@crewx/cli 0.9.0-rc.8 → 0.9.0-rc.80

package/dist/commands/execute.js

@@ -6,6 +6,7 @@
  * Flags:
  *   --thread <name>          Conversation thread name
  *   --provider <cli/xxx>     Provider override
+ *   --model <name>           Model override (e.g. claude-sonnet-5)
  *   --metadata <json>        Extra metadata JSON (double-quoted object). Propagated to events/hooks/tracing.
  *                           e.g. --metadata='{"workflow_id":"wf-1"}'
  *   --verbose                Debug output mode (default: raw agent response only)
@@ -13,6 +14,9 @@
  *   --output-format <fmt>    Output format (json|text|stream-json)
  *   --effort <level>         Model effort (high|medium|low)
  *   -f/--prompt-file <path>  Read task body from file (bypasses cmd.exe argv truncation)
+ *   --detach                 Re-spawn as a detached runner; print task-id and exit 0 immediately.
+ *                           Ignored when CREWX_TRACE_ID is already set (recursive-spawn guard) or
+ *                           on win32 (unsupported — exits with an error).
  *
  * Stdin support:
  *   Pipe or redirect content into crewx x to supply the task body via stdin.
@@ -21,12 +25,72 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleExecute = handleExecute;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const os_1 = require("os");
 const sdk_1 = require("@crewx/sdk");
 const parse_agent_message_1 = require("./parse-agent-message");
 const parse_common_flags_1 = require("./parse-common-flags");
 const resolve_prompt_1 = require("./resolve-prompt");
 const crewx_cli_1 = require("../bootstrap/crewx-cli");
 const inherited_trace_1 = require("../utils/inherited-trace");
+const write_output_1 = require("./write-output");
+/**
+ * Split `--detach` out of argv, respecting the `--` literal-args sentinel
+ * (a `--detach` appearing after `--` is message text, not the flag).
+ */
+function extractDetachFlag(args) {
+    const rest = [];
+    let detach = false;
+    let escapeMode = false;
+    for (const arg of args) {
+        if (!escapeMode && arg === '--') {
+            escapeMode = true;
+            rest.push(arg);
+            continue;
+        }
+        if (!escapeMode && arg === '--detach') {
+            detach = true;
+            continue;
+        }
+        rest.push(arg);
+    }
+    return { detach, rest };
+}
+/**
+ * Double-detach: re-spawn this same CLI entry (minus --detach) as a detached
+ * process so it survives the parent's exit. The task-id is pre-generated here
+ * and injected as CREWX_TRACE_ID so the runner's own task row is created under
+ * this id (see handleExecute's `selfTaskId` derivation below) — it doubles as
+ * both this task's row id and the root of any further delegation it spawns.
+ *
+ * stdout contract (script-parseable): task-id only, on the first line.
+ * Everything else goes to stderr.
+ */
+function runDetached(filteredArgs) {
+    const taskId = (0, sdk_1.generateId)('tsk');
+    const logDir = (0, path_1.join)((0, os_1.homedir)(), '.crewx', 'logs');
+    if (!(0, fs_1.existsSync)(logDir))
+        (0, fs_1.mkdirSync)(logDir, { recursive: true });
+    const logPath = (0, path_1.join)(logDir, `${taskId}.log`);
+    const logFd = (0, fs_1.openSync)(logPath, 'a');
+    const entry = process.argv[1];
+    const child = (0, child_process_1.spawn)(process.execPath, [entry, 'x', ...filteredArgs], {
+        detached: true,
+        stdio: ['ignore', logFd, logFd],
+        env: { ...process.env, CREWX_TRACE_ID: taskId },
+    });
+    (0, fs_1.closeSync)(logFd);
+    child.on('error', (err) => {
+        process.stderr.write(`Failed to spawn detached runner: ${err.message}\n`);
+    });
+    child.unref();
+    console.log(taskId);
+    process.stderr.write(`Detached task ${taskId} started (log: ${logPath}).\n`);
+    process.stderr.write(`Use \`crewx result ${taskId} --wait=N\` to wait for completion.\n`);
+    process.exit(0);
+}
 /**
  * Handle `crewx execute <agentRef> <message>` command.
  *
@@ -34,7 +98,26 @@ const inherited_trace_1 = require("../utils/inherited-trace");
  * --verbose: debug info written to stderr, response to stdout.
  */
 async function handleExecute(args) {
-    const { thread, provider, metadata, verbose, config, outputFormat, effort, promptFile, overdrive, vars, rest } = (0, parse_common_flags_1.parseCommonFlags)(args);
+    const { detach, rest: detachFilteredArgs } = extractDetachFlag(args);
+    if (detach) {
+        // Recursive-spawn guard: a CREWX_TRACE_ID already present means this
+        // process is itself running inside a traced context (either the
+        // respawned runner, or a delegated sub-call) — never chain a second
+        // detach off of it. Silently fall through to normal (synchronous) execution.
+        if (process.env['CREWX_TRACE_ID']) {
