@dam-agents/cli 0.2.1-rc3 → 0.2.2-rc1

package/dist/bin.js

@@ -25484,6 +25484,11 @@ var agentCreateInputSchema = external_exports.object({
   description: external_exports.string().optional(),
   env: external_exports.array(envVarSchema).max(64).optional(),
   secretRef: external_exports.string().optional(),
+  registryCredential: external_exports.object({
+    server: external_exports.string().min(1),
+    username: external_exports.string().min(1),
+    password: external_exports.string().min(1)
+  }).optional(),
   allowedUserEmails: external_exports.array(external_exports.email()).optional(),
   egressPreset: egressPresetSchema.optional(),
   // Optional: clone this public repo (optionally a branch/tag via `ref`) into
@@ -25877,14 +25882,16 @@ var egressInjectContribution = external_exports.object({
   pathPattern: external_exports.string().optional(),
   headerName: external_exports.string().min(1),
   valueFormat: external_exports.string().min(1),
-  encoding: external_exports.literal("basic-x-access-token").optional()
+  encoding: external_exports.literal("basic-x-access-token").optional(),
+  // Moves the value into this query param instead of the header; restricted to unreserved chars since the Lua treats it as a trusted literal.
+  queryParamName: external_exports.string().regex(/^[A-Za-z0-9_.~-]+$/).optional()
 });
 var fileContribution = external_exports.object({
   kind: external_exports.literal("file"),
   path: external_exports.string().min(1),
   format: fileFormat,
   mergeMode,
-  content: external_exports.unknown()
+  content: external_exports.unknown().optional()
 });
 var mcpEntryContribution = external_exports.object({
   kind: external_exports.literal("mcp-entry"),
@@ -26071,7 +26078,11 @@ var templateInput = external_exports.object({
   name: external_exports.string(),
   state: templateInputState,
   presetValue: external_exports.string().optional(),
-  secret: external_exports.boolean().optional()
+  secret: external_exports.boolean().optional(),
+  // Marks a config input the form packs into `configInputs` rather than the typed auth fields.
+  configInput: external_exports.boolean().optional(),
+  label: external_exports.string().optional(),
+  hint: external_exports.string().optional()
 });
 var connectionTemplateView = external_exports.object({
   id: external_exports.string(),
@@ -26145,6 +26156,8 @@ var headerCreateInput = external_exports.object({
     /^[A-Za-z_][A-Za-z0-9_]*$/,
     "env var name must be letters, digits, and underscores (not starting with a digit)"
   ).optional(),
+  // Values for the template's declared config inputs, keyed by input name.
+  configInputs: external_exports.record(external_exports.string(), external_exports.string()).optional(),
   value: external_exports.string().min(1)
 });
 var noneCreateInput = external_exports.object({
@@ -26332,6 +26345,27 @@ var approvalListForOwnerInputSchema = approvalListOptionsSchema.optional();
 var approvalListForInstanceInputSchema = approvalListOptionsSchema.extend({
   agentId: external_exports.string().min(1)
 });
+var approvalActionRuleSchema = external_exports.object({
+  host: external_exports.string(),
+  method: external_exports.string(),
+  pathPattern: external_exports.string(),
+  verdict: external_exports.enum(["allow", "deny"])
+});
+var approvalActionOutcomeSchema = external_exports.object({
+  outcome: external_exports.enum(["applied", "rule_written_expired", "not_actionable"]),
+  rule: approvalActionRuleSchema.nullable()
+});
+
+// ../api-server-api/src/modules/approvals/format.ts
+function describeApprovalPayload(payload) {
+  if (payload.kind === "ext_authz") {
+    return {
+      title: `${payload.method} ${payload.host}`,
+      subtitle: payload.path
+    };
+  }
+  return { title: payload.toolName ?? "tool call", subtitle: "" };
+}
 
 // ../api-server-api/src/modules/egress-rules/format.ts
 function formatEgressRuleSource(source) {
@@ -26461,6 +26495,32 @@ var e2ePerformFetchInputSchema = external_exports.object({
   headers: external_exports.record(external_exports.string(), external_exports.string()).optional()
 }).strict();
 
+// ../api-server-api/src/modules/api-keys/schemas.ts
+var AGENT_SCOPES = [
+  "agents:read",
+  "agents:operate",
+  "agents:manage"
+];
+var CREDENTIAL_SCOPES = [
+  "credentials:read",
+  "credentials:manage"
+];
+var ALL_SCOPES = [...AGENT_SCOPES, ...CREDENTIAL_SCOPES];
+var scopeSchema = external_exports.enum(ALL_SCOPES);
+var agentBindingSchema = external_exports.union([
+  external_exports.literal("*"),
+  external_exports.array(external_exports.string().min(1)).min(1).max(256).transform((arr) => Array.from(new Set(arr)))
+]);
+var apiKeyCreateInputSchema = external_exports.object({
+  name: external_exports.string().min(1).max(100),
+  scopes: external_exports.array(scopeSchema).min(1).transform((arr) => Array.from(new Set(arr))),
+  agentIds: agentBindingSchema.default("*"),
+  expiresAt: external_exports.string().datetime().nullable().optional()
+});
+var apiKeyRevokeInputSchema = external_exports.object({
+  id: external_exports.string().min(1)
+});
+
 // src/result.ts
 var ok2 = (value) => ({ ok: true, value });
 var err2 = (error51) => ({ ok: false, error: error51 });
@@ -26682,6 +26742,7 @@ var EXIT_AUTH_STATUS_NO_VALID = 4;
 var EXIT_AGENT_NOT_RESOLVED = 5;
 var EXIT_RULE_NOT_FOUND = 6;
 var EXIT_AGENT_NOT_REACHABLE = 7;
+var EXIT_APPROVAL_NOT_ACTIONABLE = 8;
 var EXIT_SIGINT = 130;
 
 // src/modules/agent/commands/errors.ts
@@ -28607,6 +28668,14 @@ async function runDelete(ref, opts, deps) {
   process.exit(EXIT_SUCCESS);
 }
 
