@getmagical/cli 0.2.5 → 0.2.7

package/dist/index.js

@@ -2056,13 +2056,13 @@ var require_ast = __commonJS({
         helperExpression: function helperExpression(node) {
           return node.type === "SubExpression" || (node.type === "MustacheStatement" || node.type === "BlockStatement") && !!(node.params && node.params.length || node.hash);
         },
-        scopedId: function scopedId(path8) {
-          return /^\.|this\b/.test(path8.original);
+        scopedId: function scopedId(path9) {
+          return /^\.|this\b/.test(path9.original);
         },
         // an ID is simple if it only has one part, and that part is not
         // `..` or `this`.
-        simpleId: function simpleId(path8) {
-          return path8.parts.length === 1 && !AST.helpers.scopedId(path8) && !path8.depth;
+        simpleId: function simpleId(path9) {
+          return path9.parts.length === 1 && !AST.helpers.scopedId(path9) && !path9.depth;
         }
       }
     };
@@ -3132,12 +3132,12 @@ var require_helpers2 = __commonJS({
         loc
       };
     }
-    function prepareMustache(path8, params, hash, open, strip, locInfo) {
+    function prepareMustache(path9, params, hash, open, strip, locInfo) {
       var escapeFlag = open.charAt(3) || open.charAt(2), escaped = escapeFlag !== "{" && escapeFlag !== "&";
       var decorator = /\*/.test(open);
       return {
         type: decorator ? "Decorator" : "MustacheStatement",
-        path: path8,
+        path: path9,
         params,
         hash,
         escaped,
@@ -3455,9 +3455,9 @@ var require_compiler = __commonJS({
       },
       DecoratorBlock: function DecoratorBlock(decorator) {
         var program2 = decorator.program && this.compileProgram(decorator.program);
-        var params = this.setupFullMustacheParams(decorator, program2, void 0), path8 = decorator.path;
+        var params = this.setupFullMustacheParams(decorator, program2, void 0), path9 = decorator.path;
         this.useDecorators = true;
-        this.opcode("registerDecorator", params.length, path8.original);
+        this.opcode("registerDecorator", params.length, path9.original);
       },
       PartialStatement: function PartialStatement(partial) {
         this.usePartial = true;
@@ -3521,46 +3521,46 @@ var require_compiler = __commonJS({
         }
       },
       ambiguousSexpr: function ambiguousSexpr(sexpr, program2, inverse) {
-        var path8 = sexpr.path, name = path8.parts[0], isBlock = program2 != null || inverse != null;
-        this.opcode("getContext", path8.depth);
+        var path9 = sexpr.path, name = path9.parts[0], isBlock = program2 != null || inverse != null;
+        this.opcode("getContext", path9.depth);
         this.opcode("pushProgram", program2);
         this.opcode("pushProgram", inverse);
-        path8.strict = true;
-        this.accept(path8);
+        path9.strict = true;
+        this.accept(path9);
         this.opcode("invokeAmbiguous", name, isBlock);
       },
       simpleSexpr: function simpleSexpr(sexpr) {
-        var path8 = sexpr.path;
-        path8.strict = true;
-        this.accept(path8);
+        var path9 = sexpr.path;
+        path9.strict = true;
+        this.accept(path9);
         this.opcode("resolvePossibleLambda");
       },
       helperSexpr: function helperSexpr(sexpr, program2, inverse) {
-        var params = this.setupFullMustacheParams(sexpr, program2, inverse), path8 = sexpr.path, name = path8.parts[0];
+        var params = this.setupFullMustacheParams(sexpr, program2, inverse), path9 = sexpr.path, name = path9.parts[0];
         if (this.options.knownHelpers[name]) {
           this.opcode("invokeKnownHelper", params.length, name);
         } else if (this.options.knownHelpersOnly) {
           throw new _exception2["default"]("You specified knownHelpersOnly, but used the unknown helper " + name, sexpr);
         } else {
-          path8.strict = true;
-          path8.falsy = true;
-          this.accept(path8);
-          this.opcode("invokeHelper", params.length, path8.original, _ast2["default"].helpers.simpleId(path8));
+          path9.strict = true;
+          path9.falsy = true;
+          this.accept(path9);
+          this.opcode("invokeHelper", params.length, path9.original, _ast2["default"].helpers.simpleId(path9));
         }
       },
-      PathExpression: function PathExpression(path8) {
-        this.addDepth(path8.depth);
-        this.opcode("getContext", path8.depth);
-        var name = path8.parts[0], scoped = _ast2["default"].helpers.scopedId(path8), blockParamId = !path8.depth && !scoped && this.blockParamIndex(name);
+      PathExpression: function PathExpression(path9) {
+        this.addDepth(path9.depth);
+        this.opcode("getContext", path9.depth);
+        var name = path9.parts[0], scoped = _ast2["default"].helpers.scopedId(path9), blockParamId = !path9.depth && !scoped && this.blockParamIndex(name);
         if (blockParamId) {
-          this.opcode("lookupBlockParam", blockParamId, path8.parts);
+          this.opcode("lookupBlockParam", blockParamId, path9.parts);
         } else if (!name) {
           this.opcode("pushContext");
-        } else if (path8.data) {
+        } else if (path9.data) {
           this.options.data = true;
-          this.opcode("lookupData", path8.depth, path8.parts, path8.strict);
+          this.opcode("lookupData", path9.depth, path9.parts, path9.strict);
         } else {
-          this.opcode("lookupOnContext", path8.parts, path8.falsy, path8.strict, scoped);
+          this.opcode("lookupOnContext", path9.parts, path9.falsy, path9.strict, scoped);
         }
       },
       StringLiteral: function StringLiteral(string) {
@@ -3910,16 +3910,16 @@ var require_util2 = __commonJS({
     }
     exports.urlGenerate = urlGenerate;
     function normalize(aPath) {
-      var path8 = aPath;
+      var path9 = aPath;
       var url = urlParse(aPath);
       if (url) {
         if (!url.path) {
           return aPath;
         }
-        path8 = url.path;
+        path9 = url.path;
       }
-      var isAbsolute = exports.isAbsolute(path8);
-      var parts = path8.split(/\/+/);
+      var isAbsolute = exports.isAbsolute(path9);
+      var parts = path9.split(/\/+/);
       for (var part, up = 0, i = parts.length - 1; i >= 0; i--) {
         part = parts[i];
         if (part === ".") {
@@ -3936,15 +3936,15 @@ var require_util2 = __commonJS({
           }
         }
       }
-      path8 = parts.join("/");
-      if (path8 === "") {
-        path8 = isAbsolute ? "/" : ".";
+      path9 = parts.join("/");
+      if (path9 === "") {
+        path9 = isAbsolute ? "/" : ".";
       }
       if (url) {
-        url.path = path8;
+        url.path = path9;
         return urlGenerate(url);
       }
-      return path8;
+      return path9;
     }
     exports.normalize = normalize;
     function join(aRoot, aPath) {
@@ -6727,8 +6727,8 @@ var require_printer = __commonJS({
       return this.accept(sexpr.path) + " " + params + hash;
     };
     PrintVisitor.prototype.PathExpression = function(id) {
-      var path8 = id.parts.join("/");
-      return (id.data ? "@" : "") + "PATH:" + path8;
+      var path9 = id.parts.join("/");
+      return (id.data ? "@" : "") + "PATH:" + path9;
     };
     PrintVisitor.prototype.StringLiteral = function(string) {
       return '"' + string.value + '"';
@@ -7079,8 +7079,8 @@ function getErrorMessage(error) {
 }
 
 // src/program.ts
-import { readFile as readFile5 } from "node:fs/promises";
-import path7 from "node:path";
+import { readFile as readFile6 } from "node:fs/promises";
+import path8 from "node:path";
 
 // ../common/dist/src/stdlib/json.util.js
 var import_ts_essentials = __toESM(require_dist(), 1);
@@ -11818,6 +11818,7 @@ var fieldMetadataSchema = z7.object({
   description: z7.string().describe("A description of the input parameter.").nullable(),
   typeOverride: z7.string().describe("The override for the input parameter.").nullable(),
   enumLabels: z7.record(z7.string(), z7.string()).describe("Optional map of enum values to their display labels.").optional(),
+  displayDefaultValue: z7.unknown().describe("Optional value to display when input is omitted without changing the parsed value.").optional(),
   label: z7.string().describe("Optional label override for the field.").optional(),
   allowLineBreaks: z7.boolean().describe("Whether the field should allow line breaks when supported by the input component.").optional(),
   hideEmptyInCollapsed: z7.boolean().describe("Whether to hide this field in collapsed view when empty.").optional(),
@@ -11850,6 +11851,7 @@ var clickTypeEnumSchema = z7.enum([
   "DOUBLE",
   "TRIPLE"
 ]);
+var updateModeSchema = z7.enum(["append", "prepend", "replace"]);
 var clickTypeSchema = withMetadata(clickTypeEnumSchema.optional(), {
   description: "The type of click to perform",
   typeOverride: null
@@ -11922,8 +11924,8 @@ var RENDER_TEMPLATE_ERROR_REASON_CATALOG = defineErrorReasonCatalog()([
 ]);
 var storeReferencePathPattern = String.raw`store(?:\.[$A-Z_a-z][\w$]*)*`;
 var storeReferenceMarkdownLinkTemplateRegex = new RegExp(String.raw`(?<open>\{\{\{?)\s*\[(?<path>${storeReferencePathPattern})\]\(\s*<?https?:\/\/\k<path>>?\s*\)\s*(?<close>\}\}\}?)`, "gu");
-function normalizeAutomationStoreTemplateLinkMatch([_match, open, path8]) {
-  return open === "{{{" ? `{{{${path8}}}}` : `{{${path8}}}`;
+function normalizeAutomationStoreTemplateLinkMatch([_match, open, path9]) {
+  return open === "{{{" ? `{{{${path9}}}}` : `{{${path9}}}`;
 }
 function normalizeAutomationStoreTemplateLinks(template) {
   return template.replaceAll(storeReferenceMarkdownLinkTemplateRegex, (...args) => normalizeAutomationStoreTemplateLinkMatch(args));
@@ -12491,18 +12493,18 @@ var reportStopDataSchema = z11.object({
 // ../common/dist/src/utils/automation-store-path.util.js
 var AUTOMATION_STORE_ROOT_PATH = "store";
 var relativeStorePathRegex = /^[$A-Z_a-z][\w$]*(?:\.[$A-Z_a-z][\w$]*)*$/u;
-function normalizeStoreMutationPath(path8) {
-  const trimmedPath = path8.trim();
+function normalizeStoreMutationPath(path9) {
+  const trimmedPath = path9.trim();
   const rootPrefix = `${AUTOMATION_STORE_ROOT_PATH}.`;
   const relativePath = trimmedPath.startsWith(rootPrefix) ? trimmedPath.slice(rootPrefix.length) : trimmedPath;
   if (!relativeStorePathRegex.test(relativePath)) {
     return Err({
       type: "invalid-automation-store-path",
-      path: path8,
+      path: path9,
       categories: ["customer_usage"],
       statusCode: 400,
       nonRetryable: true,
-      message: `Automation store path "${path8}" is invalid.`,
+      message: `Automation store path "${path9}" is invalid.`,
       suggestedAction: "Use a dot path relative to the automation store, such as patient.name or provider.clinic."
     });
   }
@@ -12515,16 +12517,16 @@ function findAutomationStorePathOverlap(paths) {
     ...new Set(paths.map(getCanonicalAutomationStoreMutationPath))
   ].toSorted((left, right) => (left === AUTOMATION_STORE_ROOT_PATH ? 0 : left.split(".").length) - (right === AUTOMATION_STORE_ROOT_PATH ? 0 : right.split(".").length));
   for (const [index, ancestorPath] of canonicalPaths.entries()) {
-    const descendantPath = canonicalPaths.slice(index + 1).find((path8) => ancestorPath === AUTOMATION_STORE_ROOT_PATH || path8.startsWith(`${ancestorPath}.`));
+    const descendantPath = canonicalPaths.slice(index + 1).find((path9) => ancestorPath === AUTOMATION_STORE_ROOT_PATH || path9.startsWith(`${ancestorPath}.`));
     if (descendantPath !== void 0) {
       return { ancestorPath, descendantPath };
     }
   }
   return void 0;
 }
-function getCanonicalAutomationStoreMutationPath(path8) {
-  const normalizedPath = normalizeStoreMutationPath(path8);
-  return normalizedPath._tag === "Ok" ? normalizedPath.value : path8.trim();
+function getCanonicalAutomationStoreMutationPath(path9) {
+  const normalizedPath = normalizeStoreMutationPath(path9);
+  return normalizedPath._tag === "Ok" ? normalizedPath.value : path9.trim();
 }
 
 // ../common/dist/src/constants/tool-declarations.js
@@ -12748,9 +12750,9 @@ var baseToolDeclarations = {
           path: []
         });
       }
-      const canonicalUpdatePaths = updates.map(({ path: path8 }) => getCanonicalAutomationStoreMutationPath(path8));
+      const canonicalUpdatePaths = updates.map(({ path: path9 }) => getCanonicalAutomationStoreMutationPath(path9));
       const canonicalClearPathSet = new Set(clears.map(getCanonicalAutomationStoreMutationPath));
-      const conflictedUpdatePath = canonicalUpdatePaths.find((path8) => canonicalClearPathSet.has(path8));
+      const conflictedUpdatePath = canonicalUpdatePaths.find((path9) => canonicalClearPathSet.has(path9));
       if (conflictedUpdatePath !== void 0) {
         context.addIssue({
           code: "custom",
@@ -12826,10 +12828,11 @@ var baseToolDeclarations = {
   },
   type: {
     id: "type",
-    description: "Type in the currently focused element with the given text",
+    description: "Type in the currently focused element. By default, this replaces the complete current value; updateMode can instead append or prepend the text.",
     parameters: z12.object({
       [COMMON_PARAMETERS_KEY]: DEFAULT_COMMON_PARAMETERS,
-      text: z12.string().describe("The text to type")
+      text: z12.string().describe("The text to type"),
+      updateMode: updateModeSchema.optional().describe("How to combine the text with the current value. Defaults to replace.")
     })
   },
   getNDCFromMedication: {
@@ -13429,9 +13432,9 @@ var specialCommands = {
 };
 
 // ../common/dist/src/utils/agent-knowledge-base-assets.util.js
-function getIsKnowledgeBaseAssetPathAllowed(path8) {
-  const pathSegments = path8.split("/");
-  if (path8.length === 0 || pathSegments.some((segment) => segment.length === 0)) {
+function getIsKnowledgeBaseAssetPathAllowed(path9) {
+  const pathSegments = path9.split("/");
+  if (path9.length === 0 || pathSegments.some((segment) => segment.length === 0)) {
     return false;
   }
   const isTopLevelAssetPath = pathSegments[0] === "assets";
@@ -13473,46 +13476,46 @@ var API_FILE_TYPE_REGISTRY = {
 var ApiAgentOutputModes = ["inline", "file"];
 var API_EMBEDDED_FILE_PATH_PATTERN = /^(?:\[\*\]|[A-Za-z_$][\w$-]*)(?:\[\*\]|\.[A-Za-z_$][\w$-]*)*$/u;
 var API_EMBEDDED_FILE_PATH_SEGMENT_PATTERN = /\[\*\]|[A-Za-z_$][\w$-]*/gu;
-function parseApiEmbeddedFilePath(path8) {
-  if (!API_EMBEDDED_FILE_PATH_PATTERN.test(path8)) {
+function parseApiEmbeddedFilePath(path9) {
+  if (!API_EMBEDDED_FILE_PATH_PATTERN.test(path9)) {
     return void 0;
   }
-  return [...path8.matchAll(API_EMBEDDED_FILE_PATH_SEGMENT_PATTERN)].map(([segment]) => segment === "[*]" ? { type: "arrayWildcard" } : { key: segment, type: "property" });
+  return [...path9.matchAll(API_EMBEDDED_FILE_PATH_SEGMENT_PATTERN)].map(([segment]) => segment === "[*]" ? { type: "arrayWildcard" } : { key: segment, type: "property" });
 }
 var apiAgentEmbeddedFileSchema = z14.object({
-  path: z14.string().trim().min(1, "Embedded file path is required.").refine((path8) => parseApiEmbeddedFilePath(path8) !== void 0, {
+  path: z14.string().trim().min(1, "Embedded file path is required.").refine((path9) => parseApiEmbeddedFilePath(path9) !== void 0, {
     message: "Embedded file path must use object properties and [*] array wildcards."
   }).describe("Path to a Base64 value relative to the projected API response. Supports object properties and [*] array wildcards."),
   contentType: z14.enum(ApiFileContentTypes).describe("File type of the decoded Base64 value.")
 }).strict();
 var apiAgentEmbeddedFilesSchema = z14.array(apiAgentEmbeddedFileSchema).superRefine((embeddedFiles, context) => {
   const paths = /* @__PURE__ */ new Set();
-  for (const [index, { path: path8 }] of embeddedFiles.entries()) {
-    if (paths.has(path8)) {
+  for (const [index, { path: path9 }] of embeddedFiles.entries()) {
+    if (paths.has(path9)) {
       context.addIssue({
         code: z14.ZodIssueCode.custom,
-        message: `Embedded file path "${path8}" can only be configured once.`,
+        message: `Embedded file path "${path9}" can only be configured once.`,
         path: [index, "path"]
       });
     }
-    paths.add(path8);
+    paths.add(path9);
   }
 }).describe("Base64 values to decode, upload as permanent files, and replace with file references in the projected API response.");
 