+            process.stderr.write('Note: --detach ignored (already running inside a traced context; CREWX_TRACE_ID is set).\n');
+        }
+        else if (process.platform === 'win32') {
+            console.error('Error: --detach is not supported on win32.');
+            process.exit(1);
+            return;
+        }
+        else {
+            runDetached(detachFilteredArgs);
+            return;
+        }
+    }
+    const { thread, provider, model, metadata, verbose, config, outputFormat, effort, promptFile, overdrive, vars, out, rest } = (0, parse_common_flags_1.parseCommonFlags)(detachFilteredArgs);
     const { agentRef: parsedAgentRef, message } = (0, parse_agent_message_1.parseAgentMessage)(rest);
     // No @mention → default to @crewx agent (matches cli-bak behaviour)
     const agentRef = parsedAgentRef || '@crewx';
@@ -55,6 +138,7 @@ async function handleExecute(args) {
         console.error('Options:');
         console.error('  --thread <name>           Conversation thread name');
         console.error('  --provider <cli/xxx>      Provider override');
+        console.error('  --model <name>            Model override (e.g. claude-sonnet-5)');
         console.error('  --metadata <json>         Extra metadata (JSON object, double-quoted).');
         console.error('                            Propagated to events/hooks/tracing.');
         console.error('                            Invalid JSON aborts with exit code 2.');
@@ -62,6 +146,7 @@ async function handleExecute(args) {
         console.error('  --verbose                 Debug output mode');
         console.error('  --config/-c <path>        Config file path');
         console.error('  --output-format <fmt>     Output format (json|text|stream-json)');
+        console.error('  --out/-o <path>           Save result to file (stdout suppressed)');
         console.error('  --effort <level>          Model effort (high|medium|low)');
         console.error('  -f/--prompt-file <path>   Read task body from file');
         console.error('  --var key=value           Template variable (repeatable)');
@@ -80,6 +165,8 @@ async function handleExecute(args) {
             process.stderr.write(`🔗 Thread: ${thread}\n`);
         if (provider)
             process.stderr.write(`🔌 Provider: ${provider}\n`);
+        if (model)
+            process.stderr.write(`🧠 Model: ${model}\n`);
         if (outputFormat)
             process.stderr.write(`📄 Output-format: ${outputFormat}\n`);
         if (effort)
@@ -97,20 +184,32 @@ async function handleExecute(args) {
         process.stderr.write(`Error: ${msg}\n`);
         process.exit(2);
     }
+    const inheritedTrace = (0, inherited_trace_1.readInheritedTrace)();
+    // A trace with a rootTraceId but no parentTaskId means the id was pre-assigned
+    // to *this* task itself (the detach runner's parent injects only CREWX_TRACE_ID,
+    // never CREWX_PARENT_TASK_ID — see execute.ts's runDetached), not inherited from
+    // an ancestor task in a delegation chain (which always carries both). It doubles
+    // as this task's own row id so `crewx result <task-id>` can find it.
+    const selfTaskId = inheritedTrace && !inheritedTrace.parentTaskId
+        ? (inheritedTrace.rootTraceId || undefined)
+        : undefined;
     let exitCode = 0;
     try {
         const result = await crewx.execute(agentRef, finalMessage, {
             provider,
+            model,
             effort: effort || undefined,
             overdrive: overdrive || undefined,
             threadId: thread,
+            taskId: selfTaskId,
             metadata: Object.keys(parsedMetadata).length > 0 ? parsedMetadata : undefined,
             vars: Object.keys(vars).length > 0 ? vars : undefined,
-            trace: (0, inherited_trace_1.readInheritedTrace)(),
+            trace: inheritedTrace,
         });
         if (!result.ok) {
             const errMsg = result.error?.message ?? 'Execute failed';
             console.error(errMsg);
+            (0, write_output_1.appendError)(out, errMsg);
             exitCode = 1;
         }
         else {
@@ -123,7 +222,7 @@ async function handleExecute(args) {
                 process.stderr.write('\n📄 Response:\n');
                 process.stderr.write('─'.repeat(40) + '\n');
             }
-            console.log(result.data);
+            (0, write_output_1.writeResult)(out, result.data);
             if (verbose) {
                 process.stderr.write('\n✅ Execute completed successfully\n');
             }
@@ -132,6 +231,7 @@ async function handleExecute(args) {
     catch (err) {
         const errMsg = err instanceof Error ? err.message : String(err);
         console.error(`Error: ${errMsg}`);
+        (0, write_output_1.appendError)(out, `Error: ${errMsg}`);
         exitCode = 1;
     }
     finally {

