@fulldivevr/workcord-cli 1.3.0 → 2.17.0

package/README.md

@@ -1,6 +1,6 @@
 # @fulldivevr/workcord-cli
 
-TypeScript CLI for talking to WorkCord agents through persistent Hermes tenant
+TypeScript CLI for talking to WorkCord agents through persistent Autoworker Hub tenant
 chat and using the WorkCord API. **One invocation = one user action.** Designed
 for automated agents such as Claude Code: ask the user's Assistant for the
 outcome you need, let that tenant manage its own instructions, skills, and
@@ -149,7 +149,7 @@ workcord [--as <userId>] <namespace> <command> [flags]
 ### Agent-first customization
 
 To change agent behavior, create or update a skill, or maintain a flavor, talk
-to the owning agent through Hermes tenant chat. Do not edit prompts or tenant
+to the owning agent through Hub tenant chat. Do not edit prompts or tenant
 files directly. With no `--agent`, the user's non-deletable Assistant is the
 target and becomes the default owner of anything it creates:
 
@@ -164,7 +164,7 @@ Use the returned `chatId` for follow-up, verification, or rollback:
 workcord agent chat send --chat "$CHAT_ID" --message "Verify the change, list the versions you created, and explain how to roll it back."
 ```
 
-Both commands wait up to two minutes by default and return the durable Hermes
+Both commands wait up to two minutes by default and return the durable Hub
 message document. Use `--async` for a queued response, then continue with its
 `messageId`:
 
@@ -184,8 +184,8 @@ workcord agent chat new --agent "$AGENT_ID" --message "Create and maintain a fin
 
 The Assistant or selected agent works within its tenant's Hub permissions. It
 can safely validate changes and report what it activated. `agent chat` uses
-Hermes' native durable `hub_chat` transport; it is not raw A2A wire traffic.
-A2A remains available for external agent peers. Direct `hermes` commands are
+the Hub's native durable `hub_chat` transport; it is not raw A2A wire traffic.
+A2A remains available for external agent peers. Direct `hub` commands are
 advanced diagnostics and recovery tools, not the normal customization workflow.
 
 - `workcord --help` lists namespaces.
@@ -205,6 +205,7 @@ workcord <namespace> <command> [--<path-param> <value>] [--body '<json>'] [--que
 ```bash
 workcord auth login --email you@company.com
 workcord --as USER messages send-text --room R --text "hello"
+workcord messages ask-agent --room R --agent INSTALLATION_ID --text "Summarize the decision"
 ```
 
 Semantic aliases cover common agent/admin actions with consistent flags:
@@ -225,6 +226,10 @@ Server auto-extracts mention tokens from visible `@Name` text. Prefer
 member's display name and avoids exposing raw user ids. `auth login` never
 takes `--as` — it is how you obtain a `WORKCORD_TOKEN` in the first place.
 
+`messages ask-agent` posts an ordinary visible `@Agent` request, then waits for
+that installed agent's visible reply in the room or request thread. Pass the
+`installationId` returned by Home to `--agent`.
+
 ### Error handling
 
 Every error is **a single JSON line on stderr**, with a non-zero exit code:
@@ -316,22 +321,25 @@ workcord --as $U dm send-text --to $OTHER --text "hey"
 # → composite: opens (or finds) the DM room, sends the message, returns both
 ```
 
-## Advanced Hermes diagnostics and recovery (`hermes` namespace)
+## Advanced Hub diagnostics and recovery (`hub` namespace)
 
-WorkCord provisions a **Hermes Hub tenant** for each room-agent, Hermes custom
+WorkCord provisions an **Autoworker Hub tenant** for each room-agent, custom
 agent, and room-scoped marketplace flavor install. That tenant is where the
 agent actually runs: its chats, runs, files, skills, flavor pin, A2A peers and
 eval runs all live on the Hub, not in WorkCord. Normal changes should be
-requested with `workcord agent chat`; the `hermes` namespace exists for direct
+requested with `workcord agent chat`; the `hub` namespace exists for direct
 inspection, diagnostics, and recovery.
 
