@gizai/cli 1.0.1 → 1.2.1

package/cli/giz.mjs

@@ -1,22 +1,27 @@
 #!/usr/bin/env node
+import { computerIdentity, managedRevision } from './computer-identity.mjs'
 import { createHash, randomBytes } from 'node:crypto'
 import { openAsBlob } from 'node:fs'
-import { chmod, mkdir, readFile, unlink, writeFile } from 'node:fs/promises'
+import { mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises'
 import { createServer } from 'node:http'
+import { once } from 'node:events'
 import { createRequire } from 'node:module'
 import os from 'node:os'
 import path from 'node:path'
 import { spawn, spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
+import { lock } from 'proper-lockfile'
+import { Client } from '@modelcontextprotocol/sdk/client/index.js'
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 
 const { version: CLI_VERSION } = createRequire(import.meta.url)('../package.json')
 const DEFAULT_URL = 'https://www.giz.ai'
-const CALLBACK_URL = 'http://127.0.0.1:53682/callback'
 const CLIENT_ID = 'giz-cli'
-const SCOPES = ['giz.read', 'giz.write', 'giz.execute', 'giz.destructive', 'offline_access']
-const BOOLEAN_OPTIONS = new Set(['help', 'json', 'no-open', 'version'])
-const configPath = process.env.GIZ_CONFIG ||
-  path.join(os.homedir(), '.config', 'giz', 'credentials.json')
+const SCOPES = ['giz.read', 'giz.inference', 'giz.write', 'giz.execute', 'giz.destructive', 'offline_access']
+const BOOLEAN_OPTIONS = new Set(['help', 'json', 'no-open', 'version', 'device'])
+const configPath = path.resolve(process.env.GIZ_CONFIG ||
+  path.join(os.homedir(), '.config', 'giz', 'credentials.json'))
 
 class CliError extends Error {
   constructor(message, hint, status) {
@@ -65,14 +70,27 @@ async function readConfig() {
   }
 }
 
-async function saveConfig(config) {
-  await mkdir(path.dirname(configPath), { recursive: true })
-  await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 })
-  await chmod(configPath, 0o600)
+async function updateConfig(update) {
+  await mkdir(path.dirname(configPath), { recursive: true, mode: 0o700 })
+  const release = await lock(configPath, { realpath: false, retries: { retries: 120, minTimeout: 100, maxTimeout: 500 } })
+  const temporary = `${configPath}.${randomBytes(8).toString('hex')}`
+  try {
+    const config = await update(await readConfig())
+    if (config) {
+      await writeFile(temporary, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600, flag: 'wx' })
+      await rename(temporary, configPath)
+    } else {
+      await unlink(configPath).catch((error) => { if (error.code !== 'ENOENT') throw error })
+    }
+    return config
+  } finally {
+    try { await unlink(temporary).catch((error) => { if (error.code !== 'ENOENT') throw error }) }
+    finally { await release() }
+  }
 }
 
 async function discovery(baseUrl) {
-  const response = await fetch(new URL('/.well-known/oauth-authorization-server', baseUrl))
+  const response = await fetch(new URL('/.well-known/oauth-authorization-server', baseUrl), { signal: AbortSignal.timeout(30_000) })
   if (!response.ok) {
     throw new CliError(
       `OAuth discovery failed: HTTP ${response.status}.`,
@@ -82,143 +100,158 @@ async function discovery(baseUrl) {
   return await response.json()
 }
 
-async function refresh(config) {
-  if (!config?.refresh_token) {
-    throw new CliError('Not authenticated.', 'Run: giz auth login')
-  }
-  const metadata = await discovery(config.baseUrl)
+async function exchangeToken(baseUrl, metadata, grant, config = {}) {
   const body = new URLSearchParams({
-    grant_type: 'refresh_token',
     client_id: CLIENT_ID,
-    refresh_token: config.refresh_token,
-    resource: new URL('/api/mcp', config.baseUrl).href
+    resource: new URL('/api/mcp', baseUrl).href,
+    ...grant
   })
   const response = await fetch(metadata.token_endpoint, {
     method: 'POST',
     headers: { 'content-type': 'application/x-www-form-urlencoded' },
-    body
+    body,
+    signal: AbortSignal.timeout(30_000)
   })
   const payload = await response.json()
   if (!response.ok) {
-    throw new CliError(
-      payload.error_description || payload.error || 'Giz session could not be refreshed.',
-      'Run: giz auth login'
-    )
+    const error = new CliError(payload.error_description || payload.error || 'OAuth token exchange failed.', 'Run: giz auth login')
+    error.oauthError = payload.error
+    throw error
   }
-  const next = {
+  return {
     ...config,
+    baseUrl,
     ...payload,
     refresh_token: payload.refresh_token || config.refresh_token,
     expires_at: Date.now() + Number(payload.expires_in || 3600) * 1000
   }
-  await saveConfig(next)
-  return next
 }
 
-async function credentials(baseUrl, forceRefresh = false) {
+async function credentials(baseUrl, rejectedToken) {
   if (process.env.GIZ_TOKEN) return { access_token: process.env.GIZ_TOKEN, baseUrl }
-  let config = await readConfig()
-  if (!config?.access_token) throw new CliError('Not authenticated.', 'Run: giz auth login')
+  const config = await readConfig()
+  if (!config?.access_token) {
+    const computer = await computerIdentity(rejectedToken)
+    if (!computer) throw new CliError('Not authenticated.', 'Run: giz auth login')
+    if (computer.baseUrl !== baseUrl) throw new CliError('컴퓨터 신원은 다른 서버에서 사용할 수 없습니다.', '사용자 계정으로 giz auth login을 실행해 주세요.')
+    return computer
+  }
   if (String(config.baseUrl).replace(/\/+$/, '') !== baseUrl) {
     throw new CliError(
       `Credentials belong to ${config.baseUrl}.`,
       `Run: giz auth login --base-url ${baseUrl}`
     )
   }
-  if (forceRefresh || Number(config.expires_at || 0) <= Date.now() + 60_000) config = await refresh(config)
+  const expired = (value) => value.access_token === rejectedToken || Number(value.expires_at || 0) <= Date.now() + 60_000
+  if (expired(config)) {
+    return await updateConfig(async (config) => {
+      if (config?.baseUrl !== baseUrl) throw new CliError('Giz credentials changed.', 'Run: giz auth login')
+      if (expired(config)) {
+        if (!config.refresh_token) throw new CliError('Giz session expired.', 'Run: giz auth login')
+        return await exchangeToken(baseUrl, await discovery(baseUrl), {
+          grant_type: 'refresh_token', refresh_token: config.refresh_token
+        }, config)
+      }
+      return config
+    })
+  }
   return config
 }
 