package/dist/commands/init.js

@@ -52,6 +52,7 @@ const git = __importStar(require("isomorphic-git"));
 const nodeFs = __importStar(require("fs"));
 const os_1 = __importDefault(require("os"));
 const repository_1 = require("@crewx/sdk/repository");
+const sdk_1 = require("@crewx/sdk");
 const install_1 = require("./hook/install");
 const STATUSLINE_SCRIPT_NAME = 'claude-usage-statusline.js';
 const STATUSLINE_SCRIPT_MARKER = 'CrewX claude-usage-statusline';
@@ -84,6 +85,11 @@ const CREWX_MARKER = '# CrewX runtime';
 const CREWX_GITIGNORE = `# CrewX runtime
 .crewx/
 
+# Secrets (workspace .env — see docs/manual)
+.env
+.env.*
+!.env.example
+
 # Memory runtime state (regenerable from entries/)
 memory/*/.dirty-summary
 memory/*/graph.json
@@ -435,7 +441,7 @@ async function handleInit(opts) {
         }
     }
     // Always create docs dirs and templates, regardless of whether yaml was skipped
-    for (const dir of ['.crewx/logs', '.claude/commands', 'docs/goal', 'docs/daily', 'docs/wi']) {
+    for (const dir of ['.crewx/logs', '.claude/commands', 'docs/goal', 'docs/daily', 'docs/wi', 'workflows']) {
         try {
             (0, fs_1.mkdirSync)((0, path_1.join)(target, dir), { recursive: true });
         }
@@ -456,6 +462,21 @@ async function handleInit(opts) {
             console.log(`✅ ${t.dir}/ ${action} (${t.file})`);
         }
     }
+    try {
+        const workflowTemplatesDir = (0, sdk_1.resolveWorkflowTemplatesPath)();
+        for (const filename of [sdk_1.WI_DEFAULT_FLOW_FILENAME, sdk_1.WI_PLAN_FLOW_FILENAME]) {
+            const sourcePath = (0, path_1.join)(workflowTemplatesDir, filename);
+            const targetPath = (0, path_1.join)(target, 'workflows', filename);
+            if (force || !(0, fs_1.existsSync)(targetPath)) {
+                const action = (0, fs_1.existsSync)(targetPath) ? 'updated' : 'created';
+                (0, fs_1.copyFileSync)(sourcePath, targetPath);
+                console.log(`✅ workflows/ ${action} (${filename})`);
+            }
+        }
+    }
+    catch (e) {
+        errors.push(`WORKFLOW_TEMPLATE_FAILED:${e.message}`);
+    }
     // Always register workspace in ~/.crewx/crewx.db (best-effort, idempotent)
     let workspaceId;
     let slug;

