@descix/cli 1.0.1 → 1.0.4

package/lib/commands/model-config.js

@@ -0,0 +1,313 @@
+/**
+ * Model Config Commands — WS-CONFIG-BOOTSTRAP-FIX item #10
+ *
+ * CLI surface for the four resolver-chain knobs:
+ *   - descix app set-default-model -a <app_id> -m <model_name> [--env=dev|demo|prod]
+ *   - descix app set-default-model -a <app_id> --clear [--env=dev|demo|prod]
+ *   - descix kb set-override-model -a <app_id> -k <kb_name> -m <model_name> [--env=dev|demo|prod]
+ *   - descix kb clear-override-model -a <app_id> -k <kb_name> [--env=dev|demo|prod]
+ *
+ * Per CEO 2026-05-26 inheritance chain:
+ *   options.model || kb.kb_model_override || app.default_app_model || levelConfig.model || utils.DEFAULT_AI_MODEL
+ *
+ * --clear flows use FieldValue.delete() server-side (NOT null) per tripwire #2.
+ *
+ * Every action appends a JSONL audit-log line to {workspace-root}/docs/audit/model-config-changes.jsonl.
+ *
+ * This module performs NO Firestore I/O directly — it is HTTP-only, routing to backend handlers
+ * via DeSciXApiClient.invoke (set_app_default_model, clear_app_default_model, set_kb_model_override,
+ * clear_kb_model_override). This preserves the CLI invariant: zero direct service imports.
+ */
+
+import chalk from 'chalk';
+import fs from 'fs/promises';
+import path from 'path';
+import { DeSciXApiClient } from '../api-client.js';
+import { requireAuth } from '../auth-guard.js';
+import { WorkspaceConfig } from '../workspace-config.js';
+
+const AUDIT_LOG_RELATIVE = 'docs/audit/model-config-changes.jsonl';
+
+/**
+ * Resolve the audit-log absolute path. Anchored at workspace root so the JSONL lives in
+ * the worktree alongside related design docs. Creates the parent dir if missing.
+ */
+async function resolveAuditLogPath() {
+    const ws = await WorkspaceConfig.tryLoad();
+    const root = (ws && ws.getWorkspaceRoot && ws.getWorkspaceRoot()) || process.cwd();
+    const abs = path.resolve(root, AUDIT_LOG_RELATIVE);
+    await fs.mkdir(path.dirname(abs), { recursive: true });
+    return abs;
+}
+
+/**
+ * Append a single JSONL line to the audit log.
+ *
+ * Schema (per dispatch §2.6):
+ *   { date, action, env, app, kb?, before, after, performed_by }
+ *
+ * `performed_by` is sourced from the wallet credential email if available; if not,
+ * we record "unknown" rather than guessing.
+ */
+async function appendAudit({ action, env, app_id, kb_name, before, after, performed_by }) {
+    const line = {
+        date: new Date().toISOString(),
+        action,
+        env: env || null,
+        app: app_id,
+        ...(kb_name ? { kb: kb_name } : {}),
+        before,
+        after,
+        performed_by: performed_by || 'unknown'
+    };
+    const auditPath = await resolveAuditLogPath();
+    await fs.appendFile(auditPath, JSON.stringify(line) + '\n');
+    return { path: auditPath, line };
+}
+
+/**
+ * Best-effort identity from the API client wallet credentials.
+ *
+ * Resolution order (mirrors backend's `params.user?.email || user_id || wallet`
+ * pattern so audit lines remain comparable whether identity is captured at the
+ * CLI or downstream):
+ *   1. c.email          — primary, human-readable
+ *   2. c.user_email     — alternate spelling some legacy wallet files used
+ *   3. c.userId         — Powch's user_id (often the email, but kept distinct
+ *                         in the wallet schema; was missing from this chain)
+ *   4. c.user_id        — snake_case variant for cross-service consistency
+ *   5. c.walletAddress  — 0x-address; durable identity even when email absent
+ *   6. c.wallet_address — snake_case variant
+ *   7. c.address        — generic last fallback
+ * Returns null on any failure; `appendAudit` then writes the literal
+ * "unknown" to make the audit line explicitly mark "identity could not be
+ * captured" rather than silently dropping the field.
+ */
+function identityFromApiClient(apiClient) {
+    try {
+        const c = apiClient.credentials || {};
+        return c.email
+            || c.user_email
