@fulldivevr/workcord-cli 1.6.0 → 2.17.0

package/README.md

@@ -1,6 +1,6 @@
 # @fulldivevr/workcord-cli
 
-TypeScript CLI for talking to WorkCord agents through persistent Hermes tenant
+TypeScript CLI for talking to WorkCord agents through persistent Autoworker Hub tenant
 chat and using the WorkCord API. **One invocation = one user action.** Designed
 for automated agents such as Claude Code: ask the user's Assistant for the
 outcome you need, let that tenant manage its own instructions, skills, and
@@ -149,7 +149,7 @@ workcord [--as <userId>] <namespace> <command> [flags]
 ### Agent-first customization
 
 To change agent behavior, create or update a skill, or maintain a flavor, talk
-to the owning agent through Hermes tenant chat. Do not edit prompts or tenant
+to the owning agent through Hub tenant chat. Do not edit prompts or tenant
 files directly. With no `--agent`, the user's non-deletable Assistant is the
 target and becomes the default owner of anything it creates:
 
@@ -164,7 +164,7 @@ Use the returned `chatId` for follow-up, verification, or rollback:
 workcord agent chat send --chat "$CHAT_ID" --message "Verify the change, list the versions you created, and explain how to roll it back."
 ```
 
-Both commands wait up to two minutes by default and return the durable Hermes
+Both commands wait up to two minutes by default and return the durable Hub
 message document. Use `--async` for a queued response, then continue with its
 `messageId`:
 
@@ -184,8 +184,8 @@ workcord agent chat new --agent "$AGENT_ID" --message "Create and maintain a fin
 
 The Assistant or selected agent works within its tenant's Hub permissions. It
 can safely validate changes and report what it activated. `agent chat` uses
-Hermes' native durable `hub_chat` transport; it is not raw A2A wire traffic.
-A2A remains available for external agent peers. Direct `hermes` commands are
+the Hub's native durable `hub_chat` transport; it is not raw A2A wire traffic.
+A2A remains available for external agent peers. Direct `hub` commands are
 advanced diagnostics and recovery tools, not the normal customization workflow.
 
 - `workcord --help` lists namespaces.
@@ -321,22 +321,25 @@ workcord --as $U dm send-text --to $OTHER --text "hey"
 # → composite: opens (or finds) the DM room, sends the message, returns both
 ```
 
-## Advanced Hermes diagnostics and recovery (`hermes` namespace)
+## Advanced Hub diagnostics and recovery (`hub` namespace)
 
-WorkCord provisions a **Hermes Hub tenant** for each room-agent, Hermes custom
+WorkCord provisions an **Autoworker Hub tenant** for each room-agent, custom
 agent, and room-scoped marketplace flavor install. That tenant is where the
 agent actually runs: its chats, runs, files, skills, flavor pin, A2A peers and
 eval runs all live on the Hub, not in WorkCord. Normal changes should be
-requested with `workcord agent chat`; the `hermes` namespace exists for direct
+requested with `workcord agent chat`; the `hub` namespace exists for direct
 inspection, diagnostics, and recovery.
 
 This is the one namespace that talks to a **second origin**. Every other command
-goes to the WorkCord API; `hermes` uses the WorkCord API only to reveal the
+goes to the WorkCord API; `hub` uses the WorkCord API only to reveal the
 tenant key, then calls the Hub's `/v1/tenant-api/*` routes with it.
 
+`workcord hub ...` is a hidden alias of `workcord hub ...`, kept for one
+release. New scripts should use `hub`.
+
 ### Target selection
 
-Every `hermes` command takes exactly one of:
+Every `hub` command takes exactly one of:
 
 | Flag | Meaning |
 | --- | --- |
@@ -355,11 +358,16 @@ and is **never** accepted as a flag:
 
 | Env var | Meaning |
 | --- | --- |
-| `WORKCORD_HERMES_KEY` | tenant key, used verbatim; requires `WORKCORD_HERMES_HUB_URL` |
-| `WORKCORD_HERMES_HUB_URL` | Hub origin (bare origin, no path); requires `WORKCORD_HERMES_KEY` |
-| `WORKCORD_HERMES_TENANT_ID` | tenant id for the tenant-scoped routes, alongside the two above |
+| `WORKCORD_HUB_KEY` | tenant key, used verbatim; requires `WORKCORD_HUB_URL` |
+| `WORKCORD_HUB_URL` | Hub origin (bare origin, no path); requires `WORKCORD_HUB_KEY` |
+| `WORKCORD_HUB_TENANT_ID` | tenant id for the tenant-scoped routes, alongside the two above |
+| `WORKCORD_HUB_MANAGED` | `1` enables managed mode (see below) |
+
+The older `WORKCORD_HERMES_KEY`, `WORKCORD_HERMES_HUB_URL`,
+`WORKCORD_HERMES_TENANT_ID` and `WORKCORD_HERMES_MANAGED` names still work and
+take precedence when both are set.
 
-Setting only one of `WORKCORD_HERMES_KEY` / `WORKCORD_HERMES_HUB_URL` is an
+Setting only one of `WORKCORD_HUB_KEY` / `WORKCORD_HUB_URL` is an
 error — the CLI will not half-guess a hub.
 
 With none of them set, the CLI calls
@@ -376,34 +384,56 @@ under `hermes`, alongside the saved login. The file is written `0600` inside a
 | `--refresh` | ignore the cached entry, re-reveal, rewrite the cache |
 | `--no-cache` | neither read nor write the cache for this invocation |
 
-Env credentials always win over the cache. `hermes key` prints the resolved
+Env credentials always win over the cache. `hub key` prints the resolved
 credentials on stdout — that is its whole job; no other command emits key
 material.
 