-async function api(baseUrl, pathname, data, options = {}) {
-  const run = async (forceRefresh = false) => {
-    const auth = await credentials(baseUrl, forceRefresh)
-    const response = await fetch(new URL(pathname, baseUrl), {
-      method: data === undefined ? 'GET' : 'POST',
-      headers: {
-        accept: 'application/json',
-        ...(data === undefined ? {} : { 'content-type': 'application/json' }),
-        authorization: `Bearer ${auth.access_token}`
-      },
-      ...(data === undefined ? {} : { body: JSON.stringify(data) })
-    })
-    const text = await response.text()
-    let payload
-    try {
-      payload = text ? JSON.parse(text) : null
-    } catch {
-      payload = { message: text.slice(0, 500) }
-    }
-    return { response, payload }
+async function authenticatedFetch(baseUrl, url, init = {}) {
+  const headers = new Headers(init.headers)
+  let auth = await credentials(baseUrl)
+  const signal = AbortSignal.timeout(25 * 60_000)
+  const send = () => {
+    headers.set('authorization', `Bearer ${auth.access_token}`)
+    // The server resolves membership and roles; the CLI only names the organization, as the web's selector does.
+    if (process.env.GIZ_ORGANIZATION) headers.set('x-giz-organization', process.env.GIZ_ORGANIZATION)
+    return fetch(url, { ...init, headers, signal: init.signal ? AbortSignal.any([init.signal, signal]) : signal })
   }
-  let result = await run()
-  if (result.response.status === 401 && !process.env.GIZ_TOKEN && !options.refreshed) {
-    result = await run(true)
+  let response = await send()
+  if (response.status === 401 && !process.env.GIZ_TOKEN) {
+    await response.body?.cancel()
+    auth = await credentials(baseUrl, auth.access_token)
+    response = await send()
   }
-  if (!result.response.ok) {
-    const required = result.response.status === 403 ? result.payload?.message : undefined
+  return response
+}
+
+async function jsonResponse(response, baseUrl) {
+  const text = await response.text()
+  let payload
+  try { payload = JSON.parse(text) } catch {
+    if (response.ok) throw new CliError('Giz API returned invalid JSON.', `Request: ${new URL(response.url).pathname}`)
+    payload = { message: text.slice(0, 500) }
+  }
+  if (!response.ok) {
+    const message = payload?.message || payload?.error?.message || `Giz API returned HTTP ${response.status}.`
+    // Older servers have only the legacy message; classify that exact contract without hiding other 404s.
+    if (response.status === 404 && (payload?.code === 'EXTERNAL_TOOL_UNAVAILABLE' ||
+        (new URL(response.url).pathname.startsWith('/api/tools/') && /^Unknown Giz tool: /.test(message)))) {
+      const compatibility = payload?.code === 'EXTERNAL_TOOL_UNAVAILABLE'
+        ? message : '서버 버전은 확인할 수 없습니다(구버전 서버).'
+      throw new CliError(
+        `이 서버는 요청한 명령을 지원하지 않습니다. CLI ${CLI_VERSION}. ${compatibility}`,
+        `서버 주소(${baseUrl})와 지원 버전을 확인해 주세요. 지원하는 서버는 --base-url로 선택할 수 있습니다.`,
+        response.status
+      )
+    }
     throw new CliError(
-      result.payload?.message || `Giz API returned HTTP ${result.response.status}.`,
-      required?.includes('scope') ? 'Run: giz auth login' : 'Run with --json for the complete error.',
-      result.response.status
+      message,
+      response.status === 403 && /scope/i.test(message)
+        ? (process.env.GIZ_TOKEN ? 'Provide a GIZ_TOKEN with the required scope.' : `Run: giz auth login --base-url ${baseUrl}`)
+        : `Request: ${new URL(response.url).pathname}`,
+      response.status
     )
   }
-  return result.payload
+  return payload
 }
 
-async function uploadMedia(baseUrl, localFile) {
-  const filePath = path.resolve(String(localFile))
-  const run = async (forceRefresh = false) => {
-    const auth = await credentials(baseUrl, forceRefresh)
-    let file
-    try {
-      file = await openAsBlob(filePath)
-    } catch (error) {
-      throw new CliError(`Could not open ${filePath}.`, String(error?.message || error))
-    }
-    const body = new FormData()
-    body.append('file', file, path.basename(filePath))
-    const response = await fetch(new URL('/api/storage/media', baseUrl), {
-      method: 'POST',
-      headers: {
-        accept: 'application/json',
-        authorization: `Bearer ${auth.access_token}`
-      },
-      body
-    })
-    const text = await response.text()
-    let payload
-    try {
-      payload = text ? JSON.parse(text) : null
-    } catch {
-      payload = { message: text.slice(0, 500) }
+async function api(baseUrl, pathname, data, options = {}) {
+  const response = await authenticatedFetch(baseUrl, new URL(pathname, baseUrl), {
+    method: options.method || (data === undefined ? 'GET' : 'POST'),
+    headers: { accept: 'application/json', ...(data === undefined ? {} : { 'content-type': 'application/json' }) },
+    ...(data === undefined ? {} : { body: JSON.stringify(data) })
+  })
+  const payload = await jsonResponse(response, baseUrl)
+  if (pathname === '/api/external/me' && payload.minimumCliVersion) {
+    const current = CLI_VERSION.split('.').map(Number)
+    const minimum = String(payload.minimumCliVersion).split('.').map(Number)
+    const differing = minimum.findIndex((part, index) => part !== current[index])
+    if (differing >= 0 && current[differing] < minimum[differing]) {
+      process.stderr.write(`Warning: Giz CLI ${CLI_VERSION} is below minimum ${payload.minimumCliVersion}; update @gizai/cli.\n`)
     }
-    return { response, payload }
   }
-  let result = await run()
-  if (result.response.status === 401 && !process.env.GIZ_TOKEN) result = await run(true)
-  if (!result.response.ok) {
-    throw new CliError(
-      result.payload?.message || `Giz upload returned HTTP ${result.response.status}.`,
-      'Check the file and your Giz storage access.'
-    )
-  }
-  const url = String(result.payload?.url || '').trim()
-  const drivePath = String(result.payload?.path || '').trim()
+  return payload
+}
+
+async function uploadMedia(baseUrl, localFile) {
+  const filePath = path.resolve(String(localFile))
+  const body = new FormData()
+  body.append('file', await openAsBlob(filePath), path.basename(filePath))
+  const response = await authenticatedFetch(baseUrl, new URL('/api/storage/media', baseUrl), {
+    method: 'POST', headers: { accept: 'application/json' }, body
+  })
+  const payload = await jsonResponse(response, baseUrl)
+  const url = String(payload?.url || '').trim()
+  const drivePath = String(payload?.path || '').trim()
   if (!url || !drivePath) throw new CliError('Giz upload returned an incomplete file reference.', 'Try the upload again.')
-  return { ...result.payload, url: new URL(url, baseUrl).href }
+  return { ...payload, url: new URL(url, baseUrl).href }
 }
 
