@gravity-rail/cli 0.7.2 → 0.8.0

package/dist/lib.js

@@ -1,157 +1,48 @@
+import {
+  COL,
+  LIST_PAGINATION_ARGS,
+  confirmAccountPhoneVerify,
+  createAuthenticatedContext,
+  createConciergeChat,
+  createContext,
+  createPublicAuthenticatedContext,
+  createPublicContext,
+  detectOutputFormat,
+  extractPaginationMeta,
+  fetchAllCursorPages,
+  fetchAllPages,
+  formatPaginationWarning,
+  getConciergeChat,
+  getConciergeChatMessages,
+  isCursorPaginatedResponse,
+  isListResult,
+  isPagePaginatedResponse,
+  isPaginatedResponse,
+  listConciergeChats,
+  listResult,
+  originateConciergeCall,
+  originateConciergeSms,
+  outputData,
+  outputSingle,
+  parsePaginationArgs,
+  requireAuth,
+  startAccountPhoneVerify,
+  stderr,
+  unwrapItems
+} from "./chunk-L5YCPUAM.js";
 import {
   AGUIClient,
-  CredentialsManager,
-  clearScreen,
   formatTimestamp,
-  getEnvironmentConfig,
   getErrorMessage,
   getTextDelta,
   performOAuthFlow,
-  printMessage,
-  printTable,
-  refreshAccessToken,
   selectFromList
 } from "./chunk-H62EC2CF.js";
 import {
   AuthRequiredError,
   CLIError,
   handleError
-} from "./chunk-OPWCTOHP.js";
-
-// src/lib/pagination.ts
-function isListResult(data) {
-  if (!data || typeof data !== "object" || Array.isArray(data)) return false;
-  const obj = data;
-  return Array.isArray(obj.items) && ("supportsAll" in obj || "meta" in obj && (obj.meta === void 0 || typeof obj.meta === "object"));
-}
-function isPagePaginatedResponse(data) {
-  if (!data || typeof data !== "object") return false;
-  const obj = data;
-  if (!Array.isArray(obj.items) || typeof obj.page !== "number") return false;
-  if (typeof obj.totalPages === "number") return true;
-  if (typeof obj.total === "number" && typeof obj.pageSize === "number") return true;
-  return false;
-}
-function isCursorPaginatedResponse(data) {
-  if (!data || typeof data !== "object") return false;
-  const obj = data;
-  return Array.isArray(obj.items) && typeof obj.hasMore === "boolean";
-}
-function isPaginatedResponse(data) {
-  return isPagePaginatedResponse(data) || isCursorPaginatedResponse(data);
-}
-function extractPaginationMeta(data) {
-  if (isPagePaginatedResponse(data)) {
-    const totalPages = data.totalPages ?? (data.pageSize ? Math.ceil(data.total / data.pageSize) : void 0);
-    return {
-      total: data.total,
-      page: data.page,
-      totalPages
-    };
-  }
-  if (isCursorPaginatedResponse(data)) {
-    return {
-      hasMore: data.hasMore,
-      nextCursor: data.nextCursor
-    };
-  }
-  return void 0;
-}
-function formatPaginationWarning(meta, supportsAll = true) {
-  if (!meta) return void 0;
-  const allHint = supportsAll ? " Use --all to fetch all pages." : "";
-  if (meta.totalPages !== void 0 && meta.totalPages > 1) {
-    const pageNum = meta.page ?? 1;
-    return `Showing page ${pageNum} of ${meta.totalPages} (${meta.total} total items).${allHint}`;
-  }
-  if (meta.hasMore === true) {
-    return `More results available.${allHint}`;
-  }
-  return void 0;
-}
-function unwrapItems(data) {
-  if (Array.isArray(data)) return data;
-  if (data && typeof data === "object" && "items" in data && Array.isArray(data.items)) {
-    return data.items;
-  }
-  return [data];
-}
-var LIST_PAGINATION_ARGS = [
-  { name: "page", description: "Page number" },
-  { name: "page-size", description: "Page size" },
-  { name: "all", description: "Fetch all pages and return combined results", isFlag: true }
-];
-function parsePaginationArgs(args) {
-  const result2 = {};
-  if (args.all === true) {
-    result2.all = true;
-  }
-  if (args.page !== void 0) {
-    const num = Number(args.page);
-    if (isNaN(num) || num < 1) throw new CLIError("--page must be a positive integer");
-    result2.page = num;
-  }
-  if (args["page-size"] !== void 0) {
-    const num = Number(args["page-size"]);
-    if (isNaN(num) || num < 1) throw new CLIError("--page-size must be a positive integer");
-    if (num > 100) throw new CLIError("--page-size must be at most 100 (API limit)");
-    result2.pageSize = num;
-  }
-  return result2;
-}
-var MAX_PAGE_SIZE = 100;
-var MAX_PAGES = 200;
-async function fetchAllPages(fetcher) {
-  const allItems = [];
-  let page = 1;
-  while (page <= MAX_PAGES) {
-    const result2 = await fetcher({ page, pageSize: MAX_PAGE_SIZE });
-    const items = unwrapItems(result2);
-    allItems.push(...items);
-    const meta = extractPaginationMeta(result2);
-    if (meta?.totalPages !== void 0) {
-      if (page >= meta.totalPages) break;
-    } else if (!isPagePaginatedResponse(result2)) {
-      if (items.length < MAX_PAGE_SIZE) break;
-    }
-    if (page === MAX_PAGES) {
-      throw new CLIError(
-        `Reached maximum page limit (${MAX_PAGES}). Results may be incomplete.`
-      );
-    }
-    page++;
-  }
-  return allItems;
-}
-async function fetchAllCursorPages(fetcher) {
-  const allItems = [];
-  let cursor;
-  let pages = 0;
-  while (pages < MAX_PAGES) {
-    const result2 = await fetcher({ cursor });
-    const items = unwrapItems(result2);
-    allItems.push(...items);
-    pages++;
-    if (isCursorPaginatedResponse(result2) && result2.hasMore && result2.nextCursor) {
-      cursor = result2.nextCursor;
-    } else {
-      break;
-    }
-    if (pages === MAX_PAGES) {
-      throw new CLIError(
-        `Reached maximum page limit (${MAX_PAGES}). Results may be incomplete.`
-      );
-    }
-  }
-  return allItems;
-}
-function listResult(data, supportsAll = false) {
-  return {
-    items: unwrapItems(data),
-    meta: extractPaginationMeta(data),
-    supportsAll
-  };
-}
+} from "./chunk-7VZ4JLAJ.js";
 
 // src/lib/args.ts
 var PAGINATION_ARGS = [
@@ -229,475 +120,8 @@ function findDef(defs, arg) {
   return void 0;
 }
 