 // ../common/dist/src/zod-schemas/api-agent-request-file-encoding.schema.js
 import { z as z15 } from "zod";
 var API_REQUEST_FILE_PATH_PATTERN = /^[A-Za-z_$][\w$-]*(?:\.[A-Za-z_$][\w$-]*)*$/u;
-function parseApiRequestFilePath(path8) {
-  if (!API_REQUEST_FILE_PATH_PATTERN.test(path8)) {
+function parseApiRequestFilePath(path9) {
+  if (!API_REQUEST_FILE_PATH_PATTERN.test(path9)) {
     return void 0;
   }
-  return path8.split(".");
+  return path9.split(".");
 }
 var apiAgentRequestFileEncodingSchema = z15.object({
-  sourceInput: z15.string().trim().min(1, "File input is required.").refine((path8) => parseApiRequestFilePath(path8) !== void 0, {
+  sourceInput: z15.string().trim().min(1, "File input is required.").refine((path9) => parseApiRequestFilePath(path9) !== void 0, {
     message: "File input must use an object property path."
   }).describe("API Agent input containing the file reference to encode."),
-  destinationPath: z15.string().trim().min(1, "Request field is required.").refine((path8) => parseApiRequestFilePath(path8) !== void 0, {
+  destinationPath: z15.string().trim().min(1, "Request field is required.").refine((path9) => parseApiRequestFilePath(path9) !== void 0, {
     message: "Request field must use an object property path."
   }).describe("JSON request body path where the encoded value is inserted."),
   encoding: z15.literal("base64").describe("Encoding applied to the source file before insertion.")
@@ -13863,25 +13866,32 @@ function hasControlCharacter(value) {
   }
   return false;
 }
-function isNormalizedRepoPath(path8) {
-  if (path8 === "/") {
+function isNormalizedRepoPath(path9) {
+  if (path9 === "/") {
     return true;
   }
-  if (path8.length === 0 || path8.startsWith("/") || path8.startsWith("\\") || path8.includes("\\") || hasControlCharacter(path8) || windowsAbsolutePathPattern.test(path8)) {
+  if (path9.length === 0 || path9.startsWith("/") || path9.startsWith("\\") || path9.includes("\\") || hasControlCharacter(path9) || windowsAbsolutePathPattern.test(path9)) {
     return false;
   }
-  return path8.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== ".." && segment !== ".git");
+  return path9.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== ".." && segment !== ".git");
 }
-function normalizeRepoPath(path8) {
-  if (path8 === "/") {
-    return path8;
+function normalizeRepoPath(path9) {
+  if (path9 === "/") {
+    return path9;
   }
-  return path8.replaceAll(/\/+$/gu, "");
+  return path9.replaceAll(/\/+$/gu, "");
 }
 var skillPathPattern = /^(?:skills\/.+|automations\/[^/]+\/skills\/.+|automations\/[^/]+\/agents\/[^/]+\/skills\/.+)$/u;
+var skillRootPathPattern = /^(?:skills\/[^/]+|automations\/[^/]+\/skills\/[^/]+|automations\/[^/]+\/agents\/[^/]+\/skills\/[^/]+)$/u;
 var repoPathSchema = z21.string().min(1).transform(normalizeRepoPath).refine(isNormalizedRepoPath, {
   message: "Path must be a normalized repository-relative path."
 });
+var registeredSkillPathSchema = repoPathSchema.refine((path9) => skillPathPattern.test(path9), {
+  message: "Skill paths must be under root, automation, or automation-agent skills."
+});
+var registeredSkillRootPathSchema = registeredSkillPathSchema.refine((path9) => skillRootPathPattern.test(path9) && !path9.endsWith("/SKILL.md"), {
+  message: "Registered skill paths must identify a skill root directory."
+});
 var knowledgeBasePluginPermissionSchema = z21.object({
   path: repoPathSchema.refine(getIsKnowledgeBaseAssetPathAllowed, {
     message: "Knowledge Base paths must be under org, automation, or automation-agent assets."
@@ -13897,9 +13907,7 @@ var memoryConfigSchema = z21.object({
 }).strict().describe("Configuration for the memory runtime plugin.");
 var skillsConfigSchema = z21.object({
   enabled: z21.boolean().default(false).describe("Explicit rollout switch for the skills runtime plugin."),
-  registeredSkills: z21.array(repoPathSchema.refine((path8) => skillPathPattern.test(path8), {
-    message: "Skill paths must be under root, automation, or automation-agent skills."
-  })).default(() => []).describe("Repository skill root paths available to the skills plugin."),
+  registeredSkills: z21.array(registeredSkillPathSchema).default(() => []).describe("Repository skill root paths available to the skills plugin."),
   canEdit: z21.boolean().default(false).describe("Allows the skills runtime plugin to edit repo skills under the root skills folder.")
 }).describe("Configuration for the skills runtime plugin.");
 var agentPluginsConfigSchema = z21.object({
@@ -13921,6 +13929,7 @@ var baseAgentConfigFieldsSchema = z21.object({
   environmentOptions: environmentOptionsSchema.optional().default(DEFAULT_ENVIRONMENT_OPTION).describe("Environment configuration for the agent. Default is browser with SOM."),
   runSettings: agentRunSettingsSchema.optional().describe("Run settings persisted on the agent and used when this agent is selected as the settings source for a run while the run-settings rollout is enabled. This is the canonical runtime source for resource pools during the migration. It intentionally mirrors a subset of agent config so settings survive topology changes and can be stored on any agent regardless of that agent's own execution environment. Writers may populate this before the rollout flag is enabled, but runtime snapshotting must keep using legacy fields while the flag is disabled."),
   skipBrowserDebuggerPauses: z21.boolean().optional().describe("Legacy agent-local browser session startup setting. Used only when a run is in legacy config mode; canonical run settings mode reads runSettings.skipBrowserDebuggerPauses instead."),
+  stepFollowingVerification: z21.enum(["default", "enabled", "disabled"]).optional().describe("Controls step-following verification for this agent. Default runs verification unless skills are enabled; enabled forces it on past the skills rule; disabled forces it off. Automation and system feature gates still take precedence."),
   limitations: agentRunLimitationSchema.describe("Resource limits for this agent, including maximum duration and tool call limits."),
   commonParametersSchema: z21.custom().optional().describe("Custom schema defining metadata the agent must provide with every tool call. By default, agents provide reasoning and step information. If specified, this schema replaces the default metadata schema entirely."),
   idempotencySettings: z21.object({
@@ -14266,7 +14275,8 @@ var automationRunConfigBaseSchema = z24.object({
   resolvedRunSettings: automationRunResolvedRunSettingsSchema.optional().describe("Canonical run settings snapshotted onto the automation run at creation time. Present only for runSettings mode; legacyConfig mode intentionally resolves runtime settings from each current agent config instead of storing a misleading snapshot."),
   queueResourcePools: resourcePoolsSchema.optional().describe("Canonical deduped resource-pool requirements snapshotted for queue and slot assignment. Present on new runs so assignment does not recompute requirements from mutable agent config."),
   credentialVariableResourcePools: resourcePoolsSchema.optional().describe("Additional resource pools selected through credential-valued automation variables. These are additive queue requirements and do not change whether the run uses runSettings or legacyConfig as its runtime settings source."),
-  resolvedRunSettingsSource: z24.enum(["runSettings", "legacyConfig"]).optional().describe("Runtime mode decided at run creation. runSettings means resolvedRunSettings is canonical for browser/session/resource-pool behaviour; legacyConfig means runtime consumers must use current agent legacy config fields.")
+  resolvedRunSettingsSource: z24.enum(["runSettings", "legacyConfig"]).optional().describe("Runtime mode decided at run creation. runSettings means resolvedRunSettings is canonical for browser/session/resource-pool behaviour; legacyConfig means runtime consumers must use current agent legacy config fields."),
+  automationVersionPinned: z24.literal(true).optional().describe("Infrastructure-owned marker set when the run was explicitly pinned to an automation version (e.g. a branch head draft run). Draft-scoped prompt rendering must keep the pinned agent version instead of re-resolving the latest draft instructions.")
 });
 var automationRunConfigSchema = automationRunConfigBaseSchema.superRefine((config, ctx) => {
   if (config.networkTrafficCaptureExplicitlyDisabled === true && config.networkTrafficCapture !== void 0) {
@@ -14279,6 +14289,7 @@ var automationRunConfigSchema = automationRunConfigBaseSchema.superRefine((confi
 });
 var automationRunStartConfigSchema = automationRunConfigBaseSchema.omit({
   allowPointOfNoReturnOverride: true,
+  automationVersionPinned: true,
   credentialVariableResourcePools: true,
   implicitNetworkTrafficRecordingDecision: true,
   networkTrafficCapture: true,
@@ -14327,13 +14338,13 @@ function getMentionedStandardCommand(instructions) {
   const normalizedInstructions = instructions.toLowerCase();
   return STANDARD_COMMAND_NAMES.find((commandName) => normalizedInstructions.includes(commandName.toLowerCase())) ?? null;
 }
-function assertCustomInstructionsCommand({ commands, path: path8 }) {
-  const customCommands = commands.flatMap((command, commandIndex) => command["commandName"] === "custom" ? [{ command, path: `${path8}[${commandIndex.toString()}]` }] : []);
+function assertCustomInstructionsCommand({ commands, path: path9 }) {
+  const customCommands = commands.flatMap((command, commandIndex) => command["commandName"] === "custom" ? [{ command, path: `${path9}[${commandIndex.toString()}]` }] : []);
   if (customCommands.length === 0) {
     return;
   }
   if (customCommands.length > MAX_CUSTOM_COMMAND_COUNT) {
-    throw createInvalidValueError(`${path8} contains ${customCommands.length.toString()} custom commands. Use at most one short custom command per agent. Split policy, decision, outreach, and multi-step work into catalog commands or child agents instead.`);
+    throw createInvalidValueError(`${path9} contains ${customCommands.length.toString()} custom commands. Use at most one short custom command per agent. Split policy, decision, outreach, and multi-step work into catalog commands or child agents instead.`);
   }
   const [customCommand] = customCommands;
   if (!customCommand) {
@@ -14387,27 +14398,35 @@ function createOperationSpec(spec) {
 }
 
