@gravity-rail/cli 0.5.0 → 0.6.0

package/dist/lib.js

@@ -1,8 +1,6 @@
 import {
   AGUIClient,
   CredentialsManager,
-  __export,
-  __reExport,
   clearScreen,
   formatTimestamp,
   getEnvironmentConfig,
@@ -13,50 +11,16 @@ import {
   printTable,
   refreshAccessToken,
   selectFromList
-} from "./chunk-C6D4FO6A.js";
-
-// src/lib/errors.ts
-var CLIError = class extends Error {
-  constructor(message, exitCode = 1) {
-    super(message);
-    this.exitCode = exitCode;
-    this.name = "CLIError";
-  }
-};
-var AuthRequiredError = class extends CLIError {
-  constructor(message = "Not authenticated. Run `gr login` or set GRAVITY_RAIL_API_KEY.") {
-    super(message, 2);
-    this.name = "AuthRequiredError";
-  }
-};
-function handleError(err) {
-  if (err instanceof CLIError) {
-    process.stderr.write(`Error: ${err.message}
-`);
-    process.exit(err.exitCode);
-  }
-  if (err instanceof Error) {
-    process.stderr.write(`Error: ${err.message}
-`);
-    if ("errors" in err && Array.isArray(err.errors)) {
-      for (const e of err.errors) {
-        process.stderr.write(`  - ${e}
-`);
-      }
-    }
-    if ("statusCode" in err && err.statusCode === 401) {
-      process.stderr.write(
-        `
-Hint: Run "gr login" to authenticate, or set GRAVITY_RAIL_API_KEY for non-interactive use.
-`
-      );
-    }
-    process.exit(1);
-  }
-  process.stderr.write(`Error: ${String(err)}
-`);
-  process.exit(1);
-}
+} from "./chunk-H62EC2CF.js";
+import {
+  AuthRequiredError,
+  CLIError,
+  handleError
+} from "./chunk-OPWCTOHP.js";
+import {
+  __export,
+  __reExport
+} from "./chunk-424PT5DM.js";
 
 // src/lib/pagination.ts
 function isListResult(data) {
@@ -206,7 +170,7 @@ var COMMON_ARGS = [
   { name: "uuid", description: "Entity UUID" }
 ];
 function parseArgs(defs, argv) {
-  const allDefs = [...COMMON_ARGS, ...defs];
+  const allDefs = [...defs, ...COMMON_ARGS];
   const result = {};
   for (const def of allDefs) {
     if (def.default !== void 0) {
@@ -233,8 +197,7 @@ function parseArgs(defs, argv) {
     const def = findDef(allDefs, flagPart);
     if (!def) {
       if ((flagPart.startsWith("--") || flagPart.startsWith("-")) && !KNOWN_GLOBAL_FLAGS.has(flagPart)) {
-        process.stderr.write(`Warning: unknown flag "${flagPart}" (ignored)
-`);
+        throw new CLIError(`Unknown flag "${flagPart}"`);
       }
       continue;
     }
@@ -249,9 +212,11 @@ function parseArgs(defs, argv) {
     }
   }
   for (const def of allDefs) {
-    if (def.required && result[def.name] === void 0) {
-      throw new CLIError(`Missing required argument: --${def.name}`);
-    }
+    if (!def.required) continue;
+    if (result[def.name] !== void 0) continue;
+    const aliasNames = [def.alias, ...def.aliases ?? []].filter(Boolean);
+    if (aliasNames.some((a) => result[a] !== void 0)) continue;
+    throw new CLIError(`Missing required argument: --${def.name}`);
   }
   return result;
 }
@@ -2203,12 +2168,14 @@ function requireAuth(ctx) {
   return ctx;
 }
 function createPublicContext(opts) {
-  const apiUrl = opts.apiUrl || process.env.GRAVITY_RAIL_API_URL || "https://api.gravityrail.com";
-  const frontendUrl = opts.frontendUrl || process.env.GRAVITY_RAIL_FRONTEND_URL || "https://app.gravityrail.com";
-  const envConfig = { apiUrl, frontendUrl };
-  const credentialsManager = new CredentialsManager(homedir(), apiUrl);
+  const env = opts.env ?? "prod";
+  const envConfig = opts.apiUrl ? {
+    apiUrl: opts.apiUrl,
+    frontendUrl: opts.frontendUrl || process.env.GRAVITY_RAIL_FRONTEND_URL || "https://app.gravityrail.com"
+  } : getEnvironmentConfig(env);
+  const credentialsManager = new CredentialsManager(homedir(), envConfig.apiUrl);
   return {
-    env: "prod",
+    env,
     envConfig,
     outputFormat: detectOutputFormat(opts.outputFormat),
     verbose: opts.verbose ?? false,
@@ -2260,32 +2227,48 @@ async function readJsonInput(args) {
       throw new CLIError(`Cannot read file: ${filePath}`);
     }
   }
-  if (!process.stdin.isTTY) {
-    return readStdin();
+  if (process.stdin.isTTY === true) {
+    return void 0;
   }
-  return void 0;
+  return readStdinIfPiped();
 }
-function readStdin() {
+function readStdinIfPiped() {
   return new Promise((resolve, reject) => {
     let data = "";
-    process.stdin.setEncoding("utf-8");
-    process.stdin.on("data", (chunk) => {
-      data += chunk;
-    });
-    process.stdin.on("end", () => {
+    let settled = false;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      resolve(value);
+    };
+    const flush = () => {
       if (!data.trim()) {
-        resolve(void 0);
+        finish(void 0);
         return;
       }
       try {
-        resolve(JSON.parse(data));
+        finish(JSON.parse(data));
       } catch {
         reject(new CLIError("Invalid JSON from stdin"));
       }
+    };
+    process.stdin.setEncoding("utf-8");
+    process.stdin.on("data", (chunk) => {
+      data += chunk;
     });
+    process.stdin.on("end", flush);
     process.stdin.on("error", (err) => {
       reject(new CLIError(`Error reading stdin: ${err.message}`));
     });
+    process.stdin.resume();
+    setImmediate(() => {
+      if (data) return;
+      if (process.stdin.readableEnded) {
+        flush();
+        return;
+      }
+      finish(void 0);
+    });
   });
 }
 
@@ -2881,6 +2864,17 @@ function requireNumber(args, key) {
   if (isNaN(num)) throw new Error(`Argument --${key} must be a number`);
   return num;
 }
+function requireNumberFrom(args, ...keys) {
+  for (const key of keys) {
+    const val = args[key];
+    if (typeof val === "string") {
+      const num = Number(val);
+      if (!isNaN(num)) return num;
+    }
+  }
+  const hint = keys.map((k) => `--${k}`).join(" or ");
+  throw new Error(`Missing required argument: ${hint}`);
+}
 
 // src/domains/agent-tasks.ts
 var LIST_COLUMNS = [
@@ -3041,6 +3035,7 @@ var agentsDomain = {
 var COLUMNS2 = [
   COL.id(),
   COL.uuid(),
+  { header: "TYPE", getValue: (item) => item.chatType ?? item.chat_type ?? "" },
   { header: "MEMBER", getValue: (item) => item.member_name ?? String(item.member_id ?? "") },
   COL.status(),
   { header: "CHANNEL", getValue: (item) => item.channel ?? "" },
@@ -3092,7 +3087,11 @@ var chatsDomain = {
           isFlag: true
         },
         { name: "is-test", description: "Show only test chats", isFlag: true },
-        { name: "member-id", description: "Filter by member ID" }
