@dayofweek/dcli 1.3.0 → 1.5.0

package/dist/bin/dcli.js

@@ -1,14 +1,16 @@
 #!/usr/bin/env node
 import { Command } from "commander";
-import { DayOfWeekClient } from "../client.js";
-import { getToken, getApiUrl, saveConfig, loadConfig } from "../config.js";
-import { readFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
-import { join, dirname } from "node:path";
+import { ApiError, DayOfWeekClient, toArrayBuffer } from "../client.js";
+import { getToken, getApiUrl, saveConfig, loadConfig, saveCredential, deleteCredential } from "../config.js";
+import { browserLogin } from "../auth/login.js";
+import { parseBrainResource } from "../uri.js";
+import { accessSync, constants, mkdirSync, readFileSync, existsSync, statSync, writeFileSync } from "node:fs";
+import { join, basename, resolve, relative, sep } from "node:path";
 import { homedir } from "node:os";
 import { createInterface } from "node:readline/promises";
-import { fileURLToPath } from "node:url";
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const pkg = JSON.parse(readFileSync(join(__dirname, "../../package.json"), "utf-8"));
+import pkg from "../../package.json" with { type: "json" };
+import { createHash } from "node:crypto";
+import { validateSkillBundle, writeSkillBundle } from "../skills.js";
 const program = new Command()
     .name("dcli")
     .description("CLI for the Day of Week AgTech platform")
@@ -30,25 +32,29 @@ const auth = program.command("auth").description("Authentication commands");
 auth
     .command("login")
     .description("Authenticate via browser")
-    .action(async () => {
+    .option("--scopes <scopes>", "Comma-separated scopes", "brain:read,brain:write")
+    .option("--source-app <sourceApp>", "Authorization client", "dcli")
+    .action(async (opts) => {
     const apiUrl = program.opts().apiUrl ?? getApiUrl();
-    const baseUrl = apiUrl.replace("/api/dcli", "");
-    const authUrl = `${baseUrl}/dcli/auth`;
-    console.log(`Opening browser for authentication...`);
-    console.log(`If the browser doesn't open, visit: ${authUrl}`);
-    const open = (await import("open")).default;
-    await open(authUrl);
-    console.log("\nAfter authenticating, copy the token and run:");
-    console.log("  export DCLI_AUTH_TOKEN=<your-token>");
-    console.log("  # or");
-    console.log("  dcli auth set-token <your-token>");
+    const scopes = opts.scopes.split(",").map((scope) => scope.trim()).filter(Boolean);
+    if (opts.sourceApp !== "dcli" && opts.sourceApp !== "dayofweek-desktop")
+        throw new Error("Invalid authorization client");
+    console.error("Opening Day of Week in your browser…");
+    const result = await browserLogin({ apiUrl, scopes, sourceApp: opts.sourceApp });
+    saveCredential(result.secret);
+    output({ authenticated: true, scopes: result.scopes, bootstrap: result.bootstrap });
 });
 auth
-    .command("set-token <token>")
-    .description("Save a token to local config")
-    .action((token) => {
-    saveConfig({ authToken: token });
-    console.log("Token saved to ~/.config/dayofweek/dcli.json");
+    .command("logout")
+    .description("Revoke and remove the credential from this device")
+    .action(async () => {
+    if (program.opts().token || process.env.DCLI_AUTH_TOKEN || process.env.DCLI_TOKEN) {
+        throw new Error("Unset the token override before logging out this device");
+    }
+    const client = new DayOfWeekClient(getToken(), getApiUrl());
+    await client.revokeCurrentDevice();
+    deleteCredential();
+    output({ authenticated: false, loggedOut: true, revoked: true });
 });
 auth
     .command("status")
@@ -56,12 +62,24 @@ auth
     .action(async () => {
     try {
         const client = getClient();
-        const result = await client.checkAuth();
+        let result;
+        try {
+            result = await client.brainBootstrap();
+        }
+        catch (error) {
+            if (!(error instanceof ApiError) || error.code !== "scope_denied")
+                throw error;
+            result = await client.checkAuth();
+        }
         // Persist isAdmin so the next CLI invocation can register admin
         // subcommands in --help without a network round-trip. Stale cache
         // is harmless: admin commands still reject non-admin tokens at the
         // API boundary, and admin demotion is rare.