+// src/modules/shared/stdout.ts
+async function writeStdoutAndExit(data, exitCode) {
+  await new Promise((resolve4) => {
+    process.stdout.write(data, () => resolve4());
+  });
+  process.exit(exitCode);
+}
+
 // src/modules/agent/commands/get.ts
 function buildGetCommand(deps) {
   return new Command("get").description("Show one Agent's details, addressed by name or ID").argument("<ref>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
@@ -28631,12 +28700,13 @@ function buildGetCommand(deps) {
       process.exit(exitCodeForResolveError(result.error));
     }
     if (opts.json) {
-      process.stdout.write(`${JSON.stringify(result.value)}
-`);
-      process.exit(EXIT_SUCCESS);
+      return writeStdoutAndExit(
+        `${JSON.stringify(result.value)}
+`,
+        EXIT_SUCCESS
+      );
     }
-    process.stdout.write(renderAgent(result.value));
-    process.exit(EXIT_SUCCESS);
+    return writeStdoutAndExit(renderAgent(result.value), EXIT_SUCCESS);
   });
 }
 function renderAgent(agent) {
@@ -28677,6 +28747,28 @@ function renderTable(rows) {
     ).join("   ")
   ).join("\n") + "\n";
 }
+var COLUMN_GAP = 3;
+var MIN_FLEX_WIDTH = 20;
+var collapse = (s) => s.replace(/\s+/g, " ").trim();
+function truncate(s, max) {
+  return s.length <= max ? s : `${s.slice(0, Math.max(0, max - 1))}\u2026`;
+}
+function renderFittedTable(header, rows, flexCol = header.length - 1) {
+  let fixedWidth = 0;
+  for (let col = 0; col < header.length; col++) {
+    if (col === flexCol) continue;
+    const w3 = Math.max(header[col].length, ...rows.map((r) => r[col].length));
+    fixedWidth += w3 + COLUMN_GAP;
+  }
+  const columns = process.stdout.columns ?? 100;
+  const budget = Math.max(MIN_FLEX_WIDTH, columns - fixedWidth);
+  const clamped = rows.map(
+    (r) => r.map(
+      (cell, col) => col === flexCol ? truncate(collapse(cell), budget) : cell
+    )
+  );
+  return renderTable([[...header], ...clamped]);
+}
 
 // src/modules/agent/commands/list.ts
 function buildListCommand(deps) {
@@ -28700,9 +28792,11 @@ function buildListCommand(deps) {
       process.exit(EXIT_RUNTIME_FAILURE);
     }
     if (opts.json) {
-      process.stdout.write(`${JSON.stringify(result.value)}
-`);
-      process.exit(EXIT_SUCCESS);
+      return writeStdoutAndExit(
+        `${JSON.stringify(result.value)}
+`,
+        EXIT_SUCCESS
+      );
     }
     if (result.value.length === 0) {
       process.stderr.write(
@@ -28713,7 +28807,7 @@ function buildListCommand(deps) {
     const sorted = [...result.value].sort(
       (a, b2) => a.name.localeCompare(b2.name)
     );
-    process.stdout.write(
+    return writeStdoutAndExit(
       renderTable([
         ["NAME", "ID", "TEMPLATE", "STATE"],
         ...sorted.map((a) => [
@@ -28722,9 +28816,9 @@ function buildListCommand(deps) {
           a.templateId ?? "<custom>",
           a.state
         ])
-      ])
+      ]),
+      EXIT_SUCCESS
     );
-    process.exit(EXIT_SUCCESS);
   });
 }
 
@@ -28866,9 +28960,7 @@ function createAgentService(deps) {
   }
   return {
     async list() {
-      return trpcCall(
-        () => deps.trpc.agents.list.query()
-      );
+      return trpcCall(() => deps.trpc.agents.list.query());
     },
     async get(id) {
       try {
@@ -28933,6 +29025,294 @@ function composeAgentModule(opts) {
   return { commands: [parent], exports: { createService } };
 }
 