 async function login(baseUrl, options) {
   const metadata = await discovery(baseUrl)
+  if (options.device === true) return await deviceLogin(baseUrl, metadata)
   const verifier = randomBytes(48).toString('base64url')
   const challenge = createHash('sha256').update(verifier).digest('base64url')
   const state = randomBytes(24).toString('base64url')
-  const callback = waitForCallback(state)
+  const callback = await waitForCallback(state)
   const authorization = new URL(metadata.authorization_endpoint)
   for (const [name, value] of Object.entries({
     response_type: 'code',
     client_id: CLIENT_ID,
-    redirect_uri: CALLBACK_URL,
+    redirect_uri: callback.url,
     scope: SCOPES.join(' '),
     resource: new URL('/api/mcp', baseUrl).href,
     code_challenge: challenge,
@@ -226,76 +259,86 @@ async function login(baseUrl, options) {
     prompt: 'consent',
     state
   })) authorization.searchParams.set(name, value)
-  process.stdout.write(`Opening Giz sign-in:\n${authorization}\n`)
+  process.stderr.write(`Opening Giz sign-in:\n${authorization}\n`)
   if (options.open !== 'false' && options['no-open'] !== true) openBrowser(authorization.href)
-  const code = await callback
-  const response = await fetch(metadata.token_endpoint, {
-    method: 'POST',
-    headers: { 'content-type': 'application/x-www-form-urlencoded' },
-    body: new URLSearchParams({
-      grant_type: 'authorization_code',
-      client_id: CLIENT_ID,
-      redirect_uri: CALLBACK_URL,
-      code,
-      code_verifier: verifier,
-      resource: new URL('/api/mcp', baseUrl).href
-    })
+  const code = await callback.code
+  await updateConfig(() => exchangeToken(baseUrl, metadata, {
+    grant_type: 'authorization_code', redirect_uri: callback.url, code, code_verifier: verifier
+  }))
+  return await api(baseUrl, '/api/external/me')
+}
+
+async function deviceLogin(baseUrl, metadata) {
+  if (!metadata.device_authorization_endpoint) throw new CliError('OAuth device authorization is not supported.')
+  const response = await fetch(metadata.device_authorization_endpoint, {
+    method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({ client_id: CLIENT_ID, scope: SCOPES.join(' '), resource: new URL('/api/mcp', baseUrl).href }),
+    signal: AbortSignal.timeout(30_000)
   })
-  const payload = await response.json()
-  if (!response.ok) {
-    throw new CliError(payload.error_description || payload.error || 'OAuth token exchange failed.', 'Run: giz auth login')
+  const device = await response.json()
+  if (!response.ok) throw new CliError(device.error_description || device.error || 'OAuth device authorization failed.')
+  if (!device.device_code || !device.user_code || !device.verification_uri || !(Number(device.expires_in) > 0)) {
+    throw new CliError('OAuth device authorization returned an incomplete response.')
   }
-  await saveConfig({
-    baseUrl,
-    ...payload,
-    expires_at: Date.now() + Number(payload.expires_in || 3600) * 1000
-  })
-  return await api(baseUrl, '/api/external/me')
+  process.stderr.write(`Giz sign-in: ${device.verification_uri_complete || device.verification_uri}\nCode: ${device.user_code}\n`)
+  let interval = Number(device.interval ?? 5) * 1000
+  if (!Number.isFinite(interval) || interval <= 0) throw new CliError('OAuth device authorization returned an invalid interval.')
+  const deadline = Date.now() + Number(device.expires_in) * 1000
+  while (Date.now() < deadline) {
+    const remaining = deadline - Date.now()
+    await new Promise((resolve) => setTimeout(resolve, Math.min(interval, remaining)))
+    if (interval >= remaining || Date.now() >= deadline) break
+    try {
+      await updateConfig(() => exchangeToken(baseUrl, metadata, {
+        grant_type: 'urn:ietf:params:oauth:grant-type:device_code', device_code: device.device_code
+      }))
+    } catch (error) {
+      if (error.oauthError === 'slow_down') interval += 5000
+      else if (error.name === 'TimeoutError') interval *= 2
+      else if (error.oauthError !== 'authorization_pending') throw error
+      continue
+    }
+    return await api(baseUrl, '/api/external/me')
+  }
+  throw new CliError('expired_token: Giz device code expired.', 'Run: giz auth login --device')
 }
 
-function waitForCallback(expectedState) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => {
+async function waitForCallback(expectedState) {
+  const server = createServer()
+  server.listen(0, '127.0.0.1')
+  await once(server, 'listening')
+  const callbackUrl = `http://127.0.0.1:${server.address().port}/callback`
+  const code = new Promise((resolve, reject) => {
+    const finish = (error, value) => {
+      clearTimeout(timer)
       server.close()
-      reject(new CliError('Giz sign-in timed out.', 'Run: giz auth login'))
-    }, 5 * 60 * 1000)
-    const server = createServer((request, response) => {
-      const url = new URL(request.url || '/', CALLBACK_URL)
+      error ? reject(error) : resolve(value)
+    }
+    const timer = setTimeout(() => finish(new CliError('Giz sign-in timed out.', 'Run: giz auth login')), 5 * 60 * 1000)
+    server.on('request', (request, response) => {
+      const url = new URL(request.url || '/', callbackUrl)
       if (url.pathname !== '/callback') {
         response.writeHead(404).end('Not found')
         return
       }
-      const finish = (error, code) => {
-        clearTimeout(timer)
-        response.setHeader('content-type', 'text/html; charset=utf-8')
-        response.end(error
-          ? '<h1>Giz connection failed</h1><p>Return to the terminal for details.</p>'
-          : '<h1>Giz connected</h1><p>You can close this window and return to the terminal.</p>')
-        server.close()
-        error ? reject(error) : resolve(code)
-      }
       if (url.searchParams.get('state') !== expectedState) {
-        finish(new CliError('OAuth state did not match.', 'Run: giz auth login'))
-      } else if (url.searchParams.get('error')) {
-        finish(new CliError(
-          url.searchParams.get('error_description') || url.searchParams.get('error'),
-          'Run: giz auth login'
-        ))
-      } else if (!url.searchParams.get('code')) {
-        finish(new CliError('OAuth callback did not include a code.', 'Run: giz auth login'))
-      } else {
-        finish(undefined, url.searchParams.get('code'))
+        response.writeHead(400).end('This sign-in link has expired. Use the link from your current giz auth login.')
+        return
       }
+      const code = url.searchParams.get('code')
+      const error = url.searchParams.get('error') || !code
+        ? new CliError(url.searchParams.get('error_description') || url.searchParams.get('error') || 'OAuth callback did not include a code.', 'Run: giz auth login')
+        : undefined
+      response.setHeader('content-type', 'text/html; charset=utf-8')
+      response.setHeader('connection', 'close')
+      response.end(error
+        ? '<h1>Giz connection failed</h1><p>Return to the terminal for details.</p>'
+        : '<h1>Giz connected</h1><p>You can close this window and return to the terminal.</p>')
+      finish(error, code)
     })
-    server.on('error', (error) => {
-      clearTimeout(timer)
-      reject(new CliError(
-        `Could not listen on ${CALLBACK_URL}: ${error.message}`,
-        'Close the process using port 53682 and run: giz auth login'
-      ))
-    })
-    server.listen(53682, '127.0.0.1')
+    server.on('error', finish)
   })
+  return { url: callbackUrl, code }
 }
 
 function openBrowser(url) {
@@ -306,6 +349,23 @@ function openBrowser(url) {
   child.unref()
 }
 