+### Managed mode
+
+A personal Shadow tenant runs this CLI with a WorkCord token that WorkCord
+resolves to the owner user. It must use the same `hub` commands, but with a
+per-call reveal and nothing on disk. Managed mode is enabled by
+`WORKCORD_HUB_MANAGED=1` (or `WORKCORD_HERMES_MANAGED=1`), or per invocation
+with `--managed`. In managed mode the CLI:
+
+- always reveals the key through `POST /api/v1/agents/{id}/hermes-cli-key/reveal`,
+- never reads or writes `~/.workcord/config.json` for hub credentials,
+- ignores `WORKCORD_HUB_KEY` / `WORKCORD_HERMES_KEY`,
+- rejects `--as` with an error,
+- never prints the key (`hub key` prints only `tenantId` and `hubBaseUrl`).
+
+```bash
+export WORKCORD_TOKEN=...            # the owner user's token
+export WORKCORD_HUB_MANAGED=1
+workcord hub flavor set --agent $AGENT --flavor-version 1.4.0
+workcord hub flavor subscribe --agent $AGENT --policy stable
+workcord hub agent restart --agent $AGENT
+```
+
 ### Commands
 
 | Group | What |
 | --- | --- |
-| `hermes key` / `whoami` / `runtime` | reveal credentials, show the tenant, show its runtime |
-| `hermes agent status\|start\|stop\|restart\|card` | tenant agent lifecycle |
-| `hermes chat list\|create\|get\|messages\|send\|message\|stream\|stop\|approve` | chats and chat messages (`stream` is SSE) |
-| `hermes run create\|get\|stream\|stop\|approve` | runs |
-| `hermes files ls\|cat\|download` | tenant-visible files |
-| `hermes share groups\|ls\|read\|stat\|grep\|find\|write\|mkdir\|move\|rm` | share-group filesystem |
-| `hermes skills list\|enable\|disable\|files\|cat` | skills installed on this tenant |
-| `hermes flavor current\|catalog\|get\|set\|subscribe\|checkout\|publish\|rollout` | flavor marketplace and this tenant's pin |
-| `hermes skill catalog\|get\|checkout\|publish` | skill marketplace |
-| `hermes eval suites\|run\|list\|get\|cancel` | flavor eval suites and runs |
-| `hermes peers list\|get\|call\|find` | A2A peers |
-| `hermes conversations list\|get\|messages` | A2A conversations |
-| `hermes sessions list`, `hermes artifacts` | agent sessions and artifacts |
+| `hub key` / `whoami` / `runtime` | reveal credentials, show the tenant, show its runtime |
+| `hub agent status\|start\|stop\|restart\|card` | tenant agent lifecycle |
+| `hub chat list\|create\|get\|messages\|send\|message\|stream\|stop\|approve` | chats and chat messages (`stream` is SSE) |
+| `hub run create\|get\|stream\|stop\|approve` | runs |
+| `hub files ls\|cat\|download` | tenant-visible files |
+| `hub share groups\|ls\|read\|stat\|grep\|find\|write\|mkdir\|move\|rm` | share-group filesystem |
+| `hub skills list\|enable\|disable\|files\|cat` | skills installed on this tenant |
+| `hub flavor current\|catalog\|get\|set\|subscribe\|checkout\|publish\|rollout` | flavor marketplace and this tenant's pin |
+| `hub skill catalog\|get\|checkout\|publish` | skill marketplace |
+| `hub eval suites\|run\|list\|get\|cancel` | flavor eval suites and runs |
+| `hub peers list\|get\|call\|find` | A2A peers |
+| `hub conversations list\|get\|messages` | A2A conversations |
+| `hub sessions list`, `hub artifacts` | agent sessions and artifacts |
 
 ```bash
-workcord hermes whoami --room-agent $RA
-workcord hermes whoami --marketplace-install $MARKETPLACE_INSTALL
-workcord hermes chat send --room-agent $RA --chat $CHAT --text "status?"
-workcord hermes flavor current --agent $AGENT
-workcord hermes peers find --agent $AGENT --query "translation" --limit 5
+workcord hub whoami --room-agent $RA
+workcord hub whoami --marketplace-install $MARKETPLACE_INSTALL
+workcord hub chat send --room-agent $RA --chat $CHAT --text "status?"
+workcord hub flavor current --agent $AGENT
+workcord hub peers find --agent $AGENT --query "translation" --limit 5
 ```
 
 Version flags are named `--flavor-version` and `--skill-version`, not
@@ -413,7 +443,7 @@ anywhere in argv, prints the CLI version and exits before the subcommand runs.
 ### Direct flavor and skill recovery
 
 For normal work, ask the Assistant or another owned agent to create, update,
-validate, or activate its own flavor and skills. Hermes Hub supports
+validate, or activate its own flavor and skills. Autoworker Hub supports
 tenant-owned skill and flavor namespaces; ownership defaults to whichever agent
 tenant performs the creation.
 
@@ -424,9 +454,9 @@ the selected tenant and can only mutate namespaces that tenant owns.
 The CLI does **not** pack or untar archives. The authoring loop is:
 
 ```bash
-workcord hermes flavor checkout --agent $AGENT --flavor-version 1.4.0 --out flavor.tgz
-# unpack, edit, and repack with hermes-hub's own tooling
-workcord hermes flavor publish --agent $AGENT --archive flavor.tgz
+workcord hub flavor checkout --agent $AGENT --flavor-version 1.4.0 --out flavor.tgz
+# unpack, edit, and repack with the Hub's own tooling
+workcord hub flavor publish --agent $AGENT --archive flavor.tgz
 ```
 
 `--archive` must already be a gzipped package built beforehand; anything over
@@ -467,10 +497,10 @@ without running `regen` if you don't need the latest server changes.
 src/
 ├── cli.ts                  commander entry, global --as flag
 ├── auth.ts                 auth resolution: WORKCORD_TOKEN vs minted --as JWT,
-│                           plus Hermes Hub key resolution
+│                           plus Autoworker Hub key resolution
 ├── http.ts                 shared fetch primitives (retry, errors, query)
 ├── client.ts               WorkCord fetch wrapper (JSON + multipart)
-├── hermes-client.ts        Hermes Hub fetch wrapper (JSON, upload, SSE, binary)
+├── hermes-client.ts        Autoworker Hub fetch wrapper (JSON, upload, SSE, binary)
 ├── hermes-guards.ts        rollout/ownership/archive guards, version compare
 ├── commands/               hand-written semantic commands
 └── generated/              auto-generated from openapi.json
@@ -511,7 +541,21 @@ part of any automated gate.
 
