@elevasis/sdk 0.5.14 → 0.5.16

package/dist/cli.cjs

@@ -40164,6 +40164,12 @@ var DOMAIN_MAP = {
   [DOMAINS.DIAGNOSTIC]: DIAGNOSTIC_DOMAIN
 };
 
+// ../core/src/platform/registry/reserved.ts
+var RESERVED_RESOURCE_IDS = /* @__PURE__ */ new Set(["command-center-assistant"]);
+function isReservedResourceId(resourceId) {
+  return RESERVED_RESOURCE_IDS.has(resourceId);
+}
+
 // ../core/src/execution/engine/base/errors.ts
 var ExecutionError = class extends Error {
   /**
@@ -43363,6 +43369,13 @@ var ResourceRegistry = class {
       }
       seen.add(id);
     }
+    for (const id of incomingIds) {
+      if (isReservedResourceId(id)) {
+        throw new Error(
+          `Resource ID '${id}' is reserved for platform use. External deployments cannot use reserved resource IDs.`
+        );
+      }
+    }
     if (this.isRemote(orgName)) {
       this.unregisterOrganization(orgName);
     }
@@ -43395,6 +43408,46 @@ var ResourceRegistry = class {
     }
     this.serializedCache.set(orgName, serializeOrganization(this.registry[orgName]));
   }
+  /**
+   * Register built-in platform resources (static, local execution)
+   *
+   * Unlike registerOrganization(), these resources:
+   * - Do NOT have remote config (execute in-process, not in worker threads)
+   * - Are NOT removed by unregisterOrganization() (persist across redeployments)
+   * - Use reserved resource IDs that external deployments cannot claim
+   *
+   * @param orgName - Organization name
+   * @param org - Resource definitions with real handlers (not stubs)
+   */
+  registerStaticResources(orgName, org) {
+    const incomingWorkflowIds = (org.workflows ?? []).map((w) => w.config.resourceId);
+    const incomingAgentIds = (org.agents ?? []).map((a) => a.config.resourceId);
+    const incomingIds = [...incomingWorkflowIds, ...incomingAgentIds];
+    const seen = /* @__PURE__ */ new Set();
+    for (const id of incomingIds) {
+      if (seen.has(id)) {
+        throw new Error(`Duplicate resource ID '${id}' in static resources.`);
+      }
+      seen.add(id);
+    }
+    const existingOrg = this.registry[orgName];
+    if (existingOrg) {
+      const existingWorkflowIds = new Set((existingOrg.workflows ?? []).map((w) => w.config.resourceId));
+      const existingAgentIds = new Set((existingOrg.agents ?? []).map((a) => a.config.resourceId));
+      for (const id of incomingIds) {
+        if (existingWorkflowIds.has(id) || existingAgentIds.has(id)) {
+          throw new Error(`Static resource '${id}' conflicts with existing resource in '${orgName}'.`);
+        }
+      }
+    }
+    if (existingOrg) {
+      existingOrg.workflows = [...existingOrg.workflows ?? [], ...org.workflows ?? []];
+      existingOrg.agents = [...existingOrg.agents ?? [], ...org.agents ?? []];
+    } else {
+      this.registry[orgName] = org;
+    }
+    this.serializedCache.set(orgName, serializeOrganization(this.registry[orgName]));
+  }
   /**
    * Unregister runtime-registered resources for an organization
    *
@@ -43798,7 +43851,7 @@ async function apiDelete(endpoint, apiUrl = resolveApiUrl()) {
 // package.json
 var package_default = {
   name: "@elevasis/sdk",
-  version: "0.5.14",
+  version: "0.5.16",
   description: "SDK for building Elevasis organization resources",
   type: "module",
   bin: {
@@ -43884,9 +43937,7 @@ async function scanDocumentation() {
         const raw = await (0, import_promises.readFile)(fullPath, "utf-8");
         const fileSize = Buffer.byteLength(raw, "utf-8");
         if (fileSize > 100 * 1024) {
-          throw new Error(
-            `Documentation file exceeds 100KB: docs/${relPath} (${Math.round(fileSize / 1024)}KB)`
-          );
+          throw new Error(`Documentation file exceeds 100KB: docs/${relPath} (${Math.round(fileSize / 1024)}KB)`);
         }
         totalSize += fileSize;
         if (totalSize > 1024 * 1024) {
@@ -43939,7 +43990,9 @@ async function generateResourceMap(org) {
     );
     for (const w of workflows) {
       const desc = escapeMdx(w.config.description);
-      lines.push(`| \`${w.config.resourceId}\` | ${escapeMdx(w.config.name)} | ${w.config.version} | ${w.config.status} | ${desc} |`);
+      lines.push(
+        `| \`${w.config.resourceId}\` | ${escapeMdx(w.config.name)} | ${w.config.version} | ${w.config.status} | ${desc} |`
+      );
     }
     lines.push("");
   }
@@ -43952,11 +44005,16 @@ async function generateResourceMap(org) {
     );
     for (const a of agents) {
       const desc = escapeMdx(a.config.description);
-      lines.push(`| \`${a.config.resourceId}\` | ${escapeMdx(a.config.name)} | ${a.config.version} | ${a.config.status} | ${desc} |`);
+      lines.push(
+        `| \`${a.config.resourceId}\` | ${escapeMdx(a.config.name)} | ${a.config.version} | ${a.config.status} | ${desc} |`
+      );
     }
     lines.push("");
   }
-  lines.push(`**Total:** ${workflows.length + agents.length} resources (${workflows.length} workflows, ${agents.length} agents)`, "");
+  lines.push(
+    `**Total:** ${workflows.length + agents.length} resources (${workflows.length} workflows, ${agents.length} agents)`,
+    ""
+  );
   await (0, import_promises.mkdir)((0, import_path.resolve)("docs"), { recursive: true });
   await (0, import_promises.writeFile)((0, import_path.resolve)("docs/resource-map.mdx"), lines.join("\n"), "utf-8");
 }
@@ -44020,8 +44078,12 @@ async function generateProjectMap(org) {
         if (resourceCount === 0) {
           types = "(utilities)";
         } else {
-          const wCount = workflows.filter((w) => Array.isArray(w.config.domains) && w.config.domains.includes(domainName)).length;
-          const aCount = agents.filter((a) => Array.isArray(a.config.domains) && a.config.domains.includes(domainName)).length;
+          const wCount = workflows.filter(
+            (w) => Array.isArray(w.config.domains) && w.config.domains.includes(domainName)
+          ).length;
+          const aCount = agents.filter(
+            (a) => Array.isArray(a.config.domains) && a.config.domains.includes(domainName)
+          ).length;
           const parts = [];
           if (wCount > 0) parts.push(`${wCount} workflow${wCount !== 1 ? "s" : ""}`);
           if (aCount > 0) parts.push(`${aCount} agent${aCount !== 1 ? "s" : ""}`);
@@ -44133,10 +44195,7 @@ async function generateProjectMap(org) {
     if (categories.length === 0) {
       lines.push("SDK reference found but no categories parsed.", "");
     } else {
-      lines.push(
-        "| Category | Files | Covers |",
-        "| --- | --- | --- |"
-      );
+      lines.push("| Category | Files | Covers |", "| --- | --- | --- |");
       for (const cat of categories) {
         const covers = cat.titles.slice(0, 5).join(", ") + (cat.titles.length > 5 ? ", ..." : "");
         lines.push(`| ${escapeMdx(cat.name)} | ${cat.count} | ${escapeMdx(covers)} |`);
@@ -44154,10 +44213,7 @@ async function generateProjectMap(org) {
     if (cmdFiles.length === 0) {
       lines.push("No commands found.", "");
     } else {
-      lines.push(
-        "| Command | File | Purpose |",
-        "| --- | --- | --- |"
-      );
+      lines.push("| Command | File | Purpose |", "| --- | --- | --- |");
       for (const f of cmdFiles) {
         const cmdName = f.name.replace(/\.md$/, "");
         let purpose = "";
@@ -44186,10 +44242,7 @@ async function generateProjectMap(org) {
     if (ruleFiles.length === 0) {
       lines.push("No rules found.", "");
     } else {
-      lines.push(
-        "| Rule | File | Scope |",
-        "| --- | --- | --- |"
-      );
+      lines.push("| Rule | File | Scope |", "| --- | --- | --- |");
       for (const f of ruleFiles) {
         const ruleName = f.name.replace(/\.md$/, "").replace(/-/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
         let scope = "";
@@ -44220,10 +44273,7 @@ async function generateProjectMap(org) {
     if (skillDirs.length === 0) {
       lines.push("No skills found.", "");
     } else {
-      lines.push(
-        "| Skill | File | Trigger |",
-        "| --- | --- | --- |"
-      );
+      lines.push("| Skill | File | Trigger |", "| --- | --- | --- |");
       for (const d of skillDirs) {
         const skillFile = (0, import_path.resolve)(".claude/skills", d.name, "SKILL.md");
         let trigger = "";
@@ -44279,10 +44329,7 @@ async function generateProjectMap(org) {
     if (memoryFiles.length === 0) {
       lines.push("No memory files found.", "");
     } else {
-      lines.push(
-        "| File | Purpose | Last Modified |",
-        "| --- | --- | --- |"
-      );
+      lines.push("| File | Purpose | Last Modified |", "| --- | --- | --- |");
       for (const m of memoryFiles) {
         lines.push(`| .claude/memory/${m.rel} | ${escapeMdx(m.purpose)} | ${m.mtime} |`);
       }
@@ -44314,250 +44361,293 @@ async function generateProjectMap(org) {
   await (0, import_promises.mkdir)((0, import_path.resolve)("docs"), { recursive: true });
   await (0, import_promises.writeFile)((0, import_path.resolve)("docs/project-map.mdx"), lines.join("\n"), "utf-8");
 }
+async function generateNavigationMap(docs) {
+  const excludedFiles = /* @__PURE__ */ new Set(["docs/navigation-map.mdx", "docs/project-map.mdx", "docs/resource-map.mdx"]);
+  const filtered = docs.filter((doc) => !excludedFiles.has(doc.path)).sort((a, b) => {
+    const orderA = a.frontmatter.order ?? 9999;
+    const orderB = b.frontmatter.order ?? 9999;
+    if (orderA !== orderB) return orderA - orderB;
+    return a.frontmatter.title.localeCompare(b.frontmatter.title);
+  });
+  const lines = [
+    "---",
+    "title: Navigation Map",
+    "description: Auto-generated table of contents for all documentation (updated on each deploy)",
+    "order: 997",
+    "---",
+    "",
+    "# Navigation Map",
+    "",
+    "> Auto-generated by `elevasis-sdk deploy`. Do not edit manually.",
+    "",
+    "| Title | Description | Path |",
+    "| --- | --- | --- |"
+  ];
+  for (const doc of filtered) {
+    lines.push(`| ${escapeMdx(doc.frontmatter.title)} | ${escapeMdx(doc.frontmatter.description)} | ${doc.path} |`);
+  }
+  lines.push("");
+  await (0, import_promises.mkdir)((0, import_path.resolve)("docs"), { recursive: true });
+  await (0, import_promises.writeFile)((0, import_path.resolve)("docs/navigation-map.mdx"), lines.join("\n"), "utf-8");
+}
 function registerDeployCommand(program3) {
-  program3.command("deploy").description("Validate, bundle, upload, and deploy project resources\n  Example: elevasis-sdk deploy --api-url http://localhost:5170").option("--api-url <url>", "API URL").option("--entry <path>", "Path to entry file (default: ./src/index.ts)").option("--prod", "Deploy to production (overrides NODE_ENV=development)").action(wrapAction("deploy", async (options2) => {
-    const startTime = Date.now();
-    const apiUrl = resolveApiUrl(options2.apiUrl, options2.prod);
-    const env2 = resolveEnvironment(options2.prod);
-    const entryPath = options2.entry ?? "./src/index.ts";
-    const authSpinner = ora("Authenticating...").start();
-    let orgName;
-    try {
-      const me = await apiGet("/api/external/me", apiUrl);
-      orgName = me.organizationName;
-      authSpinner.succeed(
-        source_default.green("Authenticating...") + source_default.white("          done") + source_default.gray(` (${orgName})`)
-      );
-    } catch (error46) {
-      authSpinner.fail(source_default.red("Authentication failed"));