+// src/modules/approval/commands/outcome.ts
+function describeRule(rule) {
+  const hostWide = rule.method === "*" && rule.pathPattern === "*";
+  return `${hostWide ? "host-wide " : ""}egress rule (${formatEgressRuleInline(rule)})`;
+}
+function printOutcomeAndExit(outcome, opts, wording) {
+  const exitCode = outcome.outcome === "not_actionable" ? EXIT_APPROVAL_NOT_ACTIONABLE : EXIT_SUCCESS;
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(outcome)}
+`);
+    process.exit(exitCode);
+  }
+  switch (outcome.outcome) {
+    case "applied":
+      if (outcome.rule) {
+        process.stdout.write(
+          `${wording.pastTense} \u2014 wrote permanent ${describeRule(outcome.rule)}. It now appears in \`dam network list <agent>\`.
+`
+        );
+      } else if (opts.once) {
+        process.stdout.write(`${wording.onceLine}
+`);
+      } else {
+        process.stdout.write(
+          `${wording.pastTense} \u2014 verdict sent to the harness (tool-call permission; no egress rule involved).
+`
+        );
+      }
+      break;
+    case "rule_written_expired":
+      process.stdout.write(
+        `Held call already expired \u2014 wrote the durable ${outcome.rule ? describeRule(outcome.rule) : "egress rule"} anyway; ${wording.expiredEffect}
+`
+      );
+      break;
+    case "not_actionable":
+      process.stderr.write(
+        "error: approval not found or already settled. See `dam approval list --status all`.\n"
+      );
+      break;
+  }
+  process.exit(exitCode);
+}
+
+// src/modules/approval/commands/approve.ts
+function buildApproveCommand(deps) {
+  return new Command("approve").description("Approve a pending request from the inbox").argument("<id>", "approval id (copy from `dam approval list`)").option(
+    "--once",
+    "allow only this held call \u2014 the same request shape re-prompts next time"
+  ).option(
+    "--entire-host",
+    "allow the entire host (any method, any path); network requests only"
+  ).option(
+    "--server <url>",
+    "override the configured server URL for this call"
+  ).option("--json", "emit the raw action outcome as JSON").addHelpText(
+    "after",
+    "\nBare `approve` is durable: for a network (ext_authz) request it writes a\npermanent allow rule \u2014 egress to that host/method/path stays open and the rule\nappears in `dam network list <agent>`. Use --once to allow only the held call.\nTool-call (acp_native) approvals never write an egress rule; the harness owns\nits own permission persistence, and --entire-host falls back to the durable approve.\n"
+  ).action(
+    async (id, opts) => {
+      if (opts.once && opts.entireHost) {
+        process.stderr.write(
+          "error: --once and --entire-host are mutually exclusive\n"
+        );
+        process.exit(EXIT_INVALID_INPUT);
+      }
+      const host = await resolveActiveHost(deps, {
+        flag: opts.server ? { server: opts.server } : void 0,
+        exitCodes: {
+          runtimeFailure: EXIT_RUNTIME_FAILURE,
+          belowFloor: EXIT_BELOW_FLOOR
+        }
+      });
+      const service = deps.createApprovalService(host);
+      const result = await (opts.once ? service.approveOnce(id) : opts.entireHost ? service.approveHost(id) : service.approvePermanent(id));
+      if (!result.ok) {
+        printServiceError(result.error, host);
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      printOutcomeAndExit(result.value, opts, {
+        pastTense: "Approved",
+        onceLine: "Approved this call only \u2014 the same request shape will re-prompt next time.",
+        expiredEffect: "the next request of this shape passes."
+      });
+    }
+  );
+}
+
+// src/modules/approval/commands/deny.ts
+function buildDenyCommand(deps) {
+  return new Command("deny").description("Deny a pending request from the inbox").argument("<id>", "approval id (copy from `dam approval list`)").option(
+    "--once",
+    "deny only this held call \u2014 the same request shape re-prompts next time"
+  ).option(
+    "--server <url>",
+    "override the configured server URL for this call"
+  ).option("--json", "emit the raw action outcome as JSON").addHelpText(
+    "after",
+    "\nBare `deny` is durable: for a network (ext_authz) request it writes a\npermanent deny rule \u2014 future requests of that shape are blocked without\nprompting, and the rule appears in `dam network list <agent>`. Use --once to\ndeny only the held call. Tool-call (acp_native) denials never write an egress\nrule; the verdict goes to the harness.\n"
+  ).action(
+    async (id, opts) => {
+      const host = await resolveActiveHost(deps, {
+        flag: opts.server ? { server: opts.server } : void 0,
+        exitCodes: {
+          runtimeFailure: EXIT_RUNTIME_FAILURE,
+          belowFloor: EXIT_BELOW_FLOOR
+        }
+      });
+      const service = deps.createApprovalService(host);
+      const result = await (opts.once ? service.dismiss(id) : service.denyForever(id));
+      if (!result.ok) {
+        printServiceError(result.error, host);
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      printOutcomeAndExit(result.value, opts, {
+        pastTense: "Denied",
+        onceLine: "Denied this call only \u2014 re-prompts next time.",
+        expiredEffect: "future requests of this shape are blocked."
+      });
+    }
+  );
+}
+
+// src/modules/shared/relative-time.ts
+var MINUTE_MS = 6e4;
+var HOUR_MS = 36e5;
+var DAY_MS = 864e5;
+function formatRelative(iso, now) {
+  const diffMs = Date.parse(iso) - now.getTime();
+  const abs = Math.abs(diffMs);
+  const value = abs >= DAY_MS ? `${Math.floor(abs / DAY_MS)}d` : abs >= HOUR_MS ? `${Math.floor(abs / HOUR_MS)}h` : `${Math.max(1, Math.floor(abs / MINUTE_MS))}m`;
+  return diffMs >= 0 ? `in ${value}` : `${value} ago`;
+}
+
+// src/modules/approval/commands/list.ts
+function buildListCommand2(deps) {
+  return new Command("list").description(
+    "List the HITL approval inbox \u2014 requests your Agents are waiting on"
+  ).argument(
+    "[agent]",
+    "Agent Ref \u2014 name or 'agent-\u2026' ID; omit for all your Agents"
+  ).addOption(
+    new Option(
+      "--status <status>",
+      "filter by status; 'all' includes resolved and expired"
+    ).choices(["pending", "resolved", "expired", "all"]).default("pending")
+  ).option("--limit <n>", "maximum rows (1\u2013500)").option(
+    "--server <url>",
+    "override the configured server URL for this call"
+  ).option("--json", "emit raw JSON instead of the default table").addHelpText(
+    "after",
+    "\nExamples:\n  dam approval list\n  dam approval list my-agent --status all\n\n`dam network` manages the standing rules (pre-approvals that stop a prompt\nfrom appearing); `dam approval` actions the prompts that did appear.\n"
+  ).action(
+    async (ref, opts) => {
+      let limit;
+      if (opts.limit !== void 0) {
+        const n = Number(opts.limit);
+        if (!Number.isInteger(n) || n <= 0 || n > 500) {
+          process.stderr.write(
+            `error: invalid \`--limit\` value \`${opts.limit}\`; expected integer between 1 and 500
+`
+          );
+          process.exit(EXIT_INVALID_INPUT);
+        }
+        limit = n;
+      }
+      const host = await resolveActiveHost(deps, {
+        flag: opts.server ? { server: opts.server } : void 0,
+        exitCodes: {
+          runtimeFailure: EXIT_RUNTIME_FAILURE,
+          belowFloor: EXIT_BELOW_FLOOR
+        }
+      });
+      const listOpts = {
+        ...opts.status === "all" ? {} : { status: opts.status },
+        ...limit === void 0 ? {} : { limit }
+      };
+      const service = deps.createApprovalService(host);
+      let result;
+      if (ref === void 0) {
+        result = await service.listForOwner(listOpts);
+      } else {
+        const resolver = createAgentResolver({
+          agentService: deps.createAgentService(host)
+        });
+        const resolved = await resolver.resolve(ref);
+        if (!resolved.ok) {
+          printResolveError(resolved.error, host);
+          process.exit(exitCodeForResolveError(resolved.error));
+        }
+        result = await service.listForInstance(resolved.value.id, listOpts);
+      }
+      if (!result.ok) {
+        printServiceError(result.error, host);
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+      if (opts.json) {
+        return writeStdoutAndExit(
+          `${JSON.stringify(result.value)}
+`,
+          EXIT_SUCCESS
+        );
+      }
+      if (result.value.length === 0) {
+        process.stderr.write(
+          opts.status === "pending" ? "No pending approvals. Use --status all to include resolved and expired.\n" : `No ${opts.status === "all" ? "" : `${opts.status} `}approvals.
+`
+        );
+        process.exit(EXIT_SUCCESS);
+      }
+      const now = /* @__PURE__ */ new Date();
+      return writeStdoutAndExit(
+        renderFittedTable(
+          ["ID", "TYPE", "AGENT", "REQUEST", "STATUS", "EXPIRES"],
+          result.value.map((row) => {
+            const { title, subtitle } = describeApprovalPayload(row.payload);
+            return [
+              row.id,
+              row.type,
+              row.agentId,
+              title + (subtitle ? ` ${subtitle}` : ""),
+              row.status,
+              row.status === "pending" ? formatRelative(row.expiresAt, now) : "\u2014"
+            ];
+          }),
+          3
+        ),
+        EXIT_SUCCESS
+      );
+    }
+  );
+}
+
+// src/modules/approval/services/approval-service.ts
+function createApprovalService(deps) {
+  return {
+    async listForOwner(opts) {
+      return trpcCall(() => deps.trpc.approvals.listForOwner.query(opts));
+    },
+    async listForInstance(agentId, opts) {
+      return trpcCall(
+        () => deps.trpc.approvals.listForInstance.query({ agentId, ...opts })
+      );
+    },
+    async approveOnce(id) {
+      return trpcCall(() => deps.trpc.approvals.approveOnce.mutate({ id }));
+    },
+    async approvePermanent(id) {
+      return trpcCall(
+        () => deps.trpc.approvals.approvePermanent.mutate({ id })
+      );
+    },
+    async approveHost(id) {
+      return trpcCall(() => deps.trpc.approvals.approveHost.mutate({ id }));
+    },
+    async denyForever(id) {
+      return trpcCall(() => deps.trpc.approvals.denyForever.mutate({ id }));
+    },
+    async dismiss(id) {
+      return trpcCall(() => deps.trpc.approvals.dismiss.mutate({ id }));
+    }
+  };
+}
+
+// src/modules/approval/compose.ts
+function composeApprovalModule(opts) {
+  const buildTrpc = (host) => createTrpcClient({ host, tokenProvider: opts.tokenProvider });
+  const createService = (host) => createApprovalService({ trpc: buildTrpc(host) });
+  const agentScoped = {
+    compatService: opts.compatService,
+    configService: opts.configService,
+    createAgentService: opts.createAgentService,
+    createApprovalService: createService
+  };
+  const idScoped = {
+    compatService: opts.compatService,
+    configService: opts.configService,
+    createApprovalService: createService
+  };
+  const parent = new Command("approval").description(
+    "Action pending approvals \u2014 the HITL prompts your Agents are waiting on (see `dam network` for the standing rules)"
+  );
+  parent.addCommand(buildListCommand2(agentScoped));
+  parent.addCommand(buildApproveCommand(idScoped));
+  parent.addCommand(buildDenyCommand(idScoped));
+  return { commands: [parent] };
+}
+
 // src/modules/auth/commands/login.ts
 import { createInterface as createInterface3 } from "readline/promises";
 var EXIT_AUTH_SUCCESS_OR_ABORT = 0;
@@ -29220,6 +29600,154 @@ function printStatusError(e2) {
   }
 }
 