+// --input @FILE and --input - (stdin) carry JSON too large for one process argument (Linux caps one at 128 KiB).
+async function inputText(value) {
+  if (value === '-') {
+    let text = ''
+    for await (const chunk of process.stdin) text += chunk
+    return text
+  }
+  if (typeof value === 'string' && value.startsWith('@')) {
+    try {
+      return await readFile(value.slice(1), 'utf8')
+    } catch {
+      throw new CliError(`Could not read ${value.slice(1)}.`, 'Pass --input @PATH to an existing JSON file.')
+    }
+  }
+  return value
+}
+
 function jsonInput(value) {
   if (value === undefined || value === true) return {}
   try {
@@ -340,14 +400,66 @@ async function applyUploads(baseUrl, input, values = []) {
   return input
 }
 
+// Mutations use the user's reviewed App revision; fetching it silently would bypass conflict protection.
+function appRevision(options) {
+  const raw = options['expected-revision']
+  if (raw === undefined || raw === '') {
+    throw new CliError('개정 번호가 필요합니다.', 'giz app list에서 확인한 revision을 --expected-revision으로 전달해 주세요.')
+  }
+  const revision = Number(raw)
+  if (typeof raw !== 'string' || !/^\d+$/.test(raw) || !Number.isSafeInteger(revision) || revision < 1 || revision > 9_007_199_254_740_990) {
+    throw new CliError('개정 번호는 1 이상의 안전한 정수여야 합니다.', 'giz app list에서 현재 revision을 확인해 주세요.')
+  }
+  return revision
+}
+
 async function invoke(baseUrl, tool, input) {
   return await api(baseUrl, `/api/tools/${encodeURIComponent(tool)}`, input)
 }
 
+function mcpTransport(baseUrl) {
+  return new StreamableHTTPClientTransport(new URL('/api/mcp', baseUrl), {
+    fetch: (url, init) => authenticatedFetch(baseUrl, url, init)
+  })
+}
+
+async function serveMcp(baseUrl) {
+  const remote = mcpTransport(baseUrl)
+  const stdio = new StdioServerTransport()
+  try {
+    await remote.start()
+    await new Promise((resolve, reject) => {
+      remote.onerror = stdio.onerror = reject
+      remote.onmessage = (message) => {
+        if (message.result?.protocolVersion) remote.setProtocolVersion(message.result.protocolVersion)
+        stdio.send(message).catch(reject)
+      }
+      stdio.onmessage = (message) => { remote.send(message).catch(reject) }
+      process.stdin.once('end', resolve)
+      stdio.start().catch(reject)
+    })
+  } finally {
+    await remote.close()
+    await stdio.close()
+  }
+}
+
 async function runCommand(baseUrl, positionals, options) {
   const [command, subcommand, ...rest] = positionals
-  if (options.version === true) return { kind: 'message', value: CLI_VERSION }
+  if (options.version === true) {
+    const revision = await managedRevision()
+    return { kind: 'message', value: CLI_VERSION + (revision ? ` (region ${revision.trim()})` : '') }
+  }
   if (!command || command === 'help' || options.help === true) return { kind: 'help', value: help(command) }
+  if (command === 'engine' && subcommand === 'run') {
+    if (rest[0] !== 'claude') throw new CliError('Only Claude Code is an engine connection.')
+    await api(baseUrl, '/api/external/engine/claude/authorization')
+    const { runEngine } = await import('./engine.mjs')
+    const result = await runEngine(rest[0], required(rest[1], 'INSTRUCTION', 'Run: giz engine run claude "instruction"'), options.dir,
+      event => process.stdout.write(JSON.stringify(event) + '\n'))
+    if (result.status !== 'completed') process.exitCode = 1
+    return { kind: 'result', value: result }
+  }
   if (command === 'auth' && subcommand === 'login') {
     return { kind: 'auth', value: await login(baseUrl, options) }
   }
@@ -355,24 +467,43 @@ async function runCommand(baseUrl, positionals, options) {
     return { kind: 'auth', value: await api(baseUrl, '/api/external/me') }
   }
   if (command === 'auth' && subcommand === 'logout') {
-    const config = await readConfig()
-    if (config?.refresh_token) {
-      const metadata = await discovery(baseUrl)
-      await fetch(metadata.revocation_endpoint, {
-        method: 'POST',
-        headers: { 'content-type': 'application/x-www-form-urlencoded' },
-        body: new URLSearchParams({
-          token: config.refresh_token,
-          token_type_hint: 'refresh_token',
-          client_id: CLIENT_ID
+    await updateConfig(async (config) => {
+      if (config?.refresh_token) {
+        const metadata = await discovery(config.baseUrl)
+        const response = await fetch(metadata.revocation_endpoint, {
+          method: 'POST', signal: AbortSignal.timeout(30_000),
+          headers: { 'content-type': 'application/x-www-form-urlencoded' },
+          body: new URLSearchParams({ token: config.refresh_token, token_type_hint: 'refresh_token', client_id: CLIENT_ID })
         })
-      })
-    }
-    await unlink(configPath).catch((error) => {
-      if (error?.code !== 'ENOENT') throw error
+        if (!response.ok) throw new CliError(`Giz sign-out failed: HTTP ${response.status}.`, 'Run: giz auth logout')
+      }
     })
     return { kind: 'message', value: 'Signed out of Giz on this device.' }
   }
+  if (command === 'api-key' && subcommand === 'list') {
+    return { kind: 'result', value: await api(baseUrl, '/api/external/api-keys') }
+  }
+  if (command === 'api-key' && subcommand === 'create') {
+    const name = required(rest.join(' ') || options.name, 'NAME', 'Run: giz api-key create "My app"')
+    const scopes = options.scopes
+      ? String(options.scopes).split(',').map((scope) => scope.trim()).filter(Boolean)
+      : undefined
+    return {
+      kind: 'result',
+      value: await api(baseUrl, '/api/external/api-keys', {
+        name,
+        ...(scopes ? { scopes } : {}),
+        ...(options.expires ? { expiresAt: options.expires } : {})
+      })
+    }
+  }
+  if (command === 'api-key' && subcommand === 'revoke') {
+    const id = required(rest[0], 'KEY', 'Run: giz api-key revoke key_...')
+    return {
+      kind: 'result',
+      value: await api(baseUrl, `/api/external/api-keys/${encodeURIComponent(id)}`, undefined, { method: 'DELETE' })
+    }
+  }
 