-      const errMsg = error46 instanceof Error ? error46.message : String(error46);
-      if (errMsg.includes("401") || errMsg.toLowerCase().includes("unauthorized")) {
-        const keyVar = !options2.prod && process.env.NODE_ENV === "development" && process.env.ELEVASIS_PLATFORM_KEY_DEV ? "ELEVASIS_PLATFORM_KEY_DEV" : "ELEVASIS_PLATFORM_KEY";
-        console.error(source_default.red("  Invalid API key."));
-        console.error(source_default.gray(`  Your ${keyVar} was rejected by the server.`));
-        console.error(source_default.gray("  Check your .env file and verify the key in the Elevasis dashboard."));
-      } else {
-        console.error(source_default.gray("  Check your API key and API URL."));
+  program3.command("deploy").description(
+    "Validate, bundle, upload, and deploy project resources\n  Example: elevasis-sdk deploy --api-url http://localhost:5170"
+  ).option("--api-url <url>", "API URL").option("--entry <path>", "Path to entry file (default: ./src/index.ts)").option("--prod", "Deploy to production (overrides NODE_ENV=development)").action(
+    wrapAction("deploy", async (options2) => {
+      const startTime = Date.now();
+      const apiUrl = resolveApiUrl(options2.apiUrl, options2.prod);
+      const env2 = resolveEnvironment(options2.prod);
+      const entryPath = options2.entry ?? "./src/index.ts";
+      const authSpinner = ora("Authenticating...").start();
+      let orgName;
+      try {
+        const me = await apiGet("/api/external/me", apiUrl);
+        orgName = me.organizationName;
+        authSpinner.succeed(
+          source_default.green("Authenticating...") + source_default.white("          done") + source_default.gray(` (${orgName})`)
+        );
+      } catch (error46) {
+        authSpinner.fail(source_default.red("Authentication failed"));
+        const errMsg = error46 instanceof Error ? error46.message : String(error46);
+        if (errMsg.includes("401") || errMsg.toLowerCase().includes("unauthorized")) {
+          const keyVar = !options2.prod && process.env.NODE_ENV === "development" && process.env.ELEVASIS_PLATFORM_KEY_DEV ? "ELEVASIS_PLATFORM_KEY_DEV" : "ELEVASIS_PLATFORM_KEY";
+          console.error(source_default.red("  Invalid API key."));
+          console.error(source_default.gray(`  Your ${keyVar} was rejected by the server.`));
+          console.error(source_default.gray("  Check your .env file and verify the key in the Elevasis dashboard."));
+        } else {
+          console.error(source_default.gray("  Check your API key and API URL."));
+        }
+        throw error46;
       }
-      throw error46;
-    }
-    const validateSpinner = ora("Validating...").start();
-    let org;
-    try {
-      const jiti = (0, import_jiti.createJiti)(import_meta.url);
-      const entryModule = await jiti.import((0, import_path.resolve)(entryPath));
-      org = entryModule.default;
-      if (!org) {
-        validateSpinner.fail("Invalid entry: no default export found");
-        console.error(source_default.gray(`  Entry file: ${(0, import_path.resolve)(entryPath)}`));
-        throw new Error("Invalid entry: no default export found");
+      const validateSpinner = ora("Validating...").start();
+      let org;
+      try {
+        const jiti = (0, import_jiti.createJiti)(import_meta.url);
+        const entryModule = await jiti.import((0, import_path.resolve)(entryPath));
+        org = entryModule.default;
+        if (!org) {
+          validateSpinner.fail("Invalid entry: no default export found");
+          console.error(source_default.gray(`  Entry file: ${(0, import_path.resolve)(entryPath)}`));
+          throw new Error("Invalid entry: no default export found");
+        }
+        new ResourceRegistry({ [orgName]: org });
+        const workflowCount = org.workflows?.length ?? 0;
+        const agentCount = org.agents?.length ?? 0;
+        const totalCount = workflowCount + agentCount;
+        validateSpinner.succeed(
+          source_default.green("Validating...") + source_default.white("              done") + source_default.gray(` (${totalCount} resource${totalCount !== 1 ? "s" : ""}, 0 errors)`)
+        );
+        console.log("");
+        console.log(source_default.gray(`  Org:    ${orgName}`));
+        console.log(source_default.gray(`  Target: ${apiUrl} (${env2})`));
+        console.log("");
+        for (const w of org.workflows ?? []) {
+          console.log(source_default.gray(`  workflow  ${source_default.white(w.config.resourceId)}  v${w.config.version}`));
+        }
+        for (const a of org.agents ?? []) {
+          console.log(source_default.gray(`  agent     ${source_default.white(a.config.resourceId)}  v${a.config.version}`));
+        }
+        console.log("");
+      } catch (error46) {
+        if (error46 instanceof RegistryValidationError) {
+          validateSpinner.fail(source_default.red("Validation failed"));
+          console.error("");
+          console.error(source_default.red(`  ERROR  ${error46.message}`));
+          if (error46.resourceId) {
+            console.error(source_default.gray(`  Resource: ${error46.resourceId}`));
+          }
+          console.error("");
+          console.error(source_default.gray("  Deploy aborted."));
+        }
+        throw error46;
       }
-      new ResourceRegistry({ [orgName]: org });
-      const workflowCount = org.workflows?.length ?? 0;
-      const agentCount = org.agents?.length ?? 0;
-      const totalCount = workflowCount + agentCount;
-      validateSpinner.succeed(
-        source_default.green("Validating...") + source_default.white("              done") + source_default.gray(` (${totalCount} resource${totalCount !== 1 ? "s" : ""}, 0 errors)`)
-      );
-      console.log("");
-      console.log(source_default.gray(`  Org:    ${orgName}`));
-      console.log(source_default.gray(`  Target: ${apiUrl} (${env2})`));
-      console.log("");
-      for (const w of org.workflows ?? []) {
-        console.log(source_default.gray(`  workflow  ${source_default.white(w.config.resourceId)}  v${w.config.version}`));
+      await generateResourceMap(org);
+      await generateProjectMap(org);
+      let documentation = await scanDocumentation();
+      if (documentation) {
+        await generateNavigationMap(documentation);
+        documentation = await scanDocumentation();
+        console.log(
+          source_default.gray(
+            `  docs    ${source_default.white(String(documentation.length))} file${documentation.length !== 1 ? "s" : ""}`
+          )
+        );
       }
-      for (const a of org.agents ?? []) {
-        console.log(source_default.gray(`  agent     ${source_default.white(a.config.resourceId)}  v${a.config.version}`));
+      const triggerCount = org.triggers?.length ?? 0;
+      const integrationCount = org.integrations?.length ?? 0;
+      const checkpointCount = org.humanCheckpoints?.length ?? 0;
+      if (triggerCount > 0) console.log(source_default.gray(`  triggers  ${source_default.white(String(triggerCount))}`));
+      if (integrationCount > 0) console.log(source_default.gray(`  integrations  ${source_default.white(String(integrationCount))}`));
+      if (checkpointCount > 0) console.log(source_default.gray(`  checkpoints  ${source_default.white(String(checkpointCount))}`));
+      const relationshipCount = org.relationships ? Object.keys(org.relationships).length : 0;
+      if (relationshipCount > 0) {
+        console.log(
+          source_default.gray(
+            `  rels    ${source_default.white(String(relationshipCount))} resource${relationshipCount !== 1 ? "s" : ""}`
+          )
+        );
       }
-      console.log("");
-    } catch (error46) {
-      if (error46 instanceof RegistryValidationError) {
-        validateSpinner.fail(source_default.red("Validation failed"));
-        console.error("");
-        console.error(source_default.red(`  ERROR  ${error46.message}`));
-        if (error46.resourceId) {
-          console.error(source_default.gray(`  Resource: ${error46.resourceId}`));
+      const schemaWarnings = [];
+      const workflows = (org.workflows ?? []).map((w) => {
+        const meta = {
+          resourceId: w.config.resourceId,
+          name: w.config.name,
+          version: w.config.version,
+          status: w.config.status,
+          description: w.config.description,
+          domains: w.config.domains
+        };
+        if (w.contract.inputSchema) {
+          try {
+            meta.inputSchema = external_exports.toJSONSchema(w.contract.inputSchema);
+          } catch {
+            schemaWarnings.push(`${w.config.resourceId}: inputSchema could not be serialized`);
+          }
         }
-        console.error("");
-        console.error(source_default.gray("  Deploy aborted."));
-      }
-      throw error46;
-    }
-    await generateResourceMap(org);
-    await generateProjectMap(org);
-    const documentation = await scanDocumentation();
-    if (documentation) {
-      console.log(source_default.gray(`  docs    ${source_default.white(String(documentation.length))} file${documentation.length !== 1 ? "s" : ""}`));
-    }
-    const triggerCount = org.triggers?.length ?? 0;
-    const integrationCount = org.integrations?.length ?? 0;
-    const checkpointCount = org.humanCheckpoints?.length ?? 0;
-    if (triggerCount > 0) console.log(source_default.gray(`  triggers  ${source_default.white(String(triggerCount))}`));
-    if (integrationCount > 0) console.log(source_default.gray(`  integrations  ${source_default.white(String(integrationCount))}`));
-    if (checkpointCount > 0) console.log(source_default.gray(`  checkpoints  ${source_default.white(String(checkpointCount))}`));
-    const relationshipCount = org.relationships ? Object.keys(org.relationships).length : 0;
-    if (relationshipCount > 0) {
-      console.log(source_default.gray(`  rels    ${source_default.white(String(relationshipCount))} resource${relationshipCount !== 1 ? "s" : ""}`));
-    }
-    const schemaWarnings = [];
-    const workflows = (org.workflows ?? []).map((w) => {
-      const meta = {
-        resourceId: w.config.resourceId,
-        name: w.config.name,
-        version: w.config.version,
-        status: w.config.status,
-        description: w.config.description,
-        domains: w.config.domains
-      };
-      if (w.contract.inputSchema) {
-        try {
-          meta.inputSchema = external_exports.toJSONSchema(w.contract.inputSchema);
-        } catch {
-          schemaWarnings.push(`${w.config.resourceId}: inputSchema could not be serialized`);
+        if (w.contract.outputSchema) {
+          try {
+            meta.outputSchema = external_exports.toJSONSchema(w.contract.outputSchema);
+          } catch {
+            schemaWarnings.push(`${w.config.resourceId}: outputSchema could not be serialized`);
+          }
         }
-      }
-      if (w.contract.outputSchema) {
-        try {
-          meta.outputSchema = external_exports.toJSONSchema(w.contract.outputSchema);
-        } catch {
-          schemaWarnings.push(`${w.config.resourceId}: outputSchema could not be serialized`);
+        return meta;
+      });
+      const agents = (org.agents ?? []).map((a) => {
+        const meta = {
+          resourceId: a.config.resourceId,
+          name: a.config.name,
+          version: a.config.version,
+          status: a.config.status,