 ## Release
 
-Publishing is a manual maintainer action — there is no auto-publish CI.
+The backend release workflow synchronizes API, CLI, and app release versions.
+It regenerates commands, tests, builds, and packs the CLI before deployment.
+After all deployments succeed, it publishes that archive to npmjs.org: `main`
+updates `latest`, and `dev` updates `dev`. Manual backend deployments do not
+publish. App workflows increment only the Flutter build number.
+
+Configure npm trusted publishing for `fulldiveVR/wizeup-rooms-api`, workflow
+`deploy-wize-rooms-api.yml`, with permission to publish and manage dist-tags for
+`@fulldivevr/workcord-cli`. The API repository's `TOKEN_FOR_SUB` secret must also
+have contents read/write access to `fulldiveVR/wizeup-rooms` so that release CI
+can synchronize `pubspec.yaml`. Merge the app workflow changes before enabling
+the backend pipeline. An existing npm version must match the verified archive;
+release CI fails on a conflicting archive or a version that would lower a tag.
+
+For a manual recovery publish:
 
 1. `npm run regen` — refresh the spec and generated commands; commit the diff.
 2. `npm run typecheck`
@@ -520,7 +564,8 @@ Publishing is a manual maintainer action — there is no auto-publish CI.
    `README.md`, `LICENSE`, `package.json`. No sources, no `openapi.json`, no
    `.npmrc`.
 5. Smoke: `node dist/cli.js --help` and `node dist/cli.js --version`.
-6. Bump `version` in `package.json`, then `npm publish`.
+6. Use the backend release version, then publish with explicit registry overrides:
+   `npm publish --access public --registry=https://registry.npmjs.org --@fulldivevr:registry=https://registry.npmjs.org`.
 
 `prepack` re-runs `typecheck` + `test` + `build`, so steps 2–3 also gate the publish.
 

package/dist/auth.js

@@ -28,7 +28,14 @@ export function resolveAuth(asUserId, env = process.env, config = {}) {
     }
     throw new Error("No credentials. Run `workcord auth login --email <address> --save`, or set WORKCORD_TOKEN. For privileged impersonation, set WORKCORD_JWT_SECRET and pass --as <userId>.");
 }
-async function revealHermesKey(agentRef, asUserId) {
+function envFlag(value) {
+    const v = value?.trim().toLowerCase();
+    return v === "1" || v === "true" || v === "yes";
+}
+export function isManagedHubMode(env = process.env) {
+    return envFlag(env.WORKCORD_HERMES_MANAGED) || envFlag(env.WORKCORD_HUB_MANAGED);
+}
+export async function revealHermesKey(agentRef, asUserId) {
     const { call } = await import("./client.js");
     const res = (await call({
         method: "POST",
@@ -36,25 +43,34 @@ async function revealHermesKey(agentRef, asUserId) {
         asUserId,
     }));
     if (!res?.key) {
-        throw new Error(`Reveal for ${agentRef} returned no Hermes key`);
+        throw new Error(`Reveal for ${agentRef} returned no hub tenant key`);
     }
     if (!res.hubBaseUrl) {
-        throw new Error(`Reveal for ${agentRef} returned no hubBaseUrl. Set WORKCORD_HERMES_HUB_URL (with WORKCORD_HERMES_KEY) to target the hub explicitly.`);
+        throw new Error(`Reveal for ${agentRef} returned no hubBaseUrl. Set WORKCORD_HUB_URL (with WORKCORD_HUB_KEY) to target the hub explicitly.`);
     }
     return { key: res.key, tenantId: res.tenantId ?? "", hubBaseUrl: res.hubBaseUrl };
 }
 export async function resolveHermesKey(agentRef, opts = {}) {
     const env = opts.env ?? process.env;
-    const envKey = env.WORKCORD_HERMES_KEY?.trim() || undefined;
-    const envHub = env.WORKCORD_HERMES_HUB_URL?.trim() || undefined;
+    const managed = opts.managed ?? isManagedHubMode(env);
+    if (managed) {
+        if (opts.asUserId) {
+            throw new Error("--as is not allowed in managed hub mode (WORKCORD_HUB_MANAGED): the hub key is always revealed for the token's own user.");
+        }
+        const revealed = await (opts.reveal ?? revealHermesKey)(agentRef);
+        return { ...revealed, source: "reveal" };
+    }
+    const envKey = env.WORKCORD_HERMES_KEY?.trim() || env.WORKCORD_HUB_KEY?.trim() || undefined;
+    const envHub = env.WORKCORD_HERMES_HUB_URL?.trim() || env.WORKCORD_HUB_URL?.trim() || undefined;
+    const envTenant = env.WORKCORD_HERMES_TENANT_ID?.trim() || env.WORKCORD_HUB_TENANT_ID?.trim() || "";
     if (envKey) {
         if (!envHub) {
-            throw new Error("WORKCORD_HERMES_KEY is set but WORKCORD_HERMES_HUB_URL is not. Set both, or unset the key to reveal it from WorkCord.");
+            throw new Error("WORKCORD_HUB_KEY (WORKCORD_HERMES_KEY) is set but WORKCORD_HUB_URL (WORKCORD_HERMES_HUB_URL) is not. Set both, or unset the key to reveal it from WorkCord.");
         }
-        return { key: envKey, tenantId: env.WORKCORD_HERMES_TENANT_ID?.trim() || "", hubBaseUrl: envHub, source: "env" };
+        return { key: envKey, tenantId: envTenant, hubBaseUrl: envHub, source: "env" };
     }
     if (envHub && !envKey) {
-        throw new Error("WORKCORD_HERMES_HUB_URL is set but WORKCORD_HERMES_KEY is not. Set both, or unset the hub URL to reveal both from WorkCord.");
+        throw new Error("WORKCORD_HUB_URL (WORKCORD_HERMES_HUB_URL) is set but WORKCORD_HUB_KEY (WORKCORD_HERMES_KEY) is not. Set both, or unset the hub URL to reveal both from WorkCord.");
     }
     const useCache = opts.cache !== false;
     const config = opts.config ?? (await readConfig());