+        { name: "member-id", description: "Filter by member ID" },
+        {
+          name: "chat-type",
+          description: "Filter by chat type (assignment, manager, developer, member, contributor). Default: assignment"
+        }
       ]
     }),
     // Messages
@@ -3101,7 +3100,7 @@ var chatsDomain = {
       description: "List messages for a chat. Use --limit/--offset to page; the API caps a single request at 100. Tool-call shell rows that the API filter excludes (parent_message_id IS NOT NULL or parent_call_id IS NOT NULL) are still hidden \u2014 use `gr chats inspect --id <chat>` for the full debug view.",
       requiresWorkspace: true,
       args: [
-        { name: "chat-id", description: "Chat ID", required: true },
+        { name: "chat-id", aliases: ["id"], description: "Chat ID", required: true },
         {
           name: "limit",
           description: "Max messages to return (1-100, default 100)"
@@ -3124,7 +3123,7 @@ var chatsDomain = {
         }
         const result = await requireAuth(ctx).apiClient.getChatMessages(
           workspace,
-          requireNumber(args, "chat-id"),
+          requireNumberFrom(args, "chat-id", "id"),
           limit,
           offset
         );
@@ -3137,7 +3136,7 @@ var chatsDomain = {
       mutates: true,
       requiresWorkspace: true,
       args: [
-        { name: "chat-id", description: "Chat ID", required: true },
+        { name: "chat-id", aliases: ["id"], description: "Chat ID", required: true },
         { name: "stream", description: "Stream the AI response via AG-UI", isFlag: true }
       ],
       handler: async ({ ctx, workspace, args, data }) => {
@@ -3146,7 +3145,7 @@ var chatsDomain = {
           throw new Error(
             `Message content is required (pass --data '"your message"' or --data '{"content":"your message"}')`
           );
-        const chatId = requireNumber(args, "chat-id");
+        const chatId = requireNumberFrom(args, "chat-id", "id");
         if (args.stream) {
           const aguiClient = new AGUIClient({
             baseUrl: ctx.envConfig.apiUrl,
@@ -3179,11 +3178,11 @@ var chatsDomain = {
       description: "Send an assistant message to a chat (does not trigger AI inference)",
       mutates: true,
       requiresWorkspace: true,
-      args: [{ name: "chat-id", description: "Chat ID", required: true }],
+      args: [{ name: "chat-id", aliases: ["id"], description: "Chat ID", required: true }],
       handler: async ({ ctx, workspace, args, data }) => {
         const result = await requireAuth(ctx).apiClient.sendAssistantMessage(
           workspace,
-          requireNumber(args, "chat-id"),
+          requireNumberFrom(args, "chat-id", "id"),
           data
         );
         outputSingle(result, ctx, MESSAGE_COLUMNS2);
@@ -5246,10 +5245,20 @@ var eventRulesCrudNoList = crudCommands({
     '  "eventType":"journey_step:execute","actionType":"member:label",',
     `  "actionParams":{"addLabelIds":["<label-uuid>"]},"journeyStepId":<step-id>}'`,
     "",
+    "Scheduled outbound (routine \u2192 chat \u2192 voice/SMS):",
+    `gr events rules create -w $WID --allow-write --data '{"name":"AM voice check-in",`,
+    '  "objectType":"routine","eventType":"routine:triggered","actionType":"chat:create",',
+    '  "routineId":<routine-id>,',
+    '  "actionParams":{"workflowId":<workflow-id>,"channel":"phone-voice",',
+    `  "phoneNumberId":<workspace-phone-id>}}'`,
+    "",
+    '  PM SMS variant: use "channel":"phone-sms" and a second rule on the same routineId.',
+    "  Prereq: org phone assigned + gr phone-numbers link; workflow published with start task.",
+    "",
     "Required: objectType, eventType, actionType",
-    "Optional: name, actionParams, conditions (CEL), journeyStepId, delay (sec), order",
+    "Optional: name, actionParams, conditions (CEL), journeyStepId, routineId, delay (sec), order",
     "",
-    "Common eventTypes: journey_step:execute, journey:enrolled, journey:completed,",
+    "Common eventTypes: journey_step:execute, journey:enrolled, routine:triggered,",
     "  task:created, chat:created, data_record:created, member:created",
     "",
     "Common actionTypes: member:label, member:notify, webhook:send, email:send,",
@@ -7533,7 +7542,7 @@ var conciergeDomain = {
       path: ["concierge", "messages"],
       description: "Show messages for a concierge chat",
       requiresWorkspace: false,
-      args: [{ name: "id", description: "Chat ID", required: true }],
+      args: [{ name: "id", aliases: ["chat-id"], description: "Chat ID", required: true }],
       handler: async ({ ctx, args }) => {
         const auth = requireAuth(ctx);
         const chatId = Number(args.id);
@@ -8166,15 +8175,15 @@ var DOMAIN_UUID_ARG = {
 function pluralize(count, singular, plural = `${singular}s`) {
   return count === 1 ? singular : plural;
 }
-function emailVerifyCommand(path, description) {
+function emailVerifyCommand(path4, description) {
   return {
-    path,
+    path: path4,
     description,
     mutates: true,
     requiresWorkspace: false,
     args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
     examples: [
-      `yarn gr ${path.join(" ")} --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write`
+      `yarn gr ${path4.join(" ")} --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write`
     ],
     handler: async (hctx) => {
       const result = await requireAuth(hctx.ctx).apiClient.verifyOrgDomainEmail(
@@ -8185,15 +8194,15 @@ function emailVerifyCommand(path, description) {
     }
   };
 }
-function siteVerifyCommand(path, description) {
+function siteVerifyCommand(path4, description) {
   return {
-    path,
+    path: path4,
     description,
     mutates: true,
     requiresWorkspace: false,
     args: [ORG_UUID_ARG, DOMAIN_UUID_ARG],
     examples: [
-      `yarn gr ${path.join(" ")} --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write`
+      `yarn gr ${path4.join(" ")} --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write`
     ],
     handler: async (hctx) => {
       const result = await requireAuth(hctx.ctx).apiClient.verifyOrgDomainSite(
@@ -8204,9 +8213,9 @@ function siteVerifyCommand(path, description) {
     }
   };
 }
-function registerDomainCommand(path) {
+function registerDomainCommand(path4) {
   return {
-    path,
+    path: path4,
     description: "Register an organization domain and return ownership TXT instructions",
     mutates: true,
     requiresWorkspace: false,