-// src/lib/context.ts
-import { GravityRailClient } from "@gravity-rail/sdk";
-import { homedir } from "os";
-
-// src/lib/output.ts
-function detectOutputFormat(explicit) {
-  if (explicit) return explicit;
-  return process.stdout.isTTY ? "table" : "json";
-}
-function outputData(data, opts, columns, paginationMeta, supportsAll) {
-  let items;
-  let meta;
-  let allSupported;
-  if (isListResult(data)) {
-    items = data.items;
-    meta = data.meta;
-    allSupported = data.supportsAll ?? false;
-  } else {
-    items = unwrapItems(data);
-    meta = paginationMeta ?? extractPaginationMeta(data);
-    allSupported = supportsAll ?? false;
-  }
-  const warning = formatPaginationWarning(meta, allSupported);
-  if (warning) {
-    process.stderr.write(warning + "\n");
-  }
-  switch (opts.outputFormat) {
-    case "json":
-      process.stdout.write(JSON.stringify(items, null, 2) + "\n");
-      break;
-    case "jsonl":
-      for (const item of items) {
-        process.stdout.write(JSON.stringify(item) + "\n");
-      }
-      break;
-    case "table":
-      if (columns) {
-        printTable(items, columns);
-      } else {
-        process.stdout.write(JSON.stringify(items, null, 2) + "\n");
-      }
-      break;
-  }
-}
-function outputSingle(data, opts, columns) {
-  switch (opts.outputFormat) {
-    case "json":
-      process.stdout.write(JSON.stringify(data, null, 2) + "\n");
-      break;
-    case "jsonl":
-      process.stdout.write(JSON.stringify(data) + "\n");
-      break;
-    case "table":
-      if (columns) {
-        printTable([data], columns);
-      } else {
-        process.stdout.write(JSON.stringify(data, null, 2) + "\n");
-      }
-      break;
-  }
-}
-var COL = {
-  id: () => ({ header: "ID", getValue: (item) => String(item.id ?? "") }),
-  uuid: () => ({ header: "UUID", getValue: (item) => item.uuid ?? "" }),
-  name: () => ({ header: "NAME", getValue: (item) => item.name ?? "" }),
-  status: () => ({ header: "STATUS", getValue: (item) => item.status ?? "" }),
-  created: () => ({
-    header: "CREATED",
-    getValue: (item) => item.created_at ?? ""
-  }),
-  updated: () => ({
-    header: "UPDATED",
-    getValue: (item) => item.updated_at ?? ""
-  }),
-  description: () => ({
-    header: "DESCRIPTION",
-    getValue: (item) => item.description ?? ""
-  }),
-  enabled: () => ({
-    header: "ENABLED",
-    getValue: (item) => String(item.enabled ?? "")
-  })
-};
-function stderr(msg) {
-  process.stderr.write(msg + "\n");
-}
-
-// src/lib/realm.ts
-import { execSync } from "child_process";
-import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
-import { dirname, join } from "path";
-function findDevRealmsFile() {
-  let dir = process.cwd();
-  while (dir !== dirname(dir)) {
-    const candidate = join(dir, "dev-realms.json");
-    if (existsSync(candidate)) return candidate;
-    dir = dirname(dir);
-  }
-  throw new Error("Cannot find dev-realms.json in any parent directory");
-}
-var DEV_CLOUD_CACHE_DIR = ".dev-cloud";
-var CACHE_MAX_AGE_MS = 60 * 60 * 1e3;
-function findRepoRoot() {
-  let dir = process.cwd();
-  while (dir !== dirname(dir)) {
-    if (existsSync(join(dir, ".git"))) {
-      return dir;
-    }
-    dir = dirname(dir);
-  }
-  return void 0;
-}
-function getDevCloudCacheDir(namespace) {
-  const repoRoot = findRepoRoot();
-  const base = repoRoot ?? process.cwd();
-  return join(base, DEV_CLOUD_CACHE_DIR, namespace);
-}
-function fetchDevCloudRealms(namespace) {
-  const k8sNamespace = `dev-cloud-${namespace}`;
-  const cmd = `kubectl exec -n ${k8sNamespace} deploy/env -c devbox -- cat /workspace/dev-realms.json`;
-  try {
-    return execSync(cmd, { encoding: "utf-8", timeout: 3e4 });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    throw new Error(
-      `Failed to fetch dev-realms.json from dev-cloud pod "${namespace}": ${message}`
-    );
-  }
-}
-function loadDevCloudRealmFile(namespace) {
-  const cacheDir = getDevCloudCacheDir(namespace);
-  const cachePath = join(cacheDir, "dev-realms.json");
-  if (existsSync(cachePath)) {
-    const stat = statSync(cachePath);
-    const age = Date.now() - stat.mtimeMs;
-    if (age < CACHE_MAX_AGE_MS) {
-      return cachePath;
-    }
-  }
-  const content = fetchDevCloudRealms(namespace);
-  mkdirSync(cacheDir, { recursive: true });
-  writeFileSync(cachePath, content, "utf-8");
-  return cachePath;
-}
-function loadRealmCredentials(realm, devRealmsPath) {
-  const filePath = devRealmsPath ?? findDevRealmsFile();
-  let data;
-  try {
-    data = JSON.parse(readFileSync(filePath, "utf-8"));
-  } catch {
-    throw new Error(`Cannot read dev-realms.json at ${filePath}`);
-  }
-  const parts = realm.split("/");
-  if (parts.length === 1) {
-    const accounts = data._accounts;
-    const account = accounts?.[parts[0]];
-    if (!account?.token) {
-      throw new Error(`Realm account "${parts[0]}" not found in dev-realms.json`);
-    }
-    return { token: account.token };
-  } else {
-    const [wsName, memberName] = parts;
-    const ws = data[wsName];
-    if (!ws) {
-      throw new Error(`Realm workspace "${wsName}" not found in dev-realms.json`);
-    }
-    const member = ws.members?.[memberName];
-    if (!member?.token) {
-      throw new Error(`Realm member "${memberName}" not found in workspace "${wsName}"`);
-    }
-    return { token: member.token, workspaceUuid: ws.workspaceUuid };
-  }
-}
-
-// src/lib/org-auth.ts
-import { execFile } from "child_process";
-var ORG_AUTH_TIMEOUT_MS = 5 * 60 * 1e3;
-function extractOrgTokenFromSetCookies(setCookieValues, preferredCookieName) {
-  let fallback;
-  for (const value of setCookieValues) {
-    const nameValue = value.split(";")[0]?.trim() ?? "";
-    const eqIdx = nameValue.indexOf("=");
-    if (eqIdx === -1) continue;
-    const name = nameValue.slice(0, eqIdx).trim();
-    const tokenValue = nameValue.slice(eqIdx + 1).trim() || void 0;
-    if (!tokenValue) continue;
-    if (name === preferredCookieName) return tokenValue;
-    if (!fallback && (name.startsWith("orgToken") || name.startsWith("orgSession"))) {
-      fallback = tokenValue;
-    }
-  }
-  return fallback;
-}
-async function tryDirectJoin(apiUrl, accessToken, orgAuthInfo) {
-  const response = await fetch(`${apiUrl}/api/v2/o/${orgAuthInfo.orgUuid}/join`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${accessToken}`
-    },
-    body: "{}"
-  });
-  if (response.status === 400) {
-    return null;
-  }
-  if (!response.ok) {
-    throw new Error(`Org join failed (HTTP ${response.status})`);
-  }
-  const rawHeaders = response.headers;
-  const setCookies = rawHeaders.getSetCookie?.() ?? (rawHeaders.get("set-cookie") ? [rawHeaders.get("set-cookie")] : []);
-  if (setCookies.length === 0) {
-    throw new Error("Org join succeeded but no Set-Cookie header returned");
-  }
-  const orgToken = extractOrgTokenFromSetCookies(setCookies, orgAuthInfo.cookieName);
-  if (!orgToken) {
-    throw new Error("Org join succeeded but org token cookie not found in Set-Cookie");
-  }
-  return orgToken;
-}
-function isAllowedAuthUrl(url, apiUrl) {
-  try {
-    const parsed = new URL(url);
-    const api = new URL(apiUrl);
-    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return false;
-    if (parsed.hostname === api.hostname) return true;
-    const lastTwo = (host) => {
-      const parts = host.split(".").filter(Boolean);
-      return parts.length >= 2 ? parts.slice(-2).join(".") : host;
-    };
-    const isIp = /^[0-9.]+$|^\[.*\]$/.test(parsed.hostname);
-    if (isIp) return false;
-    return lastTwo(parsed.hostname) === lastTwo(api.hostname);
-  } catch {
-    return false;
-  }
-}
-function openBrowser(url) {
-  let command;
-  let args;
-  if (process.platform === "darwin") {
-    command = "open";
-    args = [url];
-  } else if (process.platform === "win32") {
-    command = "cmd.exe";
-    args = ["/c", "start", "", url];
-  } else {
-    command = "xdg-open";
-    args = [url];
-  }
-  execFile(command, args, (_err) => {
-  });
-}
-function registerOrgAuthHandler(apiClient, apiUrl, accessToken) {
-  apiClient.setOrgAuthHandler(async (orgAuthInfo) => {
-    try {
-      const orgToken = await tryDirectJoin(apiUrl, accessToken, orgAuthInfo);
-      if (orgToken !== null) {
-        apiClient.setOrgToken(orgToken, orgAuthInfo.orgUuid);
-        return;
-      }
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      stderr(`Warning: org direct-join failed (${msg}); trying browser auth`);
-    }
-    if (!isAllowedAuthUrl(orgAuthInfo.authUrl, apiUrl)) {
-      throw new Error(
-        `Refusing to open organization auth URL: scheme/host does not match the configured API host. Re-run with the expected --api-url, or contact support.`
-      );
-    }
-    stderr(`
-This workspace requires organization SSO authentication.`);
-    stderr(`Opening browser to complete authentication...`);
-    stderr(`  ${orgAuthInfo.authUrl}
-`);
-    stderr(`If the browser does not open, visit the URL above manually.`);
-    stderr(
-      `After signing in, re-run the command \u2014 the CLI cannot receive the SSO token directly.`
-    );
-    openBrowser(orgAuthInfo.authUrl);
-    await new Promise((_, reject) => {
-      const t = setTimeout(
-        () => reject(
-          new Error(
-            "Organization authentication timed out.\nPlease complete authentication in the browser, then re-run the command."
-          )
-        ),
-        ORG_AUTH_TIMEOUT_MS
-      );
-      t.unref?.();
-    });
-  });
-}
-
-// src/lib/pinned-fetch.ts
-import { Agent, fetch as undiciFetch } from "undici";
-function createPinnedFetch(apiUrl, apiIp) {
-  if (!apiIp) return fetch;
-  let parsed;
-  try {
-    parsed = new URL(apiUrl);
-  } catch {
-    return fetch;
-  }
-  const hostname = parsed.hostname;
-  const dispatcher = new Agent({
-    connect: {
-      servername: hostname
-    }
-  });
-  return async (input, init) => {
-    const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
-    let reqUrl;
-    try {
-      reqUrl = new URL(url, apiUrl);
-    } catch {
-      return fetch(input, init);
-    }
-    const headers2 = new Headers(init?.headers);
-    if (reqUrl.hostname === hostname) {
-      headers2.set("Host", hostname);
-      reqUrl = new URL(reqUrl.href);
-      reqUrl.hostname = apiIp;
-    }
-    return undiciFetch(reqUrl, {
-      ...init,
-      headers: headers2,
-      dispatcher
-    });
-  };
-}
-function withAuditHeaders(fetchFn, headers2) {
-  const { chatId, sessionId, toolCallId } = headers2;
-  if (chatId === void 0 && !sessionId && !toolCallId) {
-    return fetchFn;
-  }
-  return async (input, init) => {
-    const reqHeaders = new Headers(init?.headers);
-    if (chatId !== void 0) {
-      reqHeaders.set("X-GR-Chat-Id", String(chatId));
-    }
-    if (sessionId) {
-      reqHeaders.set("X-GR-Session-Id", sessionId);
-    }
-    if (toolCallId) {
-      reqHeaders.set("X-GR-Tool-Call-Id", toolCallId);
-    }
-    return fetchFn(input, { ...init, headers: reqHeaders });
-  };
-}
-function createSandboxFetchFromEnv(apiUrl) {
-  const apiIp = process.env.GRAVITY_RAIL_API_IP;
-  let fetchFn = createPinnedFetch(apiUrl, apiIp);
-  const chatIdRaw = process.env.GRAVITY_RAIL_CHAT_ID;
-  const chatId = chatIdRaw ? Number(chatIdRaw) : void 0;
-  return withAuditHeaders(fetchFn, {
-    chatId: chatId !== void 0 && Number.isFinite(chatId) ? chatId : void 0,
-    sessionId: process.env.GRAVITY_RAIL_SESSION_ID,
-    toolCallId: process.env.GRAVITY_RAIL_TOOL_CALL_ID
-  });
-}
-
-// src/lib/context.ts
-function makeApiClient(accessToken, apiUrl) {
-  const fetchFn = createSandboxFetchFromEnv(apiUrl);
-  const apiClient = new GravityRailClient(accessToken, apiUrl, fetchFn);
-  registerOrgAuthHandler(apiClient, apiUrl, accessToken);
-  return apiClient;
-}
-async function tryTokenRefresh(ctx, creds) {
-  if (!creds.refreshToken) return null;
-  const refreshed = await refreshAccessToken(
-    ctx.envConfig,
-    creds,
-    ctx.credentialsManager,
-    ctx.env
-  );
-  if (!refreshed?.accessToken) return null;
-  const apiClient = makeApiClient(refreshed.accessToken, ctx.envConfig.apiUrl);
-  return { ...ctx, accessToken: refreshed.accessToken, apiClient };
-}
-function createContext(opts) {
-  const baseConfig = getEnvironmentConfig(opts.env);
-  const apiUrl = opts.apiUrl || process.env.GRAVITY_RAIL_API_URL || baseConfig.apiUrl;
-  const envConfig = apiUrl === baseConfig.apiUrl ? baseConfig : { ...baseConfig, apiUrl };
-  const credentialsManager = new CredentialsManager(homedir(), envConfig.apiUrl);
-  return {
-    env: opts.env,
-    envConfig,
-    outputFormat: detectOutputFormat(opts.outputFormat),
-    verbose: opts.verbose ?? false,
-    allowWrite: opts.allowWrite ?? false,
-    credentialsManager
-  };
-}
-async function createAuthenticatedContext(opts) {
-  const ctx = createContext(opts);
-  if (opts.realm) {
-    let devRealmsPath;
-    if (opts.env.startsWith("dev-cloud:")) {
-      const namespace = opts.env.slice("dev-cloud:".length);
-      devRealmsPath = loadDevCloudRealmFile(namespace);
-    }
-    const { token, workspaceUuid } = loadRealmCredentials(opts.realm, devRealmsPath);
-    const apiClient = makeApiClient(token, ctx.envConfig.apiUrl);
-    return { ...ctx, accessToken: token, apiClient, realmWorkspace: workspaceUuid };
-  }
-  const apiKey = process.env.GRAVITY_RAIL_API_KEY;
-  if (apiKey) {
-    const apiClient = makeApiClient(apiKey, ctx.envConfig.apiUrl);
-    return { ...ctx, accessToken: apiKey, apiClient };
-  }
-  const creds = ctx.credentialsManager.load(ctx.env);
-  if (creds?.accessToken) {
-    const buffer = 5 * 60 * 1e3;
-    const notExpired = !creds.expiresAt || new Date(creds.expiresAt) > new Date(Date.now() + buffer);
-    if (notExpired) {
-      const apiClient = makeApiClient(creds.accessToken, ctx.envConfig.apiUrl);
-      return { ...ctx, accessToken: creds.accessToken, apiClient };
-    }
-    const refreshed = await tryTokenRefresh(ctx, creds);
-    if (refreshed) return refreshed;
-  }
-  throw new AuthRequiredError();
-}
-function requireAuth(ctx) {
-  if (!("apiClient" in ctx)) {
-    throw new Error("Command handler accessed apiClient without declaring requiresAuth");
-  }
-  return ctx;
-}
-function createPublicContext(opts) {
-  const env = opts.env ?? "prod";
-  const envConfig = opts.apiUrl ? {
-    apiUrl: opts.apiUrl,
-    frontendUrl: opts.frontendUrl || process.env.GRAVITY_RAIL_FRONTEND_URL || "https://app.gravityrail.com"
-  } : getEnvironmentConfig(env);
-  const credentialsManager = new CredentialsManager(homedir(), envConfig.apiUrl);
-  return {
-    env,
-    envConfig,
-    outputFormat: detectOutputFormat(opts.outputFormat),
-    verbose: opts.verbose ?? false,
-    allowWrite: opts.allowWrite ?? false,
-    credentialsManager
-  };
-}
-async function createPublicAuthenticatedContext(opts) {
-  const ctx = createPublicContext(opts);
-  const apiKey = process.env.GRAVITY_RAIL_API_KEY;
-  if (apiKey) {
-    const apiClient = makeApiClient(apiKey, ctx.envConfig.apiUrl);
-    return { ...ctx, accessToken: apiKey, apiClient };
-  }
-  const creds = ctx.credentialsManager.load(ctx.env);
-  if (creds?.accessToken) {
-    const buffer = 5 * 60 * 1e3;
-    const notExpired = !creds.expiresAt || new Date(creds.expiresAt) > new Date(Date.now() + buffer);
-    if (notExpired) {
-      const apiClient = makeApiClient(creds.accessToken, ctx.envConfig.apiUrl);
-      return { ...ctx, accessToken: creds.accessToken, apiClient };
-    }
-    const refreshed = await tryTokenRefresh(ctx, creds);
-    if (refreshed) return refreshed;
-  }
-  throw new AuthRequiredError();
-}
-
 // src/lib/input.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync } from "fs";
 var JSON_BODY_ACTIONS = /* @__PURE__ */ new Set([
   "create",
   "update",
@@ -744,7 +168,7 @@ async function readJsonInput(args) {
   }
   if (filePath) {
     try {
-      const content = readFileSync2(filePath, "utf-8");
+      const content = readFileSync(filePath, "utf-8");
       return JSON.parse(content);
     } catch (err) {
       if (err instanceof SyntaxError) {
@@ -1344,6 +768,11 @@ var CommandRegistry = class {
     const key = cmd.path.join(" ");
     this.commands.set(key, cmd);
   }
+  registerCommands(commands3) {
+    for (const cmd of commands3) {
+      this.registerCommand(cmd);
+    }
+  }
   /** Resolve command words to a CommandDef using longest-match.
    *  Supports {param} path segments that match any word and extract as pathParams. */
   resolve(words) {
@@ -1376,6 +805,7 @@ var CommandRegistry = class {
   }
   /** Generate help text. If prefix given, show commands under that prefix. */
   getHelp(prefix) {
+    const inSandbox = process.env.GRAVITY_RAIL_SANDBOX === "1";
     if (!prefix || prefix.length === 0) {
       return this.getTopLevelHelp();
     }
@@ -1412,18 +842,21 @@ var CommandRegistry = class {
 `, "Commands:"];
     for (const cmd of matching.sort((a, b) => a.path.join(" ").localeCompare(b.path.join(" ")))) {
       const subPath = cmd.path.slice(prefix.length).join(" ") || cmd.path[cmd.path.length - 1];
-      lines.push(`  ${subPath.padEnd(28)} ${cmd.description}`);
+      const description = inSandbox ? sandboxHelpText(cmd.description) : cmd.description;
+      lines.push(`  ${subPath.padEnd(28)} ${description}`);
     }
     return lines.join("\n") + "\n";
   }
   getCommandHelp(cmd) {
     const cmdStr = cmd.path.join(" ");
-    const lines = [`${cmd.description}
+    const inSandbox = process.env.GRAVITY_RAIL_SANDBOX === "1";
+    const description = inSandbox ? sandboxHelpText(cmd.description) : cmd.description;
+    const lines = [`${description}
 `, `Usage: gr ${cmdStr} [options]`];
-    if (cmd.requiresWorkspace) {
+    if (cmd.requiresWorkspace && !inSandbox) {
       lines.push("  Requires: -w <workspace-uuid>  (or --realm <workspace>/<member> in dev)");
     }
-    if (cmd.mutates) {
+    if (cmd.mutates && !inSandbox) {
       lines.push("  Requires: --allow-write");
     }
     const action = cmd.path[cmd.path.length - 1] ?? "";
@@ -1445,7 +878,7 @@ var CommandRegistry = class {
     if (cmd.examples && cmd.examples.length > 0) {
       lines.push("", "Examples:");
       for (const ex of cmd.examples) {
-        lines.push(`  ${ex}`);
+        lines.push(`  ${inSandbox ? sandboxExample(ex) : ex}`);
       }
     }
     return lines.join("\n") + "\n";
@@ -1460,38 +893,50 @@ var CommandRegistry = class {
   }
   getTopLevelHelp() {
     const lines = ["Usage: gr <command> [options]\n", "Commands:"];
+    const inSandbox = process.env.GRAVITY_RAIL_SANDBOX === "1";
     const seen = /* @__PURE__ */ new Set();
     for (const domain of this.domains) {
       if (!seen.has(domain.name)) {
         seen.add(domain.name);
-        lines.push(`  ${domain.name.padEnd(28)} ${domain.description}`);
+        const description = inSandbox ? sandboxHelpText(domain.description) : domain.description;
+        lines.push(`  ${domain.name.padEnd(28)} ${description}`);
       }
     }
     for (const [, cmd] of this.commands) {
       const topWord = cmd.path[0];
       if (!seen.has(topWord) && cmd.path.length === 1) {
         seen.add(topWord);
-        lines.push(`  ${topWord.padEnd(28)} ${cmd.description}`);
+        const description = inSandbox ? sandboxHelpText(cmd.description) : cmd.description;
+        lines.push(`  ${topWord.padEnd(28)} ${description}`);
       }
     }
-    lines.push(
+    const globalOptions = [
       "",
       "Global Options:",
-      "  --env <env>               Environment: dev, staging, prod (default: dev)",
-      "  --realm <ws>/<member>     Dev auth shortcut (dev only; sets -w automatically)",
-      "  --api-url <url>           API base URL (or GRAVITY_RAIL_API_URL)",
-      "  -w, --workspace <uuid>    Workspace UUID",
+      ...!inSandbox ? [
+        "  --env <env>               Environment: dev, staging, prod (default: dev)",
+        "  --realm <ws>/<member>     Dev auth shortcut (dev only; sets -w automatically)",
+        "  --api-url <url>           API base URL (or GRAVITY_RAIL_API_URL)",
+        "  -w, --workspace <uuid>    Workspace UUID"
+      ] : [],
       "  -d, --data <json>         JSON body (create/update and other write commands)",
       "  -f, --file <path>         JSON body from file",
-      "  --allow-write             Required for create/update/delete/archive",
+      ...!inSandbox ? ["  --allow-write             Required for create/update/delete/archive"] : [],
       "  -o, --output-format <fmt> Output format: json, jsonl, table (default: auto)",
       "  -v, --verbose             Verbose output to stderr",
       "  --help                    Show help",
       "  --version                 Show version"
-    );
+    ];
+    lines.push(...globalOptions);
     return lines.join("\n") + "\n";
   }
 };
+function sandboxHelpText(text) {
+  return text.replace(/\byarn gr\b/g, "gr").replace(/\s--allow-write\b/g, "").replace(/\s--realm\s+(?:"[^"]+"|'[^']+'|<[^>]+>|\S+)/g, "").replace(/\s-w\s+(?:"[^"]+"|'[^']+'|<[^>]+>|\S+)/g, "");
+}
+function sandboxExample(example) {
+  return sandboxHelpText(example);
+}
 
 // src/lib/types.ts
 function requireString(args, key) {
@@ -1514,8 +959,8 @@ function requireNumberFrom(args, ...keys) {
       if (!isNaN(num)) return num;
     }
   }
-  const hint = keys.map((k) => `--${k}`).join(" or ");
-  throw new Error(`Missing required argument: ${hint}`);
+  const hint2 = keys.map((k) => `--${k}`).join(" or ");
+  throw new Error(`Missing required argument: ${hint2}`);
 }
 