 // ../mcp-registry/src/operation-specs.ts
+var AUTOMATION_BRANCH_NAME_PATTERN = /^[\da-z]+(?:-[\da-z]+)*$/u;
+var AUTOMATION_BRANCH_NAME_MESSAGE = 'Branch name must use lowercase letters or numbers separated by single dashes (for example, "release-2").';
 function stringOption({
+  clientOnly = false,
   description,
   flagName,
   inputKey,
-  required = false
+  required = false,
+  valueHint
 }) {
   return {
+    ...clientOnly ? { clientOnly: true } : {},
     description,
     flagName,
     inputKey,
     required,
+    ...valueHint ? { valueHint } : {},
     valueType: "string"
   };
 }
 function numberOption({
+  clientOnly = false,
   description,
   flagName,
   inputKey,
   required = false
 }) {
   return {
+    ...clientOnly ? { clientOnly: true } : {},
     description,
     flagName,
     inputKey,
@@ -14416,11 +14435,13 @@ function numberOption({
   };
 }
 function booleanOption({
+  clientOnly = false,
   description,
   flagName,
   inputKey
 }) {
   return {
+    ...clientOnly ? { clientOnly: true } : {},
     description,
     flagName,
     inputKey,
@@ -14458,13 +14479,79 @@ function jsonOption({
   };
 }
 var jsonObjectSchema = z25.record(z25.string(), z25.unknown());
+var evalRunStatusSchema = z25.enum([
+  "QUEUED",
+  "RUNNING",
+  "COMPLETE",
+  "FAILED",
+  "CANCELLED"
+]);
+var evalInputChoicesSchema = z25.record(
+  z25.string(),
+  z25.array(z25.unknown()).min(1)
+);
+var registeredEvalRunInputSchema = z25.object({
+  description: z25.string().min(1).optional(),
+  input: evalInputChoicesSchema,
+  maxConcurrency: z25.number().int().positive().default(1),
+  name: z25.string().min(1).optional(),
+  repeatCount: z25.number().int().positive().default(1),
+  slug: z25.string().min(1),
+  tags: z25.array(z25.string().min(1)).default([])
+});
+var registeredEvalSelection = `    slug
+    name
+    description
+    tags
+    version
+    inputSchema`;
+var evalRunSelection = `    id
+    createdAt
+    updatedAt
+    userId
+    slug
+    evalName
+    evalDescription
+    evalTags
+    evalVersion
+    input
+    name
+    description
+    tags
+    scorerSlugs
+    maxConcurrency
+    repeatCount
+    acknowledgedTrialCount
+    idempotencyKey
+    dashboardUrl
+    workflowId
+    workflowRunId
+    status
+    startedAt
+    finishedAt
+    trialStatusCounts {
+      queued
+      running
+      complete
+      failed
+      cancelled
+    }`;
+var evalRunExportSelection = `    exportId
+    evalRunId
+    status
+    workflowId
+    workflowRunId
+    fileName
+    trialCount
+    downloadUrl
+    error`;
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function validateCustomInstructionsCommands({
   commands,
   ctx,
-  path: path8
+  path: path9
 }) {
   if (!Array.isArray(commands)) {
     return;
@@ -14472,14 +14559,14 @@ function validateCustomInstructionsCommands({
   const validationResult = fromThrowable(() => {
     assertCustomInstructionsCommand({
       commands: commands.map((command) => isRecord3(command) ? command : {}),
-      path: path8.join(".").replaceAll(/\.(?<index>\d+)/gu, "[$<index>]")
+      path: path9.join(".").replaceAll(/\.(?<index>\d+)/gu, "[$<index>]")
     });
   }, "invalid-custom-instructions-command");
   if (isErr(validationResult)) {
     ctx.addIssue({
       code: "custom",
       message: `${getErrorMessage2(validationResult.error.cause)} Run mgcl catalog commands to find the standard command for this work.`,
-      path: path8
+      path: path9
     });
   }
 }
@@ -14715,6 +14802,7 @@ ${agentLimitationsSelection}
       systemPrompt
       additionalSystemPrompt
       ignoreUnstableSessionState
+      stepFollowingVerification
       resourcePools {
         id
         type
@@ -14784,6 +14872,7 @@ ${agentLimitationsSelection}
       systemPrompt
       additionalSystemPrompt
       ignoreUnstableSessionState
+      stepFollowingVerification
     }
     isCurrent
   }
@@ -15493,6 +15582,193 @@ query GetAutomations($ids: [ID!]!) {
       }
     }
   }
+}`
+  }),
+  createOperationSpec({
+    operationName: "ListAutomationBranches",
+    kind: "query",
+    inputSchema: z25.object({
+      automationId: z25.string().min(1)
+    }),
+    cli: {
+      name: "list-automation-branches",
+      path: ["automations", "branches", "list"],
+      description: "List active branches for an automation.",
+      resultKey: "automationBranches",
+      options: [
+        stringOption({
+          inputKey: "automationId",
+          flagName: "automation-id",
+          description: "Automation ID.",
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "automationBranches.graphql" },
+    document: `# List active automation branches. Deleted branches are excluded.
+query ListAutomationBranches($automationId: ID!) {
+  automationBranches(automationId: $automationId) {
+    branchId
+    automationId
+    name
+    headVersionId
+    forkedFromBranchId
+    forkedFromVersionId
+    createdAt
+    updatedAt
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "CreateAutomationBranch",
+    kind: "mutation",
+    inputSchema: z25.object({
+      automationId: z25.string().min(1),
+      name: z25.string().regex(AUTOMATION_BRANCH_NAME_PATTERN, AUTOMATION_BRANCH_NAME_MESSAGE),
+      sourceBranchId: z25.string().min(1).optional(),
+      sourceVersionId: z25.string().min(1).optional()
+    }),
+    cli: {
+      name: "create-automation-branch",
+      path: ["automations", "branches", "create"],
+      description: "Create an automation branch. The source defaults to the current main head.",
+      resultKey: "createAutomationBranch",
+      options: [
+        stringOption({
+          inputKey: "automationId",
+          flagName: "automation-id",
+          description: "Automation ID.",
+          required: true
+        }),
+        stringOption({
+          inputKey: "name",
+          flagName: "name",
+          description: 'Lowercase branch name with single dashes between words or numbers (for example, "release-2").',
+          required: true
+        }),
+        stringOption({
+          inputKey: "sourceBranchId",
+          flagName: "source-branch-id",
+          description: "Optional source branch ID. Omit to branch from main."
+        }),
+        stringOption({
+          inputKey: "sourceVersionId",
+          flagName: "source-version-id",
+          description: "Optional version in the selected source history. Omit to use its head."
+        })
+      ]
+    },
+    mcp: { fileName: "createAutomationBranch.graphql" },
+    document: `# Create an automation branch from main or another branch.
+mutation CreateAutomationBranch(
+  $automationId: ID!
+  $name: String!
+  $sourceBranchId: ID
+  $sourceVersionId: ID
+) {
+  createAutomationBranch(
+    automationId: $automationId
+    name: $name
+    sourceBranchId: $sourceBranchId
+    sourceVersionId: $sourceVersionId
+  ) {
+    branchId
+    automationId
+    name
+    headVersionId
+    forkedFromBranchId
+    forkedFromVersionId
+    createdAt
+    updatedAt
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "GetAutomationBranch",
+    kind: "query",
+    inputSchema: z25.object({
+      automationId: z25.string().min(1),
+      branchId: z25.string().min(1)
+    }),
+    cli: {
+      branchContext: "required",
+      name: "get-automation-branch",
+      path: ["automations", "branches", "get"],
+      description: "Get the hydrated snapshot at an automation branch head without authentication secrets.",
+      resultKey: "automationBranchHead",
+      options: [
+        stringOption({
+          inputKey: "automationId",
+          flagName: "automation-id",
+          description: "Automation ID.",
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "automationBranchHead.graphql" },
+    document: `# Get the hydrated snapshot at an active branch head. Authentication secrets are excluded.
+query GetAutomationBranch($automationId: ID!, $branchId: ID!) {
+  automationBranchHead(automationId: $automationId, branchId: $branchId) {
+    branchId
+    headVersionId
+    automation
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "MergeAutomationBranch",
+    kind: "mutation",
+    inputSchema: z25.object({
+      automationId: z25.string().min(1),
+      branchId: z25.string().min(1)
+    }),
+    cli: {
+      branchContext: "required",
+      name: "merge-automation-branch",
+      path: ["automations", "branches", "merge"],
+      description: "Preview and merge a branch into main when every change is conflict-free.",
+      resultKey: "mergeAutomationBranch",
+      options: [
+        stringOption({
+          inputKey: "automationId",
+          flagName: "automation-id",
+          description: "Automation ID.",
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "mergeAutomationBranch.graphql" },
+    document: `# Preview a branch merge and apply it only when there are no conflicts.
+mutation MergeAutomationBranch($automationId: ID!, $branchId: ID!) {
+  mergeAutomationBranch(automationId: $automationId, branchId: $branchId) {
+    automationId
+    branchId
+    status
+    sourceBranchDeleted
+    preview {
+      baseVersionId
+      sourceVersionId
+      targetVersionId
+      changes {
+        id
+        group
+        label
+        status
+      }
+    }
+    conflicts {
+      id
+      group
+      label
+      status
+    }
+    applyResult {
+      draftVersionId
+      lastSavedAt
+      publishedVersionId
+      wasRebased
+    }
+  }
 }`
   }),
   createOperationSpec({
@@ -15747,9 +16023,11 @@ query GetAutomationWorkbenchCredentials {
     operationName: "GetAutomationWorkbenchDiagnostics",
     kind: "query",
     inputSchema: z25.object({
-      draftAutomationId: z25.string().min(1)
+      draftAutomationId: z25.string().min(1),
+      branchId: z25.string().min(1).optional()
     }),
     cli: {
+      branchContext: "optional",
       name: "get-automation-workbench-diagnostics",
       path: ["workbench", "diagnostics"],
       description: "Fetch a compact draft automation graph plus workbench diagnostics.",
@@ -15765,8 +16043,10 @@ query GetAutomationWorkbenchCredentials {
     },
     mcp: { fileName: "automationWorkbenchDiagnostics.graphql" },
     document: `# Query automation workbench diagnostics for a draft automation.
-query GetAutomationWorkbenchDiagnostics($draftAutomationId: ID!) {
-  automationWorkbenchDiagnostics(draftAutomationId: $draftAutomationId) {
+query GetAutomationWorkbenchDiagnostics($draftAutomationId: ID!, $branchId: ID) {
+  automationWorkbenchDiagnostics(draftAutomationId: $draftAutomationId, branchId: $branchId) {
+    branchId
+    headVersionId
     summary {
       draftAutomationId
       name
@@ -16111,10 +16391,19 @@ query GetAutomationWorkbenchAwaitRunCompletion(
     inputSchema: z25.object({
       automationRunId: z25.string().min(1),
       draftAutomationId: z25.string().min(1).optional(),
+      branchId: z25.string().min(1).optional(),
       minConfidence: z25.number().min(0).max(1).optional(),
       includeSensitive: z25.boolean().optional()
+    }).superRefine((input, ctx) => {
+      if (input.branchId && !input.draftAutomationId) {
+        ctx.addIssue({
+          code: z25.ZodIssueCode.custom,
+          message: "--branch-id requires --draft-automation-id."
+        });
+      }
     }),
     cli: {
+      branchContext: "optional",
       name: "get-automation-workbench-schema-suggestions",
       path: ["workbench", "schema-suggestions"],
       description: "Heuristic suggestions for schema fields the agent observed on browser pages but were not declared in the input schema.",
@@ -16149,15 +16438,19 @@ query GetAutomationWorkbenchAwaitRunCompletion(
 query GetAutomationWorkbenchSchemaSuggestions(
   $automationRunId: ID!
   $draftAutomationId: ID
+  $branchId: ID
   $minConfidence: Float
   $includeSensitive: Boolean
 ) {
   automationWorkbenchSchemaSuggestions(
     automationRunId: $automationRunId
     draftAutomationId: $draftAutomationId
+    branchId: $branchId
     minConfidence: $minConfidence
     includeSensitive: $includeSensitive
   ) {
+    branchId
+    headVersionId
     kind
     fieldName
     fieldLabel
@@ -16596,6 +16889,7 @@ mutation ResumeAutomationRun($automationRunId: ID!, $message: String) {
     kind: "mutation",
     inputSchema: z25.object({
       draftAutomationId: z25.string().min(1),
+      branchId: z25.string().min(1).optional(),
       agentId: z25.string().min(1),
       idempotencyKey: z25.string().min(1),
       input: z25.unknown().optional(),
@@ -16605,6 +16899,7 @@ mutation ResumeAutomationRun($automationRunId: ID!, $message: String) {
       consistencyCheckCount: z25.number().int().optional()
     }),
     cli: {
+      branchContext: "optional",
       name: "run-draft-automation",
       path: ["automations", "run-draft"],
       description: "Run a draft automation with an explicit trigger agent.",
@@ -16660,6 +16955,7 @@ mutation ResumeAutomationRun($automationRunId: ID!, $message: String) {
 # \`draftAutomationId\` is the draft automation entity ID (\`Automation.id\`), not \`draftVersionId\`.
 mutation RunDraftAutomation(
   $draftAutomationId: ID!
+  $branchId: ID
   $agentId: ID!
   $idempotencyKey: String!
   $input: JSON
@@ -16670,6 +16966,7 @@ mutation RunDraftAutomation(
 ) {
   runDraftAutomation(
     draftAutomationId: $draftAutomationId
+    branchId: $branchId
     agentId: $agentId
     idempotencyKey: $idempotencyKey
     input: $input
@@ -16679,6 +16976,9 @@ mutation RunDraftAutomation(
     consistencyCheckCount: $consistencyCheckCount
   ) {
     automationRunId
+    automationVersionId
+    branchId
+    headVersionId
     workflowId
     workflowRunId
   }
@@ -16715,10 +17015,12 @@ mutation StopAutomationRun($automationRunId: ID!) {
     kind: "mutation",
     inputSchema: z25.object({
       draftAutomationId: z25.string().min(1),
+      branchId: z25.string().min(1).optional(),
       expectedLastSavedAt: z25.string().optional(),
       operations: automationPatchOperationsSchema
     }),
     cli: {
+      branchContext: "optional",
       name: "preview-automation-patch",
       path: ["workbench", "patch", "preview"],
       description: "Preview semantic workbench patch operations without saving the draft.",
@@ -16742,13 +17044,17 @@ mutation StopAutomationRun($automationRunId: ID!) {
     document: `# Preview semantic automation patch operations without writing.
 mutation PreviewAutomationPatch(
   $draftAutomationId: ID!
+  $branchId: ID
   $operations: [AutomationWorkbenchPatchOperationInput!]!
 ) {
   previewAutomationPatch(
     draftAutomationId: $draftAutomationId
+    branchId: $branchId
     operations: $operations
   ) {
     draftAutomationId
+    branchId
+    headVersionId
     applied
     updateInput
     before {
@@ -16820,6 +17126,83 @@ mutation PreviewAutomationPatch(
       name
     }
   }
+}`
+  }),
+  createOperationSpec({
+    operationName: "ValidateAutomationPatchReadiness",
+    kind: "mutation",
+    inputSchema: z25.object({
+      targetDraftAutomationId: z25.string().min(1).optional(),
+      newAutomationName: z25.string().min(1).optional(),
+      branchId: z25.string().min(1).optional(),
+      operations: automationPatchOperationsSchema
+    }).superRefine((input, ctx) => {
+      if (input.branchId && !input.targetDraftAutomationId) {
+        ctx.addIssue({
+          code: z25.ZodIssueCode.custom,
+          message: "--branch-id requires --target-draft-automation-id."
+        });
+      }
+    }),
+    cli: {
+      branchContext: "optional",
+      name: "validate-automation-patch-readiness",
+      path: ["workbench", "patch", "readiness"],
+      description: "Validate workbench patch readiness without changing an automation.",
+      resultKey: "validateAutomationPatchReadiness",
+      options: [
+        stringOption({
+          inputKey: "targetDraftAutomationId",
+          flagName: "target-draft-automation-id",
+          description: "Existing draft automation ID to validate."
+        }),
+        stringOption({
+          inputKey: "newAutomationName",
+          flagName: "new-automation-name",
+          description: "New automation name when validating without an existing target."
+        }),
+        jsonOption({
+          inputKey: "operations",
+          flagName: "operations-json",
+          description: `Automation patch operations array. ${COMMAND_CATALOG_HELP}`,
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "validateAutomationPatchReadiness.graphql" },
+    document: `# Validate automation patch readiness without writing.
+mutation ValidateAutomationPatchReadiness(
+  $targetDraftAutomationId: ID
+  $newAutomationName: String
+  $branchId: ID
+  $operations: [AutomationWorkbenchPatchOperationInput!]!
+) {
+  validateAutomationPatchReadiness(
+    targetDraftAutomationId: $targetDraftAutomationId
+    newAutomationName: $newAutomationName
+    branchId: $branchId
+    operations: $operations
+  ) {
+    targetDraftAutomationId
+    branchId
+    headVersionId
+    issues {
+      severity
+      code
+      message
+      agentId
+      localId
+      path
+      repair
+      relatedAgentIds
+      relatedLocalIds
+    }
+    createdAgents {
+      localId
+      id
+      name
+    }
+  }
 }`
   }),
   createOperationSpec({
@@ -16827,9 +17210,12 @@ mutation PreviewAutomationPatch(
     kind: "mutation",
     inputSchema: z25.object({
       draftAutomationId: z25.string().min(1),
+      branchId: z25.string().min(1).optional(),
+      expectedLastSavedAt: z25.string().optional(),
       operations: automationPatchOperationsSchema
     }),
     cli: {
+      branchContext: "optional",
       name: "apply-automation-patch",
       path: ["workbench", "patch", "apply"],
       description: "Apply semantic workbench patch operations through the versioned save path.",
@@ -16858,15 +17244,19 @@ mutation PreviewAutomationPatch(
     document: `# Apply semantic automation patch operations through the versioned save path.
 mutation ApplyAutomationPatch(
   $draftAutomationId: ID!
+  $branchId: ID
   $operations: [AutomationWorkbenchPatchOperationInput!]!
   $expectedLastSavedAt: String
 ) {
   applyAutomationPatch(
     draftAutomationId: $draftAutomationId
+    branchId: $branchId
     operations: $operations
     expectedLastSavedAt: $expectedLastSavedAt
   ) {
     draftAutomationId
+    branchId
+    headVersionId
     applied
     updateInput
     before {
@@ -16945,9 +17335,11 @@ mutation ApplyAutomationPatch(
     kind: "mutation",
     inputSchema: z25.object({
       id: z25.string().min(1),
+      branchId: z25.string().min(1).optional(),
       input: updateAutomationInputSchema
     }),
     cli: {
+      branchContext: "optional",
       name: "update-automation-by-id",
       path: ["automations", "update"],
       description: "Update an automation.",
@@ -16974,102 +17366,865 @@ mutation ApplyAutomationPatch(
 # config.storeSchema remains additive. Use removeStoreSchemaPaths to delete named properties (and combine it with config.storeSchema for an atomic rename), or replaceStoreSchema for an exact replacement. replaceStoreSchema cannot be combined with either of those fields.
 # Destructive Store schema changes are rejected when the final agent set still references a removed property. Rewrite those agent references in the same update or leave the property in place.
 # Returns only id and lastSavedAt for MCP tool simplicity
-mutation UpdateAutomationById($id: ID!, $input: UpdateAutomationInput!) {
-  updateAutomation(id: $id, input: $input) {
+mutation UpdateAutomationById($id: ID!, $branchId: ID, $input: UpdateAutomationInput!) {
+  updateAutomation(id: $id, branchId: $branchId, input: $input) {
     id
+    branchId
+    headVersionId
     lastSavedAt
   }
 }`
-  })
-];
-
-// src/program.ts
-import { Command as Command2, InvalidArgumentError as InvalidArgumentError2, Option as Option2 } from "commander";
-
-// src/api.ts
-import { z as z26 } from "zod";
-
-// src/version.ts
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-var packageManifestPath = path.resolve(
-  path.dirname(fileURLToPath(import.meta.url)),
-  "../package.json"
-);
-var packageManifestResult = safeJsonParse(
-  fs.readFileSync(packageManifestPath, "utf8")
-);
-if (isErr(packageManifestResult)) {
-  throw new Error(`Failed to parse ${packageManifestPath}.`, {
-    cause: packageManifestResult.error.cause
-  });
-}
-var cliPackageVersion = packageManifestResult.value.version;
-if (typeof cliPackageVersion !== "string" || cliPackageVersion.length === 0) {
-  throw new Error(`Expected a version in ${packageManifestPath}.`);
-}
-var CLI_VERSION = cliPackageVersion;
-
-// src/api.ts
-var OTTO_AUTHORIZATION_HEADER_NAME = "X-Otto-Authorization";
-var OTTO_AUTHORIZATION_ISSUER = "magical:otto";
-var workosOrganizationsResponseSchema = z26.object({
-  organizations: z26.array(
-    z26.object({
-      id: z26.string().min(1),
-      name: z26.string().min(1),
-      primaryDomain: z26.string().nullable().optional()
-    })
-  ),
-  success: z26.boolean()
-});
-var workosUserSchema = z26.object({
-  email: z26.string().nullable(),
-  id: z26.string().min(1)
-});
-var nangoIntegrationWireSchema = z26.object({
-  // eslint-disable-next-line @typescript-eslint/naming-convention -- mirrors Nango REST payload
-  unique_key: z26.string().min(1)
-}).passthrough().transform((data) => ({
-  ...data,
-  uniqueKey: data.unique_key
-}));
-var nangoIntegrationsResponseSchema = z26.array(nangoIntegrationWireSchema);
-var organizationAuthenticationSchema = z26.object({
-  id: z26.string().min(1),
-  type: z26.string().min(1),
-  connectionId: z26.string().nullable().optional(),
-  providerConfigKey: z26.string().nullable().optional(),
-  description: z26.string().nullable().optional(),
-  hostname: z26.string().nullable().optional()
-}).passthrough();
-var organizationAuthenticationsResponseSchema = z26.object({
-  authentications: z26.array(organizationAuthenticationSchema),
-  success: z26.boolean()
-});
-var graphQlResponseSchema = z26.object({
-  data: z26.record(z26.string(), z26.unknown()).optional(),
-  errors: z26.array(
-    z26.object({
-      message: z26.string().min(1)
-    })
-  ).optional()
-});
-var apiErrorResponseSchema = z26.object({
-  errors: z26.array(
-    z26.object({
-      message: z26.string().min(1)
-    })
-  ).optional(),
-  message: z26.string().min(1).optional()
-});
-function getApiErrorDetail(responseBody) {
-  const parsedResponse = apiErrorResponseSchema.safeParse(responseBody);
-  if (!parsedResponse.success) {
-    return null;
-  }
-  if (parsedResponse.data.message) {
+  }),
+  createOperationSpec({
+    operationName: "ListRegisteredEvals",
+    kind: "query",
+    inputSchema: z25.object({}),
+    cli: {
+      name: "list-registered-evals",
+      path: ["evals", "list"],
+      description: "List globally registered eval definitions.",
+      resultKey: "registeredEvals",
+      options: []
+    },
+    mcp: { fileName: "registeredEvals.graphql" },
+    scope: "global",
+    document: `# List globally registered eval definitions available to the authenticated caller
+query ListRegisteredEvals {
+  registeredEvals {
+${registeredEvalSelection}
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "GetRegisteredEval",
+    kind: "query",
+    inputSchema: z25.object({ slug: z25.string().min(1) }),
+    cli: {
+      name: "get-registered-eval",
+      path: ["evals", "get"],
+      description: "Get one globally registered eval definition.",
+      resultKey: "registeredEval",
+      options: [
+        stringOption({
+          description: "Registered eval slug.",
+          flagName: "slug",
+          inputKey: "slug",
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "registeredEval.graphql" },
+    scope: "global",
+    document: `# Get one globally registered eval definition by slug
+query GetRegisteredEval($slug: String!) {
+  registeredEval(slug: $slug) {
+${registeredEvalSelection}
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "TestRegisteredEval",
+    kind: "mutation",
+    inputSchema: z25.object({
+      input: jsonObjectSchema,
+      slug: z25.string().min(1)
+    }),
+    cli: {
+      name: "test-registered-eval",
+      path: ["evals", "test-run"],
+      description: "Execute one registered eval input and its scorers without persistence.",
+      resultKey: "testRegisteredEval",
+      options: [
+        stringOption({
+          description: "Registered eval slug.",
+          flagName: "slug",
+          inputKey: "slug",
+          required: true
+        }),
+        jsonOption({
+          description: "Concrete eval input object.",
+          flagName: "input-json",
+          inputKey: "input"
+        }),
+        stringOption({
+          clientOnly: true,
+          description: "Path to a JSON file containing the concrete input.",
+          flagName: "input-file",
+          inputKey: "inputFile"
+        })
+      ]
+    },
+    mcp: { fileName: "testRegisteredEval.graphql" },
+    scope: "global",
+    document: `# Execute exactly one registered eval input and its scorers without persistence or automatic retries
+# COMPLETE and FAILED execution outcomes are returned in the result body
+mutation TestRegisteredEval($slug: String!, $input: JSON!) {
+  testRegisteredEval(input: { slug: $slug, input: $input }) {
+    status
+    input
+    output
+    scores
+    error {
+      type
+      message
+    }
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "PlanRegisteredEvalRun",
+    kind: "query",
+    inputSchema: registeredEvalRunInputSchema,
+    cli: {
+      name: "plan-registered-eval-run",
+      path: ["evals", "plan-run"],
+      description: "Validate a registered eval run and calculate its exact trial count.",
+      resultKey: "planRegisteredEvalRun",
+      options: [
+        stringOption({
+          description: "Registered eval slug.",
+          flagName: "slug",
+          inputKey: "slug",
+          required: true
+        }),
+        jsonOption({
+          description: "Eval input choices keyed by registered input name.",
+          flagName: "input-json",
+          inputKey: "input"
+        }),
+        stringOption({
+          clientOnly: true,
+          description: "Path to a JSON file containing eval input choices.",
+          flagName: "input-file",
+          inputKey: "inputFile"
+        }),
+        stringOption({
+          description: "Optional persisted run name.",
+          flagName: "name",
+          inputKey: "name"
+        }),
+        stringOption({
+          description: "Optional persisted run description.",
+          flagName: "description",
+          inputKey: "description"
+        }),
+        stringArrayOption({
+          description: "Persisted run tags.",
+          flagName: "tags",
+          inputKey: "tags"
+        }),
+        numberOption({
+          description: "Maximum simultaneously executing trials.",
+          flagName: "max-concurrency",
+          inputKey: "maxConcurrency"
+        }),
+        numberOption({
+          description: "Number of times to repeat each input combination.",
+          flagName: "repeat-count",
+          inputKey: "repeatCount"
+        })
+      ]
+    },
+    mcp: { fileName: "planRegisteredEvalRun.graphql" },
+    scope: "global",
+    document: `# Validate the complete proposed run and return the exact trial count without persistence
+query PlanRegisteredEvalRun(
+  $slug: String!
+  $input: JSON!
+  $name: String
+  $description: String
+  $tags: [String!]
+  $maxConcurrency: Int
+  $repeatCount: Int
+) {
+  planRegisteredEvalRun(
+    input: {
+      slug: $slug
+      input: $input
+      name: $name
+      description: $description
+      tags: $tags
+      maxConcurrency: $maxConcurrency
+      repeatCount: $repeatCount
+    }
+  ) {
+    combinationCount
+    repeatCount
+    trialCount
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "StartRegisteredEvalRun",
+    kind: "mutation",
+    inputSchema: registeredEvalRunInputSchema.extend({
+      expectedTrialCount: z25.number().int().positive(),
+      idempotencyKey: z25.string().trim().min(1)
+    }),
+    cli: {
+      name: "start-registered-eval-run",
+      path: ["evals", "run"],
+      description: "Plan, confirm, and asynchronously start a registered eval run.",
+      resultKey: "startRegisteredEvalRun",
+      options: [
+        stringOption({
+          description: "Registered eval slug.",
+          flagName: "slug",
+          inputKey: "slug",
+          required: true
+        }),
+        jsonOption({
+          description: "Eval input choices keyed by registered input name.",
+          flagName: "input-json",
+          inputKey: "input"
+        }),
+        stringOption({
+          clientOnly: true,
+          description: "Path to a JSON file containing eval input choices.",
+          flagName: "input-file",
+          inputKey: "inputFile"
+        }),
+        stringOption({
+          description: "Optional persisted run name.",
+          flagName: "name",
+          inputKey: "name"
+        }),
+        stringOption({
+          description: "Optional persisted run description.",
+          flagName: "description",
+          inputKey: "description"
+        }),
+        stringArrayOption({
+          description: "Persisted run tags.",
+          flagName: "tags",
+          inputKey: "tags"
+        }),
+        numberOption({
+          description: "Maximum simultaneously executing trials.",
+          flagName: "max-concurrency",
+          inputKey: "maxConcurrency"
+        }),
+        numberOption({