@@ -8215,7 +8224,7 @@ function registerDomainCommand(path) {
       { name: "domain", description: "Domain to register, e.g. example.com", required: true }
     ],
     examples: [
-      `yarn gr ${path.join(" ")} --org-uuid $ORG_UUID --domain example.com --allow-write`
+      `yarn gr ${path4.join(" ")} --org-uuid $ORG_UUID --domain example.com --allow-write`
     ],
     handler: async (hctx) => {
       const result = await requireAuth(hctx.ctx).apiClient.registerOrgDomain(
@@ -8570,6 +8579,12 @@ var commands2 = [
         workspaceUuid
       );
       outputSingle(result, hctx.ctx, PROVIDER_PHONE_COLUMNS);
+      process.stdout.write(
+        `
+Create a workspace phone linked to this provider number (sets Twilio webhooks):
+  gr phone-numbers create -w ${workspaceUuid} --allow-write --data '{"name":"\u2026","providerPhoneUuid":"${providerPhoneUuid}"}'
+`
+      );
     }
   },
   {
@@ -8673,6 +8688,31 @@ var phoneNumbersDomain = {
         outputData(result, ctx, COLUMNS25);
       }
     },
+    {
+      path: ["phone-numbers", "link"],
+      description: "Link a workspace phone number to a provider (org) phone",
+      mutates: true,
+      requiresWorkspace: true,
+      args: [
+        {
+          name: "phone-number-id",
+          aliases: ["id"],
+          description: "Workspace phone number ID",
+          required: true
+        },
+        { name: "provider-phone-uuid", description: "Provider phone UUID", required: true }
+      ],
+      examples: [
+        "gr phone-numbers link -w $WID --id 1 --provider-phone-uuid <uuid> --allow-write"
+      ],
+      handler: async ({ ctx, workspace, args }) => {
+        const auth = requireAuth(ctx);
+        const id = requireNumberFrom(args, "phone-number-id", "id");
+        const providerPhoneUuid = requireString(args, "provider-phone-uuid");
+        const result = await auth.apiClient.linkPhoneNumber(workspace, id, providerPhoneUuid);
+        outputData([result], auth, COLUMNS25);
+      }
+    },
     {
       path: ["phone-numbers", "request"],
       description: "Request a phone number",
@@ -8691,7 +8731,12 @@ var phoneNumbersDomain = {
       description: "List calls for a phone number",
       requiresWorkspace: true,
       args: [
-        { name: "phone-number-id", description: "Phone number ID", required: true },
+        {
+          name: "phone-number-id",
+          aliases: ["id"],
+          description: "Phone number ID",
+          required: true
+        },
         { name: "page", description: "Page number" },
         { name: "page-size", description: "Page size" },
         { name: "status", description: "Filter by status" }
@@ -8700,7 +8745,7 @@ var phoneNumbersDomain = {
         const status = args.status;
         const result = await requireAuth(ctx).apiClient.getPhoneNumberCalls(
           workspace,
-          requireNumber(args, "phone-number-id"),
+          requireNumberFrom(args, "phone-number-id", "id"),
           args.page ? Number(args.page) : void 0,
           args["page-size"] ? Number(args["page-size"]) : void 0,
           status ? { status } : void 0
@@ -8713,14 +8758,19 @@ var phoneNumbersDomain = {
       description: "List messages for a phone number",
       requiresWorkspace: true,
       args: [
-        { name: "phone-number-id", description: "Phone number ID", required: true },
+        {
+          name: "phone-number-id",
+          aliases: ["id"],
+          description: "Phone number ID",
+          required: true
+        },
         { name: "page", description: "Page number" },
         { name: "page-size", description: "Page size" }
       ],
       handler: async ({ ctx, workspace, args }) => {
         const result = await requireAuth(ctx).apiClient.getPhoneNumberMessages(
           workspace,
-          requireNumber(args, "phone-number-id"),
+          requireNumberFrom(args, "phone-number-id", "id"),
           args.page ? Number(args.page) : void 0,
           args["page-size"] ? Number(args["page-size"]) : void 0
         );
@@ -8730,36 +8780,85 @@ var phoneNumbersDomain = {
   ]
 };
 
+// src/lib/resolve-org.ts
+async function resolveOrgUuidFromWorkspace(apiClient, workspaceUuid) {
+  const workspace = await apiClient.getWorkspace(workspaceUuid);
+  const orgUuid = workspace.organizationUuid;
+  if (!orgUuid) {
+    throw new CLIError(
+      "Workspace has no organization; pass --org-uuid for organization-scoped commands"
+    );
+  }
+  return orgUuid;
+}
+function normalizePronunciationCreatePayload(data) {
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
+    throw new CLIError("JSON body required with term and respelling (--data or --file)");
+  }
+  const raw = data;
+  const term = raw.term ?? raw.word;
+  const respelling = raw.respelling ?? raw.pronunciation;
+  if (typeof term !== "string" || !term) {
+    throw new CLIError("Payload requires term (alias: word)");
+  }
+  if (typeof respelling !== "string" || !respelling) {
+    throw new CLIError("Payload requires respelling (alias: pronunciation)");
+  }
+  const payload = { term, respelling };
+  if (raw.accountId !== void 0 && raw.accountId !== null) {
+    payload.accountId = Number(raw.accountId);
+  }
+  return payload;
+}
+function normalizePronunciationUpdatePayload(data) {
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
+    throw new CLIError("JSON body required (--data or --file)");
+  }
+  const raw = data;
+  const respelling = raw.respelling ?? raw.pronunciation;
+  if (typeof respelling !== "string" || !respelling) {
+    throw new CLIError("Payload requires respelling (alias: pronunciation)");
+  }
+  return { respelling };
+}
+
 // src/domains/pronunciations.ts
 var COLUMNS26 = [
   COL.id(),
-  { header: "WORD", getValue: (item) => item.word ?? "" },
-  { header: "PRONUNCIATION", getValue: (item) => item.pronunciation ?? "" },
-  { header: "TYPE", getValue: (item) => item.type ?? "" }
+  { header: "TERM", getValue: (item) => item.term ?? "" },
+  { header: "RESPELLING", getValue: (item) => item.respelling ?? "" },
+  { header: "SCOPE", getValue: (item) => item.scope ?? "" }
+];
+var CREATE_EXAMPLES = [
+  `gr pronunciations create -w $WID --data '{"term":"Jeeves","respelling":"JEEVZ"}' --allow-write`,
+  "  (aliases: word \u2192 term, pronunciation \u2192 respelling)"
 ];
 var pronunciationsDomain = {
   name: "pronunciations",
-  description: "Manage pronunciation entries",