 // src/domains/agent-tasks.ts
@@ -1653,6 +1098,42 @@ var agentTasksDomain = {
 
 // src/domains/agents.ts
 var COLUMNS = [COL.id(), COL.uuid(), COL.name(), COL.status(), COL.created()];
+var TOOL_COLUMNS = [
+  COL.name(),
+  { header: "DESCRIPTION", getValue: (item) => (item.description ?? "").slice(0, 60) }
+];
+var ABILITY_COLUMNS = [
+  COL.uuid(),
+  { header: "ABILITY-TYPE", getValue: (item) => item.abilityType ?? "" },
+  COL.enabled(),
+  { header: "CEL-CONDITION", getValue: (item) => item.celCondition ?? "" }
+];
+function requireAbilityScope(args) {
+  const hasWorkflow = typeof args["workflow-id"] === "string";
+  const hasTask = typeof args["task-id"] === "string";
+  if (hasWorkflow === hasTask) {
+    throw new CLIError(
+      "Specify exactly one of --workflow-id or --task-id. Abilities are scoped to a workflow or task, not to the agent row itself."
+    );
+  }
+  if (hasTask) {
+    const taskId = Number(args["task-id"]);
+    if (isNaN(taskId)) throw new CLIError("--task-id must be a number");
+    return { taskId };
+  }
+  const workflowId = Number(args["workflow-id"]);
+  if (isNaN(workflowId)) throw new CLIError("--workflow-id must be a number");
+  return { workflowId };
+}
+function normalizeChannel(channel) {
+  const aliases = {
+    phone: "phone-voice",
+    voice: "phone-voice",
+    sms: "phone-sms",
+    web: "web-chat"
+  };
+  return aliases[channel] ?? channel;
+}
 var agentsDomain = {
   name: "agents",
   description: "Manage agents",
@@ -1668,52 +1149,207 @@ var agentsDomain = {
       archiveMethod: "archiveAgent",
       unarchiveMethod: "unarchiveAgent",
       columns: COLUMNS,
-      paginationSupport: "full"
-    })
-  ]
-};
-
-// src/domains/chats.ts
-var COLUMNS2 = [
-  COL.id(),
-  COL.uuid(),
-  { header: "TYPE", getValue: (item) => item.chatType ?? item.chat_type ?? "" },
-  { header: "MEMBER", getValue: (item) => item.member_name ?? String(item.member_id ?? "") },
-  COL.status(),
-  { header: "CHANNEL", getValue: (item) => item.channel ?? "" },
-  COL.created()
-];
-var LABEL_COLUMNS = [
-  COL.id(),
-  COL.uuid(),
-  COL.name(),
-  { header: "COLOR", getValue: (item) => item.color ?? "" }
-];
-var FILTER_COLUMNS = [COL.id(), COL.uuid(), COL.name()];
-var MESSAGE_COLUMNS2 = [
-  COL.id(),
-  { header: "ROLE", getValue: (item) => item.role ?? "" },
-  {
-    header: "CONTENT",
-    getValue: (item) => String(item.content ?? "").slice(0, 80),
-    maxWidth: 80
-  },
-  {
-    header: "TOOL_CALLS",
-    getValue: (item) => Array.isArray(item.tool_calls) && item.tool_calls.length > 0 ? item.tool_calls.map((t) => t.function?.name ?? "?").join(",") : ""
-  },
-  COL.created()
-];
-var chatsDomain = {
-  name: "chats",
-  description: "Manage chats",
-  commands: [
-    ...crudCommands({
-      prefix: ["chats"],
-      entityName: "chat",
-      listMethod: "getChats",
-      getMethod: "getChat",
-      createMethod: "createChat",
+      paginationSupport: "full",
+      updateHelp: "Update an agent. Body schema (JSON via --data/--file/stdin), all fields optional:\n  name              string   display name\n  description       string   short summary shown in listings\n  systemPrompt      string   base instructions for the agent\n  model             string   AI model slug (see `gr ai-models list`)\n  temperature       number   sampling temperature (0-2)\n  avatarFileId      number   workspace file ID for the avatar\n  config            object   AgentConfig overrides (advanced)\nAbilities are NOT set here \u2014 they live on a workflow/task scope; use `gr agents abilities` to manage them.",
+      updateExamples: [
+        `gr agents update --id 42 --data '{"name":"Scheduler","temperature":0.4}'`,
+        "gr agents update --id 42 --file agent.json"
+      ]
+    }),
+    {
+      path: ["agents", "resolve-tools"],
+      description: "Show resolved runtime tools for an agent in a channel context. Channel accepts canonical values (phone-voice, web-voice, phone-sms, web-chat) or shorthand aliases: phone -> phone-voice, voice -> phone-voice, sms -> phone-sms, web -> web-chat. Unknown values are passed through unchanged. When neither --task-id nor --task-uuid is supplied the agent's workflow start task is used.",
+      requiresWorkspace: true,
+      args: [
+        { name: "id", description: "Agent ID", required: true },
+        {
+          name: "channel",
+          description: "Channel to simulate. Canonical: phone-voice, web-voice, phone-sms, web-chat. Aliases: phone|voice -> phone-voice, sms -> phone-sms, web -> web-chat.",
+          required: true
+        },
+        {
+          name: "task-id",
+          description: "Numeric task ID whose workflow abilities to resolve. Omit to use the workflow start task (or supply --task-uuid instead).",
+          required: false
+        },
+        {
+          name: "task-uuid",
+          description: "Task UUID as an alternative to --task-id. Omit to use the workflow start task.",
+          required: false
+        }
+      ],
+      handler: async ({ ctx, workspace, args }) => {
+        const rawTaskId = args["task-id"];
+        const rawTaskUuid = args["task-uuid"];
+        if (rawTaskId !== void 0 && rawTaskUuid !== void 0) {
+          throw new Error("Provide at most one of --task-id or --task-uuid, not both");
+        }
+        const options = {
+          channel: normalizeChannel(String(args.channel))
+        };
+        if (typeof rawTaskId === "string") {
+          const n = Number(rawTaskId);
+          if (isNaN(n)) throw new Error("Argument --task-id must be a number");
+          options.taskId = n;
+        }
+        if (typeof rawTaskUuid === "string") {
+          options.taskUuid = rawTaskUuid;
+        }
+        const result2 = await requireAuth(ctx).apiClient.resolveAgentTools(
+          workspace,
+          requireNumber(args, "id"),
+          options
+        );
+        const tools = result2.tools ?? result2;
+        outputData(Array.isArray(tools) ? tools : [tools], ctx, TOOL_COLUMNS);
+      }
+    },
+    {
+      path: ["agents", "abilities", "list"],
+      description: "Show the abilities effective for an agent on a task (read-only). Requires --task-id because abilities are resolved through the task's workflow, not stored on the agent row.",
+      requiresWorkspace: true,
+      columns: ABILITY_COLUMNS,
+      args: [
+        { name: "id", description: "Agent ID", required: true },
+        {
+          name: "task-id",
+          description: "Task ID whose workflow abilities to list",
+          required: true
+        }
+      ],
+      handler: async ({ ctx, workspace, args }) => {
+        const result2 = await requireAuth(ctx).apiClient.listAgentAbilities(
+          workspace,
+          requireNumber(args, "id"),
+          { taskId: requireNumber(args, "task-id") }
+        );
+        outputData(result2, ctx, ABILITY_COLUMNS);
+      }
+    },
+    {
+      path: ["agents", "abilities", "enable"],
+      description: "Enable (create) an ability on a workflow or task scope. Requires exactly one of --workflow-id or --task-id \u2014 abilities are scoped to a workflow/task, never to the agent row. Provide initial --config JSON inline or via --data/--file.",
+      mutates: true,
+      requiresWorkspace: true,
+      args: [
+        { name: "ability-type", description: "Ability type slug (e.g. 'communication:send_sms')", required: true },
+        { name: "workflow-id", description: "Workflow scope (mutually exclusive with --task-id)" },
+        { name: "task-id", description: "Task scope (mutually exclusive with --workflow-id)" }
+      ],
+      examples: [
+        "gr agents abilities enable --workflow-id 7 --ability-type tools:web_search",
+        `gr agents abilities enable --task-id 12 --ability-type integration:data_access --data '{"dataTypeUuid":"..."}'`
+      ],
+      handler: async ({ ctx, workspace, args, data }) => {
+        const abilityType = args["ability-type"];
+        if (typeof abilityType !== "string") {
+          throw new CLIError("--ability-type is required");
+        }
+        const scope = requireAbilityScope(args);
+        const config = data && typeof data === "object" ? data : {};
+        const body = {
+          abilityType,
+          config,
+          ...scope
+        };
+        const result2 = await requireAuth(ctx).apiClient.createAbility(workspace, body);
+        outputSingle(result2, ctx, ABILITY_COLUMNS);
+      }
+    },
+    {
+      path: ["agents", "abilities", "disable"],
+      description: "Disable an ability instance by UUID (sets enabled=false, keeps config). Use `gr agents abilities list` to find the UUID.",
+      mutates: true,
+      requiresWorkspace: true,
+      args: [{ name: "uuid", description: "Ability instance UUID", required: true }],
+      handler: async ({ ctx, workspace, args }) => {
+        const uuid = args.uuid;
+        if (typeof uuid !== "string") throw new CLIError("--uuid is required");
+        const result2 = await requireAuth(ctx).apiClient.updateAbility(workspace, uuid, {
+          enabled: false
+        });
+        outputSingle(result2, ctx, ABILITY_COLUMNS);
+      }
+    },
+    {
+      path: ["agents", "abilities", "configure"],
+      description: "Update an ability instance by UUID. Pass --data/--file JSON to merge into config, and/or --enabled true|false to toggle. config is merged with the existing config server-side.",
+      mutates: true,
+      requiresWorkspace: true,
+      args: [
+        { name: "uuid", description: "Ability instance UUID", required: true },
+        { name: "enabled", description: "Set enabled state (true|false)" }
+      ],
+      examples: [
+        `gr agents abilities configure --uuid <uuid> --data '{"canForward":true}'`,
+        "gr agents abilities configure --uuid <uuid> --enabled true"
+      ],
+      handler: async ({ ctx, workspace, args, data }) => {
+        const uuid = args.uuid;
+        if (typeof uuid !== "string") throw new CLIError("--uuid is required");
+        const body = {};
+        if (data && typeof data === "object") {
+          body.config = data;
+        }
+        if (typeof args.enabled === "string") {
+          if (args.enabled !== "true" && args.enabled !== "false") {
+            throw new CLIError("--enabled must be true or false");
+          }
+          body.enabled = args.enabled === "true";
+        }
+        if (Object.keys(body).length === 0) {
+          throw new CLIError(
+            "Nothing to update: provide --data config and/or --enabled"
+          );
+        }
+        const result2 = await requireAuth(ctx).apiClient.updateAbility(workspace, uuid, body);
+        outputSingle(result2, ctx, ABILITY_COLUMNS);
+      }
+    }
+  ]
+};
+
+// src/domains/chats.ts
+var COLUMNS2 = [
+  COL.id(),
+  COL.uuid(),
+  { header: "TYPE", getValue: (item) => item.chatType ?? item.chat_type ?? "" },
+  { header: "MEMBER", getValue: (item) => item.member_name ?? String(item.member_id ?? "") },
+  COL.status(),
+  { header: "CHANNEL", getValue: (item) => item.channel ?? "" },
+  COL.created()
+];
+var LABEL_COLUMNS = [
+  COL.id(),
+  COL.uuid(),
+  COL.name(),
+  { header: "COLOR", getValue: (item) => item.color ?? "" }
+];
+var FILTER_COLUMNS = [COL.id(), COL.uuid(), COL.name()];
+var MESSAGE_COLUMNS2 = [
+  COL.id(),
+  { header: "ROLE", getValue: (item) => item.role ?? "" },
+  {
+    header: "CONTENT",
+    getValue: (item) => String(item.content ?? "").slice(0, 80),
+    maxWidth: 80
+  },
+  {
+    header: "TOOL_CALLS",
+    getValue: (item) => Array.isArray(item.tool_calls) && item.tool_calls.length > 0 ? item.tool_calls.map((t) => t.function?.name ?? "?").join(",") : ""
+  },
+  COL.created()
+];
+var chatsDomain = {
+  name: "chats",
+  description: "Manage chats",
+  commands: [
+    ...crudCommands({
+      prefix: ["chats"],
+      entityName: "chat",
+      listMethod: "getChats",
+      getMethod: "getChat",
+      createMethod: "createChat",
       updateMethod: "updateChat",
       deleteMethod: "deleteChat",
       archiveMethod: "archiveChat",
@@ -1894,21 +1530,47 @@ var chatsDomain = {
     // Inspect (aggregated debug view)
     {
       path: ["chats", "inspect"],
-      description: "Inspect a chat with messages, assignment state, and data records",
-      requiresWorkspace: true,
+      description: "Inspect a chat with messages, assignment state, and data records. Omit -w for concierge (account-level) chats.",
+      requiresWorkspace: false,
       args: [{ name: "id", description: "Chat ID", required: true }],
       handler: async ({ ctx, workspace, args }) => {
         const chatId = requireNumber(args, "id");
-        const [chat, messages, ws] = await Promise.all([
-          requireAuth(ctx).apiClient.getChat(workspace, chatId),
-          requireAuth(ctx).apiClient.getChatMessages(workspace, chatId),
-          requireAuth(ctx).apiClient.getWorkspace(workspace)
-        ]);
-        const isHipaa = ws.features?.includes("hipaa_compliance");
+        const authed = requireAuth(ctx);
         const truncate2 = (content) => {
           const text = typeof content === "string" ? content : JSON.stringify(content);
           return text.slice(0, 200);
         };
+        if (!workspace) {
+          const [chat2, messages2] = await Promise.all([
+            getConciergeChat(authed, chatId),
+            getConciergeChatMessages(authed, chatId)
+          ]);
+          outputSingle(
+            {
+              chat: {
+                id: chat2.id,
+                uuid: chat2.uuid,
+                title: chat2.title,
+                chatType: chat2.chatType,
+                threadId: chat2.threadId,
+                createdAt: chat2.createdAt
+              },
+              messages: messages2.map((m) => ({
+                id: m.id,
+                role: m.role,
+                content: truncate2(m.content)
+              }))
+            },
+            ctx
+          );
+          return;
+        }
+        const [chat, messages, ws] = await Promise.all([
+          authed.apiClient.getChat(workspace, chatId),
+          authed.apiClient.getChatMessages(workspace, chatId),
+          authed.apiClient.getWorkspace(workspace)
+        ]);
+        const isHipaa = ws.features?.includes("hipaa_compliance");
         const result2 = {
           chat: {
             id: chat.id,
@@ -1928,10 +1590,7 @@ var chatsDomain = {
         };
         const assignmentId = chat.assignmentId;
         if (assignmentId) {
-          const assignment = await requireAuth(ctx).apiClient.getAssignment(
-            workspace,
-            assignmentId
-          );
+          const assignment = await authed.apiClient.getAssignment(workspace, assignmentId);
           result2.assignment = {
             id: assignment.id,
             status: assignment.status,
@@ -2186,10 +1845,7 @@ var memberRolesDomain = {
     updateMethod: "updateMemberRole",
     deleteMethod: "deleteMemberRole",
     columns: ROLE_COLUMNS2,
-    createExamples: [
-      "gr member-roles list -w $WID",
-      "gr member-roles get -w $WID --id 2"
-    ]
+    createExamples: ["gr member-roles list -w $WID", "gr member-roles get -w $WID --id 2"]
   })
 };
 
@@ -2198,10 +1854,13 @@ var COLUMNS4 = [
   COL.id(),
   COL.uuid(),
   COL.name(),
-  COL.status(),
+  // TaskResponse has no `status` field — it has `archived`. Surface that
+  // directly so active vs archived is visible in the default table (relevant
+  // once --include-archived mixes both into the listing).
+  { header: "STATUS", getValue: (item) => item.archived ? "archived" : "active" },
   {
     header: "WORKFLOW",
-    getValue: (item) => item.workflow_name ?? String(item.workflow_id ?? "")
+    getValue: (item) => String(item.workflowId ?? "")
   },
   COL.created()
 ];
@@ -2219,7 +1878,21 @@ var tasksDomain = {
       deleteMethod: "deleteTask",
       archiveMethod: "archiveTask",
       unarchiveMethod: "unarchiveTask",
-      columns: COLUMNS4
+      columns: COLUMNS4,
+      // `tasks list` is workspace-wide by default. Filter to one workflow
+      // with --workflow-id, and opt into archived tasks with
+      // --include-archived (active-only by default, matching the backend).
+      listArgs: [
+        {
+          name: "workflow-id",
+          description: "Filter tasks to a single workflow by ID"
+        },
+        {
+          name: "include-archived",
+          description: "Include archived tasks in the listing",
+          isFlag: true
+        }
+      ]
     }),
     {
       path: ["tasks", "clone"],
@@ -2274,9 +1947,18 @@ var COLUMNS5 = [
   COL.id(),
   COL.uuid(),
   COL.name(),
-  { header: "TASKS", getValue: (item) => String(item.taskCount ?? "") },
+  // taskCount is the total (active + archived). Show the active count as the
+  // headline number — matching `tasks list` — and call out archived tasks
+  // separately so the table never overstates how many tasks actually run.
+  { header: "TASKS", getValue: (item) => formatTaskCount(item) },
   COL.created()
 ];
+function formatTaskCount(item) {
+  const total = Number(item.taskCount ?? 0);
+  const archived = Number(item.archivedTaskCount ?? 0);
+  const active = total - archived;
+  return archived > 0 ? `${active} (+${archived} archived)` : String(active);
+}
 var NOTE_COLUMNS = [
   COL.id(),
   { header: "TITLE", getValue: (item) => item.title ?? "" },
@@ -2377,13 +2059,21 @@ var workflowsDomain = {
     // Diagram
     {
       path: ["workflows", "diagram"],
-      description: "Get workflow diagram",
+      description: "Get workflow diagram (active tasks only by default)",
       requiresWorkspace: true,
-      args: [{ name: "id", description: "Workflow ID", required: true }],
+      args: [
+        { name: "id", description: "Workflow ID", required: true },
+        {
+          name: "include-archived",
+          description: "Render archived tasks (distinctly styled) too",
+          isFlag: true
+        }
+      ],
       handler: async ({ ctx, workspace, args }) => {
         const result2 = await requireAuth(ctx).apiClient.getWorkflowDiagram(
           workspace,
-          requireNumber(args, "id")
+          requireNumber(args, "id"),
+          { includeArchived: args["include-archived"] === true }
         );
         outputSingle(result2, ctx);
       }
@@ -2900,28 +2590,64 @@ var workspacesDomain = {
         outputSingle(result2, ctx, COLUMNS7);
       }
     },
-    // Create a workspace via the public endpoint
+    // Provision a workspace under an organization's active subscription.
     {
       path: ["workspaces", "create"],
-      description: "Create a workspace",
+      description: "Provision a workspace in an organization (requires an active subscription)",
       mutates: true,
       requiresWorkspace: false,
-      handler: async ({ ctx, data }) => {
-        if (!data) throw new CLIError("JSON data required (--data, --file, or stdin)");
-        const payload = data;
-        if (!payload.organizationId) {
+      args: [
+        {
+          name: "org",
+          aliases: ["org-uuid"],
+          description: "Organization UUID",
+          required: true
+        },
+        { name: "product", description: "Workspace plan product ID", required: true },
+        { name: "name", description: "Workspace name", required: true },
+        { name: "period", description: "Billing period: 'month' or 'year'", default: "month" },
+        { name: "slug", description: "Workspace slug (optional)" },
+        { name: "template", description: "Template workspace UUID to clone (optional)" }
+      ],
+      examples: ['gr workspaces create --org <org-uuid> --product 14 --name "Front Desk"'],
+      handler: async ({ ctx, args }) => {
+        const orgUuid = args.org ?? args["org-uuid"];
+        const name = args.name;
+        const productRaw = args.product;
+        if (!orgUuid) throw new CLIError("Missing required argument: --org <org-uuid>");
+        if (!name) throw new CLIError("Missing required argument: --name");
+        if (!productRaw) {
           throw new CLIError(
-            `organizationId is required in --data (e.g. --data '{"organizationId": 1, "name": "My Workspace"}')`
+            "Missing required argument: --product\nList workspace plans with: gr billing products --type workspace"
           );
         }
+        const payload = {
+          name,
+          productId: Number(productRaw),
+          planPeriod: args.period || "month"
+        };
+        if (args.slug) payload.slug = args.slug;
+        if (args.template) payload.templateWorkspaceUuid = args.template;
         try {
-          const result2 = await requireAuth(ctx).apiClient.createWorkspace(payload);
+          const result2 = await requireAuth(ctx).apiClient.createOrganizationWorkspace(
+            orgUuid,
+            payload
+          );
           outputSingle(result2, ctx, COLUMNS7);
+          if ((ctx.outputFormat ?? "table") === "table") {
+            const wsUuid = result2?.uuid ?? "<workspace-uuid>";
+            process.stdout.write(
+              `
+Provisioning started. Watch it come up with:
+  gr workspaces get -w ${wsUuid}
+`
+            );
+          }
         } catch (err) {
           const statusCode = err?.statusCode;
-          if (statusCode === 405) {
+          if (statusCode === 400) {
             throw new CLIError(
-              'Creating a workspace directly is not supported \u2014 provisioning runs through the concierge (it handles product selection and billing).\nNext: gr concierge chat --allow-write --message "Create a new workspace"\nThen: gr workspaces list  (to get the new workspace UUID for -w)'
+              "Could not create the workspace. The organization needs an active, paid subscription first.\n  gr billing products --type org      # pick an org plan\n  gr billing checkout --product <id>  # pay up front\n  gr billing status                   # confirm it is active"
             );
           }
           throw err;
@@ -3421,7 +3147,7 @@ var MESSAGE_COLUMNS4 = [
   COL.created()
 ];
 var TASK_COLUMNS = [COL.id(), COL.name(), COL.status()];
-var TOOL_COLUMNS = [
+var TOOL_COLUMNS2 = [
   COL.name(),
   { header: "DESCRIPTION", getValue: (item) => (item.description ?? "").slice(0, 60) }
 ];
@@ -3529,7 +3255,7 @@ var assignmentsDomain = {
           requireNumber(args, "assignment-id")
         );
         const tools = result2.tools ?? result2;
-        outputData(Array.isArray(tools) ? tools : [tools], ctx, TOOL_COLUMNS);
+        outputData(Array.isArray(tools) ? tools : [tools], ctx, TOOL_COLUMNS2);
       }
     }
   ]
@@ -3975,35 +3701,24 @@ Common optional
 Scope (set exactly one when objectType requires it)
   routineId, workflowId, taskId, dataTypeId, journeyStepId, calendarId, ...
 