package/dist/commands/log.js

@@ -10,6 +10,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleLog = handleLog;
+const sdk_1 = require("@crewx/sdk");
 const repository_1 = require("@crewx/sdk/repository");
 function statusIcon(status) {
     switch (status) {
@@ -36,10 +37,10 @@ async function handleLog(args) {
         console.log(`Status: ${statusIcon(task.status)} ${task.status}`);
         console.log(`Agent: ${task.agent_id ?? '—'}`);
         console.log(`Mode: ${task.mode ?? '—'}`);
-        console.log(`Started: ${new Date(task.started_at).toLocaleString()}`);
+        console.log(`Started: ${(0, sdk_1.formatDisplayTimestamp)(new Date(task.started_at))}`);
         if (task.completed_at) {
             const duration = new Date(task.completed_at).getTime() - new Date(task.started_at).getTime();
-            console.log(`Completed: ${new Date(task.completed_at).toLocaleString()} (${duration}ms)`);
+            console.log(`Completed: ${(0, sdk_1.formatDisplayTimestamp)(new Date(task.completed_at))} (${duration}ms)`);
         }
         console.log('='.repeat(60));
         console.log('');
@@ -78,7 +79,7 @@ async function handleLog(args) {
                 : 'running...';
             console.log(`${idx + 1}. ${icon} ${task.id}`);
             console.log(`   Agent: ${task.agent_id ?? '—'}  Mode: ${task.mode ?? '—'}`);
-            console.log(`   Started: ${new Date(task.started_at).toLocaleString()}`);
+            console.log(`   Started: ${(0, sdk_1.formatDisplayTimestamp)(new Date(task.started_at))}`);
             console.log(`   Duration: ${duration}`);
             console.log('');
         });

package/dist/commands/parse-common-flags.d.ts

@@ -2,7 +2,7 @@
  * Common flag parser for query/execute commands.
  *
  * Supports both `--flag=value` and `--flag value` forms.
- * Handles: --thread, --provider, --metadata, --verbose, --config/-c,
+ * Handles: --thread, --provider, --model, --metadata, --verbose, --config/-c,
  *          --output-format, --effort, --prompt-file/-f, --overdrive.
  *
  * Strict mode: unknown --xxx tokens after known flags are consumed throw an
@@ -14,6 +14,8 @@ export interface CommonFlags {
     thread?: string;
     /** Provider override (e.g., cli/claude). */
     provider?: string;
+    /** Model override (e.g., claude-sonnet-5). */
+    model?: string;
     /** Raw metadata JSON string. */
     metadata?: string;
     /** Enable verbose/debug output mode. */
@@ -28,6 +30,8 @@ export interface CommonFlags {
     promptFile?: string;
     /** Whether overdrive (boost) is active for this request. */
     overdrive: boolean;
+    /** Output file path for saving result (--out/-o). */
+    out?: string;
     /** Template variables from --var key=value flags. */
     vars: Record<string, string>;
     /** Remaining non-flag positional arguments. */

package/dist/commands/parse-common-flags.js

@@ -3,7 +3,7 @@
  * Common flag parser for query/execute commands.
  *
  * Supports both `--flag=value` and `--flag value` forms.
- * Handles: --thread, --provider, --metadata, --verbose, --config/-c,
+ * Handles: --thread, --provider, --model, --metadata, --verbose, --config/-c,
  *          --output-format, --effort, --prompt-file/-f, --overdrive.
  *
  * Strict mode: unknown --xxx tokens after known flags are consumed throw an
@@ -63,11 +63,13 @@ exports.UnknownOptionError = UnknownOptionError;
 function parseCommonFlags(args) {
     const thread = parseFlag(args, '--thread');
     const provider = parseFlag(args, '--provider');
+    const model = parseFlag(args, '--model');
     const metadata = parseFlag(args, '--metadata');
     const config = parseFlag(args, '--config', '-c');
     const outputFormat = parseFlag(args, '--output-format');
     const effort = parseFlag(args, '--effort');
     const promptFile = parseFlag(args, '--prompt-file', '-f');
+    const out = parseFlag(args, '--out', '-o');
     const verbose = hasFlag(args, '--verbose');
     const overdrive = hasFlag(args, '--overdrive');
     // Collect consumed positions for known flags
@@ -75,11 +77,13 @@ function parseCommonFlags(args) {
     const flagPairs = [
         { names: ['--thread'] },
         { names: ['--provider'] },
+        { names: ['--model'] },
         { names: ['--metadata'] },
         { names: ['--config', '-c'] },
         { names: ['--output-format'] },
         { names: ['--effort'] },
         { names: ['--prompt-file', '-f'] },
+        { names: ['--out', '-o'] },
     ];
     // Parse --var key=value flags (multiple allowed; last value wins on duplicate keys)
     const vars = {};
@@ -153,7 +157,7 @@ function parseCommonFlags(args) {
         }
         rest.push(token);
     }
-    return { thread, provider, metadata, verbose, config, outputFormat, effort, promptFile, overdrive, vars, rest };
+    return { thread, provider, model, metadata, verbose, config, outputFormat, effort, promptFile, overdrive, vars, out, rest };
 }
 /**
  * Parse metadata JSON string from --metadata flag.