 This is the one namespace that talks to a **second origin**. Every other command
-goes to the WorkCord API; `hermes` uses the WorkCord API only to reveal the
+goes to the WorkCord API; `hub` uses the WorkCord API only to reveal the
 tenant key, then calls the Hub's `/v1/tenant-api/*` routes with it.
 
+`workcord hub ...` is a hidden alias of `workcord hub ...`, kept for one
+release. New scripts should use `hub`.
+
 ### Target selection
 
-Every `hermes` command takes exactly one of:
+Every `hub` command takes exactly one of:
 
 | Flag | Meaning |
 | --- | --- |
@@ -350,11 +358,16 @@ and is **never** accepted as a flag:
 
 | Env var | Meaning |
 | --- | --- |
-| `WORKCORD_HERMES_KEY` | tenant key, used verbatim; requires `WORKCORD_HERMES_HUB_URL` |
-| `WORKCORD_HERMES_HUB_URL` | Hub origin (bare origin, no path); requires `WORKCORD_HERMES_KEY` |
-| `WORKCORD_HERMES_TENANT_ID` | tenant id for the tenant-scoped routes, alongside the two above |
+| `WORKCORD_HUB_KEY` | tenant key, used verbatim; requires `WORKCORD_HUB_URL` |
+| `WORKCORD_HUB_URL` | Hub origin (bare origin, no path); requires `WORKCORD_HUB_KEY` |
+| `WORKCORD_HUB_TENANT_ID` | tenant id for the tenant-scoped routes, alongside the two above |
+| `WORKCORD_HUB_MANAGED` | `1` enables managed mode (see below) |
+
+The older `WORKCORD_HERMES_KEY`, `WORKCORD_HERMES_HUB_URL`,
+`WORKCORD_HERMES_TENANT_ID` and `WORKCORD_HERMES_MANAGED` names still work and
+take precedence when both are set.
 
-Setting only one of `WORKCORD_HERMES_KEY` / `WORKCORD_HERMES_HUB_URL` is an
+Setting only one of `WORKCORD_HUB_KEY` / `WORKCORD_HUB_URL` is an
 error — the CLI will not half-guess a hub.
 
 With none of them set, the CLI calls
@@ -371,34 +384,56 @@ under `hermes`, alongside the saved login. The file is written `0600` inside a
 | `--refresh` | ignore the cached entry, re-reveal, rewrite the cache |
 | `--no-cache` | neither read nor write the cache for this invocation |
 
-Env credentials always win over the cache. `hermes key` prints the resolved
+Env credentials always win over the cache. `hub key` prints the resolved
 credentials on stdout — that is its whole job; no other command emits key
 material.
 
+### Managed mode
+
+A personal Shadow tenant runs this CLI with a WorkCord token that WorkCord
+resolves to the owner user. It must use the same `hub` commands, but with a
+per-call reveal and nothing on disk. Managed mode is enabled by
+`WORKCORD_HUB_MANAGED=1` (or `WORKCORD_HERMES_MANAGED=1`), or per invocation
+with `--managed`. In managed mode the CLI:
+
+- always reveals the key through `POST /api/v1/agents/{id}/hermes-cli-key/reveal`,
+- never reads or writes `~/.workcord/config.json` for hub credentials,
+- ignores `WORKCORD_HUB_KEY` / `WORKCORD_HERMES_KEY`,
+- rejects `--as` with an error,
+- never prints the key (`hub key` prints only `tenantId` and `hubBaseUrl`).
+
+```bash
+export WORKCORD_TOKEN=...            # the owner user's token
+export WORKCORD_HUB_MANAGED=1
+workcord hub flavor set --agent $AGENT --flavor-version 1.4.0
+workcord hub flavor subscribe --agent $AGENT --policy stable
+workcord hub agent restart --agent $AGENT
+```
+
 ### Commands
 