-chat:create actionParams (outbound voice/SMS)
-  {"workflowId":<id>,"channel":"phone-voice"|"phone-sms","phoneNumberId":<id>,
-   "inboxId":<optional>,"assistantEnabled":<bool>}
+chat:create actionParams (outbound voice/SMS \u2014 starts a workflow chat)
+  {"workflowUUID":"<workflow-uuid>","channel":"phone-voice"|"phone-sms",
+   "phoneNumberUUID":"<uuid>","inboxUUID":"<optional-uuid>","assistantEnabled":<bool>}
+  Keys are UUID strings: workflowUUID (not workflowId), phoneNumberUUID (not
+  phoneNumberId), inboxUUID (not inboxId). Unknown keys are rejected.
+
+sms:send actionParams (send an SMS, or start an SMS workflow chat)
+  One-off text:  {"phoneNumberUUID":"<from-number-uuid>","messageTemplate":"Hi {{name}} \u2026"}
+  Workflow chat: {"phoneNumberUUID":"<from-number-uuid>","workflowUUID":"<workflow-uuid>",
+                  "initialUserMessage":"<optional seed>"}
+  phoneNumberUUID (the from-number) is required. The message body is messageTemplate
+  (supports {{record/member}} template vars) \u2014 there is no "body"/"message" key.
+  Provide messageTemplate for a one-off text, OR workflowUUID to start a chat.
 
 member:label actionParams
   {"addLabelIds":["<uuid>"],"removeLabelIds":["<uuid>"]}
 `;
 
-// src/lib/routines/field-help.ts
-var ROUTINE_FIELD_REFERENCE = `
-Field reference for --data JSON (create/update):
-
-Core
-  name (string)                         Display name
-  workflowId (number)                   Workflow run when the routine fires
-  targetMemberId (number)               Member who receives the scheduled outreach
-
-Schedule
-  scheduleEnabled (bool)                Master on/off for the cron trigger
-  scheduleMode (string)                 "CRON" (only mode today)
-  cronString (string)                   Standard cron, e.g. "0 7 * * *"
-  timezone (string, optional)           IANA name, e.g. "America/Los_Angeles"
-                                        Defaults to workspace timezone, else UTC
-
-Visibility / lifecycle
-  archived (bool)                       Archive flag on update
-  event rules                           Use gr events rules create \u2014 not inline here
-`;
-
 // src/domains/events.ts
 var RULE_COLUMNS = [
   COL.id(),
@@ -4011,15 +3726,6 @@ var RULE_COLUMNS = [
   { header: "EVENT", getValue: (item) => item.eventType ?? "" },
   { header: "ACTIVE", getValue: (item) => String(item.active ?? "") }
 ];
-var ROUTINE_COLUMNS = [
-  COL.id(),
-  COL.name(),
-  { header: "MODE", getValue: (item) => item.scheduleMode ?? "" },
-  { header: "CRON", getValue: (item) => item.cronString ?? "" },
-  { header: "TZ", getValue: (item) => item.timezone ?? "UTC" },
-  { header: "ENABLED", getValue: (item) => String(item.scheduleEnabled ?? "") },
-  { header: "NEXT RUN", getValue: (item) => item.nextRun ?? "" }
-];
 var eventRulesCrudNoList = crudCommands({
   prefix: ["events", "rules"],
   entityName: "event rule",
@@ -4043,8 +3749,8 @@ ${EVENT_RULE_FIELD_REFERENCE}`,
     `gr events rules create -w $WID --allow-write --data '{"name":"AM voice check-in",`,
     '  "objectType":"routine","eventType":"routine:triggered","actionType":"chat:create",',
     '  "routineId":<routine-id>,',
-    '  "actionParams":{"workflowId":<workflow-id>,"channel":"phone-voice",',
-    `  "phoneNumberId":<workspace-phone-id>}}'`,
+    '  "actionParams":{"workflowUUID":"<workflow-uuid>","channel":"phone-voice",',
+    `  "phoneNumberUUID":"<workspace-phone-uuid>"}}'`,
     "",
     '  PM SMS variant: use "channel":"phone-sms" and a second rule on the same routineId.',
     "  Prereq: org phone assigned + gr phone-numbers link; workflow published with start task.",
@@ -4182,77 +3888,9 @@ var eventsDomain = {
         const result2 = await requireAuth(ctx).apiClient.searchEventRules(workspace, opts);
         outputData(result2, ctx, RULE_COLUMNS);
       }
-    },
-    // Routines
-    ...crudCommands({
-      prefix: ["routines"],
-      entityName: "routine",
-      listMethod: "getRoutines",
-      getMethod: "getRoutine",
-      createMethod: "createRoutine",
-      updateMethod: "updateRoutine",
-      deleteMethod: "deleteRoutine",
-      paginationSupport: "full",
-      columns: ROUTINE_COLUMNS,
-      createHelp: `Create a routine
-
-${ROUTINE_FIELD_REFERENCE}`,
-      updateHelp: `Update a routine
-
-${ROUTINE_FIELD_REFERENCE}`,
-      createExamples: [
-        "Daily 7am check-in in the member\u2019s timezone (cron is interpreted in `timezone`):",
-        `gr routines create -w $WID --allow-write --data '{"name":"AM check-in",`,
-        '  "scheduleEnabled":true,"scheduleMode":"CRON","cronString":"0 7 * * *",',
-        `  "timezone":"America/Los_Angeles","targetMemberId":1,"workflowId":2}'`,
-        "  (timezone is an IANA name; omit it to default to the workspace timezone, else UTC.",
-        '   Without it, "0 7 * * *" fires at 07:00 UTC, not 7am local.)'
-      ]
-    }),
-    {
-      path: ["routines", "run"],
-      description: "Run a routine now",
-      mutates: true,
-      requiresWorkspace: true,
-      args: [{ name: "id", description: "Routine ID", required: true }],
-      handler: async ({ ctx, workspace, args, data }) => {
-        const result2 = await requireAuth(ctx).apiClient.runRoutine(
-          workspace,
-          requireNumber(args, "id"),
-          data ?? {}
-        );
-        outputSingle(result2, ctx);
-      }
-    },
-    {
-      path: ["routines", "runs", "list"],
-      description: "List runs for a routine",
-      requiresWorkspace: true,
-      args: [
-        {
-          name: "id",
-          description: "Routine ID (aligns with routines get/run/update/delete)"
-        },
-        { name: "status", description: "Filter by run status" },
-        { name: "page", description: "Page number (1-indexed)" },
-        { name: "page-size", description: "Page size (max 100)" }
-      ],
-      handler: async ({ ctx, workspace, args }) => {
-        const routineId = args.id ? requireNumber(args, "id") : void 0;
-        const page = args.page ? requireNumber(args, "page") : void 0;
-        const pageSize = args["page-size"] ? requireNumber(args, "page-size") : void 0;
-        const status = args.status ?? void 0;
-        const result2 = await requireAuth(ctx).apiClient.getRoutineRuns(workspace, {
-          ...routineId !== void 0 ? { routineId } : {},
-          ...page !== void 0 ? { page } : {},
-          ...pageSize !== void 0 ? { pageSize } : {},
-          ...status ? { status } : {}
-        });
-        outputData(result2, ctx);
-      }
-    }
-  ]
-};
+    }
+  ]
+};
 
 // src/domains/experiments.ts
 var EXPERIMENT_COLUMNS = [
@@ -5866,6 +5504,178 @@ var sitesDomain = {
   ]
 };
 
+// src/domains/abilities.ts
+import { randomUUID } from "crypto";
+var ATTACHED_COLUMNS = [
+  { header: "UUID", getValue: (item) => item.uuid ?? "" },
+  { header: "TYPE", getValue: (item) => item.abilityType ?? "" },
+  { header: "ENABLED", getValue: (item) => item.enabled === false ? "" : "yes" },
+  { header: "CEL", getValue: (item) => item.celCondition ?? "" }
+];
+function toAbilityData(a) {
+  return {
+    uuid: a.uuid,
+    abilityType: a.abilityType,
+    config: a.config ?? {},
+    enabled: a.enabled ?? true,
+    ...a.celCondition ? { celCondition: a.celCondition } : {}
+  };
+}
+var TYPE_COLUMNS = [
+  { header: "SLUG", getValue: (item) => item.slug ?? "" },
+  { header: "TITLE", getValue: (item) => item.title ?? "" },
+  { header: "CATEGORY", getValue: (item) => item.category ?? "" },
+  {
+    header: "CHANNELS",
+    // null channels means "all channels" — show that explicitly so an empty
+    // cell never reads as "no channels".
+    getValue: (item) => Array.isArray(item.channels) ? item.channels.join(",") : "all"
+  },
+  { header: "SINGLETON", getValue: (item) => item.singleton ? "yes" : "" },
+  { header: "FEATURE-GATE", getValue: (item) => item.requiredFeature ?? "" }
+];
+var abilitiesDomain = {
+  name: "abilities",
+  description: "Inspect ability types and attach/detach them on a task",
+  commands: [
+    {
+      path: ["abilities", "list"],
+      description: "List builtin ability types with their channel constraints and param specs. Table shows SLUG, TITLE, CATEGORY, CHANNELS (all = every channel), SINGLETON, FEATURE-GATE; use -o json for full specs including the params JSON Schema.",
+      requiresWorkspace: true,
+      columns: TYPE_COLUMNS,
+      args: [
+        {
+          name: "include-system",
+          description: "Also list auto-injected system abilities (hidden by default)",
+          isFlag: true
+        }
+      ],
+      handler: async (hctx) => {
+        const includeSystem = hctx.args["include-system"] === true;
+        const result2 = await requireAuth(hctx.ctx).apiClient.getAbilityTypes(
+          hctx.workspace,
+          includeSystem ? { includeSystem: true } : {}
+        );
+        outputData(result2.types ?? [], hctx.ctx, TYPE_COLUMNS);
+      }
+    },
+    {
+      path: ["abilities", "get"],
+      description: "Show the full spec for one ability type: title, description, category, channels, singleton/system flags, required feature, and the JSON Schema of its params model.",
+      requiresWorkspace: true,
+      args: [
+        {
+          name: "name",
+          aliases: ["slug"],
+          description: "Ability type slug (e.g. 'communication:phone_call_tools')",
+          required: true
+        }
+      ],
+      handler: async (hctx) => {
+        const slug = hctx.args.name ?? hctx.args.slug;
+        if (!slug) throw new CLIError("--name is required");
+        const result2 = await requireAuth(hctx.ctx).apiClient.getAbilityType(
+          hctx.workspace,
+          slug
+        );
+        outputSingle(result2, hctx.ctx);
+      }
+    },
+    {
+      path: ["abilities", "attached"],
+      description: "List a task's task-specific abilities (excludes workflow-inherited).",
+      requiresWorkspace: true,
+      columns: ATTACHED_COLUMNS,
+      args: [{ name: "task", description: "Task ID", required: true }],
+      handler: async (hctx) => {
+        const task = await requireAuth(hctx.ctx).apiClient.getTask(
+          hctx.workspace,
+          requireNumber(hctx.args, "task")
+        );
+        outputData(task.abilities ?? [], hctx.ctx, ATTACHED_COLUMNS);
+      }
+    },
+    {
+      path: ["abilities", "attach"],
+      description: "Attach an ability to a task. Reads the task, appends the new ability (generating its uuid), and saves \u2014 so existing abilities aren't lost. Find slugs via 'gr abilities list' and the config schema via 'gr abilities get'.",
+      mutates: true,
+      requiresWorkspace: true,
+      args: [
+        { name: "task", description: "Task ID to attach to", required: true },
+        {
+          name: "type",
+          aliases: ["ability-type", "slug"],
+          description: "Ability type slug, e.g. 'integration:data_access'",
+          required: true
+        },
+        {
+          name: "config",
+          description: `Ability config as a JSON object, e.g. '{"pauseOnEscalate":true}'`
+        },
+        { name: "cel", description: "Optional CEL activation condition" },
+        {
+          name: "disabled",
+          description: "Attach in a disabled state (default: enabled)",
+          isFlag: true
+        }
+      ],
+      handler: async (hctx) => {
+        const api = requireAuth(hctx.ctx).apiClient;
+        const taskId = requireNumber(hctx.args, "task");
+        const abilityType = hctx.args.type ?? hctx.args["ability-type"] ?? hctx.args.slug;
+        if (!abilityType) throw new CLIError("--type is required (an ability type slug)");
+        let config = {};
+        if (hctx.args.config) {
+          try {
+            config = JSON.parse(hctx.args.config);
+          } catch {
+            throw new CLIError("--config must be a valid JSON object");
+          }
+        }
+        const task = await api.getTask(hctx.workspace, taskId);
+        const existing = (task.abilities ?? []).map(toAbilityData);
+        const next = {
+          uuid: randomUUID(),
+          abilityType,
+          config,
+          enabled: hctx.args.disabled !== true,
+          ...hctx.args.cel ? { celCondition: hctx.args.cel } : {}
+        };
+        const updated = await api.updateTask(hctx.workspace, taskId, {
+          abilities: [...existing, next]
+        });
+        outputData(updated.abilities ?? [], hctx.ctx, ATTACHED_COLUMNS);
+      }
+    },
+    {
+      path: ["abilities", "detach"],
+      description: "Detach an ability from a task by its uuid (from `gr abilities attached`). Re-saves the remaining task-specific abilities so the rest are preserved.",
+      mutates: true,
+      requiresWorkspace: true,
+      args: [
+        { name: "task", description: "Task ID", required: true },
+        { name: "uuid", description: "UUID of the attached ability to remove", required: true }
+      ],
+      handler: async (hctx) => {
+        const api = requireAuth(hctx.ctx).apiClient;
+        const taskId = requireNumber(hctx.args, "task");
+        const uuid = hctx.args.uuid;
+        if (!uuid) throw new CLIError("--uuid is required");
+        const task = await api.getTask(hctx.workspace, taskId);
+        const existing = task.abilities ?? [];
+        const remaining = existing.filter((a) => a.uuid !== uuid).map(toAbilityData);
+        if (remaining.length === existing.length) {
+          throw new CLIError(`No attached ability with uuid '${uuid}' on task ${taskId}`);
+        }
+        const updated = await api.updateTask(hctx.workspace, taskId, {
+          abilities: remaining
+        });
+        outputData(updated.abilities ?? [], hctx.ctx, ATTACHED_COLUMNS);
+      }
+    }
+  ]
+};
+
 // src/domains/access-grants.ts
 var COLUMNS14 = [
   COL.id(),
@@ -5938,6 +5748,7 @@ var accessGrantsDomain = {
     {
       path: ["access-grants", "resolve"],
       description: "Resolve an access grant",
+      mutates: true,
       requiresWorkspace: true,
       args: [{ name: "id", description: "Access grant ID", required: true }],
       handler: async ({ ctx, workspace, args, data }) => {
@@ -6386,6 +6197,149 @@ var authManageDomain = {
   ]
 };
 
+// src/domains/billing.ts
+function priceSummary(product) {
+  const plans = product.plans ?? {};
+  const abbr = { month: "mo", year: "yr", quarter: "qtr" };
+  const parts = [];
+  for (const [period, plan] of Object.entries(plans)) {
+    const cents = plan?.costPerPeriod ?? 0;
+    if (!plan?.stripePriceId) continue;
+    parts.push(`$${(cents / 100).toFixed(0)}/${abbr[period] ?? period}`);
+  }
+  return parts.join(", ") || "\u2014";
+}
+var PRODUCT_COLUMNS2 = [
+  { header: "ID", getValue: (p) => String(p.id ?? "") },
+  { header: "NAME", getValue: (p) => p.name ?? "" },
+  { header: "TYPE", getValue: (p) => String(p.productType ?? "") },
+  { header: "PRICE", getValue: (p) => priceSummary(p) },
+  {
+    header: "TRIAL",
+    getValue: (p) => {
+      const days = p.trialPeriodDays ?? 0;
+      return days > 0 ? `${days}d` : "\u2014";
+    }
+  }
+];
+var SUBSCRIPTION_COLUMNS = [
+  COL.id(),
+  COL.status(),
+  { header: "PLAN", getValue: (s) => String(s.plan_name ?? s.productName ?? s.plan ?? "") },
+  { header: "PERIOD", getValue: (s) => String(s.planPeriod ?? s.plan_period ?? "") },
+  {
+    header: "ORG",
+    getValue: (s) => String(s.organizationUuid ?? s.customerOrganizationUuid ?? "")
+  }
+];
+function isTable(ctx) {
+  return (ctx.outputFormat ?? "table") === "table";
+}
+function hint(ctx, lines) {
+  if (!isTable(ctx)) return;
+  process.stdout.write("\n" + lines.join("\n") + "\n");
+}
+function productType(args) {
+  const t = args.type ?? args["product-type"];
+  if (t === "org" || t === "workspace") return t;
+  return void 0;
+}
+var billingDomain = {
+  name: "billing",
+  description: "Browse plans, start checkout, and check subscription status",
+  commands: [
+    {
+      path: ["billing", "products"],
+      description: "List self-service plans you can purchase",
+      requiresWorkspace: false,
+      args: [
+        {
+          name: "type",
+          description: "Filter by plan type: 'org' or 'workspace'"
+        }
+      ],
+      examples: ["gr billing products --type org"],
+      handler: async ({ ctx, args }) => {
+        const products = await requireAuth(ctx).apiClient.listSelfServeProducts(
+          productType(args)
+        );
+        outputData(products, ctx, PRODUCT_COLUMNS2);
+        if (products.length === 0) {
+          hint(ctx, ["No purchasable plans found. (Free plans are not sold via the CLI.)"]);
+        } else {
+          hint(ctx, [
+            "Next \u2014 buy an organization plan to get started:",
+            "  gr billing checkout --product <id> [--period month|year]"
+          ]);
+        }
+      }
+    },
+    {
+      path: ["billing", "checkout"],
+      description: "Get a Stripe payment link to purchase an organization plan",
+      mutates: true,
+      requiresWorkspace: false,
+      args: [
+        { name: "product", description: "Product ID of the org plan to buy", required: true },
+        { name: "period", description: "Billing period: 'month' or 'year'", default: "month" }
+      ],
+      examples: ["gr billing checkout --product 12 --period month"],
+      handler: async ({ ctx, args }) => {
+        const productId = Number(requireString(args, "product"));
+        const period = args.period || "month";
+        const result2 = await requireAuth(ctx).apiClient.createCheckoutSession(
+          productId,
+          period
+        );
+        if (isTable(ctx)) {
+          process.stdout.write(
+            `
+\u{1F4B3}  Open this link in a browser to complete payment:
+
+    ${result2.checkoutUrl}
+
+Once payment succeeds, your organization and subscription are created automatically.
+Then check it landed:
+  gr billing status
+`
+          );
+        } else {
+          outputSingle(result2, ctx);
+        }
+      }
+    },
+    {
+      path: ["billing", "status"],
+      description: "Show your subscriptions and what to do next",
+      requiresWorkspace: false,
+      examples: ["gr billing status"],
+      handler: async ({ ctx }) => {
+        const subs = await requireAuth(ctx).apiClient.getSubscriptions();
+        outputData(subs, ctx, SUBSCRIPTION_COLUMNS);
+        const active = subs.find(
+          (s) => ["active", "trialing"].includes(String(s.status ?? s.subscriptionStatus ?? ""))
+        );
+        if (!active) {
+          hint(ctx, [
+            "No active subscription yet. To get started:",
+            "  gr billing products --type org        # pick a plan",
+            "  gr billing checkout --product <id>    # pay up front"
+          ]);
+          return;
+        }
+        const orgUuid = String(
+          active.organizationUuid ?? active.customerOrganizationUuid ?? "<org-uuid>"
+        );
+        hint(ctx, [
+          "You have an active subscription. Add a workspace:",
+          "  gr billing products --type workspace                       # pick a workspace plan",
+          `  gr workspaces create --org ${orgUuid} --product <id> --name "My Workspace"`
+        ]);
+      }
+    }
+  ]
+};
+
 // src/domains/billing-portal.ts
 var INVOICE_COLUMNS = [
   { header: "ID", getValue: (i) => String(i.id) },
@@ -6485,119 +6439,6 @@ var billingPortalDomain = {
   commands
 };
 
