@getmagical/cli 0.9.2 → 0.10.0

package/dist/index.js

@@ -1897,13 +1897,13 @@ var require_ast = __commonJS({
         helperExpression: function helperExpression(node) {
           return node.type === "SubExpression" || (node.type === "MustacheStatement" || node.type === "BlockStatement") && !!(node.params && node.params.length || node.hash);
         },
-        scopedId: function scopedId(path21) {
-          return /^\.|this\b/.test(path21.original);
+        scopedId: function scopedId(path22) {
+          return /^\.|this\b/.test(path22.original);
         },
         // an ID is simple if it only has one part, and that part is not
         // `..` or `this`.
-        simpleId: function simpleId(path21) {
-          return path21.parts.length === 1 && !AST.helpers.scopedId(path21) && !path21.depth;
+        simpleId: function simpleId(path22) {
+          return path22.parts.length === 1 && !AST.helpers.scopedId(path22) && !path22.depth;
         }
       }
     };
@@ -2973,12 +2973,12 @@ var require_helpers2 = __commonJS({
         loc
       };
     }
-    function prepareMustache(path21, params, hash, open2, strip, locInfo) {
+    function prepareMustache(path22, params, hash, open2, strip, locInfo) {
       var escapeFlag = open2.charAt(3) || open2.charAt(2), escaped = escapeFlag !== "{" && escapeFlag !== "&";
       var decorator = /\*/.test(open2);
       return {
         type: decorator ? "Decorator" : "MustacheStatement",
-        path: path21,
+        path: path22,
         params,
         hash,
         escaped,
@@ -3296,9 +3296,9 @@ var require_compiler = __commonJS({
       },
       DecoratorBlock: function DecoratorBlock(decorator) {
         var program2 = decorator.program && this.compileProgram(decorator.program);
-        var params = this.setupFullMustacheParams(decorator, program2, void 0), path21 = decorator.path;
+        var params = this.setupFullMustacheParams(decorator, program2, void 0), path22 = decorator.path;
         this.useDecorators = true;
-        this.opcode("registerDecorator", params.length, path21.original);
+        this.opcode("registerDecorator", params.length, path22.original);
       },
       PartialStatement: function PartialStatement(partial) {
         this.usePartial = true;
@@ -3362,46 +3362,46 @@ var require_compiler = __commonJS({
         }
       },
       ambiguousSexpr: function ambiguousSexpr(sexpr, program2, inverse) {
-        var path21 = sexpr.path, name = path21.parts[0], isBlock = program2 != null || inverse != null;
-        this.opcode("getContext", path21.depth);
+        var path22 = sexpr.path, name = path22.parts[0], isBlock = program2 != null || inverse != null;
+        this.opcode("getContext", path22.depth);
         this.opcode("pushProgram", program2);
         this.opcode("pushProgram", inverse);
-        path21.strict = true;
-        this.accept(path21);
+        path22.strict = true;
+        this.accept(path22);
         this.opcode("invokeAmbiguous", name, isBlock);
       },
       simpleSexpr: function simpleSexpr(sexpr) {
-        var path21 = sexpr.path;
-        path21.strict = true;
-        this.accept(path21);
+        var path22 = sexpr.path;
+        path22.strict = true;
+        this.accept(path22);
         this.opcode("resolvePossibleLambda");
       },
       helperSexpr: function helperSexpr(sexpr, program2, inverse) {
-        var params = this.setupFullMustacheParams(sexpr, program2, inverse), path21 = sexpr.path, name = path21.parts[0];
+        var params = this.setupFullMustacheParams(sexpr, program2, inverse), path22 = sexpr.path, name = path22.parts[0];
         if (this.options.knownHelpers[name]) {
           this.opcode("invokeKnownHelper", params.length, name);
         } else if (this.options.knownHelpersOnly) {
           throw new _exception2["default"]("You specified knownHelpersOnly, but used the unknown helper " + name, sexpr);
         } else {
-          path21.strict = true;
-          path21.falsy = true;
-          this.accept(path21);
-          this.opcode("invokeHelper", params.length, path21.original, _ast2["default"].helpers.simpleId(path21));
+          path22.strict = true;
+          path22.falsy = true;
+          this.accept(path22);
+          this.opcode("invokeHelper", params.length, path22.original, _ast2["default"].helpers.simpleId(path22));
         }
       },
-      PathExpression: function PathExpression(path21) {
-        this.addDepth(path21.depth);
-        this.opcode("getContext", path21.depth);
-        var name = path21.parts[0], scoped = _ast2["default"].helpers.scopedId(path21), blockParamId = !path21.depth && !scoped && this.blockParamIndex(name);
+      PathExpression: function PathExpression(path22) {
+        this.addDepth(path22.depth);
+        this.opcode("getContext", path22.depth);
+        var name = path22.parts[0], scoped = _ast2["default"].helpers.scopedId(path22), blockParamId = !path22.depth && !scoped && this.blockParamIndex(name);
         if (blockParamId) {
-          this.opcode("lookupBlockParam", blockParamId, path21.parts);
+          this.opcode("lookupBlockParam", blockParamId, path22.parts);
         } else if (!name) {
           this.opcode("pushContext");
-        } else if (path21.data) {
+        } else if (path22.data) {
           this.options.data = true;
-          this.opcode("lookupData", path21.depth, path21.parts, path21.strict);
+          this.opcode("lookupData", path22.depth, path22.parts, path22.strict);
         } else {
-          this.opcode("lookupOnContext", path21.parts, path21.falsy, path21.strict, scoped);
+          this.opcode("lookupOnContext", path22.parts, path22.falsy, path22.strict, scoped);
         }
       },
       StringLiteral: function StringLiteral(string) {
@@ -3751,16 +3751,16 @@ var require_util = __commonJS({
     }
     exports.urlGenerate = urlGenerate;
     function normalize(aPath) {
-      var path21 = aPath;
+      var path22 = aPath;
       var url = urlParse(aPath);
       if (url) {
         if (!url.path) {
           return aPath;
         }
-        path21 = url.path;
+        path22 = url.path;
       }
-      var isAbsolute = exports.isAbsolute(path21);
-      var parts = path21.split(/\/+/);
+      var isAbsolute = exports.isAbsolute(path22);
+      var parts = path22.split(/\/+/);
       for (var part, up = 0, i = parts.length - 1; i >= 0; i--) {
         part = parts[i];
         if (part === ".") {
@@ -3777,15 +3777,15 @@ var require_util = __commonJS({
           }
         }
       }
-      path21 = parts.join("/");
-      if (path21 === "") {
-        path21 = isAbsolute ? "/" : ".";
+      path22 = parts.join("/");
+      if (path22 === "") {
+        path22 = isAbsolute ? "/" : ".";
       }
       if (url) {
-        url.path = path21;
+        url.path = path22;
         return urlGenerate(url);
       }
-      return path21;
+      return path22;
     }
     exports.normalize = normalize;
     function join(aRoot, aPath) {
@@ -6568,8 +6568,8 @@ var require_printer = __commonJS({
       return this.accept(sexpr.path) + " " + params + hash;
     };
     PrintVisitor.prototype.PathExpression = function(id) {
-      var path21 = id.parts.join("/");
-      return (id.data ? "@" : "") + "PATH:" + path21;
+      var path22 = id.parts.join("/");
+      return (id.data ? "@" : "") + "PATH:" + path22;
     };
     PrintVisitor.prototype.StringLiteral = function(string) {
       return '"' + string.value + '"';
@@ -7219,7 +7219,7 @@ function getErrorMessage(error) {
 
 // src/program.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
-import path20 from "node:path";
+import path21 from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
 
 // ../common/dist/src/stdlib/json.util.js
@@ -12441,8 +12441,8 @@ var RENDER_TEMPLATE_ERROR_REASON_CATALOG = defineErrorReasonCatalog()([
 ]);
 var storeReferencePathPattern = String.raw`store(?:\.[$A-Z_a-z][\w$]*)*`;
 var storeReferenceMarkdownLinkTemplateRegex = new RegExp(String.raw`(?<open>\{\{\{?)\s*\[(?<path>${storeReferencePathPattern})\]\(\s*<?https?:\/\/\k<path>>?\s*\)\s*(?<close>\}\}\}?)`, "gu");