+          description: a.config.description,
+          domains: a.config.domains
+        };
+        if (a.contract.inputSchema) {
+          try {
+            meta.inputSchema = external_exports.toJSONSchema(a.contract.inputSchema);
+          } catch {
+            schemaWarnings.push(`${a.config.resourceId}: inputSchema could not be serialized`);
+          }
         }
-      }
-      return meta;
-    });
-    const agents = (org.agents ?? []).map((a) => {
-      const meta = {
-        resourceId: a.config.resourceId,
-        name: a.config.name,
-        version: a.config.version,
-        status: a.config.status,
-        description: a.config.description,
-        domains: a.config.domains
-      };
-      if (a.contract.inputSchema) {
-        try {
-          meta.inputSchema = external_exports.toJSONSchema(a.contract.inputSchema);
-        } catch {
-          schemaWarnings.push(`${a.config.resourceId}: inputSchema could not be serialized`);
+        if (a.contract.outputSchema) {
+          try {
+            meta.outputSchema = external_exports.toJSONSchema(a.contract.outputSchema);
+          } catch {
+            schemaWarnings.push(`${a.config.resourceId}: outputSchema could not be serialized`);
+          }
         }
-      }
-      if (a.contract.outputSchema) {
-        try {
-          meta.outputSchema = external_exports.toJSONSchema(a.contract.outputSchema);
-        } catch {
-          schemaWarnings.push(`${a.config.resourceId}: outputSchema could not be serialized`);
+        return meta;
+      });
+      if (schemaWarnings.length > 0) {
+        for (const warning of schemaWarnings) {
+          console.log(source_default.yellow(`  warn  ${warning}`));
         }
+        console.log(source_default.gray("  Schemas will be unavailable on the platform for these resources."));
+        console.log("");
       }
-      return meta;
-    });
-    if (schemaWarnings.length > 0) {
-      for (const warning of schemaWarnings) {
-        console.log(source_default.yellow(`  warn  ${warning}`));
-      }
-      console.log(source_default.gray("  Schemas will be unavailable on the platform for these resources."));
-      console.log("");
-    }
-    const bundleSpinner = ora("Bundling...").start();
-    const wrapperPath = (0, import_path.resolve)("__elevasis_worker.ts");
-    const bundleOutfile = (0, import_path.resolve)("dist/bundle.js");
-    try {
-      const entryImport = entryPath.replace(/\.ts$/, ".js");
-      const wrapperContent = `import org from ${JSON.stringify(entryImport)}
+      const bundleSpinner = ora("Bundling...").start();
+      const wrapperPath = (0, import_path.resolve)("__elevasis_worker.ts");
+      const bundleOutfile = (0, import_path.resolve)("dist/bundle.js");
+      try {
+        const entryImport = entryPath.replace(/\.ts$/, ".js");
+        const wrapperContent = `import org from ${JSON.stringify(entryImport)}
 import { startWorker } from '@elevasis/sdk/worker'
 startWorker(org)
 `;
-      await (0, import_promises.writeFile)(wrapperPath, wrapperContent, "utf-8");
-      await (0, import_promises.mkdir)((0, import_path.resolve)("dist"), { recursive: true });
-      await esbuild.build({
-        entryPoints: [wrapperPath],
-        bundle: true,
-        platform: "node",
-        format: "cjs",
-        outfile: bundleOutfile
-      });
-      await (0, import_promises.unlink)(wrapperPath);
-      const bundleBuffer = await (0, import_promises.readFile)(bundleOutfile);
-      const bundleSizeKB = Math.round(bundleBuffer.length / 1024);
-      bundleSpinner.succeed(
-        source_default.green("Bundling...") + source_default.white("                done") + source_default.gray(` (${bundleSizeKB} KB)`)
-      );
-    } catch (error46) {
-      try {
+        await (0, import_promises.writeFile)(wrapperPath, wrapperContent, "utf-8");
+        await (0, import_promises.mkdir)((0, import_path.resolve)("dist"), { recursive: true });
+        await esbuild.build({
+          entryPoints: [wrapperPath],
+          bundle: true,
+          platform: "node",
+          format: "cjs",
+          outfile: bundleOutfile
+        });
         await (0, import_promises.unlink)(wrapperPath);
-      } catch {
+        const bundleBuffer = await (0, import_promises.readFile)(bundleOutfile);
+        const bundleSizeKB = Math.round(bundleBuffer.length / 1024);
+        bundleSpinner.succeed(
+          source_default.green("Bundling...") + source_default.white("                done") + source_default.gray(` (${bundleSizeKB} KB)`)
+        );
+      } catch (error46) {
+        try {
+          await (0, import_promises.unlink)(wrapperPath);
+        } catch {
+        }
+        bundleSpinner.fail(source_default.red("Bundling failed"));
+        throw error46;
       }
-      bundleSpinner.fail(source_default.red("Bundling failed"));
-      throw error46;
-    }
-    const uploadSpinner = ora("Uploading...").start();
-    try {
-      const bundleBuffer = await (0, import_promises.readFile)(bundleOutfile);
-      const apiKey = resolveApiKey(options2.prod);
-      if (!apiKey) {
-        uploadSpinner.fail(source_default.red("Missing API key environment variable"));
-        console.error(source_default.gray("  Set it in your .env file or shell environment:"));
-        if (!options2.prod && process.env.NODE_ENV === "development") {
-          console.error(source_default.gray("    ELEVASIS_PLATFORM_KEY_DEV=sk_...  (or ELEVASIS_PLATFORM_KEY as fallback)"));
-        } else {
-          console.error(source_default.gray("    ELEVASIS_PLATFORM_KEY=sk_..."));
-        }
-        throw new Error("Missing API key environment variable");
-      }
-      const metadata = {
-        sdkVersion: SDK_VERSION,
-        mode: env2,
-        resources: { workflows, agents },
-        ...documentation ? { documentation } : {},
-        ...org.relationships ? { relationships: org.relationships } : {}
-      };
-      const form = new FormData();
-      form.append("bundle", new Blob([bundleBuffer]), "bundle.js");
-      form.append("metadata", JSON.stringify(metadata));
-      const response = await fetch(`${apiUrl}/api/external/deploy`, {
-        method: "POST",
-        headers: { Authorization: `Bearer ${apiKey}` },
-        body: form
-      });
-      if (!response.ok) {
-        const errorText = await response.text();
-        uploadSpinner.fail(source_default.red("Upload failed"));
-        console.error(source_default.red(`  ${response.status}: ${errorText}`));
-        throw new Error(`Deploy upload failed (${response.status}): ${errorText}`);
-      }
-      const result = await response.json();
-      uploadSpinner.succeed(
-        source_default.green("Uploading...") + source_default.white("               done")
-      );
-      const totalResources = (org.workflows?.length ?? 0) + (org.agents?.length ?? 0);
-      const elapsed = ((Date.now() - startTime) / 1e3).toFixed(1);
-      if (result.status === "active") {
-        console.log("");
-        console.log(source_default.green.bold(`  Deployed! ${totalResources} resource${totalResources !== 1 ? "s" : ""} live.`));
-        if (result.deployId) {
-          console.log(source_default.gray(`  Version:  ${result.deployId}`));
+      const uploadSpinner = ora("Uploading...").start();
+      try {
+        const bundleBuffer = await (0, import_promises.readFile)(bundleOutfile);
+        const apiKey = resolveApiKey(options2.prod);
+        if (!apiKey) {
+          uploadSpinner.fail(source_default.red("Missing API key environment variable"));
+          console.error(source_default.gray("  Set it in your .env file or shell environment:"));
+          if (!options2.prod && process.env.NODE_ENV === "development") {
+            console.error(source_default.gray("    ELEVASIS_PLATFORM_KEY_DEV=sk_...  (or ELEVASIS_PLATFORM_KEY as fallback)"));
+          } else {
+            console.error(source_default.gray("    ELEVASIS_PLATFORM_KEY=sk_..."));
+          }
+          throw new Error("Missing API key environment variable");
         }
-        console.log(source_default.gray(`  Duration: ${elapsed}s`));
-      } else if (result.status === "failed") {
-        console.log("");
-        console.log(source_default.red.bold("  Deploy failed."));
-        if (result.error) {
-          console.error(source_default.red(`  ${result.error}`));
+        const metadata = {
+          sdkVersion: SDK_VERSION,
+          mode: env2,
+          resources: { workflows, agents },
+          ...documentation ? { documentation } : {},
+          ...org.relationships ? { relationships: org.relationships } : {}
+        };
+        const form = new FormData();
+        form.append("bundle", new Blob([bundleBuffer]), "bundle.js");
+        form.append("metadata", JSON.stringify(metadata));
+        const response = await fetch(`${apiUrl}/api/external/deploy`, {
+          method: "POST",
+          headers: { Authorization: `Bearer ${apiKey}` },
+          body: form
+        });
+        if (!response.ok) {
+          const errorText = await response.text();
+          uploadSpinner.fail(source_default.red("Upload failed"));
+          console.error(source_default.red(`  ${response.status}: ${errorText}`));
+          throw new Error(`Deploy upload failed (${response.status}): ${errorText}`);
+        }
+        const result = await response.json();
+        uploadSpinner.succeed(source_default.green("Uploading...") + source_default.white("               done"));
+        const totalResources = (org.workflows?.length ?? 0) + (org.agents?.length ?? 0);
+        const elapsed = ((Date.now() - startTime) / 1e3).toFixed(1);
+        if (result.status === "active") {
+          console.log("");
+          console.log(
+            source_default.green.bold(`  Deployed! ${totalResources} resource${totalResources !== 1 ? "s" : ""} live.`)
+          );
+          if (result.deployId) {
+            console.log(source_default.gray(`  Version:  ${result.deployId}`));
+          }
+          console.log(source_default.gray(`  Duration: ${elapsed}s`));
+        } else if (result.status === "failed") {
+          console.log("");
+          console.log(source_default.red.bold("  Deploy failed."));
+          if (result.error) {
+            console.error(source_default.red(`  ${result.error}`));
+          }
+          throw new Error(`Deploy failed: ${result.error ?? "unknown error"}`);
+        } else {
+          console.log("");
+          console.log(source_default.yellow(`  Deploy status: ${result.status ?? "unknown"}`));
+          if (result.deployId) {
+            console.log(source_default.gray(`  Version: ${result.deployId}`));
+          }
         }
-        throw new Error(`Deploy failed: ${result.error ?? "unknown error"}`);
-      } else {
-        console.log("");
-        console.log(source_default.yellow(`  Deploy status: ${result.status ?? "unknown"}`));
-        if (result.deployId) {
-          console.log(source_default.gray(`  Version: ${result.deployId}`));
+      } catch (error46) {
+        if (uploadSpinner.isSpinning) {
+          uploadSpinner.fail(source_default.red("Deploy failed"));
         }
+        throw error46;
       }
-    } catch (error46) {
-      if (uploadSpinner.isSpinning) {
-        uploadSpinner.fail(source_default.red("Deploy failed"));
-      }
-      throw error46;
-    }
-  }));
+    })
+  );
 }
 