package/dist/commands/ps.js

@@ -34,9 +34,9 @@ function isAgyCommand(codingAgentCommand) {
     const base = firstToken.split('/').pop() ?? firstToken;
     return base.startsWith('agy');
 }
-function getLastActive(task) {
+function getLastActive(task, taskRepo) {
     try {
-        const entries = task.logs ? JSON.parse(task.logs) : [];
+        const entries = taskRepo.readLogsTail(task.id, 1)?.entries ?? [];
         if (Array.isArray(entries) && entries.length > 0) {
             const lastEntry = entries[entries.length - 1];
             const ts = lastEntry?.timestamp;
@@ -59,9 +59,9 @@ function getLastActive(task) {
     }
     return { display: '—', isoTimestamp: null, logCapable: true };
 }
-function taskToRow(task) {
+function taskToRow(task, taskRepo) {
     const elapsed = formatElapsed(Date.now() - new Date(task.started_at).getTime());
-    const lastActive = getLastActive(task);
+    const lastActive = getLastActive(task, taskRepo);
     return [
         task.id,
         task.agent_id ?? '—',
@@ -83,6 +83,7 @@ function renderTable(headers, rows) {
 }
 async function handlePs(args) {
     const repo = new repository_1.TaskRepository();
+    repo.reapRunningWorkflowTasks();
     const tasks = repo.getRunningTasks();
     if (tasks.length === 0) {
         console.log('No running tasks.');
@@ -90,7 +91,7 @@ async function handlePs(args) {
     }
     if (args.includes('--json')) {
         const withLastActive = tasks.map((task) => {
-            const lastActive = getLastActive(task);
+            const lastActive = getLastActive(task, repo);
             return {
                 ...task,
                 last_active_at: lastActive.isoTimestamp,
@@ -101,7 +102,7 @@ async function handlePs(args) {
         return;
     }
     const headers = ['TASK ID', 'AGENT', 'PID', 'ELAPSED', 'MODE', 'LAST ACTIVE'];
-    const rows = tasks.map(taskToRow);
+    const rows = tasks.map((task) => taskToRow(task, repo));
     renderTable(headers, rows);
     console.log(`\n  ${tasks.length} running task(s)`);
 }

package/dist/commands/publish.d.ts

@@ -0,0 +1 @@
+export declare function handlePublish(args: string[]): Promise<void>;