-function normalizeAutomationStoreTemplateLinkMatch([_match, open2, path21]) {
-  return open2 === "{{{" ? `{{{${path21}}}}` : `{{${path21}}}`;
+function normalizeAutomationStoreTemplateLinkMatch([_match, open2, path22]) {
+  return open2 === "{{{" ? `{{{${path22}}}}` : `{{${path22}}}`;
 }
 function normalizeAutomationStoreTemplateLinks(template) {
   return template.replaceAll(storeReferenceMarkdownLinkTemplateRegex, (...args) => normalizeAutomationStoreTemplateLinkMatch(args));
@@ -12512,12 +12512,14 @@ function renderOutcomeList(outcomes) {
 function formatCaseHeading(label, description) {
   return `* **Case ${label}**: ${description}`;
 }
-import_handlebars.default.registerHelper("renderIfElseList", (rawCases, rawElse) => {
+import_handlebars.default.registerHelper("renderIfElseList", (rawCases, rawElse, options) => {
   const cases = z7.array(ConditionCaseSchema).min(1).parse(rawCases);
   const elseOutcome = OutcomeType.optional().parse(rawElse);
   const hasElseOutcomes = elseOutcome !== void 0 && elseOutcome.length > 0;
   const totalOptions = cases.length + (hasElseOutcomes ? 1 : 0);
-  const preamble = `You now have ${totalOptions} option${totalOptions === 1 ? "" : "s"}:`;
+  const literalStoreReferences = options.data?.literalStoreReferences === true;
+  const preamble = literalStoreReferences ? `Conditional instruction: ${totalOptions} mutually exclusive case${totalOptions === 1 ? "" : "s"} (select once on entry).` : `You now have ${totalOptions} option${totalOptions === 1 ? "" : "s"}:`;
+  const executionRules = "These cases are mutually exclusive alternatives, not sequential steps. Before evaluating a condition, check prior tool calls and results for outcomes already executed on this visit. If a case has begun, continue its unfinished outcomes without checking the conditions again. A successful tool result completes that outcome; when the selected case's final outcome succeeds, this entire conditional is complete and execution continues with the next instruction. Only on first entry, select the first matching case, or Otherwise if present and no condition matched. Otherwise never applies because a selected case changed its own condition. Retry failed actions within the selected case. Reevaluate only when an explicit loop or return instruction enters this conditional again.";
   const ifBlocks = cases.map((c, idx) => {
     const heading = formatCaseHeading(indexToLetters(idx), c.condition);
     const outcomes = renderOutcomeList(c.outcome.map((o) => o.preview));
@@ -12527,7 +12529,13 @@ ${outcomes}`;
   const elseHeading = formatCaseHeading(indexToLetters(cases.length), "Otherwise");
   const elseBlock = hasElseOutcomes ? [elseHeading, renderOutcomeList(elseOutcome.map((o) => o.preview))] : [];
   const fallthroughBlock = hasElseOutcomes ? [] : ["If no case matches, continue to the next instruction."];
-  const result = [preamble, ifBlocks, ...elseBlock, ...fallthroughBlock].join("\n");
+  const result = [
+    preamble,
+    ...literalStoreReferences ? [executionRules] : [],
+    ifBlocks,
+    ...elseBlock,
+    ...fallthroughBlock
+  ].join("\n");
   return new import_handlebars.default.SafeString(result);
 });
 function isPathExpression(expr) {
@@ -13931,18 +13939,18 @@ var specialCommands = {
 // ../common/dist/src/utils/automation-store-path.util.js
 var AUTOMATION_STORE_ROOT_PATH = "store";
 var relativeStorePathRegex = /^[$A-Z_a-z][\w$]*(?:\.[$A-Z_a-z][\w$]*)*$/u;
-function normalizeStoreMutationPath(path21) {
-  const trimmedPath = path21.trim();
+function normalizeStoreMutationPath(path22) {
+  const trimmedPath = path22.trim();
   const rootPrefix = `${AUTOMATION_STORE_ROOT_PATH}.`;
   const relativePath = trimmedPath.startsWith(rootPrefix) ? trimmedPath.slice(rootPrefix.length) : trimmedPath;
   if (!relativeStorePathRegex.test(relativePath)) {
     return Err({
       type: "invalid-automation-store-path",
-      path: path21,
+      path: path22,
       categories: ["customer_usage"],
       statusCode: 400,
       nonRetryable: true,
-      message: `Automation store path "${path21}" is invalid.`,
+      message: `Automation store path "${path22}" is invalid.`,
       suggestedAction: "Use a dot path relative to the automation store, such as patient.name or provider.clinic."
     });
   }
@@ -13955,16 +13963,16 @@ function findAutomationStorePathOverlap(paths) {
     ...new Set(paths.map(getCanonicalAutomationStoreMutationPath))
   ].toSorted((left, right) => (left === AUTOMATION_STORE_ROOT_PATH ? 0 : left.split(".").length) - (right === AUTOMATION_STORE_ROOT_PATH ? 0 : right.split(".").length));
   for (const [index, ancestorPath] of canonicalPaths.entries()) {
-    const descendantPath = canonicalPaths.slice(index + 1).find((path21) => ancestorPath === AUTOMATION_STORE_ROOT_PATH || path21.startsWith(`${ancestorPath}.`));
+    const descendantPath = canonicalPaths.slice(index + 1).find((path22) => ancestorPath === AUTOMATION_STORE_ROOT_PATH || path22.startsWith(`${ancestorPath}.`));
     if (descendantPath !== void 0) {
       return { ancestorPath, descendantPath };
     }
   }
   return void 0;
 }
-function getCanonicalAutomationStoreMutationPath(path21) {
-  const normalizedPath = normalizeStoreMutationPath(path21);
-  return normalizedPath._tag === "Ok" ? normalizedPath.value : path21.trim();
+function getCanonicalAutomationStoreMutationPath(path22) {
+  const normalizedPath = normalizeStoreMutationPath(path22);
+  return normalizedPath._tag === "Ok" ? normalizedPath.value : path22.trim();
 }
 
 // ../common/dist/src/constants/tool-declarations.js
@@ -14152,9 +14160,9 @@ var baseToolDeclarations = {
           path: []
         });
       }
-      const canonicalUpdatePaths = updates.map(({ path: path21 }) => getCanonicalAutomationStoreMutationPath(path21));
+      const canonicalUpdatePaths = updates.map(({ path: path22 }) => getCanonicalAutomationStoreMutationPath(path22));
       const canonicalClearPathSet = new Set(clears.map(getCanonicalAutomationStoreMutationPath));
-      const conflictedUpdatePath = canonicalUpdatePaths.find((path21) => canonicalClearPathSet.has(path21));
+      const conflictedUpdatePath = canonicalUpdatePaths.find((path22) => canonicalClearPathSet.has(path22));
       if (conflictedUpdatePath !== void 0) {
         context.addIssue({
           code: "custom",
@@ -14687,9 +14695,9 @@ var magicalApiKeyPermissionPresets = [
 import { z as z25 } from "zod";
 
 // ../common/dist/src/utils/agent-knowledge-base-assets.util.js
-function getIsKnowledgeBaseAssetPathAllowed(path21) {
-  const pathSegments = path21.split("/");
-  if (path21.length === 0 || pathSegments.some((segment) => segment.length === 0)) {
+function getIsKnowledgeBaseAssetPathAllowed(path22) {
+  const pathSegments = path22.split("/");
+  if (path22.length === 0 || pathSegments.some((segment) => segment.length === 0)) {
     return false;
   }
   const isTopLevelAssetPath = pathSegments[0] === "assets";
@@ -14744,29 +14752,29 @@ var ApiEmbeddedFileContentTypes = [
 ];
 var API_EMBEDDED_FILE_PATH_PATTERN = /^(?:\[\*\]|[A-Za-z_$][\w$-]*)(?:\[\*\]|\.[A-Za-z_$][\w$-]*)*$/u;
 var API_EMBEDDED_FILE_PATH_SEGMENT_PATTERN = /\[\*\]|[A-Za-z_$][\w$-]*/gu;
-function parseApiEmbeddedFilePath(path21) {
-  if (!API_EMBEDDED_FILE_PATH_PATTERN.test(path21)) {
+function parseApiEmbeddedFilePath(path22) {
+  if (!API_EMBEDDED_FILE_PATH_PATTERN.test(path22)) {
     return void 0;
   }
-  return [...path21.matchAll(API_EMBEDDED_FILE_PATH_SEGMENT_PATTERN)].map(([segment]) => segment === "[*]" ? { type: "arrayWildcard" } : { key: segment, type: "property" });
+  return [...path22.matchAll(API_EMBEDDED_FILE_PATH_SEGMENT_PATTERN)].map(([segment]) => segment === "[*]" ? { type: "arrayWildcard" } : { key: segment, type: "property" });
 }
 var apiAgentEmbeddedFileSchema = z17.object({
-  path: z17.string().trim().min(1, "Embedded file path is required.").refine((path21) => parseApiEmbeddedFilePath(path21) !== void 0, {
+  path: z17.string().trim().min(1, "Embedded file path is required.").refine((path22) => parseApiEmbeddedFilePath(path22) !== void 0, {
     message: "Embedded file path must use object properties and [*] array wildcards."