package/dist/cli.js

@@ -12,7 +12,7 @@ import { registerRoomAgents } from "./commands/room-agents.js";
 import { registerCustomAgents } from "./commands/custom-agents.js";
 import { registerChallenges } from "./commands/challenges.js";
 import { registerHealth } from "./commands/health.js";
-import { registerHermes } from "./commands/hermes.js";
+import { registerHub } from "./commands/hub.js";
 import { registerAgent } from "./commands/agent.js";
 import { registerAgentSkills } from "./commands/agent-skills.js";
 import { registerReflections } from "./commands/reflections.js";
@@ -22,7 +22,7 @@ const require = createRequire(import.meta.url);
 const { version } = require("../package.json");
 program
     .name("workcord")
-    .description("Talk to WorkCord agents through Hermes tenant chat, with advanced API diagnostics.")
+    .description("Talk to WorkCord agents through Autoworker Hub tenant chat, with advanced API diagnostics.")
     .version(version)
     .option("--as <userId>", "user to act as")
     .option("--base-url <url>", "API base URL (overrides WORKCORD_API_URL and saved configuration)");
@@ -42,7 +42,7 @@ registerAgentSkills(program);
 registerReflections(program);
 registerChallenges(program); // adds regenerate-cards (not in the OpenAPI spec)
 registerHealth(program);
-registerHermes(program);
+registerHub(program);
 registerGenerated(program);
 program.parseAsync().catch((err) => {
     const out = { error: err.message ?? String(err) };