+            || c.userId
+            || c.user_id
+            || c.walletAddress
+            || c.wallet_address
+            || c.address
+            || null;
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * Pretty-print the resolution chain that will apply going forward.
+ * The print is deterministic and includes:
+ *   - the chain template
+ *   - the current value of App.default_app_model
+ *   - the per-level platform defaults (L1..L5)
+ *   - per-KB overrides (with explicit "cleared" markers when null/absent)
+ */
+function printResolution({ app_id, resolution }) {
+    if (!resolution) return;
+    const dam = resolution.default_app_model === null ? 'null' : `"${resolution.default_app_model}"`;
+    const dai = resolution.default_ai_model ? `"${resolution.default_ai_model}"` : 'null';
+
+    console.log(chalk.cyan('\nResolution chain that will apply going forward:'));
+    console.log(chalk.gray(`  ${resolution.chain}`));
+    console.log(chalk.gray(`  app.default_app_model = ${dam}`));
+    console.log(chalk.gray(`  utils.DEFAULT_AI_MODEL = ${dai}`));
+
+    const levels = resolution.intelligence_levels || {};
+    const levelKeys = Object.keys(levels).sort();
+    if (levelKeys.length > 0) {
+        const parts = levelKeys.map(k => `L${k}: ${(levels[k] && levels[k].model) || '?'}`);
+        console.log(chalk.gray(`  Per-level: ${parts.join(' | ')}`));
+    }
+
+    const overrides = resolution.kb_overrides || {};
+    const keys = Object.keys(overrides).sort();
+    if (keys.length > 0) {
+        const parts = keys.map(k => {
+            const v = overrides[k];
+            return v === null || v === undefined ? `${k}=cleared` : `${k}="${v}"`;
+        });
+        console.log(chalk.gray(`  KB overrides: ${parts.join(', ')}`));
+    }
+}
+
+/**
+ * Pretty-print the before/after pair for a field.
+ */
+function printBeforeAfter({ field, before, after }) {
+    const fmt = (v) => (v === null || v === undefined) ? chalk.gray('<absent>') : chalk.white(`"${v}"`);
+    console.log(chalk.cyan(`\n${field}:`));
+    console.log(`  before: ${fmt(before)}`);
+    console.log(`  after:  ${fmt(after)}`);
+}
+
+// ============ App: set / clear default_app_model ============
+
+/**
+ * descix app set-default-model -a <app_id> -m <model_name> [--clear]
+ *
+ * HARD-FAIL on missing -a; HARD-FAIL on (no -m AND no --clear); HARD-FAIL on (-m AND --clear).
+ * Backend HARD-FAILs on unknown app.
+ */
+export async function runAppSetDefaultModel(options) {
+    const { app: app_id, model: model_name, clear, env } = options || {};
+
+    if (!app_id) throw new Error('Missing required option: -a, --app <app_id>');
+    if (!clear && !model_name) {
+        throw new Error('Either -m, --model <model_name> or --clear is required.');
+    }
+    if (clear && model_name) {
+        throw new Error('-m and --clear are mutually exclusive.');
+    }
+
+    const apiClient = new DeSciXApiClient();
+    await requireAuth(apiClient);
+
+    if (clear) {
+        const response = await apiClient.invoke('clear_app_default_model', { app_id });
+        const result = response.message || response;
+
+        console.log(chalk.green(`\n✓ Cleared App.default_app_model for ${app_id}`));
+        printBeforeAfter({
+            field: 'App.default_app_model',
+            before: result.before?.default_app_model,
+            after: result.after?.default_app_model
+        });
+        printResolution({ app_id, resolution: result.resolution });
+
+        const audit = await appendAudit({
+            action: 'clear_app_default_model',
+            env,
+            app_id,
+            before: result.before,
+            after: result.after,
+            performed_by: identityFromApiClient(apiClient)
+        });
+        console.log(chalk.gray(`\nAudit log: ${audit.path}\n`));
+        return result;
+    }
+
+    const response = await apiClient.invoke('set_app_default_model', { app_id, model_name });
+    const result = response.message || response;
+