package/dist/commands/publish.js

@@ -0,0 +1,270 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handlePublish = handlePublish;
+/**
+ * crewx publish handler — thin CLI wrapper over @crewx/sdk/publish.
+ *
+ * Usage:
+ *   crewx publish [dir] [--dry-run] [--version <semver>] [--json] [--upload]
+ *
+ * All scanning, exclusion-rule judgment, secret detection, hashing, and
+ * tar.gz packing lives in @crewx/sdk/publish (planPublish / packTemplate).
+ * Submit+upload (WI-SHR-20260806-013) lives in the same package
+ * (uploadToMarketplace) for the same reason — see that module's header.
+ * This command only parses argv, forwards options, reads auth.json
+ * (read-only — see readAuthJson()'s own doc), and renders the result.
+ */
+const fs = __importStar(require("fs"));
+const publish_1 = require("@crewx/sdk/publish");
+const parse_common_flags_1 = require("./parse-common-flags");
+function parsePublishFlags(args) {
+    const flags = { dryRun: false, json: false, help: false, upload: false };
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--help' || arg === '-h') {
+            flags.help = true;
+            continue;
+        }
+        if (arg === '--dry-run') {
+            flags.dryRun = true;
+            continue;
+        }
+        if (arg === '--json') {
+            flags.json = true;
+            continue;
+        }
+        if (arg === '--upload') {
+            flags.upload = true;
+            continue;
+        }
+        if (arg === '--version') {
+            const value = args[i + 1];
+            if (value === undefined)
+                throw new parse_common_flags_1.UnknownOptionError('--version requires a value');
+            flags.version = value;
+            i++;
+            continue;
+        }
+        if (arg.startsWith('--version=')) {
+            flags.version = arg.slice('--version='.length);
+            continue;
+        }
+        if (arg.startsWith('-')) {
+            throw new parse_common_flags_1.UnknownOptionError(`Unknown option: ${arg}`);
+        }
+        if (flags.dir === undefined) {
+            flags.dir = arg;
+            continue;
+        }
+        throw new parse_common_flags_1.UnknownOptionError(`Unknown option: ${arg}`);
+    }
+    return flags;
+}
+function resolveWorkspaceDir(flags) {
+    return flags.dir ?? process.env['CREWX_WORKSPACE'] ?? process.cwd();
+}
+function printJson(payload) {
+    console.log(JSON.stringify(payload));
+}
+/** Prints the error and exits 1. Never returns (matches `process.exit`'s `never` type). */
+function failWithError(err, json) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (json) {
+        printJson({ success: false, error: message });
+    }
+    else {
+        console.error(`✗ ${message}`);
+    }
+    process.exit(1);
+}
+function printHelp() {
+    console.log(`
+crewx publish — package a workspace as a distributable template archive
+
+Usage:
+  crewx publish [dir] [--dry-run] [--version <semver>] [--json] [--upload]
+
+Arguments:
+  dir              Workspace to publish (default: $CREWX_WORKSPACE or cwd)
+
+Options:
+  --dry-run        Scan + build manifest only; do not write a .tgz
+  --version <ver>  Override manifest version (semver, e.g. 1.0.0)
+  --json           Print machine-readable JSON to stdout
+  --upload         Submit + upload the packed archive to marketplace
+                    (requires CREWX_MARKETPLACE_URL and a prior login;
+                    ignored when combined with --dry-run)
+  --help, -h       Show this help
+
+Notes:
+  Without --upload, this command only scans the workspace, applies
+  exclusion rules, checks for secrets, and packs a local
+  .crewx/publish/<name>-<version>.tgz archive.
+`.trim());
+}
+/** CREWX_MARKETPLACE_URL — same env var name as the server's MARKETPLACE_DISABLED check, never a second name. */
+function requireMarketplaceUrl() {
+    const url = process.env['CREWX_MARKETPLACE_URL'];
+    if (!url) {
+        throw new Error('publish: [E_ENV_MISSING] CREWX_MARKETPLACE_URL is not set — this environment variable is required for upload');
+    }
+    return url;
+}
+async function handlePublish(args) {
+    const flags = parsePublishFlags(args);
+    if (flags.help) {
+        printHelp();
+        return;
+    }
+    const dir = resolveWorkspaceDir(flags);
+    process.stderr.write(`[publish] scanning ${dir}...\n`);
+    let plan;
+    try {
+        plan = await (0, publish_1.planPublish)(dir, { version: flags.version });
+    }
+    catch (err) {
+        failWithError(err, flags.json);
+    }
+    if (plan.secretFindings.length > 0) {
+        if (flags.json) {
+            printJson({ success: false, error: 'secret findings detected', findings: plan.secretFindings });