+// src/modules/auth/commands/token-create.ts
+function buildTokenCreateCommand(deps) {
+  return new Command("create").description(
+    "Mint a new API key. The plaintext token is printed once on stderr \u2014 copy it now, it cannot be recovered."
+  ).requiredOption("--name <name>", "human-readable label").option(
+    "--scope <scope...>",
+    `permission scope (${ALL_SCOPES.join(" | ")}); repeatable`
+  ).option(
+    "--agent <agent-id...>",
+    "restrict to specific Agent IDs (repeatable); defaults to all owned agents"
+  ).option(
+    "--expires <iso>",
+    "expiration timestamp in ISO 8601, e.g. 2026-12-31T00:00:00Z"
+  ).option("--json", "emit the result as JSON (still warns on stderr)").action(
+    async (opts) => {
+      const scopes = opts.scope ?? ["agents:operate"];
+      const parsedScopes = [];
+      for (const s of scopes) {
+        const r = scopeSchema.safeParse(s);
+        if (!r.success) {
+          process.stderr.write(
+            `error: unknown scope "${s}". Valid: ${ALL_SCOPES.join(", ")}
+`
+          );
+          process.exit(EXIT_INVALID_INPUT);
+        }
+        parsedScopes.push(r.data);
+      }
+      const resolved = await deps.configService.getResolved({});
+      if (!resolved.ok) {
+        process.stderr.write(
+          "error: no server configured; pass `--server <url>` or run `dam config set server <url>`\n"
+        );
+        process.exit(EXIT_INVALID_INPUT);
+      }
+      const trpc = deps.buildTrpc(resolved.value.server);
+      try {
+        const result = await trpc.apiKeys.create.mutate({
+          name: opts.name,
+          scopes: parsedScopes,
+          agentIds: opts.agent && opts.agent.length > 0 ? opts.agent : "*",
+          ...opts.expires ? { expiresAt: opts.expires } : {}
+        });
+        if (opts.json) {
+          process.stdout.write(
+            `${JSON.stringify({ ...result.key, plaintext: result.plaintext })}
+`
+          );
+        } else {
+          process.stderr.write(
+            "\u26A0 Copy this token now. It will never be shown again.\n"
+          );
+          process.stderr.write(`${result.plaintext}
+`);
+          process.stderr.write(`id: ${result.key.id}
+`);
+          process.stderr.write(`name: ${result.key.name}
+`);
+          process.stderr.write(`scopes: ${result.key.scopes.join(", ")}
+`);
+          const binding = result.key.agentIds === "*" ? "all owned agents" : result.key.agentIds.join(", ");
+          process.stderr.write(`agents: ${binding}
+`);
+          if (result.key.expiresAt)
+            process.stderr.write(`expires: ${result.key.expiresAt}
+`);
+        }
+      } catch (err3) {
+        process.stderr.write(
+          `error: ${err3 instanceof Error ? err3.message : String(err3)}
+`
+        );
+        process.exit(EXIT_RUNTIME_FAILURE);
+      }
+    }
+  );
+}
+
+// src/modules/auth/commands/token-list.ts
+function buildTokenListCommand(deps) {
+  return new Command("list").description(
+    "List API keys owned by the current user (plaintext never shown)"
+  ).option("--json", "emit raw JSON").action(async (opts) => {
+    const resolved = await deps.configService.getResolved({});
+    if (!resolved.ok) {
+      process.stderr.write(
+        "error: no server configured; pass `--server <url>` or run `dam config set server <url>`\n"
+      );
+      process.exit(EXIT_INVALID_INPUT);
+    }
+    const trpc = deps.buildTrpc(resolved.value.server);
+    try {
+      const keys = await trpc.apiKeys.list.query();
+      if (opts.json) {
+        process.stdout.write(`${JSON.stringify(keys)}
+`);
+        return;
+      }
+      if (keys.length === 0) {
+        process.stdout.write("(no api keys)\n");
+        return;
+      }
+      for (const k2 of keys) {
+        const binding = k2.agentIds === "*" ? "*" : k2.agentIds.join(",");
+        const exp = k2.expiresAt ? `exp=${k2.expiresAt}` : "exp=never";
+        const last = k2.lastUsedAt ? `last=${k2.lastUsedAt}` : "last=never";
+        process.stdout.write(
+          `${k2.id}	${k2.name}	[${k2.scopes.join(",")}]	agents=${binding}	${exp}	${last}
+`
+        );
+      }
+    } catch (err3) {
+      process.stderr.write(
+        `error: ${err3 instanceof Error ? err3.message : String(err3)}
+`
+      );
+      process.exit(EXIT_RUNTIME_FAILURE);
+    }
+  });
+}
+
+// src/modules/auth/commands/token-revoke.ts
+function buildTokenRevokeCommand(deps) {
+  return new Command("revoke").description(
+    "Revoke an API key by ID. The key is immediately rejected on the next request."
+  ).argument("<id>", "API key ID (e.g. key-abcdef12)").action(async (id) => {
+    const resolved = await deps.configService.getResolved({});
+    if (!resolved.ok) {
+      process.stderr.write(
+        "error: no server configured; pass `--server <url>` or run `dam config set server <url>`\n"
+      );
+      process.exit(EXIT_INVALID_INPUT);
+    }
+    const trpc = deps.buildTrpc(resolved.value.server);
+    try {
+      await trpc.apiKeys.revoke.mutate({ id });
+      process.stdout.write(`\u2713 Revoked ${id}
+`);
+    } catch (err3) {
+      process.stderr.write(
+        `error: ${err3 instanceof Error ? err3.message : String(err3)}
+`
+      );
+      process.exit(EXIT_RUNTIME_FAILURE);
+    }
+  });
+}
+
 // src/modules/auth/infrastructure/auth-config-probe.ts
 var authConfigSchema2 = external_exports.object({
   issuer: external_exports.string().min(1),
@@ -31686,6 +32214,29 @@ function composeAuthModule(opts) {
     })
   );
   authParent.addCommand(buildStatusCommand({ authService }));
+  const buildTrpc = (host) => createTrpcClient({ host, tokenProvider });
+  const tokenParent = new Command("token").description(
+    "Manage API keys for headless / CI use"
+  );
+  tokenParent.addCommand(
+    buildTokenCreateCommand({
+      configService: opts.configService,
+      buildTrpc
+    })
+  );
+  tokenParent.addCommand(
+    buildTokenListCommand({
+      configService: opts.configService,
+      buildTrpc
+    })
+  );
+  tokenParent.addCommand(
+    buildTokenRevokeCommand({
+      configService: opts.configService,
+      buildTrpc
+    })
+  );
+  authParent.addCommand(tokenParent);
   return {
     commands: [authParent],
     exports: { tokenProvider },
@@ -34188,7 +34739,7 @@ function createProcessEnvReader() {
 
