@gizai/cli 1.0.0 → 1.1.0

package/README.md

@@ -1,10 +1,11 @@
 # Giz CLI
 
-Connect once in the browser, then use every live Giz non-LLM model, Drive, and Computer from a terminal or AI agent.
+Connect once in the browser, then use live Giz text and media models, Drive, and Computer from a terminal or AI agent.
 
 ```bash
 npm install -g @gizai/cli
 giz auth login
+giz chat gpt-5-6-luna "Say hello in Korean"
 giz generate image "A paper observatory at blue hour"
 ```
 
@@ -18,20 +19,61 @@ giz model run ltx2-distilled \
   --upload image=./first-frame.png
 ```
 
-Remote MCP:
+MCP for Claude Code and Codex (install the chosen client first):
 
 ```bash
+giz auth login
 giz mcp add codex
 giz mcp add claude
+giz mcp check --json
 ```
 
+These commands register `giz mcp serve` over stdio. It forwards the server's live
+MCP protocol and shares the CLI's rotating OAuth credentials. Tokens are not
+copied into Claude or Codex configuration. A custom `GIZ_CONFIG` path is preserved.
+
+For clients with their own OAuth session, use `giz mcp add claude --transport http`
+and sign in through `/mcp`, or `giz mcp add codex --transport http`. The remote
+endpoint also supports OAuth discovery and scoped API keys. A manually copied
+OAuth access token expires after one hour; updating CLI credentials does not
+update a static client header.
+
+For a headless Claude Code check, after login and registration:
+
+```bash
+claude -p 'Use model_list to list one Giz image model.' --allowedTools mcp__giz__model_list
+```
+
+`giz mcp check --json` checks the MCP handshake and lists actual tool names without
+running a model. Claude's `--verbose --output-format stream-json` also shows MCP
+connection state. If registration reports an existing `giz` entry, remove that
+entry with the client's `mcp remove` command before adding the desired transport.
+The exact client failure is returned on stderr.
+
 Agent Skill:
 
 ```bash
 giz skill install
 ```
 
-The CLI stores rotating OAuth credentials in `~/.config/giz/credentials.json` with mode `0600`. It never asks for or stores a Giz password.
-Set `GIZ_TOKEN` only for ephemeral automation. Run `giz --help` for Drive, Computer, job, upload, and raw tool commands.
+The CLI stores rotating OAuth credentials as unencrypted JSON in
+`~/.config/giz/credentials.json` with mode `0600` (owner access only), using atomic
+writes and serialized sign-in, refresh, and sign-out. Failed token revocation is
+reported before local credentials are removed. It never stores a Giz password.
+The sign-in callback binds a fresh loopback port; use the URL printed by the
+current login. Progress goes to stderr, leaving `--json` stdout machine-readable.
+
+After updating from 1.0.1, run `giz auth login` again to consent to `giz.inference`.
+Refreshing an old grant cannot add this scope. `giz auth status --json` shows
+granted scopes; a missing scope error names the required permission.
+
+`giz computer exec --deadline-ms 120000 -- COMMAND ARGS...` uses the bounded
+Computer command API (2 minutes by default, up to 15 minutes). The CLI preserves
+the remote command's exit code; `giz job wait` exits with status 1 for failed or
+cancelled jobs. JSON results remain available on stdout. Free Computers have a runtime limit; check the current
+Computer plan before starting long workflows. MCP authentication does not extend
+that runtime. Media jobs run independently and are tracked with `giz job get`.
+
+Create a scoped API key with `giz api-key create "My app"`; its secret is shown once. Set `GIZ_TOKEN` only for ephemeral automation. Run `giz --help` for chat, models, Drive, Computer, job, upload, and raw tool commands.
 
 Documentation: <https://www.giz.ai/mcp/>

package/cli/giz.mjs

@@ -1,20 +1,26 @@
 #!/usr/bin/env node
 import { createHash, randomBytes } from 'node:crypto'
 import { openAsBlob } from 'node:fs'
-import { chmod, mkdir, readFile, unlink, writeFile } from 'node:fs/promises'
+import { mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises'
 import { createServer } from 'node:http'
+import { once } from 'node:events'
+import { createRequire } from 'node:module'
 import os from 'node:os'
 import path from 'node:path'
 import { spawn, spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
+import { lock } from 'proper-lockfile'
+import { Client } from '@modelcontextprotocol/sdk/client/index.js'
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 
+const { version: CLI_VERSION } = createRequire(import.meta.url)('../package.json')
 const DEFAULT_URL = 'https://www.giz.ai'
-const CALLBACK_URL = 'http://127.0.0.1:53682/callback'
 const CLIENT_ID = 'giz-cli'
-const SCOPES = ['giz.read', 'giz.write', 'giz.execute', 'giz.destructive', 'offline_access']
+const SCOPES = ['giz.read', 'giz.inference', 'giz.write', 'giz.execute', 'giz.destructive', 'offline_access']
 const BOOLEAN_OPTIONS = new Set(['help', 'json', 'no-open', 'version'])
-const configPath = process.env.GIZ_CONFIG ||
-  path.join(os.homedir(), '.config', 'giz', 'credentials.json')
+const configPath = path.resolve(process.env.GIZ_CONFIG ||
+  path.join(os.homedir(), '.config', 'giz', 'credentials.json'))
 
 class CliError extends Error {
   constructor(message, hint, status) {
@@ -63,14 +69,27 @@ async function readConfig() {
   }
 }
 
-async function saveConfig(config) {
-  await mkdir(path.dirname(configPath), { recursive: true })
-  await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 })
-  await chmod(configPath, 0o600)
+async function updateConfig(update) {
+  await mkdir(path.dirname(configPath), { recursive: true, mode: 0o700 })
+  const release = await lock(configPath, { realpath: false, retries: { retries: 120, minTimeout: 100, maxTimeout: 500 } })
+  const temporary = `${configPath}.${randomBytes(8).toString('hex')}`
+  try {
+    const config = await update(await readConfig())
+    if (config) {
+      await writeFile(temporary, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600, flag: 'wx' })
+      await rename(temporary, configPath)
+    } else {
+      await unlink(configPath).catch((error) => { if (error.code !== 'ENOENT') throw error })
+    }
+    return config
+  } finally {
+    try { await unlink(temporary).catch((error) => { if (error.code !== 'ENOENT') throw error }) }
+    finally { await release() }
+  }
 }
 
 async function discovery(baseUrl) {
-  const response = await fetch(new URL('/.well-known/oauth-authorization-server', baseUrl))
+  const response = await fetch(new URL('/.well-known/oauth-authorization-server', baseUrl), { signal: AbortSignal.timeout(30_000) })
   if (!response.ok) {
     throw new CliError(
       `OAuth discovery failed: HTTP ${response.status}.`,
@@ -80,42 +99,37 @@ async function discovery(baseUrl) {
   return await response.json()
 }
 
-async function refresh(config) {
-  if (!config?.refresh_token) {
-    throw new CliError('Not authenticated.', 'Run: giz auth login')
-  }
-  const metadata = await discovery(config.baseUrl)
