@gizai/cli 1.0.0

package/README.md

@@ -0,0 +1,37 @@
+# Giz CLI
+
+Connect once in the browser, then use every live Giz non-LLM model, Drive, and Computer from a terminal or AI agent.
+
+```bash
+npm install -g @gizai/cli
+giz auth login
+giz generate image "A paper observatory at blue hour"
+```
+
+Discover a model's live inputs, upload local media, and run it:
+
+```bash
+giz model list --type video-generation
+giz model get ltx2-distilled
+giz model run ltx2-distilled \
+  --input '{"prompt":"A slow camera push through morning fog"}' \
+  --upload image=./first-frame.png
+```
+
+Remote MCP:
+
+```bash
+giz mcp add codex
+giz mcp add claude
+```
+
+Agent Skill:
+
+```bash
+giz skill install
+```
+
+The CLI stores rotating OAuth credentials in `~/.config/giz/credentials.json` with mode `0600`. It never asks for or stores a Giz password.
+Set `GIZ_TOKEN` only for ephemeral automation. Run `giz --help` for Drive, Computer, job, upload, and raw tool commands.
+
+Documentation: <https://www.giz.ai/mcp/>

package/cli/giz.mjs

@@ -0,0 +1,681 @@
+#!/usr/bin/env node
+import { createHash, randomBytes } from 'node:crypto'
+import { openAsBlob } from 'node:fs'
+import { chmod, mkdir, readFile, unlink, writeFile } from 'node:fs/promises'
+import { createServer } from 'node:http'
+import os from 'node:os'
+import path from 'node:path'
+import { spawn, spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const DEFAULT_URL = 'https://www.giz.ai'
+const CALLBACK_URL = 'http://127.0.0.1:53682/callback'
+const CLIENT_ID = 'giz-cli'
+const SCOPES = ['giz.read', 'giz.write', 'giz.execute', 'giz.destructive', 'offline_access']
+const BOOLEAN_OPTIONS = new Set(['help', 'json', 'no-open', 'version'])
+const configPath = process.env.GIZ_CONFIG ||
+  path.join(os.homedir(), '.config', 'giz', 'credentials.json')
+
+class CliError extends Error {
+  constructor(message, hint, status) {
+    super(message)
+    this.hint = hint
+    this.status = status
+  }
+}
+
+function parse(argv) {
+  const positionals = []
+  const options = {}
+  for (let index = 0; index < argv.length; index += 1) {
+    const value = argv[index]
+    if (value === '--') {
+      positionals.push(...argv.slice(index + 1))
+      break
+    }
+    if (!value.startsWith('--')) {
+      positionals.push(value)
+      continue
+    }
+    const [rawName, inline] = value.slice(2).split(/=(.*)/s, 2)
+    const next = argv[index + 1]
+    const parsed = inline !== undefined
+      ? inline
+      : BOOLEAN_OPTIONS.has(rawName) || !next || next.startsWith('--')
+        ? true
+        : next
+    if (rawName === 'upload') {
+      options.upload = [...(Array.isArray(options.upload) ? options.upload : []), parsed]
+    } else {
+      options[rawName] = parsed
+    }
+    if (inline === undefined && parsed !== true) index += 1
+  }
+  return { positionals, options }
+}
+
+async function readConfig() {
+  try {
+    return JSON.parse(await readFile(configPath, 'utf8'))
+  } catch (error) {
+    if (error?.code === 'ENOENT') return undefined
+    throw new CliError('Could not read Giz credentials.', `Remove or repair ${configPath}.`)
+  }
+}
+
+async function saveConfig(config) {
+  await mkdir(path.dirname(configPath), { recursive: true })
+  await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 })
+  await chmod(configPath, 0o600)
+}
+
+async function discovery(baseUrl) {
+  const response = await fetch(new URL('/.well-known/oauth-authorization-server', baseUrl))
+  if (!response.ok) {
+    throw new CliError(
+      `OAuth discovery failed: HTTP ${response.status}.`,
+      `Check ${new URL('/.well-known/oauth-authorization-server', baseUrl)}.`
+    )
+  }
+  return await response.json()
+}
+
+async function refresh(config) {
+  if (!config?.refresh_token) {
+    throw new CliError('Not authenticated.', 'Run: giz auth login')
+  }
+  const metadata = await discovery(config.baseUrl)
+  const body = new URLSearchParams({