 // src/modules/cli/infrastructure/package-version.ts
 function readPackageVersion() {
-  return true ? "0.2.1-rc3" : DEV_VERSION;
+  return true ? "0.2.2-rc1" : DEV_VERSION;
 }
 
 // src/modules/cli/infrastructure/version-probe.ts
@@ -34415,7 +34966,10 @@ function buildConnectCommand(deps) {
   ).option(
     "--auth <mode>",
     "MCP auth mode: oauth | none (default: auto-detect from the server)"
-  ).option("--url <url>", "input: url").option("--host <host>", "input: host").option("--client-id <id>", "input: OAuth client id").option("--client-secret <secret>", "input: OAuth client secret").option("--app-slug <slug>", "input: GitHub App slug").option("--header-name <name>", "input: header name").option("--value-format <format>", "input: header value format").option("--value <value>", "input: header secret value").option(
+  ).option("--url <url>", "input: url").option("--host <host>", "input: host").option("--client-id <id>", "input: OAuth client id").option("--client-secret <secret>", "input: OAuth client secret").option("--app-slug <slug>", "input: GitHub App slug").option("--header-name <name>", "input: header name").option("--value-format <format>", "input: header value format").option(
+    "--env-name <name>",
+    "input: expose the credential to the agent as this env var (custom header credentials)"
+  ).option("--value <value>", "input: header secret value").option(
     "--server <url>",
     "override the configured server URL for this call"
   ).option(
@@ -34664,12 +35218,20 @@ function buildPayload(template, name, values) {
     case "header": {
       const value = v2("value");
       if (!value) return { error: "the secret value is required (--value)" };
+      const configInputs = {};
+      for (const input of template.inputs) {
+        if (!input.configInput) continue;
+        const ov = v2(input.name);
+        if (ov) configInputs[input.name] = ov;
+      }
       return {
         ...common,
         authKind: "header",
         ...v2("host") ? { host: v2("host") } : {},
         ...v2("headerName") ? { headerName: v2("headerName") } : {},
         ...v2("valueFormat") ? { valueFormat: v2("valueFormat") } : {},
+        ...v2("envName") ? { envName: v2("envName") } : {},
+        ...Object.keys(configInputs).length > 0 ? { configInputs } : {},
         value
       };
     }
@@ -34752,7 +35314,8 @@ var FIELD_LABELS = {
   value: "Secret value",
   clientId: "Client ID",
   clientSecret: "Client secret",
-  appSlug: "GitHub App slug"
+  appSlug: "GitHub App slug",
+  envName: "Env var name"
 };
 function labelFor(key) {
   return FIELD_LABELS[key] ?? key;
@@ -34929,7 +35492,7 @@ function tableFor(views) {
     ])
   ]);
 }
-function buildListCommand2(deps) {
+function buildListCommand3(deps) {
   return new Command("list").description(
     "List team connections, or the connections granted to one Agent"
   ).argument("[agent]", "Agent Ref \u2014 name or 'agent-\u2026' ID (optional)").option(
@@ -34955,9 +35518,11 @@ function buildListCommand2(deps) {
           process.exit(EXIT_RUNTIME_FAILURE);
         }
         if (opts.json) {
-          process.stdout.write(`${JSON.stringify(result.value)}
-`);
-          process.exit(EXIT_SUCCESS);
+          return writeStdoutAndExit(
+            `${JSON.stringify(result.value)}
+`,
+            EXIT_SUCCESS
+          );
         }
         if (result.value.length === 0) {
           process.stderr.write(
@@ -34965,8 +35530,7 @@ function buildListCommand2(deps) {
           );
           process.exit(EXIT_SUCCESS);
         }
-        process.stdout.write(tableFor(result.value));
-        process.exit(EXIT_SUCCESS);
+        return writeStdoutAndExit(tableFor(result.value), EXIT_SUCCESS);
       }
       const resolver = createAgentResolver({
         agentService: deps.createAgentService(host)
@@ -34997,9 +35561,11 @@ function buildListCommand2(deps) {
         else missing.push(id);
       }
       if (opts.json) {
-        process.stdout.write(`${JSON.stringify(matched)}
-`);
-        process.exit(EXIT_SUCCESS);
+        return writeStdoutAndExit(
+          `${JSON.stringify(matched)}
+`,
+          EXIT_SUCCESS
+        );
       }
       if (matched.length === 0 && missing.length === 0) {
         process.stderr.write(
@@ -35008,13 +35574,15 @@ function buildListCommand2(deps) {
         );
         process.exit(EXIT_SUCCESS);
       }
-      if (matched.length > 0) process.stdout.write(tableFor(matched));
       if (missing.length > 0) {
         process.stderr.write(
           `note: ${missing.length} granted connection(s) no longer exist: ${missing.join(", ")}
 `
         );
       }
+      if (matched.length > 0) {
+        return writeStdoutAndExit(tableFor(matched), EXIT_SUCCESS);
+      }
       process.exit(EXIT_SUCCESS);
     }
   );
@@ -35153,15 +35721,16 @@ function buildTemplatesCommand(deps) {
     }
     const connectable = result.value.filter((t) => t.category !== "mcp");
     if (opts.json) {
-      process.stdout.write(`${JSON.stringify(connectable)}
-`);
-      process.exit(EXIT_SUCCESS);
+      return writeStdoutAndExit(
+        `${JSON.stringify(connectable)}
+`,
+        EXIT_SUCCESS
+      );
     }
-    process.stdout.write(tableFor2(connectable));
     process.stderr.write(
       "\nMCP servers are added by URL: dam connection connect https://your-mcp-server\n"
     );
-    process.exit(EXIT_SUCCESS);
+    return writeStdoutAndExit(tableFor2(connectable), EXIT_SUCCESS);
   });
 }
 