+async function exchangeToken(baseUrl, metadata, grant, config = {}) {
   const body = new URLSearchParams({
-    grant_type: 'refresh_token',
     client_id: CLIENT_ID,
-    refresh_token: config.refresh_token,
-    resource: new URL('/api/mcp', config.baseUrl).href
+    resource: new URL('/api/mcp', baseUrl).href,
+    ...grant
   })
   const response = await fetch(metadata.token_endpoint, {
     method: 'POST',
     headers: { 'content-type': 'application/x-www-form-urlencoded' },
-    body
+    body,
+    signal: AbortSignal.timeout(30_000)
   })
   const payload = await response.json()
   if (!response.ok) {
     throw new CliError(
-      payload.error_description || payload.error || 'Giz session could not be refreshed.',
+      payload.error_description || payload.error || 'OAuth token exchange failed.',
       'Run: giz auth login'
     )
   }
-  const next = {
+  return {
     ...config,
+    baseUrl,
     ...payload,
     refresh_token: payload.refresh_token || config.refresh_token,
     expires_at: Date.now() + Number(payload.expires_in || 3600) * 1000
   }
-  await saveConfig(next)
-  return next
 }
 
-async function credentials(baseUrl, forceRefresh = false) {
+async function credentials(baseUrl, rejectedToken) {
   if (process.env.GIZ_TOKEN) return { access_token: process.env.GIZ_TOKEN, baseUrl }
-  let config = await readConfig()
+  const config = await readConfig()
   if (!config?.access_token) throw new CliError('Not authenticated.', 'Run: giz auth login')
   if (String(config.baseUrl).replace(/\/+$/, '') !== baseUrl) {
     throw new CliError(
@@ -123,87 +137,80 @@ async function credentials(baseUrl, forceRefresh = false) {
       `Run: giz auth login --base-url ${baseUrl}`
     )
   }
-  if (forceRefresh || Number(config.expires_at || 0) <= Date.now() + 60_000) config = await refresh(config)
+  const expired = (value) => value.access_token === rejectedToken || Number(value.expires_at || 0) <= Date.now() + 60_000
+  if (expired(config)) {
+    return await updateConfig(async (config) => {
+      if (config?.baseUrl !== baseUrl) throw new CliError('Giz credentials changed.', 'Run: giz auth login')
+      if (expired(config)) {
+        if (!config.refresh_token) throw new CliError('Giz session expired.', 'Run: giz auth login')
+        return await exchangeToken(baseUrl, await discovery(baseUrl), {
+          grant_type: 'refresh_token', refresh_token: config.refresh_token
+        }, config)
+      }
+      return config
+    })
+  }
   return config
 }
 
-async function api(baseUrl, pathname, data, options = {}) {
-  const run = async (forceRefresh = false) => {
-    const auth = await credentials(baseUrl, forceRefresh)
-    const response = await fetch(new URL(pathname, baseUrl), {
-      method: data === undefined ? 'GET' : 'POST',
-      headers: {
-        accept: 'application/json',
-        ...(data === undefined ? {} : { 'content-type': 'application/json' }),
-        authorization: `Bearer ${auth.access_token}`
-      },
-      ...(data === undefined ? {} : { body: JSON.stringify(data) })
-    })
-    const text = await response.text()
-    let payload
-    try {
-      payload = text ? JSON.parse(text) : null
-    } catch {
-      payload = { message: text.slice(0, 500) }
-    }
-    return { response, payload }
-  }
-  let result = await run()
-  if (result.response.status === 401 && !process.env.GIZ_TOKEN && !options.refreshed) {
-    result = await run(true)
+async function authenticatedFetch(baseUrl, url, init = {}) {
+  const headers = new Headers(init.headers)
+  let auth = await credentials(baseUrl)
+  const signal = AbortSignal.timeout(25 * 60_000)
+  const send = () => {
+    headers.set('authorization', `Bearer ${auth.access_token}`)
+    return fetch(url, { ...init, headers, signal: init.signal ? AbortSignal.any([init.signal, signal]) : signal })
+  }
+  let response = await send()
+  if (response.status === 401 && !process.env.GIZ_TOKEN) {
+    await response.body?.cancel()
+    auth = await credentials(baseUrl, auth.access_token)
+    response = await send()
+  }
+  return response
+}
+
+async function jsonResponse(response, baseUrl) {
+  const text = await response.text()
+  let payload
+  try { payload = JSON.parse(text) } catch {
+    if (response.ok) throw new CliError('Giz API returned invalid JSON.', `Request: ${new URL(response.url).pathname}`)
+    payload = { message: text.slice(0, 500) }
   }
-  if (!result.response.ok) {
-    const required = result.response.status === 403 ? result.payload?.message : undefined
+  if (!response.ok) {
+    const message = payload?.message || payload?.error?.message || `Giz API returned HTTP ${response.status}.`
     throw new CliError(
-      result.payload?.message || `Giz API returned HTTP ${result.response.status}.`,
-      required?.includes('scope') ? 'Run: giz auth login' : 'Run with --json for the complete error.',
-      result.response.status
+      message,
+      response.status === 403 && /scope/i.test(message)
+        ? (process.env.GIZ_TOKEN ? 'Provide a GIZ_TOKEN with the required scope.' : `Run: giz auth login --base-url ${baseUrl}`)
+        : `Request: ${new URL(response.url).pathname}`,
+      response.status
     )
   }
-  return result.payload
+  return payload
+}
+
+async function api(baseUrl, pathname, data, options = {}) {
+  const response = await authenticatedFetch(baseUrl, new URL(pathname, baseUrl), {
+    method: options.method || (data === undefined ? 'GET' : 'POST'),
+    headers: { accept: 'application/json', ...(data === undefined ? {} : { 'content-type': 'application/json' }) },
+    ...(data === undefined ? {} : { body: JSON.stringify(data) })
+  })
+  return await jsonResponse(response, baseUrl)
 }
 
 async function uploadMedia(baseUrl, localFile) {
   const filePath = path.resolve(String(localFile))
-  const run = async (forceRefresh = false) => {
-    const auth = await credentials(baseUrl, forceRefresh)
-    let file
-    try {
-      file = await openAsBlob(filePath)
-    } catch (error) {
-      throw new CliError(`Could not open ${filePath}.`, String(error?.message || error))
-    }
-    const body = new FormData()
-    body.append('file', file, path.basename(filePath))
-    const response = await fetch(new URL('/api/storage/media', baseUrl), {
-      method: 'POST',
-      headers: {
-        accept: 'application/json',
-        authorization: `Bearer ${auth.access_token}`
-      },
-      body
-    })
-    const text = await response.text()
-    let payload
-    try {
-      payload = text ? JSON.parse(text) : null
-    } catch {
-      payload = { message: text.slice(0, 500) }
-    }
-    return { response, payload }
-  }
-  let result = await run()
-  if (result.response.status === 401 && !process.env.GIZ_TOKEN) result = await run(true)
-  if (!result.response.ok) {
-    throw new CliError(
-      result.payload?.message || `Giz upload returned HTTP ${result.response.status}.`,
-      'Check the file and your Giz storage access.'