   if (command === 'model' && subcommand === 'list') {
     return {
@@ -395,6 +526,22 @@ async function runCommand(baseUrl, positionals, options) {
   if (command === 'models') {
     throw new CliError('Unknown command "models".', 'Did you mean: giz model list')
   }
+  if (command === 'chat') {
+    const model = required(options.model || subcommand, 'MODEL', 'Run: giz chat MODEL "your prompt"')
+    const input = jsonInput(options.input)
+    const prompt = rest.join(' ').trim()
+    const messages = input.messages || (prompt ? [{ role: 'user', content: prompt }] : undefined)
+    required(messages, 'MESSAGES', 'Pass a prompt or --input \'{"messages":[...]}\'')
+    return {
+      kind: 'result',
+      value: await api(baseUrl, '/v1/chat/completions', {
+        ...input,
+        model,
+        messages,
+        stream: false
+      })
+    }
+  }
 
   if (command === 'generate' && ['image', 'video', 'audio', 'music', 'talking-head'].includes(subcommand)) {
     const tool = {
@@ -414,7 +561,6 @@ async function runCommand(baseUrl, positionals, options) {
       ...(rest.length ? { prompt: rest.join(' ') } : {}),
       ...(options.model ? { model: options.model } : {})
     }, uploads)
-    required(input.prompt, 'PROMPT', `Run: giz generate ${subcommand} "your prompt"`)
     return { kind: 'job', value: await invoke(baseUrl, tool, input) }
   }
 
@@ -433,7 +579,7 @@ async function runCommand(baseUrl, positionals, options) {
     const id = required(rest[0], 'JOB', 'Run: giz job wait JOB')
     while (true) {
       const job = await invoke(baseUrl, 'job.get', { job: id })
-      if (['completed', 'failed', 'cancelled'].includes(job.status)) return { kind: 'job', value: job }
+      if (['completed', 'failed', 'cancelled'].includes(job.status)) return { kind: 'job', value: job, exitCode: job.status === 'completed' ? 0 : 1 }
       if (process.stderr.isTTY) process.stderr.write(`\r${job.id}  ${job.status}  ${job.message || ''}`.slice(0, 120))
       await new Promise((resolve) => setTimeout(resolve, 1000))
     }
@@ -467,16 +613,47 @@ async function runCommand(baseUrl, positionals, options) {
           path: drivePath,
           content: String(content),
           encoding,
-          ...(options.computer ? { computerId: options.computer } : {})
+          ...(options.computer ? { computer: options.computer } : {})
         })
       }
     }
-    const mapping = mappings[subcommand]
+    const mapping = mappings[subcommand === 'ls' ? 'list' : subcommand]
     if (!mapping) throw new CliError(`Unknown drive command "${subcommand || ''}".`, 'Run: giz drive --help')
     const [tool, input] = mapping()
     return {
       kind: 'result',
-      value: await invoke(baseUrl, tool, { ...input, ...(options.computer ? { computerId: options.computer } : {}) })
+      value: await invoke(baseUrl, tool, { ...input, ...(options.computer ? { computer: options.computer } : {}) })
+    }
+  }
+
+  if (command === 'table' && subcommand === 'list') {
+    return { kind: 'result', value: await invoke(baseUrl, 'workspace.objects', {}) }
+  }
+
+  if (command === 'table' && subcommand === 'get') {
+    const object = required(rest[0], 'TABLE', 'Run: giz table get task')
+    return { kind: 'result', value: await invoke(baseUrl, 'workspace.objects', { object }) }
+  }
+
+  if (command === 'table' && subcommand === 'action') {
+    const view = required(rest[0], 'TABLE', 'Run: giz table action TABLE ACTION [--id ID] --input JSON')
+    const action = required(rest[1], 'ACTION', 'Run: giz table get TABLE to see its actions')
+    const id = options.id === undefined ? undefined : String(options.id).includes(',') ? String(options.id).split(',') : String(options.id)
+    return {
+      kind: 'result',
+      value: await invoke(baseUrl, 'workspace.executeAction', { view, action, ...(id === undefined ? {} : { dataId: id }), data: jsonInput(options.input) })
+    }
+  }
+
+  if (command === 'table' && ['read', 'write'].includes(subcommand)) {
+    const table = required(rest[0], 'TABLE', `Run: giz table ${subcommand} TABLE_PATH --input JSON`)
+    return {
+      kind: 'result',
+      value: await invoke(baseUrl, subcommand === 'read' ? 'table.readRows' : 'table.writeRows', {
+        ...jsonInput(options.input),
+        table,
+        ...(options.computer ? { computer: options.computer } : {})
+      })
     }
   }
 
@@ -487,28 +664,128 @@ async function runCommand(baseUrl, positionals, options) {
 