+          description: "Number of times to repeat each input combination.",
+          flagName: "repeat-count",
+          inputKey: "repeatCount"
+        }),
+        stringOption({
+          description: "Idempotency key; generated by mgcl when omitted.",
+          flagName: "idempotency-key",
+          inputKey: "idempotencyKey"
+        }),
+        numberOption({
+          clientOnly: true,
+          description: "Explicitly acknowledge the planned trial count.",
+          flagName: "confirm-trials",
+          inputKey: "confirmTrials"
+        }),
+        booleanOption({
+          clientOnly: true,
+          description: "Wait until the persisted run reaches a terminal state.",
+          flagName: "wait",
+          inputKey: "wait"
+        })
+      ]
+    },
+    mcp: { fileName: "startRegisteredEvalRun.graphql" },
+    scope: "global",
+    document: `# Start a registered eval run after PlanRegisteredEvalRun has returned an exact count
+# MCP callers must provide a unique idempotencyKey and the planned expectedTrialCount
+mutation StartRegisteredEvalRun(
+  $slug: String!
+  $input: JSON!
+  $name: String
+  $description: String
+  $tags: [String!]
+  $maxConcurrency: Int
+  $repeatCount: Int
+  $idempotencyKey: String!
+  $expectedTrialCount: Int!
+) {
+  startRegisteredEvalRun(
+    input: {
+      slug: $slug
+      input: $input
+      name: $name
+      description: $description
+      tags: $tags
+      maxConcurrency: $maxConcurrency
+      repeatCount: $repeatCount
+      idempotencyKey: $idempotencyKey
+      expectedTrialCount: $expectedTrialCount
+    }
+  ) {
+    idempotencyKey
+    evalRunId
+    workflowId
+    workflowRunId
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "ListEvalRuns",
+    kind: "query",
+    inputSchema: z25.object({
+      page: z25.number().int().nonnegative().default(0),
+      pageSize: z25.number().int().min(1).max(100).default(20),
+      slug: z25.string().min(1).optional(),
+      status: evalRunStatusSchema.optional()
+    }),
+    cli: {
+      name: "list-eval-runs",
+      path: ["evals", "runs", "list"],
+      description: "List persisted eval runs with optional filters.",
+      resultKey: "evalRuns",
+      options: [
+        stringOption({
+          description: "Filter by registered eval slug.",
+          flagName: "slug",
+          inputKey: "slug"
+        }),
+        stringOption({
+          description: "Filter by eval run status.",
+          flagName: "status",
+          inputKey: "status"
+        }),
+        numberOption({
+          description: "Zero-based page number.",
+          flagName: "page",
+          inputKey: "page"
+        }),
+        numberOption({
+          description: "Page size from 1 to 100.",
+          flagName: "page-size",
+          inputKey: "pageSize"
+        })
+      ]
+    },
+    mcp: { fileName: "evalRuns.graphql" },
+    scope: "global",
+    document: `# List globally persisted eval runs with status counts and offset pagination
+query ListEvalRuns(
+  $slug: String
+  $status: EvalRunStatus
+  $page: Int
+  $pageSize: Int
+) {
+  evalRuns(slug: $slug, status: $status, page: $page, pageSize: $pageSize) {
+    items {
+${evalRunSelection}
+    }
+    total
+    page
+    pageSize
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "GetEvalRun",
+    kind: "query",
+    inputSchema: z25.object({ id: z25.string().min(1) }),
+    cli: {
+      name: "get-eval-run",
+      path: ["evals", "runs", "get"],
+      description: "Get one persisted eval run with current status counts.",
+      resultKey: "evalRun",
+      options: [
+        stringOption({
+          description: "Eval run ID.",
+          flagName: "id",
+          inputKey: "id",
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "evalRun.graphql" },
+    scope: "global",
+    document: `# Get one globally persisted eval run by ID
+query GetEvalRun($id: String!) {
+  evalRun(id: $id) {
+${evalRunSelection}
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "AwaitEvalRun",
+    kind: "query",
+    inputSchema: z25.object({
+      id: z25.string().min(1),
+      timeoutMs: z25.number().int().min(1e3).max(6e4).default(3e4)
+    }),
+    cli: {
+      name: "await-eval-run",
+      path: ["evals", "runs", "await"],
+      description: "Wait for an eval run by repeating bounded server long-polls.",
+      resultKey: "evalRunAwait",
+      options: [
+        stringOption({
+          description: "Eval run ID.",
+          flagName: "id",
+          inputKey: "id",
+          required: true
+        }),
+        stringOption({
+          clientOnly: true,
+          description: "Overall client wait timeout.",
+          flagName: "timeout",
+          inputKey: "timeout",
+          valueHint: "duration, for example 30s or 5m"
+        })
+      ]
+    },
+    mcp: { fileName: "evalRunAwait.graphql" },
+    scope: "global",
+    document: `# Wait up to 60 seconds for an eval run to reach COMPLETE, FAILED, or CANCELLED
+# Call again when reachedTerminal is false and a longer overall wait is needed
+query AwaitEvalRun($id: String!, $timeoutMs: Int) {
+  evalRunAwait(id: $id, timeoutMs: $timeoutMs) {
+    reachedTerminal
+    pollCount
+    elapsedMs
+    evalRun {
+${evalRunSelection}
+    }
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "ListEvalRunTrials",
+    kind: "query",
+    inputSchema: z25.object({
+      cursor: z25.string().min(1).optional(),
+      id: z25.string().min(1),
+      limit: z25.number().int().min(1).max(1e3).default(100)
+    }),
+    cli: {
+      name: "list-eval-run-trials",
+      path: ["evals", "runs", "trials"],
+      description: "List eval trials in deterministic cursor order.",
+      resultKey: "evalRunTrials",
+      options: [
+        stringOption({
+          description: "Eval run ID.",
+          flagName: "id",
+          inputKey: "id",
+          required: true
+        }),
+        numberOption({
+          description: "Maximum trials to return, from 1 to 1000.",
+          flagName: "limit",
+          inputKey: "limit"
+        }),
+        stringOption({
+          description: "Opaque cursor returned by the previous page.",
+          flagName: "cursor",
+          inputKey: "cursor"
+        })
+      ]
+    },
+    mcp: { fileName: "evalRunTrials.graphql" },
+    scope: "global",
+    document: `# List eval trials in ascending deterministic order with an opaque continuation cursor
+query ListEvalRunTrials($id: String!, $limit: Int, $cursor: String) {
+  evalRunTrials(id: $id, limit: $limit, cursor: $cursor) {
+    trials {
+      id
+      createdAt
+      updatedAt
+      evalRunId
+      repeatIndex
+      input
+      status
+      startedAt
+      finishedAt
+      scores
+      output
+      workflowId
+      workflowRunId
+    }
+    nextCursor
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "CancelEvalRun",
+    kind: "mutation",
+    inputSchema: z25.object({ id: z25.string().min(1) }),
+    cli: {
+      name: "cancel-eval-run",
+      path: ["evals", "runs", "cancel"],
+      description: "Request cancellation for a queued or running eval run.",
+      resultKey: "cancelEvalRun",
+      options: [
+        stringOption({
+          description: "Eval run ID.",
+          flagName: "id",
+          inputKey: "id",
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "cancelEvalRun.graphql" },
+    scope: "global",
+    document: `# Request cancellation without claiming the run has already reached CANCELLED
+mutation CancelEvalRun($id: String!) {
+  cancelEvalRun(id: $id) {
+    evalRunId
+    cancellationRequested
+    status
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "RequestEvalRunExport",
+    kind: "mutation",
+    inputSchema: z25.object({ id: z25.string().min(1) }),
+    cli: {
+      name: "request-eval-run-export",
+      path: ["evals", "runs", "export"],
+      description: "Request an asynchronous raw-results export.",
+      resultKey: "requestEvalRunExport",
+      options: [
+        stringOption({
+          description: "Eval run ID.",
+          flagName: "id",
+          inputKey: "id",
+          required: true
+        }),
+        stringOption({
+          clientOnly: true,
+          description: "Destination path for the completed export.",
+          flagName: "output",
+          inputKey: "output",
+          required: true
+        }),
+        booleanOption({
+          clientOnly: true,
+          description: "Wait for export completion and download the file.",
+          flagName: "wait",
+          inputKey: "wait"
+        }),
+        booleanOption({
+          clientOnly: true,
+          description: "Authorize replacement of an existing output file.",
+          flagName: "force",
+          inputKey: "force"
+        })
+      ]
+    },
+    mcp: { fileName: "requestEvalRunExport.graphql" },
+    scope: "global",
+    document: `# Request or reuse an asynchronous raw-results export for a terminal eval run
+mutation RequestEvalRunExport($id: String!) {
+  requestEvalRunExport(id: $id) {
+${evalRunExportSelection}
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "GetEvalRunExport",
+    kind: "query",
+    inputSchema: z25.object({ exportId: z25.string().min(1) }),
+    cli: {
+      hidden: true,
+      name: "get-eval-run-export",
+      path: ["evals", "runs", "export-status"],
+      description: "Get asynchronous eval export status by export ID.",
+      resultKey: "evalRunExport",
+      options: [
+        stringOption({
+          description: "Eval export ID.",
+          flagName: "export-id",
+          inputKey: "exportId",
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "evalRunExport.graphql" },
+    scope: "global",
+    document: `# Get asynchronous eval export status; downloadUrl is signed and only present when COMPLETE
+query GetEvalRunExport($exportId: String!) {
+  evalRunExport(exportId: $exportId) {
+${evalRunExportSelection}
+  }
+}`
+  })
+];
+
+// src/program.ts
+import { Command as Command2, InvalidArgumentError as InvalidArgumentError2, Option as Option2 } from "commander";
+
+// src/api.ts
+import { randomUUID } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import { access, link, rename, rm } from "node:fs/promises";
+import nodePath from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { z as z26 } from "zod";
+
+// src/version.ts
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+var packageManifestPath = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "../package.json"
+);
+var packageManifestResult = safeJsonParse(
+  fs.readFileSync(packageManifestPath, "utf8")
+);
+if (isErr(packageManifestResult)) {
+  throw new Error(`Failed to parse ${packageManifestPath}.`, {
+    cause: packageManifestResult.error.cause
+  });
+}
+var cliPackageVersion = packageManifestResult.value.version;
+if (typeof cliPackageVersion !== "string" || cliPackageVersion.length === 0) {
+  throw new Error(`Expected a version in ${packageManifestPath}.`);
+}
+var CLI_VERSION = cliPackageVersion;
+
+// src/api.ts
+var OTTO_AUTHORIZATION_HEADER_NAME = "X-Otto-Authorization";
+var OTTO_AUTHORIZATION_ISSUER = "magical:otto";
+var workosOrganizationsResponseSchema = z26.object({
+  organizations: z26.array(
+    z26.object({
+      id: z26.string().min(1),
+      name: z26.string().min(1),
+      primaryDomain: z26.string().nullable().optional()
+    })
+  ),
+  success: z26.boolean()
+});
+var workosUserSchema = z26.object({
+  email: z26.string().nullable(),
+  id: z26.string().min(1)
+});
+var nangoIntegrationWireSchema = z26.object({
+  // eslint-disable-next-line @typescript-eslint/naming-convention -- mirrors Nango REST payload
+  unique_key: z26.string().min(1)
+}).passthrough().transform((data) => ({
+  ...data,
+  uniqueKey: data.unique_key
+}));
+var nangoIntegrationsResponseSchema = z26.array(nangoIntegrationWireSchema);
+var organizationAuthenticationSchema = z26.object({
+  id: z26.string().min(1),
+  type: z26.string().min(1),
+  connectionId: z26.string().nullable().optional(),
+  providerConfigKey: z26.string().nullable().optional(),
+  description: z26.string().nullable().optional(),
+  hostname: z26.string().nullable().optional()
+}).passthrough();
+var organizationAuthenticationsResponseSchema = z26.object({
+  authentications: z26.array(organizationAuthenticationSchema),
+  success: z26.boolean()
+});
+var pathwayRegressionRunStatusSchema = z26.enum([
+  "queued",
+  "running",
+  "passed",
+  "failed",
+  "inconclusive",
+  "errored"
+]);
+var pathwayRegressionReplayIterationStatusSchema = z26.enum([
+  "running",
+  "passed",
+  "failed",
+  "inconclusive",
+  "errored"
+]);
+var pathwayRegressionMatchingRunSchema = z26.object({
+  agentRunId: z26.string().min(1),
+  agentVersionId: z26.string().min(1),
+  automationRunId: z26.string().min(1),
+  contractPathHash: z26.string().min(1),
+  finishedAt: z26.string().min(1),
+  signatureId: z26.string().min(1),
+  stepCount: z26.number().nullable()
+});
+var pathwayRegressionMatchingRunsPathSchema = z26.object({
+  contractPathId: z26.string().min(1),
+  executablePathHash: z26.string().min(1),
+  label: z26.string().min(1),
+  pathwayKey: z26.string().min(1),
+  runs: z26.array(pathwayRegressionMatchingRunSchema),
+  sortOrder: z26.number()
+});
+var pathwayRegressionMatchingRunsResponseSchema = z26.object({
+  agentVersionId: z26.string().min(1),
+  automationId: z26.string().min(1),
+  automationVersionId: z26.string().min(1),
+  contractId: z26.string().min(1),
+  paths: z26.array(pathwayRegressionMatchingRunsPathSchema)
+});
+var pathwayRegressionAgentVersionRunPathStatusSchema = z26.enum([
+  "historical_path_missing_after_change",
+  "missing_after_change",
+  "new_pathway",
+  "no_matching_runs",
+  "queued"
+]);
+var pathwayRegressionAgentVersionRunStatusSchema = z26.enum([
+  "queued",
+  "running",
+  "passed",
+  "failed",
+  "inconclusive",
+  "errored",
+  "contract_generation_queued",
+  "not_started"
+]);
+var pathwayRegressionAgentVersionRunPathSideSchema = z26.object({
+  contractPathId: z26.string().min(1),
+  executablePathHash: z26.string().min(1),
+  label: z26.string().min(1),
+  sortOrder: z26.number()
+});
+var pathwayRegressionAgentVersionRunPathSchema = z26.object({
+  baseline: pathwayRegressionAgentVersionRunPathSideSchema.nullable(),
+  candidate: pathwayRegressionAgentVersionRunPathSideSchema.nullable(),
+  isInLatestPublishedBaseline: z26.boolean().optional(),
+  lastSeenPublishedAgentVersionId: z26.string().min(1).optional(),
+  lastSeenPublishedAt: z26.string().min(1).nullable().optional(),
+  lastSeenPublishedAutomationVersionId: z26.string().min(1).optional(),
+  lastSeenPublishedSequence: z26.number().optional(),
+  pathwayKey: z26.string().min(1),
+  selectedRunCount: z26.number(),
+  status: pathwayRegressionAgentVersionRunPathStatusSchema
+});
+var pathwayRegressionContractGenerationStatusSchema = z26.enum([
+  "failed",
+  "queued",
+  "running",
+  "succeeded"
+]);
+var pathwayRegressionAgentVersionContractQueuedResponseSchema = z26.object({
+  agentVersionId: z26.string().min(1),
+  automationId: z26.string().min(1),
+  automationVersionId: z26.string().min(1),
+  contractGenerationStatus: pathwayRegressionContractGenerationStatusSchema,
+  contractWorkflowId: z26.string().min(1),
+  regressionRunId: z26.null(),
+  selectedReplayCount: z26.literal(0),
+  status: z26.literal("contract_generation_queued"),
+  workflowId: z26.null()
+});
+var pathwayRegressionAgentVersionRegressionRunResponseSchema = z26.object({
+  agentVersionId: z26.string().min(1),
+  automationId: z26.string().min(1),
+  automationVersionId: z26.string().min(1),
+  baselineAgentVersionId: z26.string().min(1),
+  baselineAutomationVersionId: z26.string().min(1),
+  baselineContractId: z26.string().min(1),
+  candidateContractId: z26.string().min(1),
+  contractId: z26.string().min(1),
+  paths: z26.array(pathwayRegressionAgentVersionRunPathSchema),
+  regressionRunId: z26.string().min(1).nullable(),
+  selectedReplayCount: z26.number(),
+  status: pathwayRegressionAgentVersionRunStatusSchema,
+  workflowId: z26.string().min(1).nullable()
+});
+var pathwayRegressionAgentVersionRunResponseSchema = z26.union([
+  pathwayRegressionAgentVersionContractQueuedResponseSchema,
+  pathwayRegressionAgentVersionRegressionRunResponseSchema
+]);
+var pathwayRegressionCheckSummarySchema = z26.object({
+  errored: z26.number(),
+  failed: z26.number(),
+  inconclusive: z26.number(),
+  passed: z26.number(),
+  total: z26.number()
+});
+var pathwayRegressionRunResultIterationSchema = z26.object({
+  baselineIterationId: z26.string().min(1),
+  createdAt: z26.string().min(1),
+  expectedToolName: z26.string().min(1),
+  id: z26.string().min(1),
+  observedToolName: z26.string().min(1).nullable(),
+  outputResult: z26.unknown().nullable(),
+  sequence: z26.number(),
+  status: pathwayRegressionReplayIterationStatusSchema,
+  updatedAt: z26.string().min(1)
+});
+var pathwayRegressionReplayCheckResultSchema = z26.object({
+  actualToolName: z26.string().min(1).nullable(),
+  attemptIndex: z26.number(),
+  createdAt: z26.string().min(1),
+  expectedActionAssessment: z26.unknown().nullable(),
+  expectedToolName: z26.string().min(1),
+  id: z26.string().min(1),
+  llmRequestId: z26.string().min(1).nullable(),
+  modelId: z26.string().min(1).nullable(),
+  outputResult: z26.unknown().nullable(),
+  status: z26.enum(["passed", "failed", "errored"]),
+  strictExactMatch: z26.boolean().nullable()
+});
+var pathwayRegressionReplayIterationCheckResultsResponseSchema = z26.object({
+  regressionReplayIteration: pathwayRegressionRunResultIterationSchema.extend({
+    checkResults: z26.array(pathwayRegressionReplayCheckResultSchema),
+    regressionReplayId: z26.string().min(1)
+  })
+});
+var pathwayRegressionRunResultReplaySchema = z26.object({
+  baselineAgentRunId: z26.string().min(1),
+  baselineAutomationRunId: z26.string().min(1),
+  checks: pathwayRegressionCheckSummarySchema,
+  createdAt: z26.string().min(1),
+  finishedAt: z26.string().min(1).nullable(),
+  id: z26.string().min(1),
+  iterations: z26.array(pathwayRegressionRunResultIterationSchema),
+  status: pathwayRegressionRunStatusSchema
+});
+var pathwayRegressionRunResultPathwaySchema = z26.object({
+  contractId: z26.string().min(1),
+  contractPathId: z26.string().min(1).nullable(),
+  label: z26.string().min(1).nullable(),
+  pathwayKey: z26.string().min(1),
+  replays: z26.array(pathwayRegressionRunResultReplaySchema),
+  sortOrder: z26.number().nullable()
+});
+var pathwayRegressionRunResultResponseSchema = z26.object({
+  pathways: z26.array(pathwayRegressionRunResultPathwaySchema),
+  regressionRun: z26.object({
+    automationId: z26.string().min(1),
+    candidateAgentVersionId: z26.string().min(1).nullable(),
+    candidateAutomationVersionId: z26.string().min(1),
+    createdAt: z26.string().min(1),
+    finishedAt: z26.string().min(1).nullable(),
+    id: z26.string().min(1),
+    scope: z26.enum(["single_run", "contract_batch", "automation_version"]),
+    status: pathwayRegressionRunStatusSchema,
+    workflowId: z26.string().min(1)
+  })
+});
+var graphQlResponseSchema = z26.object({
+  data: z26.record(z26.string(), z26.unknown()).nullable().optional(),
+  errors: z26.array(
+    z26.object({
+      extensions: z26.object({
+        code: z26.string().min(1).optional()
+      }).passthrough().optional(),
+      message: z26.string().min(1)
+    })
+  ).optional()
+});
+var apiErrorResponseSchema = z26.object({
+  errors: z26.array(
+    z26.object({
+      message: z26.string().min(1)
+    })
+  ).optional(),
+  message: z26.string().min(1).optional()
+});
+function getApiErrorDetail(responseBody) {
+  const parsedResponse = apiErrorResponseSchema.safeParse(responseBody);
+  if (!parsedResponse.success) {
+    return null;
+  }
+  if (parsedResponse.data.message) {
     return parsedResponse.data.message;
   }
   if (!parsedResponse.data.errors || parsedResponse.data.errors.length === 0) {
@@ -17077,9 +18232,57 @@ function getApiErrorDetail(responseBody) {
   }
   return parsedResponse.data.errors.map((error) => error.message).join("\n");
 }
+var DEFINITIVE_GRAPHQL_APPLICATION_ERROR_CODES = /* @__PURE__ */ new Set([
+  "BAD_REQUEST",
+  "BAD_USER_INPUT",
+  "FORBIDDEN",
+  "GRAPHQL_PARSE_FAILED",
+  "GRAPHQL_VALIDATION_FAILED",
+  "NOT_FOUND",
+  "OPERATION_RESOLUTION_FAILURE",
+  "PERSISTED_QUERY_NOT_FOUND",
+  "PERSISTED_QUERY_NOT_SUPPORTED",
+  "UNAUTHORIZED"
+]);
+var GraphQlResponseError = class extends CliError {
+  graphQlCodes;
+  hasUnclassifiedGraphQlErrors;
+  constructor(message, {
+    graphQlCodes,
+    hasUnclassifiedGraphQlErrors = false
+  }) {
+    super(message);
+    this.name = "GraphQlResponseError";
+    this.graphQlCodes = [...graphQlCodes];
+    this.hasUnclassifiedGraphQlErrors = hasUnclassifiedGraphQlErrors;
+  }
+};
+function isDefinitiveGraphQlApplicationError(error) {
+  return error instanceof GraphQlResponseError && !error.hasUnclassifiedGraphQlErrors && error.graphQlCodes.length > 0 && error.graphQlCodes.every(
+    (code) => DEFINITIVE_GRAPHQL_APPLICATION_ERROR_CODES.has(code)
+  );
+}
 function trimTrailingSlash(value) {
   return value.replace(/\/+$/u, "");
 }
+function isFileAlreadyExistsError(error) {
+  return error instanceof Error && "code" in error && error.code === "EEXIST";
+}
+async function assertOutputDoesNotExist(outputPath) {
+  const outputExists = await access(outputPath).then(() => true).catch((error) => {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return false;
+    }
+    throw new CliError(`Failed to inspect export path "${outputPath}".`, {
+      cause: error
+    });
+  });
+  if (outputExists) {
+    throw new CliError(
+      `Refusing to overwrite existing file "${outputPath}". Pass --force to authorize replacement.`
+    );
+  }
+}
 function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -17099,6 +18302,23 @@ function decodeJwtPayload(token) {
 function isOttoAuthorizationToken(token) {
   return decodeJwtPayload(token)?.["iss"] === OTTO_AUTHORIZATION_ISSUER;
 }
+function buildPathwayRegressionAgentVersionPath({
+  agentVersionId,
+  automationVersionId,
+  leafPath,
+  runsPerPath
+}) {
+  const path9 = `/pathway-regression/automation-versions/${encodeURIComponent(
+    automationVersionId
+  )}/agent-versions/${encodeURIComponent(agentVersionId)}/${leafPath}`;
+  if (runsPerPath === void 0) {
+    return path9;
+  }
+  const queryParams = new URLSearchParams({
+    runsPerPath: String(runsPerPath)
+  });
+  return `${path9}?${queryParams.toString()}`;
+}
 function applyAuthenticationHeaders({
   accessToken,
   allowOttoAuthorization,
@@ -17133,11 +18353,11 @@ function createMagicalApiClient({
     accessToken,
     impersonatedOrganizationId,
     allowOttoAuthorization,
-    path: path8,
+    path: path9,
     init,
     organizationId
   }) {
-    const url = `${trimTrailingSlash(await resolveApiBaseUrl())}${path8}`;
+    const url = `${trimTrailingSlash(await resolveApiBaseUrl())}${path9}`;
     const headers = new Headers(init?.headers);
     applyAuthenticationHeaders({
       accessToken,
@@ -17182,6 +18402,51 @@ function createMagicalApiClient({
     return responseBody;
   }
   return {
+    async downloadFile({ outputPath, overwrite = false, url }) {
+      if (!overwrite) {
+        await assertOutputDoesNotExist(outputPath);
+      }
+      const temporaryPath = nodePath.join(
+        nodePath.dirname(outputPath),
+        `.${nodePath.basename(outputPath)}.${randomUUID()}.tmp`
+      );
+      await (async () => {
+        const response = await fetchFn(url).catch((error) => {
+          throw new CliError("Failed to download eval export.", {
+            cause: error
+          });
+        });
+        if (!response.ok) {
+          throw new CliError(
+            `Eval export download failed with status ${response.status}.`
+          );
+        }
+        if (!response.body) {
+          throw new CliError("Eval export download returned an empty body.");
+        }
+        await pipeline(
+          Readable.fromWeb(response.body),
+          createWriteStream(temporaryPath, { flags: "wx" })
+        );
+        if (overwrite) {
+          await rename(temporaryPath, outputPath);
+          return;
+        }
+        await link(temporaryPath, outputPath).catch((error) => {
+          if (isFileAlreadyExistsError(error)) {
+            throw new CliError(
+              `Refusing to overwrite existing file "${outputPath}". Pass --force to authorize replacement.`,
+              { cause: error }
+            );
+          }
+          throw error;
+        });
+        await rm(temporaryPath, { force: true });
+      })().catch(async (error) => {
+        await rm(temporaryPath, { force: true });
+        throw error;
+      });
+    },
     async executeGraphQl({
       accessToken,
       impersonatedOrganizationId,
@@ -17213,8 +18478,15 @@ function createMagicalApiClient({
         throw new CliError("GraphQL response payload was invalid.");
       }
       if (parsedResponse.data.errors && parsedResponse.data.errors.length > 0) {
-        throw new CliError(
-          parsedResponse.data.errors.map((error) => error.message).join("\n")
+        const graphQlCodes = parsedResponse.data.errors.flatMap(
+          (error) => error.extensions?.code ? [error.extensions.code] : []
+        );
+        throw new GraphQlResponseError(
+          parsedResponse.data.errors.map((error) => error.message).join("\n"),
+          {
+            graphQlCodes,
+            hasUnclassifiedGraphQlErrors: graphQlCodes.length !== parsedResponse.data.errors.length
+          }
         );
       }
       return parsedResponse.data.data?.[resultKey] ?? null;
@@ -17287,6 +18559,111 @@ function createMagicalApiClient({
         throw new CliError("Organization authentications payload was invalid.");
       }
       return parsedResponse.data.authentications;
+    },
+    async previewPathwayRegressionMatchingRuns({
+      accessToken,
+      agentVersionId,
+      automationVersionId,
+      impersonatedOrganizationId,
+      organizationId,
+      runsPerPath
+    }) {
+      const parsedResponse = pathwayRegressionMatchingRunsResponseSchema.safeParse(
+        await fetchJson({
+          accessToken,
+          allowOttoAuthorization: true,
+          ...impersonatedOrganizationId ? { impersonatedOrganizationId } : {},
+          ...organizationId ? { organizationId } : {},
+          path: buildPathwayRegressionAgentVersionPath({
+            agentVersionId,
+            automationVersionId,
+            leafPath: "matching-runs",
+            ...runsPerPath === void 0 ? {} : { runsPerPath }
+          })
+        })
+      );
+      if (!parsedResponse.success) {
+        throw new CliError(
+          "Pathway regression matching-runs payload was invalid."
+        );
+      }
+      return parsedResponse.data;
+    },
+    async startPathwayRegressionAgentVersionRun({
+      accessToken,
+      agentVersionId,
+      automationVersionId,
+      impersonatedOrganizationId,
+      organizationId,
+      runsPerPath
+    }) {
+      const parsedResponse = pathwayRegressionAgentVersionRunResponseSchema.safeParse(
+        await fetchJson({
+          accessToken,
+          allowOttoAuthorization: true,
+          ...impersonatedOrganizationId ? { impersonatedOrganizationId } : {},
+          ...organizationId ? { organizationId } : {},
+          path: buildPathwayRegressionAgentVersionPath({
+            agentVersionId,
+            automationVersionId,
+            leafPath: "run",
+            ...runsPerPath === void 0 ? {} : { runsPerPath }
+          }),
+          init: {
+            method: "POST"
+          }
+        })
+      );
+      if (!parsedResponse.success) {
+        throw new CliError("Pathway regression kickoff payload was invalid.");
+      }
+      return parsedResponse.data;
+    },
+    async getPathwayRegressionRunResult({
+      accessToken,
+      impersonatedOrganizationId,
+      organizationId,
+      regressionRunId
+    }) {
+      const parsedResponse = pathwayRegressionRunResultResponseSchema.safeParse(
+        await fetchJson({
+          accessToken,
+          allowOttoAuthorization: true,
+          ...impersonatedOrganizationId ? { impersonatedOrganizationId } : {},
+          ...organizationId ? { organizationId } : {},
+          path: `/pathway-regression/runs/${encodeURIComponent(
+            regressionRunId
+          )}`
+        })
+      );
+      if (!parsedResponse.success) {
+        throw new CliError("Pathway regression run payload was invalid.");
+      }
+      return parsedResponse.data;
+    },
+    async getPathwayRegressionReplayIterationCheckResults({
+      accessToken,
+      impersonatedOrganizationId,
+      organizationId,
+      regressionReplayIterationId
+    }) {
+      const parsedResponse = pathwayRegressionReplayIterationCheckResultsResponseSchema.safeParse(
+        await fetchJson({
+          accessToken,
+          allowOttoAuthorization: true,
+          ...impersonatedOrganizationId ? { impersonatedOrganizationId } : {},
+          ...organizationId ? { organizationId } : {},
+          path: `/pathway-regression/replay-iterations/${encodeURIComponent(
+            regressionReplayIterationId
+          )}/check-results`
+        })
+      );
+      if (!parsedResponse.success) {
+        throw new CliError(
+          "Pathway regression replay iteration check-results payload was invalid."
+        );
+      }
+      return parsedResponse.data;
     }
   };
 }
@@ -17372,7 +18749,7 @@ function requireWorkosClientId(config) {
 }
 