+    console.log(chalk.green(`\n✓ Set App.default_app_model = "${model_name}" for ${app_id}`));
+    printBeforeAfter({
+        field: 'App.default_app_model',
+        before: result.before?.default_app_model,
+        after: result.after?.default_app_model
+    });
+    printResolution({ app_id, resolution: result.resolution });
+
+    const audit = await appendAudit({
+        action: 'set_app_default_model',
+        env,
+        app_id,
+        before: result.before,
+        after: result.after,
+        performed_by: identityFromApiClient(apiClient)
+    });
+    console.log(chalk.gray(`\nAudit log: ${audit.path}\n`));
+    return result;
+}
+
+// ============ KB: set kb_model_override ============
+
+/**
+ * descix kb set-override-model -a <app_id> -k <kb_name> -m <model_name>
+ *
+ * HARD-FAIL on missing -a/-k/-m. Backend HARD-FAILs on unknown app/KB.
+ */
+export async function runKbSetOverrideModel(options) {
+    const { app: app_id, kb: kb_name, model: model_name, env } = options || {};
+
+    if (!app_id) throw new Error('Missing required option: -a, --app <app_id>');
+    if (!kb_name) throw new Error('Missing required option: -k, --kb <kb_name>');
+    if (!model_name) throw new Error('Missing required option: -m, --model <model_name>');
+
+    const apiClient = new DeSciXApiClient();
+    await requireAuth(apiClient);
+
+    const response = await apiClient.invoke('set_kb_model_override', { app_id, kb_name, model_name });
+    const result = response.message || response;
+
+    console.log(chalk.green(`\n✓ Set KB.kb_model_override = "${model_name}" for ${app_id}/${kb_name}`));
+    printBeforeAfter({
+        field: `KB.kb_model_override (${kb_name})`,
+        before: result.before?.kb_model_override,
+        after: result.after?.kb_model_override
+    });
+    printResolution({ app_id, resolution: result.resolution });
+
+    const audit = await appendAudit({
+        action: 'set_kb_model_override',
+        env,
+        app_id,
+        kb_name,
+        before: result.before,
+        after: result.after,
+        performed_by: identityFromApiClient(apiClient)
+    });
+    console.log(chalk.gray(`\nAudit log: ${audit.path}\n`));
+    return result;
+}
+
+// ============ KB: clear kb_model_override ============
+
+/**
+ * descix kb clear-override-model -a <app_id> -k <kb_name>
+ *
+ * HARD-FAIL on missing -a/-k. Backend HARD-FAILs on unknown app/KB.
+ * Backend uses FieldValue.delete() — field GONE after this, not null.
+ */
+export async function runKbClearOverrideModel(options) {
+    const { app: app_id, kb: kb_name, env } = options || {};
+
+    if (!app_id) throw new Error('Missing required option: -a, --app <app_id>');
+    if (!kb_name) throw new Error('Missing required option: -k, --kb <kb_name>');
+
+    const apiClient = new DeSciXApiClient();
+    await requireAuth(apiClient);
+
+    const response = await apiClient.invoke('clear_kb_model_override', { app_id, kb_name });
+    const result = response.message || response;
+
+    console.log(chalk.green(`\n✓ Cleared KB.kb_model_override for ${app_id}/${kb_name}`));
+    printBeforeAfter({
+        field: `KB.kb_model_override (${kb_name})`,
+        before: result.before?.kb_model_override,
+        after: result.after?.kb_model_override
+    });
+    printResolution({ app_id, resolution: result.resolution });
+
+    const audit = await appendAudit({
+        action: 'clear_kb_model_override',
+        env,
+        app_id,
+        kb_name,
+        before: result.before,
+        after: result.after,
+        performed_by: identityFromApiClient(apiClient)
+    });
+    console.log(chalk.gray(`\nAudit log: ${audit.path}\n`));
+    return result;
+}
+
+// Re-export helpers so tests can exercise them with mocked api clients / fs.
+export const _internal = {
+    resolveAuditLogPath,
+    appendAudit,
+    identityFromApiClient,
+    printResolution,
+    printBeforeAfter,
+    AUDIT_LOG_RELATIVE
+};
+
+export default {
+    runAppSetDefaultModel,
+    runKbSetOverrideModel,
+    runKbClearOverrideModel
+};