-        if (result.authenticated && typeof result.isAdmin === "boolean") {
+        if (typeof result === "object" &&
+            result !== null &&
+            "authenticated" in result &&
+            "isAdmin" in result &&
+            typeof result.isAdmin === "boolean") {
             saveConfig({ isAdmin: result.isAdmin, roleCachedAt: Date.now() });
         }
         output(result);
@@ -71,6 +89,208 @@ auth
         process.exit(1);
     }
 });
+program
+    .command("doctor")
+    .description("Run machine-readable Day of Week health checks")
+    .action(async () => {
+    const project = inspectWikiProject(process.cwd());
+    const checks = [
+        { name: "binary", ok: true, detail: pkg.version },
+        { name: "credential", ok: false },
+        { name: "api", ok: false },
+        { name: "login", ok: false },
+        { name: "areas", ok: false },
+        project.manifest,
+        project.launcher,
+        project.skills,
+        project.write,
+        { name: "default_area", ok: false, detail: "manifest or API unavailable" },
+    ];
+    try {
+        getToken();
+        checks[1] = { name: "credential", ok: true };
+        const bootstrap = await getClient().brainBootstrap();
+        checks[2] = { name: "api", ok: true };
+        checks[3] = { name: "login", ok: bootstrap.authenticated, detail: bootstrap.scopes.join(",") };
+        checks[4] = { name: "areas", ok: bootstrap.areas.length > 0, detail: String(bootstrap.areas.length) };
+        const defaultArea = checks.find((check) => check.name === "default_area");
+        defaultArea.ok = Boolean(project.defaultAreaId && bootstrap.areas.some((area) => area.id === project.defaultAreaId));
+        defaultArea.detail = defaultArea.ok ? project.defaultAreaId : "configured area is no longer accessible";
+        output({ ok: checks.every((check) => check.ok), checks, defaultAreaId: bootstrap.defaultAreaId });
+    }
+    catch (error) {
+        output({ ok: false, checks, error: error instanceof Error ? error.message : "Health check failed" });
+        process.exitCode = 2;
+    }
+});
+// ── Shared Brain Commands ───────────────────────────────────────────────────
+const brain = program.command("brain").description("Work with shared Day of Week knowledge");
+const brainCompany = brain.command("company").description("Connect the idempotent company knowledge space");
+brainCompany
+    .command("status")
+    .description("Check whether the current hierarchy membership can connect a company space")
+    .action(async () => output(await getClient().companyBrainStatus()));
+brainCompany
+    .command("ensure")
+    .description("Create or connect the one company brain for the current entity")
+    .action(async () => output(await getClient().ensureCompanyBrain()));
+brain
+    .command("list")
+    .description("List accessible company and project spaces")
+    .action(async () => output(await getClient().listBrainAreas()));
+brain
+    .command("search <query>")
+    .description("Search accessible shared knowledge")
+    .option("--area <areaId>", "Restrict to one accessible area")
+    .option("--limit <count>", "Maximum results", (value) => Number.parseInt(value, 10), 10)
+    .action(async (query, opts) => {
+    output(await getClient().searchBrain(query, { areaId: opts.area, limit: opts.limit }));
+});
+brain
+    .command("get <uri>")
+    .description("Resolve a Day of Week brain URI")
+    .option("--markdown", "Print note markdown only")
+    .action(async (uri, opts) => {
+    parseBrainResource(uri);
+    const result = await getClient().resolveBrain(uri);
+    if (opts.markdown) {
+        if (result.resourceType !== "note")
+            throw new Error("--markdown requires a note URI");
+        process.stdout.write(result.note.markdown);
+        if (!result.note.markdown.endsWith("\n"))
+            process.stdout.write("\n");
+        return;
+    }
+    output(result);
+});
+brain
+    .command("share")
+    .description("Explicitly share a markdown note")
+    .requiredOption("--area <areaId>", "Destination area")
+    .requiredOption("--title <title>", "Shared note title")
+    .option("--file <path>", "Markdown file")
+    .option("--stdin", "Read markdown from standard input")
+    .requiredOption("--intent <intent>", "interactive or autonomous")
+    .action(async (opts) => {
+    if (Boolean(opts.file) === Boolean(opts.stdin))
+        throw new Error("Use exactly one of --file or --stdin");
+    if (opts.intent !== "interactive" && opts.intent !== "autonomous")