+    grant_type: 'refresh_token',
+    client_id: CLIENT_ID,
+    refresh_token: config.refresh_token,
+    resource: new URL('/api/mcp', config.baseUrl).href
+  })
+  const response = await fetch(metadata.token_endpoint, {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body
+  })
+  const payload = await response.json()
+  if (!response.ok) {
+    throw new CliError(
+      payload.error_description || payload.error || 'Giz session could not be refreshed.',
+      'Run: giz auth login'
+    )
+  }
+  const next = {
+    ...config,
+    ...payload,
+    refresh_token: payload.refresh_token || config.refresh_token,
+    expires_at: Date.now() + Number(payload.expires_in || 3600) * 1000
+  }
+  await saveConfig(next)
+  return next
+}
+
+async function credentials(baseUrl, forceRefresh = false) {
+  if (process.env.GIZ_TOKEN) return { access_token: process.env.GIZ_TOKEN, baseUrl }
+  let config = await readConfig()
+  if (!config?.access_token) throw new CliError('Not authenticated.', 'Run: giz auth login')
+  if (String(config.baseUrl).replace(/\/+$/, '') !== baseUrl) {
+    throw new CliError(
+      `Credentials belong to ${config.baseUrl}.`,
+      `Run: giz auth login --base-url ${baseUrl}`
+    )
+  }
+  if (forceRefresh || Number(config.expires_at || 0) <= Date.now() + 60_000) config = await refresh(config)
+  return config
+}
+
+async function api(baseUrl, pathname, data, options = {}) {
+  const run = async (forceRefresh = false) => {
+    const auth = await credentials(baseUrl, forceRefresh)
+    const response = await fetch(new URL(pathname, baseUrl), {
+      method: data === undefined ? 'GET' : 'POST',
+      headers: {
+        accept: 'application/json',
+        ...(data === undefined ? {} : { 'content-type': 'application/json' }),
+        authorization: `Bearer ${auth.access_token}`
+      },
+      ...(data === undefined ? {} : { body: JSON.stringify(data) })
+    })
+    const text = await response.text()
+    let payload
+    try {
+      payload = text ? JSON.parse(text) : null
+    } catch {
+      payload = { message: text.slice(0, 500) }
+    }
+    return { response, payload }
+  }
+  let result = await run()
+  if (result.response.status === 401 && !process.env.GIZ_TOKEN && !options.refreshed) {
+    result = await run(true)
+  }
+  if (!result.response.ok) {
+    const required = result.response.status === 403 ? result.payload?.message : undefined
+    throw new CliError(
+      result.payload?.message || `Giz API returned HTTP ${result.response.status}.`,
+      required?.includes('scope') ? 'Run: giz auth login' : 'Run with --json for the complete error.',
+      result.response.status
+    )
+  }
+  return result.payload
+}
+
+async function uploadMedia(baseUrl, localFile) {
+  const filePath = path.resolve(String(localFile))
+  const run = async (forceRefresh = false) => {
+    const auth = await credentials(baseUrl, forceRefresh)
+    let file
+    try {
+      file = await openAsBlob(filePath)
+    } catch (error) {
+      throw new CliError(`Could not open ${filePath}.`, String(error?.message || error))
+    }
+    const body = new FormData()
+    body.append('file', file, path.basename(filePath))
+    const response = await fetch(new URL('/api/storage/media', baseUrl), {
+      method: 'POST',
+      headers: {
+        accept: 'application/json',
+        authorization: `Bearer ${auth.access_token}`
+      },
+      body
+    })
+    const text = await response.text()
+    let payload
+    try {
+      payload = text ? JSON.parse(text) : null
+    } catch {
+      payload = { message: text.slice(0, 500) }
+    }
+    return { response, payload }
+  }
+  let result = await run()
+  if (result.response.status === 401 && !process.env.GIZ_TOKEN) result = await run(true)
+  if (!result.response.ok) {
+    throw new CliError(
+      result.payload?.message || `Giz upload returned HTTP ${result.response.status}.`,
+      'Check the file and your Giz storage access.'