   if (command === 'computer') {
     if (subcommand === 'list') return { kind: 'computers', value: await invoke(baseUrl, 'computer.list', {}) }
-    const computerId = rest[0] || options.computer
-    if (subcommand === 'get') return { kind: 'result', value: await invoke(baseUrl, 'computer.get', computerId ? { computerId } : {}) }
+    const computer = options.computer || (subcommand === 'exec' ? undefined : rest[0])
+    if (subcommand === 'get') return { kind: 'result', value: await invoke(baseUrl, 'computer.get', computer ? { computer } : {}) }
     if (subcommand === 'start' || subcommand === 'stop') {
       return {
         kind: 'result',
-        value: await invoke(baseUrl, `computer.${subcommand}`, computerId ? { computerId } : {})
+        value: await invoke(baseUrl, `computer.${subcommand}`, computer ? { computer } : {})
       }
     }
     if (subcommand === 'exec') {
-      const commandArgs = rest
-      if (!commandArgs.length) throw new CliError('COMMAND is required.', 'Run: giz computer exec -- ls -la')
+      if (!rest.length) throw new CliError('COMMAND is required.', 'Run: giz computer exec -- ls -la')
+      const stdin = options['stdin-file'] ? await readFile(String(options['stdin-file']), 'utf8') : options.stdin
+      const value = await invoke(baseUrl, 'computer.exec', {
+        command: rest,
+        ...(stdin !== undefined ? { stdin: String(stdin) } : {}),
+        ...(options['deadline-ms'] !== undefined ? { deadlineMs: Number(options['deadline-ms']) } : {}),
+        ...(options.cwd ? { cwd: options.cwd } : {}),
+        ...(computer ? { computer } : {})
+      })
+      return { kind: 'result', value, exitCode: value.exitCode }
+    }
+    throw new CliError(`Unknown computer command "${subcommand || ''}".`, 'Run: giz computer --help')
+  }
+
+  if (command === 'app') {
+    const computer = options.computer ? { computer: options.computer } : {}
+    if (subcommand === 'list') {
+      return { kind: 'result', value: await invoke(baseUrl, 'app.list', computer) }
+    }
+    if (subcommand === 'save' || subcommand === 'create') {
+      const input = jsonInput(options.input)
+      return { kind: 'result', value: await invoke(baseUrl, 'app.save', { ...input, ...computer }) }
+    }
+    if (subcommand === 'run') {
+      const id = required(rest[0], 'APP_ID', 'Run: giz app run APP_ID --expected-revision REVISION')
+      return { kind: 'result', value: await invoke(baseUrl, 'app.run', { ...computer, id, expectedRevision: appRevision(options) }) }
+    }
+    if (subcommand === 'publish') {
+      const id = required(rest[0], 'APP_ID', 'Run: giz app publish APP_ID private|workspace|public')
+      const visibility = required(rest[1] || options.visibility, 'VISIBILITY', 'Run: giz app publish APP_ID private|workspace|public')
+      return { kind: 'result', value: await invoke(baseUrl, 'app.publish', { ...computer, id, visibility, expectedRevision: appRevision(options) }) }
+    }
+    if (subcommand === 'open') {
+      const id = required(rest[0], 'APP_ID', 'Run: giz app open APP_ID')
+      return { kind: 'result', value: await invoke(baseUrl, 'app.open', { ...computer, id }) }
+    }
+    if (subcommand === 'delete') {
+      const id = required(rest[0], 'APP_ID', 'Run: giz app delete APP_ID')
+      return { kind: 'result', value: await invoke(baseUrl, 'app.delete', { ...computer, id, expectedRevision: appRevision(options) }) }
+    }
+    throw new CliError(`Unknown app command "${subcommand || ''}".`, 'Run: giz app --help')
+  }
+
+  if (command === 'capability') {
+    if (subcommand === 'list') {
       return {
         kind: 'result',
-        value: await invoke(baseUrl, 'container.exec', {
-          command: commandArgs,
-          sessionId: String(options.session || 'giz-cli'),
-          ...(options.cwd ? { cwd: options.cwd } : {}),
-          ...(options.computer ? { computerId: options.computer } : {})
+        value: await invoke(baseUrl, 'capability.status', {
+          ...(options.computer ? { computer: options.computer } : {})
         })
       }
     }
-    throw new CliError(`Unknown computer command "${subcommand || ''}".`, 'Run: giz computer --help')
+    if (subcommand === 'search') {
+      const kind = required(rest[0], 'KIND', 'Run: giz capability search skill|mcp QUERY')
+      const query = required(rest.slice(1).join(' '), 'QUERY', 'Run: giz capability search skill|mcp QUERY')
+      return {
+        kind: 'result',
+        value: await invoke(baseUrl, 'capability.catalog', {
+          kind,
+          query,
+          ...(options.limit ? { limit: Number(options.limit) } : {})
+        })
+      }
+    }
+    if (subcommand === 'install') {
+      const kind = required(rest[0], 'KIND', 'Run: giz capability install skill|mcp ID --query QUERY')
+      const id = required(rest[1], 'ID', 'Run: giz capability install skill|mcp ID --query QUERY')
+      const query = required(options.query, 'QUERY', 'Repeat the catalog query with --query QUERY.')
+      return {
+        kind: 'result',
+        value: await invoke(baseUrl, 'capability.install', {
+          kind,
+          id,
+          query,
+          ...(options.computer ? { computer: options.computer } : {})
+        })
+      }
+    }
+    if (subcommand === 'update' || subcommand === 'remove') {
+      const id = required(rest[0], 'ID', `Run: giz capability ${subcommand} ID`)
+      return {
+        kind: 'result',
+        value: await invoke(baseUrl, 'capability.manage', {
+          id,
+          operation: subcommand,
+          ...(options.computer ? { computer: options.computer } : {})
+        })
+      }
+    }
+    throw new CliError(`Unknown capability command "${subcommand || ''}".`, 'Run: giz capability --help')
+  }
+
+  if (command === 'agent') {
+    if (subcommand === 'start') {
+      return {
+        kind: 'result',
+        value: await invoke(baseUrl, 'agent.start', {
+          ...jsonInput(options.input),
+          ...(options.computer ? { computer: options.computer } : {})
+        })
+      }
+    }
+    if (subcommand === 'status' || subcommand === 'cancel') {
+      const turnId = required(rest[0], 'TURN', `Run: giz agent ${subcommand} TURN`)
+      return {
+        kind: 'result',
+        value: await invoke(baseUrl, `agent.${subcommand}`, {
+          turnId,
+          ...(subcommand === 'status' && options.wait ? { wait: true } : {})
+        })
+      }
+    }
+    throw new CliError(`Unknown agent command "${subcommand || ''}".`, 'Run: giz agent --help')
   }
 
   if (command === 'invoke') {
@@ -519,90 +796,133 @@ async function runCommand(baseUrl, positionals, options) {
   if (command === 'mcp' && subcommand === 'url') {
     return { kind: 'message', value: new URL('/api/mcp', baseUrl).href }
   }
+  if (command === 'mcp' && subcommand === 'serve') {
+    await serveMcp(baseUrl)
+    return
+  }
+  if (command === 'mcp' && subcommand === 'check') {
+    const client = new Client({ name: 'giz-cli', version: CLI_VERSION })
+    try {
+      await client.connect(mcpTransport(baseUrl))
+      const { tools } = await client.listTools()
+      if (!tools.length) throw new CliError('Giz MCP returned zero tools.', 'Check your Giz connection and scopes.')
+      return { kind: 'result', value: { server: client.getServerVersion(), tools: tools.map((tool) => tool.name) } }
+    } finally { await client.close() }
+  }
   if (command === 'mcp' && subcommand === 'add') {
     const client = required(rest[0], 'CLIENT', 'Run: giz mcp add codex|claude')
+    if (!['codex', 'claude'].includes(client)) throw new CliError(`Unsupported MCP client "${client}".`, 'Supported clients: codex, claude')
+    const transport = options.transport || 'stdio'
+    if (!['stdio', 'http'].includes(transport)) throw new CliError('MCP transport must be stdio or http.')
     const endpoint = new URL('/api/mcp', baseUrl).href
-    if (client === 'codex') {
-      runExternal('codex', ['mcp', 'add', 'giz', '--url', endpoint, '--oauth-resource', endpoint], 'Install Codex CLI first.')
-      return { kind: 'message', value: 'Giz was added to Codex. Complete the browser approval opened by Codex.' }
-    }
-    if (client === 'claude') {
-      runExternal('claude', ['mcp', 'add', '--transport', 'http', '--scope', 'user', 'giz', endpoint], 'Install Claude Code first.')
-      return { kind: 'message', value: 'Giz was added to Claude Code. Open Claude Code and run /mcp to sign in.' }
-    }
-    throw new CliError(`Unsupported MCP client "${client}".`, 'Supported clients: codex, claude')
+    const target = transport === 'stdio'
+      ? ['--env', `GIZ_CONFIG=${configPath}`, '--', process.execPath, fileURLToPath(import.meta.url), 'mcp', 'serve', '--base-url', baseUrl]
+      : client === 'codex' ? ['--url', endpoint, '--oauth-resource', endpoint] : [endpoint]
+    runExternal(client, ['mcp', 'add', ...(client === 'claude' ? ['--scope', 'user', '--transport', transport] : []), 'giz', ...target],
+      `Install ${client === 'codex' ? 'Codex: npm install -g @openai/codex' : 'Claude Code: npm install -g @anthropic-ai/claude-code'}`, transport === 'http')
+    return { kind: 'message', value: `Giz was added to ${client} (${transport}). ${transport === 'stdio'
+      ? 'Run giz auth login, then giz mcp check --json before starting a headless session.'
+      : client === 'claude' ? 'Open Claude Code and run /mcp to sign in.' : 'Complete the browser approval opened by Codex.'}` }
   }
 
   if (command === 'skill' && subcommand === 'install') {
     const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'skills')
-    runExternal('npx', ['--yes', 'skills', 'add', root, '--all'], 'Install Node.js 20 or newer first.')
+    runExternal('npx', ['--yes', 'skills', 'add', root, '--skill', '*', '--agent', 'universal', '--copy', '-y'], 'Install Node.js 20 or newer first.')
     return { kind: 'message', value: 'Giz Skill installed for available AI agents.' }
   }
 
   throw new CliError(`Unknown command "${[command, subcommand].filter(Boolean).join(' ')}".`, 'Run: giz --help')
 }
 