package/dist/commands/hub.js

@@ -0,0 +1,667 @@
+import { Help, Option } from "commander";
+import { randomUUID } from "node:crypto";
+import { readFile, stat, writeFile } from "node:fs/promises";
+import { Writable } from "node:stream";
+import { actingUserId, isManagedHubMode, resolveHermesKey } from "../auth.js";
+import { hermesBinary, hermesCall, hermesStream, hermesUpload } from "../hermes-client.js";
+import { assertArchiveSize, flavorSetWarnings, guardOwnership, rolloutBody, } from "../hermes-guards.js";
+import { getOrCreateGroup } from "./_group.js";
+export function agentRef(opts) {
+    const refs = [opts.agent, opts.roomAgent, opts.marketplaceInstall].filter(Boolean);
+    if (refs.length !== 1) {
+        throw new Error("Pass exactly one of --agent <id>, --room-agent <id>, or --marketplace-install <id>.");
+    }
+    if (opts.roomAgent)
+        return `workcord-room-agent:${opts.roomAgent}`;
+    if (opts.marketplaceInstall)
+        return `marketplace-install:${opts.marketplaceInstall}`;
+    return opts.agent;
+}
+function agentFlags(cmd) {
+    return cmd
+        .option("--agent <id>", "custom agent id")
+        .option("--room-agent <id>", "room agent id (resolved as workcord-room-agent:<id>)")
+        .option("--marketplace-install <id>", "marketplace flavor install id or its room agent id")
+        .option("--refresh", "re-reveal the tenant key instead of using the cached one")
+        .option("--no-cache", "do not read or write the local tenant-key cache")
+        .option("--managed", "managed mode: always reveal, no cache, no --as (also WORKCORD_HUB_MANAGED=1)");
+}
+function jsonOption(cmd, name, description) {
+    return cmd.option(`--${name} <json>`, description);
+}
+function parseJson(raw, flag) {
+    if (raw === undefined)
+        return undefined;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`${flag} must be valid JSON`);
+    }
+}
+function out(data) {
+    process.stdout.write(JSON.stringify(data) + "\n");
+}
+export function hermesChatTextBody(text) {
+    return { parts: [{ type: "text", text }] };
+}
+async function credentials(program, opts, deps) {
+    return resolveHermesKey(agentRef(opts), {
+        refresh: opts.refresh,
+        cache: opts.cache,
+        managed: opts.managed || undefined,
+        asUserId: actingUserId(program),
+        ...deps,
+    });
+}
+function tenantPath(creds, suffix) {
+    if (!creds.tenantId) {
+        throw new Error("No tenantId available for this agent. Re-run with --refresh, or set WORKCORD_HUB_TENANT_ID alongside WORKCORD_HUB_KEY.");
+    }
+    return `/v1/tenants/${encodeURIComponent(creds.tenantId)}${suffix}`;
+}
+function seg(value) {
+    return encodeURIComponent(value);
+}
+function segments(value) {
+    return value
+        .split("/")
+        .filter((part) => part.length > 0)
+        .map(seg)
+        .join("/");
+}
+function collect(value, previous = []) {
+    return [...previous, value];
+}
+async function currentFlavor(creds) {
+    const res = (await hermesCall({ ...creds, path: "/v1/tenant-api/flavors/current" }));
+    return res?.flavor ?? null;
+}
+async function resolveFlavorId(creds, explicit) {
+    if (explicit)
+        return explicit;
+    const current = await currentFlavor(creds);
+    if (!current?.id) {
+        throw new Error("This tenant has no current flavor. Pass --flavor <flavorId>.");
+    }
+    return current.id;
+}
+async function downloadToFile(creds, path, outPath, query) {
+    const chunks = [];
+    const sink = new Writable({
+        write(chunk, _encoding, done) {
+            chunks.push(Buffer.from(chunk));
+            done();
+        },
+    });
+    await hermesBinary({ ...creds, path, query, out: sink });
+    const bytes = Buffer.concat(chunks);
+    await writeFile(outPath, bytes);
+    return bytes.byteLength;
+}
+async function readArchive(archivePath) {
+    const info = await stat(archivePath);
+    assertArchiveSize(info.size, archivePath);
+    const buffer = await readFile(archivePath);
+    return buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength);
+}
+export function registerHub(program, deps = {}) {
+    // `hermes` is a hidden alias of `hub`, kept for one release. The help formatter
+    // below replaces only the exact `name|alias` token so the alias stays out of help output.
+    const help = new Help();
+    const withoutAlias = (cmd, term) => {
+        const alias = cmd.aliases()[0];
+        return alias ? term.replace(`${cmd.name()}|${alias}`, cmd.name()) : term;
+    };
+    program.configureHelp({
+        subcommandTerm: (cmd) => withoutAlias(cmd, help.subcommandTerm(cmd)),
+        commandUsage: (cmd) => withoutAlias(cmd, help.commandUsage(cmd)),
+    });
+    const group = getOrCreateGroup(program, "hub", "Advanced Autoworker Hub diagnostics and recovery for an agent tenant").alias("hermes");
+    agentFlags(group.command("key").description("Reveal (and cache) the Autoworker Hub tenant key for an agent. In managed mode the key is not printed.")).action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        if (opts.managed || isManagedHubMode()) {
+            out({ tenantId: creds.tenantId, hubBaseUrl: creds.hubBaseUrl, managed: true });
+            return;
+        }
+        out({ key: creds.key, tenantId: creds.tenantId, hubBaseUrl: creds.hubBaseUrl });
+    });
+    agentFlags(group.command("whoami").description("Show the Autoworker Hub tenant this agent's key belongs to.")).action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant" }));
+    });
+    agentFlags(group.command("runtime").description("Show the tenant runtime.")).action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/runtime" }));
+    });
+    const agent = group.command("agent").description("Tenant agent lifecycle");
+    agentFlags(agent.command("status").description("Show the tenant agent.")).action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/agent" }));
+    });
+    for (const verb of ["start", "stop", "restart"]) {
+        agentFlags(agent.command(verb).description(`${verb[0].toUpperCase()}${verb.slice(1)} the tenant agent.`)).action(async (opts) => {
+            const creds = await credentials(program, opts, deps);
+            out(await hermesCall({ ...creds, method: "POST", path: `/v1/tenant-api/tenant/agent/${verb}` }));
+        });
+    }
+    agentFlags(agent.command("card").description("Show the tenant agent card.")).action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/agent-card" }));
+    });
+    const chat = group.command("chat").description("Tenant chats and chat messages");
+    jsonOption(agentFlags(chat.command("list").description("List chats.")), "query", "query parameters as JSON").action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: tenantPath(creds, "/chats"), query: parseJson(opts.query, "--query") }));
+    });
+    jsonOption(agentFlags(chat.command("create").description("Create a chat.")), "body", "request body as JSON").action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, method: "POST", path: tenantPath(creds, "/chats"), body: parseJson(opts.body, "--body") ?? {} }));
+    });
+    agentFlags(chat.command("get").description("Get one chat."))
+        .requiredOption("--chat <chatId>", "chat id")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: tenantPath(creds, `/chats/${encodeURIComponent(opts.chat)}`) }));
+    });
+    jsonOption(agentFlags(chat.command("messages").description("List messages in a chat.")), "query", "query parameters as JSON")
+        .requiredOption("--chat <chatId>", "chat id")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({
+            ...creds,
+            path: tenantPath(creds, `/chats/${encodeURIComponent(opts.chat)}/messages`),
+            query: parseJson(opts.query, "--query"),
+        }));
+    });
+    jsonOption(agentFlags(chat.command("send").description("Send a message to a chat.")), "body", "request body as JSON (overrides --text)")
+        .requiredOption("--chat <chatId>", "chat id")
+        .option("--text <text>", "message text")
+        .option("--idempotency-key <key>", "Idempotency-Key header (generated when omitted)")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        const body = parseJson(opts.body, "--body") ?? (opts.text !== undefined ? hermesChatTextBody(opts.text) : undefined);