+    )
+  }
+  const url = String(result.payload?.url || '').trim()
+  const drivePath = String(result.payload?.path || '').trim()
+  if (!url || !drivePath) throw new CliError('Giz upload returned an incomplete file reference.', 'Try the upload again.')
+  return { ...result.payload, url: new URL(url, baseUrl).href }
+}
+
+async function login(baseUrl, options) {
+  const metadata = await discovery(baseUrl)
+  const verifier = randomBytes(48).toString('base64url')
+  const challenge = createHash('sha256').update(verifier).digest('base64url')
+  const state = randomBytes(24).toString('base64url')
+  const callback = waitForCallback(state)
+  const authorization = new URL(metadata.authorization_endpoint)
+  for (const [name, value] of Object.entries({
+    response_type: 'code',
+    client_id: CLIENT_ID,
+    redirect_uri: CALLBACK_URL,
+    scope: SCOPES.join(' '),
+    resource: new URL('/api/mcp', baseUrl).href,
+    code_challenge: challenge,
+    code_challenge_method: 'S256',
+    prompt: 'consent',
+    state
+  })) authorization.searchParams.set(name, value)
+  process.stdout.write(`Opening Giz sign-in:\n${authorization}\n`)
+  if (options.open !== 'false' && options['no-open'] !== true) openBrowser(authorization.href)
+  const code = await callback
+  const response = await fetch(metadata.token_endpoint, {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      grant_type: 'authorization_code',
+      client_id: CLIENT_ID,
+      redirect_uri: CALLBACK_URL,
+      code,
+      code_verifier: verifier,
+      resource: new URL('/api/mcp', baseUrl).href
+    })
+  })
+  const payload = await response.json()
+  if (!response.ok) {
+    throw new CliError(payload.error_description || payload.error || 'OAuth token exchange failed.', 'Run: giz auth login')
+  }
+  await saveConfig({
+    baseUrl,
+    ...payload,
+    expires_at: Date.now() + Number(payload.expires_in || 3600) * 1000
+  })
+  return await api(baseUrl, '/api/external/me')
+}
+
+function waitForCallback(expectedState) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      server.close()
+      reject(new CliError('Giz sign-in timed out.', 'Run: giz auth login'))
+    }, 5 * 60 * 1000)
+    const server = createServer((request, response) => {
+      const url = new URL(request.url || '/', CALLBACK_URL)
+      if (url.pathname !== '/callback') {
+        response.writeHead(404).end('Not found')
+        return
+      }
+      const finish = (error, code) => {
+        clearTimeout(timer)
+        response.setHeader('content-type', 'text/html; charset=utf-8')
+        response.end(error
+          ? '<h1>Giz connection failed</h1><p>Return to the terminal for details.</p>'
+          : '<h1>Giz connected</h1><p>You can close this window and return to the terminal.</p>')
+        server.close()
+        error ? reject(error) : resolve(code)
+      }
+      if (url.searchParams.get('state') !== expectedState) {
+        finish(new CliError('OAuth state did not match.', 'Run: giz auth login'))
+      } else if (url.searchParams.get('error')) {
+        finish(new CliError(
+          url.searchParams.get('error_description') || url.searchParams.get('error'),
+          'Run: giz auth login'
+        ))
+      } else if (!url.searchParams.get('code')) {
+        finish(new CliError('OAuth callback did not include a code.', 'Run: giz auth login'))
+      } else {
+        finish(undefined, url.searchParams.get('code'))
+      }
+    })
+    server.on('error', (error) => {
+      clearTimeout(timer)
+      reject(new CliError(
+        `Could not listen on ${CALLBACK_URL}: ${error.message}`,
+        'Close the process using port 53682 and run: giz auth login'
+      ))
+    })
+    server.listen(53682, '127.0.0.1')
+  })
+}
+
+function openBrowser(url) {
+  const command = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open'
+  const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url]
+  const child = spawn(command, args, { detached: true, stdio: 'ignore' })
+  child.on('error', () => {})
+  child.unref()
+}
+
+function jsonInput(value) {
+  if (value === undefined || value === true) return {}
+  try {
+    const parsed = JSON.parse(value)
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error()
+    return parsed
+  } catch {
+    throw new CliError('--input must be one JSON object.', 'Example: --input \'{"prompt":"A quiet ocean"}\'')
+  }
+}
+
+function required(value, name, example) {
+  if (value) return value
+  throw new CliError(`${name} is required.`, example)