   }).describe("Path to a Base64 value relative to the projected API response. Supports object properties and [*] array wildcards."),
   contentType: z17.enum(ApiEmbeddedFileContentTypes).describe("File type of the decoded Base64 value. Use auto to detect PDF, PNG, or JPEG from each file\u2019s contents. Unrecognized files are skipped.")
 }).strict();
 var apiAgentEmbeddedFilesSchema = z17.array(apiAgentEmbeddedFileSchema).superRefine((embeddedFiles, context) => {
   const paths = /* @__PURE__ */ new Set();
-  for (const [index, { path: path21 }] of embeddedFiles.entries()) {
-    if (paths.has(path21)) {
+  for (const [index, { path: path22 }] of embeddedFiles.entries()) {
+    if (paths.has(path22)) {
       context.addIssue({
         code: z17.ZodIssueCode.custom,
-        message: `Embedded file path "${path21}" can only be configured once.`,
+        message: `Embedded file path "${path22}" can only be configured once.`,
         path: [index, "path"]
       });
     }
-    paths.add(path21);
+    paths.add(path22);
   }
 }).describe("Base64 values to decode, upload as permanent files, and replace with file references in the projected API response.");
 
@@ -14776,13 +14784,13 @@ var API_REQUEST_FILE_PATH_PATTERN = /^[A-Za-z_$][\w$-]*(?:\.[A-Za-z_$][\w$-]*)*$
 var API_REQUEST_BASE64_FILE_HELPER_PATTERN = /^\s*\{\{\s*base64File\s+(?<sourceInput>[^{}\s]+)\s*\}\}\s*$/u;
 var API_REQUEST_BASE64_FILE_HELPER_USAGE_PATTERN = /\{\{\s*base64File\b/u;
 var API_REQUEST_BASE64_FILE_HELPER_EXAMPLE = "{{base64File fileInput}}";
-function parseApiRequestFilePath(path21) {
-  if (!API_REQUEST_FILE_PATH_PATTERN.test(path21)) {
+function parseApiRequestFilePath(path22) {
+  if (!API_REQUEST_FILE_PATH_PATTERN.test(path22)) {
     return void 0;
   }
-  return path21.split(".");
+  return path22.split(".");
 }
-function inspectApiRequestBase64FileHelperValue({ path: path21, value }) {
+function inspectApiRequestBase64FileHelperValue({ path: path22, value }) {
   const match = API_REQUEST_BASE64_FILE_HELPER_PATTERN.exec(value);
   if (match === null) {
     return API_REQUEST_BASE64_FILE_HELPER_USAGE_PATTERN.test(value) ? {
@@ -14790,7 +14798,7 @@ function inspectApiRequestBase64FileHelperValue({ path: path21, value }) {
       issues: [
         {
           message: `Use ${API_REQUEST_BASE64_FILE_HELPER_EXAMPLE} as the entire JSON field value.`,
-          path: path21
+          path: path22
         }
       ]
     } : { helpers: [], issues: [] };
@@ -14802,24 +14810,24 @@ function inspectApiRequestBase64FileHelperValue({ path: path21, value }) {
       issues: [
         {
           message: "Base64 file helper input must use an object property path.",
-          path: path21
+          path: path22
         }
       ]
     };
   }
   return {
-    helpers: [{ destinationPath: path21, sourceInput }],
+    helpers: [{ destinationPath: path22, sourceInput }],
     issues: []
   };
 }
-function inspectApiRequestBase64FileHelpers(body, path21 = []) {
+function inspectApiRequestBase64FileHelpers(body, path22 = []) {
   if (typeof body === "string") {
-    return inspectApiRequestBase64FileHelperValue({ path: path21, value: body });
+    return inspectApiRequestBase64FileHelperValue({ path: path22, value: body });
   }
   if (Array.isArray(body)) {
     return body.reduce((inspection, value, index) => {
       const nestedInspection = inspectApiRequestBase64FileHelpers(value, [
-        ...path21,
+        ...path22,
         index
       ]);
       return {
@@ -14833,7 +14841,7 @@ function inspectApiRequestBase64FileHelpers(body, path21 = []) {
   }
   return Object.entries(body).reduce((inspection, [key, value]) => {
     const nestedInspection = inspectApiRequestBase64FileHelpers(value, [
-      ...path21,
+      ...path22,
       key
     ]);
     return {
@@ -14877,10 +14885,10 @@ function validateApiRequestBase64FileHelpers({ body, bodyType, context, supports
   }
 }
 var apiAgentRequestFileEncodingSchema = z18.object({
-  sourceInput: z18.string().trim().min(1, "File input is required.").refine((path21) => parseApiRequestFilePath(path21) !== void 0, {
+  sourceInput: z18.string().trim().min(1, "File input is required.").refine((path22) => parseApiRequestFilePath(path22) !== void 0, {
     message: "File input must use an object property path."
   }).describe("API Agent input containing the file reference to encode."),
-  destinationPath: z18.string().trim().min(1, "Request field is required.").refine((path21) => parseApiRequestFilePath(path21) !== void 0, {
+  destinationPath: z18.string().trim().min(1, "Request field is required.").refine((path22) => parseApiRequestFilePath(path22) !== void 0, {
     message: "Request field must use an object property path."
   }).describe("JSON request body path where the encoded value is inserted."),
   encoding: z18.literal("base64").describe("Encoding applied to the source file before insertion.")