+        if (body === undefined) {
+            throw new Error("One of --text or --body is required.");
+        }
+        out(await hermesCall({
+            ...creds,
+            method: "POST",
+            path: tenantPath(creds, `/chats/${encodeURIComponent(opts.chat)}/messages`),
+            headers: { "idempotency-key": opts.idempotencyKey ?? randomUUID() },
+            body,
+        }));
+    });
+    agentFlags(chat.command("message").description("Get one chat message."))
+        .requiredOption("--message <messageId>", "chat message id")
+        .option("--after-revision <n>", "only return when the revision is newer than this")
+        .option("--wait-seconds <n>", "long-poll for up to this many seconds")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({
+            ...creds,
+            path: tenantPath(creds, `/chat-messages/${encodeURIComponent(opts.message)}`),
+            query: { afterRevision: opts.afterRevision, waitSeconds: opts.waitSeconds },
+        }));
+    });
+    agentFlags(chat.command("stream").description("Stream a chat message's events (SSE)."))
+        .requiredOption("--message <messageId>", "chat message id")
+        .option("--last-event-id <id>", "resume from this event id")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        await hermesStream({
+            ...creds,
+            path: tenantPath(creds, `/chat-messages/${encodeURIComponent(opts.message)}/events`),
+            lastEventId: opts.lastEventId,
+        });
+    });
+    agentFlags(chat.command("stop").description("Stop a chat message."))
+        .requiredOption("--message <messageId>", "chat message id")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, method: "POST", path: tenantPath(creds, `/chat-messages/${encodeURIComponent(opts.message)}/stop`) }));
+    });
+    jsonOption(agentFlags(chat.command("approve").description("Answer a chat message's approval request.")), "body", "request body as JSON")
+        .requiredOption("--message <messageId>", "chat message id")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({
+            ...creds,
+            method: "POST",
+            path: tenantPath(creds, `/chat-messages/${encodeURIComponent(opts.message)}/approval`),
+            body: parseJson(opts.body, "--body") ?? {},
+        }));
+    });
+    const run = group.command("run").description("Tenant runs");
+    jsonOption(agentFlags(run.command("create").description("Create a run.")), "body", "request body as JSON").action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, method: "POST", path: tenantPath(creds, "/runs"), body: parseJson(opts.body, "--body") ?? {} }));
+    });
+    agentFlags(run.command("get").description("Get one run."))
+        .requiredOption("--run <runId>", "run id")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: tenantPath(creds, `/runs/${encodeURIComponent(opts.run)}`) }));
+    });
+    agentFlags(run.command("stream").description("Stream a run's events (SSE)."))
+        .requiredOption("--run <runId>", "run id")
+        .option("--last-event-id <id>", "resume from this event id")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        await hermesStream({ ...creds, path: tenantPath(creds, `/runs/${encodeURIComponent(opts.run)}/events`), lastEventId: opts.lastEventId });
+    });
+    agentFlags(run.command("stop").description("Stop a run."))
+        .requiredOption("--run <runId>", "run id")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, method: "POST", path: tenantPath(creds, `/runs/${encodeURIComponent(opts.run)}/stop`) }));
+    });
+    jsonOption(agentFlags(run.command("approve").description("Answer a run's approval request.")), "body", "request body as JSON")
+        .requiredOption("--run <runId>", "run id")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({
+            ...creds,
+            method: "POST",
+            path: tenantPath(creds, `/runs/${encodeURIComponent(opts.run)}/approval`),
+            body: parseJson(opts.body, "--body") ?? {},
+        }));
+    });
+    const files = group.command("files").description("Tenant-visible files");
+    agentFlags(files.command("ls").description("List files under the tenant's virtual roots."))
+        .option("--path <path>", "directory path (empty means root)")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/files", query: { path: opts.path } }));
+    });
+    agentFlags(files.command("cat").description("Read one tenant-visible file."))
+        .requiredOption("--path <path>", "file path")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/files/content", query: { path: opts.path } }));
+    });
+    agentFlags(files.command("download").description("Download one tenant-visible file (raw bytes)."))
+        .requiredOption("--path <path>", "file path")
+        .option("--out <file>", "write to this file instead of stdout")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        const path = "/v1/tenant-api/tenant/files/download";
+        const query = { path: opts.path };
+        if (opts.out) {
+            out({ path: opts.out, bytes: await downloadToFile(creds, path, opts.out, query) });
+            return;
+        }
+        await hermesBinary({ ...creds, path, query });
+    });
+    const share = group.command("share").description("Share-group filesystem");
+    agentFlags(share.command("groups").description("List share groups visible to this tenant.")).action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/shares" }));
+    });
+    const shareGroupFlags = (cmd) => agentFlags(cmd).requiredOption("--group <groupId>", "share group id");
+    const sharePath = (groupId, action) => `/v1/tenant-api/tenant/shares/${seg(groupId)}/${action}`;
+    shareGroupFlags(share.command("ls").description("List one share-group directory."))
+        .option("--path <path>", "path relative to the share root")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: sharePath(opts.group, "list"), query: { path: opts.path } }));
+    });
+    shareGroupFlags(share.command("read").description("Read one file from a share group."))
+        .requiredOption("--path <path>", "path relative to the share root")
+        .option("--offset <n>", "leading lines to skip")
+        .option("--limit <n>", "maximum lines to return")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({
+            ...creds,
+            path: sharePath(opts.group, "read"),
+            query: { path: opts.path, offset: opts.offset, limit: opts.limit },
+        }));
+    });
+    shareGroupFlags(share.command("stat").description("Stat one share-group path."))
+        .requiredOption("--path <path>", "path relative to the share root")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: sharePath(opts.group, "stat"), query: { path: opts.path } }));
+    });
+    shareGroupFlags(share.command("grep").description("Search share-group file contents."))
+        .requiredOption("--pattern <regexp>", "Go regular expression")
+        .option("--path <path>", "path relative to the share root")
+        .option("--ignore-case", "case-insensitive match")
+        .option("--max <n>", "maximum results")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({
+            ...creds,
+            path: sharePath(opts.group, "grep"),
+            query: { pattern: opts.pattern, path: opts.path, ignore_case: opts.ignoreCase, max: opts.max },
+        }));
+    });
+    shareGroupFlags(share.command("find").description("Find share-group paths by base name."))
+        .option("--name <glob>", "glob matched against each entry's base name")
+        .option("--path <path>", "path relative to the share root")
+        .option("--max <n>", "maximum results")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({
+            ...creds,
+            path: sharePath(opts.group, "find"),
+            query: { name: opts.name, path: opts.path, max: opts.max },
+        }));
+    });
+    shareGroupFlags(share.command("write").description("Write one file into a share group."))
+        .requiredOption("--path <path>", "path relative to the share root")
+        .option("--content <text>", "file contents", "")
+        .addOption(new Option("--mode <mode>", "write mode").choices(["overwrite", "append"]))