-    )
-  }
-  const url = String(result.payload?.url || '').trim()
-  const drivePath = String(result.payload?.path || '').trim()
+  const body = new FormData()
+  body.append('file', await openAsBlob(filePath), path.basename(filePath))
+  const response = await authenticatedFetch(baseUrl, new URL('/api/storage/media', baseUrl), {
+    method: 'POST', headers: { accept: 'application/json' }, body
+  })
+  const payload = await jsonResponse(response, baseUrl)
+  const url = String(payload?.url || '').trim()
+  const drivePath = String(payload?.path || '').trim()
   if (!url || !drivePath) throw new CliError('Giz upload returned an incomplete file reference.', 'Try the upload again.')
-  return { ...result.payload, url: new URL(url, baseUrl).href }
+  return { ...payload, url: new URL(url, baseUrl).href }
 }
 
 async function login(baseUrl, options) {
@@ -211,12 +218,12 @@ async function login(baseUrl, options) {
   const verifier = randomBytes(48).toString('base64url')
   const challenge = createHash('sha256').update(verifier).digest('base64url')
   const state = randomBytes(24).toString('base64url')
-  const callback = waitForCallback(state)
+  const callback = await waitForCallback(state)
   const authorization = new URL(metadata.authorization_endpoint)
   for (const [name, value] of Object.entries({
     response_type: 'code',
     client_id: CLIENT_ID,
-    redirect_uri: CALLBACK_URL,
+    redirect_uri: callback.url,
     scope: SCOPES.join(' '),
     resource: new URL('/api/mcp', baseUrl).href,
     code_challenge: challenge,
@@ -224,76 +231,51 @@ async function login(baseUrl, options) {
     prompt: 'consent',
     state
   })) authorization.searchParams.set(name, value)
-  process.stdout.write(`Opening Giz sign-in:\n${authorization}\n`)
+  process.stderr.write(`Opening Giz sign-in:\n${authorization}\n`)
   if (options.open !== 'false' && options['no-open'] !== true) openBrowser(authorization.href)
-  const code = await callback
-  const response = await fetch(metadata.token_endpoint, {
-    method: 'POST',
-    headers: { 'content-type': 'application/x-www-form-urlencoded' },
-    body: new URLSearchParams({
-      grant_type: 'authorization_code',
-      client_id: CLIENT_ID,
-      redirect_uri: CALLBACK_URL,
-      code,
-      code_verifier: verifier,
-      resource: new URL('/api/mcp', baseUrl).href
-    })
-  })
-  const payload = await response.json()
-  if (!response.ok) {
-    throw new CliError(payload.error_description || payload.error || 'OAuth token exchange failed.', 'Run: giz auth login')
-  }
-  await saveConfig({
-    baseUrl,
-    ...payload,
-    expires_at: Date.now() + Number(payload.expires_in || 3600) * 1000
-  })
+  const code = await callback.code
+  await updateConfig(() => exchangeToken(baseUrl, metadata, {
+    grant_type: 'authorization_code', redirect_uri: callback.url, code, code_verifier: verifier
+  }))
   return await api(baseUrl, '/api/external/me')
 }
 
-function waitForCallback(expectedState) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => {
+async function waitForCallback(expectedState) {
+  const server = createServer()
+  server.listen(0, '127.0.0.1')
+  await once(server, 'listening')
+  const callbackUrl = `http://127.0.0.1:${server.address().port}/callback`
+  const code = new Promise((resolve, reject) => {
+    const finish = (error, value) => {
+      clearTimeout(timer)
       server.close()
-      reject(new CliError('Giz sign-in timed out.', 'Run: giz auth login'))
-    }, 5 * 60 * 1000)
-    const server = createServer((request, response) => {
-      const url = new URL(request.url || '/', CALLBACK_URL)
+      error ? reject(error) : resolve(value)
+    }
+    const timer = setTimeout(() => finish(new CliError('Giz sign-in timed out.', 'Run: giz auth login')), 5 * 60 * 1000)
+    server.on('request', (request, response) => {
+      const url = new URL(request.url || '/', callbackUrl)
       if (url.pathname !== '/callback') {
         response.writeHead(404).end('Not found')
         return
       }
-      const finish = (error, code) => {
-        clearTimeout(timer)
-        response.setHeader('content-type', 'text/html; charset=utf-8')
-        response.end(error
-          ? '<h1>Giz connection failed</h1><p>Return to the terminal for details.</p>'
-          : '<h1>Giz connected</h1><p>You can close this window and return to the terminal.</p>')
-        server.close()
-        error ? reject(error) : resolve(code)
-      }
       if (url.searchParams.get('state') !== expectedState) {
-        finish(new CliError('OAuth state did not match.', 'Run: giz auth login'))
-      } else if (url.searchParams.get('error')) {
-        finish(new CliError(
-          url.searchParams.get('error_description') || url.searchParams.get('error'),
-          'Run: giz auth login'
-        ))
-      } else if (!url.searchParams.get('code')) {
-        finish(new CliError('OAuth callback did not include a code.', 'Run: giz auth login'))
-      } else {
-        finish(undefined, url.searchParams.get('code'))
+        response.writeHead(400).end('This sign-in link has expired. Use the link from your current giz auth login.')