-// src/lib/concierge-api.ts
-function baseUrl2(ctx) {
-  return `${ctx.envConfig.apiUrl}/api/v2/concierge`;
-}
-function authHeaders(ctx) {
-  return {
-    Authorization: `Bearer ${ctx.accessToken}`,
-    "Content-Type": "application/json"
-  };
-}
-function toCamelChat(raw) {
-  return {
-    id: raw.id,
-    uuid: raw.uuid,
-    chatType: raw.chat_type,
-    title: raw.title,
-    threadId: raw.thread_id,
-    createdAt: raw.created_at,
-    updatedAt: raw.updated_at
-  };
-}
-function toCamelMessage(raw) {
-  return {
-    id: raw.id,
-    role: raw.role,
-    content: raw.content ?? "",
-    createdAt: raw.createdAt ?? raw.created_at ?? null,
-    toolCalls: raw.toolCalls ?? raw.tool_calls ?? null,
-    toolCallId: raw.toolCallId ?? raw.tool_call_id ?? null
-  };
-}
-async function listConciergeChats(ctx) {
-  const res = await fetch(`${baseUrl2(ctx)}/chats`, { headers: authHeaders(ctx) });
-  if (!res.ok) throw new Error(`Failed to list concierge chats: ${res.status}`);
-  const data = await res.json();
-  return data.map(toCamelChat);
-}
-async function createConciergeChat(ctx, title) {
-  const res = await fetch(`${baseUrl2(ctx)}/chats`, {
-    method: "POST",
-    headers: authHeaders(ctx),
-    body: JSON.stringify({ title: title ?? null })
-  });
-  if (!res.ok) throw new Error(`Failed to create concierge chat: ${res.status}`);
-  return toCamelChat(await res.json());
-}
-async function getConciergeChat(ctx, chatId) {
-  const res = await fetch(`${baseUrl2(ctx)}/chats/${chatId}`, { headers: authHeaders(ctx) });
-  if (!res.ok) throw new Error(`Failed to get concierge chat ${chatId}: ${res.status}`);
-  return toCamelChat(await res.json());
-}
-async function originateConciergeCall(ctx, kind = "concierge_setup") {
-  const res = await fetch(`${baseUrl2(ctx)}/calls`, {
-    method: "POST",
-    headers: authHeaders(ctx),
-    body: JSON.stringify({ kind })
-  });
-  if (res.status === 412) {
-    throw new Error("Your account phone is not verified. Run `gr account verify-phone` first.");
-  }
-  if (!res.ok) {
-    const detail = await res.text();
-    throw new Error(`Failed to start concierge call: ${res.status} ${detail}`);
-  }
-  return await res.json();
-}
-async function originateConciergeSms(ctx, kind = "concierge_setup") {
-  const res = await fetch(`${baseUrl2(ctx)}/sms`, {
-    method: "POST",
-    headers: authHeaders(ctx),
-    body: JSON.stringify({ kind })
-  });
-  if (res.status === 412) {
-    throw new Error("Your account phone is not verified. Run `gr account verify-phone` first.");
-  }
-  if (!res.ok) {
-    const detail = await res.text();
-    throw new Error(`Failed to start concierge SMS: ${res.status} ${detail}`);
-  }
-  return await res.json();
-}
-async function startAccountPhoneVerify(ctx, phone) {
-  const res = await fetch(`${ctx.envConfig.apiUrl}/api/v2/account/phone/verify/start`, {
-    method: "POST",
-    headers: authHeaders(ctx),
-    body: JSON.stringify({ phone })
-  });
-  if (!res.ok) {
-    const detail = await res.text();
-    throw new Error(`Failed to send verification code: ${res.status} ${detail}`);
-  }
-}
-async function confirmAccountPhoneVerify(ctx, code) {
-  const res = await fetch(`${ctx.envConfig.apiUrl}/api/v2/account/phone/verify/confirm`, {
-    method: "POST",
-    headers: authHeaders(ctx),
-    body: JSON.stringify({ code })
-  });
-  if (!res.ok) {
-    const detail = await res.text();
-    throw new Error(`Failed to confirm verification code: ${res.status} ${detail}`);
-  }
-}
-async function getConciergeChatMessages(ctx, chatId) {
-  const res = await fetch(`${baseUrl2(ctx)}/chats/${chatId}/messages`, {
-    headers: authHeaders(ctx)
-  });
-  if (!res.ok)
-    throw new Error(`Failed to get concierge messages for chat ${chatId}: ${res.status}`);
-  const data = await res.json();
-  return data.map(toCamelMessage);
-}
-
 // src/domains/concierge.ts
 var CHAT_COLUMNS = [
   COL.id(),
@@ -6642,7 +6483,7 @@ var conciergeDomain = {
 
 // src/domains/custom-toolkits.ts
 var COLUMNS17 = [COL.id(), COL.name(), COL.description(), COL.enabled()];
-var TOOL_COLUMNS2 = [COL.id(), COL.name(), COL.description()];
+var TOOL_COLUMNS3 = [COL.id(), COL.name(), COL.description()];
 var customToolkitsDomain = {
   name: "custom-toolkits",
   description: "Manage custom toolkits and their tools",
@@ -6700,7 +6541,7 @@ var customToolkitsDomain = {
           toolkitId,
           data
         );
-        outputSingle(result2, ctx, TOOL_COLUMNS2);
+        outputSingle(result2, ctx, TOOL_COLUMNS3);
       }
     },
     {
@@ -6722,7 +6563,7 @@ var customToolkitsDomain = {
           toolId,
           data
         );
-        outputSingle(result2, ctx, TOOL_COLUMNS2);
+        outputSingle(result2, ctx, TOOL_COLUMNS3);
       }
     },
     {
@@ -7935,6 +7776,50 @@ function parseCallerRole(value) {
   }
   return VALID_CALLER_ROLES.has(value) ? value : void 0;
 }
+var PERMISSION_USE = 1;
+function evaluateWorkflowMemberRoleAccess(memberRoleId, memberRoleAccess) {
+  if (memberRoleAccess === void 0) {
+    return { outcome: "skip", detail: "workflow memberRoleAccess not available" };
+  }
+  if (memberRoleAccess.length === 0) {
+    return { outcome: "allow", detail: "no workflow role restrictions configured" };
+  }
+  if (memberRoleId === void 0) {
+    return {
+      outcome: "skip",
+      detail: "caller member role unknown \u2014 cannot evaluate role gate"
+    };
+  }
+  const hasUse = memberRoleAccess.some(
+    (entry) => entry.memberRoleId === memberRoleId && (entry.accessMode & PERMISSION_USE) === PERMISSION_USE
+  );
+  if (hasUse) {
+    return { outcome: "allow", detail: `memberRoleId=${memberRoleId} has USE on workflow` };
+  }
+  return {
+    outcome: "deny",
+    detail: `memberRoleId=${memberRoleId} lacks USE in workflow memberRoleAccess`
+  };
+}
+function parseWorkflowMemberRoleAccess(workflow) {
+  const raw = workflow.memberRoleAccess;
+  if (!Array.isArray(raw)) {
+    return [];
+  }
+  const entries = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object") {
+      continue;
+    }
+    const row = item;
+    const memberRoleId = typeof row.memberRoleId === "number" ? row.memberRoleId : Number(row.memberRoleId);
+    const accessMode = typeof row.accessMode === "number" ? row.accessMode : Number(row.accessMode);
+    if (Number.isFinite(memberRoleId) && Number.isFinite(accessMode)) {
+      entries.push({ memberRoleId, accessMode });
+    }
+  }
+  return entries;
+}
 function inferCallerRole(phone, opts) {
   if (opts.asRole) {
     return opts.asRole;
@@ -8061,6 +7946,32 @@ function simulateInboundRouting(phone, opts = {}) {
     return finish("no_inbound_workflow", false, true, steps, recommendations, callerRole);
   }
   steps.push({ step: "inbound_workflow", outcome: "ok", detail: `workflowId=${workflowId}` });
+  const callerMemberRoleId = callerRole === "member" ? opts.matchedMemberRoleId : callerRole === "anonymous" ? phone.anonymousMemberRoleId ?? void 0 : void 0;
+  const roleAccess = evaluateWorkflowMemberRoleAccess(
+    callerMemberRoleId,
+    opts.workflowMemberRoleAccess
+  );
+  if (roleAccess.outcome === "deny") {
+    steps.push({
+      step: "workflow_member_role_access",
+      outcome: "reject",
+      detail: roleAccess.detail
+    });
+    recommendations.push(
+      "Grant the caller's member role USE access on the inbound workflow (workflow memberRoleAccess or `gr member-roles update` workflowAccess)"
+    );
+    return finish("workflow_member_role_denied", false, true, steps, recommendations, callerRole);
+  }
+  steps.push({
+    step: "workflow_member_role_access",
+    outcome: roleAccess.outcome === "skip" ? "skipped" : "ok",
+    detail: roleAccess.detail
+  });
+  if (roleAccess.outcome === "skip" && callerMemberRoleId === void 0 && opts.workflowMemberRoleAccess !== void 0 && opts.workflowMemberRoleAccess.length > 0) {
+    recommendations.push(
+      "Workflow has member role restrictions but caller memberRoleId was not resolved \u2014 re-run with --as +E.164 (caller phone) so the role gate can be evaluated against real data"
+    );
+  }
   steps.push({ step: "chat_create", outcome: "create_phone_voice_chat" });
   steps.push({ step: "assistant", outcome: "connect_media_stream" });
   return finish("ai_voice_chat", true, true, steps, recommendations, callerRole);
@@ -8077,6 +7988,7 @@ function finish(code, createsChat, createsPhoneCall, steps, recommendations, cal
     voicemail_record: "Record voicemail",
     play_message_hangup: "Play off-hours message, hang up",
     no_inbound_workflow: "Play unavailable message (no inbound workflow)",
+    workflow_member_role_denied: "Reject \u2014 caller member role lacks workflow USE (memberRoleAccess)",
     ai_voice_chat: "Create chat + connect AI voice"
   };
   return {
@@ -8128,9 +8040,22 @@ function formatPhoneNumberBehaviorMatrix(phone, outboundUsers, warnings = collec
   lines.push(`UUID: ${phone.uuid}  |  Mapped: ${phone.isMapped ? "yes" : "no"}`);
   lines.push("");
   lines.push("## Channels");
-  lines.push(`  Voice: ${phone.enableVoice ? "on" : "off"}  SMS: ${phone.enableSms ? "on" : "off"}  WhatsApp: ${phone.enableWhatsApp ? "on" : "off"}`);
+  lines.push(
+    `  Voice: ${phone.enableVoice ? "on" : "off"}  SMS: ${phone.enableSms ? "on" : "off"}  WhatsApp: ${phone.enableWhatsApp ? "on" : "off"}`
+  );
   lines.push(`  Assistant: ${phone.assistantEnabled ? "on" : "off"}`);
   lines.push("");
+  if (phone.enableVoice) {
+    lines.push("## Channel defaults (auto-injected on voice)");
+    lines.push(
+      "  Voice channels auto-add the hang_up_call tool (system:voice_channel);"
+    );
+    lines.push(
+      "  it is not listed by `gr agents abilities list`. See `gr abilities get"
+    );
+    lines.push("  --name communication:phone_call_tools` for the voice ability spec.");
+    lines.push("");
+  }
   lines.push("## Inbound route");
   lines.push(
     `  defaultWorkflowId (inbound): ${phone.defaultWorkflowId ?? "null"}  restartDelay: ${phone.restartDelay ?? "null"}s`
@@ -8211,9 +8136,7 @@ async function findOutboundPhoneUsers(client, workspace, phone) {
     }
     page += 1;
     if (page > 50) {
-      process.stderr.write(
-        "Warning: event-rules lookup truncated at 5000 results (50 pages)\n"
-      );
+      process.stderr.write("Warning: event-rules lookup truncated at 5000 results (50 pages)\n");
       break;
     }
   }
@@ -10488,7 +10411,9 @@ function normalizeCallerE164(phone) {
 var MEMBER_SEARCH_PAGE_SIZE = 100;
 async function resolveMemberByCallerPhone(client, workspace, callerE164) {
   const normalized = normalizeCallerE164(callerE164);
-  const candidates = [normalized, callerE164.trim()].filter(
+  const digits = callerE164.replace(/\D/g, "");
+  const nsn = digits.length === 11 && digits.startsWith("1") ? digits.slice(1) : digits;
+  const candidates = [normalized, callerE164.trim(), digits, nsn].filter(
     (v, i, arr) => Boolean(v) && arr.indexOf(v) === i
   );
   const matchInRows = (rows) => {
@@ -10533,6 +10458,25 @@ async function resolveMemberByCallerPhone(client, workspace, callerE164) {
   return void 0;
 }
 
+// src/lib/phone-numbers/workflow-role-access.ts
+async function loadInboundWorkflowMemberRoleAccess(client, workspace, defaultWorkflowId) {
+  const workflowId = typeof defaultWorkflowId === "number" ? defaultWorkflowId : defaultWorkflowId === null || defaultWorkflowId === void 0 ? void 0 : Number(defaultWorkflowId);
+  if (workflowId === void 0 || !Number.isFinite(workflowId)) {
+    return void 0;
+  }
+  try {
+    const workflow = await client.getWorkflow(workspace, workflowId);
+    return parseWorkflowMemberRoleAccess(workflow);
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    process.stderr.write(
+      `[diagnose] Could not fetch workflow ${workflowId} memberRoleAccess \u2014 role gate will be skipped (${reason})
+`
+    );
+    return void 0;
+  }
+}
+
 // src/domains/phone-numbers.ts
 function asPhoneRecord(value) {
   return value;
@@ -10591,9 +10535,8 @@ var phoneNumbersDomain = {
         const client = requireAuth(ctx).apiClient;
         const id = requireNumber(args, "id");
         const phone = asPhoneRecord(await client.getPhoneNumber(workspace, id));
-        if (args.raw) {
-          process.stdout.write(`${JSON.stringify(phone, null, 2)}
-`);
+        if (args.raw || ctx.outputFormat !== "table") {
+          outputSingle(phone, ctx);
           return;
         }
         const outboundUsers = await findOutboundPhoneUsers(client, workspace, phone);
@@ -10767,21 +10710,34 @@ Setup complete: id=${phone.id} uuid=${phone.uuid}
         const asRole = parseCallerRole(args["as-role"]);
         let hasMemberMatch = asRole === "member";
         let matchedMemberId;
+        let matchedMemberRoleId;
         let matchedMemberPhoneType;
         if (!asRole && typeof args.as === "string") {
           const match = await resolveMemberByCallerPhone(client, workspace, args.as);
           if (match) {
             hasMemberMatch = true;
             matchedMemberId = match.memberId;
+            matchedMemberRoleId = match.memberRoleId;
             matchedMemberPhoneType = match.phoneType;
           }
         }
+        const workflowMemberRoleAccess = await loadInboundWorkflowMemberRoleAccess(
+          client,
+          workspace,
+          phone.defaultWorkflowId
+        );
         const sim = simulateInboundRouting(phone, {
           asRole,
           hasMemberMatch,
           matchedMemberId,
-          matchedMemberPhoneType
+          matchedMemberRoleId,
+          matchedMemberPhoneType,
+          workflowMemberRoleAccess
         });
+        if (ctx.outputFormat !== "table") {
+          outputSingle({ phoneNumberId: id, simulation: sim }, ctx);
+          return;
+        }
         process.stdout.write(`${formatRoutingSimulation(sim, phone)}
 `);
       }
@@ -10803,10 +10759,28 @@ Setup complete: id=${phone.id} uuid=${phone.uuid}
         const id = requireNumber(args, "id");
         const role = requireCallerRole(args, "as-role");
         const phone = asPhoneRecord(await client.getPhoneNumber(workspace, id));
+        const workflowMemberRoleAccess = await loadInboundWorkflowMemberRoleAccess(
+          client,
+          workspace,
+          phone.defaultWorkflowId
+        );
         const sim = simulateInboundRouting(phone, {
           asRole: role,
-          hasMemberMatch: role === "member"
+          hasMemberMatch: role === "member",
+          workflowMemberRoleAccess
         });
+        if (ctx.outputFormat !== "table") {
+          outputSingle(
+            {
+              phoneNumberId: id,
+              callerRole: role,
+              finalBehavior: sim.finalBehavior,
+              simulation: sim
+            },
+            ctx
+          );
+          return;
+        }
         process.stdout.write(
           `If a caller in role "${role}" dials this line right now:
   \u2192 ${sim.finalBehavior}
@@ -10832,17 +10806,26 @@ ${formatRoutingSimulation(sim, phone)}
         const asRole = parseCallerRole(args["as-role"]);
         let hasMemberMatch = asRole === "member";
         let matchedMemberId;
+        let matchedMemberRoleId;
         if (!asRole && typeof args.as === "string") {
           const match = await resolveMemberByCallerPhone(client, workspace, args.as);
           if (match) {
             hasMemberMatch = true;
             matchedMemberId = match.memberId;
+            matchedMemberRoleId = match.memberRoleId;
           }
         }
+        const workflowMemberRoleAccess = await loadInboundWorkflowMemberRoleAccess(
+          client,
+          workspace,
+          phone.defaultWorkflowId
+        );
         const sim = simulateInboundRouting(phone, {
           asRole,
           hasMemberMatch,
-          matchedMemberId
+          matchedMemberId,
+          matchedMemberRoleId,
+          workflowMemberRoleAccess
         });
         process.stdout.write(
           `${JSON.stringify({ phoneNumberId: id, simulation: sim }, null, 2)}
@@ -10886,11 +10869,15 @@ ${formatRoutingSimulation(sim, phone)}
           { inbound: true }
         );
         const inbound = result2.items ?? [];
-        process.stdout.write(`Inbound calls (most recent page): ${inbound.length} shown
+        if (ctx.outputFormat === "table") {
+          process.stdout.write(`Inbound calls (most recent page): ${inbound.length} shown
 `);
-        process.stdout.write(
-          "Tip: gr phone-numbers diagnose --id <id> --as +1\u2026 simulates routing without a live call.\n"
-        );
+          process.stdout.write(
+            "Tip: gr phone-numbers diagnose --id <id> --as +1\u2026 simulates routing without a live call.\n"
+          );
+        } else {
+          stderr(`Inbound calls (most recent page): ${inbound.length} shown`);
+        }
         outputData(inbound, ctx);
       }
     },
@@ -11264,6 +11251,115 @@ var reportsDomain = {
   ]
 };
 