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({
+            ...creds,
+            method: "POST",
+            path: sharePath(opts.group, "write"),
+            body: { path: opts.path, content: opts.content, ...(opts.mode ? { mode: opts.mode } : {}) },
+        }));
+    });
+    shareGroupFlags(share.command("mkdir").description("Create a share-group directory."))
+        .requiredOption("--path <path>", "directory path relative to the share root")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, method: "POST", path: sharePath(opts.group, "mkdir"), body: { path: opts.path } }));
+    });
+    shareGroupFlags(share.command("move").description("Move a share-group path."))
+        .requiredOption("--from <path>", "source path relative to the share root")
+        .requiredOption("--to <path>", "destination path relative to the share root")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, method: "POST", path: sharePath(opts.group, "move"), body: { from: opts.from, to: opts.to } }));
+    });
+    shareGroupFlags(share.command("rm").description("Remove a share-group path."))
+        .requiredOption("--path <path>", "path relative to the share root")
+        .option("--recursive", "required to remove a non-empty directory")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({
+            ...creds,
+            method: "POST",
+            path: sharePath(opts.group, "remove"),
+            body: { path: opts.path, recursive: Boolean(opts.recursive) },
+        }));
+    });
+    const skills = group.command("skills").description("Skills installed on this tenant");
+    agentFlags(skills.command("list").description("List this tenant's skills.")).action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/skills" }));
+    });
+    for (const [verb, enabled] of [["enable", true], ["disable", false]]) {
+        agentFlags(skills.command(verb).description(`${verb[0].toUpperCase()}${verb.slice(1)} one skill on this tenant.`))
+            .requiredOption("--skill <name>", "skill name")
+            .action(async (opts) => {
+            const creds = await credentials(program, opts, deps);
+            out(await hermesCall({
+                ...creds,
+                method: "PUT",
+                path: `/v1/tenant-api/tenant/skills/${seg(opts.skill)}/state`,
+                body: { enabled },
+            }));
+        });
+    }
+    agentFlags(skills.command("files").description("List one skill's files."))
+        .requiredOption("--category <category>", "skill category")
+        .requiredOption("--skill <skill>", "skill name")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: `/v1/tenant-api/tenant/skills/${seg(opts.category)}/${seg(opts.skill)}/files` }));
+    });
+    agentFlags(skills.command("cat").description("Read one skill file."))
+        .requiredOption("--path <skillPath>", "slash-delimited path relative to $HERMES_HOME/skills")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: `/v1/tenant-api/tenant/skill-files/${segments(opts.path)}` }));
+    });
+    const flavor = group.command("flavor").description("Flavor marketplace and this tenant's flavor pin");
+    agentFlags(flavor.command("current").description("Show this tenant's current flavor pin.")).action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: "/v1/tenant-api/flavors/current" }));
+    });
+    agentFlags(flavor.command("catalog").description("List the flavor catalog.")).action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: "/v1/tenant-api/flavors" }));
+    });
+    agentFlags(flavor.command("get").description("Get one catalog flavor."))
+        .requiredOption("--flavor <flavorId>", "flavor id")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: `/v1/tenant-api/flavors/${seg(opts.flavor)}` }));
+    });
+    agentFlags(flavor.command("set").description("Re-pin this tenant to another version of its flavor."))
+        .requiredOption("--flavor-version <version>", "flavor version")
+        .option("--flavor <flavorId>", "flavor id (defaults to the current pin)")
+        .option("--force", "proceed despite a downgrade or deprecated target")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        const current = await currentFlavor(creds);
+        const flavorId = opts.flavor ?? current?.id;
+        if (!flavorId) {
+            throw new Error("This tenant has no current flavor. Pass --flavor <flavorId>.");
+        }
+        const entry = (await hermesCall({ ...creds, path: `/v1/tenant-api/flavors/${seg(flavorId)}` }));
+        const warnings = flavorSetWarnings(flavorId === current?.id ? current?.version : undefined, opts.flavorVersion, entry?.versions ?? []);
+        if (warnings.length > 0) {
+            for (const warning of warnings) {
+                process.stderr.write(`warning: ${warning}\n`);
+            }
+            if (!opts.force) {
+                throw new Error(`Refusing to re-pin ${flavorId} to ${opts.flavorVersion}: ${warnings.join("; ")}. Re-run with --force to proceed.`);
+            }
+        }
+        out(await hermesCall({
+            ...creds,
+            method: "PUT",
+            path: "/v1/tenant-api/flavors/current",
+            body: { flavorId, flavorVersion: opts.flavorVersion },
+        }));
+    });
+    agentFlags(flavor.command("subscribe").description("Set this tenant's flavor update policy."))
+        .addOption(new Option("--policy <policy>", "update policy").choices(["pinned", "stable", "canary", "auto_patch"]).makeOptionMandatory())
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({
+            ...creds,
+            method: "PUT",
+            path: "/v1/tenant-api/flavors/current/subscription",
+            body: { updatePolicy: opts.policy },
+        }));
+    });
+    agentFlags(flavor.command("checkout").description("Download one flavor version's source tarball."))
+        .requiredOption("--flavor-version <version>", "flavor version")
+        .requiredOption("--out <file>", "write the gzipped tarball here")
+        .option("--flavor <flavorId>", "flavor id (defaults to the current pin)")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        const flavorId = await resolveFlavorId(creds, opts.flavor);
+        const bytes = await downloadToFile(creds, `/v1/tenant-api/flavors/${seg(flavorId)}/versions/${seg(opts.flavorVersion)}/source`, opts.out);
+        out({ path: opts.out, bytes });
+    });
+    agentFlags(flavor.command("publish").description("Publish a new version of an owned flavor."))
+        .requiredOption("--archive <file>", "gzipped flavor package built beforehand")
+        .option("--flavor <flavorId>", "flavor id (defaults to the current pin)")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        const flavorId = await resolveFlavorId(creds, opts.flavor);
+        const data = await readArchive(opts.archive);
+        out(await guardOwnership("flavor", flavorId, creds.tenantId, () => hermesUpload({
+            ...creds,
+            path: `/v1/tenant-api/flavors/${seg(flavorId)}/versions`,
+            contentType: "application/gzip",
+            data,
+        })));
+    });
+    agentFlags(flavor.command("rollout").description("Roll one flavor version out to tenants pinned to that flavor."))
+        .requiredOption("--flavor-version <version>", "flavor version")
+        .option("--flavor <flavorId>", "flavor id (defaults to the current pin)")
+        .option("--all-matching", "target every tenant pinned to this flavor id, ignoring their update policy (requires --force)")
+        .option("--canary", "restrict the automatic rollout to the canary cohort")
+        .option("--tenant <tenantId>", "target one tenant (repeatable)", collect)
+        .option("--force", "accept the blast radius of --all-matching")
+        .action(async (opts) => {
+        const body = rolloutBody(opts);
+        const creds = await credentials(program, opts, deps);
+        const flavorId = await resolveFlavorId(creds, opts.flavor);
+        const result = (await guardOwnership("flavor", flavorId, creds.tenantId, () => hermesCall({
+            ...creds,
+            method: "POST",
+            path: `/v1/tenant-api/flavors/${seg(flavorId)}/versions/${seg(opts.flavorVersion)}/rollout`,
+            body,