+        return
       }
+      const code = url.searchParams.get('code')
+      const error = url.searchParams.get('error') || !code
+        ? new CliError(url.searchParams.get('error_description') || url.searchParams.get('error') || 'OAuth callback did not include a code.', 'Run: giz auth login')
+        : undefined
+      response.setHeader('content-type', 'text/html; charset=utf-8')
+      response.setHeader('connection', 'close')
+      response.end(error
+        ? '<h1>Giz connection failed</h1><p>Return to the terminal for details.</p>'
+        : '<h1>Giz connected</h1><p>You can close this window and return to the terminal.</p>')
+      finish(error, code)
     })
-    server.on('error', (error) => {
-      clearTimeout(timer)
-      reject(new CliError(
-        `Could not listen on ${CALLBACK_URL}: ${error.message}`,
-        'Close the process using port 53682 and run: giz auth login'
-      ))
-    })
-    server.listen(53682, '127.0.0.1')
+    server.on('error', finish)
   })
+  return { url: callbackUrl, code }
 }
 
 function openBrowser(url) {
@@ -342,9 +324,36 @@ async function invoke(baseUrl, tool, input) {
   return await api(baseUrl, `/api/tools/${encodeURIComponent(tool)}`, input)
 }
 
+function mcpTransport(baseUrl) {
+  return new StreamableHTTPClientTransport(new URL('/api/mcp', baseUrl), {
+    fetch: (url, init) => authenticatedFetch(baseUrl, url, init)
+  })
+}
+
+async function serveMcp(baseUrl) {
+  const remote = mcpTransport(baseUrl)
+  const stdio = new StdioServerTransport()
+  try {
+    await remote.start()
+    await new Promise((resolve, reject) => {
+      remote.onerror = stdio.onerror = reject
+      remote.onmessage = (message) => {
+        if (message.result?.protocolVersion) remote.setProtocolVersion(message.result.protocolVersion)
+        stdio.send(message).catch(reject)
+      }
+      stdio.onmessage = (message) => { remote.send(message).catch(reject) }
+      process.stdin.once('end', resolve)
+      stdio.start().catch(reject)
+    })
+  } finally {
+    await remote.close()
+    await stdio.close()
+  }
+}
+
 async function runCommand(baseUrl, positionals, options) {
   const [command, subcommand, ...rest] = positionals
-  if (options.version === true) return { kind: 'message', value: '1.0.0' }
+  if (options.version === true) return { kind: 'message', value: CLI_VERSION }
   if (!command || command === 'help' || options.help === true) return { kind: 'help', value: help(command) }
   if (command === 'auth' && subcommand === 'login') {
     return { kind: 'auth', value: await login(baseUrl, options) }
@@ -353,24 +362,43 @@ async function runCommand(baseUrl, positionals, options) {
     return { kind: 'auth', value: await api(baseUrl, '/api/external/me') }
   }
   if (command === 'auth' && subcommand === 'logout') {
-    const config = await readConfig()
-    if (config?.refresh_token) {
-      const metadata = await discovery(baseUrl)
-      await fetch(metadata.revocation_endpoint, {
-        method: 'POST',
-        headers: { 'content-type': 'application/x-www-form-urlencoded' },
-        body: new URLSearchParams({
-          token: config.refresh_token,
-          token_type_hint: 'refresh_token',
-          client_id: CLIENT_ID
+    await updateConfig(async (config) => {
+      if (config?.refresh_token) {
+        const metadata = await discovery(config.baseUrl)
+        const response = await fetch(metadata.revocation_endpoint, {
+          method: 'POST', signal: AbortSignal.timeout(30_000),
+          headers: { 'content-type': 'application/x-www-form-urlencoded' },
+          body: new URLSearchParams({ token: config.refresh_token, token_type_hint: 'refresh_token', client_id: CLIENT_ID })
         })
-      })
-    }
-    await unlink(configPath).catch((error) => {
-      if (error?.code !== 'ENOENT') throw error
+        if (!response.ok) throw new CliError(`Giz sign-out failed: HTTP ${response.status}.`, 'Run: giz auth logout')
+      }
     })
     return { kind: 'message', value: 'Signed out of Giz on this device.' }
   }
+  if (command === 'api-key' && subcommand === 'list') {
+    return { kind: 'result', value: await api(baseUrl, '/api/external/api-keys') }
+  }
+  if (command === 'api-key' && subcommand === 'create') {
+    const name = required(rest.join(' ') || options.name, 'NAME', 'Run: giz api-key create "My app"')
+    const scopes = options.scopes
+      ? String(options.scopes).split(',').map((scope) => scope.trim()).filter(Boolean)
+      : undefined
+    return {
+      kind: 'result',
+      value: await api(baseUrl, '/api/external/api-keys', {
+        name,
+        ...(scopes ? { scopes } : {}),
+        ...(options.expires ? { expiresAt: options.expires } : {})
+      })
+    }
+  }
+  if (command === 'api-key' && subcommand === 'revoke') {
+    const id = required(rest[0], 'KEY', 'Run: giz api-key revoke key_...')