package/lib/commands/retired-kb-sync.js

@@ -0,0 +1,134 @@
+/**
+ * ONE OWNER for the retirement of every superseded KB-sync surface.
+ *
+ * CEO 2026-08-29: "there should never be a deprecated path and then everything else is a
+ * waterfall of problems." The CLI exposes exactly ONE kb sync surface — `descix kb corpus
+ * sync` (git-synced manifest). Every other sync path is DELETED: its implementation is gone
+ * and its old name exits NON-ZERO naming the replacement. That is not a compat fence — a
+ * compat fence is a path that still WORKS under an old name. These do not work at all.
+ *
+ * Why a module and not a literal at each site: two derivations of one fact is the general
+ * form of mirror drift. The retired set is enumerated ONCE here. bin/descix.js registers by
+ * ITERATING this list via registerAllRetiredKbSync() -- it does not name any retired verb
+ * itself -- and tests/kb-sync-single-surface.test.js asserts against the same list. So the
+ * drift is closed in BOTH directions: a surface added to the list is registered, and a
+ * surface cannot be registered without being in the list.
+ */
+
+/** The single canonical KB sync surface. Named in every refusal. */
+export const CANONICAL_KB_SYNC = 'descix kb corpus sync';
+
+/** The verb that creates a KB — `kb corpus sync`'s dependency (I4). */
+export const CANONICAL_KB_CREATE = 'descix kb create';
+
+/**
+ * Every KB-sync surface retired by ws-devplane-cli-kb-surface-single-canonical-sync.
+ * `invocation` is what a user types; `parent` is the commander parent it hung off.
+ */
+export const RETIRED_KB_SYNC_SURFACES = [
+  { id: 'sync',      parent: 'program', name: 'sync',  invocation: 'descix sync',      registered: true  },
+  { id: 'sync.kb',   parent: 'sync',    name: 'kb',    invocation: 'descix sync kb',   registered: true  },
+  { id: 'kb.chunk',  parent: 'kb',      name: 'chunk', invocation: 'descix kb chunk',  registered: true  },
+  { id: 'kb.sync',   parent: 'kb',      name: 'sync',  invocation: 'descix kb sync',   registered: true  },
+  // registered:false -- `update` survives for app/site, so this one is a dispatcher branch
+  // inside the live `update` command rather than a commander registration of its own.
+  { id: 'update.kb', parent: 'update',  name: 'kb',    invocation: 'descix update kb', registered: false },
+];
+
+/** Implementations deleted with those surfaces. No exported symbol survives without a caller (I3). */
+export const DELETED_KB_SYNC_SYMBOLS = [
+  'runKbChunk',
+  'runKbSync',
+  'runKbBuild',
+  'runKbStatus',
+  'runKbCompare',
+  'updateKB',
+];
+
+/**
+ * The single refusal message. Fails loud and names the replacement — never warns, never falls back.
+ * @param {string} invocation - the retired invocation the user typed, e.g. 'descix kb chunk'
+ * @returns {string}
+ */
+export function retiredKbSyncMessage(invocation) {
+  return (
+    `\`${invocation}\` has been REMOVED. There is no replacement flag and no fallback.\n\n` +
+    `Use the one canonical KB sync surface:\n` +
+    `  ${CANONICAL_KB_SYNC} -a <app_id> [-k <kb_name>]\n\n` +
+    `It syncs from a git-tracked corpus manifest (.descix/manifests/), which the removed ` +
+    `path could not do. If the KB does not exist yet, create it first with ` +
+    `\`${CANONICAL_KB_CREATE}\`.`
+  );
+}
+
+/**
+ * Refuse a retired invocation LOUDLY and exit non-zero.
+ *
+ * MEASURED, not assumed: a `throw` from updateAuto is NOT swallowed — updateAuto's own catch
+ * prints the message before rethrowing, so both forms reach the user and exit 1. This exists
+ * for two smaller, real reasons: (1) ONE owner for the refusal, so the dispatcher branch and
+ * updateAuto's kb branch cannot drift into different wording or different exit codes; and
+ * (2) a deliberate retirement is not a crash, so it should not be framed as "✖ Update failed".
+ *
+ * @param {string} invocation - the retired invocation, e.g. 'descix update kb'
+ * @param {(s:string)=>string} red - chalk.red or equivalent
+ * @returns {never}
+ */
+export function refuseRetiredKbSync(invocation, red) {
+  console.error(red(`\n❌ ${retiredKbSyncMessage(invocation)}\n`));
+  process.exit(1);
+}
+
+/**
+ * Register a retired invocation so it exits NON-ZERO naming the canonical surface.
+ * Accepts and ignores any args/options the old surface took, so an old script fails with
+ * this message rather than a confusing commander parse error.
+ *
+ * @param {import('commander').Command} parent - commander parent to attach to
+ * @param {string} name - the retired command name
+ * @param {string} invocation - full invocation used in the message
+ * @param {(s:string)=>string} red - chalk.red or equivalent
+ */
+export function registerRetiredKbSync(parent, name, invocation, red) {
+  return parent
+    .command(name, { hidden: true })
+    .description(`REMOVED — use \`${CANONICAL_KB_SYNC}\``)
+    .allowUnknownOption(true)
+    // helpOption(false) is load-bearing: commander intercepts `--help` BEFORE the action and
+    // exits 0. A retired surface must exit NON-ZERO however it is invoked — `descix kb chunk`
+    // and `descix kb chunk --help` must both fail and name the replacement. Without this, the
+    // most natural way a user probes a dead verb is the one way it appears to still work.
+    .helpOption(false)
+    .argument('[args...]', 'ignored')
+    .action(() => {
+      console.error(red(`\n❌ ${retiredKbSyncMessage(invocation)}\n`));
+      process.exit(1);
+    });
+}
+
+/**
+ * Register EVERY retired surface by iterating RETIRED_KB_SYNC_SURFACES.
+ *
+ * This is what makes the one-owner claim true rather than merely asserted: bin/descix.js
+ * calls this once and never names a retired verb itself, so a retired surface cannot be
+ * registered without appearing in the list above.
+ *
+ * @param {Record<string, import('commander').Command>} roots - seed parents, e.g. { program, kb }
+ * @param {(s:string)=>string} red - chalk.red or equivalent
+ * @returns {Record<string, import('commander').Command>} roots plus each registered surface by id
+ */
+export function registerAllRetiredKbSync(roots, red) {
+  const byId = { ...roots };
+  for (const s of RETIRED_KB_SYNC_SURFACES) {
+    if (!s.registered) continue;
+    const parent = byId[s.parent];
+    if (!parent) {
+      throw new Error(
+        `retired-kb-sync: no parent '${s.parent}' available for '${s.invocation}'. ` +
+        'Seed it in the roots map or order the list so the parent is registered first.'
+      );
+    }
+    byId[s.id] = registerRetiredKbSync(parent, s.name, s.invocation, red);
+  }
+  return byId;
+}