+  description: "Manage pronunciation entries (org-scoped; -w resolves organization)",
   commands: [
     {
       path: ["pronunciations", "list"],
-      description: "List pronunciation entries",
+      description: "List pronunciation entries for the workspace organization",
       requiresWorkspace: true,
       handler: async ({ ctx, workspace }) => {
-        const result = await requireAuth(ctx).apiClient.getPronunciationEntries(workspace);
+        const auth = requireAuth(ctx);
+        const orgUuid = await resolveOrgUuidFromWorkspace(auth.apiClient, workspace);
+        const result = await auth.apiClient.getPronunciationEntries(orgUuid);
         outputData(result, ctx, COLUMNS26);
       }
     },
     {
       path: ["pronunciations", "create"],
-      description: "Create a pronunciation entry",
+      description: "Create a pronunciation entry (term + respelling)",
       mutates: true,
       requiresWorkspace: true,
+      examples: CREATE_EXAMPLES,
       handler: async ({ ctx, workspace, data }) => {
-        const result = await requireAuth(ctx).apiClient.createPronunciationEntry(
-          workspace,
-          data
-        );
+        const auth = requireAuth(ctx);
+        const orgUuid = await resolveOrgUuidFromWorkspace(auth.apiClient, workspace);
+        const payload = normalizePronunciationCreatePayload(data);
+        const result = await auth.apiClient.createPronunciationEntry(orgUuid, payload);
         outputSingle(result, ctx, COLUMNS26);
       }
     },
@@ -8770,10 +8869,13 @@ var pronunciationsDomain = {
       requiresWorkspace: true,
       args: [{ name: "id", description: "Pronunciation entry ID", required: true }],
       handler: async ({ ctx, workspace, args, data }) => {
-        const result = await requireAuth(ctx).apiClient.updatePronunciationEntry(
-          workspace,
+        const auth = requireAuth(ctx);
+        const orgUuid = await resolveOrgUuidFromWorkspace(auth.apiClient, workspace);
+        const payload = normalizePronunciationUpdatePayload(data);
+        const result = await auth.apiClient.updatePronunciationEntry(
+          orgUuid,
           requireNumber(args, "id"),
-          data
+          payload
         );
         outputSingle(result, ctx, COLUMNS26);
       }
@@ -8785,8 +8887,10 @@ var pronunciationsDomain = {
       requiresWorkspace: true,
       args: [{ name: "id", description: "Pronunciation entry ID", required: true }],
       handler: async ({ ctx, workspace, args }) => {
+        const auth = requireAuth(ctx);
+        const orgUuid = await resolveOrgUuidFromWorkspace(auth.apiClient, workspace);
         const id = requireNumber(args, "id");
-        await requireAuth(ctx).apiClient.deletePronunciationEntry(workspace, id);
+        await auth.apiClient.deletePronunciationEntry(orgUuid, id);
         process.stdout.write(`Deleted pronunciation entry ${id}
 `);
       }
@@ -8806,7 +8910,8 @@ var pronunciationsDomain = {
       mutates: true,
       requiresWorkspace: true,
       handler: async ({ ctx, data }) => {
-        const result = await requireAuth(ctx).apiClient.createMyPronunciation(data);
+        const payload = normalizePronunciationCreatePayload(data);
+        const result = await requireAuth(ctx).apiClient.createMyPronunciation(payload);
         outputSingle(result, ctx, COLUMNS26);
       }
     },
@@ -8814,11 +8919,17 @@ var pronunciationsDomain = {
       path: ["pronunciations", "suggest"],
       description: "Get pronunciation suggestions for a word",
       requiresWorkspace: true,
-      args: [{ name: "word", description: "Word to get suggestions for", required: true }],
+      args: [
+        {
+          name: "word",
+          aliases: ["term"],
+          description: "Word to get suggestions for",
+          required: true
+        }
+      ],
       handler: async ({ ctx, args }) => {
-        const result = await requireAuth(ctx).apiClient.suggestPronunciations(
-          requireString(args, "word")
-        );
+        const word = typeof args.word === "string" ? args.word : typeof args.term === "string" ? args.term : requireString(args, "word");
+        const result = await requireAuth(ctx).apiClient.suggestPronunciations(word);
         outputData(result, ctx);
       }
     },
@@ -10779,8 +10890,356 @@ function openUrl(url) {
   });
 }
 
+// src/lib/cli-client-context.ts
+import path from "path";
+function buildCliConciergeAppContext() {
+  const shell = process.env.SHELL ? path.basename(process.env.SHELL) : void 0;
+  return {
+    clientSurface: "cli",
+    channel: "text",
+    cliContext: {
+      shell,
+      os: process.platform,
+      cwdBasename: path.basename(process.cwd())
+    }
+  };
+}
+
+// src/lib/cli-hitl.ts
+import readline2 from "readline";
+
+// src/lib/local-files.ts
+import fs from "fs";
+import path2 from "path";
+var DEFAULT_MAX_READ_BYTES = 5e4;
+var ABSOLUTE_MAX_READ_BYTES = 1e6;
+function resolveSafePath(root, relativePath) {
+  const rootResolved = path2.resolve(root);
+  const target = path2.resolve(rootResolved, relativePath || ".");
+  if (target !== rootResolved && !target.startsWith(rootResolved + path2.sep)) {
+    return null;
+  }
+  let cursor = rootResolved;
+  const rest = path2.relative(rootResolved, target);
+  if (rest && rest !== ".") {
+    for (const segment of rest.split(path2.sep)) {
+      cursor = path2.join(cursor, segment);
+      try {
+        const lstat = fs.lstatSync(cursor);
+        if (lstat.isSymbolicLink()) {
+          return null;
+        }
+      } catch {
+        break;
+      }
+    }
+  }
+  return target;
+}
+function executeCliLocalFileAction(root, interrupt, opts) {
+  const safe = resolveSafePath(root, interrupt.path);
+  if (!safe) {
+    return { ok: false, error: "Path escapes trusted directory" };
+  }
+  try {
+    switch (interrupt.action) {
+      case "read_file": {
+        if (!fs.existsSync(safe)) {
+          return { ok: false, error: "File not found" };
+        }
+        const stat = fs.lstatSync(safe);
+        if (stat.isSymbolicLink()) {
+          return { ok: false, error: "Path escapes trusted directory" };
+        }
+        if (!stat.isFile()) {
+          return { ok: false, error: "Not a file" };
+        }
+        const requested = Number.isFinite(interrupt.max_bytes) ? Math.max(1, Math.min(Number(interrupt.max_bytes), ABSOLUTE_MAX_READ_BYTES)) : DEFAULT_MAX_READ_BYTES;
+        if (stat.size > requested) {
+          const buf = fs.readFileSync(safe, { encoding: "utf8" });