 // src/cli/commands/check.ts
@@ -44663,6 +44753,7 @@ function registerCheckCommand(program3) {
 }
 
 // src/cli/commands/exec.ts
+var import_node_fs = require("node:fs");
 var POLL_INTERVAL_MS = 3e3;
 async function pollForCompletion(resourceId, executionId, apiUrl) {
   const pollSpinner = ora("Waiting for completion...").start();
@@ -44681,10 +44772,7 @@ async function pollForCompletion(resourceId, executionId, apiUrl) {
     const elapsed = Math.round((Date.now() - startTime) / 1e3);
     pollSpinner.text = `Waiting for completion... (${elapsed}s)`;
     try {
-      const detail = await apiGet(
-        `/api/external/executions/${resourceId}/${executionId}`,
-        apiUrl
-      );
+      const detail = await apiGet(`/api/external/executions/${resourceId}/${executionId}`, apiUrl);
       if (detail.status === "completed" || detail.status === "failed") {
         process.removeListener("SIGINT", cleanup);
         if (detail.status === "completed") {
@@ -44717,70 +44805,71 @@ async function pollForCompletion(resourceId, executionId, apiUrl) {
 }
 function registerExecCommand(program3) {
   program3.command("exec <resourceId>").description(`Execute a deployed resource
-  Example: elevasis-sdk exec my-workflow -i '{"key":"value"}'`).option("-i, --input <json>", "Input data as JSON string").option("--async", "Execute asynchronously with polling").option("--api-url <url>", "API URL").action(wrapAction("exec", async (resourceId, options2) => {
-    const input = options2.input ? JSON.parse(options2.input) : {};
-    const apiUrl = resolveApiUrl(options2.apiUrl);
-    if (options2.async) {
-      const asyncSpinner = ora(`Starting async execution of ${resourceId}...`).start();
-      const asyncResult = await apiPost(
-        "/api/external/execute-async",
-        { resourceId, input },
-        apiUrl
-      );
-      asyncSpinner.succeed(source_default.green("Execution started"));
-      console.log(source_default.gray("  Execution ID:"), source_default.cyan(asyncResult.executionId));
-      console.log("");
-      await pollForCompletion(resourceId, asyncResult.executionId, apiUrl);
-      return;
-    }
-    const spinner = ora(`Executing ${resourceId}...`).start();
-    try {
-      const result = await apiPost(
-        "/api/external/execute",
-        { resourceId, input },
-        apiUrl
-      );
-      if (result.success) {
-        spinner.succeed(source_default.green("Execution complete"));
-        console.log(source_default.gray("  Execution ID:"), source_default.cyan(result.executionId));
-        console.log("");
-        console.log(source_default.green("  Output:"));
-        console.log(JSON.stringify(result.data, null, 2));
-      } else {
-        spinner.fail(source_default.red("Execution failed"));
-        console.log(source_default.gray("  Execution ID:"), source_default.cyan(result.executionId));
-      }
-    } catch (error46) {
-      const message = error46 instanceof Error ? error46.message : String(error46);
-      const isConnectionFailure = message.includes("fetch failed") || message.includes("ECONNRESET") || message.includes("socket hang up") || message.includes("network");
-      if (isConnectionFailure) {
-        spinner.warn("Connection lost -- execution may still be running");
-        console.log();
-        try {
-          const recoverSpinner = ora("Recovering execution...").start();
-          const listResult = await apiGet(
-            `/api/external/executions/${resourceId}?limit=1`,
+  Example: elevasis-sdk exec my-workflow -i '{"key":"value"}'`).option("-i, --input <json>", "Input data as JSON string").option("-f, --input-file <path>", "Read input from a JSON file (avoids shell escaping issues)").option("--async", "Execute asynchronously with polling").option("--api-url <url>", "API URL").action(
+    wrapAction(
+      "exec",
+      async (resourceId, options2) => {
+        const input = options2.inputFile ? JSON.parse((0, import_node_fs.readFileSync)(options2.inputFile, "utf8")) : options2.input ? JSON.parse(options2.input) : {};
+        const apiUrl = resolveApiUrl(options2.apiUrl);
+        if (options2.async) {
+          const asyncSpinner = ora(`Starting async execution of ${resourceId}...`).start();
+          const asyncResult = await apiPost(
+            "/api/external/execute-async",
+            { resourceId, input },
             apiUrl
           );
-          const running = listResult.executions.find((e) => e.status === "running");
-          if (running) {
-            recoverSpinner.succeed(`Found running execution: ${running.id}`);
-            console.log();
-            await pollForCompletion(resourceId, running.id, apiUrl);
+          asyncSpinner.succeed(source_default.green("Execution started"));
+          console.log(source_default.gray("  Execution ID:"), source_default.cyan(asyncResult.executionId));
+          console.log("");
+          await pollForCompletion(resourceId, asyncResult.executionId, apiUrl);
+          return;
+        }
+        const spinner = ora(`Executing ${resourceId}...`).start();
+        try {
+          const result = await apiPost("/api/external/execute", { resourceId, input }, apiUrl);
+          if (result.success) {
+            spinner.succeed(source_default.green("Execution complete"));
+            console.log(source_default.gray("  Execution ID:"), source_default.cyan(result.executionId));
+            console.log("");
+            console.log(source_default.green("  Output:"));
+            console.log(JSON.stringify(result.data, null, 2));
           } else {
-            recoverSpinner.info("No running execution found -- it may have already completed");
-            console.log(source_default.dim("  Check status manually or re-run with --async"));
+            spinner.fail(source_default.red("Execution failed"));
+            console.log(source_default.gray("  Execution ID:"), source_default.cyan(result.executionId));
           }
-        } catch {
-          console.log(source_default.yellow("Could not recover. The execution may still be running on the server."));
-          console.log(source_default.dim("  Check status manually or re-run with --async"));
+        } catch (error46) {
+          const message = error46 instanceof Error ? error46.message : String(error46);
+          const isConnectionFailure = message.includes("fetch failed") || message.includes("ECONNRESET") || message.includes("socket hang up") || message.includes("network");
+          if (isConnectionFailure) {
+            spinner.warn("Connection lost -- execution may still be running");
+            console.log();
+            try {
+              const recoverSpinner = ora("Recovering execution...").start();
+              const listResult = await apiGet(
+                `/api/external/executions/${resourceId}?limit=1`,
+                apiUrl
+              );
+              const running = listResult.executions.find((e) => e.status === "running");
+              if (running) {
+                recoverSpinner.succeed(`Found running execution: ${running.id}`);
+                console.log();
+                await pollForCompletion(resourceId, running.id, apiUrl);
+              } else {
+                recoverSpinner.info("No running execution found -- it may have already completed");
+                console.log(source_default.dim("  Check status manually or re-run with --async"));
+              }
+            } catch {
+              console.log(source_default.yellow("Could not recover. The execution may still be running on the server."));
+              console.log(source_default.dim("  Check status manually or re-run with --async"));
+            }
+            process.exit(0);
+          }
+          spinner.fail(source_default.red("Execution failed"));
+          throw error46;
         }
-        process.exit(0);
       }
-      spinner.fail(source_default.red("Execution failed"));
-      throw error46;
-    }
-  }));
+    )
+  );
 }
 