+}
+
+async function applyUploads(baseUrl, input, values = []) {
+  for (const value of values.filter((item) => item !== undefined)) {
+    const separator = String(value).indexOf('=')
+    if (separator < 1 || separator === String(value).length - 1) {
+      throw new CliError(
+        '--upload must be FIELD=LOCAL_PATH.',
+        'Example: --upload image=./first-frame.png'
+      )
+    }
+    const field = String(value).slice(0, separator).trim()
+    const localFile = String(value).slice(separator + 1).trim()
+    const stored = await uploadMedia(baseUrl, localFile)
+    const current = input[field]
+    input[field] = current === undefined ? stored.url : Array.isArray(current) ? [...current, stored.url] : [current, stored.url]
+  }
+  return input
+}
+
+async function invoke(baseUrl, tool, input) {
+  return await api(baseUrl, `/api/tools/${encodeURIComponent(tool)}`, input)
+}
+
+async function runCommand(baseUrl, positionals, options) {
+  const [command, subcommand, ...rest] = positionals
+  if (options.version === true) return { kind: 'message', value: '1.0.0' }
+  if (!command || command === 'help' || options.help === true) return { kind: 'help', value: help(command) }
+  if (command === 'auth' && subcommand === 'login') {
+    return { kind: 'auth', value: await login(baseUrl, options) }
+  }
+  if (command === 'auth' && subcommand === 'status') {
+    return { kind: 'auth', value: await api(baseUrl, '/api/external/me') }
+  }
+  if (command === 'auth' && subcommand === 'logout') {
+    const config = await readConfig()
+    if (config?.refresh_token) {
+      const metadata = await discovery(baseUrl)
+      await fetch(metadata.revocation_endpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          token: config.refresh_token,
+          token_type_hint: 'refresh_token',
+          client_id: CLIENT_ID
+        })
+      })
+    }
+    await unlink(configPath).catch((error) => {
+      if (error?.code !== 'ENOENT') throw error
+    })
+    return { kind: 'message', value: 'Signed out of Giz on this device.' }
+  }
+
+  if (command === 'model' && subcommand === 'list') {
+    return {
+      kind: 'models',
+      value: await invoke(baseUrl, 'model.list', {
+        ...(options.type ? { type: options.type } : {}),
+        ...(options.search ? { search: options.search } : {})
+      })
+    }
+  }
+  if (command === 'model' && subcommand === 'get') {
+    const model = required(rest[0] || options.model, 'MODEL', 'Run: giz model get MODEL')
+    return { kind: 'model', value: await invoke(baseUrl, 'model.get', { model }) }
+  }
+  if (command === 'model' && subcommand === 'run') {
+    const model = required(rest[0] || options.model, 'MODEL', 'Run: giz model run MODEL --input JSON')
+    const input = await applyUploads(baseUrl, jsonInput(options.input), options.upload)
+    return { kind: 'job', value: await invoke(baseUrl, 'model.run', { model, input }) }
+  }
+  if (command === 'models') {
+    throw new CliError('Unknown command "models".', 'Did you mean: giz model list')
+  }
+
+  if (command === 'generate' && ['image', 'video', 'audio', 'music', 'talking-head'].includes(subcommand)) {
+    const tool = {
+      image: 'generateImage',
+      video: 'generateVideo',
+      audio: 'generateAudio',
+      music: 'generateMusic',
+      'talking-head': 'generateTalkingHead'
+    }[subcommand]
+    const uploads = [
+      ...(Array.isArray(options.upload) ? options.upload : []),
+      ...(options.image ? [`references=${options.image}`] : []),
+      ...(options.audio ? [`audio=${options.audio}`] : [])
+    ]
+    const input = await applyUploads(baseUrl, {
+      ...jsonInput(options.input),
+      ...(rest.length ? { prompt: rest.join(' ') } : {}),
+      ...(options.model ? { model: options.model } : {})
+    }, uploads)
+    required(input.prompt, 'PROMPT', `Run: giz generate ${subcommand} "your prompt"`)
+    return { kind: 'job', value: await invoke(baseUrl, tool, input) }
+  }
+
+  if (command === 'job' && subcommand === 'list') {
+    return { kind: 'jobs', value: await invoke(baseUrl, 'job.list', options.limit ? { limit: Number(options.limit) } : {}) }
+  }
+  if (command === 'job' && subcommand === 'get') {
+    const job = required(rest[0], 'JOB', 'Run: giz job get JOB')
+    return { kind: 'job', value: await invoke(baseUrl, 'job.get', { job }) }
+  }
+  if (command === 'job' && subcommand === 'cancel') {
+    const job = required(rest[0], 'JOB', 'Run: giz job cancel JOB')