+        throw new Error("Invalid --intent");
+    const markdown = opts.stdin ? await readStdin() : readFileSync(opts.file, "utf8");
+    output(await getClient().shareBrainNote({
+        areaId: opts.area,
+        title: opts.title,
+        markdown,
+        sourceName: opts.file ? basename(opts.file) : undefined,
+        intent: opts.intent,
+    }));
+});
+brain
+    .command("update <uri>")
+    .description("Update a shared note with optimistic concurrency")
+    .requiredOption("--file <path>", "Markdown file")
+    .requiredOption("--if-version <version>", "Expected current version", (value) => Number.parseInt(value, 10))
+    .option("--title <title>", "Updated title")
+    .action(async (uri, opts) => {
+    const parsed = parseBrainResource(uri);
+    if (parsed.resourceType !== "note" || !parsed.resourceId)
+        throw new Error("A note URI is required");
+    const note = await getClient().updateBrainNote(parsed.resourceId, {
+        title: opts.title,
+        markdown: readFileSync(opts.file, "utf8"),
+        expectedVersion: opts.ifVersion,
+    });
+    if (note.areaId !== parsed.areaId)
+        throw new Error("Server returned a mismatched area");
+    output(note);
+});
+brain
+    .command("archive <uri>")
+    .description("Soft-archive a shared note")
+    .requiredOption("--if-version <version>", "Expected current version", (value) => Number.parseInt(value, 10))
+    .action(async (uri, opts) => {
+    const parsed = parseBrainResource(uri);
+    if (parsed.resourceType !== "note" || !parsed.resourceId)
+        throw new Error("A note URI is required");
+    const note = await getClient().archiveBrainNote(parsed.resourceId, opts.ifVersion);
+    if (note.areaId !== parsed.areaId)
+        throw new Error("Server returned a mismatched area");
+    output(note);
+});
+brain
+    .command("restore <uri>")
+    .description("Restore an archived shared note")
+    .requiredOption("--if-version <version>", "Expected current version", (value) => Number.parseInt(value, 10))
+    .action(async (uri, opts) => {
+    const parsed = parseBrainResource(uri);
+    if (parsed.resourceType !== "note" || !parsed.resourceId)
+        throw new Error("A note URI is required");
+    const note = await getClient().restoreBrainNote(parsed.resourceId, opts.ifVersion);
+    if (note.areaId !== parsed.areaId)
+        throw new Error("Server returned a mismatched area");
+    output(note);
+});
+brain
+    .command("audit")
+    .description("List bounded audit metadata (area owner and brain:manage scope required)")
+    .requiredOption("--area <areaId>", "Area to inspect")
+    .option("--cursor <cursor>", "Pagination cursor")
+    .option("--limit <count>", "Maximum events", (value) => Number.parseInt(value, 10), 50)
+    .action(async (opts) => {
+    output(await getClient().listBrainAudit(opts.area, { cursor: opts.cursor, limit: opts.limit }));
+});
+const brainSource = brain.command("source").description("Work with original shared files and recordings");
+brainSource
+    .command("get <uri>")
+    .description("Read source metadata and derived text")
+    .action(async (uri) => {
+    const parsed = parseBrainResource(uri);
+    if (parsed.resourceType !== "source" || !parsed.resourceId)
+        throw new Error("A source URI is required");
+    const source = await getClient().getBrainSource(parsed.resourceId);
+    if (source.areaId !== parsed.areaId)
+        throw new Error("Server returned a mismatched area");
+    output(source);
+});
+brainSource
+    .command("upload")
+    .description("Upload an original file or meeting recording")
+    .requiredOption("--area <areaId>", "Destination area")
+    .requiredOption("--file <path>", "File to upload")
+    .option("--mime <mimeType>", "MIME type; inferred from extension when omitted")
+    .option("--meeting", "Mark this source as a recorded meeting")
+    .option("--consent-ack", "Confirm recorded participants were informed and consented")
+    .action(async (opts) => {
+    if (opts.meeting && !opts.consentAck) {
+        throw new Error("--consent-ack is required: you are attesting that recorded participants were informed and consented");
+    }
+    output(await getClient().uploadBrainSource({
+        areaId: opts.area,
+        path: opts.file,
+        mimeType: opts.mime ?? inferMimeType(opts.file),
+        isMeeting: opts.meeting ?? false,
+        consentAcknowledged: opts.consentAck ?? false,
+    }));
+});
+brainSource
+    .command("download <uri>")
+    .description("Download exact original bytes to an explicit path")