@@ -15132,6 +15140,7 @@ var browserSOMEnvironmentOptionsSchema = z25.object({
   environment: z25.literal("browser").describe("Browser environment using Set of Marks (SOM) for element identification."),
   maxMediaToIncludeInMemory: z25.number().min(1).optional().describe("Maximum number of screenshots/media items to keep in the agent memory context."),
   somFilter: somFilterConfigSchema.optional().describe("Default SOM overlay filter to apply for each browser iteration until the somFilter tool sets or clears a session filter."),
+  somFrameTimeoutMs: z25.number().int().positive().optional().describe("Timeout in milliseconds for processing each child frame during SOM generation. Defaults to REMOTE_SESSION_SOM_FRAME_TIMEOUT_MS (7000 ms) when omitted. The overall 40000 ms SOM generation limit still applies."),
   saveAuthCookiesAfterRun: z25.boolean().optional().describe("Whether to save authentication cookies after the run completes for reuse in future runs."),
   suppressNativePrint: z25.boolean().optional().describe("Suppress native window.print dialogs for the whole browser session while still recording print calls."),
   startingUrl: startingUrlSchema.describe("Initial URL to navigate to when the agent starts. Accepts a valid URL or a Handlebars template with agent inputs. If not provided, uses the current URL of the browser; if this is the first agent, it will be a blank page."),
@@ -15177,7 +15186,8 @@ var environmentOptionsSchema = z25.discriminatedUnion("environment", [
   minimalEnvironmentOptionsSchema
 ]).describe("Environment configuration for the agent. Determines the execution context.");
 var runSettingsBrowserSOMEnvironmentOptionsSchema = browserSOMEnvironmentOptionsSchema.omit({
-  somFilter: true
+  somFilter: true,
+  somFrameTimeoutMs: true
 }).describe("Browser environment configuration using Set of Marks (SOM) for element identification. This is the recommended browser mode for most use cases.");
 var runSettingsEnvironmentOptionsSchema = z25.discriminatedUnion("environment", [
   runSettingsBrowserSOMEnvironmentOptionsSchema,
@@ -15238,30 +15248,30 @@ function hasControlCharacter(value) {
   }
   return false;
 }
-function isNormalizedRepoPath(path21) {
-  if (path21 === "/") {
+function isNormalizedRepoPath(path22) {
+  if (path22 === "/") {
     return true;
   }
-  if (path21.length === 0 || path21.startsWith("/") || path21.startsWith("\\") || path21.includes("\\") || hasControlCharacter(path21) || windowsAbsolutePathPattern.test(path21)) {
+  if (path22.length === 0 || path22.startsWith("/") || path22.startsWith("\\") || path22.includes("\\") || hasControlCharacter(path22) || windowsAbsolutePathPattern.test(path22)) {
     return false;
   }
-  return path21.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== ".." && segment !== ".git");
+  return path22.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== ".." && segment !== ".git");
 }
-function normalizeRepoPath(path21) {
-  if (path21 === "/") {
-    return path21;
+function normalizeRepoPath(path22) {
+  if (path22 === "/") {
+    return path22;
   }
-  return path21.replaceAll(/\/+$/gu, "");
+  return path22.replaceAll(/\/+$/gu, "");
 }
 var skillPathPattern = /^(?:skills\/.+|automations\/[^/]+\/skills\/.+|automations\/[^/]+\/agents\/[^/]+\/skills\/.+)$/u;
 var skillRootPathPattern = /^(?:skills\/[^/]+|automations\/[^/]+\/skills\/[^/]+|automations\/[^/]+\/agents\/[^/]+\/skills\/[^/]+)$/u;
 var repoPathSchema = z25.string().min(1).transform(normalizeRepoPath).refine(isNormalizedRepoPath, {
   message: "Path must be a normalized repository-relative path."
 });
-var registeredSkillPathSchema = repoPathSchema.refine((path21) => skillPathPattern.test(path21), {
+var registeredSkillPathSchema = repoPathSchema.refine((path22) => skillPathPattern.test(path22), {
   message: "Skill paths must be under root, automation, or automation-agent skills."
 });
-var registeredSkillRootPathSchema = registeredSkillPathSchema.refine((path21) => skillRootPathPattern.test(path21) && !path21.endsWith("/SKILL.md"), {
+var registeredSkillRootPathSchema = registeredSkillPathSchema.refine((path22) => skillRootPathPattern.test(path22) && !path22.endsWith("/SKILL.md"), {
   message: "Registered skill paths must identify a skill root directory."
 });
 var knowledgeBasePluginPermissionSchema = z25.object({
@@ -15910,13 +15920,13 @@ function getMentionedStandardCommand(instructions) {
   const normalizedInstructions = instructions.toLowerCase();
   return STANDARD_COMMAND_NAMES.find((commandName) => normalizedInstructions.includes(commandName.toLowerCase())) ?? null;
 }
-function assertCustomInstructionsCommand({ commands, path: path21 }) {
-  const customCommands = commands.flatMap((command, commandIndex) => command["commandName"] === "custom" ? [{ command, path: `${path21}[${commandIndex.toString()}]` }] : []);
+function assertCustomInstructionsCommand({ commands, path: path22 }) {
+  const customCommands = commands.flatMap((command, commandIndex) => command["commandName"] === "custom" ? [{ command, path: `${path22}[${commandIndex.toString()}]` }] : []);
   if (customCommands.length === 0) {
     return;
   }
   if (customCommands.length > MAX_CUSTOM_COMMAND_COUNT) {
-    throw createInvalidValueError(`${path21} contains ${customCommands.length.toString()} custom commands. Use at most ${MAX_CUSTOM_COMMAND_COUNT.toString()} short custom commands per agent. Split policy, decision, outreach, and multi-step work into catalog commands or child agents instead.`);
+    throw createInvalidValueError(`${path22} contains ${customCommands.length.toString()} custom commands. Use at most ${MAX_CUSTOM_COMMAND_COUNT.toString()} short custom commands per agent. Split policy, decision, outreach, and multi-step work into catalog commands or child agents instead.`);
   }
   for (const customCommand of customCommands) {
     const instructions = getCustomInstructions(customCommand.command);
@@ -16298,7 +16308,7 @@ function isRecord3(value) {
 function validateCustomInstructionsCommands({
   commands,
   ctx,
-  path: path21
+  path: path22
 }) {
   if (!Array.isArray(commands)) {
     return;
@@ -16306,14 +16316,14 @@ function validateCustomInstructionsCommands({
   const validationResult = fromThrowable(() => {
     assertCustomInstructionsCommand({
       commands: commands.map((command) => isRecord3(command) ? command : {}),
-      path: path21.join(".").replaceAll(/\.(?<index>\d+)/gu, "[$<index>]")
+      path: path22.join(".").replaceAll(/\.(?<index>\d+)/gu, "[$<index>]")
     });
   }, "invalid-custom-instructions-command");
   if (isErr(validationResult)) {
     ctx.addIssue({
       code: "custom",
       message: `${getErrorMessage2(validationResult.error.cause)} Run mgcl catalog commands to find the standard command for this work.`,
-      path: path21
+      path: path22
     });
   }
 }
@@ -16396,6 +16406,27 @@ var runDraftConfigInputSchema = automationRunStartConfigSchema.partial().omit({
   networkTrafficCapture: runDraftNetworkTrafficCaptureInputSchema.nullable().optional()
 }).strict();
 var COMMAND_CATALOG_HELP = "When authoring raw instructionsCommands, run mgcl catalog commands and prefer a standard command.";
+var LIBRARY_ASSET_WORKBENCH_SELECTION = `libraryEntityId
+    rootAgentId
+    currentVersionId
+    updatedAt
+    summary {
+      name
+      agentCount
+      edgeCount
+      rootAgentIds
+      agents {
+        id
+        name
+        type
+        kind
+        description
+        instructions
+        tools
+        childAgentIds
+        parentAgentIds
+      }
+    }`;
 var apiKeyAccessPolicies = {
   baseline: { type: "baseline" },
   automationRead: {
@@ -16440,6 +16471,10 @@ var apiKeyAccessPolicies = {
     type: "allOf",
     permissions: ["runs:execute", "runs:read", "store:write"]
   },
+  libraryDenied: {
+    type: "denied",
+    reason: "Shared library operations do not have a public API-key permission."