+    return { kind: 'job', value: await invoke(baseUrl, 'job.cancel', { job }) }
+  }
+  if (command === 'job' && subcommand === 'wait') {
+    const id = required(rest[0], 'JOB', 'Run: giz job wait JOB')
+    while (true) {
+      const job = await invoke(baseUrl, 'job.get', { job: id })
+      if (['completed', 'failed', 'cancelled'].includes(job.status)) return { kind: 'job', value: job }
+      if (process.stderr.isTTY) process.stderr.write(`\r${job.id}  ${job.status}  ${job.message || ''}`.slice(0, 120))
+      await new Promise((resolve) => setTimeout(resolve, 1000))
+    }
+  }
+
+  if (command === 'drive') {
+    const mappings = {
+      list: () => ['drive.list', { path: rest[0] || '' }],
+      search: () => ['drive.search', { query: required(rest.join(' '), 'QUERY', 'Run: giz drive search QUERY') }],
+      read: () => ['drive.readFile', { path: required(rest[0], 'PATH', 'Run: giz drive read PATH') }],
+      mkdir: () => ['drive.makeDirectory', { path: required(rest[0], 'PATH', 'Run: giz drive mkdir PATH') }],
+      move: () => ['drive.movePath', {
+        from: required(rest[0], 'FROM', 'Run: giz drive move FROM TO'),
+        to: required(rest[1], 'TO', 'Run: giz drive move FROM TO')
+      }],
+      delete: () => ['drive.deletePath', { path: required(rest[0], 'PATH', 'Run: giz drive delete PATH') }]
+    }
+    if (subcommand === 'write') {
+      const drivePath = required(rest[0], 'PATH', 'Run: giz drive write PATH --content TEXT')
+      let content = options.content
+      let encoding = 'utf8'
+      if (options.file) {
+        const buffer = await readFile(String(options.file))
+        content = buffer.toString('base64')
+        encoding = 'base64'
+      }
+      required(content, 'CONTENT', 'Use --content TEXT or --file LOCAL_PATH.')
+      return {
+        kind: 'result',
+        value: await invoke(baseUrl, 'drive.writeFile', {
+          path: drivePath,
+          content: String(content),
+          encoding,
+          ...(options.computer ? { computerId: options.computer } : {})
+        })
+      }
+    }
+    const mapping = mappings[subcommand]
+    if (!mapping) throw new CliError(`Unknown drive command "${subcommand || ''}".`, 'Run: giz drive --help')
+    const [tool, input] = mapping()
+    return {
+      kind: 'result',
+      value: await invoke(baseUrl, tool, { ...input, ...(options.computer ? { computerId: options.computer } : {}) })
+    }
+  }
+
+  if (command === 'upload') {
+    const localFile = required(subcommand, 'LOCAL_PATH', 'Run: giz upload ./reference.png')
+    return { kind: 'result', value: await uploadMedia(baseUrl, localFile) }
+  }
+
+  if (command === 'computer') {
+    if (subcommand === 'list') return { kind: 'computers', value: await invoke(baseUrl, 'computer.list', {}) }
+    const computerId = rest[0] || options.computer
+    if (subcommand === 'get') return { kind: 'result', value: await invoke(baseUrl, 'computer.get', computerId ? { computerId } : {}) }
+    if (subcommand === 'start' || subcommand === 'stop') {
+      return {
+        kind: 'result',
+        value: await invoke(baseUrl, `computer.${subcommand}`, computerId ? { computerId } : {})
+      }
+    }
+    if (subcommand === 'exec') {
+      const commandArgs = rest
+      if (!commandArgs.length) throw new CliError('COMMAND is required.', 'Run: giz computer exec -- ls -la')
+      return {
+        kind: 'result',
+        value: await invoke(baseUrl, 'container.exec', {
+          command: commandArgs,
+          sessionId: String(options.session || 'giz-cli'),
+          ...(options.cwd ? { cwd: options.cwd } : {}),
+          ...(options.computer ? { computerId: options.computer } : {})
+        })
+      }
+    }
+    throw new CliError(`Unknown computer command "${subcommand || ''}".`, 'Run: giz computer --help')
+  }
+
+  if (command === 'invoke') {
+    const tool = required(subcommand, 'TOOL', 'Run: giz invoke TOOL --input JSON')
+    return { kind: 'result', value: await invoke(baseUrl, tool, jsonInput(options.input)) }
+  }
+
+  if (command === 'mcp' && subcommand === 'url') {
+    return { kind: 'message', value: new URL('/api/mcp', baseUrl).href }
+  }
+  if (command === 'mcp' && subcommand === 'add') {
+    const client = required(rest[0], 'CLIENT', 'Run: giz mcp add codex|claude')
+    const endpoint = new URL('/api/mcp', baseUrl).href
+    if (client === 'codex') {
+      runExternal('codex', ['mcp', 'add', 'giz', '--url', endpoint, '--oauth-resource', endpoint], 'Install Codex CLI first.')