+// src/lib/routines/field-help.ts
+var ROUTINE_FIELD_REFERENCE = `
+Field reference for --data JSON (create/update):
+
+Core
+  name (string)                         Display name
+  workflowId (number)                   Workflow run when the routine fires
+  targetMemberId (number)               Member who receives the scheduled outreach
+
+Schedule
+  scheduleEnabled (bool)                Master on/off for the cron trigger
+  scheduleMode (string)                 "CRON" (only mode today)
+  cronString (string)                   Standard cron, e.g. "0 7 * * *"
+  timezone (string, optional)           IANA name, e.g. "America/Los_Angeles"
+                                        Defaults to workspace timezone, else UTC
+
+Visibility / lifecycle
+  archived (bool)                       Archive flag on update
+  event rules                           Use gr events rules create \u2014 not inline here
+`;
+
+// src/domains/routines.ts
+var ROUTINE_COLUMNS = [
+  COL.id(),
+  COL.name(),
+  { header: "MODE", getValue: (item) => item.scheduleMode ?? "" },
+  { header: "CRON", getValue: (item) => item.cronString ?? "" },
+  { header: "TZ", getValue: (item) => item.timezone ?? "UTC" },
+  { header: "ENABLED", getValue: (item) => String(item.scheduleEnabled ?? "") },
+  { header: "NEXT RUN", getValue: (item) => item.nextRun ?? "" }
+];
+var routinesDomain = {
+  name: "routines",
+  description: "Schedule recurring outbound (e.g. a daily SMS/voice check-in via cron)",
+  commands: [
+    ...crudCommands({
+      prefix: ["routines"],
+      entityName: "routine",
+      listMethod: "getRoutines",
+      getMethod: "getRoutine",
+      createMethod: "createRoutine",
+      updateMethod: "updateRoutine",
+      deleteMethod: "deleteRoutine",
+      paginationSupport: "full",
+      columns: ROUTINE_COLUMNS,
+      createHelp: `Create a routine
+
+${ROUTINE_FIELD_REFERENCE}`,
+      updateHelp: `Update a routine
+
+${ROUTINE_FIELD_REFERENCE}`,
+      createExamples: [
+        "Daily 7am check-in in the member\u2019s timezone (cron is interpreted in `timezone`):",
+        `gr routines create -w $WID --allow-write --data '{"name":"AM check-in",`,
+        '  "scheduleEnabled":true,"scheduleMode":"CRON","cronString":"0 7 * * *",',
+        `  "timezone":"America/Los_Angeles","targetMemberId":1,"workflowId":2}'`,
+        "  (timezone is an IANA name; omit it to default to the workspace timezone, else UTC.",
+        '   Without it, "0 7 * * *" fires at 07:00 UTC, not 7am local.)',
+        "",
+        "To actually send via SMS/voice, pair the routine with an event rule:",
+        '  gr events rules create \u2014 objectType "routine", eventType "routine:triggered",',
+        '  actionType "chat:create". See `gr events --help`.'
+      ]
+    }),
+    {
+      path: ["routines", "run"],
+      description: "Run a routine now",
+      mutates: true,
+      requiresWorkspace: true,
+      args: [{ name: "id", description: "Routine ID", required: true }],
+      handler: async ({ ctx, workspace, args, data }) => {
+        const result2 = await requireAuth(ctx).apiClient.runRoutine(
+          workspace,
+          requireNumber(args, "id"),
+          data ?? {}
+        );
+        outputSingle(result2, ctx);
+      }
+    },
+    {
+      path: ["routines", "runs", "list"],
+      description: "List runs for a routine",
+      requiresWorkspace: true,
+      args: [
+        {
+          name: "id",
+          description: "Routine ID (aligns with routines get/run/update/delete)"
+        },
+        { name: "status", description: "Filter by run status" },
+        { name: "page", description: "Page number (1-indexed)" },
+        { name: "page-size", description: "Page size (max 100)" }
+      ],
+      handler: async ({ ctx, workspace, args }) => {
+        const routineId = args.id ? requireNumber(args, "id") : void 0;
+        const page = args.page ? requireNumber(args, "page") : void 0;
+        const pageSize = args["page-size"] ? requireNumber(args, "page-size") : void 0;
+        const status = args.status ?? void 0;
+        const result2 = await requireAuth(ctx).apiClient.getRoutineRuns(workspace, {
+          ...routineId !== void 0 ? { routineId } : {},
+          ...page !== void 0 ? { page } : {},
+          ...pageSize !== void 0 ? { pageSize } : {},
+          ...status ? { status } : {}
+        });
+        outputData(result2, ctx);
+      }
+    }
+  ]
+};
+
 // src/domains/subscriptions.ts
 var COLUMNS27 = [
   COL.id(),
@@ -13126,11 +13222,13 @@ function registerPublicDomains(registry) {
   registry.register(sitesDomain);
   registry.register(filesDomain);
   registry.register(eventsDomain);
+  registry.register(routinesDomain);
   registry.register(experimentsDomain);
   registry.register(calendarsDomain);
   registry.register(qualificationsDomain);
   registry.register(personasDomain);
   registry.register(journeysDomain);
+  registry.register(abilitiesDomain);
   registry.register(phoneNumbersDomain);
   registry.register(inboxesDomain);
   registry.register(operatorGroupsDomain);
@@ -13143,6 +13241,7 @@ function registerPublicDomains(registry) {
   registry.register(mcpServersDomain);
   registry.register(apiKeysDomain);
   registry.register(subscriptionsDomain);
+  registry.register(billingDomain);
   registry.register(supportDomain);
   registry.register(reportsDomain);
   registry.register(aiModelsDomain);
@@ -13169,7 +13268,7 @@ function registerPublicDomains(registry) {
 }
 
 // src/commands/auth-browser.ts
-import { execFile as execFile2 } from "child_process";
+import { execFile } from "child_process";
 async function authBrowserCommand(ctx, args) {
   const noOpen = Boolean(args["no-open"]);
   const account = await ctx.apiClient.getUserAccount();
@@ -13205,7 +13304,7 @@ function openUrl(url) {
     command = "xdg-open";
     args = [url];
   }
-  execFile2(command, args, (err) => {
+  execFile(command, args, (err) => {
     if (err) {
       process.stderr.write("Warning: Could not open browser automatically\n");
     }
@@ -13418,7 +13517,7 @@ async function resolveDirectoryTrust(opts) {
   return "trusted";
 }
 async function requireDirectoryTrust(opts) {
-  const { CLIError: CLIError2 } = await import("./errors-SMY7LZJB.js");
+  const { CLIError: CLIError2 } = await import("./errors-VK4QO3QZ.js");
   const dir = path3.resolve(opts.trustDir ?? opts.cwd ?? process.cwd());
   const status = await resolveDirectoryTrust(opts);
   if (status === "trusted") return;
@@ -13541,27 +13640,42 @@ async function runConciergeAguiLoop(client, initialMessages, onEvent, opts) {
     if (!hitlPayload) {
       break;
     }
-    const next = await handleCliHitlInterrupt(hitlPayload, {
-      allowWrite: opts.allowWrite,
-      autoApprove: opts.autoApprove,
-      trustCwd: opts.trustCwd,
-      trustDir: opts.trustDir,
-      nonInteractive: opts.nonInteractive
-    });
+    opts.onHitlPromptStart?.();
+    let next;
+    try {
+      next = await handleCliHitlInterrupt(hitlPayload, {
+        allowWrite: opts.allowWrite,
+        autoApprove: opts.autoApprove,
+        trustCwd: opts.trustCwd,
+        trustDir: opts.trustDir,
+        nonInteractive: opts.nonInteractive
+      });
+    } finally {
+      opts.onHitlPromptEnd?.();
+    }
     if (!next) {
       process.stderr.write(
         "  [HITL] Unsupported interrupt in CLI \u2014 open app.gravityrail.com/setup to continue.\n"
       );
-      break;
+      return {
+        streamText,
+        hasToolCalls,
+        unsupportedHitl: normalizeUnsupportedHitl(hitlPayload)
+      };
     }
     resume = next;
     streamText = "";
   }
   return { streamText, hasToolCalls };
 }
-
-// src/lib/chat-session.ts
-import * as readline4 from "readline";
+function normalizeUnsupportedHitl(raw) {
+  const payload = raw && typeof raw === "object" ? raw : {};
+  return {
+    type: typeof payload.type === "string" ? payload.type : void 0,
+    interruptId: typeof payload.interrupt_id === "string" ? payload.interrupt_id : void 0,
+    payload
+  };
+}
 