 // src/settings.ts
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rm as rm2, writeFile } from "node:fs/promises";
 import path3 from "node:path";
 import { z as z27 } from "zod";
 var cliSettingsSchema = z27.object({
@@ -17431,7 +18808,7 @@ function createFileSettingsStore(stateFilePath) {
     },
     async save(settings) {
       if (!hasCliSettingsOverrides(settings)) {
-        await rm(settingsFilePath, { force: true });
+        await rm2(settingsFilePath, { force: true });
         return;
       }
       await mkdir(path3.dirname(settingsFilePath), { recursive: true });
@@ -17520,6 +18897,7 @@ var rootOperationalGroupDescriptions = /* @__PURE__ */ new Map([
   ["automations", "Manage automations."],
   ["automation-runs", "Inspect and control automation runs."],
   ["catalog", "Inspect available commands, models, and tools."],
+  ["evals", "Discover registered evals and manage eval runs."],
   ["graphql", "Inspect GraphQL metadata."],
   ["skills", "Inspect and update root-level Workplace skills."]
 ]);
@@ -17529,29 +18907,525 @@ function configureCommandPresentation(command) {
   command.createHelp = () => new MagicalHelp();
   return command;
 }
-function createOperationHelpExamples(operationSpec) {
-  const baseCommand = `mgcl ${operationSpec.cli.path.join(" ")}`;
-  const requiredOptions = operationSpec.cli.options.filter((optionSpec) => optionSpec.required).map((optionSpec) => {
-    if (optionSpec.valueType === "boolean") {
-      return `--${optionSpec.flagName}`;
+function createOperationHelpExamples(operationSpec) {
+  const commandPath = operationSpec.cli.path.join(" ");
+  const baseCommand = operationSpec.cli.branchContext === "required" ? `mgcl --branch-id <branch-id> ${commandPath}` : `mgcl ${commandPath}`;
+  const requiredOptions = operationSpec.cli.options.filter((optionSpec) => optionSpec.required).map((optionSpec) => {
+    if (optionSpec.valueType === "boolean") {
+      return `--${optionSpec.flagName}`;
+    }
+    if (optionSpec.valueType === "number") {
+      return `--${optionSpec.flagName} 10`;
+    }
+    if (optionSpec.valueType === "json") {
+      return `--${optionSpec.flagName} '{...}'`;
+    }
+    if (optionSpec.valueType === "string-array") {
+      return `--${optionSpec.flagName} value-a,value-b`;
+    }
+    return `--${optionSpec.flagName} <${optionSpec.flagName}>`;
+  });
+  const baseInvocation = [baseCommand, ...requiredOptions].join(" ");
+  return [
+    baseInvocation,
+    ...operationSpec.scope === "global" ? [] : [`${baseInvocation} --org <org>`],
+    `${baseInvocation} --json`,
+    ...operationSpec.cli.branchContext === "optional" ? [
+      [
+        "mgcl --branch-id <branch-id>",
+        commandPath,
+        ...requiredOptions,
+        "--json"
+      ].join(" ")
+    ] : []
+  ];
+}
+
+// src/eval-commands.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { access as access2, readFile as readFile2 } from "node:fs/promises";
+import path4 from "node:path";
+import { createInterface } from "node:readline/promises";
+import { z as z28 } from "zod";
+var MAX_AWAIT_REQUEST_MS = 6e4;
+var MIN_AWAIT_REQUEST_MS = 1e3;
+var EXPORT_POLL_INTERVAL_MS = 1e3;
+var evalRunStatusSchema2 = z28.enum([
+  "QUEUED",
+  "RUNNING",
+  "COMPLETE",
+  "FAILED",
+  "CANCELLED"
+]);
+var awaitResultSchema = z28.object({
+  elapsedMs: z28.number().nonnegative(),
+  evalRun: z28.object({
+    id: z28.string().min(1),
+    status: evalRunStatusSchema2
+  }).passthrough(),
+  pollCount: z28.number().int().nonnegative(),
+  reachedTerminal: z28.boolean()
+}).passthrough();
+var planResultSchema = z28.object({ trialCount: z28.number().int().nonnegative() }).passthrough();
+var startResultSchema = z28.object({
+  evalRunId: z28.string().min(1),
+  idempotencyKey: z28.string().min(1),
+  workflowId: z28.string().min(1),
+  workflowRunId: z28.string().min(1)
+}).passthrough();
+var exportResultSchema = z28.object({
+  downloadUrl: z28.string().min(1).nullable().optional(),
+  evalRunId: z28.string().min(1),
+  exportId: z28.string().min(1),
+  status: z28.enum(["QUEUED", "RUNNING", "COMPLETE", "FAILED"])
+}).passthrough();
+var inputOptionsSchema = z28.object({
+  inputFile: z28.string().min(1).optional(),
+  inputJson: z28.unknown().optional()
+});
+var commonRunOptionsSchema = inputOptionsSchema.extend({
+  description: z28.string().min(1).optional(),
+  maxConcurrency: z28.number().int().positive().optional(),
+  name: z28.string().min(1).optional(),
+  repeatCount: z28.number().int().positive().optional(),
+  slug: z28.string().min(1),
+  tags: z28.array(z28.string().min(1)).optional()
+});
+function parseApiResult(value, schema, label) {
+  const parsedResult = schema.safeParse(value);
+  if (!parsedResult.success) {
+    throw new CliError(`${label} returned an invalid response.`);
+  }
+  return parsedResult.data;
+}
+async function parseInputFile({
+  inputFile,
+  workingDirectory
+}) {
+  const inputPath = path4.resolve(workingDirectory, inputFile);
+  const contents = await readFile2(inputPath, "utf8").catch(
+    (error) => {
+      throw new CliError(`Failed to read eval input file "${inputPath}".`, {
+        cause: error
+      });
+    }
+  );
+  const parsedJson = safeJsonParseWithoutLogging(contents);
+  if (isErr(parsedJson)) {
+    throw new CliError(
+      `Eval input file "${inputPath}" must contain valid JSON.`,
+      { cause: parsedJson.error }
+    );
+  }
+  return parsedJson.value;
+}
+async function resolveEvalInput({
+  inputFile,
+  inputJson,
+  workingDirectory
+}) {
+  const inputSourceCount = Number(inputFile !== void 0) + Number(inputJson !== void 0);
+  if (inputSourceCount !== 1) {
+    throw new CliError(
+      "Pass exactly one of --input-file or --input-json for eval input."
+    );
+  }
+  const input = inputFile === void 0 ? inputJson : await parseInputFile({ inputFile, workingDirectory });
+  const parsedInput = z28.record(z28.string(), z28.unknown()).safeParse(input);
+  if (!parsedInput.success) {
+    throw new CliError("Eval input must be a JSON object.");
+  }
+  return parsedInput.data;
+}
+async function resolveEvalInputFromOptions({
+  inputFile,
+  inputJson,
+  workingDirectory
+}) {
+  return await resolveEvalInput({
+    ...inputFile === void 0 ? {} : { inputFile },
+    ...inputJson === void 0 ? {} : { inputJson },
+    workingDirectory
+  });
+}
+function buildCommonRunVariables({
+  input,
+  options
+}) {
+  return {
+    input,
+    slug: options.slug,
+    ...options.description === void 0 ? {} : { description: options.description },
+    ...options.maxConcurrency === void 0 ? {} : { maxConcurrency: options.maxConcurrency },
+    ...options.name === void 0 ? {} : { name: options.name },
+    ...options.repeatCount === void 0 ? {} : { repeatCount: options.repeatCount },
+    ...options.tags === void 0 ? {} : { tags: options.tags }
+  };
+}
+function parseDurationMs(value) {
+  const match = /^(?<amount>\d+(?:\.\d+)?)(?<unit>ms|s|m|h)$/iu.exec(
+    value.trim()
+  );
+  const amount = Number(match?.groups?.["amount"]);
+  const multiplierByUnit = { h: 36e5, m: 6e4, ms: 1, s: 1e3 };
+  const parsedUnit = z28.enum(["h", "m", "ms", "s"]).safeParse(match?.groups?.["unit"]?.toLowerCase());
+  const durationMs = parsedUnit.success ? amount * multiplierByUnit[parsedUnit.data] : Number.NaN;
+  if (!Number.isSafeInteger(durationMs) || durationMs < MIN_AWAIT_REQUEST_MS) {
+    throw new CliError(
+      "Expected --timeout to be a duration of at least 1s, such as 30s, 5m, or 1h."
+    );
+  }
+  return durationMs;
+}
+function quotePosixShellArgument(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+async function defaultConfirm(question) {
+  const prompt = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  const answer = await prompt.question(`${question} [y/N] `).finally(() => {
+    prompt.close();
+  });
+  return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
+}
+function terminalExitError(result) {
+  const { id, status } = result.evalRun;
+  if (status === "FAILED" || status === "CANCELLED") {
+    return new CliError(`Eval run "${id}" finished with status ${status}.`);
+  }
+  return void 0;
+}
+async function awaitEvalRun({
+  evalRunId,
+  executeOperation,
+  now: now2,
+  timeoutMs
+}) {
+  const deadline = timeoutMs === void 0 ? void 0 : now2() + timeoutMs;
+  let previousResult = void 0;
+  for (; ; ) {
+    const remainingMs = deadline === void 0 ? void 0 : deadline - now2();
+    if (remainingMs !== void 0 && remainingMs < MIN_AWAIT_REQUEST_MS) {
+      return {
+        exitError: new CliError(
+          `Timed out waiting for eval run "${evalRunId}".`
+        ),
+        result: previousResult ?? {
+          elapsedMs: timeoutMs ?? 0,
+          evalRun: { id: evalRunId, status: "QUEUED" },
+          pollCount: 0,
+          reachedTerminal: false
+        }
+      };
+    }
+    const requestTimeoutMs = Math.min(
+      MAX_AWAIT_REQUEST_MS,
+      remainingMs ?? MAX_AWAIT_REQUEST_MS
+    );
+    const result = parseApiResult(
+      // eslint-disable-next-line no-await-in-loop -- each long-poll must finish before the next bounded request begins
+      await executeOperation("AwaitEvalRun", {
+        id: evalRunId,
+        timeoutMs: requestTimeoutMs
+      }),
+      awaitResultSchema,
+      "Eval run await"
+    );
+    if (result.reachedTerminal) {
+      const exitError = terminalExitError(result);
+      return { ...exitError ? { exitError } : {}, result };
+    }
+    previousResult = result;
+  }
+}
+async function assertExportOutputAvailable({
+  force,
+  outputPath
+}) {
+  if (force) {
+    return;
+  }
+  const exists = await access2(outputPath).then(() => true).catch((error) => {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return false;
+    }
+    throw new CliError(`Failed to inspect export path "${outputPath}".`, {
+      cause: error
+    });
+  });
+  if (exists) {
+    throw new CliError(
+      `Refusing to overwrite existing file "${outputPath}". Pass --force to authorize replacement.`
+    );
+  }
+}
+async function finishExport({
+  downloadFile,
+  exportResult,
+  force,
+  outputPath
+}) {
+  if (exportResult.status === "FAILED") {
+    return {
+      exitError: new CliError(`Eval export "${exportResult.exportId}" failed.`),
+      result: exportResult
+    };
+  }
+  if (exportResult.status !== "COMPLETE") {
+    return { result: exportResult };
+  }
+  if (!exportResult.downloadUrl) {
+    throw new CliError(
+      `Completed eval export "${exportResult.exportId}" did not include a download URL.`
+    );
+  }
+  if (!downloadFile) {
+    throw new CliError("Eval export download is not configured.");
+  }
+  await downloadFile({
+    outputPath,
+    overwrite: force,
+    url: exportResult.downloadUrl
+  });
+  const { downloadUrl: _downloadUrl, ...downloadedExport } = exportResult;
+  return { result: { ...downloadedExport, outputPath } };
+}
+async function pollExport({
+  executeOperation,
+  exportId,
+  sleep
+}) {
+  for (; ; ) {
+    await sleep(EXPORT_POLL_INTERVAL_MS);
+    const result = parseApiResult(
+      // eslint-disable-next-line no-await-in-loop -- do not overlap signed-export status requests
+      await executeOperation("GetEvalRunExport", { exportId }),
+      exportResultSchema,
+      "Eval export status"
+    );
+    if (result.status !== "QUEUED" && result.status !== "RUNNING") {
+      return result;
+    }
+  }
+}
+async function executeTestRegisteredEval({
+  executeOperation,
+  options,
+  workingDirectory
+}) {
+  const parsedOptions = commonRunOptionsSchema.pick({ slug: true }).merge(inputOptionsSchema).parse(options);
+  const input = await resolveEvalInputFromOptions({
+    ...parsedOptions,
+    workingDirectory
+  });
+  return {
+    result: await executeOperation("TestRegisteredEval", {
+      input,
+      slug: parsedOptions.slug
+    })
+  };
+}
+async function executePlanRegisteredEvalRun({
+  executeOperation,
+  options,
+  workingDirectory
+}) {
+  const parsedOptions = commonRunOptionsSchema.parse(options);
+  const input = await resolveEvalInputFromOptions({
+    ...parsedOptions,
+    workingDirectory
+  });
+  return {
+    result: await executeOperation(
+      "PlanRegisteredEvalRun",
+      buildCommonRunVariables({ input, options: parsedOptions })
+    )
+  };
+}
+async function confirmPlannedTrialCount({
+  confirm,
+  confirmedTrialCount,
+  isInteractive,
+  json,
+  trialCount
+}) {
+  if (confirmedTrialCount !== void 0) {
+    if (confirmedTrialCount !== trialCount) {
+      throw new CliError(
+        `Planned ${trialCount} trials, but --confirm-trials was ${confirmedTrialCount}.`
+      );
+    }
+    return;
+  }
+  if (json || !isInteractive) {
+    throw new CliError(
+      `This run will start ${trialCount} trials. Pass --confirm-trials ${trialCount} in non-interactive mode.`
+    );
+  }
+  const confirmed = await confirm(`Start ${trialCount} eval trials?`);
+  if (confirmed) {
+    return;
+  }
+  throw new CliError("Eval run cancelled before starting.");
+}
+async function executeStartRegisteredEvalRun({
+  executeOperation,
+  options,
+  runtime,
+  workingDirectory
+}) {
+  const parsedOptions = commonRunOptionsSchema.extend({
+    confirmTrials: z28.number().int().positive().optional(),
+    idempotencyKey: z28.string().trim().min(1).optional(),
+    json: z28.boolean().optional(),
+    wait: z28.boolean().optional()
+  }).parse(options);
+  const input = await resolveEvalInputFromOptions({
+    ...parsedOptions,
+    workingDirectory
+  });
+  const commonVariables = buildCommonRunVariables({
+    input,
+    options: parsedOptions
+  });
+  const plan = parseApiResult(
+    await executeOperation("PlanRegisteredEvalRun", commonVariables),
+    planResultSchema,
+    "Eval run plan"
+  );
+  await confirmPlannedTrialCount({
+    confirm: runtime.confirm ?? defaultConfirm,
+    ...parsedOptions.confirmTrials === void 0 ? {} : { confirmedTrialCount: parsedOptions.confirmTrials },
+    isInteractive: runtime.isInteractive?.() ?? (process.stdin.isTTY && process.stdout.isTTY),
+    json: parsedOptions.json === true,
+    trialCount: plan.trialCount
+  });
+  const idempotencyKey = parsedOptions.idempotencyKey ?? `mgcl-eval-${(runtime.randomUuid ?? randomUUID2)()}`;
+  const start = await executeOperation("StartRegisteredEvalRun", {
+    ...commonVariables,
+    expectedTrialCount: plan.trialCount,
+    idempotencyKey
+  }).catch((error) => {
+    if (isDefinitiveGraphQlApplicationError(error)) {
+      throw error;
+    }
+    throw new CliError(
+      `${getErrorMessage(error)}
+If execution was accepted, retry with --idempotency-key ${quotePosixShellArgument(idempotencyKey)} to resolve the request safely.`,
+      { cause: error }
+    );
+  });
+  const parsedStart = parseApiResult(
+    start,
+    startResultSchema,
+    "Eval run start"
+  );
+  if (parsedOptions.wait !== true) {
+    return { result: parsedStart };
+  }
+  const awaited = await awaitEvalRun({
+    evalRunId: parsedStart.evalRunId,
+    executeOperation,
+    now: runtime.now ?? Date.now
+  });
+  return {
+    ...awaited.exitError ? { exitError: awaited.exitError } : {},
+    result: { ...parsedStart, await: awaited.result }
+  };
+}
+async function executeAwaitEvalRun({
+  executeOperation,
+  options,
+  runtime
+}) {
+  const parsedOptions = z28.object({ id: z28.string().min(1), timeout: z28.string().optional() }).parse(options);
+  return await awaitEvalRun({
+    evalRunId: parsedOptions.id,
+    executeOperation,
+    now: runtime.now ?? Date.now,
+    ...parsedOptions.timeout ? { timeoutMs: parseDurationMs(parsedOptions.timeout) } : {}
+  });
+}
+async function defaultSleep(milliseconds) {
+  await new Promise((resolve) => {
+    setTimeout(resolve, milliseconds);
+  });
+}
+async function executeRequestEvalRunExport({
+  executeOperation,
+  options,
+  runtime,
+  workingDirectory
+}) {
+  const parsedOptions = z28.object({
+    force: z28.boolean().optional(),
+    id: z28.string().min(1),
+    output: z28.string().min(1),
+    wait: z28.boolean().optional()
+  }).parse(options);
+  const outputPath = path4.resolve(workingDirectory, parsedOptions.output);
+  const force = parsedOptions.force === true;
+  const shouldWait = parsedOptions.wait === true;
+  if (shouldWait) {
+    await assertExportOutputAvailable({ force, outputPath });
+  }
+  const requestedExport = parseApiResult(
+    await executeOperation("RequestEvalRunExport", { id: parsedOptions.id }),
+    exportResultSchema,
+    "Eval export request"
+  );
+  if (!shouldWait) {
+    return { result: requestedExport };
+  }
+  const exportResult = requestedExport.status === "QUEUED" || requestedExport.status === "RUNNING" ? await pollExport({
+    executeOperation,
+    exportId: requestedExport.exportId,
+    sleep: runtime.sleep ?? defaultSleep
+  }) : requestedExport;
+  if (exportResult.status === "QUEUED" || exportResult.status === "RUNNING") {
+    return { result: exportResult };
+  }
+  return await finishExport({
+    ...runtime.downloadFile ? { downloadFile: runtime.downloadFile } : {},
+    exportResult,
+    force,
+    outputPath
+  });
+}
+async function executeEvalCliOperation({
+  executeOperation,
+  operationName,
+  options,
+  runtime = {}
+}) {
+  const handlerInput = {
+    executeOperation,
+    options,
+    runtime,
+    workingDirectory: runtime.workingDirectory ?? process.cwd()
+  };
+  switch (operationName) {
+    case "TestRegisteredEval": {
+      return await executeTestRegisteredEval(handlerInput);
     }
-    if (optionSpec.valueType === "number") {
-      return `--${optionSpec.flagName} 10`;
+    case "PlanRegisteredEvalRun": {
+      return await executePlanRegisteredEvalRun(handlerInput);
     }
-    if (optionSpec.valueType === "json") {
-      return `--${optionSpec.flagName} '{...}'`;
+    case "StartRegisteredEvalRun": {
+      return await executeStartRegisteredEvalRun(handlerInput);
     }
-    if (optionSpec.valueType === "string-array") {
-      return `--${optionSpec.flagName} value-a,value-b`;
+    case "AwaitEvalRun": {
+      return await executeAwaitEvalRun(handlerInput);
     }
-    return `--${optionSpec.flagName} <${optionSpec.flagName}>`;
-  });
-  const baseInvocation = [baseCommand, ...requiredOptions].join(" ");
-  return [
-    baseInvocation,
-    `${baseInvocation} --org <org>`,
-    `${baseInvocation} --json`
-  ];
+    case "RequestEvalRunExport": {
+      return await executeRequestEvalRunExport(handlerInput);
+    }
+    default: {
+      return null;
+    }
+  }
 }
 