+          return {
+            ok: true,
+            content: buf.slice(0, requested) + `
+
+[truncated at ${requested} bytes]`
+          };
+        }
+        return { ok: true, content: fs.readFileSync(safe, "utf8") };
+      }
+      case "list_dir": {
+        if (!fs.existsSync(safe)) {
+          return { ok: false, error: "Directory not found" };
+        }
+        const entries = fs.readdirSync(safe, { withFileTypes: true });
+        const lines = entries.slice(0, 200).map((e) => e.isDirectory() ? `${e.name}/` : e.name);
+        if (entries.length > 200) {
+          lines.push(`... and ${entries.length - 200} more`);
+        }
+        return { ok: true, content: lines.join("\n") };
+      }
+      case "write_file": {
+        if (!opts.allowWrite) {
+          return { ok: false, error: "Write requires --allow-write" };
+        }
+        if (interrupt.content === void 0) {
+          return { ok: false, error: "Missing content for write_file" };
+        }
+        fs.mkdirSync(path2.dirname(safe), { recursive: true });
+        fs.writeFileSync(safe, interrupt.content, "utf8");
+        return { ok: true, content: "written" };
+      }
+      default:
+        return { ok: false, error: `Unknown action: ${interrupt.action}` };
+    }
+  } catch (e) {
+    return { ok: false, error: sanitizeLocalFileError(e) };
+  }
+}
+function sanitizeLocalFileError(e) {
+  if (e && typeof e === "object" && "code" in e) {
+    const code = e.code;
+    if (code === "ENOENT") return "File or directory not found";
+    if (code === "EACCES" || code === "EPERM") return "Permission denied";
+    if (code === "EISDIR") return "Not a file";
+    if (code === "ENOTDIR") return "Not a directory";
+  }
+  return "Local file operation failed";
+}
+function isCliLocalFileInterrupt(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  return v.type === "cli_local_file" && typeof v.action === "string" && typeof v.path === "string";
+}
+
+// src/lib/trusted-dirs.ts
+import fs2 from "fs";
+import os from "os";
+import path3 from "path";
+import readline from "readline";
+var STORE_VERSION = 1;
+function storePath() {
+  const base = process.env.XDG_CONFIG_HOME ?? (process.platform === "win32" ? path3.join(process.env.APPDATA ?? os.homedir(), "gravityrail") : path3.join(os.homedir(), ".config", "gravityrail"));
+  return path3.join(base, "trusted-dirs.json");
+}
+function loadTrustedDirsStore() {
+  const file = storePath();
+  try {
+    const raw = JSON.parse(fs2.readFileSync(file, "utf8"));
+    if (raw?.version === STORE_VERSION && Array.isArray(raw.always)) {
+      return { version: STORE_VERSION, always: raw.always.map((p) => path3.resolve(p)) };
+    }
+  } catch {
+  }
+  return { version: STORE_VERSION, always: [] };
+}
+function saveTrustedDirsStore(store) {
+  const file = storePath();
+  const dir = path3.dirname(file);
+  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs2.writeFileSync(file, JSON.stringify(store, null, 2) + "\n", { mode: 384 });
+}
+function isDirectoryTrusted(dirPath, opts) {
+  if (opts?.trustCwdFlag) return true;
+  const resolved = path3.resolve(dirPath);
+  const store = loadTrustedDirsStore();
+  return store.always.includes(resolved);
+}
+async function promptTrustInteractive(dirPath) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+  const question = (q) => new Promise((resolve) => rl.question(q, resolve));
+  process.stderr.write(
+    `
+Gravity Rail may read files in:
+  ${dirPath}
+
+File contents can influence the assistant. Do you trust the files in this directory?
+  [1] Trust once (this session)
+  [2] Trust always (remember for this path)
+  [3] No \u2014 do not read local files
+
+Choice [1/2/3] (default 3): `
+  );
+  const answer = (await question("")).trim() || "3";
+  rl.close();
+  if (answer === "1") return "once";
+  if (answer === "2") return "always";
+  return "denied";
+}
+var sessionTrusted = /* @__PURE__ */ new Set();
+async function resolveDirectoryTrust(opts) {
+  const dir = path3.resolve(opts.trustDir ?? opts.cwd ?? process.cwd());
+  if (isDirectoryTrusted(dir, { trustCwdFlag: opts.trustCwd })) return "trusted";
+  if (sessionTrusted.has(dir)) return "trusted";
+  if (opts.trustDir && path3.resolve(opts.trustDir) === dir) {
+    sessionTrusted.add(dir);
+    return "trusted";
+  }
+  if (opts.trustCwd) {
+    sessionTrusted.add(dir);
+    return "trusted";
+  }
+  if (!process.stdin.isTTY || opts.nonInteractive) {
+    return "denied";
+  }
+  const decision = await promptTrustInteractive(dir);
+  if (decision === "denied") {
+    return "denied";
+  }
+  if (decision === "always") {
+    const store = loadTrustedDirsStore();
+    if (!store.always.includes(dir)) {
+      store.always.push(dir);
+      saveTrustedDirsStore(store);
+    }
+  }
+  sessionTrusted.add(dir);
+  return "trusted";
+}
+async function requireDirectoryTrust(opts) {
+  const { CLIError: CLIError2 } = await import("./errors-4MAJGD3C.js");
+  const dir = path3.resolve(opts.trustDir ?? opts.cwd ?? process.cwd());
+  const status = await resolveDirectoryTrust(opts);
+  if (status === "trusted") return;
+  throw new CLIError2(
+    `Directory not trusted: ${dir}
+
+Re-run with --trust-cwd (or --trust-dir <path>) after reviewing files in that directory, or run interactively to approve trust when a local file tool is first used.`
+  );
+}
+
+// src/lib/cli-hitl.ts
+function extractHumanInputRequest(event) {
+  const type = String(event.type ?? "").toUpperCase();
+  if (type === "CUSTOM" && event.name === "human_input_request") {
+    return event.value;
+  }
+  if (event.name === "human_input_request") {
+    return event.value;
+  }
+  return null;
+}
+async function handleCliHitlInterrupt(value, opts) {
+  if (!value || typeof value !== "object") return null;
+  const payload = value;
+  if (isCliLocalFileInterrupt(payload)) {
+    const interrupt = payload;
+    if (typeof payload.interrupt_id === "string") {
+      interrupt.interrupt_id = payload.interrupt_id;
+    }
+    return handleCliLocalFile(interrupt, opts);
+  }
+  if (payload.type === "present_choice") {
+    return handlePresentChoiceTerminal(payload);
+  }
+  return null;
+}
+async function handleCliLocalFile(interrupt, opts) {
+  const trust = await resolveDirectoryTrust({
+    cwd: process.cwd(),
+    trustCwd: opts.trustCwd,
+    trustDir: opts.trustDir,
+    // Interactive sessions: prompt on first local-file use (review feedback).