+    return {
+      kind: 'result',
+      value: await api(baseUrl, `/api/external/api-keys/${encodeURIComponent(id)}`, undefined, { method: 'DELETE' })
+    }
+  }
 
   if (command === 'model' && subcommand === 'list') {
     return {
@@ -393,6 +421,22 @@ async function runCommand(baseUrl, positionals, options) {
   if (command === 'models') {
     throw new CliError('Unknown command "models".', 'Did you mean: giz model list')
   }
+  if (command === 'chat') {
+    const model = required(options.model || subcommand, 'MODEL', 'Run: giz chat MODEL "your prompt"')
+    const input = jsonInput(options.input)
+    const prompt = rest.join(' ').trim()
+    const messages = input.messages || (prompt ? [{ role: 'user', content: prompt }] : undefined)
+    required(messages, 'MESSAGES', 'Pass a prompt or --input \'{"messages":[...]}\'')
+    return {
+      kind: 'result',
+      value: await api(baseUrl, '/v1/chat/completions', {
+        ...input,
+        model,
+        messages,
+        stream: false
+      })
+    }
+  }
 
   if (command === 'generate' && ['image', 'video', 'audio', 'music', 'talking-head'].includes(subcommand)) {
     const tool = {
@@ -431,7 +475,7 @@ async function runCommand(baseUrl, positionals, options) {
     const id = required(rest[0], 'JOB', 'Run: giz job wait JOB')
     while (true) {
       const job = await invoke(baseUrl, 'job.get', { job: id })
-      if (['completed', 'failed', 'cancelled'].includes(job.status)) return { kind: 'job', value: job }
+      if (['completed', 'failed', 'cancelled'].includes(job.status)) return { kind: 'job', value: job, exitCode: job.status === 'completed' ? 0 : 1 }
       if (process.stderr.isTTY) process.stderr.write(`\r${job.id}  ${job.status}  ${job.message || ''}`.slice(0, 120))
       await new Promise((resolve) => setTimeout(resolve, 1000))
     }
@@ -465,7 +509,7 @@ async function runCommand(baseUrl, positionals, options) {
           path: drivePath,
           content: String(content),
           encoding,
-          ...(options.computer ? { computerId: options.computer } : {})
+          ...(options.computer ? { computer: options.computer } : {})
         })
       }
     }
@@ -474,7 +518,7 @@ async function runCommand(baseUrl, positionals, options) {
     const [tool, input] = mapping()
     return {
       kind: 'result',
-      value: await invoke(baseUrl, tool, { ...input, ...(options.computer ? { computerId: options.computer } : {}) })
+      value: await invoke(baseUrl, tool, { ...input, ...(options.computer ? { computer: options.computer } : {}) })
     }
   }
 
@@ -485,28 +529,133 @@ async function runCommand(baseUrl, positionals, options) {
 
   if (command === 'computer') {
     if (subcommand === 'list') return { kind: 'computers', value: await invoke(baseUrl, 'computer.list', {}) }
-    const computerId = rest[0] || options.computer
-    if (subcommand === 'get') return { kind: 'result', value: await invoke(baseUrl, 'computer.get', computerId ? { computerId } : {}) }
+    const computer = options.computer || (subcommand === 'exec' ? undefined : rest[0])
+    if (subcommand === 'get') return { kind: 'result', value: await invoke(baseUrl, 'computer.get', computer ? { computer } : {}) }
     if (subcommand === 'start' || subcommand === 'stop') {
       return {
         kind: 'result',
-        value: await invoke(baseUrl, `computer.${subcommand}`, computerId ? { computerId } : {})
+        value: await invoke(baseUrl, `computer.${subcommand}`, computer ? { computer } : {})
       }
     }
     if (subcommand === 'exec') {
-      const commandArgs = rest
-      if (!commandArgs.length) throw new CliError('COMMAND is required.', 'Run: giz computer exec -- ls -la')
+      if (!rest.length) throw new CliError('COMMAND is required.', 'Run: giz computer exec -- ls -la')
+      const stdin = options['stdin-file'] ? await readFile(String(options['stdin-file']), 'utf8') : options.stdin
+      const value = await invoke(baseUrl, 'computer.exec', {
+        command: rest,
+        ...(stdin !== undefined ? { stdin: String(stdin) } : {}),
+        ...(options['deadline-ms'] !== undefined ? { deadlineMs: Number(options['deadline-ms']) } : {}),
+        ...(options.cwd ? { cwd: options.cwd } : {}),
+        ...(computer ? { computer } : {})
+      })
+      return { kind: 'result', value, exitCode: value.exitCode }
+    }
+    throw new CliError(`Unknown computer command "${subcommand || ''}".`, 'Run: giz computer --help')
+  }
+
+  if (command === 'site') {
+    const computer = options.computer ? { computer: options.computer } : {}
+    if (subcommand === 'list') {
+      return { kind: 'result', value: await invoke(baseUrl, 'site.list', computer) }
+    }
+    if (subcommand === 'create' || subcommand === 'update') {
+      const input = jsonInput(options.input)
+      const siteId = subcommand === 'update'
+        ? required(rest[0], 'SITE', 'Run: giz site update SITE --input JSON')
+        : undefined
       return {
         kind: 'result',
-        value: await invoke(baseUrl, 'container.exec', {
-          command: commandArgs,
-          sessionId: String(options.session || 'giz-cli'),
-          ...(options.cwd ? { cwd: options.cwd } : {}),
-          ...(options.computer ? { computerId: options.computer } : {})
+        value: await invoke(baseUrl, 'site.configure', {
+          ...input,
+          ...computer,
+          operation: subcommand,
+          ...(siteId ? { siteId } : {})
         })
       }
     }
-    throw new CliError(`Unknown computer command "${subcommand || ''}".`, 'Run: giz computer --help')
+    if (subcommand === 'verify') {
+      const siteId = required(rest[0], 'SITE', 'Run: giz site verify SITE')
+      return {
+        kind: 'result',
+        value: await invoke(baseUrl, 'site.configure', { ...computer, operation: 'verify', siteId })
+      }
+    }
+    if (subcommand === 'delete') {
+      const siteId = required(rest[0], 'SITE', 'Run: giz site delete SITE')
+      return { kind: 'result', value: await invoke(baseUrl, 'site.delete', { ...computer, siteId }) }
+    }
+    throw new CliError(`Unknown site command "${subcommand || ''}".`, 'Run: giz site --help')
+  }
+
+  if (command === 'capability') {
+    if (subcommand === 'list') {
+      return {
+        kind: 'result',
+        value: await invoke(baseUrl, 'capability.status', {
+          ...(options.computer ? { computer: options.computer } : {})
+        })
+      }
+    }
+    if (subcommand === 'search') {
+      const kind = required(rest[0], 'KIND', 'Run: giz capability search skill|mcp QUERY')
+      const query = required(rest.slice(1).join(' '), 'QUERY', 'Run: giz capability search skill|mcp QUERY')
+      return {
+        kind: 'result',
+        value: await invoke(baseUrl, 'capability.catalog', {
+          kind,
+          query,
+          ...(options.limit ? { limit: Number(options.limit) } : {})
+        })
+      }
+    }
+    if (subcommand === 'install') {
+      const kind = required(rest[0], 'KIND', 'Run: giz capability install skill|mcp ID --query QUERY')
+      const id = required(rest[1], 'ID', 'Run: giz capability install skill|mcp ID --query QUERY')
+      const query = required(options.query, 'QUERY', 'Repeat the catalog query with --query QUERY.')