-function runExternal(command, args, hint) {
-  const result = spawnSync(command, args, { stdio: 'inherit' })
+function runExternal(command, args, hint, interactive = false) {
+  const result = spawnSync(command, args, { encoding: 'utf8', stdio: interactive ? ['inherit', 2, 2] : ['inherit', 'pipe', 'pipe'] })
   if (result.error?.code === 'ENOENT') throw new CliError(`${command} is not installed.`, hint)
-  if (result.status !== 0) throw new CliError(`${command} exited with status ${result.status}.`, hint)
+  if (result.error || result.status !== 0) throw new CliError(
+    `${command} failed (${result.error?.code || result.signal || result.status}): ${(result.stderr || result.stdout || result.error?.message || '').trim()}`
+  )
+  if (result.stderr || result.stdout) process.stderr.write(result.stderr + result.stdout)
 }
 
-function print(kind, value, json) {
+function print(kind, value, json, output = process.stdout) {
   if (json) {
-    process.stdout.write(`${JSON.stringify(value, null, 2)}\n`)
+    output.write(`${JSON.stringify(value, null, 2)}\n`)
     return
   }
   if (kind === 'help' || kind === 'message') {
-    process.stdout.write(`${value}\n`)
+    output.write(`${value}\n`)
+    return
+  }
+  if (kind === 'auth' && value.identity?.type === 'computer') {
+    output.write(`컴퓨터 신원으로 로그인됨 (소유자 ${value.email || value.name})\n`)
     return
   }
   if (kind === 'models') {
     const rows = value.models || []
-    for (const model of rows) process.stdout.write(`${model.id}\t${model.type}\t${model.provider || '-'}\t${model.label}\n`)
-    process.stdout.write(`\n${rows.length} models\n`)
+    for (const model of rows) output.write(`${model.id}\t${model.type}\t${model.provider || '-'}\t${model.label}\n`)
+    output.write(`\n${rows.length} models\n`)
     return
   }
   if (kind === 'jobs') {
-    for (const job of value.jobs || []) process.stdout.write(`${job.id}\t${job.status}\t${job.tool}\t${job.createdAt}\n`)
+    for (const job of value.jobs || []) output.write(`${job.id}\t${job.status}\t${job.tool}\t${job.createdAt}\n`)
     return
   }
   if (kind === 'computers') {
     for (const computer of value.computers || []) {
-      process.stdout.write(`${computer.id}\t${computer.status || '-'}\t${computer.isDefault ? 'default' : '-'}\t${computer.name}\n`)
+      output.write(`${computer.id}\t${computer.status || '-'}\t${computer.isDefault ? 'default' : '-'}\t${computer.name}\n`)
     }
     return
   }
   if (kind === 'job') {
-    process.stdout.write(`${value.id}  ${value.status}\n`)
-    if (value.message) process.stdout.write(`${value.message}\n`)
-    if (value.error) process.stdout.write(`Error: ${value.error}\n`)
-    if (value.result) process.stdout.write(`${JSON.stringify(value.result, null, 2)}\n`)
+    output.write(`${value.id}  ${value.status}\n`)
+    if (value.message) output.write(`${value.message}\n`)
+    if (value.error) output.write(`Error: ${value.error}\n`)
+    if (value.result) output.write(`${JSON.stringify(value.result, null, 2)}\n`)
     if (!['completed', 'failed', 'cancelled'].includes(value.status)) {
-      process.stdout.write(`Run: giz job wait ${value.id}\n`)
+      output.write(`Run: giz job wait ${value.id}\n`)
     }
     return
   }
-  process.stdout.write(`${JSON.stringify(value, null, 2)}\n`)
+  output.write(`${JSON.stringify(value, null, 2)}\n`)
 }
 
 function help(command) {
+  if (command === 'engine') return `Usage
+  giz engine run claude "instruction" [--dir path]
+
+Runs the official Claude Code in an isolated worktree. Connect Claude Code in Giz first.
+Progress and the final diff, files and summary are returned. Interrupting stops the engine.`
+  if (command === 'api-key') return `Usage
+  giz api-key list
+  giz api-key create "My app" [--scopes giz.inference,giz.read] [--expires ISO_TIMESTAMP]
+  giz api-key revoke KEY_ID
+
+The secret is shown only when the key is created.`
+  if (command === 'chat') return `Usage
+  giz chat MODEL "your prompt"
+  giz chat MODEL --input '{"messages":[{"role":"user","content":"Hello"}]}'`
   if (command === 'model') return `Usage
   giz model list [--type TYPE] [--search TEXT]
   giz model get MODEL
   giz model run MODEL --input JSON [--upload FIELD=LOCAL_PATH]
 
-Run model get first. Its live input schema is the source of truth. Repeat --upload for multiple media inputs.`
+Run model get first. Its live input schema is the source of truth. Repeat --upload for multiple media inputs.
+model run returns a job immediately. Retrieve the result with giz job wait JOB_ID, or poll with giz job get JOB_ID.
+For speech-to-text, use model run with the audio field returned by model get. Callback/webhook delivery is not supported.`
   if (command === 'generate') return `Usage
-  giz generate image|video|audio|music|talking-head "PROMPT" [--model MODEL]
+  giz generate image|video|music|talking-head "PROMPT" [--model MODEL]
+  giz generate audio --input '{"purpose":"speech","script":"Hello"}' [--model MODEL]
+  giz generate audio --input '{"purpose":"sound","prompt":"Rain","duration":5}'
 