+  },
   skillsRead: {
     type: "allOf",
     permissions: ["skills:read"]
@@ -16550,6 +16585,7 @@ var agentEnvironmentOptionsSelection = `      environmentOptions {
         ... on AgentConfig_environmentOptions_Browser {
           environment
           somFilter
+          somFrameTimeoutMs
           maxMediaToIncludeInMemory
           saveAuthCookiesAfterRun
           startingUrl
@@ -17028,6 +17064,320 @@ query GetCaptureContext($automationId: ID, $recordingId: ID) {
     metadata
     rawEvents
   }
+}`
+  }),
+  createOperationSpec({
+    operationName: "ExportAgents",
+    apiKeyAccess: {
+      type: "denied",
+      reason: "Agent transfer requires user login; shared library access has no API-key permission."
+    },
+    kind: "query",
+    inputSchema: z28.object({
+      ids: z28.array(z28.string().min(1)).min(1),
+      libraryEntityId: z28.string().min(1).optional(),
+      automationVersionId: z28.string().min(1).optional()
+    }).refine(
+      (input) => Boolean(input.libraryEntityId) !== Boolean(input.automationVersionId),
+      {
+        message: "Provide exactly one of --library-entity-id or --automation-version-id."
+      }
+    ),
+    cli: {
+      name: "export-agents",
+      path: ["agents", "export"],
+      description: "Export complete selected agents as portable JSON. Use --json > agents.json. Requires user login.",
+      resultKey: "exportAgents",
+      options: [
+        stringArrayOption({
+          inputKey: "ids",
+          flagName: "ids",
+          description: "Agent IDs, including their dependencies.",
+          required: true
+        }),
+        stringOption({
+          inputKey: "libraryEntityId",
+          flagName: "library-entity-id",
+          description: "Source library asset ID (exclusive with --automation-version-id)."
+        }),
+        stringOption({
+          inputKey: "automationVersionId",
+          flagName: "automation-version-id",
+          description: "Source saved automation version ID."
+        })
+      ]
+    },
+    mcp: { fileName: "exportAgents.graphql" },
+    document: `query ExportAgents($ids: [ID!]!, $libraryEntityId: ID, $automationVersionId: ID) {
+  exportAgents(ids: $ids, libraryEntityId: $libraryEntityId, automationVersionId: $automationVersionId)
+}`
+  }),
+  createOperationSpec({
+    operationName: "ImportAgents",
+    apiKeyAccess: {
+      type: "denied",
+      reason: "Agent transfer requires user login; shared library access has no API-key permission."
+    },
+    kind: "mutation",
+    inputSchema: z28.object({
+      automationId: z28.string().min(1),
+      baseVersionId: z28.string().min(1),
+      data: z28.unknown().refine((value) => value !== void 0, {
+        message: "Agent export data is required."
+      })
+    }),
+    cli: {
+      name: "import-agents",
+      path: ["agents", "import"],
+      description: "Append independent copies from an agent export file to a same-workspace draft. Keeps destination settings. Requires user login.",
+      resultKey: "importAgents",
+      options: [
+        stringOption({
+          inputKey: "automationId",
+          flagName: "automation-id",
+          description: "Destination draft automation ID.",
+          required: true
+        }),
+        stringOption({
+          inputKey: "baseVersionId",
+          flagName: "base-version-id",
+          description: "Current draftVersionId from a fresh automation fetch.",
+          required: true
+        }),
+        stringOption({
+          inputKey: "file",
+          flagName: "file",
+          description: "JSON file produced by agents export --json.",
+          required: true,
+          clientOnly: true
+        })
+      ]
+    },
+    mcp: { fileName: "importAgents.graphql" },
+    document: `mutation ImportAgents($automationId: ID!, $baseVersionId: ID!, $data: JSON!) {
+  importAgents(automationId: $automationId, baseVersionId: $baseVersionId, data: $data)
+}`
+  }),
+  createOperationSpec({
+    operationName: "LibraryAssetSearch",
+    apiKeyAccess: apiKeyAccessPolicies.libraryDenied,
+    kind: "query",
+    inputSchema: z28.object({
+      query: z28.string().min(1).optional(),
+      limit: z28.number().int().min(1).max(50).optional()
+    }),
+    cli: {
+      name: "library-asset-search",
+      path: ["library", "search"],
+      description: "Find shared library assets in the current workspace by name. Omit --query to list recent assets. Requires user login.",
+      resultKey: "libraryAssetSearch",
+      options: [
+        stringOption({
+          inputKey: "query",
+          flagName: "query",
+          description: "Case-insensitive substring of the asset name."
+        }),
+        numberOption({
+          inputKey: "limit",
+          flagName: "limit",
+          description: "Maximum assets to return (1-50, default 20)."
+        })
+      ]
+    },
+    mcp: { fileName: "libraryAssetSearch.graphql" },
+    document: `query LibraryAssetSearch($query: String, $limit: Int) {
+  libraryAssetSearch(query: $query, limit: $limit) {
+    libraryEntityId
+    rootAgentId
+    name
+    description
+    currentVersionId
+    updatedAt
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "LibraryAssetWorkbench",
+    apiKeyAccess: apiKeyAccessPolicies.libraryDenied,
+    kind: "query",
+    inputSchema: z28.object({
+      libraryEntityId: z28.string().min(1)
+    }),
+    cli: {
+      name: "library-asset-get",
+      path: ["library", "get"],
+      description: "Fetch a shared library asset and its agent tree. Requires user login.",
+      resultKey: "libraryAssetWorkbench",
+      options: [
+        stringOption({
+          inputKey: "libraryEntityId",
+          flagName: "library-entity-id",
+          description: "Library asset ID.",
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "libraryAssetWorkbench.graphql" },
+    document: `query LibraryAssetWorkbench($libraryEntityId: ID!) {
+  libraryAssetWorkbench(libraryEntityId: $libraryEntityId) {
+    ${LIBRARY_ASSET_WORKBENCH_SELECTION}
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "CreateLibraryAsset",
+    apiKeyAccess: apiKeyAccessPolicies.libraryDenied,
+    kind: "mutation",
+    inputSchema: z28.object({
+      assetName: z28.string().trim().min(1).optional()
+    }),
+    cli: {
+      name: "create-library-asset",
+      path: ["library", "create"],
+      description: "Create an empty shared library asset with a single root agent. Requires user login.",
+      resultKey: "createLibraryAsset",
+      options: [
+        stringOption({
+          inputKey: "assetName",
+          flagName: "name",
+          description: 'Asset name. Defaults to "New Asset".'
+        })
+      ]
+    },
+    mcp: { fileName: "createLibraryAsset.graphql" },
+    document: `mutation CreateLibraryAsset($assetName: String) {
+  createLibraryAsset(assetName: $assetName) {
+    ${LIBRARY_ASSET_WORKBENCH_SELECTION}
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "ConvertAutomationSubtreeToLibraryAsset",
+    apiKeyAccess: apiKeyAccessPolicies.libraryDenied,
+    kind: "mutation",
+    inputSchema: z28.object({
+      draftAutomationId: z28.string().min(1),
+      rootAgentId: z28.string().min(1),
+      baseVersionId: z28.string().min(1),
+      assetName: z28.string().trim().min(1).optional()
+    }),
+    cli: {
+      name: "convert-to-library-asset",
+      path: ["library", "convert"],
+      description: "Convert an agent and its descendants in a draft automation into a new shared library asset. Requires user login.",
+      resultKey: "convertAutomationSubtreeToLibraryAsset",
+      options: [
+        stringOption({
+          inputKey: "draftAutomationId",
+          flagName: "draft-automation-id",
+          description: "Draft automation ID.",
+          required: true
+        }),
+        stringOption({
+          inputKey: "rootAgentId",
+          flagName: "root-agent-id",
+          description: "Agent that becomes the asset root.",
+          required: true
+        }),
+        stringOption({
+          inputKey: "baseVersionId",
+          flagName: "base-version-id",
+          description: "Current draftVersionId from a fresh automation fetch.",
+          required: true
+        }),
+        stringOption({
+          inputKey: "assetName",
+          flagName: "name",
+          description: "Asset name. Renames the root agent; defaults to its current name."