+      return {
+        kind: 'result',
+        value: await invoke(baseUrl, 'capability.install', {
+          kind,
+          id,
+          query,
+          ...(options.computer ? { computer: options.computer } : {})
+        })
+      }
+    }
+    if (subcommand === 'update' || subcommand === 'remove') {
+      const id = required(rest[0], 'ID', `Run: giz capability ${subcommand} ID`)
+      return {
+        kind: 'result',
+        value: await invoke(baseUrl, 'capability.manage', {
+          id,
+          operation: subcommand,
+          ...(options.computer ? { computer: options.computer } : {})
+        })
+      }
+    }
+    throw new CliError(`Unknown capability command "${subcommand || ''}".`, 'Run: giz capability --help')
+  }
+
+  if (command === 'agent') {
+    if (subcommand === 'start') {
+      return {
+        kind: 'result',
+        value: await invoke(baseUrl, 'agent.start', {
+          ...jsonInput(options.input),
+          ...(options.computer ? { computer: options.computer } : {})
+        })
+      }
+    }
+    if (subcommand === 'status' || subcommand === 'cancel') {
+      const turnId = required(rest[0], 'TURN', `Run: giz agent ${subcommand} TURN`)
+      return {
+        kind: 'result',
+        value: await invoke(baseUrl, `agent.${subcommand}`, {
+          turnId,
+          ...(subcommand === 'status' && options.wait ? { wait: true } : {})
+        })
+      }
+    }
+    throw new CliError(`Unknown agent command "${subcommand || ''}".`, 'Run: giz agent --help')
   }
 
   if (command === 'invoke') {
@@ -517,75 +666,101 @@ async function runCommand(baseUrl, positionals, options) {
   if (command === 'mcp' && subcommand === 'url') {
     return { kind: 'message', value: new URL('/api/mcp', baseUrl).href }
   }
+  if (command === 'mcp' && subcommand === 'serve') {
+    await serveMcp(baseUrl)
+    return
+  }
+  if (command === 'mcp' && subcommand === 'check') {
+    const client = new Client({ name: 'giz-cli', version: CLI_VERSION })
+    try {
+      await client.connect(mcpTransport(baseUrl))
+      const { tools } = await client.listTools()
+      if (!tools.length) throw new CliError('Giz MCP returned zero tools.', 'Check your Giz connection and scopes.')
+      return { kind: 'result', value: { server: client.getServerVersion(), tools: tools.map((tool) => tool.name) } }
+    } finally { await client.close() }
+  }
   if (command === 'mcp' && subcommand === 'add') {
     const client = required(rest[0], 'CLIENT', 'Run: giz mcp add codex|claude')
+    if (!['codex', 'claude'].includes(client)) throw new CliError(`Unsupported MCP client "${client}".`, 'Supported clients: codex, claude')
+    const transport = options.transport || 'stdio'
+    if (!['stdio', 'http'].includes(transport)) throw new CliError('MCP transport must be stdio or http.')
     const endpoint = new URL('/api/mcp', baseUrl).href
-    if (client === 'codex') {
-      runExternal('codex', ['mcp', 'add', 'giz', '--url', endpoint, '--oauth-resource', endpoint], 'Install Codex CLI first.')
-      runExternal('codex', ['mcp', 'login', 'giz', '--scopes', SCOPES.join(',')], 'Run: codex mcp login giz')
-      return { kind: 'message', value: 'Giz is connected to Codex.' }
-    }
-    if (client === 'claude') {
-      runExternal('claude', ['mcp', 'add', '--transport', 'http', '--scope', 'user', 'giz', endpoint], 'Install Claude Code first.')
-      return { kind: 'message', value: 'Giz was added to Claude Code. Open Claude Code and run /mcp to sign in.' }
-    }
-    throw new CliError(`Unsupported MCP client "${client}".`, 'Supported clients: codex, claude')
+    const target = transport === 'stdio'
+      ? ['--env', `GIZ_CONFIG=${configPath}`, '--', process.execPath, fileURLToPath(import.meta.url), 'mcp', 'serve', '--base-url', baseUrl]
+      : client === 'codex' ? ['--url', endpoint, '--oauth-resource', endpoint] : [endpoint]
+    runExternal(client, ['mcp', 'add', ...(client === 'claude' ? ['--scope', 'user', '--transport', transport] : []), 'giz', ...target],
+      `Install ${client === 'codex' ? 'Codex: npm install -g @openai/codex' : 'Claude Code: npm install -g @anthropic-ai/claude-code'}`, transport === 'http')
+    return { kind: 'message', value: `Giz was added to ${client} (${transport}). ${transport === 'stdio'
+      ? 'Run giz auth login, then giz mcp check --json before starting a headless session.'
+      : client === 'claude' ? 'Open Claude Code and run /mcp to sign in.' : 'Complete the browser approval opened by Codex.'}` }
   }
 
   if (command === 'skill' && subcommand === 'install') {
     const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'skills')
-    runExternal('npx', ['--yes', 'skills', 'add', root, '--all'], 'Install Node.js 20 or newer first.')
+    runExternal('npx', ['--yes', 'skills', 'add', root, '--skill', '*', '--agent', 'universal', '--copy', '-y'], 'Install Node.js 20 or newer first.')