 | Group | What |
 | --- | --- |
-| `hermes key` / `whoami` / `runtime` | reveal credentials, show the tenant, show its runtime |
-| `hermes agent status\|start\|stop\|restart\|card` | tenant agent lifecycle |
-| `hermes chat list\|create\|get\|messages\|send\|message\|stream\|stop\|approve` | chats and chat messages (`stream` is SSE) |
-| `hermes run create\|get\|stream\|stop\|approve` | runs |
-| `hermes files ls\|cat\|download` | tenant-visible files |
-| `hermes share groups\|ls\|read\|stat\|grep\|find\|write\|mkdir\|move\|rm` | share-group filesystem |
-| `hermes skills list\|enable\|disable\|files\|cat` | skills installed on this tenant |
-| `hermes flavor current\|catalog\|get\|set\|subscribe\|checkout\|publish\|rollout` | flavor marketplace and this tenant's pin |
-| `hermes skill catalog\|get\|checkout\|publish` | skill marketplace |
-| `hermes eval suites\|run\|list\|get\|cancel` | flavor eval suites and runs |
-| `hermes peers list\|get\|call\|find` | A2A peers |
-| `hermes conversations list\|get\|messages` | A2A conversations |
-| `hermes sessions list`, `hermes artifacts` | agent sessions and artifacts |
+| `hub key` / `whoami` / `runtime` | reveal credentials, show the tenant, show its runtime |
+| `hub agent status\|start\|stop\|restart\|card` | tenant agent lifecycle |
+| `hub chat list\|create\|get\|messages\|send\|message\|stream\|stop\|approve` | chats and chat messages (`stream` is SSE) |
+| `hub run create\|get\|stream\|stop\|approve` | runs |
+| `hub files ls\|cat\|download` | tenant-visible files |
+| `hub share groups\|ls\|read\|stat\|grep\|find\|write\|mkdir\|move\|rm` | share-group filesystem |
+| `hub skills list\|enable\|disable\|files\|cat` | skills installed on this tenant |
+| `hub flavor current\|catalog\|get\|set\|subscribe\|checkout\|publish\|rollout` | flavor marketplace and this tenant's pin |
+| `hub skill catalog\|get\|checkout\|publish` | skill marketplace |
+| `hub eval suites\|run\|list\|get\|cancel` | flavor eval suites and runs |
+| `hub peers list\|get\|call\|find` | A2A peers |
+| `hub conversations list\|get\|messages` | A2A conversations |
+| `hub sessions list`, `hub artifacts` | agent sessions and artifacts |
 
 ```bash
-workcord hermes whoami --room-agent $RA
-workcord hermes whoami --marketplace-install $MARKETPLACE_INSTALL
-workcord hermes chat send --room-agent $RA --chat $CHAT --text "status?"
-workcord hermes flavor current --agent $AGENT
-workcord hermes peers find --agent $AGENT --query "translation" --limit 5
+workcord hub whoami --room-agent $RA
+workcord hub whoami --marketplace-install $MARKETPLACE_INSTALL
+workcord hub chat send --room-agent $RA --chat $CHAT --text "status?"
+workcord hub flavor current --agent $AGENT
+workcord hub peers find --agent $AGENT --query "translation" --limit 5
 ```
 
 Version flags are named `--flavor-version` and `--skill-version`, not
@@ -408,7 +443,7 @@ anywhere in argv, prints the CLI version and exits before the subcommand runs.
 ### Direct flavor and skill recovery
 
 For normal work, ask the Assistant or another owned agent to create, update,
-validate, or activate its own flavor and skills. Hermes Hub supports
+validate, or activate its own flavor and skills. Autoworker Hub supports
 tenant-owned skill and flavor namespaces; ownership defaults to whichever agent
 tenant performs the creation.
 
@@ -419,9 +454,9 @@ the selected tenant and can only mutate namespaces that tenant owns.
 The CLI does **not** pack or untar archives. The authoring loop is:
 
 ```bash
-workcord hermes flavor checkout --agent $AGENT --flavor-version 1.4.0 --out flavor.tgz
-# unpack, edit, and repack with hermes-hub's own tooling
-workcord hermes flavor publish --agent $AGENT --archive flavor.tgz
+workcord hub flavor checkout --agent $AGENT --flavor-version 1.4.0 --out flavor.tgz
+# unpack, edit, and repack with the Hub's own tooling
+workcord hub flavor publish --agent $AGENT --archive flavor.tgz
 ```
 
