r.needs.padEnd(6)}  ${r.availability.padEnd(17)}  ${r.does}${why}`);
+    }
+    return 0;
+}

package/dist/cli.js

@@ -24,6 +24,8 @@ import { cmdMcp } from "./mcp.js";
 import { cmdRelease } from "./release.js";
 import { cmdEnvironment } from "./environment.js";
 import { cmdSecret } from "./secret.js";
+import { cmdTeam } from "./team.js";
+import { cmdCapabilities } from "./capabilities.js";
 import { cmdIdentity } from "./identity.js";
 import { cmdConnections } from "./connections.js";
 export { CONFIG_MODE, DEFAULT_BASE_URL, FIRST_STAMPED_VERSION, LEGACY_PACKAGE_NAME, PACKAGE_NAME, PROVENANCE_MARKER, CliError, MeError, UsageError, configPathFor, contractPathFor, defaultCtx, defaultReplicaDbFor, defaultSkillsDirFor, fetchMe, formatMode, installedBundleVersion, installSkills, loadConfig, modernCliPath, normalizeBaseUrl, parseArgs, parseChangelogEntry, parseProvenanceVersion, readChangelog, readManifest, resolveSkillsDir, saveConfig, skillsSourceDir, updateNoticeLine, writeConfig, };
@@ -49,26 +51,28 @@ export function usageText() {
         `${PACKAGE_NAME} — the Catalyst Cloud customer CLI: connect to your tenant, read through the SDK, write through the agent proxy`,
         "",
         "Usage:",
-        "  catalyst-skills login [--base-url <url>] [--start-replica]   (keyless: logs you in as yourself)",
-        "  catalyst-skills login --key <personal-key> [--base-url <url>]   (or CATALYST_CLOUD_TOKEN, for a key)",
-        "  catalyst-skills join ...   (deprecated alias of login; removed in the next minor version)",
-        "  catalyst-skills install [--skills-dir <dir>] [--force]   (repair path; your agent's own command installs the skills)",
-        "  catalyst-skills status | notice | me | ready | accounts",
-        "  catalyst-skills mcp add|list|remove (vault references only)",
-        "  catalyst-skills contract [--refresh] [--path <a.b.c>]",
-        "  catalyst-skills query <issues|issue <id>|pulls|pull <id>|projects|cycles|search <terms>|changes --since <cursor|head>>",
-        "  catalyst-skills replica <start [--detach]|stop|status [--probe]|sql \"<select>\"|schema [table]>",
-        "  catalyst-skills runtime <status [--json]|install|path|uninstall>   (a pinned Node this CLI manages itself)",
-        "  catalyst-skills events <tail|wait-for|query|status [--probe]> [--type NAME] [--ticket CTC-N] [--after SEQUENCE]",
-        "  catalyst-skills explain <ticket> | history <ticket> | running [--ticket T --phase P] | queue [--team K]",
-        "  catalyst-skills watch [--team K] [--ticket T]... [--project P] [--exec CMD]",
-        "  catalyst-skills write <comment|state|label|create|reaction|attachment|session> ...",
-        "  catalyst-skills ask <raise|accept|list> ...",
-        "  catalyst-skills release <ticket> --because <what changed> [--retry-unchanged] [--dry-run] | release --class <c> --team <K> ...",
-        "  catalyst-skills environment [read] | environment propose --file <path>|--stdin [--approve] | environment approve",
-        "  catalyst-skills secret set <NAME> --repo <owner/name> [--command '<cmd>'] | secret import <file> --repo <owner/name>",
-        "  catalyst-skills identity linear <status|options|set> [<linearUserId>] [--json]",
-        "  catalyst-skills connections personal <linear|github> <start|status> [--wait <seconds>] [--json]",
+        "  catalyst login [--base-url <url>] [--start-replica]   (keyless: logs you in as yourself)",
+        "  catalyst login --key <personal-key> [--base-url <url>]   (or CATALYST_CLOUD_TOKEN, for a key)",
+        "  catalyst join ...   (deprecated alias of login; removed in the next minor version)",
+        "  catalyst install [--skills-dir <dir>] [--force]   (repair path; your agent's own command installs the skills)",