+        })
+      ]
+    },
+    mcp: { fileName: "convertAutomationSubtreeToLibraryAsset.graphql" },
+    document: `mutation ConvertAutomationSubtreeToLibraryAsset(
+  $draftAutomationId: ID!
+  $rootAgentId: ID!
+  $baseVersionId: ID!
+  $assetName: String
+) {
+  convertAutomationSubtreeToLibraryAsset(
+    draftAutomationId: $draftAutomationId
+    rootAgentId: $rootAgentId
+    baseVersionId: $baseVersionId
+    assetName: $assetName
+  ) {
+    automationId
+    rootAgentId
+    libraryEntityId
+    libraryEntityVersionId
+    convertedAgentIds
+    draftVersionId
+    lastSavedAt
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "ImportLibraryAssetToAutomation",
+    apiKeyAccess: apiKeyAccessPolicies.libraryDenied,
+    kind: "mutation",
+    inputSchema: z28.object({
+      draftAutomationId: z28.string().min(1),
+      libraryEntityId: z28.string().min(1),
+      baseVersionId: z28.string().min(1),
+      parentAgentId: z28.string().min(1).optional()
+    }),
+    cli: {
+      name: "import-library-asset",
+      path: ["library", "import"],
+      description: "Import a shared library asset into a draft automation, optionally under a parent agent. The automation stays linked to the asset. Requires user login.",
+      resultKey: "importLibraryAssetToAutomation",
+      options: [
+        stringOption({
+          inputKey: "draftAutomationId",
+          flagName: "draft-automation-id",
+          description: "Draft automation ID.",
+          required: true
+        }),
+        stringOption({
+          inputKey: "libraryEntityId",
+          flagName: "library-entity-id",
+          description: "Library asset ID.",
+          required: true
+        }),
+        stringOption({
+          inputKey: "baseVersionId",
+          flagName: "base-version-id",
+          description: "Current draftVersionId from a fresh automation fetch.",
+          required: true
+        }),
+        stringOption({
+          inputKey: "parentAgentId",
+          flagName: "parent-agent-id",
+          description: "Existing agent to attach the asset under. Omit to add it top-level."
+        })
+      ]
+    },
+    mcp: { fileName: "importLibraryAssetToAutomation.graphql" },
+    document: `mutation ImportLibraryAssetToAutomation(
+  $draftAutomationId: ID!
+  $libraryEntityId: ID!
+  $baseVersionId: ID!
+  $parentAgentId: ID
+) {
+  importLibraryAssetToAutomation(
+    draftAutomationId: $draftAutomationId
+    libraryEntityId: $libraryEntityId
+    baseVersionId: $baseVersionId
+    parentAgentId: $parentAgentId
+  ) {
+    automationId
+    parentAgentId
+    rootAgentId
+    libraryEntityId
+    libraryEntityVersionId
+    importedAgentIds
+    draftVersionId
+    lastSavedAt
+  }
 }`
   }),
   createOperationSpec({
@@ -21536,18 +21886,18 @@ async function downloadAuthenticatedFileFromApi({
   organizationId,
   outputPath,
   overwrite = false,
-  path: path21,
+  path: path22,
   resolveApiBaseUrl,
   timeoutMs
 }) {
-  if (!path21.startsWith("/") || path21.startsWith("//")) {
+  if (!path22.startsWith("/") || path22.startsWith("//")) {
     throw new CliError(
       "Authenticated file download path must be relative to the configured Magical API."
     );
   }
   const normalizedApiBaseUrl = trimTrailingSlash(await resolveApiBaseUrl());
   const apiBaseResult = safeUrlConstructor(`${normalizedApiBaseUrl}/`);
-  const urlResult = safeUrlConstructor(`${normalizedApiBaseUrl}${path21}`);
+  const urlResult = safeUrlConstructor(`${normalizedApiBaseUrl}${path22}`);
   if (isErr(apiBaseResult) || isErr(urlResult) || urlResult.value.origin !== apiBaseResult.value.origin || !urlResult.value.pathname.startsWith(apiBaseResult.value.pathname)) {
     throw new CliError(
       "Authenticated file download path must stay within the configured Magical API."
@@ -21644,16 +21994,16 @@ function buildPathwayRegressionAgentVersionPath({
   leafPath,
   runsPerPath
 }) {
-  const path21 = `/pathway-regression/automation-versions/${encodeURIComponent(
+  const path22 = `/pathway-regression/automation-versions/${encodeURIComponent(
     automationVersionId
   )}/agent-versions/${encodeURIComponent(agentVersionId)}/${leafPath}`;
   if (runsPerPath === void 0) {
-    return path21;
+    return path22;
   }
   const queryParams = new URLSearchParams({
     runsPerPath: String(runsPerPath)
   });
-  return `${path21}?${queryParams.toString()}`;
+  return `${path22}?${queryParams.toString()}`;
 }
 function applyAuthenticationHeaders({
   accessToken,
@@ -21689,11 +22039,11 @@ function createFetchJson({
     accessToken,
     impersonatedOrganizationId,
     allowOttoAuthorization,
-    path: path21,
+    path: path22,
     init,
     organizationId
   }) {
-    const url = `${trimTrailingSlash(await resolveApiBaseUrl())}${path21}`;
+    const url = `${trimTrailingSlash(await resolveApiBaseUrl())}${path22}`;
     const usesWorkOSApiKey = isWorkOSApiKey(accessToken);
     const headers = new Headers(init?.headers);
     applyAuthenticationHeaders({
@@ -21893,7 +22243,7 @@ function createMagicalApiClient({
       organizationId,
       outputPath,
       overwrite = false,
-      path: path21,
+      path: path22,
       timeoutMs
     }) {
       await downloadAuthenticatedFileFromApi({
@@ -21906,7 +22256,7 @@ function createMagicalApiClient({
         ...maxSizeBytes === void 0 ? {} : { maxSizeBytes },
         outputPath,
         overwrite,
-        path: path21,
+        path: path22,
         resolveApiBaseUrl,
         ...timeoutMs === void 0 ? {} : { timeoutMs }
       });
@@ -29039,6 +29389,55 @@ function resolveOpenCommand(url) {
   return { executable: "xdg-open", args: [url] };
 }
 
+// src/operation-variables.ts
+import { readFile as readFile5 } from "node:fs/promises";
+import path16 from "node:path";
+function parseOperationVariables(operationSpec, variables) {
+  const parsedVariables = operationSpec.inputSchema.safeParse(variables);
+  if (!parsedVariables.success) {
+    throw new CliError(
+      parsedVariables.error.issues[0]?.message ?? "Invalid command input."
+    );
+  }
+  if (!isStringKeyedRecord(parsedVariables.data)) {
+    throw new CliError("Invalid command input.");
+  }
+  return parsedVariables.data;
+}
+async function resolveOperationVariables({
+  operationSpec,
+  variables,
+  options,
+  workingDirectory = process.cwd()
+}) {
+  return parseOperationVariables(
+    operationSpec,
+    operationSpec.operationName === "ImportAgents" ? {
+      ...variables,
+      data: await readAgentImportFile(options["file"], workingDirectory)
+    } : variables
+  );
+}
+async function readAgentImportFile(file, workingDirectory) {
+  if (typeof file !== "string" || !file.trim()) {
+    throw new CliError(
+      "Provide --file with the JSON file produced by agents export --json."