 `--archive` must already be a gzipped package built beforehand; anything over
@@ -462,10 +497,10 @@ without running `regen` if you don't need the latest server changes.
 src/
 ├── cli.ts                  commander entry, global --as flag
 ├── auth.ts                 auth resolution: WORKCORD_TOKEN vs minted --as JWT,
-│                           plus Hermes Hub key resolution
+│                           plus Autoworker Hub key resolution
 ├── http.ts                 shared fetch primitives (retry, errors, query)
 ├── client.ts               WorkCord fetch wrapper (JSON + multipart)
-├── hermes-client.ts        Hermes Hub fetch wrapper (JSON, upload, SSE, binary)
+├── hermes-client.ts        Autoworker Hub fetch wrapper (JSON, upload, SSE, binary)
 ├── hermes-guards.ts        rollout/ownership/archive guards, version compare
 ├── commands/               hand-written semantic commands
 └── generated/              auto-generated from openapi.json
@@ -506,7 +541,21 @@ part of any automated gate.
 
 ## Release
 
-Publishing is a manual maintainer action — there is no auto-publish CI.
+The backend release workflow synchronizes API, CLI, and app release versions.
+It regenerates commands, tests, builds, and packs the CLI before deployment.
+After all deployments succeed, it publishes that archive to npmjs.org: `main`
+updates `latest`, and `dev` updates `dev`. Manual backend deployments do not
+publish. App workflows increment only the Flutter build number.
+
+Configure npm trusted publishing for `fulldiveVR/wizeup-rooms-api`, workflow
+`deploy-wize-rooms-api.yml`, with permission to publish and manage dist-tags for
+`@fulldivevr/workcord-cli`. The API repository's `TOKEN_FOR_SUB` secret must also
+have contents read/write access to `fulldiveVR/wizeup-rooms` so that release CI
+can synchronize `pubspec.yaml`. Merge the app workflow changes before enabling
+the backend pipeline. An existing npm version must match the verified archive;
+release CI fails on a conflicting archive or a version that would lower a tag.
+
+For a manual recovery publish:
 
 1. `npm run regen` — refresh the spec and generated commands; commit the diff.
 2. `npm run typecheck`
@@ -515,7 +564,8 @@ Publishing is a manual maintainer action — there is no auto-publish CI.
    `README.md`, `LICENSE`, `package.json`. No sources, no `openapi.json`, no
    `.npmrc`.
 5. Smoke: `node dist/cli.js --help` and `node dist/cli.js --version`.
-6. Bump `version` in `package.json`, then `npm publish`.
+6. Use the backend release version, then publish with explicit registry overrides:
+   `npm publish --access public --registry=https://registry.npmjs.org --@fulldivevr:registry=https://registry.npmjs.org`.
 
 `prepack` re-runs `typecheck` + `test` + `build`, so steps 2–3 also gate the publish.
 