 // src/keychain.ts
@@ -17620,7 +19494,7 @@ function resolveOpenCommand(url) {
 }
 
 // src/program-session.ts
-import { readFile as readFile2, rm as rm2 } from "node:fs/promises";
+import { readFile as readFile3, rm as rm3 } from "node:fs/promises";
 async function withOrgScopedAccessToken({
   dependencies,
   organizationId,
@@ -17633,6 +19507,35 @@ async function withOrgScopedAccessToken({
   if (directAccessToken) {
     return { accessToken: directAccessToken };
   }
+  return await refreshAccessToken({
+    dependencies,
+    organizationId,
+    state
+  });
+}
+async function withGlobalAccessToken({
+  authenticationOrganizationId,
+  dependencies,
+  state
+}) {
+  const directAccessToken = await loadDirectAccessToken({
+    dependencies,
+    organizationId: authenticationOrganizationId
+  });
+  if (directAccessToken) {
+    return { accessToken: directAccessToken };
+  }
+  return await refreshAccessToken({
+    dependencies,
+    organizationId: authenticationOrganizationId,
+    state
+  });
+}
+async function refreshAccessToken({
+  dependencies,
+  organizationId,
+  state
+}) {
   const refreshToken = await dependencies.refreshTokenStore.load(state.account);
   if (!refreshToken) {
     throw new CliError(
@@ -17664,7 +19567,7 @@ async function clearDirectAccessToken(runtimeConfig) {
   if (!runtimeConfig.accessTokenFilePath) {
     return;
   }
-  await rm2(runtimeConfig.accessTokenFilePath, { force: true });
+  await rm3(runtimeConfig.accessTokenFilePath, { force: true });
 }
 async function loadDirectAccessToken({
   dependencies,
@@ -17674,7 +19577,7 @@ async function loadDirectAccessToken({
   if (!accessTokenFilePath) {
     return null;
   }
-  const accessTokenFileContents = await readFile2(accessTokenFilePath, "utf8").then((value) => value.trim()).catch((error) => {
+  const accessTokenFileContents = await readFile3(accessTokenFilePath, "utf8").then((value) => value.trim()).catch((error) => {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
     }
@@ -17701,7 +19604,7 @@ async function loadDirectAccessToken({
     }
     return null;
   }
-  if (claims.org_id && claims.org_id !== organizationId) {
+  if (organizationId !== void 0 && claims.org_id && claims.org_id !== organizationId) {
     throw new CliError(
       `The current Otto session is authenticated for organization "${claims.org_id}", not "${organizationId}". Start a new Otto session from the desired organization.`
     );
@@ -17718,7 +19621,7 @@ function isExpiredAccessTokenClaims(claims) {
 // src/self-update.ts
 import { spawn as spawn2 } from "node:child_process";
 import fs2 from "node:fs";
-import path4 from "node:path";
+import path5 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var CLI_PACKAGE_NAME = "@getmagical/cli";
 var DEFAULT_CLI_DIST_TAG2 = "latest";
@@ -17729,9 +19632,9 @@ function resolveInstalledPackageRoot({
   packageName
 }) {
   const packagePathSegments = packageName.split("/");
-  let currentPath = path4.dirname(entryFilePath);
+  let currentPath = path5.dirname(entryFilePath);
   for (; ; ) {
-    const currentPathSegments = currentPath.split(path4.sep).filter(Boolean);
+    const currentPathSegments = currentPath.split(path5.sep).filter(Boolean);
     const currentPackageSegments = currentPathSegments.slice(
       -packagePathSegments.length
     );
@@ -17740,7 +19643,7 @@ function resolveInstalledPackageRoot({
     )) {
       return currentPath;
     }
-    const parentPath = path4.dirname(currentPath);
+    const parentPath = path5.dirname(currentPath);
     if (parentPath === currentPath) {
       return null;
     }
@@ -17750,14 +19653,14 @@ function resolveInstalledPackageRoot({
 function resolveInstallPrefixFromPackageRoot(packageRootPath) {
   let currentPath = packageRootPath;
   for (; ; ) {
-    if (path4.basename(currentPath) === "node_modules") {
-      const nodeModulesParentPath = path4.dirname(currentPath);
-      if (path4.basename(nodeModulesParentPath) === "lib") {
-        return path4.dirname(nodeModulesParentPath);
+    if (path5.basename(currentPath) === "node_modules") {
+      const nodeModulesParentPath = path5.dirname(currentPath);
+      if (path5.basename(nodeModulesParentPath) === "lib") {
+        return path5.dirname(nodeModulesParentPath);
       }
       return nodeModulesParentPath;
     }
-    const parentPath = path4.dirname(currentPath);
+    const parentPath = path5.dirname(currentPath);
     if (parentPath === currentPath) {
       return null;
     }
@@ -17774,13 +19677,13 @@ function resolveManagedNpmCommand(installPrefix) {
   if (process.platform === "win32") {
     return null;
   }
-  const managedNodeExecutable = path4.join(
+  const managedNodeExecutable = path5.join(
     installPrefix,
     MANAGED_NODE_SUBPATH,
     "bin",
     "node"
   );
-  const managedNpmCli = path4.join(
+  const managedNpmCli = path5.join(
     installPrefix,
     MANAGED_NODE_SUBPATH,
     "lib",
@@ -17979,20 +19882,20 @@ ${formatExamples("Examples", [
 