package/lib/commands/serve.js

@@ -1,12 +1,37 @@
 /**
  * descix serve — thin CLI wrapper around @descix/app-sdk gateway.
+ *
+ * The API target follows the SAME channel every other CLI command uses: the
+ * global `--api-url` / `--env` flags are normalized into DESCIX_API_URL by the
+ * program's preAction hook, and this command consumes that one value. There is
+ * no second `--api-url` flag on `serve`.
+ *
+ * The port follows the same shape: this wrapper passes ONLY what the developer
+ * explicitly asked for (`--port`). It does NOT substitute a default — the
+ * gateway's resolveGatewayPort owns the chain (--port > env.gateway.port >
+ * built-in default), so the server and the product map the shell bakes cannot
+ * name different ports.
+ *
+ * `cwd` is passed SEPARATELY from `workspaceRoot` on purpose. workspaceRoot is
+ * walked UP from to find .descix/workspace.json, so by the time the gateway has
+ * it, the directory the developer was actually standing in is gone — and that
+ * directory is exactly what picks the app to serve (AMB-2).
  */
 
 import { runGateway } from '@descix/app-sdk/dev';
 
 export async function runServe(options = {}) {
+  const apiUrl = process.env.DESCIX_API_URL || undefined;
+
   await runGateway({
-    port: options.port || 5173,
+    port: options.port,
+    portSource: options.port !== undefined ? '--port' : undefined,
     workspaceRoot: options.workspaceRoot || process.cwd(),
+    apiUrl,
+    apiSource: apiUrl ? 'CLI --api-url/--env (DESCIX_API_URL)' : undefined,
+    siteUrl: options.siteUrl,
+    siteSource: options.siteUrl ? 'CLI --site-url' : undefined,
+    app: options.app,
+    cwd: process.cwd(),
   });
 }

package/lib/commands/status.js

@@ -7,7 +7,7 @@
  * - Workspace context and mode
  * - Configuration state
  * 
- * Uses PathContext for workspace resolution - no scattered process.cwd() calls
+ * Uses WorkspaceConfig for workspace resolution - no scattered process.cwd() calls
  */
 
 import chalk from 'chalk';
@@ -18,8 +18,6 @@ import { exec } from 'child_process';
 import { promisify } from 'util';
 import { DeSciXApiClient } from '../api-client.js';
 import { GlobalConfig } from '../global-config.js';
-import { PathContext } from '../core/PathContext.js';
-import { detectWorkspaceMode } from '../workspace-utils.js';
 import { isAuthenticated } from '../auth-guard.js';
 
 const execAsync = promisify(exec);
@@ -94,19 +92,18 @@ export async function runStatus(options = {}) {
   console.log(`Environment:    ${globalConfig.environment} (${globalConfig.api_url})`);
   console.log();
 