 // src/cli/commands/resources.ts
@@ -45090,7 +45179,7 @@ var import_path3 = require("path");
 var import_promises2 = require("fs/promises");
 
 // src/cli/commands/templates/core/workspace.ts
-var TEMPLATE_VERSION = 27;
+var TEMPLATE_VERSION = 29;
 function configTemplate() {
   return `import type { ElevasConfig } from '@elevasis/sdk'
 
@@ -45102,44 +45191,52 @@ export default {
 `;
 }
 function packageJsonTemplate(organization) {
-  return JSON.stringify({
-    name: organization,
-    private: true,
-    type: "module",
-    scripts: {
-      "check-types": "tsc --noEmit",
-      check: "elevasis-sdk check",
-      deploy: "elevasis-sdk deploy"
-    },
-    dependencies: {
-      "@elevasis/sdk": `^${SDK_VERSION}`
+  return JSON.stringify(
+    {
+      name: organization,
+      private: true,
+      type: "module",
+      scripts: {
+        "check-types": "tsc --noEmit",
+        check: "elevasis-sdk check",
+        deploy: "elevasis-sdk deploy"
+      },
+      dependencies: {
+        "@elevasis/sdk": `^${SDK_VERSION}`
+      },
+      devDependencies: {
+        typescript: "5.9.2",
+        zod: "4.1.12"
+      }
     },
-    devDependencies: {
-      typescript: "5.9.2",
-      zod: "4.1.12"
-    }
-  }, null, 2) + "\n";
+    null,
+    2
+  ) + "\n";
 }
 function pnpmWorkspaceTemplate() {
   return `packages: []
 `;
 }
 function tsconfigTemplate() {
-  return JSON.stringify({
-    compilerOptions: {
-      target: "ES2022",
-      module: "ESNext",
-      moduleResolution: "Bundler",
-      strict: true,
-      esModuleInterop: true,
-      skipLibCheck: true,
-      forceConsistentCasingInFileNames: true,
-      isolatedModules: true,
-      outDir: "./dist"
+  return JSON.stringify(
+    {
+      compilerOptions: {
+        target: "ES2022",
+        module: "ESNext",
+        moduleResolution: "Bundler",
+        strict: true,
+        esModuleInterop: true,
+        skipLibCheck: true,
+        forceConsistentCasingInFileNames: true,
+        isolatedModules: true,
+        outDir: "./dist"
+      },
+      include: ["src"],
+      exclude: ["node_modules", "dist"]
     },
-    include: ["src"],
-    exclude: ["node_modules", "dist"]
-  }, null, 2) + "\n";
+    null,
+    2
+  ) + "\n";
 }
 function envTemplate() {
   return `ELEVASIS_PLATFORM_KEY=
@@ -45257,6 +45354,28 @@ function claudeSettingsTemplate() {
               }
             ]
           }
+        ],
+        PostToolUse: [
+          {
+            matcher: "Write|Edit|MultiEdit",
+            hooks: [
+              {
+                type: "command",
+                command: "node .claude/hooks/post-edit-validate.mjs"
+              }
+            ]
+          }
+        ],
+        PostToolUseFailure: [
+          {
+            matcher: "Bash",
+            hooks: [
+              {
+                type: "command",
+                command: "node .claude/hooks/tool-failure-recovery.mjs"
+              }
+            ]
+          }
         ]
       }
     },
@@ -45290,8 +45409,8 @@ process.stdin.on('end', () => {
 function claudeSdkBoundaryHookTemplate() {
   return String.raw`#!/usr/bin/env node
 // enforce-sdk-boundary.mjs
-// Blocks gh CLI, destructive git operations, and file writes outside the project root.
-// Allows git add, commit, push, pull, fetch -- used by /meta deploy.
+// Blocks file modifications (Write, Edit, MultiEdit, destructive Bash) outside the project root.
+// Git, gh, and other CLI tools are NOT blocked -- the agent can use them freely.
 
 import { resolve, normalize } from "node:path";
 import { appendFileSync, mkdirSync } from "node:fs";
@@ -45336,44 +45455,6 @@ try {
   if (input.tool_name === "Bash") {
     const cmd = input.tool_input?.command ?? "";
 
-    // GitHub CLI -- blocked (affects shared remote state, user-initiated only)
-    if (/\bgh\b/.test(cmd)) {
-      deny(
-        "BLOCKED: GitHub CLI (gh) command detected.\n" +
-        "WHY: GitHub CLI operations affect shared remote state (PRs, issues, releases). These must be user-initiated.\n" +
-        "INSTEAD: Ask the user to run this gh command manually."
-      );
-      process.exit(0);
-    }
-
-    // Destructive git -- blocked
-    if (/(?<!-)\bgit\s+reset\b/.test(cmd) && /--hard/.test(cmd)) {
-      deny(
-        "BLOCKED: git reset --hard detected.\n" +
-        "WHY: Hard resets destroy uncommitted work and cannot be undone. This must be user-initiated.\n" +
-        "INSTEAD: Ask the user to run this git command manually."
-      );
-      process.exit(0);
-    }
-
-    if (/(?<!-)\bgit\s+clean\b/.test(cmd) && /-[a-zA-Z]*f/.test(cmd)) {
-      deny(
-        "BLOCKED: git clean -f detected.\n" +
-        "WHY: Force-cleaning the working tree permanently removes untracked files. This must be user-initiated.\n" +
-        "INSTEAD: Ask the user to run this git command manually."
-      );
-      process.exit(0);
-    }
-
-    if (/(?<!-)\bgit\s+(rebase|merge)\b/.test(cmd)) {
-      deny(
-        "BLOCKED: git rebase/merge detected.\n" +
-        "WHY: Rebase and merge rewrite history or combine branches in ways that require user judgment.\n" +
-        "INSTEAD: Ask the user to run this git command manually."
-      );
-      process.exit(0);
-    }
-
     // Path-scoped blocks -- destructive commands or redirects outside project root
     const winPaths = cmd.match(/(?<![A-Za-z])[A-Za-z]:[/\\][^\s"'|;&)]+/g) || [];
     const unixPaths = cmd.match(/(?<=\s|^|"|')\/[^\s"'|;&)]+/g) || [];
@@ -45556,7 +45637,7 @@ For detailed per-dimension adaptation rules, read
 | --- | --- |
 | \`/meta\` | Project lifecycle: init, status, fix, deploy, health |
 | \`/docs\` | Browse, create, and verify permanent documentation |
-| \`/work\` | Task tracking: create, save, resume, complete |
+| \`/work\` | Task tracking: auto-detects intent (create, save, resume); suggests complete |
 | \`/tutorial\` | Progressive learning path (21 items across 4 sections) |
 
 ## Skills
@@ -45788,43 +45869,46 @@ Observation focus: full lifecycle coverage, pipeline internals.
 **Item 4: /work and /docs**
 
 When automation is none:
-"You can ask the assistant to track work across conversations. When you start something
-complex, use /work create to save your place. Next session, /work resume picks up where
-you left off." Walk through the concept without deep command details. Then introduce /docs:
-"When a task is finished, /work complete moves it to docs/ permanently. After that, /docs
-helps you find and read what's there -- like a notebook for your project." Run /docs (no
-args) to show the docs/ overview together.
-Verify: Create a task with \`/work create "practice task"\`, then run /work to see it listed.
+"You can ask the assistant to track work across conversations. Just say /work and tell it
+what you're working on -- it figures out the rest. It'll save your progress automatically,
+and next session you just say /work to pick up where you left off." Walk through the
+concept without deep command details. Then introduce /docs:
+"When a task is done, the assistant will ask if you want to finalize it -- that moves it
+to docs/ permanently. /docs helps you find and read what's there -- like a notebook for
+your project." Run /docs (no args) to show the docs/ overview together.
+Verify: Run \`/work\` and describe "practice task", see it created automatically.
 Then run /docs to see the docs/ structure.
 Observation focus: persistence concept, cross-session continuity, docs as permanent notes.
 
 When automation is low-code:
-Show /work operations: create (task doc with frontmatter + sections), save (updates
-Progress + Resume Context), resume (loads context for next session), complete (moves
-to permanent docs/).
+Show /work as intent-driven: the agent detects whether to create, resume, or save based
+on context. Create happens when you describe new work, resume when you pick an existing
+task, save happens automatically when progress is made. Complete is the only action that
+asks permission first.
 Then introduce /docs: "/docs is for permanent knowledge -- things that don't expire. Use
 /docs create to document a workflow or integration. Use /docs verify to check if your
 docs match the current code." Explain the boundary: /work manages in-progress/, /docs
 manages permanent docs/.
-Verify: Create a task with \`/work create "practice task"\`, run /work save, inspect the
-file. Then run /docs to browse docs/.
-Observation focus: task tracking workflow, /work vs /docs separation.
+Verify: Run \`/work\` and describe "practice task", see auto-create. Make some changes,
+then notice auto-save. Then run /docs to browse docs/.
+Observation focus: intent-driven task tracking, /work vs /docs separation.
 
 When automation is custom:
 Read \`.claude/commands/work.md\`. Full /work coverage:
-/work create (kebab-case filename, frontmatter with status, Objective/Plan/Progress/
-Resume Context sections), /work save (Progress + Resume Context update), /work resume
-(multiple-task disambiguation), /work complete (moves to final location).
+Intent detection table (list, create, resume, save auto-invoked; complete always suggests).
+Task doc anatomy: kebab-case filename, frontmatter with status, Objective/Plan/Progress/
+Resume Context sections. Auto-save behavior: triggers on heavy context, wrap-up signals,
+2+ steps completed. Resolution order for resume: number, keyword match, single in-progress.
 Then read \`.claude/commands/docs.md\`. Cover /docs operations:
 /docs (default): browse permanent docs/, categorized with read-only auto-generated files
 separate; /docs create: interview-driven, resource-aware doc creation from src/ code
 analysis; /docs verify: cross-references resource IDs, schema fields, platform tools in
 docs against src/ -- standalone analog of /meta fix step 5.
-Explain the relationship: /work owns docs/in-progress/ (task lifecycle), /work complete
+Explain the relationship: /work owns docs/in-progress/ (task lifecycle), completing a task
 moves docs to permanent location, /docs browses and verifies what's there.
-Verify: Create a task doc, save progress, run /work complete to move it. Then run /docs
-to see it in the permanent docs/ listing.
-Observation focus: task doc anatomy, /work-to-/docs handoff, docs verification as standalone tool.
+Verify: Create a task via /work, make progress, observe auto-save, then run /work complete
+to move it. Run /docs to see it in the permanent docs/ listing.
+Observation focus: intent detection, auto-save behavior, /work-to-/docs handoff, docs verification.
 