@@ -35175,14 +35744,10 @@ function createConnectionService(deps) {
   };
   return {
     async list() {
-      return trpcCall(
-        () => deps.trpc.connections.list.query()
-      );
+      return trpcCall(() => deps.trpc.connections.list.query());
     },
     async listTemplates() {
-      return trpcCall(
-        () => deps.trpc.connections.listTemplates.query()
-      );
+      return trpcCall(() => deps.trpc.connections.listTemplates.query());
     },
     async createConnection(input) {
       return trpcCall(() => deps.trpc.connections.create.mutate(input));
@@ -35196,11 +35761,7 @@ function createConnectionService(deps) {
       return trpcCall(() => deps.trpc.connections.discoverMcp.mutate({ url: url2 }));
     },
     async getConnection(id) {
-      return trpcCall(
-        () => deps.trpc.connections.get.query({
-          id
-        })
-      );
+      return trpcCall(() => deps.trpc.connections.get.query({ id }));
     },
     async agentConnectionIds(agentId) {
       return trpcCall(() => readIds(agentId));
@@ -35249,7 +35810,7 @@ function composeConnectionModule(opts) {
   const parent = new Command("connection").description(
     "Manage OAuth connections and agent connection grants"
   );
-  parent.addCommand(buildListCommand2(agentScoped));
+  parent.addCommand(buildListCommand3(agentScoped));
   parent.addCommand(
     buildTemplatesCommand({
       compatService: opts.compatService,
@@ -35413,7 +35974,7 @@ function buildCreateCommand2(deps) {
 }
 
 // src/modules/egress/commands/list.ts
-function buildListCommand3(deps) {
+function buildListCommand4(deps) {
   return new Command("list").description("List network access rules for an Agent").argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
     "--server <url>",
     "override the configured server URL for this call"
@@ -35442,9 +36003,11 @@ function buildListCommand3(deps) {
       process.exit(EXIT_RUNTIME_FAILURE);
     }
     if (opts.json) {
-      process.stdout.write(`${JSON.stringify(result.value)}
-`);
-      process.exit(EXIT_SUCCESS);
+      return writeStdoutAndExit(
+        `${JSON.stringify(result.value)}
+`,
+        EXIT_SUCCESS
+      );
     }
     if (result.value.length === 0) {
       process.stderr.write(
@@ -35460,7 +36023,7 @@ function buildListCommand3(deps) {
       if (m !== 0) return m;
       return a.pathPattern.localeCompare(b2.pathPattern);
     });
-    process.stdout.write(
+    return writeStdoutAndExit(
       renderTable([
         ["ID", "VERDICT", "METHOD", "HOST", "PATH", "SOURCE"],
         ...sorted.map((r) => [
@@ -35471,9 +36034,9 @@ function buildListCommand3(deps) {
           r.pathPattern,
           formatEgressRuleSource(r.source)
         ])
-      ])
+      ]),
+      EXIT_SUCCESS
     );
-    process.exit(EXIT_SUCCESS);
   });
 }
 
@@ -35572,14 +36135,10 @@ function buildTrustedHostsCommand(deps) {
       printServiceError(result.error, host);
       process.exit(EXIT_RUNTIME_FAILURE);
     }
-    if (opts.json) {
-      process.stdout.write(`${JSON.stringify(result.value)}
-`);
-    } else if (result.value.length > 0) {
-      process.stdout.write(`${result.value.join("\n")}
-`);
-    }
-    process.exit(EXIT_SUCCESS);
+    const out = opts.json ? `${JSON.stringify(result.value)}
+` : result.value.length > 0 ? `${result.value.join("\n")}
+` : "";
+    return writeStdoutAndExit(out, EXIT_SUCCESS);
   });
 }
 
@@ -35664,26 +36223,18 @@ function createEgressService(deps) {
     },
     async currentPreset(agentId) {
       return trpcCall(
-        () => deps.trpc.egressRules.currentPreset.query({
-          agentId
-        })
+        () => deps.trpc.egressRules.currentPreset.query({ agentId })
       );
     },
     async trustedHosts() {
-      return trpcCall(
-        () => deps.trpc.egressRules.trustedHosts.query()
-      );
+      return trpcCall(() => deps.trpc.egressRules.trustedHosts.query());
     },
     async create(input) {
-      return trpcCall(
-        () => deps.trpc.egressRules.create.mutate(input)
-      );
+      return trpcCall(() => deps.trpc.egressRules.create.mutate(input));
     },
     async update(input) {
       try {
-        const view = await deps.trpc.egressRules.update.mutate(
-          input
-        );
+        const view = await deps.trpc.egressRules.update.mutate(input);
         return ok2(view);
       } catch (e2) {
         if (e2?.data?.code === "NOT_FOUND") {
@@ -35723,7 +36274,7 @@ function composeEgressModule(opts) {
   const parent = new Command("network").description(
     "Manage per-Agent network access rules (the pre-approvals that let an Agent reach external hosts)"
   );
-  parent.addCommand(buildListCommand3(agentScoped));
+  parent.addCommand(buildListCommand4(agentScoped));
   parent.addCommand(buildCreateCommand2(agentScoped));
   parent.addCommand(buildUpdateCommand(idScoped));
   parent.addCommand(buildRevokeCommand2(idScoped));
@@ -35914,16 +36465,10 @@ function buildFileListCommand(deps) {
         printTrpcError(e2, host);
         process.exit(EXIT_RUNTIME_FAILURE);
       }
-      if (opts.json) {
-        process.stdout.write(`${JSON.stringify(entries)}
-`);
-      } else {
-        for (const e2 of entries) {
-          if (e2.type === "file") process.stdout.write(`${e2.path}
-`);
-        }
-      }
-      process.exit(EXIT_SUCCESS);
+      const out = opts.json ? `${JSON.stringify(entries)}
+` : entries.filter((e2) => e2.type === "file").map((e2) => `${e2.path}
+`).join("");
+      return writeStdoutAndExit(out, EXIT_SUCCESS);
     }
   );
 }
@@ -36467,25 +37012,6 @@ function statusFor(scanned, installed) {
 