+    );
+  }
+  const contents = await fromThrowable(
+    async () => readFile5(path16.resolve(workingDirectory, file), "utf8"),
+    "read-file-error"
+  );
+  if (isErr(contents)) {
+    throw new CliError(`Could not read agent import file: ${file}`);
+  }
+  const parsed = safeJsonParseWithoutLogging(contents.value);
+  if (isErr(parsed)) {
+    throw new CliError("Agent import file is not valid JSON.");
+  }
+  return parsed.value;
+}
+
 // src/program-command-types.ts
 var SESSION_ONLY_API_KEY_MANAGEMENT_COMMANDS = /* @__PURE__ */ new Set([
   "auth keys list",
@@ -29777,7 +30176,7 @@ function addRunEvidenceCommands({
 // src/self-update.ts
 import { spawn as spawn3 } from "node:child_process";
 import fs2 from "node:fs";
-import path16 from "node:path";
+import path17 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var CLI_PACKAGE_NAME = "@getmagical/cli";
 var DEFAULT_CLI_DIST_TAG2 = "latest";
@@ -29788,9 +30187,9 @@ function resolveInstalledPackageRoot({
   packageName
 }) {
   const packagePathSegments = packageName.split("/");
-  let currentPath = path16.dirname(entryFilePath);
+  let currentPath = path17.dirname(entryFilePath);
   for (; ; ) {
-    const currentPathSegments = currentPath.split(path16.sep).filter(Boolean);
+    const currentPathSegments = currentPath.split(path17.sep).filter(Boolean);
     const currentPackageSegments = currentPathSegments.slice(
       -packagePathSegments.length
     );
@@ -29799,7 +30198,7 @@ function resolveInstalledPackageRoot({
     )) {
       return currentPath;
     }
-    const parentPath = path16.dirname(currentPath);
+    const parentPath = path17.dirname(currentPath);
     if (parentPath === currentPath) {
       return null;
     }
@@ -29809,14 +30208,14 @@ function resolveInstalledPackageRoot({
 function resolveInstallPrefixFromPackageRoot(packageRootPath) {
   let currentPath = packageRootPath;
   for (; ; ) {
-    if (path16.basename(currentPath) === "node_modules") {
-      const nodeModulesParentPath = path16.dirname(currentPath);
-      if (path16.basename(nodeModulesParentPath) === "lib") {
-        return path16.dirname(nodeModulesParentPath);
+    if (path17.basename(currentPath) === "node_modules") {
+      const nodeModulesParentPath = path17.dirname(currentPath);
+      if (path17.basename(nodeModulesParentPath) === "lib") {
+        return path17.dirname(nodeModulesParentPath);
       }
       return nodeModulesParentPath;
     }
-    const parentPath = path16.dirname(currentPath);
+    const parentPath = path17.dirname(currentPath);
     if (parentPath === currentPath) {
       return null;
     }
@@ -29833,13 +30232,13 @@ function resolveManagedNpmCommand(installPrefix) {
   if (process.platform === "win32") {
     return null;
   }
-  const managedNodeExecutable = path16.join(
+  const managedNodeExecutable = path17.join(
     installPrefix,
     MANAGED_NODE_SUBPATH,
     "bin",
     "node"
   );
-  const managedNpmCli = path16.join(
+  const managedNpmCli = path17.join(
     installPrefix,
     MANAGED_NODE_SUBPATH,
     "lib",
@@ -29938,8 +30337,8 @@ async function selfUpdateInstalledCli({
 }
 
 // src/settings.ts
-import { mkdir as mkdir4, readFile as readFile5, rm as rm4, writeFile as writeFile2 } from "node:fs/promises";
-import path17 from "node:path";
+import { mkdir as mkdir4, readFile as readFile6, rm as rm4, writeFile as writeFile2 } from "node:fs/promises";
+import path18 from "node:path";
 import { z as z44 } from "zod";
 var cliSettingsSchema = z44.object({
   env: z44.object({
@@ -29958,13 +30357,13 @@ function hasCliSettingsOverrides(settings) {
   return Object.values(settings.env).some((value) => value !== void 0);
 }
 function resolveSettingsFilePath(stateFilePath) {
-  return path17.join(path17.dirname(stateFilePath), CLI_SETTINGS_FILE_NAME);
+  return path18.join(path18.dirname(stateFilePath), CLI_SETTINGS_FILE_NAME);
 }
 function createFileSettingsStore(stateFilePath) {
   const settingsFilePath = resolveSettingsFilePath(stateFilePath);
   return {
     async load() {
-      const fileContents = await readFile5(settingsFilePath, "utf8").catch(
+      const fileContents = await readFile6(settingsFilePath, "utf8").catch(
         (error) => {
           if (error instanceof Error && "code" in error && error.code === "ENOENT") {
             return null;
@@ -29994,7 +30393,7 @@ function createFileSettingsStore(stateFilePath) {
         await rm4(settingsFilePath, { force: true });
         return;
       }
-      await mkdir4(path17.dirname(settingsFilePath), { recursive: true });
+      await mkdir4(path18.dirname(settingsFilePath), { recursive: true });
       await writeFile2(
         settingsFilePath,
         `${JSON.stringify(settings, null, 2)}
@@ -30162,14 +30561,14 @@ import {
   lstat as lstat2,
   mkdir as mkdir5,
   mkdtemp as mkdtemp2,
-  readFile as readFile6,
+  readFile as readFile7,
   readdir,
   rename as rename4,
   rm as rm5,
   writeFile as writeFile3
 } from "node:fs/promises";
 import os3 from "node:os";
-import path18 from "node:path";
+import path19 from "node:path";
 import { z as z45 } from "zod";
 var SKILLS_ROOT_PATH = "skills";
 var METADATA_DIRECTORY_NAME = "skill-working-copies";
@@ -30240,12 +30639,12 @@ function normalizeRootSkillPath(skill) {
   return `${SKILLS_ROOT_PATH}/${skillName}`;
 }
 function resolveWorkingCopyPath(workingDirectory, skillPath) {
-  return path18.resolve(workingDirectory, ...skillPath.split("/"));
+  return path19.resolve(workingDirectory, ...skillPath.split("/"));
 }
 function resolveMetadataPath(stateFilePath, workingCopyPath) {
   const key = createHash3("sha256").update(workingCopyPath).digest("hex");
-  return path18.join(
-    path18.dirname(stateFilePath),
+  return path19.join(
+    path19.dirname(stateFilePath),
     METADATA_DIRECTORY_NAME,
     `${key}.json`
   );
@@ -30273,7 +30672,7 @@ function metadataFilesToSnapshot(files) {
   );
 }
 async function loadMetadata(metadataPath) {
-  const fileContents = await readFile6(metadataPath, "utf8").catch(
+  const fileContents = await readFile7(metadataPath, "utf8").catch(
     (error) => {
       if (isMissingFileError3(error)) {
         return null;
@@ -30297,7 +30696,7 @@ async function loadMetadata(metadataPath) {
   return parsed.data;
 }
 async function saveMetadata(metadataPath, metadata) {
-  await mkdir5(path18.dirname(metadataPath), { recursive: true });
+  await mkdir5(path19.dirname(metadataPath), { recursive: true });
   const temporaryPath = `${metadataPath}.${randomUUID6()}.tmp`;
   await writeFile3(temporaryPath, `${JSON.stringify(metadata, null, 2)}
 `, {
@@ -30374,7 +30773,7 @@ async function readDirectorySnapshot({
         const nextSegments = [...segments, entry.name];
         const relativePath = nextSegments.join("/");
         assertSafeRelativeFilePath(relativePath);
-        const filePath = path18.join(currentDirectory, entry.name);
+        const filePath = path19.join(currentDirectory, entry.name);
         if (entry.isDirectory()) {
           return await visit(filePath, nextSegments);
         }