 **Item 5: Your First Custom Workflow**
 
@@ -46358,6 +46442,8 @@ function claudeWorkCommandTemplate() {
 
 You are a task tracking assistant for this Elevasis workspace. \`/work\` is the primary command for managing all work and projects.
 
+Your job is to **intelligently manage tasks without requiring the user to know subcommands**. Detect what the user needs from context and act accordingly.
+
 ## Context
 
 Read \`docs/priorities.mdx\` if it exists for current priorities.
@@ -46377,9 +46463,25 @@ When scanning, treat \`index.mdx\` as the primary task doc for a directory.
 
 Enforce exactly three values in frontmatter: \`planned\`, \`in-progress\`, \`complete\`.
 
-## Operations
+## Intent Detection
+
+When \`/work\` is invoked (with or without arguments), detect intent from context:
+
+| Signal | Action |
+|--------|--------|
+| No arguments, no active conversation context | **List** tasks, then let user pick |
+| User picks a number or names a task | **Resume** that task automatically |
+| User describes new work (not matching existing tasks) | **Create** a task doc automatically |
+| \`/work\` with a description that matches no existing task | **Create** automatically |
+| \`/work\` with a keyword/name matching an existing task | **Resume** automatically |
+| Conversation is getting heavy, user wrapping up, or 2+ steps completed | **Save** automatically |
+| All plan steps are COMPLETE | **Suggest** \`/work complete\` (never auto-invoke) |
+
+**Key principle:** Create, save, and resume are auto-invoked. Complete always asks permission first.
+
+## Behaviors
 
-### No arguments (default) -- List and Pick
+### List and Pick (default when no context)
 
 1. Scan \`docs/in-progress/\` recursively for \`.mdx\` files with \`status\` frontmatter
 2. For directories, read \`index.mdx\` as the primary task doc
@@ -46398,30 +46500,25 @@ Active Tasks
 3. [complete] CRM Integration
    Completed: 2026-03-03
 
-Pick a task by number or name to resume, or say:
-- "create" to start new work
-- "complete <name>" to finish a task
+Pick a task by number or name, or describe new work to start.
 \`\`\`
 
 4. Cross-reference with \`docs/priorities.mdx\` if it exists
-5. When the user picks a number or describes a task in natural language, auto-invoke the **resume** flow on that task
-6. If no tasks found, suggest \`/work create\`
+5. When the user picks a number or describes a task, auto-invoke the appropriate flow (resume or create)
+6. If no tasks found, ask: "What are you trying to accomplish?"
 
-### \`create [description]\`
+### Create (auto-invoked when new work detected)
 
-Guided task creation with interview:
-
-1. If no description given, ask: "What are you trying to accomplish?"
-2. Ask 2-3 focused questions:
+1. If the user's intent is clear, skip the interview and create directly
+2. If ambiguous, ask 1-2 focused questions:
    - "What does success look like?" (acceptance criteria)
-   - "Is this related to any existing work?" (scan \`docs/in-progress/\` and \`docs/\` for related topics)
-   - "Do we need to investigate anything first, or is the path clear?" (suggest investigation if needed)
-3. Determine directory placement:
-   - Scan \`docs/in-progress/\` for existing directories related to the topic
+   - "Do we need to investigate anything first, or is the path clear?"
+3. Scan \`docs/in-progress/\` for existing directories related to the topic
+4. Determine directory placement:
    - If related to existing directory, create as a file within it
    - If new concept that may grow, create \`docs/in-progress/<slug>/index.mdx\`
    - If small/standalone, create \`docs/in-progress/<slug>.mdx\`
-4. Create the doc with \`status: planned\` and structured sections:
+5. Create the doc with \`status: planned\` and structured sections:
 
 \`\`\`yaml
 ---
@@ -46433,15 +46530,20 @@ status: planned
 
 Sections: Objective (what and why), Plan (numbered steps), Progress (per-step tracking with PENDING markers), Resume Context (current state, key docs, "To continue" prompt).
 
-5. Update \`docs/priorities.mdx\` if it exists
-6. Report what was created with location and step count
+6. Update \`docs/priorities.mdx\` if it exists
+7. Report what was created with location and step count
 
-### \`save\`
+### Save (auto-invoked when progress detected)
 
-Update the current task doc's Progress and Resume Context:
+Auto-save triggers (do NOT ask, just save):
+- The conversation context is getting heavy (many tool calls, large file reads)
+- The user appears to be wrapping up (thanks, goodbye, switching topics)
+- Significant progress has been made (2+ steps completed without saving)
+- Before a context reset
 
-1. Identify the current task from conversation context (which in-progress doc was loaded/discussed)
-2. If not working on a tracked task, list available docs and ask which to save to, or offer to create a new one
+Save flow:
+1. Identify the current task from conversation context
+2. If not working on a tracked task, offer to create a new one
 3. Update Progress section:
    - Mark completed steps as \`COMPLETE\` with: what was done, key decisions, files changed
    - Mark current step as \`IN PROGRESS\` with current state
@@ -46451,15 +46553,13 @@ Update the current task doc's Progress and Resume Context:
    - Files Modified: table of file paths and descriptions of changes
    - Key docs to read on resume: file paths with why they matter
    - To continue: copy-pasteable prompt for the next session
-5. Set \`status\` appropriately (\`in-progress\` if ongoing, \`complete\` if all steps done)
-6. Report: task title, status, completed steps count, last step, and the resume command
-
-### \`resume [name-or-number]\`
+5. Set \`status\` appropriately (\`in-progress\` if ongoing)
+6. Briefly confirm: "Progress saved to {path}."
 
-Resume in-progress work. Designed for non-technical users who may not know file paths.
+### Resume (auto-invoked when existing task detected)
 
 **Resolution order:**
-1. If a number is given (e.g., \`/work resume 2\`), map to the numbered list from the default list operation
+1. If a number is given, map to the numbered list from the task list
 2. If a name/keyword is given, substring match against task titles and filenames in \`docs/in-progress/\`
 3. If no argument, scan for \`status: in-progress\` docs -- if one found, use it; if multiple, list and ask
 4. If multiple matches, list them and ask which to resume
@@ -46485,35 +46585,32 @@ Key context loaded:
 Ready to continue. {Copy of "To continue" prompt}
 \`\`\`
 
-### \`complete [name]\`
+### Complete (NEVER auto-invoked -- always suggest)
+
+When all plan steps are COMPLETE, suggest: "All steps for '{task}' look done. Want me to finalize it?"
 
-Mark task complete, clean up, and move to permanent docs:
+Only proceed after explicit user confirmation. Then:
 
-1. Resolve target (same as resume: number, name, or scan for \`status: complete\`)
-2. **Validate readiness:** Check that all plan steps are marked COMPLETE. If not, warn and ask for confirmation.
-3. **Clean up the doc:**
+1. **Validate readiness:** Check that all plan steps are marked COMPLETE. If not, warn and ask for confirmation.
+2. **Clean up the doc:**
    - Strip \`## Resume Context\` section entirely (header through next \`##\` or EOF)
    - Strip progress markers: \`COMPLETE\`, \`IN PROGRESS\`, \`PENDING\` from step headings
    - Remove steps still marked PENDING entirely (header + body) -- they were never done
    - Remove \`status\` from frontmatter (keep \`title\` and \`description\`)
    - Target 200-400 lines; flag if result exceeds 500 lines
-4. **Determine destination:**
+3. **Determine destination:**
    - Scan \`docs/\` (excluding \`docs/in-progress/\`) for existing directories related to this work
    - If a related directory exists, propose merging into it
    - If no related directory, propose \`docs/<slug>/\` or \`docs/<slug>.mdx\`
    - Present the proposed destination and ask user to confirm
-5. **Move the doc(s):**
+4. **Move the doc(s):**
    - Single file: move from \`docs/in-progress/\` to destination
    - Directory: move entire directory
-6. **Verify and report:**
+5. **Verify and report:**
    - Confirm destination exists, source removed
    - Check no leftover \`status:\` or \`## Resume Context\` in moved files
    - Update \`docs/priorities.mdx\` if it exists
    - Report: task title, cleanup stats (lines before/after), destination path
-
-## Completion Suggestions
-
-When the agent observes that all plan steps for a task are marked COMPLETE and the user seems to be moving on, proactively suggest: "All steps for '{task}' are complete. Run \`/work complete\` to finalize it."
 `;
 }
 function claudeDocsCommandTemplate() {
@@ -46579,7 +46676,7 @@ Steps:
 
 ### \`create [description]\` -- Reference Doc Creation
 
-Interview-driven creation for permanent documentation. Task docs go through \`/work create\`.
+Interview-driven creation for permanent documentation. Task docs go through \`/work\`.
 
 1. If no description given, ask: "What do you want to document?"
 2. Determine doc type (infer or ask):
@@ -46949,17 +47046,19 @@ Exactly three values for frontmatter \`status\`: \`planned\`, \`in-progress\`, \
   - IN PROGRESS -> COMPLETE (finishing a step)
 - Do NOT update on every action -- only on step transitions
 
-## Save Suggestions
+## Auto-Save Behavior
 
-Proactively suggest \`/work save\` when:
+The agent auto-saves progress (no user action needed) when:
 - The conversation context is getting heavy (many tool calls, large file reads)
 - The user appears to be wrapping up (thanks, goodbye, switching topics)
 - Significant progress has been made (2+ steps completed without saving)
-- Before a \`/clear\` or context reset
+- Before a context reset
+
+Auto-save updates the task doc's Progress and Resume Context sections silently, then briefly confirms.
 