+      runExternal('codex', ['mcp', 'login', 'giz', '--scopes', SCOPES.join(',')], 'Run: codex mcp login giz')
+      return { kind: 'message', value: 'Giz is connected to Codex.' }
+    }
+    if (client === 'claude') {
+      runExternal('claude', ['mcp', 'add', '--transport', 'http', '--scope', 'user', 'giz', endpoint], 'Install Claude Code first.')
+      return { kind: 'message', value: 'Giz was added to Claude Code. Open Claude Code and run /mcp to sign in.' }
+    }
+    throw new CliError(`Unsupported MCP client "${client}".`, 'Supported clients: codex, claude')
+  }
+
+  if (command === 'skill' && subcommand === 'install') {
+    const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'skills')
+    runExternal('npx', ['--yes', 'skills', 'add', root, '--all'], 'Install Node.js 20 or newer first.')
+    return { kind: 'message', value: 'Giz Skill installed for available AI agents.' }
+  }
+
+  throw new CliError(`Unknown command "${[command, subcommand].filter(Boolean).join(' ')}".`, 'Run: giz --help')
+}
+
+function runExternal(command, args, hint) {
+  const result = spawnSync(command, args, { stdio: 'inherit' })
+  if (result.error?.code === 'ENOENT') throw new CliError(`${command} is not installed.`, hint)
+  if (result.status !== 0) throw new CliError(`${command} exited with status ${result.status}.`, hint)
+}
+
+function print(kind, value, json) {
+  if (json) {
+    process.stdout.write(`${JSON.stringify(value, null, 2)}\n`)
+    return
+  }
+  if (kind === 'help' || kind === 'message') {
+    process.stdout.write(`${value}\n`)
+    return
+  }
+  if (kind === 'models') {
+    const rows = value.models || []
+    for (const model of rows) process.stdout.write(`${model.id}\t${model.type}\t${model.provider || '-'}\t${model.label}\n`)
+    process.stdout.write(`\n${rows.length} models\n`)
+    return
+  }
+  if (kind === 'jobs') {
+    for (const job of value.jobs || []) process.stdout.write(`${job.id}\t${job.status}\t${job.tool}\t${job.createdAt}\n`)
+    return
+  }
+  if (kind === 'computers') {
+    for (const computer of value.computers || []) {
+      process.stdout.write(`${computer.id}\t${computer.status || '-'}\t${computer.isDefault ? 'default' : '-'}\t${computer.name}\n`)
+    }
+    return
+  }
+  if (kind === 'job') {
+    process.stdout.write(`${value.id}  ${value.status}\n`)
+    if (value.message) process.stdout.write(`${value.message}\n`)
+    if (value.error) process.stdout.write(`Error: ${value.error}\n`)
+    if (value.result) process.stdout.write(`${JSON.stringify(value.result, null, 2)}\n`)
+    if (!['completed', 'failed', 'cancelled'].includes(value.status)) {
+      process.stdout.write(`Run: giz job wait ${value.id}\n`)
+    }
+    return
+  }
+  process.stdout.write(`${JSON.stringify(value, null, 2)}\n`)
+}
+
+function help(command) {
+  if (command === 'model') return `Usage
+  giz model list [--type TYPE] [--search TEXT]
+  giz model get MODEL
+  giz model run MODEL --input JSON [--upload FIELD=LOCAL_PATH]
+
+Run model get first. Its live input schema is the source of truth. Repeat --upload for multiple media inputs.`
+  if (command === 'generate') return `Usage
+  giz generate image|video|audio|music|talking-head "PROMPT" [--model MODEL]
+
+Options
+  --image LOCAL_PATH       Upload a visual reference
+  --audio LOCAL_PATH       Upload speech audio
+  --upload FIELD=PATH      Upload into an exact tool field
+  --input JSON             Additional generation parameters`
+  if (command === 'drive') return `Usage
+  giz drive list [PATH]
+  giz drive search QUERY
+  giz drive read PATH
+  giz drive write PATH --content TEXT
+  giz drive write PATH --file LOCAL_PATH