+        "  catalyst status | notice | me | ready | accounts",
+        "  catalyst mcp add|list|remove (vault references only)",
+        "  catalyst contract [--refresh] [--path <a.b.c>]",
+        "  catalyst query <issues|issue <id>|pulls|pull <id>|projects|cycles|search <terms>|changes --since <cursor|head>>",
+        "  catalyst replica <start [--detach]|stop|status [--probe]|sql \"<select>\"|schema [table]>",
+        "  catalyst runtime <status [--json]|install|path|uninstall>   (a pinned Node this CLI manages itself)",
+        "  catalyst events <tail|wait-for|query|status [--probe]> [--type NAME] [--ticket CTC-N] [--after SEQUENCE]",
+        "  catalyst explain <ticket> | history <ticket> | running [--ticket T --phase P] | queue [--team K]",
+        "  catalyst watch [--team K] [--ticket T]... [--project P] [--exec CMD]",
+        "  catalyst write <comment|state|label|create|reaction|attachment|session> ...",
+        "  catalyst ask <raise|accept|list> ...",
+        "  catalyst release <ticket> --because <what changed> [--retry-unchanged] [--dry-run] | release --class <c> --team <K> ...",
+        "  catalyst environment [read] | environment propose --file <path>|--stdin [--approve] | environment approve",
+        "  catalyst secret set <NAME> --repo <owner/name> [--command '<cmd>'] | secret import <file> --repo <owner/name>",
+        "  catalyst team <list|check|map|adopt|migrate|checklist> ...",
+        "  catalyst capabilities [--json]   (what this CLI can do, the role each verb needs, and whether this cloud serves it)",
+        "  catalyst identity linear <status|options|set> [<linearUserId>] [--json]",
+        "  catalyst connections personal <linear|github> <start|status> [--wait <seconds>] [--json]",
         "",
         "Every verb takes --help. --json makes the output machine-readable.",
         "",
@@ -156,13 +160,13 @@ function maybePrintUpdateNotice(args, ctx) {
         refreshed = installSkills(skillsDir, { force: false, onlyExisting: true });
     }
     catch (err) {
-        ctx.stderr(`[catalyst-skills] could not refresh the skills at ${skillsDir} (${err instanceof Error ? err.message : String(err)}) — the ${manifest.version} skills are not installed yet; re-run the install command: ${INSTALL_COMMAND}`);
+        ctx.stderr(`[catalyst] could not refresh the skills at ${skillsDir} (${err instanceof Error ? err.message : String(err)}) — the ${manifest.version} skills are not installed yet; re-run the install command: ${INSTALL_COMMAND}`);
         return;
     }
     if (refreshed.installed.length > 0)
-        say(`[catalyst-skills] refreshed ${refreshed.installed.join(", ")} at ${skillsDir} to ${manifest.version}`);
+        say(`[catalyst] refreshed ${refreshed.installed.join(", ")} at ${skillsDir} to ${manifest.version}`);
     for (const s of refreshed.skipped) {
-        say(`[catalyst-skills] left "${s.name}" alone: ${skillsDir}/${s.name} was not installed by this package (catalyst-skills install --force to replace)`);
+        say(`[catalyst] left "${s.name}" alone: ${skillsDir}/${s.name} was not installed by this package (catalyst install --force to replace)`);
     }
     cfg.lastSkillBundleVersion = manifest.version;
     cfg.skillsDir = skillsDir;
@@ -243,6 +247,10 @@ export async function main(argv, ctx = defaultCtx(), deps = {}) {
                 return await cmdEnvironment(args, ctx, deps.environment ?? {});
             case "secret":
                 return await cmdSecret(args, ctx, deps.secret ?? {});
+            case "team":
+                return await cmdTeam(args, ctx, deps.team);
+            case "capabilities":
+                return await cmdCapabilities(args, ctx);
             case "identity":