 // src/lib/realtime-client.ts
 import { EventEmitter } from "events";
@@ -13822,6 +13936,19 @@ function isToolCall(item) {
 function isToolResult(item) {
   return "kind" in item && item.kind === "tool_result";
 }
+function toolResultLooksFailed(content) {
+  const trimmed = content.trim();
+  if (!trimmed) return false;
+  if (/^error[:\s]/i.test(trimmed)) return true;
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (parsed.ok === false) return true;
+    if (typeof parsed.error === "string" && parsed.error.length > 0) return true;
+    if (typeof parsed.status === "string" && parsed.status.toLowerCase() === "error") return true;
+  } catch {
+  }
+  return false;
+}
 function getTruncationLabel(reason, truncatedAtMs) {
   const timeStr = truncatedAtMs ? ` at ${(truncatedAtMs / 1e3).toFixed(1)}s` : "";
   switch (reason) {
@@ -13855,6 +13982,8 @@ var CLEAR_EOL = `${CSI}K`;
 var RESET = `${CSI}0m`;
 var MOUSE_ON = `${CSI}?1000h${CSI}?1006h`;
 var MOUSE_OFF = `${CSI}?1000l${CSI}?1006l`;
+var BRACKETED_PASTE_ON = `${CSI}?2004h`;
+var BRACKETED_PASTE_OFF = `${CSI}?2004l`;
 var BLUE = `${CSI}34m`;
 var GREEN = `${CSI}32m`;
 var GRAY = `${CSI}90m`;
@@ -13863,6 +13992,11 @@ var ORANGE = `${CSI}38;5;208m`;
 var LIGHT_BLUE = `${CSI}38;5;117m`;
 var DIM = `${CSI}2m`;
 var DIM_ITALIC_GRAY = `${CSI}2;3;90m`;
+var RED = `${CSI}31m`;
+var CYAN = `${CSI}36m`;
+var MAX_INPUT_ROWS = 6;
+var INPUT_LABEL = "You: ";
+var INPUT_LABEL_WIDTH = 5;
 function moveTo(row, col) {
   return `${CSI}${row};${col}H`;
 }
@@ -13887,6 +14021,11 @@ var ChatTUI = class {
   // Escape sequence accumulator for raw stdin parsing
   escBuf = "";
   escTimer = null;
+  // Run / inference status (title bar)
+  runState = "idle";
+  activeToolName = "";
+  pausedForPrompt = false;
+  turnInProgress = false;
   constructor(options) {
     this.options = options;
     this.debugPanelVisible = !!options.debug;
@@ -13898,8 +14037,8 @@ var ChatTUI = class {
   // ─── Lifecycle ──────────────────────────────────────────────────────
   start() {
     this.updateDimensions();
-    process.stdout.write(ALT_SCREEN_ON + MOUSE_ON);
-    process.stdout.write(`${CSI}1;${Math.max(1, this.rows - 2)}r`);
+    process.stdout.write(ALT_SCREEN_ON + MOUSE_ON + BRACKETED_PASTE_ON);
+    this.applyScrollRegion();
     process.stdin.setEncoding("utf8");
     if (process.stdin.isTTY) process.stdin.setRawMode(true);
     process.stdin.on("data", this.onData);
@@ -13942,6 +14081,7 @@ var ChatTUI = class {
   streamStart() {
     this.isStreaming = true;
     this.streamContent = "";
+    this.runState = "streaming";
     this.scrollOffset = 0;
     this.dirty();
   }
@@ -13957,8 +14097,42 @@ var ChatTUI = class {
     this.streamContent = "";
     this.dirty();
   }
+  runStarted() {
+    this.turnInProgress = true;
+    this.runState = "thinking";
+    this.activeToolName = "";
+    this.dirty();
+  }
+  runFinished() {
+    this.turnInProgress = false;
+    this.runState = "idle";
+    this.activeToolName = "";
+    this.dirty();
+  }
+  /** Temporarily leave alt-screen for an external prompt (HITL). */
+  pauseForPrompt() {
+    if (!this.started || this.pausedForPrompt) return;
+    this.pausedForPrompt = true;
+    process.stdin.removeListener("data", this.onData);
+    if (process.stdin.isTTY) process.stdin.setRawMode(false);
+    process.stdout.write(
+      `${MOUSE_OFF}${BRACKETED_PASTE_OFF}${CSI}r${ALT_SCREEN_OFF}${SHOW_CURSOR}`
+    );
+  }
+  /** Re-enter alt-screen after an external prompt. */
+  resumeAfterPrompt() {
+    if (!this.started || !this.pausedForPrompt) return;
+    this.pausedForPrompt = false;
+    process.stdout.write(ALT_SCREEN_ON + MOUSE_ON + BRACKETED_PASTE_ON);
+    this.applyScrollRegion();
+    if (process.stdin.isTTY) process.stdin.setRawMode(true);
+    process.stdin.on("data", this.onData);
+    this.render();
+  }
   toolCallStart(id, name) {
     this.items.push({ kind: "tool_call", id, name, args: "", done: false });
+    this.runState = "tool_running";
+    this.activeToolName = name;
     this.dirty();
   }
   toolCallArgs(id, delta) {
@@ -14011,7 +14185,12 @@ var ChatTUI = class {
     this.dirty();
   }
   toolCallResult(toolCallId, toolName, content) {
-    this.items.push({ kind: "tool_result", toolCallId, toolName, content });
+    const failed = toolResultLooksFailed(content);
+    this.items.push({ kind: "tool_result", toolCallId, toolName, content, failed });
+    if (!this.isStreaming) {
+      this.runState = "thinking";
+      this.activeToolName = "";
+    }
     this.dirty();
   }
   /** Find the tool name for a given tool call ID */
@@ -14064,7 +14243,9 @@ var ChatTUI = class {
     this.scheduleRender();
   }
   restoreTerminal = () => {
-    process.stdout.write(`${MOUSE_OFF}${CSI}r${ALT_SCREEN_OFF}${SHOW_CURSOR}`);
+    process.stdout.write(
+      `${MOUSE_OFF}${BRACKETED_PASTE_OFF}${CSI}r${ALT_SCREEN_OFF}${SHOW_CURSOR}`
+    );
   };
   updateDimensions() {
     this.rows = process.stdout.rows || 24;
@@ -14080,11 +14261,32 @@ var ChatTUI = class {
     if (!this.debugVisible) return 0;
     return this.cols - this.chatWidth() - 1;
   }
+  titleRows() {
+    return this.options.title || this.options.subtitle ? 1 : 0;
+  }
+  inputRows() {
+    const lines = this.inputBuffer.split("\n").length;
+    return Math.min(MAX_INPUT_ROWS, Math.max(1, lines));
+  }
+  footerRows() {
+    return 1 + this.inputRows();
+  }
+  messageAreaTop() {
+    return 1 + this.titleRows();
+  }
+  messageAreaBottom() {
+    return this.rows - this.footerRows();
+  }
+  applyScrollRegion() {
+    const top = this.messageAreaTop();
+    const bottom = Math.max(top, this.messageAreaBottom());
+    process.stdout.write(`${CSI}${top};${bottom}r`);
+  }
   scrollHeight() {
-    return Math.max(1, this.rows - 2);
+    return Math.max(1, this.messageAreaBottom() - this.messageAreaTop() + 1);
   }
   pageSize() {
-    return Math.max(1, this.rows - 4);
+    return Math.max(1, this.scrollHeight() - 2);
   }
   // ─── Scroll ───────────────────────────────────────────────────────
   scrollUp(lines) {
@@ -14150,6 +14352,11 @@ var ChatTUI = class {
   }
   /** Handle a parsed CSI sequence: params is everything between \x1B[ and the final char */
   handleCSI(params, code) {
+    if (params === "201~") {
+      this.scrollToBottom();
+      this.dirty();
+      return;
+    }
     if (params.startsWith("<") && (code === "M" || code === "m")) {
       if (code === "m") return;
       const parts = params.slice(1).split(";");
@@ -14231,22 +14438,31 @@ var ChatTUI = class {
       this.handleEnter();
       return;
     }
+    if (code === 10) {
+      this.inputBuffer += "\n";
+      this.dirty();
+      return;
+    }
     if (code === 127 || code === 8) {
       if (this.inputBuffer.length > 0) {
         this.inputBuffer = this.inputBuffer.slice(0, -1);
-        this.renderInputLine();
+        this.dirty();
       }
       return;
     }
     if (code < 32) return;
     this.inputBuffer += ch;
-    this.renderInputLine();
+    this.dirty();
   }
   handleEnter() {
+    if (this.turnInProgress) {
+      this.dirty();
+      return;
+    }
     const text = this.inputBuffer.trim();
     this.inputBuffer = "";
     if (!text) {
-      this.renderInputLine();
+      this.dirty();
       return;
     }
     if (text.toLowerCase() === "exit" || text.toLowerCase() === "quit") {
@@ -14263,7 +14479,7 @@ var ChatTUI = class {
   // ─── Events ───────────────────────────────────────────────────────
   onResize = () => {
     this.updateDimensions();
-    process.stdout.write(`${CSI}1;${Math.max(1, this.rows - 2)}r`);
+    this.applyScrollRegion();
     this.displayLinesCache = null;
     this.debugLinesCache = null;
     this.render();
@@ -14305,19 +14521,24 @@ var ChatTUI = class {
       visible = displayLines.slice(start, end);
     }
     const buf = [HIDE_CURSOR];
+    const msgTop = this.messageAreaTop();
+    if (this.titleRows()) {
+      buf.push(moveTo(1, 1), this.buildTitleBar(), CLEAR_EOL);
+    }
     if (this.debugVisible) {
-      this.renderSplitScreen(buf, visible, sh);
+      this.renderSplitScreen(buf, visible, sh, msgTop);
     } else {
       for (let i = 0; i < sh; i++) {
-        buf.push(moveTo(i + 1, 1), visible[i] || "", CLEAR_EOL);
+        buf.push(moveTo(msgTop + i, 1), visible[i] || "", CLEAR_EOL);
       }
     }
-    buf.push(moveTo(this.rows - 1, 1), this.buildSeparator(), CLEAR_EOL);
-    buf.push(moveTo(this.rows, 1), `${BLUE}You:${RESET} ${this.inputBuffer}${CLEAR_EOL}`);
+    const sepRow = this.rows - this.inputRows();
+    buf.push(moveTo(sepRow, 1), this.buildSeparator(), CLEAR_EOL);
+    this.renderInputArea(buf, sepRow + 1);
     buf.push(SHOW_CURSOR);
     process.stdout.write(buf.join(""));
   }
-  renderSplitScreen(buf, chatVisible, sh) {
+  renderSplitScreen(buf, chatVisible, sh, msgTop = 1) {
     const cw = this.chatWidth();
     const dw = this.debugWidth();
     const divCol = cw + 1;
@@ -14333,21 +14554,70 @@ var ChatTUI = class {
       const chatLine = truncateAnsi(chatVisible[i] || "", cw);
       const debugLine = truncateAnsi(debugVisible[i] || "", dw);
       buf.push(
-        moveTo(i + 1, 1),
+        moveTo(msgTop + i, 1),
         chatLine,
         CLEAR_EOL,
         // clear to end handles rest, but we need to position divider
-        moveTo(i + 1, divCol),
+        moveTo(msgTop + i, divCol),
         `${DIM}\u2502${RESET}`,
         debugLine
       );
       buf.push(CLEAR_EOL);
     }
   }
-  renderInputLine() {
-    process.stdout.write(
-      `${moveTo(this.rows, 1)}${BLUE}You:${RESET} ${this.inputBuffer}${CLEAR_EOL}`
-    );
+  renderInputArea(buf, startRow) {
+    const inputRows = this.inputRows();
+    const width = this.chatWidth();
+    const contentWidth = Math.max(1, width - INPUT_LABEL_WIDTH);
+    const inputLines = this.wrapInputLines(this.inputBuffer, contentWidth, inputRows);
+    for (let i = 0; i < inputRows; i++) {
+      const row = startRow + i;
+      const line = inputLines[i] ?? "";
+      const prefix = i === 0 ? `${BLUE}${INPUT_LABEL}${RESET} ` : " ".repeat(INPUT_LABEL_WIDTH);
+      buf.push(moveTo(row, 1), prefix, line, CLEAR_EOL);
+    }
+  }
+  wrapInputLines(text, maxWidth, maxRows) {
+    const rawLines = text.split("\n");
+    const wrapped = [];
+    for (const raw of rawLines) {
+      for (const wl of this.wrapText(raw, maxWidth)) {
+        wrapped.push(wl);
+      }
+    }
+    if (!wrapped.length) wrapped.push("");
+    if (wrapped.length > maxRows) {
+      const trimmed = wrapped.slice(wrapped.length - maxRows);
+      trimmed[0] = "\u2026" + trimmed[0].slice(1);
+      return trimmed;
+    }
+    return wrapped;
+  }
+  buildTitleBar() {
+    const parts = [];
+    if (this.options.title) {
+      parts.push(`${CYAN}${this.options.title}${RESET}`);
+    }
+    if (this.options.subtitle) {
+      parts.push(`${DIM}${this.options.subtitle}${RESET}`);
+    }
+    let status = "";
+    switch (this.runState) {
+      case "thinking":
+        status = `${YELLOW}Thinking\u2026${RESET}`;
+        break;
+      case "tool_running":
+        status = `${YELLOW}Running ${this.activeToolName}\u2026${RESET}`;
+        break;
+      case "streaming":
+        status = `${GREEN}Writing\u2026${RESET}`;
+        break;
+      default:
+        break;
+    }
+    if (status) parts.push(status);
+    const line = parts.join(` ${DIM}|${RESET} `);
+    return truncateAnsi(line, this.cols);
   }
   // ─── Separator ────────────────────────────────────────────────────
   buildSeparator() {
@@ -14362,6 +14632,7 @@ var ChatTUI = class {
     if (this.options.debug) {
       hints.push(`^D ${this.debugPanelVisible ? "hide" : "show"} debug`);
     }
+    hints.push("Enter send");
     const lineWidth = Math.min(this.cols, 60);
     if (!hints.length) {
       return `${GRAY}${"\u2500".repeat(lineWidth)}${RESET}`;
@@ -14392,8 +14663,9 @@ var ChatTUI = class {
     return lines;
   }
   appendToolCallLines(lines, tc, width) {
-    const status = tc.done ? "Called" : "Calling";
-    const summary = `  ${GRAY}${status} ${tc.name}${tc.done ? "" : "..."}${RESET}`;
+    const status = tc.done ? "\u2713" : "\u2026";
+    const verb = tc.done ? "Called" : "Calling";
+    const summary = `  ${tc.done ? GREEN : YELLOW}${status}${RESET} ${GRAY}${verb} ${tc.name}${RESET}`;
     if (!this.expandDetails) {
       lines.push(summary);
       return;
@@ -14414,14 +14686,15 @@ var ChatTUI = class {
     }
   }
   appendToolResultLines(lines, tr, width) {
+    const mark = tr.failed ? `${RED}\u2717${RESET}` : `${GREEN}\u2713${RESET}`;
     if (!this.expandDetails) {
-      const maxLen = width - 10;
+      const maxLen = width - 12;
       const preview = tr.content.replace(/\n/g, " ").slice(0, maxLen);
       const truncated = preview.length < tr.content.length ? "..." : "";
-      lines.push(`    ${GRAY}\u2192 ${tr.toolName}: ${preview}${truncated}${RESET}`);
+      lines.push(`    ${mark} ${GRAY}${tr.toolName}: ${preview}${truncated}${RESET}`);
       return;
     }
-    lines.push(`    ${GRAY}\u2192 ${tr.toolName} result:${RESET}`);
+    lines.push(`    ${mark} ${GRAY}${tr.toolName} result:${RESET}`);
     let formatted = tr.content;
     try {
       formatted = JSON.stringify(JSON.parse(tr.content), null, 2);
@@ -14473,7 +14746,12 @@ var ChatTUI = class {
     const labelWidth = 12;
     const indent = " ".repeat(labelWidth);
     if (!this.streamContent) {
-      lines.push(label);
+      if (this.runState === "thinking" || this.runState === "tool_running") {
+        const hint2 = this.runState === "tool_running" && this.activeToolName ? `Running ${this.activeToolName}\u2026` : "Thinking\u2026";
+        lines.push(`${label}${YELLOW}${hint2}${RESET}`);
+      } else {
+        lines.push(label);
+      }
       return;
     }
     let first = true;
@@ -14591,15 +14869,68 @@ function buildDebugSummary(_direction, msg) {
   return type;
 }
 
+// src/lib/agui-tui-events.ts
+function handleAguiEvent(tui, event) {
+  const type = event.type?.toLowerCase() ?? "";
+  switch (type) {
+    case "run_started":
+      tui.runStarted();
+      break;
+    case "run_finished":
+      tui.runFinished();
+      break;
+    case "text_message_start":
+      tui.streamStart();
+      break;
+    case "text_message_content": {
+      const delta = getTextDelta(event);
+      if (delta) tui.streamDelta(delta);
+      break;
+    }
+    case "text_message_end":
+      tui.streamEnd();
+      break;
+    case "tool_call_start":
+      tui.toolCallStart(
+        event.toolCallId ?? "",
+        event.toolCallName ?? event.name ?? "tool"
+      );
+      break;
+    case "tool_call_args":
+      if (event.toolCallId && event.delta) {
+        tui.toolCallArgs(event.toolCallId, event.delta);
+      }
+      break;
+    case "tool_call_end":
+      if (event.toolCallId) tui.toolCallEnd(event.toolCallId);
+      break;
+    case "tool_call_result": {
+      const toolCallId = event.toolCallId ?? "";
+      const toolName = tui.findToolCallName(toolCallId);
+      const content = typeof event.content === "string" ? event.content : typeof event.result === "string" ? event.result : JSON.stringify(event.result ?? event.content ?? "");
+      tui.toolCallResult(toolCallId, toolName, content);
+      break;
+    }
+    case "run_error": {
+      const errorMsg = getErrorMessage(event);
+      if (errorMsg) tui.showError(errorMsg);
+      tui.runFinished();
+      break;
+    }
+    default:
+      break;
+  }
+}
+
 // src/lib/audio.ts
-import { spawn, execSync as execSync2, spawnSync } from "child_process";
+import { spawn, execSync, spawnSync } from "child_process";
 import { EventEmitter as EventEmitter2 } from "events";
 import * as readline3 from "readline";
 var SAMPLE_RATE = 24e3;
 var MIC_CHUNK_BYTES = 4800;
 function checkSoxAvailable() {
   try {
-    execSync2("which sox", { stdio: "pipe" });
+    execSync("which sox", { stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -14910,6 +15241,7 @@ var AudioPlayer = class extends EventEmitter2 {
 };
 
 // src/lib/chat-session.ts
+var HITL_INTERRUPT_EXIT_CODE = 3;
 async function runChatSession(session, args) {
   const debug = !!args.debug;
   const isVoice = !!args.voice;
@@ -14939,6 +15271,14 @@ async function runChatSession(session, args) {
 function vadMode(args) {
   return typeof args.vad === "string" ? args.vad : "server";
 }
+function sanitizeInterruptForStdout(result2) {
+  const url = typeof result2.payload.url === "string" ? result2.payload.url : void 0;
+  return {
+    type: result2.type,
+    interrupt_id: result2.interruptId,
+    url
+  };
+}
 async function singleTurnChatSession(session, message, debug, autoApprove = false, allowWrite = false) {
   const aguiClient = new AGUIClient({
     baseUrl: session.ctx.envConfig.apiUrl,
@@ -14958,7 +15298,7 @@ async function singleTurnChatSession(session, message, debug, autoApprove = fals
 `);
     }
   };
-  const { streamText, hasToolCalls } = await runConciergeAguiLoop(
+  const { streamText, hasToolCalls, unsupportedHitl } = await runConciergeAguiLoop(
     aguiClient,
     [{ role: "user", content: message }],
     onEvent,
@@ -14971,6 +15311,21 @@ async function singleTurnChatSession(session, message, debug, autoApprove = fals
       nonInteractive: true
     }
   );
+  if (unsupportedHitl) {
+    const jsonPayload = JSON.stringify({
+      error: "hitl_interrupt",
+      message: "A human-in-the-loop interrupt requires out-of-band action before the operation can continue.",
+      resume: {
+        chatId: session.chatId,
+        chatUuid: session.chatUuid,
+        interruptId: unsupportedHitl.interruptId
+      },
+      interrupt: sanitizeInterruptForStdout(unsupportedHitl)
+    });
+    process.stdout.write(`${jsonPayload}
+`);
+    throw new CLIError("HITL interrupt requires out-of-band handling", HITL_INTERRUPT_EXIT_CODE);
+  }
   if (streamText) {
     process.stdout.write(`\x1B[32mAssistant:\x1B[0m ${streamText}
 `);
@@ -15015,113 +15370,95 @@ async function interactiveChatSession(session, debug, autoApprove, allowWrite) {
     model: session.model,
     appContext: session.appContext
   });
-  clearScreen();
-  console.log("=".repeat(60));
-  console.log(session.label);
-  console.log("=".repeat(60));
-  console.log(`Chat: ${session.chatTitle}`);
-  console.log("Type your message and press Enter. Type 'exit' or Ctrl+C to quit.");
-  console.log("=".repeat(60));
-  console.log("");
   const existingMessages = await session.loadMessages();
-  if (existingMessages.length > 0) {
-    console.log("\x1B[90m--- Previous messages ---\x1B[0m\n");
-    for (const msg of existingMessages.slice(-10)) {
-      const text = typeof msg.content === "string" ? msg.content : "";
-      if (text && text.trim()) {
-        printMessage(text, msg.role);
+  const history = buildHistory(existingMessages);
+  const conversationMessages = buildConversationMessages(existingMessages);
+  let tui;
+  const sendTurn = async (text) => {
+    conversationMessages.push({ role: "user", content: text });
+    let assistantContent = "";
+    try {
+      tui.runStarted();
+      const { streamText } = await runConciergeAguiLoop(
+        aguiClient,
+        conversationMessages,
+        (event) => {
+          handleAguiEvent(tui, event);
+          const type = event.type?.toLowerCase() ?? "";
+          if (type === "text_message_content" && event.delta) {
+            assistantContent += event.delta;
+          }
+          const errorMsg = getErrorMessage(event);
+          if (errorMsg) tui.showError(errorMsg);
+        },
+        {
+          autoApprove,
+          allowWrite: allowWrite || !!session.allowWrite,
+          debug,
+          trustCwd: session.trustCwd,
+          trustDir: session.trustDir,
+          onHitlPromptStart: () => tui.pauseForPrompt(),
+          onHitlPromptEnd: () => tui.resumeAfterPrompt()
+        }
+      );
+      if (streamText && !assistantContent) {
+        assistantContent = streamText;
       }
+      if (assistantContent) {
+        conversationMessages.push({ role: "assistant", content: assistantContent });
+      }
+    } catch (error) {
+      tui.showError(error instanceof Error ? error.message : String(error));
+    } finally {
+      tui.runFinished();
     }
-    console.log("\x1B[90m--- End of history ---\x1B[0m\n");
-  }
-  const conversationMessages = [];
-  for (const msg of existingMessages.slice(-10)) {
+  };
+  await new Promise((resolve) => {
+    tui = new ChatTUI({
+      title: session.label,
+      subtitle: session.chatTitle,
+      onSend: (text) => {
+        void sendTurn(text);
+      },
+      onExit: () => {
+        tui.stop();
+        resolve();
+      },
+      debug,
+      env: session.ctx.env
+    });
+    tui.loadHistory(history);
+    tui.start();
+  });
+}
+function buildConversationMessages(messages) {
+  const out = [];
+  for (const msg of messages) {
     const text = typeof msg.content === "string" ? msg.content : "";
-    if (text && text.trim() && (msg.role === "user" || msg.role === "assistant")) {
-      conversationMessages.push({ role: msg.role, content: text });
+    if (text.trim() && (msg.role === "user" || msg.role === "assistant")) {
+      out.push({ role: msg.role, content: text });
     }
   }
-  const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve) => {
-    const prompt = () => {
-      rl.question("\x1B[34mYou:\x1B[0m ", async (input) => {
-        const trimmed = input.trim();
-        if (!trimmed) {
-          prompt();
-          return;
-        }
-        if (trimmed.toLowerCase() === "exit" || trimmed.toLowerCase() === "quit") {
-          console.log("\nGoodbye!");
-          rl.close();
-          return;
-        }
-        conversationMessages.push({ role: "user", content: trimmed });
-        process.stdout.write("\n\x1B[32mAssistant:\x1B[0m ");
-        let assistantContent = "";
-        try {
-          const { streamText } = await runConciergeAguiLoop(
-            aguiClient,
-            conversationMessages,
-            (event) => {
-              const delta = getTextDelta(event);
-              if (delta) {
-                process.stdout.write(delta);
-                assistantContent += delta;
-              }
-              const errorMsg = getErrorMessage(event);
-              if (errorMsg) console.log(`
-\x1B[31mError: ${errorMsg}\x1B[0m`);
-            },
-            {
-              autoApprove,
-              allowWrite: allowWrite || !!session.allowWrite,
-              debug,
-              trustCwd: session.trustCwd,
-              trustDir: session.trustDir
-            }
-          );
-          if (streamText && !assistantContent) {
-            assistantContent = streamText;
-            process.stdout.write(streamText);
-          }
-          if (assistantContent) {
-            conversationMessages.push({ role: "assistant", content: assistantContent });
-          }
-          console.log("\n");
-        } catch (error) {
-          console.log(
-            `
-\x1B[31mError: ${error instanceof Error ? error.message : error}\x1B[0m
-`
-          );
-        }
-        prompt();
-      });
-    };
-    rl.on("close", () => {
-      console.log("\nGoodbye!");
-      resolve();
-    });
-    prompt();
-  });
-}
-function buildHistory(messages) {
-  const history = [];
-  for (const msg of messages.slice(-30)) {
-    const text = typeof msg.content === "string" ? msg.content : "";
-    if (msg.role === "user" || msg.role === "assistant") {
-      if (text.trim()) {
-        history.push({ role: msg.role, content: text });
-      }
-      if (msg.role === "assistant" && msg.tool_calls) {
-        for (const tc of msg.tool_calls) {
-          history.push({
-            kind: "tool_call",
-            id: tc.id,
-            name: tc.function.name,
-            args: tc.function.arguments || "",
-            done: true
-          });
+  return out;
+}
+function buildHistory(messages, limit) {
+  const history = [];
+  const slice = limit ? messages.slice(-limit) : messages;
+  for (const msg of slice) {
+    const text = typeof msg.content === "string" ? msg.content : "";
+    if (msg.role === "user" || msg.role === "assistant") {
+      if (text.trim()) {
+        history.push({ role: msg.role, content: text });
+      }
+      if (msg.role === "assistant" && msg.tool_calls) {
+        for (const tc of msg.tool_calls) {
+          history.push({
+            kind: "tool_call",
+            id: tc.id,
+            name: tc.function.name,
+            args: tc.function.arguments || "",
+            done: true
+          });
         }
       }
     } else if (msg.role === "tool") {
@@ -15179,7 +15516,7 @@ async function realtimeChatSession(session, vad, debug) {
     throw new CLIError(`Failed to connect: ${err instanceof Error ? err.message : err}`);
   }
   const existingMessages = await session.loadMessages();
-  const history = buildHistory(existingMessages);
+  const history = buildHistory(existingMessages, 30);
   const tui = new ChatTUI({
     onSend: (text) => {
       client.sendTextMessage(text);
@@ -15244,7 +15581,7 @@ Connecting to ${session.label.toLowerCase()}...
     throw new CLIError(`Failed to connect: ${err instanceof Error ? err.message : err}`);
   }
   const existingMessages = await session.loadMessages();
-  const history = buildHistory(existingMessages);
+  const history = buildHistory(existingMessages, 30);
   const mic = new MicCapture((pcm16) => {
     if (!client.isConnected()) return;
     client.sendAudio(pcm16);
@@ -15339,15 +15676,169 @@ async function listAudioDevices() {
   }
 }
 