 // src/modules/skill/commands/catalog.ts
 var byName = (a, b2) => a.name.localeCompare(b2.name);
-var COLUMN_GAP = 3;
-var MIN_DESCRIPTION = 20;
-var collapse = (s) => s.replace(/\s+/g, " ").trim();
-var truncate = (s, max) => s.length <= max ? s : `${s.slice(0, Math.max(0, max - 1))}\u2026`;
-function renderFittedTable(header, rows) {
-  const leadCount = header.length - 1;
-  let leadWidth = 0;
-  for (let col = 0; col < leadCount; col++) {
-    const w3 = Math.max(header[col].length, ...rows.map((r) => r[col].length));
-    leadWidth += w3 + COLUMN_GAP;
-  }
-  const columns = process.stdout.columns ?? 100;
-  const budget = Math.max(MIN_DESCRIPTION, columns - leadWidth);
-  const clamped = rows.map((r) => [
-    ...r.slice(0, -1),
-    truncate(collapse(r[r.length - 1]), budget)
-  ]);
-  return renderTable([[...header], ...clamped]);
-}
 function buildCatalogCommand(deps) {
   return new Command("catalog").description(
     "Scan a skill source's available skills; with --agent, annotate each skill's install status"
@@ -36572,36 +37098,40 @@ function buildCatalogCommand(deps) {
       const installed = installedRes !== null ? installedRes.value : void 0;
       if (installed === void 0) {
         if (opts.json) {
-          process.stdout.write(`${JSON.stringify(catalogRes.value)}
-`);
-          process.exit(EXIT_SUCCESS);
+          return writeStdoutAndExit(
+            `${JSON.stringify(catalogRes.value)}
+`,
+            EXIT_SUCCESS
+          );
         }
         const sorted2 = [...catalogRes.value].sort(byName);
-        process.stdout.write(
+        return writeStdoutAndExit(
           renderFittedTable(
             ["NAME", "DESCRIPTION"],
             sorted2.map((s) => [s.name, s.description])
-          )
+          ),
+          EXIT_SUCCESS
         );
-        process.exit(EXIT_SUCCESS);
       }
       const annotated = catalogRes.value.map((s) => ({
         ...s,
         status: statusFor(s, installed)
       }));
       if (opts.json) {
-        process.stdout.write(`${JSON.stringify(annotated)}
-`);
-        process.exit(EXIT_SUCCESS);
+        return writeStdoutAndExit(
+          `${JSON.stringify(annotated)}
+`,
+          EXIT_SUCCESS
+        );
       }
       const sorted = [...annotated].sort(byName);
-      process.stdout.write(
+      return writeStdoutAndExit(
         renderFittedTable(
           ["NAME", "STATUS", "DESCRIPTION"],
           sorted.map((s) => [s.name, s.status, s.description])
-        )
+        ),
+        EXIT_SUCCESS
       );
-      process.exit(EXIT_SUCCESS);
     }
   );
 }
@@ -36727,7 +37257,7 @@ function buildInstallCommand(deps) {
 // src/modules/skill/commands/list.ts
 var INSTALLED_HEADER = ["SOURCE", "NAME", "VERSION"];
 var STANDALONE_HEADER = ["NAME", "PUBLISHED"];
-function buildListCommand4(deps) {
+function buildListCommand5(deps) {
   return new Command("list").description("List the skills on an Agent \u2014 installed and standalone").argument("<agent>", "Agent Ref \u2014 name or 'agent-\u2026' ID").option(
     "--server <url>",
     "override the configured server URL for this call"
@@ -36765,9 +37295,8 @@ function buildListCommand4(deps) {
     }
     const state = stateRes.value;
     if (opts.json) {
-      process.stdout.write(`${JSON.stringify(state)}
-`);
-      process.exit(EXIT_SUCCESS);
+      return writeStdoutAndExit(`${JSON.stringify(state)}
+`, EXIT_SUCCESS);
     }
     if (state.installed.length === 0 && state.standalone.length === 0) {
       process.stderr.write(
@@ -36776,14 +37305,15 @@ function buildListCommand4(deps) {
       );
       process.exit(EXIT_SUCCESS);
     }
+    let out = "";
     if (state.installed.length > 0) {
-      renderInstalled(state.installed, sourcesRes.value);
+      out += renderInstalled(state.installed, sourcesRes.value);
     }
     if (state.standalone.length > 0) {
-      if (state.installed.length > 0) process.stdout.write("\n");
-      renderStandalone(state.standalone, state.instancePublishes);
+      if (out.length > 0) out += "\n";
+      out += renderStandalone(state.standalone, state.instancePublishes);
     }
-    process.exit(EXIT_SUCCESS);
+    return writeStdoutAndExit(out, EXIT_SUCCESS);
   });
 }
 function renderInstalled(installed, sources) {
@@ -36794,14 +37324,14 @@ function renderInstalled(installed, sources) {
     if (name === void 0) unresolved.add(r.source);
     return [name ?? r.source, r.name, r.version.slice(0, 7)];
   });
-  process.stdout.write("Installed skills:\n");
-  process.stdout.write(renderTable([INSTALLED_HEADER, ...rows]));
   if (unresolved.size > 0) {
     process.stderr.write(
       `note: ${unresolved.size} source(s) no longer registered, shown by URL: ${[...unresolved].join(", ")}
 `
     );
   }
+  return `Installed skills:
+${renderTable([INSTALLED_HEADER, ...rows])}`;
 }
 function renderStandalone(standalone, publishes) {
   const prByName = /* @__PURE__ */ new Map();
@@ -36814,8 +37344,8 @@ function renderStandalone(standalone, publishes) {
     }
   }
   const rows = [...standalone].sort((a, b2) => a.name.localeCompare(b2.name)).map((s) => [s.name, prByName.get(s.name) ?? "\u2014"]);
-  process.stdout.write("Standalone skills:\n");
-  process.stdout.write(renderTable([STANDALONE_HEADER, ...rows]));
+  return `Standalone skills:
+${renderTable([STANDALONE_HEADER, ...rows])}`;
 }
 function bySourceThenName(a, b2) {
   const s = a.source.localeCompare(b2.source);
@@ -37106,9 +37636,11 @@ function buildSourceListCommand(deps) {
         process.exit(EXIT_RUNTIME_FAILURE);
       }
       if (opts.json) {
-        process.stdout.write(`${JSON.stringify(result.value)}
-`);
-        process.exit(EXIT_SUCCESS);
+        return writeStdoutAndExit(
+          `${JSON.stringify(result.value)}
+`,
+          EXIT_SUCCESS
+        );
       }
       if (result.value.length === 0) {
         process.stderr.write(
@@ -37116,8 +37648,7 @@ function buildSourceListCommand(deps) {
         );
         process.exit(EXIT_SUCCESS);
       }
-      process.stdout.write(tableFor3(result.value));
-      process.exit(EXIT_SUCCESS);
+      return writeStdoutAndExit(tableFor3(result.value), EXIT_SUCCESS);
     }
   );
 }
@@ -37373,16 +37904,12 @@ function createSkillsService(deps) {
   return {
     async listSources(agentId) {
       return trpcCall(
-        () => deps.trpc.skills.sources.list.query(
-          agentId ? { agentId } : void 0
-        )
+        () => deps.trpc.skills.sources.list.query(agentId ? { agentId } : void 0)
       );
     },
     async addSource(input) {
       try {
-        const created = await deps.trpc.skills.sources.create.mutate(
-          input
-        );
+        const created = await deps.trpc.skills.sources.create.mutate(input);
         return ok2(created);
       } catch (e2) {
         if (e2?.data?.code === "CONFLICT") {
@@ -37437,15 +37964,11 @@ function createSkillsService(deps) {
       );
     },
     async state(agentId) {
-      return trpcCall(
-        async () => await deps.trpc.skills.state.query({ agentId })
-      );
+      return trpcCall(() => deps.trpc.skills.state.query({ agentId }));
     },
     async install(input) {
       try {
-        const refs = await deps.trpc.skills.install.mutate(
-          input
-        );
+        const refs = await deps.trpc.skills.install.mutate(input);
         return ok2(refs);
       } catch (e2) {
         return classifyWakeError(e2);
@@ -37453,9 +37976,7 @@ function createSkillsService(deps) {
     },
     async uninstall(input) {
       try {
-        const refs = await deps.trpc.skills.uninstall.mutate(
-          input
-        );
+        const refs = await deps.trpc.skills.uninstall.mutate(input);
         return ok2(refs);
       } catch (e2) {
         return classifyWakeError(e2);
@@ -37463,9 +37984,7 @@ function createSkillsService(deps) {
     },
     async publish(input) {
       try {
-        const result = await deps.trpc.skills.publish.mutate(
-          input
-        );
+        const result = await deps.trpc.skills.publish.mutate(input);
         return ok2(result);
       } catch (e2) {
         return classifyPublishError(e2);
@@ -37496,7 +38015,7 @@ function composeSkillModule(opts) {
   sourceGroup.addCommand(buildSourceRefreshCommand(shared));
   parent.addCommand(sourceGroup);
   parent.addCommand(buildCatalogCommand(shared));
-  parent.addCommand(buildListCommand4(shared));
+  parent.addCommand(buildListCommand5(shared));
   parent.addCommand(buildInstallCommand(shared));
   parent.addCommand(buildUninstallCommand(shared));
   parent.addCommand(buildPublishCommand(shared));
@@ -38061,7 +38580,7 @@ function composeSshModule(opts) {
 