                 return await cmdIdentity(args, ctx, deps.identity ?? {});
             case "connections":
@@ -260,17 +268,17 @@ export async function main(argv, ctx = defaultCtx(), deps = {}) {
             return 1;
         }
         if (err instanceof CliError) {
-            ctx.stderr(`catalyst-skills: ${err.message}`);
+            ctx.stderr(`catalyst: ${err.message}`);
             return err.exitCode;
         }
         if (err instanceof MeError) {
-            ctx.stderr(`catalyst-skills: ${err.message}`);
+            ctx.stderr(`catalyst: ${err.message}`);
             return 2;
         }
         throw err;
     }
 }
-const VERB_HELP_KNOWN = Object.fromEntries(["login", "join", "install", "status", "notice", "me", "contract", "query", "replica", "runtime", "events", "explain", "running", "queue", "watch", "write", "ask", "ready", "accounts", "release", "secret", "environment", "connections", "identity", "mcp"].map((v) => [v, true]));
+const VERB_HELP_KNOWN = Object.fromEntries(["login", "join", "install", "status", "notice", "me", "contract", "query", "replica", "runtime", "events", "explain", "running", "queue", "watch", "write", "ask", "ready", "accounts", "release", "secret", "environment", "connections", "identity", "mcp", "team", "capabilities"].map((v) => [v, true]));
 async function cmdLogin(args, ctx, deps) {
     const manifest = readManifest();
     const key = (args.key ?? ctx.env.CATALYST_CLOUD_TOKEN ?? "").trim();
@@ -317,7 +325,7 @@ async function cmdLogin(args, ctx, deps) {
         ctx.stdout(`Connected as ${me.user.label} (${me.user.role})${me.user.linearUserId ? "" : " — your Linear identity is not matched yet, so \"what needs me\" will show everyone's asks until an admin matches it in Settings"}`);
     }
     else {
-        ctx.stderr(`[catalyst-skills] this is the tenant's account key (a host credential), not your own — the skills work, but nothing your agent writes will carry your name and "what needs me" cannot mean you. Mint a personal key at Settings → API keys and log in with that.`);
+        ctx.stderr(`[catalyst] this is the tenant's account key (a host credential), not your own — the skills work, but nothing your agent writes will carry your name and "what needs me" cannot mean you. Mint a personal key at Settings → API keys and log in with that.`);
     }
     ctx.stdout(`Config written to ${written.path} (mode ${formatMode(written.mode)}, holds your ${auth ? "login session" : "key"} and the CLI path)${written.mode === CONFIG_MODE ? "" : ` — expected ${formatMode(CONFIG_MODE)}; chmod it by hand`}`);
     ctx.stdout(`Tenant contract range: ${manifest.tenantContractRange}`);
@@ -327,7 +335,7 @@ async function cmdLogin(args, ctx, deps) {
     }
     catch (err) {
         if (err instanceof CliError && (err.code === "contract-forbidden" || err.code === "contract-version")) {
-            ctx.stderr(`[catalyst-skills] ${err.message}`);
+            ctx.stderr(`[catalyst] ${err.message}`);
         }
         else {
             throw err;
@@ -379,7 +387,7 @@ function cmdStatus(ctx) {
     ctx.stdout(`Bundle: ${PACKAGE_NAME} ${manifest.version} (tenant contract range: ${manifest.tenantContractRange})`);
     if (cfg.cliPath)
         ctx.stdout(`CLI: ${cfg.cliPath}${existsSync(cfg.cliPath) ? "" : " (missing — re-run login)"}`);
-    ctx.stdout(`Contract: ${existsSync(contractPathFor(ctx.home)) ? contractPathFor(ctx.home) : "not cached (run: catalyst-skills contract --refresh)"}`);
+    ctx.stdout(`Contract: ${existsSync(contractPathFor(ctx.home)) ? contractPathFor(ctx.home) : "not cached (run: catalyst contract --refresh)"}`);
     return 0;
 }
 /** A short human relative time for an ISO expiry, e.g. "in 14m", "in 2h", "in 6d", or "now" once past. */