package/dist/auth.js

@@ -28,7 +28,14 @@ export function resolveAuth(asUserId, env = process.env, config = {}) {
     }
     throw new Error("No credentials. Run `workcord auth login --email <address> --save`, or set WORKCORD_TOKEN. For privileged impersonation, set WORKCORD_JWT_SECRET and pass --as <userId>.");
 }
-async function revealHermesKey(agentRef, asUserId) {
+function envFlag(value) {
+    const v = value?.trim().toLowerCase();
+    return v === "1" || v === "true" || v === "yes";
+}
+export function isManagedHubMode(env = process.env) {
+    return envFlag(env.WORKCORD_HERMES_MANAGED) || envFlag(env.WORKCORD_HUB_MANAGED);
+}
+export async function revealHermesKey(agentRef, asUserId) {
     const { call } = await import("./client.js");
     const res = (await call({
         method: "POST",
@@ -36,25 +43,34 @@ async function revealHermesKey(agentRef, asUserId) {
         asUserId,
     }));
     if (!res?.key) {
-        throw new Error(`Reveal for ${agentRef} returned no Hermes key`);
+        throw new Error(`Reveal for ${agentRef} returned no hub tenant key`);
     }
     if (!res.hubBaseUrl) {
-        throw new Error(`Reveal for ${agentRef} returned no hubBaseUrl. Set WORKCORD_HERMES_HUB_URL (with WORKCORD_HERMES_KEY) to target the hub explicitly.`);
+        throw new Error(`Reveal for ${agentRef} returned no hubBaseUrl. Set WORKCORD_HUB_URL (with WORKCORD_HUB_KEY) to target the hub explicitly.`);
     }
     return { key: res.key, tenantId: res.tenantId ?? "", hubBaseUrl: res.hubBaseUrl };
 }
 export async function resolveHermesKey(agentRef, opts = {}) {
     const env = opts.env ?? process.env;
-    const envKey = env.WORKCORD_HERMES_KEY?.trim() || undefined;
-    const envHub = env.WORKCORD_HERMES_HUB_URL?.trim() || undefined;
+    const managed = opts.managed ?? isManagedHubMode(env);
+    if (managed) {
+        if (opts.asUserId) {
+            throw new Error("--as is not allowed in managed hub mode (WORKCORD_HUB_MANAGED): the hub key is always revealed for the token's own user.");
+        }
+        const revealed = await (opts.reveal ?? revealHermesKey)(agentRef);
+        return { ...revealed, source: "reveal" };
+    }
+    const envKey = env.WORKCORD_HERMES_KEY?.trim() || env.WORKCORD_HUB_KEY?.trim() || undefined;
+    const envHub = env.WORKCORD_HERMES_HUB_URL?.trim() || env.WORKCORD_HUB_URL?.trim() || undefined;
+    const envTenant = env.WORKCORD_HERMES_TENANT_ID?.trim() || env.WORKCORD_HUB_TENANT_ID?.trim() || "";
     if (envKey) {
         if (!envHub) {
-            throw new Error("WORKCORD_HERMES_KEY is set but WORKCORD_HERMES_HUB_URL is not. Set both, or unset the key to reveal it from WorkCord.");
+            throw new Error("WORKCORD_HUB_KEY (WORKCORD_HERMES_KEY) is set but WORKCORD_HUB_URL (WORKCORD_HERMES_HUB_URL) is not. Set both, or unset the key to reveal it from WorkCord.");
         }
-        return { key: envKey, tenantId: env.WORKCORD_HERMES_TENANT_ID?.trim() || "", hubBaseUrl: envHub, source: "env" };
+        return { key: envKey, tenantId: envTenant, hubBaseUrl: envHub, source: "env" };
     }
     if (envHub && !envKey) {
-        throw new Error("WORKCORD_HERMES_HUB_URL is set but WORKCORD_HERMES_KEY is not. Set both, or unset the hub URL to reveal both from WorkCord.");
+        throw new Error("WORKCORD_HUB_URL (WORKCORD_HERMES_HUB_URL) is set but WORKCORD_HUB_KEY (WORKCORD_HERMES_KEY) is not. Set both, or unset the hub URL to reveal both from WorkCord.");
     }
     const useCache = opts.cache !== false;
     const config = opts.config ?? (await readConfig());

package/dist/cli.js

@@ -12,15 +12,17 @@ import { registerRoomAgents } from "./commands/room-agents.js";
 import { registerCustomAgents } from "./commands/custom-agents.js";
 import { registerChallenges } from "./commands/challenges.js";
 import { registerHealth } from "./commands/health.js";
-import { registerHermes } from "./commands/hermes.js";
+import { registerHub } from "./commands/hub.js";
 import { registerAgent } from "./commands/agent.js";
+import { registerAgentSkills } from "./commands/agent-skills.js";
+import { registerReflections } from "./commands/reflections.js";
 import { registerAll as registerGenerated } from "./generated/index.js";
 const program = new Command();
 const require = createRequire(import.meta.url);
 const { version } = require("../package.json");
 program
     .name("workcord")
-    .description("Talk to WorkCord agents through Hermes tenant chat, with advanced API diagnostics.")
+    .description("Talk to WorkCord agents through Autoworker Hub tenant chat, with advanced API diagnostics.")
     .version(version)
     .option("--as <userId>", "user to act as")
     .option("--base-url <url>", "API base URL (overrides WORKCORD_API_URL and saved configuration)");
@@ -36,9 +38,11 @@ registerDm(program);
 registerUsers(program);
 registerRoomAgents(program);
 registerCustomAgents(program);
+registerAgentSkills(program);
+registerReflections(program);
 registerChallenges(program); // adds regenerate-cards (not in the OpenAPI spec)
 registerHealth(program);
-registerHermes(program);
+registerHub(program);
 registerGenerated(program);
 program.parseAsync().catch((err) => {
     const out = { error: err.message ?? String(err) };