 ## Completion Suggestions
 
-When all plan steps are marked COMPLETE, suggest \`/work complete\` to finalize the task.
+When all plan steps are marked COMPLETE, **suggest** completing the task -- never auto-invoke. Ask: "All steps for '{task}' look done. Want me to finalize it?"
 
 ## Directory Conventions
 
@@ -46969,6 +47068,199 @@ When all plan steps are marked COMPLETE, suggest \`/work complete\` to finalize
 - Completed tasks move OUT of \`docs/in-progress/\` to \`docs/<relevant-dir>/\`
 `;
 }
+function claudePostEditValidateHookTemplate() {
+  return `#!/usr/bin/env node
+// post-edit-validate.mjs
+// PostToolUse hook \u2014 auto-formats with prettier, type-checks .ts/.tsx files.
+// Fires after Edit|Write|MultiEdit succeeds.
+
+import { existsSync } from 'node:fs'
+import { resolve, normalize, extname, join, dirname } from 'node:path'
+import { execSync } from 'node:child_process'
+
+const ROOT = process.env.CLAUDE_PROJECT_DIR ?? process.cwd()
+
+// Extensions prettier should format
+const PRETTIER_EXTENSIONS = new Set([
+  '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.json', '.css', '.md', '.mdx'
+])
+
+// Extensions that trigger type-checking
+const TS_EXTENSIONS = new Set(['.ts', '.tsx'])
+
+function findNearestTsconfig(startDir) {
+  let dir = startDir
+  const root = normalize(ROOT)
+  while (dir.length >= root.length) {
+    const candidate = join(dir, 'tsconfig.json')
+    if (existsSync(candidate)) return candidate
+    const parent = dirname(dir)
+    if (parent === dir) break
+    dir = parent
+  }
+  return null
+}
+
+try {
+  const chunks = []
+  for await (const chunk of process.stdin) chunks.push(chunk)
+  const input = JSON.parse(Buffer.concat(chunks).toString())
+
+  const filePath = input.tool_input?.file_path
+  if (!filePath) process.exit(0)
+
+  const ext = extname(filePath).toLowerCase()
+  const absPath = normalize(resolve(filePath))
+  if (!existsSync(absPath)) process.exit(0)
+
+  const results = []
+
+  // 1. Prettier
+  if (PRETTIER_EXTENSIONS.has(ext)) {
+    try {
+      execSync('pnpm exec prettier --write "' + absPath + '"', {
+        cwd: ROOT,
+        stdio: ['pipe', 'pipe', 'pipe'],
+        timeout: 10_000
+      })
+    } catch (err) {
+      const stderr = err.stderr?.toString().trim() || ''
+      if (stderr && !/ignored/i.test(stderr)) {
+        results.push('Prettier error: ' + stderr.slice(0, 300))
+      }
+    }
+  }
+
+  // 2. Type-check for .ts/.tsx
+  if (TS_EXTENSIONS.has(ext)) {
+    const tsconfig = findNearestTsconfig(dirname(absPath))
+    if (tsconfig) {
+      try {
+        execSync('pnpm exec tsc --noEmit -p "' + tsconfig + '"', {
+          cwd: ROOT,
+          stdio: ['pipe', 'pipe', 'pipe'],
+          timeout: 30_000,
+          env: { ...process.env, NODE_OPTIONS: '--max-old-space-size=4096' }
+        })
+      } catch (err) {
+        if (err.killed) process.exit(0) // Don't block on timeout
+        const stdout = err.stdout?.toString() || ''
+        if (stdout.includes('error TS')) {
+          const errorLines = stdout
+            .split('\\n')
+            .filter(l => l.includes('error TS'))
+            .slice(0, 10)
+          results.push('Type errors after editing ' + filePath + ':\\n' + errorLines.join('\\n'))
+        }
+      }
+    }
+  }
+
+  // Output errors to Claude's context (silence = success)
+  if (results.length > 0) {
+    process.stderr.write(results.join('\\n\\n'))
+    process.exit(2) // Exit 2 = send stderr as feedback to Claude
+  }
+} catch {}
+
+process.exit(0)
+`;
+}
+function claudeToolFailureRecoveryHookTemplate() {
+  return `#!/usr/bin/env node
+// tool-failure-recovery.mjs
+// PostToolUseFailure hook \u2014 pattern-matches known Bash errors and returns
+// recovery advice via stderr + exit 2 (feedback to Claude).
+
+const RECOVERY_TABLE = [
+  {
+    test: r => /JavaScript heap out of memory/i.test(r),
+    advice: 'Out of memory.',
+    fix: 'Run the command with NODE_OPTIONS="--max-old-space-size=4096".',
+    why: 'Large TypeScript projects can exceed Node default heap limit.',
+  },
+  {
+    test: r => /boundary hook/i.test(r) && /block|denied/i.test(r),
+    advice: 'Command blocked by SDK boundary hook.',
+    fix: 'Ask the user to run this command manually.',
+    why: 'The boundary hook blocks file modifications (Write, Edit, destructive Bash) outside the project boundary.',
+    see: 'CLAUDE.md',
+  },
+  {
+    test: r => /ENOENT/.test(r) && /node_modules/.test(r),
+    advice: 'Missing node_modules dependency.',
+    fix: 'Run: pnpm install',
+    why: 'Dependencies are not installed or were cleared.',
+  },
+  {
+    test: r => /ERR_MODULE_NOT_FOUND/.test(r) && /@elevasis\\/sdk/.test(r),
+    advice: '@elevasis/sdk module not found.',
+    fix: 'Run: pnpm install \u2014 then verify @elevasis/sdk is in package.json dependencies.',
+    why: 'The SDK package is not installed or the version is mismatched.',
+  },
+  {
+    test: r => /ERR_MODULE_NOT_FOUND/.test(r),
+    advice: 'Module not found at import path.',
+    fix: 'Check the import path and verify the package is installed (pnpm install).',
+    why: 'The import path does not match any installed package or local file.',
+  },
+  {
+    test: r => /TS2307/.test(r) || (/cannot find/i.test(r) && /declaration/i.test(r)),
+    advice: 'TypeScript cannot resolve module or declaration file.',
+    fix: 'Check that the package is installed and tsconfig paths are correct.',
+    why: 'Missing dependency or incorrect TypeScript configuration.',
+  },
+  {
+    test: r => /EPERM/.test(r) || /permission denied/i.test(r),
+    advice: 'Permission denied (EPERM).',
+    fix: 'Close the file in any other process (editor, terminal, or dev server) and retry.',
+    why: 'On Windows, files locked by another process cannot be written to.',
+  },
+  {
+    test: r => /lockfile/i.test(r) && /conflict|outdated|ERR_PNPM/i.test(r),
+    advice: 'pnpm lockfile conflict or outdated.',
+    fix: 'Run: pnpm install to regenerate the lockfile.',
+    why: 'The lockfile is out of sync with package.json changes.',
+  },
+  {
+    test: r => /elevasis-sdk check/.test(r) || /elevasis-sdk deploy/.test(r),
+    advice: 'elevasis-sdk CLI command failed.',
+    fix: 'Check the error output above. Common causes: missing .env ELEVASIS_API_KEY, invalid resource schemas, or network issues.',
+    why: 'The SDK CLI validates resources and communicates with the platform API.',
+  },
+  {
+    test: r => /EADDRINUSE/.test(r),
+    advice: 'Port already in use.',
+    fix: 'Find and kill the process using the port, or use a different port.',
+    why: 'A previous dev server or process is still holding the port.',
+  },
+]
+
+function formatRecovery(entry) {
+  let msg = 'FAILED: ' + entry.advice + '\\nFIX: ' + entry.fix
+  if (entry.why) msg += '\\nWHY: ' + entry.why
+  if (entry.see) msg += '\\nSEE: ' + entry.see
+  return msg
+}
+
+try {
+  const chunks = []
+  for await (const chunk of process.stdin) chunks.push(chunk)
+  const input = JSON.parse(Buffer.concat(chunks).toString())
+
+  const response = input.tool_response ?? ''
+
+  for (const entry of RECOVERY_TABLE) {
+    if (entry.test(response)) {
+      process.stderr.write(formatRecovery(entry))
+      process.exit(2)
+    }
+  }
+} catch {}
+
+process.exit(0)
+`;
+}
 