+  giz drive mkdir PATH
+  giz drive move FROM TO
+  giz drive delete PATH`
+  if (command === 'computer') return `Usage
+  giz computer list
+  giz computer get|start|stop [COMPUTER]
+  giz computer exec [--computer COMPUTER] [--cwd PATH] -- COMMAND [ARGS...]`
+  if (command === 'mcp') return `Usage
+  giz mcp url
+  giz mcp add codex
+  giz mcp add claude`
+  if (command === 'auth') return `Usage
+  giz auth login
+  giz auth status
+  giz auth logout`
+  return `Giz CLI — non-LLM models, Drive, and Computer from any terminal
+
+Usage
+  giz auth login
+  giz model list [--type TYPE] [--search TEXT]
+  giz model get MODEL
+  giz model run MODEL --input JSON [--upload FIELD=LOCAL_PATH]
+  giz generate image|video|audio|music "PROMPT" [--model MODEL]
+  giz job list|get|wait|cancel [JOB]
+  giz drive list|search|read|write|mkdir|move|delete
+  giz upload LOCAL_PATH
+  giz computer list|get|start|stop|exec
+  giz mcp add codex|claude
+  giz skill install
+  giz invoke TOOL --input JSON
+
+Examples
+  giz auth login
+  giz generate image "A paper observatory at blue hour"
+  giz model list --type video-generation
+  giz model run ltx2-distilled --input '{"prompt":"A slow dolly in"}' --upload image=./first-frame.png
+  giz generate talking-head "Welcome to Giz" --image ./face.png
+  giz drive write notes/brief.md --file ./brief.md
+  giz computer exec --computer ctr_123 -- python --version
+  giz mcp add codex
+
+Global options
+  --json                 Machine-readable JSON output
+  --base-url URL         Another Giz deployment
+  --no-open              Print the login URL without opening a browser
+
+Docs: https://www.giz.ai/mcp/`
+}
+
+async function main() {
+  const { positionals, options } = parse(process.argv.slice(2))
+  const saved = await readConfig()
+  const baseUrl = String(options['base-url'] || process.env.GIZ_URL || saved?.baseUrl || DEFAULT_URL).replace(/\/+$/, '')
+  const output = await runCommand(baseUrl, positionals, options)
+  print(output.kind, output.value, options.json === true)
+}
+
+main().catch((error) => {
+  const { options } = parse(process.argv.slice(2))
+  if (options.json === true) {
+    process.stderr.write(`${JSON.stringify({
+      error: {
+        message: String(error?.message || error),
+        ...(error?.hint ? { hint: error.hint } : {}),
+        ...(error?.status ? { status: error.status } : {})
+      }
+    }, null, 2)}\n`)
+  } else {
+    process.stderr.write(`Error: ${String(error?.message || error)}\n`)
+    if (error?.hint) process.stderr.write(`Hint: ${error.hint}\n`)
+  }
+  process.exitCode = 1
+})

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@gizai/cli",
+  "version": "1.0.0",
+  "description": "Giz CLI, MCP installer, and agent Skills for non-LLM models, Drive, and Computer",
+  "type": "module",
+  "bin": {
+    "giz": "cli/giz.mjs"
+  },
+  "files": [
+    "cli",
+    "skills",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "giz",
+    "mcp",
+    "ai",
+    "image",
+    "video",
+    "audio",
+    "agent"
+  ],
+  "license": "UNLICENSED",
+  "homepage": "https://www.giz.ai/mcp/",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/exinno/giz.git",
+    "directory": "apps/space/external"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "check": "node --check cli/giz.mjs"
+  }
+}

package/skills/giz/SKILL.md

@@ -0,0 +1,60 @@
+---
+name: giz
+description: Use Giz non-LLM image, video, audio, music, speech, Drive, and Computer capabilities from an AI agent. Trigger when the user asks to generate or transform media with Giz, inspect or modify Giz Drive files, operate a Giz Computer or terminal, or discover live Giz models and their parameters.