+    .requiredOption("--output <path>", "Explicit output file")
+    .option("--overwrite", "Replace an existing output file")
+    .action(async (uri, opts) => {
+    const parsed = parseBrainResource(uri);
+    if (parsed.resourceType !== "source" || !parsed.resourceId)
+        throw new Error("A source URI is required");
+    const source = await getClient().getBrainSource(parsed.resourceId);
+    if (source.areaId !== parsed.areaId)
+        throw new Error("Server returned a mismatched area");
+    output(await getClient().downloadBrainSource({
+        sourceId: source.id,
+        outputPath: opts.output,
+        expectedSha256: source.sha256,
+        overwrite: opts.overwrite,
+    }));
+});
 auth
     .command("devices")
     .description("List your agent tokens")
@@ -174,6 +394,7 @@ agent
     .option("--parent <entityId>", "Parent entity ID")
     .option("--entity-type <type>", "Entity type (Farm, Producer, ...)")
     .option("--target-id <id>", "Target record ID (for update/delete)")
+    .option("--org <slug>", "File against another org (admin tokens only)")
     .option("--file <path>", "Read payload from JSON file (- for stdin)")
     .option("--payload <json>", "Inline JSON payload")
     .action(async (opts) => {
@@ -186,6 +407,7 @@ agent
     }
     const client = getClient();
     const result = await client.submitProposal({
+        org: opts.org,
         operation: opts.op,
         targetTable: opts.table,
         title: opts.title,
@@ -205,6 +427,7 @@ agent
     .description("Submit multiple proposals")
     .requiredOption("--label <label>", "Batch label")
     .option("--source <agent>", "Agent identifier")
+    .option("--org <slug>", "File against another org (admin tokens only)")
     .requiredOption("--file <path>", "JSON file with proposals array (- for stdin)")
     .action(async (opts) => {
     const content = opts.file === "-"
@@ -213,6 +436,7 @@ agent
     const proposals = JSON.parse(content);
     const client = getClient();
     const result = await client.submitBatch({
+        org: opts.org,
         batchLabel: opts.label,
         sourceAgent: opts.source,
         proposals: Array.isArray(proposals) ? proposals : [proposals],
@@ -238,6 +462,191 @@ agent
     const result = await client.getProposal(proposalId);
     output(result);
 });
+// ── Knowledge Commands ───────────────────────────────────────────────────────
+const MIME_BY_EXT = {
+    ".pdf": "application/pdf",
+    ".md": "text/markdown",
+    ".txt": "text/plain",
+    ".csv": "text/csv",
+    ".json": "application/json",
+    ".html": "text/html",
+    ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    ".doc": "application/msword",
+    ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    ".xls": "application/vnd.ms-excel",
+    ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+};
+function guessMimeType(path) {
+    const dot = path.lastIndexOf(".");
+    const ext = dot === -1 ? "" : path.slice(dot).toLowerCase();
+    return MIME_BY_EXT[ext] ?? "application/octet-stream";
+}
+/** Filesystem-safe name for an exported document, keeping it recognisable. */
+function exportFileName(doc) {
+    const base = (doc.fileName || doc.title || doc.id || "document").trim();
+    const stripped = base.replace(/\.(md|txt)$/i, "");
+    const safe = stripped.replace(/[/\\:*?"<>|]+/g, "-").replace(/\s+/g, " ").slice(0, 120);
+    return `${safe || doc.id || "document"}.md`;
+}
+const knowledge = program
+    .command("knowledge")
+    .description("Read, add and export entity knowledge documents");
+knowledge
+    .command("list")
+    .description("List knowledge documents on an entity")
+    .requiredOption("--entity <entityId>", "Target entity id")
+    .option("--full", "Include each document's full content, not an excerpt")
+    .option("--org <org>", "Organization (admin only)")
+    .action(async (opts) => {
+    const client = getClient();
+    output(await client.listKnowledge({ entity: opts.entity, full: opts.full, org: opts.org }));
+});
+knowledge
+    .command("get <documentId>")
+    .description("Show one knowledge document with full content")
+    .option("--org <org>", "Organization (admin only)")
+    .action(async (documentId, opts) => {
+    const client = getClient();
+    output(await client.getKnowledge(documentId, opts.org));
+});
+knowledge
+    .command("search <query>")
+    .description("Semantic search across knowledge documents")
+    .option("--entity <entityId>", "Scope to one entity's org tree")