+        }
+        else {
+            console.error('✗ secret findings detected — publish aborted');
+            for (const f of plan.secretFindings) {
+                console.error(`  ${f.path}:${f.line} (${f.rule})`);
+            }
+        }
+        process.exit(1);
+    }
+    if (flags.dryRun) {
+        if (flags.json) {
+            printJson({
+                success: true,
+                dryRun: true,
+                workspace: dir,
+                manifest: plan.manifest,
+                included: plan.included,
+                excluded: plan.excluded,
+            });
+        }
+        else {
+            console.log('✓ dry-run — no archive written');
+            console.log(`  workspace: ${dir}`);
+            console.log(`  name: ${plan.manifest.name}  version: ${plan.manifest.version}`);
+            console.log(`  included: ${plan.included.length} files`);
+            console.log(`  excluded: ${plan.excluded.length} entries`);
+            for (const e of plan.excluded) {
+                console.log(`    ${e.path} (${e.rule})`);
+            }
+        }
+        return;
+    }
+    // Resolved before packing (not after) so a doomed --upload run (no
+    // marketplace url / no session) never writes a stray .tgz to the
+    // workspace — WI-SHR-20260806-013 AC-U5.
+    let marketplaceUrl = '';
+    let accessToken = '';
+    if (flags.upload) {
+        try {
+            marketplaceUrl = requireMarketplaceUrl();
+            accessToken = (0, publish_1.readAuthJson)().access_token;
+        }
+        catch (err) {
+            if (err instanceof Error && !err.message.startsWith('publish: [')) {
+                failWithError(new Error(`publish: [E_AUTH_EXPIRED] Authentication is missing or expired — please log in again — ${err.message}`), flags.json);
+            }
+            failWithError(err, flags.json);
+        }
+    }
+    process.stderr.write(`[publish] packing ${plan.manifest.name}@${plan.manifest.version}...\n`);
+    let packed;
+    try {
+        packed = await (0, publish_1.packTemplate)(dir, { version: flags.version });
+    }
+    catch (err) {
+        failWithError(err, flags.json);
+    }
+    const fileCount = packed.manifest.files.length;
+    const totalBytes = fs.statSync(packed.tgzPath).size;
+    let uploadResult;
+    if (flags.upload) {
+        process.stderr.write(`[publish] uploading ${packed.manifest.name}@${packed.manifest.version} to ${marketplaceUrl}...\n`);
+        try {
+            uploadResult = await (0, publish_1.uploadToMarketplace)({
+                tgzPath: packed.tgzPath,
+                manifest: packed.manifest,
+                baseUrl: marketplaceUrl,
+                accessToken,
+            });
+        }
+        catch (err) {
+            failWithError(err, flags.json);
+        }
+        process.stderr.write(`[publish] submit -> ${uploadResult.submitOutcome}\n`);
+    }
+    if (flags.json) {
+        printJson({
+            success: true,
+            tgzPath: packed.tgzPath,
+            fileCount,
+            totalBytes,
+            manifest: packed.manifest,
+            ...(uploadResult
+                ? {
+                    slug: uploadResult.slug,
+                    version: uploadResult.version,
+                    artifactChecksum: uploadResult.artifactChecksum,
+                    artifactSizeBytes: uploadResult.artifactSizeBytes,
+                    submitOutcome: uploadResult.submitOutcome,
+                    versionUpdate: uploadResult.versionUpdate,
+                    serverVersionBefore: uploadResult.serverVersionBefore,
+                }
+                : {}),
+        });
+    }
+    else {
+        console.log(`✓ packed: ${packed.tgzPath}`);
+        console.log(`  files: ${fileCount}  bytes: ${totalBytes}`);
+        if (uploadResult) {
+            console.log(`✓ uploaded: ${uploadResult.slug}@${uploadResult.version} (${uploadResult.submitOutcome})`);
+            console.log(`  artifactChecksum: ${uploadResult.artifactChecksum}  artifactSizeBytes: ${uploadResult.artifactSizeBytes}`);
+        }
+    }
+    if (!flags.upload) {
+        console.error('⚠ To upload, use --upload — check the generated file path');
+    }
+}

package/dist/commands/query.d.ts

@@ -5,6 +5,7 @@
  * Flags:
  *   --thread <name>          Conversation thread name
  *   --provider <cli/xxx>     Provider override
+ *   --model <name>           Model override (e.g. claude-sonnet-5)
  *   --metadata <json>        Extra metadata JSON (double-quoted object). Propagated to events/hooks/tracing.
  *                           e.g. --metadata='{"workflow_id":"wf-1"}'
  *   --verbose                Debug output mode (default: raw agent response only)