+---
+
+# Giz
+
+Use the `giz` CLI or the configured Giz MCP server. Prefer MCP when available and the CLI when working in a shell.
+
+## Workflow
+
+1. Run `model_list` before selecting an unfamiliar media model.
+2. Run `model_get` and treat its live input schema as the source of truth.
+3. Call `model_run` with the exact model ID and supported inputs. For simple prompt-only work, use `generate_image`, `generate_video`, `generate_audio`, `generate_music`, or `generate_talking_head`.
+4. Generation returns a durable job. Poll `job_get`; do not resubmit while it is queued or processing.
+5. Preserve completed Drive URLs and paths. Use Drive tools to inspect or organize results.
+6. Use Computer tools only when the task requires a shell or runtime. Reuse one terminal `sessionId` per conversation.
+7. Ask for explicit confirmation immediately before destructive Drive removal, Computer runtime changes, or commands with material side effects.
+
+## CLI
+
+Connect once in a browser:
+
+```bash
+giz auth login
+```
+
+Discover and generate:
+
+```bash
+giz model list --type image-generation
+giz model get MODEL_ID
+giz model run MODEL_ID --input '{"prompt":"..."}'
+```
+
+Upload local media into an exact model field:
+
+```bash
+giz model run MODEL_ID \
+  --input '{"prompt":"Animate this frame"}' \
+  --upload image=./frame.png
+```
+
+Invoke an exact item-driven tool:
+
+```bash
+giz invoke drive.readFile --input '{"path":"notes/brief.md"}'
+```
+
+Pass `--json` for machine output. Use `GIZ_TOKEN` only in ephemeral automation.
+
+## Boundaries
+
+- Do not guess model ids, parameter names, enum values, or costs.
+- Do not use text-generation models; this integration intentionally exposes non-LLM models only.
+- Do not turn argv arrays into shell strings.
+- Do not read binary Drive content unless the task needs it; prefer returned URLs and metadata.
+- Do not retry failed generations blindly. Report the provider or contract error.
+
+Read [references/operations.md](references/operations.md) when MCP discovery is unavailable or when choosing between Drive and Computer tools.

package/skills/giz/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Giz"
+  short_description: "Use Giz media, Drive, and Computer tools"
+  default_prompt: "Use Giz to create media or work with my Drive and Computer."

package/skills/giz/references/operations.md

@@ -0,0 +1,16 @@
+# Giz operation map
+
+| Goal | Operation |
+|---|---|
+| Discover non-LLM models and fields | `model_list`, `model_get` |
+| Run any live non-LLM model | `model_run` |
+| Generate common media with automatic routing | `generate_image`, `generate_video`, `generate_audio`, `generate_music`, `generate_talking_head` |
+| Track durable generation | `job_list`, `job_get`, `job_cancel` |
+| List, search, inspect, or read Drive | `drive_list`, `drive_search`, `drive_getMetadata`, `drive_readFile` |
+| Create or change Drive content | `drive_writeFile`, `drive_makeDirectory`, `drive_movePath`, `drive_importUrl`, `drive_createNote`, `drive_editNote` |
+| Move Drive content to Trash | `drive_deletePath` |
+| Discover and control Computers | `computer_list`, `computer_get`, `computer_start`, `computer_stop` |
+| Execute or open a terminal | `container_exec`, `terminal_open` |
+| Inspect or transform media | `media_probe`, `media_process` |
+
+Always prefer the live `tools/list` result over this map. Streamable HTTP MCP is `/api/mcp`; ChatGPT OpenAPI is `/api/openapi.json`; the authenticated HTTP manifest is `/api/tools`.