-  // Try to load workspace context — WorkspaceConfig first (handles v2), fallback to PathContext
-  let ctx = null;
+  // Load workspace context via WorkspaceConfig
   let workspaceRoot = null;
   let workspaceConfig = null;
   try {
     const { WorkspaceConfig } = await import('../workspace-config.js');
-    const wsConfig = await WorkspaceConfig.load();
-    workspaceRoot = wsConfig.getWorkspaceRoot();
-    workspaceConfig = wsConfig;
+    const wsConfig = await WorkspaceConfig.tryLoad();
+    if (wsConfig) {
+      workspaceRoot = wsConfig.getWorkspaceRoot();
+      workspaceConfig = wsConfig;
+    }
   } catch {
-    // Fallback to PathContext
-    ctx = await PathContext.tryLoad();
-    workspaceRoot = ctx?.getWorkspaceRoot();
+    // workspace not found — workspaceConfig stays null
   }
 
   // 2. Authentication
@@ -141,52 +138,27 @@ export async function runStatus(options = {}) {
   console.log(chalk.white('Workspace Context'));
   console.log(chalk.white('-----------------'));
   
-  if (workspaceConfig || ctx) {
+  if (workspaceConfig) {
     console.log(`Config File:    ${path.join(workspaceRoot, '.descix', 'workspace.json')}`);
 
-    if (workspaceConfig) {
-      // V2 path — use WorkspaceConfig which handles env.platform/products format
-      try {
-        const defaultCtx = workspaceConfig.defaultContext;
-        if (defaultCtx) {
-          console.log(`Community:      ${defaultCtx.communityId || 'unknown'}`);
-          console.log(`App:            ${defaultCtx.appId || 'unknown'}`);
-        }
-
-        // List all configured apps
-        const platform = workspaceConfig.env?.platform;
-        const products = workspaceConfig.env?.products || [];
-        const allApps = [platform?.appId, ...products.map(p => p.appId)].filter(Boolean);
-        if (allApps.length > 0) {
-          console.log(`Local Apps:     ${allApps.join(', ')}`);
-        }
-
-        console.log(`API:            ${workspaceConfig.apiUrl || 'unknown'}`);
-        console.log(`Local Root:     ${workspaceRoot}`);
-      } catch (error) {
-        console.log(`Mode:           ${chalk.red('Unknown/Invalid')} (${error.message})`);
-      }
-    } else {
-      // Legacy PathContext path
-      const wsRawConfig = ctx.getWorkspaceConfig();
-      try {
-        const mode = detectWorkspaceMode(wsRawConfig);
-        console.log(`Mode:           ${chalk.green(mode)}`);
-
-        if (wsRawConfig.communities) {
-          for (const [commId, comm] of Object.entries(wsRawConfig.communities)) {
-            const appCount = Object.keys(comm.apps || {}).length;
-            console.log(chalk.gray(`  └─ ${commId}: ${appCount} app(s)`));
-          }
-        }
-        console.log(`Local Root:     ${workspaceRoot}`);
-      } catch (error) {
-        console.log(`Mode:           ${chalk.red('Unknown/Invalid')} (${error.message})`);
+    try {
+      // List all configured apps from env.platform + env.products
+      const platform = workspaceConfig.env?.platform;
+      const products = workspaceConfig.env?.products || [];
+      const allApps = [platform?.appId, ...products.map(p => p.appId)].filter(Boolean);
+      if (allApps.length > 0) {
+        console.log(`Local Apps:     ${allApps.join(', ')}`);
       }
+
+      console.log(`API:            ${workspaceConfig.getApiUrl() ||
+        '(not configured — run `descix config set-env dev|demo|prod`)'}`);
+      console.log(`Local Root:     ${workspaceRoot}`);
+    } catch (error) {
+      console.log(`Mode:           ${chalk.red('Unknown/Invalid')} (${error.message})`);
     }
   } else {
     console.log(`Status:         ${chalk.yellow('No workspace found')}`);
-    console.log(`Action:         Run 'descix init -c <community> -a <app> -p .' to create a workspace`);
+    console.log(`Action:         Run 'descix app init -a <app_id>' to initialize a workspace`);
   }
   console.log();