 Options
   --image LOCAL_PATH       Upload a visual reference
   --audio LOCAL_PATH       Upload speech audio
   --upload FIELD=PATH      Upload into an exact tool field
-  --input JSON             Additional generation parameters`
+  --input JSON             Input matching the tool schema (@FILE reads a file, - reads stdin)
+
+For model-specific audio options, inspect giz model get MODEL and pass supported fields in settings (for example settings.speed), not at the top level.
+Generation returns a job immediately; use giz job wait JOB_ID for its result.`
   if (command === 'drive') return `Usage
-  giz drive list [PATH]
+  giz drive ls [PATH]  (list alias)
   giz drive search QUERY
   giz drive read PATH
   giz drive write PATH --content TEXT
@@ -610,47 +930,81 @@ Options
   giz drive mkdir PATH
   giz drive move FROM TO
   giz drive delete PATH`
+  if (command === 'table') return `Usage
+  giz table list
+  giz table get TABLE
+  giz table read TABLE [--input JSON] [--computer COMPUTER]
+  giz table write TABLE --input JSON [--computer COMPUTER]
+  giz table action TABLE ACTION [--id ID[,ID...]] --input JSON
+
+TABLE is a table's Drive path (for example Sales/Customers.view.ts) or a business object name from giz table list
+(for example task, issue, requirement). giz table get shows its fields, the row changes it accepts (writes) and its
+actions; an object without a write changes only through its actions. Use --org to work in an organization.
+read input:  {"select":["name"],"filters":[{"field":"status","operator":"eq","value":"open"}],"limit":50}
+write input: {"create":[{"name":"Acme"}],"update":[{"id":"ROW_ID","status":"done"}],"remove":["ROW_ID"]}
+One write is one change people can undo in the table. At most 200 rows per write.`
   if (command === 'computer') return `Usage
   giz computer list
   giz computer get|start|stop [COMPUTER]
-  giz computer exec [--computer COMPUTER] [--cwd PATH] -- COMMAND [ARGS...]`
+  giz computer exec [--computer COMPUTER] [--cwd PATH] [--deadline-ms MS] [--stdin TEXT|--stdin-file PATH] -- COMMAND [ARGS...]`
+  if (command === 'app') return `Usage
+  giz app list [--computer COMPUTER]
+  giz app create|save [--computer COMPUTER] --input JSON
+  giz app run APP_ID --expected-revision REVISION [--computer COMPUTER]
+  giz app publish APP_ID private|workspace|public --expected-revision REVISION [--computer COMPUTER]
+  giz app open APP_ID [--computer COMPUTER]
+  giz app delete APP_ID --expected-revision REVISION [--computer COMPUTER]`
+  if (command === 'capability') return `Usage
+  giz capability list [--computer COMPUTER]
+  giz capability search skill|mcp QUERY
+  giz capability install skill|mcp ID --query QUERY [--computer COMPUTER]
+  giz capability update|remove ID [--computer COMPUTER]`
+  if (command === 'agent') return `Usage
+  giz agent start [--computer COMPUTER] --input JSON
+  giz agent status TURN [--wait]
+  giz agent cancel TURN`
   if (command === 'mcp') return `Usage
   giz mcp url
-  giz mcp add codex
-  giz mcp add claude`
+  giz mcp serve
+  giz mcp check --json
+  giz mcp add codex|claude [--transport stdio|http]
+
+stdio (default) shares giz auth login and refreshes tokens automatically.
+http uses the client's own OAuth login. Install the chosen client first.`
   if (command === 'auth') return `Usage
-  giz auth login
+  giz auth login [--device]
   giz auth status
   giz auth logout`
-  return `Giz CLI — non-LLM models, Drive, and Computer from any terminal
+  return `Giz CLI — AI models, Drive, and Computer from any terminal
 
 Usage
-  giz auth login
+  giz auth login [--device]
+  giz api-key list|create|revoke
+  giz chat MODEL "your prompt"
   giz model list [--type TYPE] [--search TEXT]
   giz model get MODEL
   giz model run MODEL --input JSON [--upload FIELD=LOCAL_PATH]
-  giz generate image|video|audio|music "PROMPT" [--model MODEL]
+  giz generate image|video|music|talking-head "PROMPT" [--model MODEL]
+  giz generate audio --input JSON [--model MODEL]
   giz job list|get|wait|cancel [JOB]
-  giz drive list|search|read|write|mkdir|move|delete
+  giz drive ls|list|search|read|write|mkdir|move|delete
+  giz table list|get|read|write|action
   giz upload LOCAL_PATH
   giz computer list|get|start|stop|exec
-  giz mcp add codex|claude
+  giz app list|create|save|run|publish|open|delete
+  giz capability list|search|install|update|remove
+  giz agent start|status|cancel
+  giz engine run claude "instruction" [--dir path]
+  giz mcp url|serve|check|add
   giz skill install
   giz invoke TOOL --input JSON
 
-Examples
-  giz auth login
-  giz generate image "A paper observatory at blue hour"
-  giz model list --type video-generation
-  giz model run ltx2-distilled --input '{"prompt":"A slow dolly in"}' --upload image=./first-frame.png
-  giz generate talking-head "Welcome to Giz" --image ./face.png
-  giz drive write notes/brief.md --file ./brief.md
-  giz computer exec --computer ctr_123 -- python --version
-  giz mcp add codex
+Use giz COMMAND --help for parameters and examples.
 
 Global options
   --json                 Machine-readable JSON output
   --base-url URL         Another Giz deployment
+  --org ORGANIZATION     Organization id to work in (or GIZ_ORGANIZATION)
   --no-open              Print the login URL without opening a browser
 
 Docs: https://www.giz.ai/mcp/`
@@ -659,24 +1013,23 @@ Docs: https://www.giz.ai/mcp/`
 async function main() {
   const { positionals, options } = parse(process.argv.slice(2))
   const saved = await readConfig()
-  const baseUrl = String(options['base-url'] || process.env.GIZ_URL || saved?.baseUrl || DEFAULT_URL).replace(/\/+$/, '')
+  const requiresAuth = positionals.length && !options.help && !options.version &&
+    !(positionals[0] === 'auth' && ['login', 'logout'].includes(positionals[1]))
+  const computer = requiresAuth && !process.env.GIZ_TOKEN && !saved?.access_token ? await computerIdentity() : undefined
+  const baseUrl = String(options['base-url'] || process.env.GIZ_URL || saved?.baseUrl || computer?.baseUrl || DEFAULT_URL).replace(/\/+$/, '')
+  if (typeof options.org === 'string') process.env.GIZ_ORGANIZATION = options.org
+  options.input = await inputText(options.input)
   const output = await runCommand(baseUrl, positionals, options)
-  print(output.kind, output.value, options.json === true)
+  if (output) {
+    print(output.kind, output.value, options.json === true)
+    process.exitCode = output.exitCode ?? (output.value?.isError ? 1 : 0)
+  }
 }
 
 main().catch((error) => {
   const { options } = parse(process.argv.slice(2))
-  if (options.json === true) {
-    process.stderr.write(`${JSON.stringify({
-      error: {
-        message: String(error?.message || error),
-        ...(error?.hint ? { hint: error.hint } : {}),
-        ...(error?.status ? { status: error.status } : {})
-      }
-    }, null, 2)}\n`)
-  } else {
-    process.stderr.write(`Error: ${String(error?.message || error)}\n`)
-    if (error?.hint) process.stderr.write(`Hint: ${error.hint}\n`)
-  }
+  const json = options.json === true
+  const failure = { message: String(error?.message || error), hint: error?.hint, status: error?.status }
+  print('message', json ? { error: failure } : `Error: ${failure.message}${failure.hint ? `\nHint: ${failure.hint}` : ''}`, json, process.stderr)
   process.exitCode = 1
 })