 // src/skills-working-copy.ts
 import { execFile } from "node:child_process";
-import { createHash, randomUUID } from "node:crypto";
+import { createHash, randomUUID as randomUUID3 } from "node:crypto";
 import {
   lstat,
   mkdir as mkdir2,
   mkdtemp,
-  readFile as readFile3,
+  readFile as readFile4,
   readdir,
-  rename,
-  rm as rm3,
+  rename as rename2,
+  rm as rm4,
   writeFile as writeFile2
 } from "node:fs/promises";
 import os2 from "node:os";
-import path5 from "node:path";
-import { z as z28 } from "zod";
+import path6 from "node:path";
+import { z as z29 } from "zod";
 var SKILLS_ROOT_PATH = "skills";
 var METADATA_DIRECTORY_NAME = "skill-working-copies";
 var MAX_GIT_OUTPUT_BYTES = 10 * 1024 * 1024;
@@ -18001,40 +19904,40 @@ var FULL_COMMIT_SHA_PATTERN = /^[\dA-Fa-f]{40}$/u;
 var UTF8_ENCODER = new TextEncoder();
 var WINDOWS_RESERVED_PATH_CHARACTER_PATTERN = /[<>:"|?*]/u;
 var WINDOWS_RESERVED_PATH_NAME_PATTERN = /^(?:AUX|CON|NUL|PRN|COM[1-9]|LPT[1-9])(?:\..*)?$/iu;
-var skillBundleSchema = z28.object({
-  files: z28.array(
-    z28.object({
-      content: z28.string(),
-      encoding: z28.literal("base64"),
-      path: z28.string().min(1),
-      size: z28.number().int().nonnegative()
+var skillBundleSchema = z29.object({
+  files: z29.array(
+    z29.object({
+      content: z29.string(),
+      encoding: z29.literal("base64"),
+      path: z29.string().min(1),
+      size: z29.number().int().nonnegative()
     })
   ),
-  path: z28.string().min(1),
-  ref: z28.string().regex(FULL_COMMIT_SHA_PATTERN)
+  path: z29.string().min(1),
+  ref: z29.string().regex(FULL_COMMIT_SHA_PATTERN)
 });
-var skillsApplyPatchResultSchema = z28.object({
-  changedFiles: z28.array(
-    z28.object({ path: z28.string().min(1), status: z28.string().min(1) })
+var skillsApplyPatchResultSchema = z29.object({
+  changedFiles: z29.array(
+    z29.object({ path: z29.string().min(1), status: z29.string().min(1) })
   ),
-  commit: z28.string().regex(FULL_COMMIT_SHA_PATTERN),
-  ok: z28.boolean(),
-  ref: z28.string().min(1)
+  commit: z29.string().regex(FULL_COMMIT_SHA_PATTERN),
+  ok: z29.boolean(),
+  ref: z29.string().min(1)
 }).refine((result) => result.ok, {
   message: "Skills patch result was not successful."
 });
-var workingCopyMetadataSchema = z28.object({
-  version: z28.literal(1),
-  files: z28.array(
-    z28.object({
-      content: z28.string(),
-      path: z28.string().min(1)
+var workingCopyMetadataSchema = z29.object({
+  version: z29.literal(1),
+  files: z29.array(
+    z29.object({
+      content: z29.string(),
+      path: z29.string().min(1)
     })
   ),
-  organizationId: z28.string().min(1),
-  requestedRef: z28.string().min(1).nullable(),
-  skillPath: z28.string().min(1),
-  workingCopyPath: z28.string().min(1)
+  organizationId: z29.string().min(1),
+  requestedRef: z29.string().min(1).nullable(),
+  skillPath: z29.string().min(1),
+  workingCopyPath: z29.string().min(1)
 });
 function hasControlCharacter2(value) {
   return UTF8_ENCODER.encode(value).some((byte) => byte <= 31 || byte === 127);
@@ -18062,12 +19965,12 @@ function normalizeRootSkillPath(skill) {
   return `${SKILLS_ROOT_PATH}/${skillName}`;
 }
 function resolveWorkingCopyPath(workingDirectory, skillPath) {
-  return path5.resolve(workingDirectory, ...skillPath.split("/"));
+  return path6.resolve(workingDirectory, ...skillPath.split("/"));
 }
 function resolveMetadataPath(stateFilePath, workingCopyPath) {
   const key = createHash("sha256").update(workingCopyPath).digest("hex");
-  return path5.join(
-    path5.dirname(stateFilePath),
+  return path6.join(
+    path6.dirname(stateFilePath),
     METADATA_DIRECTORY_NAME,
     `${key}.json`
   );
@@ -18095,7 +19998,7 @@ function metadataFilesToSnapshot(files) {
   );
 }
 async function loadMetadata(metadataPath) {
-  const fileContents = await readFile3(metadataPath, "utf8").catch(
+  const fileContents = await readFile4(metadataPath, "utf8").catch(
     (error) => {
       if (isMissingFileError(error)) {
         return null;
@@ -18119,13 +20022,13 @@ async function loadMetadata(metadataPath) {
   return parsed.data;
 }
 async function saveMetadata(metadataPath, metadata) {
-  await mkdir2(path5.dirname(metadataPath), { recursive: true });
-  const temporaryPath = `${metadataPath}.${randomUUID()}.tmp`;
+  await mkdir2(path6.dirname(metadataPath), { recursive: true });
+  const temporaryPath = `${metadataPath}.${randomUUID3()}.tmp`;
   await writeFile2(temporaryPath, `${JSON.stringify(metadata, null, 2)}
 `, {
     mode: 384
   });
-  await rename(temporaryPath, metadataPath);
+  await rename2(temporaryPath, metadataPath);
 }
 function assertSafeRelativeFilePath(relativePath) {
   const segments = relativePath.split("/");
@@ -18196,7 +20099,7 @@ async function readDirectorySnapshot({
         const nextSegments = [...segments, entry.name];
         const relativePath = nextSegments.join("/");
         assertSafeRelativeFilePath(relativePath);
-        const filePath = path5.join(currentDirectory, entry.name);
+        const filePath = path6.join(currentDirectory, entry.name);
         if (entry.isDirectory()) {
           return await visit(filePath, nextSegments);
         }
@@ -18205,7 +20108,7 @@ async function readDirectorySnapshot({
             `Skill working copy contains unsupported entry "${filePath}". Only regular files and directories are allowed.`
           );
         }
-        return [[`${skillPath}/${relativePath}`, await readFile3(filePath)]];
+        return [[`${skillPath}/${relativePath}`, await readFile4(filePath)]];
       })
     );
     return nestedEntries.flat();
@@ -18231,8 +20134,8 @@ async function writeSnapshotContents(rootPath, snapshot, prefix) {
     [...snapshot.entries()].map(async ([filePath, content]) => {
       const relativePath = prefix === null ? filePath : filePath.slice(`${prefix}/`.length);
       assertSafeRelativeFilePath(relativePath);
-      const targetPath = path5.join(rootPath, ...relativePath.split("/"));
-      await mkdir2(path5.dirname(targetPath), { recursive: true });
+      const targetPath = path6.join(rootPath, ...relativePath.split("/"));
+      await mkdir2(path6.dirname(targetPath), { recursive: true });
       await writeFile2(targetPath, content);
     })
   );
@@ -18242,42 +20145,42 @@ async function replaceWorkingCopy({
   skillPath,
   workingCopyPath
 }) {
-  const parentPath = path5.dirname(workingCopyPath);
+  const parentPath = path6.dirname(workingCopyPath);
   await mkdir2(parentPath, { recursive: true });
-  const temporaryPath = path5.join(
+  const temporaryPath = path6.join(
     parentPath,
-    `.mgcl-${path5.basename(workingCopyPath)}-${randomUUID()}.tmp`
+    `.mgcl-${path6.basename(workingCopyPath)}-${randomUUID3()}.tmp`
   );
-  const backupPath = `${workingCopyPath}.${randomUUID()}.bak`;
+  const backupPath = `${workingCopyPath}.${randomUUID3()}.bak`;
   await mkdir2(temporaryPath);
   const prepareResult = await fromThrowable(async () => {
     await writeSnapshotContents(temporaryPath, snapshot, skillPath);
     const hadExistingWorkingCopy = await pathExists(workingCopyPath);
     if (hadExistingWorkingCopy) {
-      await rename(workingCopyPath, backupPath);
+      await rename2(workingCopyPath, backupPath);
     }
     return hadExistingWorkingCopy;
   }, "skills-working-copy-replace-failed");
   if (isErr(prepareResult)) {
-    await rm3(temporaryPath, { force: true, recursive: true });
+    await rm4(temporaryPath, { force: true, recursive: true });
     throw new CliError("Failed to replace the skill working copy.", {
       cause: prepareResult.error.cause
     });
   }
   const activationResult = await fromThrowable(async () => {
-    await rename(temporaryPath, workingCopyPath);
+    await rename2(temporaryPath, workingCopyPath);
   }, "skills-working-copy-activation-failed");
   if (isErr(activationResult)) {
     if (prepareResult.value) {
-      await rename(backupPath, workingCopyPath);
+      await rename2(backupPath, workingCopyPath);
     }
-    await rm3(temporaryPath, { force: true, recursive: true });
+    await rm4(temporaryPath, { force: true, recursive: true });
     throw new CliError("Failed to activate the new skill working copy.", {
       cause: activationResult.error.cause
     });
   }
   if (prepareResult.value) {
-    await rm3(backupPath, { force: true, recursive: true });
+    await rm4(backupPath, { force: true, recursive: true });
   }
 }
 async function runGit(arguments_, cwd, allowedExitCodes = [0]) {
@@ -18317,7 +20220,7 @@ async function clearDirectoryExceptGit(directoryPath) {
   const entries = await readdir(directoryPath);
   await Promise.all(
     entries.filter((entry) => entry !== ".git").map(async (entry) => {
-      await rm3(path5.join(directoryPath, entry), {
+      await rm4(path6.join(directoryPath, entry), {
         force: true,
         recursive: true
       });
@@ -18329,7 +20232,7 @@ async function createPatch(before, after) {
     return "";
   }
   const repositoryPath = await mkdtemp(
-    path5.join(os2.tmpdir(), "mgcl-skills-diff-")
+    path6.join(os2.tmpdir(), "mgcl-skills-diff-")
   );
   const patchResult = await fromThrowable(async () => {
     await runGit(["init", "--quiet"], repositoryPath);
@@ -18372,7 +20275,7 @@ async function createPatch(before, after) {
     );
     return result.stdout.toString("utf8");
   }, "skills-patch-generation-failed");
-  await rm3(repositoryPath, { force: true, recursive: true });
+  await rm4(repositoryPath, { force: true, recursive: true });
   if (isErr(patchResult)) {
     throw patchResult.error.cause;
   }
@@ -18580,7 +20483,7 @@ async function pushSkillWorkingCopy({
   assertTextPatch(patchContents);
   const applyResult = await fromThrowable(
     async () => await context.api.applyPatch({
-      idempotencyKey: `mgcl-skills-${randomUUID()}`,
+      idempotencyKey: `mgcl-skills-${randomUUID3()}`,
       message: message ?? `Update ${workingCopy.skillPath} via mgcl`,
       patch: patchContents
     }),
@@ -18651,34 +20554,34 @@ async function pushSkillWorkingCopy({
 }
 
 // src/state.ts
-import { mkdir as mkdir3, readFile as readFile4, rm as rm4, writeFile as writeFile3 } from "node:fs/promises";
-import path6 from "node:path";
-import { z as z29 } from "zod";
-var cliAccountSchema = z29.object({
-  clientId: z29.string().min(1),
-  email: z29.string().nullable(),
-  userId: z29.string().min(1)
+import { mkdir as mkdir3, readFile as readFile5, rm as rm5, writeFile as writeFile3 } from "node:fs/promises";
+import path7 from "node:path";
+import { z as z30 } from "zod";
+var cliAccountSchema = z30.object({
+  clientId: z30.string().min(1),
+  email: z30.string().nullable(),
+  userId: z30.string().min(1)
 });
-var cliOrganizationSchema = z29.object({
-  id: z29.string().min(1),
-  name: z29.string().min(1),
-  primaryDomain: z29.string().nullable().default(null)
+var cliOrganizationSchema = z30.object({
+  id: z30.string().min(1),
+  name: z30.string().min(1),
+  primaryDomain: z30.string().nullable().default(null)
 });
-var cliStateSchema = z29.object({
+var cliStateSchema = z30.object({
   account: cliAccountSchema,
-  defaultOrgId: z29.string().nullable(),
-  lastUsedOrgId: z29.string().nullable(),
-  organizations: z29.array(cliOrganizationSchema)
+  defaultOrgId: z30.string().nullable(),
+  lastUsedOrgId: z30.string().nullable(),
+  organizations: z30.array(cliOrganizationSchema)
 });
-var refreshTokenFileSchema = z29.record(z29.string(), z29.string());
+var refreshTokenFileSchema = z30.record(z30.string(), z30.string());
 function createFileStateStore(stateFilePath) {
   return {
     async clear() {
-      await rm4(stateFilePath, { force: true });
+      await rm5(stateFilePath, { force: true });
     },
     async load() {
       try {
-        const fileContents = await readFile4(stateFilePath, "utf8");
+        const fileContents = await readFile5(stateFilePath, "utf8");
         const parsed = cliStateSchema.safeParse(JSON.parse(fileContents));
         if (!parsed.success) {
           throw new CliError("Stored CLI state is invalid.");
@@ -18695,7 +20598,7 @@ function createFileStateStore(stateFilePath) {
       }
     },
     async save(state) {
-      await mkdir3(path6.dirname(stateFilePath), { recursive: true });
+      await mkdir3(path7.dirname(stateFilePath), { recursive: true });
       await writeFile3(stateFilePath, `${JSON.stringify(state, null, 2)}
 `);
     }
@@ -18704,7 +20607,7 @@ function createFileStateStore(stateFilePath) {
 function createFileRefreshTokenStore(refreshTokenFilePath) {
   async function loadRefreshTokens() {
     try {
-      const fileContents = await readFile4(refreshTokenFilePath, "utf8");
+      const fileContents = await readFile5(refreshTokenFilePath, "utf8");
       const parsed = refreshTokenFileSchema.safeParse(JSON.parse(fileContents));
       if (!parsed.success) {
         throw new CliError("Stored refresh tokens are invalid.");
@@ -18723,7 +20626,7 @@ function createFileRefreshTokenStore(refreshTokenFilePath) {
     }
   }
   async function saveRefreshTokens(refreshTokens) {
-    await mkdir3(path6.dirname(refreshTokenFilePath), { recursive: true });
+    await mkdir3(path7.dirname(refreshTokenFilePath), { recursive: true });
     await writeFile3(
       refreshTokenFilePath,
       `${JSON.stringify(refreshTokens, null, 2)}
@@ -18740,7 +20643,7 @@ function createFileRefreshTokenStore(refreshTokenFilePath) {
         )
       );
       if (Object.keys(nextRefreshTokens).length === 0) {
-        await rm4(refreshTokenFilePath, { force: true });
+        await rm5(refreshTokenFilePath, { force: true });
         return;
       }
       await saveRefreshTokens(nextRefreshTokens);
@@ -18761,37 +20664,37 @@ function buildRefreshTokenKey(account) {
 }
 
 // src/workos-auth.ts
-import { z as z30 } from "zod";
+import { z as z31 } from "zod";
 var DEFAULT_DEVICE_POLL_INTERVAL_SECONDS = 5;
 function buildFormHeaders() {
   const headers = new Headers();
   headers.set("content-type", "application/x-www-form-urlencoded");
   return headers;
 }
-var deviceAuthorizationSchema = z30.object({
-  device_code: z30.string().min(1),
-  expires_in: z30.number().int().positive().optional(),
-  interval: z30.number().int().positive().optional(),
-  user_code: z30.string().min(1),
-  verification_uri: z30.url(),
-  verification_uri_complete: z30.url().optional()
+var deviceAuthorizationSchema = z31.object({
+  device_code: z31.string().min(1),
+  expires_in: z31.number().int().positive().optional(),
+  interval: z31.number().int().positive().optional(),
+  user_code: z31.string().min(1),
+  verification_uri: z31.url(),
+  verification_uri_complete: z31.url().optional()
 });
-var tokenResponseSchema = z30.object({
-  access_token: z30.string().min(1),
-  expires_in: z30.number().int().positive().optional(),
-  refresh_token: z30.string().min(1),
-  token_type: z30.string().optional()
+var tokenResponseSchema = z31.object({
+  access_token: z31.string().min(1),
+  expires_in: z31.number().int().positive().optional(),
+  refresh_token: z31.string().min(1),
+  token_type: z31.string().optional()
 });
-var tokenErrorSchema = z30.object({
-  error: z30.string().min(1),
-  error_description: z30.string().optional()
+var tokenErrorSchema = z31.object({
+  error: z31.string().min(1),
+  error_description: z31.string().optional()
 });
-var accessTokenClaimsSchema = z30.object({
-  exp: z30.number().int().positive().optional(),
-  iss: z30.string().min(1).optional(),
-  org_id: z30.string().min(1).optional(),
-  sid: z30.string().min(1).optional(),
-  sub: z30.string().min(1)
+var accessTokenClaimsSchema = z31.object({
+  exp: z31.number().int().positive().optional(),
+  iss: z31.string().min(1).optional(),
+  org_id: z31.string().min(1).optional(),
+  sid: z31.string().min(1).optional(),
+  sub: z31.string().min(1)
 });
 function createWorkosAuthClient({
   fetchFn = fetch,
@@ -18934,6 +20837,7 @@ function createWorkosAuthClient({
 }
 