package/dist/client.js

@@ -1,13 +1,18 @@
 import { resolveAuth } from "./auth.js";
 import { DEFAULT_BASE_URL, readConfig } from "./config.js";
 import { applyQuery, fetchWithRetry, httpError, normalizeBaseUrl, safeJson } from "./http.js";
+import { validateRoomCreateBody } from "./room-types.js";
 let baseUrlOverride;
 export function setBaseUrlOverride(url) {
     baseUrlOverride = url;
 }
 export async function getBaseUrl() {
     const config = await readConfig();
-    return normalizeBaseUrl(baseUrlOverride || process.env.WORKCORD_API_URL || config.baseUrl || DEFAULT_BASE_URL);
+    return normalizeBaseUrl(baseUrlOverride
+        || process.env.WORKCORD_API_URL
+        || process.env.WORKCORD_API_URL_TOKEN
+        || config.baseUrl
+        || DEFAULT_BASE_URL);
 }
 export async function call({ method = "GET", path, query, body, headers, asUserId }) {
     const config = await readConfig();
@@ -18,6 +23,8 @@ export async function callPublic({ method = "GET", path, query, body, headers })
     return request({ method, path, query, body, headers });
 }
 async function request({ method = "GET", path, query, body, headers, bearer }) {
+    if (method === "POST" && path === "/api/v1/rooms")
+        validateRoomCreateBody(body);
     const base = await getBaseUrl();
     const url = applyQuery(new URL(base + path), query);
     const res = await fetchWithRetry(() => ({