+    nonInteractive: opts.nonInteractive ?? process.stdin.isTTY !== true
+  });
+  if (trust !== "trusted") {
+    return {
+      resumeValue: JSON.stringify({
+        ok: false,
+        error: "Directory not trusted for local file access. Re-run with --trust-cwd or --trust-dir <path>, or approve trust interactively when prompted."
+      }),
+      resumeInterruptId: interrupt.interrupt_id
+    };
+  }
+  process.stderr.write(`
+[local ${interrupt.action}] ${interrupt.path}
+`);
+  const result = executeCliLocalFileAction(process.cwd(), interrupt, {
+    allowWrite: opts.allowWrite
+  });
+  return {
+    resumeValue: JSON.stringify(result),
+    resumeInterruptId: interrupt.interrupt_id
+  };
+}
+async function handlePresentChoiceTerminal(payload) {
+  const prompt = typeof payload.user_prompt === "string" && payload.user_prompt || typeof payload.description === "string" && payload.description || "Choose an option";
+  const markup = typeof payload.openui_markup === "string" ? payload.openui_markup : "";
+  process.stderr.write(`
+${prompt}
+`);
+  if (markup) {
+    process.stderr.write(`${markup.slice(0, 2e3)}
+`);
+  }
+  if (!process.stdin.isTTY) {
+    return {
+      resumeValue: "",
+      resumeInterruptId: typeof payload.interrupt_id === "string" ? payload.interrupt_id : void 0
+    };
+  }
+  const rl = readline2.createInterface({ input: process.stdin, output: process.stderr });
+  const answer = await new Promise((resolve) => {
+    rl.question("Your choice (value): ", resolve);
+  });
+  rl.close();
+  return {
+    resumeValue: answer.trim(),
+    resumeInterruptId: typeof payload.interrupt_id === "string" ? payload.interrupt_id : void 0
+  };
+}
+
+// src/lib/concierge-agui-loop.ts
+var MAX_HITL_ROUNDS = 25;
+async function runConciergeAguiLoop(client, initialMessages, onEvent, opts) {
+  let streamText = "";
+  let hasToolCalls = false;
+  let resume;
+  for (let round = 0; round < MAX_HITL_ROUNDS; round++) {
+    let hitlPayload = null;
+    await client.streamRequest(
+      resume ? {
+        messages: [],
+        resumeValue: resume.resumeValue,
+        resumeInterruptId: resume.resumeInterruptId
+      } : { messages: initialMessages },
+      (event) => {
+        onEvent(event);
+        const delta = getTextDelta(event);
+        if (delta) streamText += delta;
+        const type = event.type?.toLowerCase() ?? "";
+        if (type === "tool_call_start") hasToolCalls = true;
+        const errorMsg = getErrorMessage(event);
+        if (errorMsg) process.stderr.write(`\x1B[31mError: ${errorMsg}\x1B[0m
+`);
+        const hitl = extractHumanInputRequest(event);
+        if (hitl) hitlPayload = hitl;
+      },
+      { autoApprove: opts.autoApprove }
+    );
+    if (!hitlPayload) {
+      break;
+    }
+    const next = await handleCliHitlInterrupt(hitlPayload, {
+      allowWrite: opts.allowWrite,
+      autoApprove: opts.autoApprove,
+      trustCwd: opts.trustCwd,
+      trustDir: opts.trustDir,
+      nonInteractive: opts.nonInteractive
+    });
+    if (!next) {
+      process.stderr.write(
+        "  [HITL] Unsupported interrupt in CLI \u2014 open app.gravityrail.com/setup to continue.\n"
+      );
+      break;
+    }
+    resume = next;
+    streamText = "";
+  }
+  return { streamText, hasToolCalls };
+}
+
 // src/lib/chat-session.ts
-import * as readline2 from "readline";
+import * as readline4 from "readline";
 
 // src/lib/realtime-client.ts
 import { EventEmitter } from "events";
@@ -11813,7 +12272,7 @@ function buildDebugSummary(_direction, msg) {
 // src/lib/audio.ts
 import { spawn, execSync as execSync2, spawnSync } from "child_process";
 import { EventEmitter as EventEmitter2 } from "events";
-import * as readline from "readline";
+import * as readline3 from "readline";
 var SAMPLE_RATE = 24e3;
 var MIC_CHUNK_BYTES = 4800;
 function checkSoxAvailable() {
@@ -11865,7 +12324,7 @@ async function selectDevice(devices, label) {
   if (devices.length <= 1) {
     return devices[0];
   }
-  const rl = readline.createInterface({
+  const rl = readline3.createInterface({
     input: process.stdin,
     output: process.stderr,
     terminal: true
@@ -12144,56 +12603,52 @@ async function runChatSession(session, args) {
       "Interactive mode requires a TTY. Use --message for non-interactive mode."
     );
   }
+  const allowWrite = !!args["allow-write"] || !!session.allowWrite;
   if (message) {
-    await singleTurnChatSession(session, message, debug, autoApprove);
+    await singleTurnChatSession(session, message, debug, autoApprove, allowWrite);
   } else if (isVoice) {
     await voiceChatSession(session, vadMode(args), args, debug);
   } else if (isRealtime) {
     await realtimeChatSession(session, vadMode(args), debug);
   } else {
-    await interactiveChatSession(session, debug);
+    await interactiveChatSession(session, debug, autoApprove, allowWrite);
   }
 }
 function vadMode(args) {
   return typeof args.vad === "string" ? args.vad : "server";
 }
-async function singleTurnChatSession(session, message, debug, autoApprove = false) {
+async function singleTurnChatSession(session, message, debug, autoApprove = false, allowWrite = false) {
   const aguiClient = new AGUIClient({
     baseUrl: session.ctx.envConfig.apiUrl,
+    workspaceUuid: session.workspaceUuid,
+    chatId: session.chatId,
     endpointUrl: session.aguiEndpointUrl,
     accessToken: session.ctx.accessToken,
     debug,
-    model: session.model
+    model: session.model,
+    appContext: session.appContext
   });
-  let streamText = "";
-  let hasToolCalls = false;
-  let eventCount = 0;
-  const logFile = process.env.GR_SSE_LOG;
-  const fs = logFile ? await import("fs") : null;
-  const logStream = logFile && fs ? fs.createWriteStream(logFile, { flags: "a" }) : null;
-  await aguiClient.sendMessage(
-    [{ role: "user", content: message }],
-    (event) => {
-      eventCount++;
-      if (logStream) logStream.write(JSON.stringify(event) + "\n");
-      const delta = getTextDelta(event);
-      if (delta) streamText += delta;
-      const type = event.type?.toLowerCase() ?? "";
-      if (type === "tool_call_start") {
-        hasToolCalls = true;
-        const name = event.name ?? "";
-        process.stderr.write(`  [${name}]
-`);
-      }
-      const errorMsg = getErrorMessage(event);
-      if (errorMsg) process.stderr.write(`\x1B[31mError: ${errorMsg}\x1B[0m
+  const onEvent = (event) => {
+    const type = event.type?.toLowerCase() ?? "";