+    .option("--types <types>", "Comma-separated sourceType filter")
+    .option("--limit <count>", "Max hits", parseInt)
+    .option("--all-orgs", "Search every org (admin only)")
+    .option("--org <org>", "Organization (admin only)")
+    .action(async (query, opts) => {
+    const client = getClient();
+    output(await client.searchKnowledge({
+        query,
+        entity: opts.entity,
+        types: opts.types
+            ? String(opts.types).split(",").map((t) => t.trim()).filter(Boolean)
+            : undefined,
+        limit: opts.limit,
+        allOrgs: opts.allOrgs,
+        org: opts.org,
+    }));
+});
+knowledge
+    .command("add")
+    .description("Add a markdown knowledge note (proposal by default)")
+    .requiredOption("--entity <entityId>", "Target entity id")
+    .requiredOption("--title <title>", "Document title")
+    .option("--file <path>", "Markdown file to read (- for stdin)")
+    .option("--content <text>", "Inline content instead of --file")
+    .option("--source-type <type>", "research | website | competitive_intel | …", "research")
+    .option("--source-url <url>", "Where the content came from")
+    .option("--source-description <text>", "Short provenance note")
+    .option("--confidence <n>", "0-1, helps reviewers prioritize", parseFloat)
+    .option("--source-agent <name>", "Attribution for the submitting agent")
+    .option("--direct", "Write immediately instead of proposing. Admin only — ask the operator first")
+    .option("--org <org>", "Organization (admin only)")
+    .action(async (opts) => {
+    let content;
+    if (opts.content) {
+        content = String(opts.content);
+    }
+    else if (opts.file) {
+        content = opts.file === "-" ? readFileSync(0, "utf8") : readFileSync(opts.file, "utf8");
+    }
+    else {
+        throw new Error("Provide --file or --content");
+    }
+    if (!content.trim())
+        throw new Error("Content is empty");
+    const client = getClient();
+    output(await client.addKnowledge({
+        entityId: opts.entity,
+        title: opts.title,
+        content,
+        sourceType: opts.sourceType,
+        sourceUrl: opts.sourceUrl,
+        sourceDescription: opts.sourceDescription,
+        confidence: opts.confidence,
+        sourceAgent: opts.sourceAgent,
+        direct: Boolean(opts.direct),
+        org: opts.org,
+    }));
+});
+knowledge
+    .command("attach")
+    .description("Attach a file (PDF, DOCX, XLSX …) as a source. Admin only")
+    .requiredOption("--entity <entityId>", "Target entity id")
+    .requiredOption("--file <path>", "File to upload")
+    .option("--name <fileName>", "Stored file name (defaults to the file's own)")
+    .option("--mime <mimeType>", "Content type (guessed from the extension)")
+    .option("--source-type <type>", "research | website | contract | …", "other")
+    .option("--source-url <url>", "Where the file came from")
+    .option("--source-description <text>", "Short provenance note")
+    .option("--org <org>", "Organization (admin only)")
+    .action(async (opts) => {
+    if (!existsSync(opts.file))
+        throw new Error(`File not found: ${opts.file}`);
+    const data = readFileSync(opts.file);
+    if (data.byteLength === 0)
+        throw new Error("File is empty");
+    const client = getClient();
+    output(await client.attachKnowledgeFile({
+        entityId: opts.entity,
+        data: toArrayBuffer(data),
+        fileName: opts.name ?? basename(opts.file),
+        mimeType: opts.mime ?? guessMimeType(opts.file),
+        sourceType: opts.sourceType,
+        sourceUrl: opts.sourceUrl,
+        sourceDescription: opts.sourceDescription,
+        org: opts.org,
+    }));
+});
+knowledge
+    .command("export")
+    .description("Write an entity's knowledge documents to disk as markdown")
+    .requiredOption("--entity <entityId>", "Source entity id")
+    .requiredOption("--out <dir>", "Directory to write into (created if missing)")
+    .option("--org <org>", "Organization (admin only)")
+    .action(async (opts) => {
+    const client = getClient();
+    const docs = await client.listKnowledge({ entity: opts.entity, full: true, org: opts.org });
+    mkdirSync(opts.out, { recursive: true });
+    const written = [];
+    const skipped = [];
+    for (const doc of docs) {
+        const body = typeof doc.content === "string" ? doc.content : "";
+        if (!body) {
+            // A binary source whose text extraction hasn't finished has nothing to
+            // mirror yet. Report it rather than writing an empty file.