     return { kind: 'message', value: 'Giz Skill installed for available AI agents.' }
   }
 
   throw new CliError(`Unknown command "${[command, subcommand].filter(Boolean).join(' ')}".`, 'Run: giz --help')
 }
 
-function runExternal(command, args, hint) {
-  const result = spawnSync(command, args, { stdio: 'inherit' })
+function runExternal(command, args, hint, interactive = false) {
+  const result = spawnSync(command, args, { encoding: 'utf8', stdio: interactive ? ['inherit', 2, 2] : ['inherit', 'pipe', 'pipe'] })
   if (result.error?.code === 'ENOENT') throw new CliError(`${command} is not installed.`, hint)
-  if (result.status !== 0) throw new CliError(`${command} exited with status ${result.status}.`, hint)
+  if (result.error || result.status !== 0) throw new CliError(
+    `${command} failed (${result.error?.code || result.signal || result.status}): ${(result.stderr || result.stdout || result.error?.message || '').trim()}`
+  )
+  if (result.stderr || result.stdout) process.stderr.write(result.stderr + result.stdout)
 }
 
-function print(kind, value, json) {
+function print(kind, value, json, output = process.stdout) {
   if (json) {
-    process.stdout.write(`${JSON.stringify(value, null, 2)}\n`)
+    output.write(`${JSON.stringify(value, null, 2)}\n`)
     return
   }
   if (kind === 'help' || kind === 'message') {
-    process.stdout.write(`${value}\n`)
+    output.write(`${value}\n`)
     return
   }
   if (kind === 'models') {
     const rows = value.models || []
-    for (const model of rows) process.stdout.write(`${model.id}\t${model.type}\t${model.provider || '-'}\t${model.label}\n`)
-    process.stdout.write(`\n${rows.length} models\n`)
+    for (const model of rows) output.write(`${model.id}\t${model.type}\t${model.provider || '-'}\t${model.label}\n`)
+    output.write(`\n${rows.length} models\n`)
     return
   }
   if (kind === 'jobs') {
-    for (const job of value.jobs || []) process.stdout.write(`${job.id}\t${job.status}\t${job.tool}\t${job.createdAt}\n`)
+    for (const job of value.jobs || []) output.write(`${job.id}\t${job.status}\t${job.tool}\t${job.createdAt}\n`)
     return
   }
   if (kind === 'computers') {
     for (const computer of value.computers || []) {
-      process.stdout.write(`${computer.id}\t${computer.status || '-'}\t${computer.isDefault ? 'default' : '-'}\t${computer.name}\n`)
+      output.write(`${computer.id}\t${computer.status || '-'}\t${computer.isDefault ? 'default' : '-'}\t${computer.name}\n`)
     }
     return
   }
   if (kind === 'job') {
-    process.stdout.write(`${value.id}  ${value.status}\n`)
-    if (value.message) process.stdout.write(`${value.message}\n`)
-    if (value.error) process.stdout.write(`Error: ${value.error}\n`)
-    if (value.result) process.stdout.write(`${JSON.stringify(value.result, null, 2)}\n`)
+    output.write(`${value.id}  ${value.status}\n`)
+    if (value.message) output.write(`${value.message}\n`)
+    if (value.error) output.write(`Error: ${value.error}\n`)
+    if (value.result) output.write(`${JSON.stringify(value.result, null, 2)}\n`)
     if (!['completed', 'failed', 'cancelled'].includes(value.status)) {
-      process.stdout.write(`Run: giz job wait ${value.id}\n`)
+      output.write(`Run: giz job wait ${value.id}\n`)
     }
     return
   }
-  process.stdout.write(`${JSON.stringify(value, null, 2)}\n`)
+  output.write(`${JSON.stringify(value, null, 2)}\n`)
 }
 
 function help(command) {
+  if (command === 'api-key') return `Usage
+  giz api-key list
+  giz api-key create "My app" [--scopes giz.inference,giz.read] [--expires ISO_TIMESTAMP]
+  giz api-key revoke KEY_ID
+
+The secret is shown only when the key is created.`
+  if (command === 'chat') return `Usage
+  giz chat MODEL "your prompt"
+  giz chat MODEL --input '{"messages":[{"role":"user","content":"Hello"}]}'`
   if (command === 'model') return `Usage
   giz model list [--type TYPE] [--search TEXT]
   giz model get MODEL
@@ -612,19 +787,40 @@ Options
   if (command === 'computer') return `Usage
   giz computer list
   giz computer get|start|stop [COMPUTER]
-  giz computer exec [--computer COMPUTER] [--cwd PATH] -- COMMAND [ARGS...]`
+  giz computer exec [--computer COMPUTER] [--cwd PATH] [--deadline-ms MS] [--stdin TEXT|--stdin-file PATH] -- COMMAND [ARGS...]`
+  if (command === 'site') return `Usage
+  giz site list [--computer COMPUTER]
+  giz site create [--computer COMPUTER] --input JSON
+  giz site update SITE [--computer COMPUTER] --input JSON
+  giz site verify SITE [--computer COMPUTER]
+  giz site delete SITE [--computer COMPUTER]`
+  if (command === 'capability') return `Usage
+  giz capability list [--computer COMPUTER]
+  giz capability search skill|mcp QUERY
+  giz capability install skill|mcp ID --query QUERY [--computer COMPUTER]
+  giz capability update|remove ID [--computer COMPUTER]`
+  if (command === 'agent') return `Usage
+  giz agent start [--computer COMPUTER] --input JSON
+  giz agent status TURN [--wait]
+  giz agent cancel TURN`
   if (command === 'mcp') return `Usage
   giz mcp url
-  giz mcp add codex
-  giz mcp add claude`
+  giz mcp serve
+  giz mcp check --json
+  giz mcp add codex|claude [--transport stdio|http]
+
+stdio (default) shares giz auth login and refreshes tokens automatically.
+http uses the client's own OAuth login. Install the chosen client first.`
   if (command === 'auth') return `Usage
   giz auth login
   giz auth status
   giz auth logout`
-  return `Giz CLI — non-LLM models, Drive, and Computer from any terminal
+  return `Giz CLI — AI models, Drive, and Computer from any terminal
 
 Usage
   giz auth login
+  giz api-key list|create|revoke
+  giz chat MODEL "your prompt"
   giz model list [--type TYPE] [--search TEXT]
   giz model get MODEL
   giz model run MODEL --input JSON [--upload FIELD=LOCAL_PATH]
@@ -633,19 +829,14 @@ Usage
   giz drive list|search|read|write|mkdir|move|delete
   giz upload LOCAL_PATH
   giz computer list|get|start|stop|exec
-  giz mcp add codex|claude
+  giz site list|create|update|verify|delete
+  giz capability list|search|install|update|remove
+  giz agent start|status|cancel
+  giz mcp url|serve|check|add
   giz skill install
   giz invoke TOOL --input JSON
 
-Examples
-  giz auth login
-  giz generate image "A paper observatory at blue hour"
-  giz model list --type video-generation
-  giz model run ltx2-distilled --input '{"prompt":"A slow dolly in"}' --upload image=./first-frame.png
-  giz generate talking-head "Welcome to Giz" --image ./face.png
-  giz drive write notes/brief.md --file ./brief.md
-  giz computer exec --computer ctr_123 -- python --version
-  giz mcp add codex
+Use giz COMMAND --help for parameters and examples.