package/dist/commands/agent-skills.js

@@ -0,0 +1,127 @@
+import { actingUserId } from "../auth.js";
+import { call } from "../client.js";
+import { getOrCreateGroup } from "./_group.js";
+const SKILL_ID = /^[a-z][a-z0-9_-]{0,63}$/;
+const SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+export function parseSkillRef(ref) {
+    const at = ref.lastIndexOf("@");
+    if (at <= 0 || at === ref.length - 1)
+        throw new Error("skill must be ID@VERSION, e.g. web-research@1.0.0");
+    return { id: skillId(ref.slice(0, at)), version: semver(ref.slice(at + 1)) };
+}
+function skillId(id) {
+    if (!SKILL_ID.test(id))
+        throw new Error("skill id must be a lowercase slug");
+    return id;
+}
+function semver(version) {
+    if (!SEMVER.test(version))
+        throw new Error("version must be a semantic version, e.g. 1.0.0");
+    return version;
+}
+function bool(value) {
+    if (value === "true")
+        return true;
+    if (value === "false")
+        return false;
+    throw new Error("enabled must be true or false");
+}
+function skillPath(path) {
+    const segments = path.split("/");
+    if (segments.some((s) => !s || s === "." || s === ".."))
+        throw new Error("invalid skill file path");
+    return segments.map(encodeURIComponent).join("/");
+}
+// Agent ids are uuids, optionally behind the prefix a room agent is listed under.
+const AGENT_ID = /^(?:workcord-room-agent:|marketplace-install:)?[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12}$/i;
+/** Pick the one agent named `name` (exact, case-insensitive) from a list-mine response. */
+export function agentIdByName(name, mine) {
+    const agents = (mine?.data ?? []);
+    const wanted = name.toLowerCase();
+    const found = (Array.isArray(agents) ? agents : [])
+        .filter((a) => typeof a?.name === "string" && a.name.toLowerCase() === wanted);
+    if (found.length === 0)
+        throw new Error(`no agent named ${name}`);
+    if (found.length > 1) {
+        throw new Error(`more than one agent named ${name}: ${found.map((a) => `${a.name} (${a.id})`).join(", ")}`);
+    }
+    return String(found[0].id);
+}
+function agentPath(agentId, suffix) {
+    return `/api/v1/agents/${encodeURIComponent(agentId)}/${suffix}`;
+}
+export function registerAgentSkills(program, send = call, output = (value) => process.stdout.write(JSON.stringify(value) + "\n")) {
+    const agents = getOrCreateGroup(program, "custom-agents", "CustomAgents operations");
+    const skills = agents.command("skills").description("Inspect and manage skills on an agent you own");
+    const withActor = (req) => {
+        const asUserId = actingUserId(program);
+        return asUserId ? { ...req, asUserId } : req;
+    };
+    // The server takes ids only, so a name is resolved here against list-mine.
+    const resolve = async (agent) => {
+        if (AGENT_ID.test(agent))
+            return agent;
+        const mine = await send(withActor({ method: "GET", path: "/api/v1/agents/mine", query: { includeShadow: "true" } }));
+        return agentIdByName(agent, mine);
+    };
+    const run = async (agent, req) => {
+        const result = await send(withActor(req(await resolve(agent))));
+        if (result != null)
+            output(result);
+    };
+    agents.command("stop")
+        .description("Stop an agent you own. Its runtime returns to cold-idle.")
+        .argument("<agent>", "agent id or exact name")
+        .action((agent) => run(agent, (id) => ({ method: "POST", path: agentPath(id, "stop") })));
+    skills.command("list")
+        .description("List the agent's skills (core, flavor, private, and market).")
+        .argument("<agent>", "agent id or exact name")
+        .action((agent) => run(agent, (id) => ({ method: "GET", path: agentPath(id, "skills") })));
+    skills.command("files")
+        .description("List the files attached to one skill.")
+        .argument("<agent>", "agent id or exact name")
+        .argument("<category>", "skill category")
+        .argument("<skill>", "skill name")
+        .action((agent, category, skill) => run(agent, (id) => ({
+        method: "GET",
+        path: agentPath(id, `skills/${encodeURIComponent(category)}/${encodeURIComponent(skill)}/files`),
+    })));
+    skills.command("read")
+        .description("Read one skill file.")
+        .argument("<agent>", "agent id or exact name")
+        .argument("<path>", "path relative to the skill root, e.g. research/web-research/SKILL.md")
+        .action((agent, path) => {
+        const file = skillPath(path);
+        return run(agent, (id) => ({ method: "GET", path: agentPath(id, `skill-files/${file}`) }));
+    });
+    skills.command("enabled")
+        .description("Enable or disable one skill.")
+        .argument("<agent>", "agent id or exact name")
+        .argument("<name>", "skill name")
+        .argument("<true|false>", "new state")
+        .action((agent, name, enabled) => {
+        const body = { enabled: bool(enabled) };
+        return run(agent, (id) => ({ method: "PUT", path: agentPath(id, `skills/${encodeURIComponent(name)}/state`), body }));
+    });
+    skills.command("installed")
+        .description("List the market skills installed on the agent.")
+        .argument("<agent>", "agent id or exact name")
+        .action((agent) => run(agent, (id) => ({ method: "GET", path: agentPath(id, "market-skills") })));
+    skills.command("install")
+        .description("Install or update a market skill at an exact version.")
+        .argument("<agent>", "agent id or exact name")
+        .argument("<ID@VERSION>", "market skill and version, e.g. web-research@1.0.0")
+        .action((agent, ref) => {
+        const body = parseSkillRef(ref);
+        return run(agent, (id) => ({ method: "POST", path: agentPath(id, "market-skills"), body }));
+    });
+    skills.command("uninstall")
+        .description("Remove a market skill.")
+        .argument("<agent>", "agent id or exact name")
+        .argument("<id>", "market skill id")
+        .action((agent, id) => {
+        const skill = encodeURIComponent(skillId(id));
+        return run(agent, (agentId) => ({ method: "DELETE", path: agentPath(agentId, `market-skills/${skill}`) }));
+    });
+}
+//# sourceMappingURL=agent-skills.js.map