+            skipped.push({
+                id: doc.id,
+                title: doc.title,
+                reason: doc.processingStatus && doc.processingStatus !== "completed"
+                    ? `processingStatus=${doc.processingStatus}`
+                    : "no extracted content",
+            });
+            continue;
+        }
+        const frontMatter = [
+            "---",
+            `document_id: ${doc.id}`,
+            `title: ${JSON.stringify(doc.title ?? "")}`,
+            `source_type: ${doc.sourceType ?? "other"}`,
+            ...(doc.sourceUrl ? [`source_url: ${doc.sourceUrl}`] : []),
+            ...(doc.sourceDescription
+                ? [`source_description: ${JSON.stringify(doc.sourceDescription)}`]
+                : []),
+            `entity_id: ${opts.entity}`,
+            ...(doc.createdAt ? [`created_at: ${new Date(doc.createdAt).toISOString()}`] : []),
+            "exported_from: dayofweek-platform",
+            "---",
+            "",
+        ].join("\n");
+        const target = join(opts.out, exportFileName(doc));
+        writeFileSync(target, `${frontMatter}${body}\n`, "utf8");
+        written.push({ id: doc.id, file: target, bytes: Buffer.byteLength(body, "utf8") });
+    }
+    output({ entity: opts.entity, out: opts.out, total: docs.length, written, skipped });
+});
 // ── Skill Commands ───────────────────────────────────────────────────────────
 const skill = program.command("skill").description("Manage the Day of Week agent skill");
 function resolveTargetDirs(target, bundleName, customDir) {
@@ -255,15 +664,88 @@ function resolveTargetDirs(target, bundleName, customDir) {
             return claudeRootExists ? [agentsDir, claudeDir] : [agentsDir];
     }
 }
-function writeBundle(bundle, targetDir) {
-    let filesWritten = 0;
-    for (const file of bundle.files) {
-        const filePath = join(targetDir, file.path);
-        mkdirSync(dirname(filePath), { recursive: true });
-        writeFileSync(filePath, file.content, "utf-8");
-        filesWritten++;
+function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function inspectWikiProject(directory) {
+    const root = resolve(directory);
+    const manifestPath = join(root, ".dayofweek", "manifest.json");
+    const missing = {
+        manifest: { name: "project_manifest", ok: false, detail: "not found in current directory" },
+        launcher: { name: "project_launcher", ok: false, detail: "manifest unavailable" },
+        skills: { name: "project_skills", ok: false, detail: "manifest unavailable" },
+        write: { name: "project_write", ok: false, detail: "manifest unavailable" },
+    };
+    if (!existsSync(manifestPath))
+        return missing;
+    try {
+        const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+        if (manifest.schemaVersion !== 1 ||
+            typeof manifest.dcliRuntimePath !== "string" ||
+            !manifest.managedFiles ||
+            typeof manifest.managedFiles !== "object") {
+            return {
+                manifest: { name: "project_manifest", ok: false, detail: "invalid schema" },
+                launcher: missing.launcher,
+                skills: missing.skills,
+                write: missing.write,
+            };
+        }
+        const runtime = resolve(manifest.dcliRuntimePath);
+        const runtimeOk = existsSync(runtime) && statSync(runtime).isFile();
+        const launcherPaths = process.platform === "win32"
+            ? [".dayofweek/bin/dcli.cmd"]
+            : [".dayofweek/bin/dcli"];
+        const launcherOk = runtimeOk && launcherPaths.every((path) => managedFileMatches(root, path, manifest.managedFiles));
+        const skillNames = ["personal-llm-wiki", "dayofweek-brain"];
+        const skillPaths = skillNames.flatMap((name) => [
+            `.agents/skills/${name}/SKILL.md`,
+            `.claude/skills/${name}/SKILL.md`,
+        ]);