+    if (type === "tool_call_start") {
+      const name = event.toolCallName ?? event.name ?? "";
+      process.stderr.write(`  [${name}]
 `);
-    },
-    { autoApprove }
+    }
+  };
+  const { streamText, hasToolCalls } = await runConciergeAguiLoop(
+    aguiClient,
+    [{ role: "user", content: message }],
+    onEvent,
+    {
+      autoApprove,
+      allowWrite: allowWrite || !!session.allowWrite,
+      debug,
+      trustCwd: session.trustCwd,
+      trustDir: session.trustDir,
+      nonInteractive: true
+    }
   );
-  if (logStream) logStream.end();
-  if (debug) process.stderr.write(`  (${eventCount} SSE events)
-`);
   if (streamText) {
     process.stdout.write(`\x1B[32mAssistant:\x1B[0m ${streamText}
 `);
@@ -12227,13 +12682,16 @@ async function singleTurnChatSession(session, message, debug, autoApprove = fals
 `);
   }
 }
-async function interactiveChatSession(session, debug) {
+async function interactiveChatSession(session, debug, autoApprove, allowWrite) {
   const aguiClient = new AGUIClient({
     baseUrl: session.ctx.envConfig.apiUrl,
+    workspaceUuid: session.workspaceUuid,
+    chatId: session.chatId,
     endpointUrl: session.aguiEndpointUrl,
     accessToken: session.ctx.accessToken,
     debug,
-    model: session.model
+    model: session.model,
+    appContext: session.appContext
   });
   clearScreen();
   console.log("=".repeat(60));
@@ -12261,7 +12719,7 @@ async function interactiveChatSession(session, debug) {
       conversationMessages.push({ role: msg.role, content: text });
     }
   }
-  const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
+  const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
     const prompt = () => {
       rl.question("\x1B[34mYou:\x1B[0m ", async (input) => {
@@ -12279,18 +12737,34 @@ async function interactiveChatSession(session, debug) {
         process.stdout.write("\n\x1B[32mAssistant:\x1B[0m ");
         let assistantContent = "";
         try {
-          await aguiClient.sendMessage(conversationMessages, (event) => {
-            const delta = getTextDelta(event);
-            if (delta) {
-              process.stdout.write(delta);
-              assistantContent += delta;
-            }
-            const errorMsg = getErrorMessage(event);
-            if (errorMsg) console.log(`
+          const { streamText } = await runConciergeAguiLoop(
+            aguiClient,
+            conversationMessages,
+            (event) => {
+              const delta = getTextDelta(event);
+              if (delta) {
+                process.stdout.write(delta);
+                assistantContent += delta;
+              }
+              const errorMsg = getErrorMessage(event);
+              if (errorMsg) console.log(`
 \x1B[31mError: ${errorMsg}\x1B[0m`);
-          });
-          if (assistantContent)
+            },
+            {
+              autoApprove,
+              allowWrite: allowWrite || !!session.allowWrite,
+              debug,
+              trustCwd: session.trustCwd,
+              trustDir: session.trustDir
+            }
+          );
+          if (streamText && !assistantContent) {
+            assistantContent = streamText;
+            process.stdout.write(streamText);
+          }
+          if (assistantContent) {
             conversationMessages.push({ role: "assistant", content: assistantContent });
+          }
           console.log("\n");
         } catch (error) {
           console.log(
@@ -12550,13 +13024,14 @@ async function conciergeCommand(hctx) {
   const chatIdArg = typeof args["chat-id"] === "string" ? args["chat-id"] : void 0;
   const message = typeof args.message === "string" ? args.message : void 0;
   const chat = await getOrCreateConciergeChat(ctx, chatIdArg, !!message);
-  const session = buildConciergeSession(ctx, chat);
+  const session = buildConciergeSession(ctx, chat, args);
   await runChatSession(session, args);
 }
-function buildConciergeSession(ctx, chat) {
+function buildConciergeSession(ctx, chat, args) {
   const wsBase = ctx.envConfig.apiUrl.replace(/^https:/, "wss:").replace(/^http:/, "ws:");
   return {
     ctx,
+    workspaceUuid: "",
     chatId: chat.id,
     chatUuid: chat.uuid,
     chatTitle: chat.title || chat.uuid,
@@ -12564,8 +13039,12 @@ function buildConciergeSession(ctx, chat) {
     wsUrl: `${wsBase}/api/v2/concierge/voice/stream-ws`,
     loadMessages: () => getConciergeChatMessages(ctx, chat.id).catch(() => []),
     label: "Concierge",
-    model: void 0
+    model: void 0,
     // concierge doesn't send model field
+    appContext: buildCliConciergeAppContext(),
+    allowWrite: true,
+    trustCwd: !!args["trust-cwd"],
+    trustDir: typeof args["trust-dir"] === "string" ? args["trust-dir"] : void 0
   };
 }
 async function getOrCreateConciergeChat(ctx, chatIdArg, skipSelection) {
@@ -12601,6 +13080,95 @@ async function getOrCreateConciergeChat(ctx, chatIdArg, skipSelection) {
   return selectedChat;
 }
 
+// src/commands/get-started.ts
+var WEB_SETUP = "https://app.gravityrail.com/setup";
+var WEB_GET_STARTED = "https://app.gravityrail.com/get-started";
+var HUMAN_GUIDE = `Gravity Rail \u2014 getting started
+
+1. Authenticate:  gr login --env prod
+   Confirm:       gr whoami
+
+2. Recommended path \u2014 concierge (no workspace required):
+   gr concierge chat --allow-write
+   The concierge can create your org (auto-created on first login), list products,
+   start Stripe checkout, and create your first workspace.
+
+3. Verify workspaces:  gr workspaces list
+
+4. Web wizards (human-friendly):  ${WEB_SETUP}  and  ${WEB_GET_STARTED}
+
+Headless boundary: Stripe checkout needs a human in a browser \u2014 the concierge returns
+a checkout URL; an agent should hand that link to the user, not loop on payment.
+
+Agent-readable steps:  gr get-started --format llm
+`;
+var LLM_GUIDE = `# Gravity Rail CLI bootstrap (agent instructions)
+
+## Preconditions
+- Install: \`npm install -g @gravity-rail/cli\` or \`npx @gravity-rail/cli\`
+- Authenticate: \`gr login --env prod\` (interactive OAuth). Verify with \`gr whoami\`.
+- **Monorepo dev:** from gravity-team with Docker dev up, use \`yarn gr <cmd> --realm superadmin\` (reads \`dev-realms.json\`; no browser). Rebuild: \`yarn workspace @gravity-rail/gr-cli build\`.
+
+## Important facts
+- **Agents/CI:** do not leave stdin open on read-only commands; use \`GRAVITY_RAIL_API_KEY\` or redirect stdin from /dev/null. Commands only read stdin when \`--data\`/\`--file\` is passed.