 // src/program.ts
+var commandBranchContexts = /* @__PURE__ */ new WeakMap();
 function buildCommandOptionProperty(flagName) {
   const [firstSegment, ...remainingSegments] = flagName.split("-");
   return [
@@ -18990,6 +20894,13 @@ function createCliCommanderOption(optionSpec, helpGroup) {
   }
   return nextOption;
 }
+function parsePositiveIntegerOption(rawValue) {
+  const parsedValue = Number(rawValue);
+  if (!Number.isInteger(parsedValue) || parsedValue < 1) {
+    throw new InvalidArgumentError2("Expected a positive integer.");
+  }
+  return parsedValue;
+}
 function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -19044,6 +20955,9 @@ function requireApiClientMethod(apiClient, key) {
 function collectOperationVariables(operationSpec, options) {
   const variables = Object.fromEntries(
     operationSpec.cli.options.flatMap((optionSpec) => {
+      if (optionSpec.clientOnly) {
+        return [];
+      }
       const optionValue = options[buildCommandOptionProperty(optionSpec.flagName)];
       if (optionValue === void 0) {
         return [];
@@ -19051,6 +20965,13 @@ function collectOperationVariables(operationSpec, options) {
       return [[optionSpec.inputKey, optionValue]];
     })
   );
+  const { branchId } = options;
+  if (operationSpec.cli.branchContext !== void 0 && typeof branchId === "string") {
+    variables["branchId"] = branchId;
+  }
+  return parseOperationVariables(operationSpec, variables);
+}
+function parseOperationVariables(operationSpec, variables) {
   const parsedVariables = operationSpec.inputSchema.safeParse(variables);
   if (!parsedVariables.success) {
     throw new CliError(
@@ -19130,6 +21051,14 @@ async function handleSelfUpdate(dependencies, options) {
   );
 }
 async function handleOperationCommand(dependencies, operationSpec, commandOptions) {
+  if (operationSpec.scope === "global") {
+    await handleGlobalOperationCommand(
+      dependencies,
+      operationSpec,
+      commandOptions
+    );
+    return;
+  }
   const { accessToken, impersonatedOrganizationId, organization, state } = await withSelectedOrganizationAndAccessToken({
     dependencies,
     options: commandOptions
@@ -19153,16 +21082,89 @@ async function handleOperationCommand(dependencies, operationSpec, commandOption
   }
   dependencies.io.info(formatHumanReadableOutput(result));
 }
-function getSkillsOperation(operationName) {
+function getOperation(operationName) {
   const operationSpec = operationSpecs.find(
     (candidate) => candidate.operationName === operationName
   );
   if (!operationSpec) {
+    throw new CliError(`Operation "${operationName}" is not registered.`);
+  }
+  return operationSpec;
+}
+async function withGlobalOperationAccessToken({
+  dependencies
+}) {
+  const state = requireLoggedInState(await dependencies.stateStore.load());
+  const directAccessTokenOrganizationId = await resolveDirectAccessTokenOrganizationId({ dependencies });
+  const authenticationOrganizationId = directAccessTokenOrganizationId ?? state.defaultOrgId ?? state.lastUsedOrgId ?? state.organizations[0]?.id;
+  if (!authenticationOrganizationId) {
     throw new CliError(
-      `Skills operation "${operationName}" is not registered.`
+      'No organization is available for authentication. Run "mgcl auth login" again.'
     );
   }
-  return operationSpec;
+  const { accessToken } = await withGlobalAccessToken({
+    authenticationOrganizationId,
+    dependencies,
+    state
+  });
+  const usesOttoAuthorization = (() => {
+    try {
+      return dependencies.authClient.decodeAccessTokenClaims(accessToken).iss === "magical:otto";
+    } catch {
+      return false;
+    }
+  })();
+  return {
+    accessToken,
+    ...usesOttoAuthorization ? { organizationId: authenticationOrganizationId } : {}
+  };
+}
+async function handleGlobalOperationCommand(dependencies, operationSpec, commandOptions) {
+  const { accessToken, organizationId } = await withGlobalOperationAccessToken({
+    dependencies
+  });
+  const executeOperation = async (operationName, variables) => {
+    const nextOperationSpec = getOperation(operationName);
+    if (nextOperationSpec.scope !== "global") {
+      throw new CliError(
+        `Global operation "${operationName}" cannot execute an organization-scoped operation.`
+      );
+    }
+    return await dependencies.apiClient.executeGraphQl({
+      accessToken,
+      ...organizationId ? { organizationId } : {},
+      query: nextOperationSpec.document,
+      resultKey: nextOperationSpec.cli.resultKey,
+      variables: parseOperationVariables(nextOperationSpec, variables)
+    });
+  };
+  const customResult = await executeEvalCliOperation({
+    executeOperation,
+    operationName: operationSpec.operationName,
+    options: commandOptions,
+    runtime: {
+      ...dependencies.evalCommandRuntime,
+      ...dependencies.apiClient.downloadFile ? { downloadFile: dependencies.apiClient.downloadFile } : {},
+      workingDirectory: dependencies.evalCommandRuntime?.workingDirectory ?? dependencies.workingDirectory ?? process.cwd()
+    }
+  });
+  const commandResult = customResult ?? {
+    result: await executeOperation(
+      operationSpec.operationName,
+      collectOperationVariables(operationSpec, commandOptions)
+    )
+  };
+  writeCommandOutput({
+    dependencies,
+    json: commandOptions.json,
+    result: commandResult.result
+  });
+  if (commandResult.exitError) {
+    throw commandResult.exitError;
+  }
+}
+function getSkillsOperation(operationName) {
+  return getOperation(operationName);
 }
 async function withSkillsWorkingCopyContext(dependencies, options) {
   const { accessToken, impersonatedOrganizationId, organization, state } = await withSelectedOrganizationAndAccessToken({ dependencies, options });
@@ -19413,6 +21415,217 @@ async function handleNangoAuthsListCommand(dependencies, options) {
     result: authentications
   });
 }
+function summarizePathwayRegressionPreview(result) {
+  return {
+    automationVersionId: result.automationVersionId,
+    agentVersionId: result.agentVersionId,
+    contractId: result.contractId,
+    pathwayCount: result.paths.length,
+    selectedReplayCount: result.paths.reduce(
+      (sum, pathway) => sum + pathway.runs.length,
+      0
+    ),
+    paths: result.paths.map((pathway) => ({
+      sortOrder: pathway.sortOrder,
+      label: pathway.label,
+      pathwayKey: pathway.pathwayKey,
+      matchingRunCount: pathway.runs.length,
+      runs: pathway.runs.map((run) => ({
+        agentRunId: run.agentRunId,
+        automationRunId: run.automationRunId,
+        finishedAt: run.finishedAt,
+        stepCount: run.stepCount
+      }))
+    }))
+  };
+}
+function summarizePathwayRegressionKickoff(result) {
+  if ("contractWorkflowId" in result) {
+    return {
+      status: result.status,
+      contractGenerationStatus: result.contractGenerationStatus,
+      contractWorkflowId: result.contractWorkflowId,
+      regressionRunId: result.regressionRunId,
+      workflowId: result.workflowId,
+      selectedReplayCount: result.selectedReplayCount,
+      automationVersionId: result.automationVersionId,
+      agentVersionId: result.agentVersionId
+    };
+  }
+  return {
+    regressionRunId: result.regressionRunId,
+    workflowId: result.workflowId,
+    status: result.status,
+    selectedReplayCount: result.selectedReplayCount,
+    automationVersionId: result.automationVersionId,
+    agentVersionId: result.agentVersionId,
+    contractId: result.contractId,
+    baselineAutomationVersionId: result.baselineAutomationVersionId,
+    baselineAgentVersionId: result.baselineAgentVersionId,
+    baselineContractId: result.baselineContractId,
+    candidateContractId: result.candidateContractId,
+    paths: result.paths.map((pathway) => ({
+      sortOrder: pathway.candidate?.sortOrder ?? pathway.baseline?.sortOrder ?? null,
+      baselineLabel: pathway.baseline?.label ?? null,
+      candidateLabel: pathway.candidate?.label ?? null,
+      pathwayKey: pathway.pathwayKey,
+      selectedRunCount: pathway.selectedRunCount,
+      status: pathway.status,
+      isInLatestPublishedBaseline: pathway.isInLatestPublishedBaseline ?? null,
+      lastSeenPublishedAutomationVersionId: pathway.lastSeenPublishedAutomationVersionId ?? null,
+      lastSeenPublishedAgentVersionId: pathway.lastSeenPublishedAgentVersionId ?? null,
+      lastSeenPublishedSequence: pathway.lastSeenPublishedSequence ?? null
+    }))
+  };
+}
+function summarizePathwayRegressionResult(result) {
+  const replayCount = result.pathways.reduce(
+    (sum, pathway) => sum + pathway.replays.length,
+    0
+  );
+  return {
+    regressionRunId: result.regressionRun.id,
+    workflowId: result.regressionRun.workflowId,
+    scope: result.regressionRun.scope,
+    status: result.regressionRun.status,
+    finishedAt: result.regressionRun.finishedAt,
+    pathwayCount: result.pathways.length,
+    replayCount,
+    pathways: result.pathways.map((pathway) => ({
+      sortOrder: pathway.sortOrder,
+      label: pathway.label ?? pathway.pathwayKey,
+      pathwayKey: pathway.pathwayKey,
+      replays: pathway.replays.map((replay) => ({
+        regressionReplayId: replay.id,
+        baselineAgentRunId: replay.baselineAgentRunId,
+        baselineAutomationRunId: replay.baselineAutomationRunId,
+        status: replay.status,
+        checks: replay.checks,
+        nonPassingIterations: replay.iterations.filter((iteration) => iteration.status !== "passed").map((iteration) => ({
+          regressionReplayIterationId: iteration.id,
+          sequence: iteration.sequence,
+          status: iteration.status,
+          expectedToolName: iteration.expectedToolName,
+          observedToolName: iteration.observedToolName
+        }))
+      }))
+    }))
+  };
+}
+function summarizePathwayRegressionReplayIterationCheckResults(result) {
+  const { regressionReplayIteration } = result;
+  return {
+    regressionReplayId: regressionReplayIteration.regressionReplayId,
+    regressionReplayIterationId: regressionReplayIteration.id,
+    sequence: regressionReplayIteration.sequence,
+    status: regressionReplayIteration.status,
+    expectedToolName: regressionReplayIteration.expectedToolName,
+    observedToolName: regressionReplayIteration.observedToolName,
+    checkCount: regressionReplayIteration.checkResults.length,
+    checks: regressionReplayIteration.checkResults.map((checkResult) => ({
+      attemptIndex: checkResult.attemptIndex,
+      status: checkResult.status,
+      expectedToolName: checkResult.expectedToolName,
+      actualToolName: checkResult.actualToolName,
+      outputResult: checkResult.outputResult
+    }))
+  };
+}
+async function handlePathwayRegressionPreviewCommand(dependencies, options) {
+  const { accessToken, impersonatedOrganizationId, organization, state } = await withSelectedOrganizationAndAccessToken({ dependencies, options });
+  const previewPathwayRegressionMatchingRuns = requireApiClientMethod(
+    dependencies.apiClient,
+    "previewPathwayRegressionMatchingRuns"
+  );
+  const result = await previewPathwayRegressionMatchingRuns({
+    accessToken,
+    agentVersionId: options.agentVersionId,
+    automationVersionId: options.automationVersionId,
+    ...impersonatedOrganizationId ? { impersonatedOrganizationId } : {},
+    organizationId: organization.id,
+    ...options.runsPerPath === void 0 ? {} : { runsPerPath: options.runsPerPath }
+  });
+  await saveLastUsedOrganization({
+    dependencies,
+    organizationId: organization.id,
+    state
+  });
+  writeCommandOutput({
+    dependencies,
+    json: options.json,
+    result: options.json ? result : summarizePathwayRegressionPreview(result)
+  });
+}
+async function handlePathwayRegressionRunCommand(dependencies, options) {
+  const { accessToken, impersonatedOrganizationId, organization, state } = await withSelectedOrganizationAndAccessToken({ dependencies, options });
+  const startPathwayRegressionAgentVersionRun = requireApiClientMethod(
+    dependencies.apiClient,
+    "startPathwayRegressionAgentVersionRun"
+  );
+  const result = await startPathwayRegressionAgentVersionRun({
+    accessToken,
+    agentVersionId: options.agentVersionId,
+    automationVersionId: options.automationVersionId,
+    ...impersonatedOrganizationId ? { impersonatedOrganizationId } : {},
+    organizationId: organization.id
+  });
+  await saveLastUsedOrganization({
+    dependencies,
+    organizationId: organization.id,
+    state
+  });
+  writeCommandOutput({
+    dependencies,
+    json: options.json,
+    result: options.json ? result : summarizePathwayRegressionKickoff(result)
+  });
+}
+async function handlePathwayRegressionResultsCommand(dependencies, options) {
+  const { accessToken, impersonatedOrganizationId, organization, state } = await withSelectedOrganizationAndAccessToken({ dependencies, options });
+  const getPathwayRegressionRunResult = requireApiClientMethod(
+    dependencies.apiClient,
+    "getPathwayRegressionRunResult"
+  );
+  const result = await getPathwayRegressionRunResult({
+    accessToken,
+    regressionRunId: options.regressionRunId,
+    ...impersonatedOrganizationId ? { impersonatedOrganizationId } : {},
+    organizationId: organization.id
+  });
+  await saveLastUsedOrganization({
+    dependencies,
+    organizationId: organization.id,
+    state
+  });
+  writeCommandOutput({
+    dependencies,
+    json: options.json,
+    result: options.json ? result : summarizePathwayRegressionResult(result)
+  });
+}
+async function handlePathwayRegressionCheckResultsCommand(dependencies, options) {
+  const { accessToken, impersonatedOrganizationId, organization, state } = await withSelectedOrganizationAndAccessToken({ dependencies, options });
+  const getPathwayRegressionReplayIterationCheckResults = requireApiClientMethod(
+    dependencies.apiClient,
+    "getPathwayRegressionReplayIterationCheckResults"
+  );
+  const result = await getPathwayRegressionReplayIterationCheckResults({
+    accessToken,
+    regressionReplayIterationId: options.regressionReplayIterationId,
+    ...impersonatedOrganizationId ? { impersonatedOrganizationId } : {},
+    organizationId: organization.id
+  });
+  await saveLastUsedOrganization({
+    dependencies,
+    organizationId: organization.id,
+    state
+  });
+  writeCommandOutput({
+    dependencies,
+    json: options.json,
+    result: options.json ? result : summarizePathwayRegressionReplayIterationCheckResults(result)
+  });
+}
 async function resolveDirectAccessTokenOrganizationId({
   dependencies
 }) {
@@ -19420,7 +21633,7 @@ async function resolveDirectAccessTokenOrganizationId({
   if (!accessTokenFilePath) {
     return null;
   }
-  const accessToken = await readFile5(accessTokenFilePath, "utf8").then((value) => value.trim()).catch((error) => {
+  const accessToken = await readFile6(accessTokenFilePath, "utf8").then((value) => value.trim()).catch((error) => {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
     }
@@ -19452,6 +21665,9 @@ function addRegistryOperationCommand({
   dependencies,
   operationSpec
 }) {
+  if (operationSpec.cli.hidden) {
+    return;
+  }
   const commandPath = [...operationSpec.cli.path];
   const leafCommandName = commandPath.pop();
   if (!leafCommandName) {
@@ -19488,12 +21704,17 @@ function addRegistryOperationCommand({
   configureOperationalCommand(legacyAliasCommand, dependencies, operationSpec);
 }
 function configureOperationalCommand(command, dependencies, operationSpec) {
-  command.description(operationSpec.cli.description).addOption(
-    new Option2(
-      "--org <org>",
-      "Organization ID or exact organization name to use."
-    ).helpGroup("Shared options:")
-  ).addHelpText(
+  commandBranchContexts.set(command, operationSpec.cli.branchContext);
+  command.description(operationSpec.cli.description);
+  if (operationSpec.scope !== "global") {
+    command.addOption(
+      new Option2(
+        "--org <org>",
+        "Organization ID or exact organization name to use."
+      ).helpGroup("Shared options:")
+    );
+  }
+  command.addHelpText(
     "after",
     `
 ${formatExamples(
@@ -19532,12 +21753,12 @@ function createConsoleIo() {
 function createDefaultDependencies() {
   const runtimeConfig = getRuntimeConfig();
   const settingsStore = createFileSettingsStore(runtimeConfig.stateFilePath);
-  const accessTokenFilePath = runtimeConfig.accessTokenFilePath ?? path7.join(
-    path7.dirname(runtimeConfig.stateFilePath),
+  const accessTokenFilePath = runtimeConfig.accessTokenFilePath ?? path8.join(
+    path8.dirname(runtimeConfig.stateFilePath),
     CLI_ACCESS_TOKEN_FILE_NAME
   );
-  const refreshTokenFilePath = runtimeConfig.refreshTokenFilePath ?? path7.join(
-    path7.dirname(runtimeConfig.stateFilePath),
+  const refreshTokenFilePath = runtimeConfig.refreshTokenFilePath ?? path8.join(
+    path8.dirname(runtimeConfig.stateFilePath),
     CLI_REFRESH_TOKEN_FILE_NAME
   );
   const selfUpdateOptions = {
@@ -19569,7 +21790,12 @@ function createDefaultDependencies() {
 function buildProgram(dependencies) {
   const program2 = configureCommandPresentation(
     new Command2().name("mgcl").description("Run Magical operations from the command line.")
-  ).addOption(new Option2("--json", "Render JSON output.")).version(CLI_VERSION, "--version", `Display mgcl version (${CLI_VERSION}).`).addOption(
+  ).addOption(new Option2("--json", "Render JSON output.")).addOption(
+    new Option2(
+      "--branch-id <id>",
+      "Target a supported automation command at one branch; omit it to target main."
+    )
+  ).version(CLI_VERSION, "--version", `Display mgcl version (${CLI_VERSION}).`).addOption(
     new Option2(
       "--update",
       "Update mgcl to the latest published npm release."
@@ -19587,6 +21813,18 @@ ${formatExamples("Quick start", [
 
 ${formatOutputModesNote()}`
   );
+  program2.hook("preAction", (_thisCommand, actionCommand) => {
+    const options = actionCommand.optsWithGlobals();
+    const branchContext = commandBranchContexts.get(actionCommand);
+    if (options.branchId && branchContext === void 0) {
+      throw new CliError(
+        `Command "${actionCommand.name()}" does not support --branch-id.`
+      );
+    }
+    if (!options.branchId && branchContext === "required") {
+      throw new CliError("--branch-id is required for this command.");
+    }
+  });
   program2.action(async function() {
     const options = this.optsWithGlobals();
     if (options.update) {
@@ -19631,6 +21869,88 @@ ${formatExamples("Examples", [
     );
   });
   program2.addCommand(orgCommand);
+  const pathwayRegressionCommand = configureCommandPresentation(
+    new Command2("pathway-regression").description(
+      "Preview, start, and inspect pathway regression runs."
+    )
+  ).helpGroup("Workspace:").addHelpText(
+    "after",
+    `
+${formatExamples("Examples", [
+      "mgcl pathway-regression preview --automation-version-id <id> --agent-version-id <id>",
+      "mgcl pathway-regression run --automation-version-id <id> --agent-version-id <id>",
+      "mgcl pathway-regression results --regression-run-id <id>",
+      "mgcl pathway-regression check-results --regression-replay-iteration-id <id>"
+    ])}`
+  );
+  const addPathwayRegressionAgentVersionOptions = (command) => command.addOption(
+    new Option2(
+      "--org <org>",
+      "Organization ID or exact organization name to use."
+    ).helpGroup("Shared options:")
+  ).addOption(
+    new Option2(
+      "--automation-version-id <id>",
+      "Automation version to test against."
+    ).helpGroup("Pathway regression options:").makeOptionMandatory(true)
+  ).addOption(
+    new Option2("--agent-version-id <id>", "Agent version to test.").helpGroup("Pathway regression options:").makeOptionMandatory(true)
+  );
+  const addPathwayRegressionPreviewOptions = (command) => addPathwayRegressionAgentVersionOptions(command).addOption(
+    new Option2(
+      "--runs-per-path <count>",
+      "Number of historical runs to use per pathway. Defaults to the service value."
+    ).helpGroup("Pathway regression options:").argParser(parsePositiveIntegerOption)
+  );
+  addPathwayRegressionPreviewOptions(
+    pathwayRegressionCommand.command("preview").description("Show which historical runs are available per pathway.")
+  ).action(async function() {
+    await handlePathwayRegressionPreviewCommand(
+      dependencies,
+      this.optsWithGlobals()
+    );
+  });
+  addPathwayRegressionAgentVersionOptions(
+    pathwayRegressionCommand.command("run").description("Start regression replay for an agent version.")
+  ).action(async function() {
+    await handlePathwayRegressionRunCommand(
+      dependencies,
+      this.optsWithGlobals()
+    );
+  });
+  pathwayRegressionCommand.command("results").description("Read a pathway regression run result.").addOption(
+    new Option2(
+      "--org <org>",
+      "Organization ID or exact organization name to use."
+    ).helpGroup("Shared options:")
+  ).addOption(
+    new Option2(
+      "--regression-run-id <id>",
+      "Pathway regression run ID to inspect."
+    ).helpGroup("Pathway regression options:").makeOptionMandatory(true)
+  ).action(async function() {
+    await handlePathwayRegressionResultsCommand(
+      dependencies,
+      this.optsWithGlobals()
+    );
+  });
+  pathwayRegressionCommand.command("check-results").description("Read detailed check attempts for one replay iteration.").addOption(
+    new Option2(
+      "--org <org>",
+      "Organization ID or exact organization name to use."
+    ).helpGroup("Shared options:")
+  ).addOption(
+    new Option2(
+      "--regression-replay-iteration-id <id>",
+      "Pathway regression replay iteration ID to inspect."
+    ).helpGroup("Pathway regression options:").makeOptionMandatory(true)
+  ).action(async function() {
+    await handlePathwayRegressionCheckResultsCommand(
+      dependencies,
+      this.optsWithGlobals()
+    );
+  });
+  program2.addCommand(pathwayRegressionCommand);
   const nangoCommand = configureCommandPresentation(
     new Command2("nango").description(
       "Inspect Nango integrations and org-scoped authentications."