+        const skillsOk = skillPaths.every((path) => managedFileMatches(root, path, manifest.managedFiles));
+        let writeOk = false;
+        try {
+            accessSync(root, constants.W_OK);
+            writeOk = true;
+        }
+        catch {
+            writeOk = false;
+        }
+        return {
+            manifest: {
+                name: "project_manifest",
+                ok: true,
+                detail: `schema=1 dcli=${manifest.dcliVersion ?? "unknown"}`,
+            },
+            launcher: {
+                name: "project_launcher",
+                ok: launcherOk,
+                detail: runtimeOk ? (launcherOk ? "managed launcher verified" : "launcher modified or missing") : "managed runtime missing",
+            },
+            skills: {
+                name: "project_skills",
+                ok: skillsOk,
+                detail: skillsOk ? Object.entries(manifest.skillVersions ?? {}).map(([name, version]) => `${name}@${version}`).join(",") : "managed skill modified or missing",
+            },
+            write: { name: "project_write", ok: writeOk, detail: writeOk ? "folder is writable" : "folder is not writable" },
+            defaultAreaId: manifest.defaultAreaId,
+        };
+    }
+    catch {
+        return {
+            manifest: { name: "project_manifest", ok: false, detail: "unreadable or malformed" },
+            launcher: missing.launcher,
+            skills: missing.skills,
+            write: missing.write,
+        };
     }
-    return filesWritten;
+}
+function managedFileMatches(root, relativePath, managedFiles) {
+    const expected = managedFiles[relativePath];
+    const target = resolve(root, relativePath);
+    const pathFromRoot = relative(root, target);
+    const insideRoot = pathFromRoot !== ".." && !pathFromRoot.startsWith(`..${sep}`) && !pathFromRoot.startsWith(sep);
+    return Boolean(expected && insideRoot && existsSync(target) && sha256(readFileSync(target)) === expected);
 }
 function parseTarget(value) {
     const v = (value ?? "all").toLowerCase();
@@ -274,67 +756,75 @@ function parseTarget(value) {
     return v;
 }
 skill
-    .command("install")
+    .command("list")
+    .description("List authenticated named skill bundles")
+    .action(async () => output(await getClient().listSkillBundles()));
+skill
+    .command("bundle <name>")
+    .description("Fetch and verify a named skill bundle for a managed installer")
+    .action(async (name) => output(validateSkillBundle(await getClient().getSkillBundle(name))));
+skill
+    .command("install [name]")
     .description("Install the agent skill (requires valid auth)")
     .option("--dir <path>", "Custom install directory (overrides --target)")
     .option("--target <target>", "Install target: agents, claude, or all (default: all)")
-    .action(async (opts) => {
+    .action(async (name, opts) => {
     const client = getClient();
-    const bundle = await client.getSkillBundle();
+    const bundle = await client.getSkillBundle(name);
     const target = parseTarget(opts.target);
     const dirs = resolveTargetDirs(target, bundle.name, opts.dir);
+    const installations = [];
     for (const dir of dirs) {
-        const count = writeBundle(bundle, dir);
-        console.log(`Installed ${count} files to ${dir}`);
+        const result = writeSkillBundle(bundle, dir);
+        installations.push({ directory: dir, ...result });
     }
-    console.log("Any compatible agent will discover the skill automatically.");
+    output({ action: "install", bundle: bundle.name, version: bundle.version, hash: bundle.hash, installations });
 });
 skill
-    .command("update")
+    .command("update [name]")
     .description("Update the skill to the latest version")
     .option("--dir <path>", "Custom install directory (overrides --target)")
     .option("--target <target>", "Install target: agents, claude, or all (default: all)")
-    .action(async (opts) => {
+    .action(async (name, opts) => {