 
 Global options
   --json                 Machine-readable JSON output
@@ -660,22 +851,16 @@ async function main() {
   const saved = await readConfig()
   const baseUrl = String(options['base-url'] || process.env.GIZ_URL || saved?.baseUrl || DEFAULT_URL).replace(/\/+$/, '')
   const output = await runCommand(baseUrl, positionals, options)
-  print(output.kind, output.value, options.json === true)
+  if (output) {
+    print(output.kind, output.value, options.json === true)
+    process.exitCode = output.exitCode ?? (output.value?.isError ? 1 : 0)
+  }
 }
 
 main().catch((error) => {
   const { options } = parse(process.argv.slice(2))
-  if (options.json === true) {
-    process.stderr.write(`${JSON.stringify({
-      error: {
-        message: String(error?.message || error),
-        ...(error?.hint ? { hint: error.hint } : {}),
-        ...(error?.status ? { status: error.status } : {})
-      }
-    }, null, 2)}\n`)
-  } else {
-    process.stderr.write(`Error: ${String(error?.message || error)}\n`)
-    if (error?.hint) process.stderr.write(`Hint: ${error.hint}\n`)
-  }
+  const json = options.json === true
+  const failure = { message: String(error?.message || error), hint: error?.hint, status: error?.status }
+  print('message', json ? { error: failure } : `Error: ${failure.message}${failure.hint ? `\nHint: ${failure.hint}` : ''}`, json, process.stderr)
   process.exitCode = 1
 })

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gizai/cli",
-  "version": "1.0.0",
-  "description": "Giz CLI, MCP installer, and agent Skills for non-LLM models, Drive, and Computer",
+  "version": "1.1.0",
+  "description": "Giz CLI, MCP installer, OpenAI-compatible models, Drive, and Computer",
   "type": "module",
   "bin": {
     "giz": "cli/giz.mjs"
@@ -12,7 +12,11 @@
     "README.md"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=20.12"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "1.29.0",
+    "proper-lockfile": "4.1.2"
   },
   "keywords": [
     "giz",
@@ -27,13 +31,13 @@
   "homepage": "https://www.giz.ai/mcp/",
   "repository": {
     "type": "git",
-    "url": "https://github.com/exinno/giz.git",
+    "url": "git+https://github.com/exinno/giz.git",
     "directory": "apps/space/external"
   },
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
-    "check": "node --check cli/giz.mjs"
+    "check": "node --check cli/giz.mjs && node --test test/*.test.mjs"
   }
 }

package/skills/giz/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: giz
-description: Use Giz non-LLM image, video, audio, music, speech, Drive, and Computer capabilities from an AI agent. Trigger when the user asks to generate or transform media with Giz, inspect or modify Giz Drive files, operate a Giz Computer or terminal, or discover live Giz models and their parameters.
+description: Use Giz text, image, video, audio, speech, embedding, reranking, Drive, and Computer capabilities from an AI agent. Trigger when the user asks to run an AI model through Giz, generate or transform media, embed or rerank content, inspect or modify Giz Drive files, operate a Giz Computer or terminal, or discover live Giz models and their parameters.
 ---
 
 # Giz
@@ -11,10 +11,10 @@ Use the `giz` CLI or the configured Giz MCP server. Prefer MCP when available an
 
 1. Run `model_list` before selecting an unfamiliar media model.
 2. Run `model_get` and treat its live input schema as the source of truth.
-3. Call `model_run` with the exact model ID and supported inputs. For simple prompt-only work, use `generate_image`, `generate_video`, `generate_audio`, `generate_music`, or `generate_talking_head`.
+3. Call `model_run` with the exact model ID and supported inputs.
 4. Generation returns a durable job. Poll `job_get`; do not resubmit while it is queued or processing.
 5. Preserve completed Drive URLs and paths. Use Drive tools to inspect or organize results.
-6. Use Computer tools only when the task requires a shell or runtime. Reuse one terminal `sessionId` per conversation.
+6. Use `giz_computer_exec` for commands; it runs outside persistent terminals and has a bounded deadline. Use `terminal_list`, `terminal_observe`, and `terminal_send` only to inspect or interact with an existing visible session. Pass a known exact Computer name, slug, or ID directly as `computer`; use `computer_list` only when the target is unknown or ambiguous.
 7. Ask for explicit confirmation immediately before destructive Drive removal, Computer runtime changes, or commands with material side effects.
 
 ## CLI
@@ -33,6 +33,12 @@ giz model get MODEL_ID
 giz model run MODEL_ID --input '{"prompt":"..."}'
 ```
 
+Use the OpenAI-compatible chat boundary:
+
+```bash
+giz chat gpt-5-6-luna "..."
+```
+
 Upload local media into an exact model field:
 
 ```bash
@@ -52,7 +58,6 @@ Pass `--json` for machine output. Use `GIZ_TOKEN` only in ephemeral automation.
 ## Boundaries
 
 - Do not guess model ids, parameter names, enum values, or costs.
-- Do not use text-generation models; this integration intentionally exposes non-LLM models only.
 - Do not turn argv arrays into shell strings.
 - Do not read binary Drive content unless the task needs it; prefer returned URLs and metadata.
 - Do not retry failed generations blindly. Report the provider or contract error.

package/skills/giz/references/operations.md

@@ -4,13 +4,13 @@
 |---|---|
 | Discover non-LLM models and fields | `model_list`, `model_get` |
 | Run any live non-LLM model | `model_run` |
-| Generate common media with automatic routing | `generate_image`, `generate_video`, `generate_audio`, `generate_music`, `generate_talking_head` |
 | Track durable generation | `job_list`, `job_get`, `job_cancel` |
-| List, search, inspect, or read Drive | `drive_list`, `drive_search`, `drive_getMetadata`, `drive_readFile` |
-| Create or change Drive content | `drive_writeFile`, `drive_makeDirectory`, `drive_movePath`, `drive_importUrl`, `drive_createNote`, `drive_editNote` |
+| List, search, or read Drive | `drive_list`, `drive_search`, `drive_readFile` |
+| Create or change Drive content | `drive_writeFile`, `drive_makeDirectory`, `drive_movePath`, `drive_importUrl` |
 | Move Drive content to Trash | `drive_deletePath` |
-| Discover and control Computers | `computer_list`, `computer_get`, `computer_start`, `computer_stop` |
-| Execute or open a terminal | `container_exec`, `terminal_open` |
+| Discover and control Computers | `computer_list`, `computer_start`, `computer_stop` |
+| Run a Computer command | `giz_computer_exec` |
+| Find, inspect, or interact with an existing terminal | `terminal_list`, `terminal_observe`, `terminal_send` |
 | Inspect or transform media | `media_probe`, `media_process` |
 
-Always prefer the live `tools/list` result over this map. Streamable HTTP MCP is `/api/mcp`; ChatGPT OpenAPI is `/api/openapi.json`; the authenticated HTTP manifest is `/api/tools`.
+Always prefer the live `tools/list` result over this map. Streamable HTTP MCP is `/api/mcp`; ChatGPT OpenAPI is `/api/openapi.json`; the authenticated HTTP manifest is `/api/tools`. `giz_computer_exec` accepts an exact Computer name, slug, or ID as `computer`, argv `command`, optional `stdin`, `cwd`, and `deadlineMs`; do not send `timeoutMs`, `yieldMs`, `sessionId`, or shell command strings. Omit `computer` for the default Computer and use `computer_list` only when the target is unknown or ambiguous.