+        })));
+        process.stderr.write(`rollout affected ${String(result?.updatedCount ?? 0)} of ${String(result?.matchedCount ?? 0)} matched tenants\n`);
+        out(result);
+    });
+    const skill = group.command("skill").description("Skill marketplace (owner-gated for publish)");
+    agentFlags(skill.command("catalog").description("List the skill catalog.")).action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: "/v1/tenant-api/skills" }));
+    });
+    agentFlags(skill.command("get").description("Get one catalog skill."))
+        .requiredOption("--skill <skillId>", "skill id")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: `/v1/tenant-api/skills/${seg(opts.skill)}` }));
+    });
+    agentFlags(skill.command("checkout").description("Download one skill version's source tarball."))
+        .requiredOption("--skill <skillId>", "skill id")
+        .requiredOption("--skill-version <version>", "skill version")
+        .requiredOption("--out <file>", "write the gzipped tarball here")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        const bytes = await downloadToFile(creds, `/v1/tenant-api/skills/${seg(opts.skill)}/versions/${seg(opts.skillVersion)}/source`, opts.out);
+        out({ path: opts.out, bytes });
+    });
+    agentFlags(skill.command("publish").description("Publish a new version of an owned skill."))
+        .requiredOption("--skill <skillId>", "skill id")
+        .requiredOption("--archive <file>", "gzipped skill package built beforehand")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        const data = await readArchive(opts.archive);
+        out(await guardOwnership("skill", opts.skill, creds.tenantId, () => hermesUpload({
+            ...creds,
+            path: `/v1/tenant-api/skills/${seg(opts.skill)}/versions`,
+            contentType: "application/gzip",
+            data,
+        })));
+    });
+    const evals = group.command("eval").description("Flavor eval suites and runs");
+    agentFlags(evals.command("suites").description("List eval suites for this tenant's flavor.")).action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/flavor/eval-suites" }));
+    });
+    agentFlags(evals.command("run").description("Start an eval run."))
+        .requiredOption("--suite <suiteId>", "eval suite id")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, method: "POST", path: "/v1/tenant-api/tenant/flavor/eval-runs", body: { suiteId: opts.suite } }));
+    });
+    agentFlags(evals.command("list").description("List this tenant's eval runs."))
+        .option("--suite <suiteId>", "filter by suite id")
+        .option("--status <status>", "filter by status")
+        .option("--limit <n>", "maximum runs to return")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({
+            ...creds,
+            path: "/v1/tenant-api/tenant/eval-runs",
+            query: { suite_id: opts.suite, status: opts.status, limit: opts.limit },
+        }));
+    });
+    agentFlags(evals.command("get").description("Get one eval run."))
+        .requiredOption("--run <evalRunId>", "eval run id")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: `/v1/tenant-api/tenant/eval-runs/${seg(opts.run)}` }));
+    });
+    agentFlags(evals.command("cancel").description("Cancel one eval run."))
+        .requiredOption("--run <evalRunId>", "eval run id")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, method: "POST", path: `/v1/tenant-api/tenant/eval-runs/${seg(opts.run)}:cancel` }));
+    });
+    const peers = group.command("peers").description("A2A peers");
+    agentFlags(peers.command("list").description("List this tenant's A2A peers.")).action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: "/v1/tenant-api/peers" }));
+    });
+    agentFlags(peers.command("get").description("Get one peer."))
+        .requiredOption("--peer <peerId>", "peer id")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: `/v1/tenant-api/peers/${seg(opts.peer)}` }));
+    });
+    jsonOption(agentFlags(peers.command("call").description("Send a message to a peer.")), "body", "request body as JSON (overrides the other flags)")
+        .requiredOption("--peer <peerId>", "peer id")
+        .option("--message <text>", "message text")
+        .option("--context <contextId>", "conversation context id")
+        .option("--async", "return before the peer replies")
+        .option("--wait-seconds <n>", "seconds to wait for a reply")
+        .option("--idempotency-key <key>", "idempotency key (generated when omitted)")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        const body = parseJson(opts.body, "--body") ??
+            (opts.message !== undefined
+                ? {
+                    message: opts.message,
+                    ...(opts.context ? { contextId: opts.context } : {}),
+                    ...(opts.async ? { async: true } : {}),
+                    ...(opts.waitSeconds ? { waitSeconds: Number(opts.waitSeconds) } : {}),
+                    idempotencyKey: opts.idempotencyKey ?? randomUUID(),
+                }
+                : undefined);
+        if (body === undefined) {
+            throw new Error("One of --message or --body is required.");
+        }
+        out(await hermesCall({ ...creds, method: "POST", path: `/v1/tenant-api/peers/${seg(opts.peer)}/messages`, body }));
+    });
+    jsonOption(agentFlags(peers.command("find").description("Find peers by query and capabilities.")), "body", "request body as JSON (overrides the other flags)")
+        .option("--query <text>", "free-text query")
+        .option("--required-capability <name>", "capability the peer must have (repeatable)", collect)
+        .option("--exclude-capability <name>", "capability the peer must not have (repeatable)", collect)
+        .option("--limit <n>", "maximum peers to return")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        const body = parseJson(opts.body, "--body") ?? {
+            ...(opts.query ? { query: opts.query } : {}),
+            ...(opts.requiredCapability?.length ? { requiredCapabilities: opts.requiredCapability } : {}),
+            ...(opts.excludeCapability?.length ? { excludeCapabilities: opts.excludeCapability } : {}),
+            ...(opts.limit ? { limit: Number(opts.limit) } : {}),
+        };
+        out(await hermesCall({ ...creds, method: "POST", path: "/v1/tenant-api/peers:find", body }));
+    });
+    const conversations = group.command("conversations").description("A2A conversations");
+    agentFlags(conversations.command("list").description("List conversations.")).action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: "/v1/tenant-api/conversations" }));
+    });
+    agentFlags(conversations.command("get").description("Get one conversation."))
+        .requiredOption("--context <contextId>", "conversation context id")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: `/v1/tenant-api/conversations/${seg(opts.context)}` }));
+    });
+    agentFlags(conversations.command("messages").description("List one conversation's messages."))
+        .requiredOption("--context <contextId>", "conversation context id")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: `/v1/tenant-api/conversations/${seg(opts.context)}/messages` }));
+    });
+    const sessions = group.command("sessions").description("Tenant agent sessions");
+    agentFlags(sessions.command("list").description("List this tenant's sessions."))
+        .option("--limit <n>", "maximum sessions to return")
+        .option("--source <source>", "filter by source")
+        .action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/sessions", query: { limit: opts.limit, source: opts.source } }));
+    });
+    agentFlags(group.command("artifacts").description("List this tenant's artifacts.")).action(async (opts) => {
+        const creds = await credentials(program, opts, deps);
+        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/artifacts" }));
+    });
+}
+//# sourceMappingURL=hub.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fulldivevr/workcord-cli",
-  "version": "1.6.0",
+  "version": "2.17.0",
   "description": "Agent-first CLI using persistent Hermes tenant chat, with advanced API diagnostics.",
   "private": false,
   "license": "UNLICENSED",