@@ -30383,7 +30782,7 @@ async function readDirectorySnapshot({
             `Skill working copy contains unsupported entry "${filePath}". Only regular files and directories are allowed.`
           );
         }
-        return [[`${skillPath}/${relativePath}`, await readFile6(filePath)]];
+        return [[`${skillPath}/${relativePath}`, await readFile7(filePath)]];
       })
     );
     return nestedEntries.flat();
@@ -30409,8 +30808,8 @@ async function writeSnapshotContents(rootPath, snapshot, prefix) {
     [...snapshot.entries()].map(async ([filePath, content]) => {
       const relativePath = prefix === null ? filePath : filePath.slice(`${prefix}/`.length);
       assertSafeRelativeFilePath(relativePath);
-      const targetPath = path18.join(rootPath, ...relativePath.split("/"));
-      await mkdir5(path18.dirname(targetPath), { recursive: true });
+      const targetPath = path19.join(rootPath, ...relativePath.split("/"));
+      await mkdir5(path19.dirname(targetPath), { recursive: true });
       await writeFile3(targetPath, content);
     })
   );
@@ -30420,11 +30819,11 @@ async function replaceWorkingCopy({
   skillPath,
   workingCopyPath
 }) {
-  const parentPath = path18.dirname(workingCopyPath);
+  const parentPath = path19.dirname(workingCopyPath);
   await mkdir5(parentPath, { recursive: true });
-  const temporaryPath = path18.join(
+  const temporaryPath = path19.join(
     parentPath,
-    `.mgcl-${path18.basename(workingCopyPath)}-${randomUUID6()}.tmp`
+    `.mgcl-${path19.basename(workingCopyPath)}-${randomUUID6()}.tmp`
   );
   const backupPath = `${workingCopyPath}.${randomUUID6()}.bak`;
   await mkdir5(temporaryPath);
@@ -30495,7 +30894,7 @@ async function clearDirectoryExceptGit(directoryPath) {
   const entries = await readdir(directoryPath);
   await Promise.all(
     entries.filter((entry) => entry !== ".git").map(async (entry) => {
-      await rm5(path18.join(directoryPath, entry), {
+      await rm5(path19.join(directoryPath, entry), {
         force: true,
         recursive: true
       });
@@ -30507,7 +30906,7 @@ async function createPatch(before, after) {
     return "";
   }
   const repositoryPath = await mkdtemp2(
-    path18.join(os3.tmpdir(), "mgcl-skills-diff-")
+    path19.join(os3.tmpdir(), "mgcl-skills-diff-")
   );
   const patchResult = await fromThrowable(async () => {
     await runGit(["init", "--quiet"], repositoryPath);
@@ -30829,8 +31228,8 @@ async function pushSkillWorkingCopy({
 }
 
 // src/state.ts
-import { mkdir as mkdir6, readFile as readFile7, rm as rm6, writeFile as writeFile4 } from "node:fs/promises";
-import path19 from "node:path";
+import { mkdir as mkdir6, readFile as readFile8, rm as rm6, writeFile as writeFile4 } from "node:fs/promises";
+import path20 from "node:path";
 import { z as z46 } from "zod";
 var cliAccountSchema = z46.object({
   clientId: z46.string().min(1),
@@ -30857,7 +31256,7 @@ function createFileStateStore(stateFilePath) {
     },
     async load() {
       try {
-        const fileContents = await readFile7(stateFilePath, "utf8");
+        const fileContents = await readFile8(stateFilePath, "utf8");
         const parsed = cliStateSchema.safeParse(JSON.parse(fileContents));
         if (!parsed.success) {
           throw new CliError("Stored CLI state is invalid.");
@@ -30874,7 +31273,7 @@ function createFileStateStore(stateFilePath) {
       }
     },
     async save(state) {
-      await mkdir6(path19.dirname(stateFilePath), { recursive: true });
+      await mkdir6(path20.dirname(stateFilePath), { recursive: true });
       await writeFile4(stateFilePath, `${JSON.stringify(state, null, 2)}
 `);
     }
@@ -30883,7 +31282,7 @@ function createFileStateStore(stateFilePath) {
 function createFileRefreshTokenStore(refreshTokenFilePath) {
   async function loadRefreshTokens() {
     try {
-      const fileContents = await readFile7(refreshTokenFilePath, "utf8");
+      const fileContents = await readFile8(refreshTokenFilePath, "utf8");
       const parsed = refreshTokenFileSchema.safeParse(JSON.parse(fileContents));
       if (!parsed.success) {
         throw new CliError("Stored refresh tokens are invalid.");
@@ -30902,7 +31301,7 @@ function createFileRefreshTokenStore(refreshTokenFilePath) {
     }
   }
   async function saveRefreshTokens(refreshTokens) {
-    await mkdir6(path19.dirname(refreshTokenFilePath), { recursive: true });
+    await mkdir6(path20.dirname(refreshTokenFilePath), { recursive: true });
     await writeFile4(
       refreshTokenFilePath,
       `${JSON.stringify(refreshTokens, null, 2)}
@@ -31234,18 +31633,6 @@ function collectOperationVariableInput(operationSpec, options) {
   }
   return variables;
 }
-function parseOperationVariables(operationSpec, variables) {
-  const parsedVariables = operationSpec.inputSchema.safeParse(variables);
-  if (!parsedVariables.success) {
-    throw new CliError(
-      parsedVariables.error.issues[0]?.message ?? "Invalid command input."
-    );
-  }
-  if (!isRecord7(parsedVariables.data)) {
-    throw new CliError("Invalid command input.");
-  }
-  return parsedVariables.data;
-}
 async function handleSelfUpdate(dependencies, options) {
   const { selfUpdateCli } = dependencies;
   if (!selfUpdateCli) {
@@ -31290,7 +31677,12 @@ async function handleOperationCommand(dependencies, operationSpec, commandOption
     runtime: dependencies.classifyCommandRuntime,
     workingDirectory: dependencies.workingDirectory ?? process.cwd()
   });
-  const variables = parseOperationVariables(operationSpec, operationVariables);
+  const variables = await resolveOperationVariables({
+    operationSpec,
+    variables: operationVariables,
+    options: commandOptions,
+    workingDirectory: dependencies.workingDirectory
+  });
   const apiKeyEnvironment = getApiKeyEnvironment(
     dependencies,
     commandOptions.apiKey
@@ -32323,12 +32715,12 @@ function createDefaultDependencies() {
     return resolveDeploymentTarget({ savedEnv: settings.env, selectors });
   };
   const resolveApiBaseUrl = () => deploymentTargetContext.get().apiUrl;
-  const accessTokenFilePath = runtimeConfig.accessTokenFilePath ?? path20.join(
-    path20.dirname(runtimeConfig.stateFilePath),
+  const accessTokenFilePath = runtimeConfig.accessTokenFilePath ?? path21.join(
+    path21.dirname(runtimeConfig.stateFilePath),
     CLI_ACCESS_TOKEN_FILE_NAME
   );
-  const refreshTokenFilePath = runtimeConfig.refreshTokenFilePath ?? path20.join(
-    path20.dirname(runtimeConfig.stateFilePath),
+  const refreshTokenFilePath = runtimeConfig.refreshTokenFilePath ?? path21.join(
+    path21.dirname(runtimeConfig.stateFilePath),
     CLI_REFRESH_TOKEN_FILE_NAME
   );
   const selfUpdateOptions = {
@@ -32346,8 +32738,8 @@ function createDefaultDependencies() {
     io: createConsoleIo(),
     openExternalUrl,
     orgPreferencesStore: createFileOrgPreferencesStore(
-      path20.join(
-        path20.dirname(runtimeConfig.stateFilePath),
+      path21.join(
+        path21.dirname(runtimeConfig.stateFilePath),
         "organization-preferences"
       )
     ),