 // src/cli/commands/templates/core/resources.ts
 function starterTemplate() {
@@ -47144,6 +47436,8 @@ function getManagedTemplates(ctx = {}) {
     ".claude/settings.json": claudeSettingsTemplate,
     ".claude/scripts/statusline-command.js": claudeStatuslineScriptTemplate,
     ".claude/hooks/enforce-sdk-boundary.mjs": claudeSdkBoundaryHookTemplate,
+    ".claude/hooks/post-edit-validate.mjs": claudePostEditValidateHookTemplate,
+    ".claude/hooks/tool-failure-recovery.mjs": claudeToolFailureRecoveryHookTemplate,
     ".claude/commands/tutorial.md": claudeTutorialCommandTemplate,
     ".claude/commands/meta.md": claudeMetaCommandTemplate,
     ".claude/commands/work.md": claudeWorkCommandTemplate,
@@ -47356,6 +47650,8 @@ var MANAGED_FILES = [
   "CLAUDE.md",
   ".claude/settings.json",
   ".claude/hooks/enforce-sdk-boundary.mjs",
+  ".claude/hooks/post-edit-validate.mjs",
+  ".claude/hooks/tool-failure-recovery.mjs",
   ".claude/commands/tutorial.md",
   ".claude/commands/meta.md",
   ".claude/commands/work.md",
@@ -47370,96 +47666,100 @@ var MANAGED_FILES = [
 ];
 var SCAFFOLD_FILES = [...INIT_ONLY_FILES, ...MANAGED_FILES];
 function registerInitCommand(program3) {
-  program3.command("init [directory]").description("Scaffold a new Elevasis workspace\n  Example: elevasis-sdk init my-workspace").option("--force", "Overwrite existing files").option("--ui", "Include a Vite + React UI app in ui/").action(wrapAction("init", async (directory, options2) => {
-    const targetDir = directory ? (0, import_path3.resolve)(directory) : process.cwd();
-    const orgSlug = toSlug((0, import_path3.basename)(targetDir));
-    if (!options2.force) {
-      const filesToCheck = options2.ui ? [...SCAFFOLD_FILES, ...UI_INIT_FILES] : SCAFFOLD_FILES;
-      const conflicts = [];
-      for (const file2 of filesToCheck) {
-        try {
-          await (0, import_promises2.access)((0, import_path3.resolve)(targetDir, file2));
-          conflicts.push(file2);
-        } catch {
-        }
-      }
-      if (conflicts.length > 0) {
-        console.error(source_default.red("Files already exist:"));
-        for (const f of conflicts) {
-          console.error(source_default.gray(`  ${f}`));
+  program3.command("init [directory]").description("Scaffold a new Elevasis workspace\n  Example: elevasis-sdk init my-workspace").option("--force", "Overwrite existing files").option("--ui", "Include a Vite + React UI app in ui/").action(
+    wrapAction("init", async (directory, options2) => {
+      const targetDir = directory ? (0, import_path3.resolve)(directory) : process.cwd();
+      const orgSlug = toSlug((0, import_path3.basename)(targetDir));
+      if (!options2.force) {
+        const filesToCheck = options2.ui ? [...SCAFFOLD_FILES, ...UI_INIT_FILES] : SCAFFOLD_FILES;
+        const conflicts = [];
+        for (const file2 of filesToCheck) {
+          try {
+            await (0, import_promises2.access)((0, import_path3.resolve)(targetDir, file2));
+            conflicts.push(file2);
+          } catch {
+          }
         }
-        console.error(source_default.gray("\n  Use --force to overwrite."));
-        throw new Error("Scaffold conflict");
-      }
-    }
-    await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, "src/operations"), { recursive: true });
-    await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, "src/example"), { recursive: true });
-    await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, "src/shared"), { recursive: true });
-    await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, "docs/in-progress"), { recursive: true });
-    await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, ".claude/hooks"), { recursive: true });
-    await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, ".claude/scripts"), { recursive: true });
-    await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, ".claude/commands"), { recursive: true });
-    await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, ".claude/skills/creds"), { recursive: true });
-    await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, ".claude/rules"), { recursive: true });
-    if (options2.ui) {
-      await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, "ui/src"), { recursive: true });
-    }
-    const files = {
-      "elevasis.config.ts": configTemplate(),
-      "package.json": packageJsonTemplate(orgSlug),
-      "pnpm-workspace.yaml": pnpmWorkspaceTemplate(),
-      "tsconfig.json": tsconfigTemplate(),
-      ".env": envTemplate(),
-      ".npmrc": npmrcTemplate(),
-      ".gitignore": gitignoreTemplate({ hasUI: options2.ui }),
-      "src/index.ts": starterTemplate(),
-      "src/operations/platform-status.ts": platformStatusTemplate(),
-      "src/operations/index.ts": operationsBarrelTemplate(),
-      "src/example/echo.ts": starterWorkflowTemplate(),
-      "src/example/index.ts": exampleBarrelTemplate(),
-      "src/shared/.gitkeep": "",
-      "docs/index.mdx": docsIndexTemplate(orgSlug),
-      "docs/in-progress/.gitkeep": "",
-      "CLAUDE.md": claudeMdTemplate({ hasUI: options2.ui }),
-      ".claude/settings.json": claudeSettingsTemplate(),
-      ".claude/hooks/enforce-sdk-boundary.mjs": claudeSdkBoundaryHookTemplate(),
-      ".claude/commands/tutorial.md": claudeTutorialCommandTemplate(),
-      ".claude/commands/meta.md": claudeMetaCommandTemplate(),
-      ".claude/commands/work.md": claudeWorkCommandTemplate(),
-      ".claude/commands/docs.md": claudeDocsCommandTemplate(),
-      ".claude/skills/creds/SKILL.md": claudeCredsSkillTemplate(),
-      ".claude/rules/sdk-patterns.md": claudeSdkPatternsRuleTemplate(),
-      ".claude/rules/workspace-patterns.md": claudeWorkspaceRulesTemplate(),
-      ".claude/rules/docs-authoring.md": claudeDocsAuthoringRuleTemplate(),
-      ".claude/rules/memory-conventions.md": claudeMemoryConventionsRuleTemplate(),
-      ".claude/rules/project-map.md": claudeProjectMapRuleTemplate(),
-      ".claude/rules/task-tracking.md": claudeTaskTrackingRuleTemplate(),
-      ".claude/scripts/statusline-command.js": claudeStatuslineScriptTemplate()
-    };
-    if (options2.ui) {
-      Object.assign(files, getUIFiles(orgSlug));
-    }
-    for (const [filePath, content] of Object.entries(files)) {
-      await (0, import_promises2.writeFile)((0, import_path3.resolve)(targetDir, filePath), content, "utf-8");
-    }
-    console.log(source_default.green.bold("  Workspace created!"));
-    console.log("");
-    console.log(source_default.gray("  Next steps:"));
-    if (directory) {
-      console.log(source_default.gray(`    cd ${directory}`));
-    }
-    console.log(source_default.gray("    pnpm install"));
-    console.log(source_default.gray("    # Add your API key to .env"));
-    console.log(source_default.gray("    elevasis-sdk check"));
-    console.log(source_default.gray("    elevasis-sdk deploy"));
-    if (options2.ui) {
+        if (conflicts.length > 0) {
+          console.error(source_default.red("Files already exist:"));
+          for (const f of conflicts) {
+            console.error(source_default.gray(`  ${f}`));
+          }
+          console.error(source_default.gray("\n  Use --force to overwrite."));
+          throw new Error("Scaffold conflict");
+        }
+      }
+      await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, "src/operations"), { recursive: true });
+      await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, "src/example"), { recursive: true });
+      await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, "src/shared"), { recursive: true });
+      await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, "docs/in-progress"), { recursive: true });
+      await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, ".claude/hooks"), { recursive: true });
+      await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, ".claude/scripts"), { recursive: true });
+      await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, ".claude/commands"), { recursive: true });
+      await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, ".claude/skills/creds"), { recursive: true });
+      await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, ".claude/rules"), { recursive: true });
+      if (options2.ui) {
+        await (0, import_promises2.mkdir)((0, import_path3.resolve)(targetDir, "ui/src"), { recursive: true });
+      }
+      const files = {
+        "elevasis.config.ts": configTemplate(),
+        "package.json": packageJsonTemplate(orgSlug),
+        "pnpm-workspace.yaml": pnpmWorkspaceTemplate(),
+        "tsconfig.json": tsconfigTemplate(),
+        ".env": envTemplate(),
+        ".npmrc": npmrcTemplate(),
+        ".gitignore": gitignoreTemplate({ hasUI: options2.ui }),
+        "src/index.ts": starterTemplate(),
+        "src/operations/platform-status.ts": platformStatusTemplate(),
+        "src/operations/index.ts": operationsBarrelTemplate(),
+        "src/example/echo.ts": starterWorkflowTemplate(),
+        "src/example/index.ts": exampleBarrelTemplate(),
+        "src/shared/.gitkeep": "",
+        "docs/index.mdx": docsIndexTemplate(orgSlug),
+        "docs/in-progress/.gitkeep": "",
+        "CLAUDE.md": claudeMdTemplate({ hasUI: options2.ui }),
+        ".claude/settings.json": claudeSettingsTemplate(),
+        ".claude/hooks/enforce-sdk-boundary.mjs": claudeSdkBoundaryHookTemplate(),
+        ".claude/hooks/post-edit-validate.mjs": claudePostEditValidateHookTemplate(),
+        ".claude/hooks/tool-failure-recovery.mjs": claudeToolFailureRecoveryHookTemplate(),
+        ".claude/commands/tutorial.md": claudeTutorialCommandTemplate(),
+        ".claude/commands/meta.md": claudeMetaCommandTemplate(),
+        ".claude/commands/work.md": claudeWorkCommandTemplate(),
+        ".claude/commands/docs.md": claudeDocsCommandTemplate(),
+        ".claude/skills/creds/SKILL.md": claudeCredsSkillTemplate(),
+        ".claude/rules/sdk-patterns.md": claudeSdkPatternsRuleTemplate(),
+        ".claude/rules/workspace-patterns.md": claudeWorkspaceRulesTemplate(),
+        ".claude/rules/docs-authoring.md": claudeDocsAuthoringRuleTemplate(),
+        ".claude/rules/memory-conventions.md": claudeMemoryConventionsRuleTemplate(),
+        ".claude/rules/project-map.md": claudeProjectMapRuleTemplate(),
+        ".claude/rules/task-tracking.md": claudeTaskTrackingRuleTemplate(),
+        ".claude/scripts/statusline-command.js": claudeStatuslineScriptTemplate()
+      };
+      if (options2.ui) {
+        Object.assign(files, getUIFiles(orgSlug));
+      }
+      for (const [filePath, content] of Object.entries(files)) {
+        await (0, import_promises2.writeFile)((0, import_path3.resolve)(targetDir, filePath), content, "utf-8");
+      }
+      console.log(source_default.green.bold("  Workspace created!"));
       console.log("");
-      console.log(source_default.gray("  UI app:"));
-      console.log(source_default.gray("    cd ui && pnpm install"));
-      console.log(source_default.gray("    # Set VITE_WORKOS_CLIENT_ID in ui/.env"));
-      console.log(source_default.gray("    pnpm dev"));
-    }
-  }));
+      console.log(source_default.gray("  Next steps:"));
+      if (directory) {
+        console.log(source_default.gray(`    cd ${directory}`));
+      }
+      console.log(source_default.gray("    pnpm install"));
+      console.log(source_default.gray("    # Add your API key to .env"));
+      console.log(source_default.gray("    elevasis-sdk check"));
+      console.log(source_default.gray("    elevasis-sdk deploy"));
+      if (options2.ui) {
+        console.log("");
+        console.log(source_default.gray("  UI app:"));
+        console.log(source_default.gray("    cd ui && pnpm install"));
+        console.log(source_default.gray("    # Set VITE_WORKOS_CLIENT_ID in ui/.env"));
+        console.log(source_default.gray("    pnpm dev"));
+      }
+    })
+  );
 }
 function toSlug(name) {
   const slug = name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^[^a-z]+/, "").replace(/-+/g, "-").replace(/-$/, "");