package/dist/config.js

@@ -96,7 +96,7 @@ export const INSTALL_COMMAND = "curl -fsSL https://staging.catalystcloud.dev/ins
 /** The one upgrade command every hint prints: update the installed package, then log in again so
  *  customer.json records the new launcher path. */
 export function upgradeCommand(root) {
-    return `npm install -g ${updatePackageName(root)}@latest && catalyst-skills login`;
+    return `npm install -g ${updatePackageName(root)}@latest && catalyst login`;
 }
 /**
  * CTC-3479 — logins before this release recorded bin/catalyst-skills.js as cliPath. That launcher is

package/dist/connections.js

@@ -24,9 +24,9 @@ function statusLine(provider, result) {
         case "connected":
             return `Personal ${name}: connected as ${result.provider === "linear" ? result.linearUserId : result.githubLogin}`;
         case "absent":
-            return `Personal ${name}: not connected — run catalyst-skills connections personal ${provider} start`;
+            return `Personal ${name}: not connected — run catalyst connections personal ${provider} start`;
         case "lapsed":
-            return `Personal ${name}: connection expired — run catalyst-skills connections personal ${provider} start`;
+            return `Personal ${name}: connection expired — run catalyst connections personal ${provider} start`;
         case "unavailable":
             return `Personal ${name}: temporarily unavailable — the grant state is unknown; retry status later`;
         default:
@@ -40,7 +40,7 @@ export async function cmdConnections(args, ctx, deps = {}) {
     const { provider, action, waitSeconds } = parseCommand(args);
     const cfg = requireConfig(ctx);
     if (!cfg.user)
-        throw new CliError("this machine uses a tenant account key, not a member credential — run catalyst-skills login as yourself", "member-required");
+        throw new CliError("this machine uses a tenant account key, not a member credential — run catalyst login as yourself", "member-required");
     const createClient = deps.createClient ?? (async (options) => (await loadHttpSdk()).createTenantClient(options));
     const client = await createClient({ key: await bearerFor(ctx, cfg), baseUrl: cfg.baseUrl, fetch: ctx.fetch });
     if (action === "status") {
@@ -62,7 +62,7 @@ export async function cmdConnections(args, ctx, deps = {}) {
         if (args.json)
             ctx.stdout(JSON.stringify(started));
         else
-            ctx.stdout(`After approval, run: catalyst-skills connections personal ${provider} status`);
+            ctx.stdout(`After approval, run: catalyst connections personal ${provider} status`);
         return 0;
     }
     const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
@@ -79,7 +79,7 @@ export async function cmdConnections(args, ctx, deps = {}) {
     else {
         ctx.stdout(statusLine(provider, status));
         if (status.outcome === "absent" || status.outcome === "lapsed")
-            ctx.stdout(`Approval has not appeared yet; run catalyst-skills connections personal ${provider} status later.`);
+            ctx.stdout(`Approval has not appeared yet; run catalyst connections personal ${provider} status later.`);
     }
     return status.outcome === "connected" ? 0 : status.outcome === "absent" || status.outcome === "lapsed" ? 2 : 1;
 }

package/dist/environment.js

@@ -131,7 +131,7 @@ export async function cmdEnvironment(args, ctx, deps = {}) {
                 if (body.reason)
                     ctx.stdout(`  reason: ${body.reason}`);
                 if (body.currentRevision !== undefined) {
-                    ctx.stdout(`  the declaration is now at revision ${body.currentRevision} — run \`catalyst-skills environment read\` and propose again from that`);
+                    ctx.stdout(`  the declaration is now at revision ${body.currentRevision} — run \`catalyst environment read\` and propose again from that`);
                 }
             }
             return 1;
@@ -144,14 +144,14 @@ export async function cmdEnvironment(args, ctx, deps = {}) {
             if (args.json)
                 ctx.stdout(JSON.stringify(body));
             else if (body.status !== "unchanged")
-                ctx.stdout("not delivered until it is approved: catalyst-skills environment approve");
+                ctx.stdout("not delivered until it is approved: catalyst environment approve");
             return 0;
         }
         // ⭐ Approve exactly what propose just returned. The whole point of the CAS is that the approver
         // saw the revision they are approving, and nothing here has to be copied by a human or a model.
         const state = body.state;
         if (!state) {
-            ctx.stderr("the cloud returned no state to approve — run: catalyst-skills environment read");
+            ctx.stderr("the cloud returned no state to approve — run: catalyst environment read");
             return 1;
         }
         const approved = await approveExact(api, routes, state.revision, state.canonicalHash);
@@ -172,7 +172,7 @@ export async function cmdEnvironment(args, ctx, deps = {}) {
     if (revision === undefined || hash === undefined) {
         const current = (await readState(api, routes)).current;
         if (current === null || current === undefined) {
-            ctx.stdout("there is no declaration to approve — propose one first: catalyst-skills environment propose --file <path>");
+            ctx.stdout("there is no declaration to approve — propose one first: catalyst environment propose --file <path>");
             return 1;
         }
         revision = current.revision;

package/dist/events.js

@@ -71,7 +71,7 @@ export async function cmdEvents(args, ctx, deps = {}) {
         if (controller.signal.aborted)
             return sub === "wait-for" ? 1 : 0;
         if (error.code === "ENOENT")
-            throw new CliError(`event cache is absent at ${directory} — start it with: catalyst-skills replica start --detach`, "events-absent", 3);
+            throw new CliError(`event cache is absent at ${directory} — start it with: catalyst replica start --detach`, "events-absent", 3);
         throw error;
     }
     finally {