 // src/modules/template/commands/list.ts
 var DESCRIPTION_MAX = 60;
-function buildListCommand5(deps) {
+function buildListCommand6(deps) {
   return new Command("list").description("List agent templates available on the active host").option(
     "--server <url>",
     "override the configured server URL for this call"
@@ -38082,9 +38601,11 @@ function buildListCommand5(deps) {
       process.exit(EXIT_RUNTIME_FAILURE);
     }
     if (opts.json) {
-      process.stdout.write(`${JSON.stringify(result.value)}
-`);
-      process.exit(EXIT_SUCCESS);
+      return writeStdoutAndExit(
+        `${JSON.stringify(result.value)}
+`,
+        EXIT_SUCCESS
+      );
     }
     if (result.value.length === 0) {
       process.stderr.write(
@@ -38095,7 +38616,7 @@ function buildListCommand5(deps) {
     const sorted = [...result.value].sort(
       (a, b2) => a.name.localeCompare(b2.name)
     );
-    process.stdout.write(
+    return writeStdoutAndExit(
       renderTable([
         ["NAME", "ID", "DESCRIPTION"],
         ...sorted.map((t) => [
@@ -38103,9 +38624,9 @@ function buildListCommand5(deps) {
           t.id,
           truncate2(t.description ?? "", DESCRIPTION_MAX)
         ])
-      ])
+      ]),
+      EXIT_SUCCESS
     );
-    process.exit(EXIT_SUCCESS);
   });
 }
 function truncate2(s, n) {
@@ -38144,7 +38665,7 @@ function composeTemplateModule(opts) {
     "Discover agent templates on the active host"
   );
   parent.addCommand(
-    buildListCommand5({
+    buildListCommand6({
       compatService: opts.compatService,
       configService: opts.configService,
       createTemplateService: createService
@@ -38205,6 +38726,12 @@ function compose(opts = {}) {
     compatService: cli.services.compatService,
     createAgentService: agent.exports.createService
   });
+  const approval = composeApprovalModule({
+    tokenProvider: auth.exports.tokenProvider,
+    configService: cli.services.configService,
+    compatService: cli.services.compatService,
+    createAgentService: agent.exports.createService
+  });
   const connection2 = composeConnectionModule({
     tokenProvider: auth.exports.tokenProvider,
     configService: cli.services.configService,
@@ -38235,6 +38762,7 @@ function compose(opts = {}) {
   for (const command of importModule.commands) program3.addCommand(command);
   for (const command of fileModule.commands) program3.addCommand(command);
   for (const command of egress.commands) program3.addCommand(command);
+  for (const command of approval.commands) program3.addCommand(command);
   for (const command of connection2.commands) program3.addCommand(command);
   for (const command of skill.commands) program3.addCommand(command);
   for (const command of ssh.commands) program3.addCommand(command);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dam-agents/cli",
   "author": "IBM Corp.",
-  "version": "0.2.1-rc3",
+  "version": "0.2.2-rc1",
   "type": "module",
   "license": "Apache-2.0",
   "homepage": "https://github.com/dam-agents/dam/tree/main/packages/cli#readme",
@@ -42,7 +42,7 @@
     "ws": "^8.20.0",
     "zod": "^4.4.3",
     "agent-runtime-api": "0.0.1",
-    "dev-config": "0.0.1",
-    "api-server-api": "0.0.1"
+    "api-server-api": "0.0.1",
+    "dev-config": "0.0.1"
   }
 }