+- Use \`--env dev|staging|prod\` (default prod) so credentials match the target; \`gr whoami\` shows the active env.
+- After login, an **organization is created automatically** \u2014 do not create a duplicate org unless \`gr organizations list\` is empty.
+- **Workspace is required** for workflow/agent/task commands (\`-w <workspace-uuid>\`).
+- **Concierge does not require \`-w\`** \u2014 use it for first-run setup.
+
+## Recommended path (concierge-driven)
+\`\`\`bash
+gr concierge chat --allow-write --message "Help me set up my first Gravity Rail workspace"
+\`\`\`
+Flags for unattended turns:
+- \`--message\` / \`-m\`: single-turn (non-interactive)
+- \`--auto-approve\`: skip HITL tool approval where policy allows
+- \`--allow-write\`: required for create/update tools
+
+The concierge can: list/create orgs, list org/workspace products, create Stripe checkout sessions, create workspace specs, and \`create_workspace\`.
+
+## Manual CLI path (if not using concierge)
+1. \`gr whoami\` \u2014 confirm account
+2. \`gr organizations list\` \u2014 note org slug/UUID
+3. \`gr concierge chat\` OR web: ${WEB_GET_STARTED}
+4. Product purchase: concierge returns Stripe checkout URL \u2192 **human must complete in browser**
+5. \`gr workspaces list\` \u2014 pick workspace UUID for \`-w\`
+
+## Support (account-level, no workspace)
+\`\`\`bash
+gr support create --type question --title "..." --description "..." --allow-write
+gr support list
+\`\`\`
+
+## Web fallbacks
+- Concierge / setup: ${WEB_SETUP}
+- Wizard: ${WEB_GET_STARTED}
+
+## Headless limits (do not retry forever)
+- Stripe payment / checkout: requires human browser
+- OAuth login: requires human browser
+- Directory trust for future local-file tools: use \`--trust-cwd\` only after user confirms files are safe
+
+## Local project files (CLI only)
+After directory trust + \`--allow-write\`, the concierge can use \`read_local_file\`, \`list_local_dir\`, \`write_local_file\` (client-executed via HITL).
+
+## Verify success
+\`gr workspaces list\` then \`gr workflows list -w <uuid>\` or \`gr agents list -w <uuid>\`
+`;
+async function getStartedCommand(hctx) {
+  const format = hctx.args.format ?? hctx.args.agent;
+  const isLlm = format === "llm" || format === "agent" || hctx.args["format"] === "llm" || !!hctx.args.agent;
+  if (!isLlm) {
+    try {
+      requireAuth(hctx.ctx);
+    } catch {
+    }
+    process.stdout.write(HUMAN_GUIDE);
+    return;
+  }
+  process.stdout.write(LLM_GUIDE);
+}
+
 // src/commands/dev.ts
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, readFileSync as readFileSync3 } from "fs";
 import { execSync as execSync3 } from "child_process";
@@ -12684,8 +13252,17 @@ async function manageCommand(hctx) {
   const chatIdArg = typeof args["chat-id"] === "string" ? args["chat-id"] : void 0;
   const message = typeof args.message === "string" ? args.message : void 0;
   const chat = await getOrCreateChat(ctx, workspace, chatIdArg, asMember, "manager", !!message);
-  const session = buildWorkspaceSession(ctx, workspace, chat, "Workspace Manager");
+  const session = buildWorkspaceSession(ctx, workspace, chat, "Workspace Manager", {
+    appContext: buildCliConciergeAppContext(),
+    allowWrite: true,
+    trustCwd: !!args["trust-cwd"],
+    trustDir: typeof args["trust-dir"] === "string" ? args["trust-dir"] : void 0
+  });
+  process.stderr.write(`Chat #${session.chatId}
+`);
   await runChatSession(session, args);
+  process.stderr.write(`Chat #${session.chatId}
+`);
 }
 async function chatCommand(hctx) {
   const ctx = requireAuth(hctx.ctx);
@@ -12710,10 +13287,11 @@ async function chatCommand(hctx) {
   const session = buildWorkspaceSession(ctx, workspace, chat, "Chat");
   await runChatSession(session, args);
 }
-function buildWorkspaceSession(ctx, workspace, chat, label) {
+function buildWorkspaceSession(ctx, workspace, chat, label, extra) {
   const wsBase = ctx.envConfig.apiUrl.replace(/^https:/, "wss:").replace(/^http:/, "ws:");
   return {
     ctx,
+    workspaceUuid: workspace,
     chatId: chat.id,
     chatUuid: chat.uuid,
     chatTitle: chat.title || chat.uuid,
@@ -12721,7 +13299,8 @@ function buildWorkspaceSession(ctx, workspace, chat, label) {
     wsUrl: `${wsBase}/api/v2/w/${workspace}/realtime/stream-ws`,
     loadMessages: () => ctx.apiClient.getChatMessages(workspace, chat.id, 50).catch(() => []),
     label,
-    model: "manager"
+    model: "manager",
+    ...extra
   };
 }
 async function getOrCreateChat(ctx, workspace, chatIdArg, asMemberId, chatType, skipSelection = false) {
@@ -12819,11 +13398,15 @@ var COLUMNS35 = [
   { header: "NAME", getValue: (a) => a.name || "", maxWidth: 30 },
   { header: "EMAIL", getValue: (a) => a.email || "", maxWidth: 40 },
   { header: "UUID", getValue: (a) => a.uuid },
+  { header: "ENV", getValue: () => "" },
   { header: "SUPERUSER", getValue: (a) => a.isSuperuser ? "yes" : "no" }
 ];
 async function whoamiCommand(ctx) {
   const account = await ctx.apiClient.getUserAccount();
-  outputSingle(account, ctx, COLUMNS35);
+  const columns = COLUMNS35.map(
+    (col) => col.header === "ENV" ? { ...col, getValue: () => ctx.env } : col
+  );
+  outputSingle(account, ctx, columns);
 }
 export {
   AuthRequiredError,
@@ -12833,6 +13416,7 @@ export {
   LIST_PAGINATION_ARGS,
   PAGINATION_ARGS,
   authBrowserCommand,
+  buildCliConciergeAppContext,
   chatCommand,
   conciergeCommand,
   createAuthenticatedContext,
@@ -12849,8 +13433,10 @@ export {
   formatPaginationWarning,
   getConciergeChat,
   getConciergeChatMessages,
+  getStartedCommand,
   handleError,
   isCursorPaginatedResponse,
+  isDirectoryTrusted,
   isListResult,
   isPagePaginatedResponse,
   isPaginatedResponse,
@@ -12867,6 +13453,7 @@ export {
   readJsonInput,
   registerPublicDomains,
   requireAuth,
+  requireDirectoryTrust,
   requireNumber,
   requireString,
   simpleCrudCommands,