     const client = getClient();
-    const bundle = await client.getSkillBundle();
+    const bundle = await client.getSkillBundle(name);
     const target = parseTarget(opts.target);
     const dirs = resolveTargetDirs(target, bundle.name, opts.dir);
+    const installations = [];
     for (const dir of dirs) {
-        const count = writeBundle(bundle, dir);
-        console.log(`Updated ${count} files in ${dir}`);
+        const result = writeSkillBundle(bundle, dir);
+        installations.push({ directory: dir, ...result });
     }
+    output({ action: "update", bundle: bundle.name, version: bundle.version, hash: bundle.hash, installations });
 });
 skill
-    .command("status")
+    .command("status [name]")
     .description("Check if the skill is installed")
     .option("--dir <path>", "Custom install directory (overrides --target)")
     .option("--target <target>", "Check target: agents, claude, or all (default: all)")
-    .action(async (opts) => {
-    const bundleName = "dayofweek-platform";
+    .action(async (name, opts) => {
+    const bundleName = name ?? "dayofweek-platform";
     const target = parseTarget(opts.target);
     const dirs = opts.dir
         ? [opts.dir]
         : target === "all"
             ? [join(homedir(), ".agents", "skills", bundleName), join(homedir(), ".claude", "skills", bundleName)]
             : resolveTargetDirs(target, bundleName);
-    let anyInstalled = false;
+    const installations = [];
     for (const dir of dirs) {
         const skillPath = join(dir, "SKILL.md");
         if (!existsSync(skillPath)) {
-            console.log(`Not installed at: ${dir}`);
+            installations.push({ installed: false, directory: dir, name: bundleName });
             continue;
         }
-        anyInstalled = true;
         const content = readFileSync(skillPath, "utf-8");
         const versionMatch = content.match(/version:\s*"([^"]+)"/);
-        console.log(`Installed at: ${dir}`);
-        console.log(`  Version: ${versionMatch?.[1] ?? "unknown"}`);
+        installations.push({ installed: true, directory: dir, name: bundleName, version: versionMatch?.[1] ?? "unknown", sha256: sha256(content) });
     }
-    if (!anyInstalled) {
-        console.log("\nRun: dcli skill install");
-        process.exit(1);
-    }
-    console.log("\nTo update: dcli skill update");
+    const installed = installations.some((entry) => entry.installed);
+    output({ installed, bundle: bundleName, installations });
+    if (!installed)
+        process.exitCode = 2;
 });
 // ── Admin Commands ───────────────────────────────────────────────────────────
 //
@@ -398,8 +888,36 @@ async function readStdin() {
     }
     return chunks.join("\n");
 }
+function inferMimeType(path) {
+    const extension = path.toLowerCase().split(".").at(-1);
+    const types = {
+        pdf: "application/pdf",
+        md: "text/markdown",
+        txt: "text/plain",
+        csv: "text/csv",
+        json: "application/json",
+        docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+        xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+        mp3: "audio/mpeg",
+        m4a: "audio/mp4",
+        wav: "audio/wav",
+        mp4: "video/mp4",
+    };
+    const mime = extension ? types[extension] : undefined;
+    if (!mime)
+        throw new Error("Could not infer MIME type; pass --mime");
+    return mime;
+}
 // ── Run ──────────────────────────────────────────────────────────────────────
 program.parseAsync(process.argv).catch((err) => {
     console.error(err.message ?? err);
-    process.exit(1);
+    if (err instanceof ApiError) {
+        const code = err.code;
+        process.exit(code === "unauthenticated" ? 2 :
+            code === "scope_denied" || code === "not_found" ? 3 :
+                code === "conflict" ? 4 :
+                    code === "quarantined" ? 7 :
+                        err.status >= 500 ? 6 : 5);
+    }
+    process.exit(5);
 });