+// src/lib/chat-history.ts
+var PAGE_SIZE = 100;
+var HARD_CAP = 2e3;
+async function loadAllChatMessages(ctx, workspaceUuid, chatId) {
+  const items = [];
+  let offset = 0;
+  while (items.length < HARD_CAP) {
+    const batch = await ctx.apiClient.getChatMessages(workspaceUuid, chatId, PAGE_SIZE, offset).catch(() => []);
+    if (!batch.length) break;
+    items.push(...batch);
+    if (batch.length < PAGE_SIZE) break;
+    offset += batch.length;
+  }
+  return items;
+}
+
+// src/commands/manage.ts
+async function manageCommand(hctx) {
+  const ctx = requireAuth(hctx.ctx);
+  const { workspace, args } = hctx;
+  const asMember = typeof args["as-member"] === "string" ? args["as-member"] : void 0;
+  const chatIdArg = typeof args["chat-id"] === "string" ? args["chat-id"] : void 0;
+  const message = typeof args.message === "string" ? args.message : void 0;
+  const chat = await getOrCreateChat(ctx, workspace, chatIdArg, asMember, "manager", !!message);
+  const session = buildWorkspaceSession(ctx, workspace, chat, "Workspace Manager", {
+    appContext: buildCliConciergeAppContext(),
+    allowWrite: true,
+    trustCwd: !!args["trust-cwd"],
+    trustDir: typeof args["trust-dir"] === "string" ? args["trust-dir"] : void 0
+  });
+  process.stderr.write(`Chat #${session.chatId}
+`);
+  await runChatSession(session, args);
+  process.stderr.write(`Chat #${session.chatId}
+`);
+}
+async function chatCommand(hctx) {
+  const ctx = requireAuth(hctx.ctx);
+  const { workspace, args } = hctx;
+  const chatIdArg = typeof args["chat-id"] === "string" ? args["chat-id"] : void 0;
+  const workflowId = typeof args.workflow === "string" ? args.workflow : void 0;
+  const memberId = typeof args.member === "string" ? args.member : void 0;
+  let chat;
+  if (chatIdArg) {
+    const id = Number(chatIdArg);
+    if (isNaN(id)) throw new CLIError("--chat-id must be a number");
+    chat = await ctx.apiClient.getChat(workspace, id);
+  } else if (workflowId) {
+    chat = await createAssignmentChat(ctx.apiClient, workspace, Number(workflowId), memberId);
+  } else if (memberId) {
+    chat = await createMemberChat(ctx.apiClient, workspace, memberId);
+  } else {
+    throw new CLIError(
+      'Specify --workflow <id>, --member <id>, or --chat-id <id>.\nUse "gr manage" for workspace manager chats.'
+    );
+  }
+  const session = buildWorkspaceSession(ctx, workspace, chat, "Chat");
+  await runChatSession(session, args);
+}
+function buildWorkspaceSession(ctx, workspace, chat, label, extra) {
+  const wsBase = ctx.envConfig.apiUrl.replace(/^https:/, "wss:").replace(/^http:/, "ws:");
+  return {
+    ctx,
+    workspaceUuid: workspace,
+    chatId: chat.id,
+    chatUuid: chat.uuid,
+    chatTitle: chat.title || chat.uuid,
+    aguiEndpointUrl: `${ctx.envConfig.apiUrl}/api/v2/w/${workspace}/web-chat/${chat.id}/chat/agui`,
+    wsUrl: `${wsBase}/api/v2/w/${workspace}/realtime/stream-ws`,
+    loadMessages: () => loadAllChatMessages(ctx, workspace, chat.id),
+    label,
+    model: "manager",
+    ...extra
+  };
+}
+async function getOrCreateChat(ctx, workspace, chatIdArg, asMemberId, chatType, skipSelection = false) {
+  if (chatIdArg) {
+    const chatId = Number(chatIdArg);
+    if (isNaN(chatId)) throw new CLIError("--chat-id must be a number");
+    return ctx.apiClient.getChat(workspace, chatId);
+  }
+  if (skipSelection) {
+    return createManagerChat(ctx.apiClient, workspace, asMemberId);
+  }
+  const chatsResponse = await ctx.apiClient.getChats(workspace, {
+    chatType,
+    sortBy: "updatedAt",
+    sortOrder: "desc",
+    pageSize: 20
+  });
+  const chats = chatsResponse.items || [];
+  const { item: selectedChat, isNew } = await selectFromList(chats, {
+    title: "Select a chat or create a new one",
+    labelFn: (chat) => chat.title || `Chat ${chat.uuid.slice(0, 8)}...`,
+    detailFn: (chat) => {
+      const time = formatTimestamp(chat.updatedAt);
+      const msgCount = chat.messageCount || 0;
+      return `${msgCount} msg${msgCount !== 1 ? "s" : ""} - ${time}`;
+    },
+    emptyMessage: "No existing chats.",
+    allowNew: true,
+    newLabel: "+ Start new chat"
+  });
+  if (!selectedChat && !isNew) {
+    throw new CLIError("No chat selected.");
+  }
+  if (isNew) {
+    return createManagerChat(ctx.apiClient, workspace, asMemberId);
+  }
+  return selectedChat;
+}
+async function createManagerChat(apiClient, workspace, asMemberId) {
+  const data = {
+    chatType: "manager",
+    channel: "web-chat"
+  };
+  if (asMemberId) {
+    data.memberId = Number(asMemberId);
+  }
+  const chat = await apiClient.createChat(workspace, data);
+  process.stderr.write(`Created chat #${chat.id}
+`);
+  return chat;
+}
+async function createAssignmentChat(apiClient, workspace, workflowId, asMemberId) {
+  if (isNaN(workflowId)) throw new CLIError("--workflow must be a number");
+  const data = {
+    chatType: "assignment",
+    channel: "web-chat",
+    workflowId
+  };
+  if (asMemberId) {
+    data.memberId = Number(asMemberId);
+  }
+  const chat = await apiClient.createChat(workspace, data);
+  process.stderr.write(`Created assignment chat #${chat.id} (workflow ${workflowId})
+`);
+  return chat;
+}
+async function createMemberChat(apiClient, workspace, memberId) {
+  const id = Number(memberId);
+  if (isNaN(id)) throw new CLIError("--member must be a number");
+  const data = {
+    chatType: "member",
+    channel: "web-chat",
+    memberId: id
+  };
+  const chat = await apiClient.createChat(workspace, data);
+  process.stderr.write(`Created DM chat #${chat.id} (member ${memberId})
+`);
+  return chat;
+}
+
 // src/commands/concierge.ts
 async function conciergeOutboundCommand(hctx) {
   const ctx = requireAuth(hctx.ctx);
   const { args } = hctx;
+  const message = typeof args.message === "string" ? args.message : void 0;
   if (args.call && args.sms) {
     throw new CLIError("--call and --sms are mutually exclusive");
   }
   if (args.call) {
-    const result2 = await originateConciergeCall(ctx);
+    const result2 = await originateConciergeCall(ctx, "concierge_setup", message, "cli");
     process.stderr.write(
       `Concierge call started. callSid=${result2.callSid} startedAt=${result2.startedAt}
 `
@@ -15438,6 +15929,64 @@ async function getOrCreateConciergeChat(ctx, chatIdArg, skipSelection) {
   return selectedChat;
 }
 
+// src/commands/dev.ts
+import { existsSync, mkdirSync, writeFileSync, readFileSync as readFileSync2 } from "fs";
+import { execSync as execSync2 } from "child_process";
+import { join } from "path";
+async function devImportLocalCommand(ctx, workspace) {
+  stderr(`Exporting workspace ${workspace}...`);
+  const exportData = await ctx.apiClient.exportWorkspace(workspace);
+  stderr("Export successful!");
+  stderr(`  Workflows: ${(exportData.workflows || []).length}`);
+  stderr(`  Tasks: ${(exportData.tasks || []).length}`);
+  stderr(`  Data Types: ${(exportData.dataTypes || []).length}`);
+  stderr(`  Sites: ${(exportData.sites || []).length}`);
+  const slug = workspace.slice(0, 8);
+  const importCacheDir = join(ctx.credentialsManager.getCacheDir(), "imports");
+  if (!existsSync(importCacheDir)) {
+    mkdirSync(importCacheDir, { recursive: true });
+  }
+  const filename = `ws-${slug}-${workspace}.json`;
+  const filepath = join(importCacheDir, filename);
+  writeFileSync(filepath, JSON.stringify(exportData, null, 2));
+  stderr(`Saved to: ${filepath}`);
+  stderr("Running dev:restore...");
+  const rootDir = findProjectRoot();
+  const relativePath = filepath.replace(rootDir + "/", "");
+  try {
+    const result2 = execSync2(`yarn dev:restore ${relativePath}`, {
+      cwd: rootDir,
+      stdio: "pipe",
+      encoding: "utf-8"
+    });
+    process.stderr.write(result2);
+    const failed = result2.includes("Failed/Skipped: ") && !result2.includes("Failed/Skipped: 0") || result2.includes("Successfully restored: 0");
+    if (failed) throw new CLIError("Import failed");
+  } catch (error) {
+    if (error instanceof CLIError) throw error;
+    const execError = error;
+    if (execError.stdout) process.stderr.write(execError.stdout);
+    if (execError.stderr) process.stderr.write(execError.stderr);
+    throw new CLIError("dev:restore failed");
+  }
+  stderr(`Import complete: ${workspace}`);
+}
+function findProjectRoot() {
+  let dir = process.cwd();
+  while (dir !== "/") {
+    const pkgPath = join(dir, "package.json");
+    if (existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync2(pkgPath, "utf-8"));
+        if (pkg.workspaces) return dir;
+      } catch {
+      }
+    }
+    dir = join(dir, "..");
+  }
+  return process.cwd();
+}
+
 // src/commands/get-started.ts
 var WEB_SETUP = "https://app.gravityrail.com/setup";
 var WEB_GET_STARTED = "https://app.gravityrail.com/get-started";
@@ -15537,73 +16086,15 @@ async function getStartedCommand(hctx) {
   process.stdout.write(LLM_GUIDE);
 }
 
-// src/commands/dev.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, readFileSync as readFileSync3 } from "fs";
-import { execSync as execSync3 } from "child_process";
-import { join as join2 } from "path";
-async function devImportLocalCommand(ctx, workspace) {
-  stderr(`Exporting workspace ${workspace}...`);
-  const exportData = await ctx.apiClient.exportWorkspace(workspace);
-  stderr("Export successful!");
-  stderr(`  Workflows: ${(exportData.workflows || []).length}`);
-  stderr(`  Tasks: ${(exportData.tasks || []).length}`);
-  stderr(`  Data Types: ${(exportData.dataTypes || []).length}`);
-  stderr(`  Sites: ${(exportData.sites || []).length}`);
-  const slug = workspace.slice(0, 8);
-  const importCacheDir = join2(ctx.credentialsManager.getCacheDir(), "imports");
-  if (!existsSync2(importCacheDir)) {
-    mkdirSync2(importCacheDir, { recursive: true });
-  }
-  const filename = `ws-${slug}-${workspace}.json`;
-  const filepath = join2(importCacheDir, filename);
-  writeFileSync2(filepath, JSON.stringify(exportData, null, 2));
-  stderr(`Saved to: ${filepath}`);
-  stderr("Running dev:restore...");
-  const rootDir = findProjectRoot();
-  const relativePath = filepath.replace(rootDir + "/", "");
-  try {
-    const result2 = execSync3(`yarn dev:restore ${relativePath}`, {
-      cwd: rootDir,
-      stdio: "pipe",
-      encoding: "utf-8"
-    });
-    process.stderr.write(result2);
-    const failed = result2.includes("Failed/Skipped: ") && !result2.includes("Failed/Skipped: 0") || result2.includes("Successfully restored: 0");
-    if (failed) throw new CLIError("Import failed");
-  } catch (error) {
-    if (error instanceof CLIError) throw error;
-    const execError = error;
-    if (execError.stdout) process.stderr.write(execError.stdout);
-    if (execError.stderr) process.stderr.write(execError.stderr);
-    throw new CLIError("dev:restore failed");
-  }
-  stderr(`Import complete: ${workspace}`);
-}
-function findProjectRoot() {
-  let dir = process.cwd();
-  while (dir !== "/") {
-    const pkgPath = join2(dir, "package.json");
-    if (existsSync2(pkgPath)) {
-      try {
-        const pkg = JSON.parse(readFileSync3(pkgPath, "utf-8"));
-        if (pkg.workspaces) return dir;
-      } catch {
-      }
-    }
-    dir = join2(dir, "..");
-  }
-  return process.cwd();
-}
-
 // src/commands/login.ts
-import { GravityRailClient as GravityRailClient2 } from "@gravity-rail/sdk";
+import { GravityRailClient } from "@gravity-rail/sdk";
 async function loginCommand(ctx) {
   const { accessToken } = await performOAuthFlow({
     env: ctx.env,
     envConfig: ctx.envConfig,
     credentialsManager: ctx.credentialsManager
   });
-  const apiClient = new GravityRailClient2(accessToken, ctx.envConfig.apiUrl);
+  const apiClient = new GravityRailClient(accessToken, ctx.envConfig.apiUrl);
   const account = await apiClient.getUserAccount();
   stderr(`Logged in as ${account.name} (${account.email})`);
 }
@@ -15612,143 +16103,6 @@ async function logoutCommand(ctx) {
   stderr(`Credentials cleared for ${ctx.env}`);
 }
 
-// src/commands/manage.ts
-async function manageCommand(hctx) {
-  const ctx = requireAuth(hctx.ctx);
-  const { workspace, args } = hctx;
-  const asMember = typeof args["as-member"] === "string" ? args["as-member"] : void 0;
-  const chatIdArg = typeof args["chat-id"] === "string" ? args["chat-id"] : void 0;
-  const message = typeof args.message === "string" ? args.message : void 0;
-  const chat = await getOrCreateChat(ctx, workspace, chatIdArg, asMember, "manager", !!message);
-  const session = buildWorkspaceSession(ctx, workspace, chat, "Workspace Manager", {
-    appContext: buildCliConciergeAppContext(),
-    allowWrite: true,
-    trustCwd: !!args["trust-cwd"],
-    trustDir: typeof args["trust-dir"] === "string" ? args["trust-dir"] : void 0
-  });
-  process.stderr.write(`Chat #${session.chatId}
-`);
-  await runChatSession(session, args);
-  process.stderr.write(`Chat #${session.chatId}
-`);
-}
-async function chatCommand(hctx) {
-  const ctx = requireAuth(hctx.ctx);
-  const { workspace, args } = hctx;
-  const chatIdArg = typeof args["chat-id"] === "string" ? args["chat-id"] : void 0;
-  const workflowId = typeof args.workflow === "string" ? args.workflow : void 0;
-  const memberId = typeof args.member === "string" ? args.member : void 0;
-  let chat;
-  if (chatIdArg) {
-    const id = Number(chatIdArg);
-    if (isNaN(id)) throw new CLIError("--chat-id must be a number");
-    chat = await ctx.apiClient.getChat(workspace, id);
-  } else if (workflowId) {
-    chat = await createAssignmentChat(ctx.apiClient, workspace, Number(workflowId), memberId);
-  } else if (memberId) {
-    chat = await createMemberChat(ctx.apiClient, workspace, memberId);
-  } else {
-    throw new CLIError(
-      'Specify --workflow <id>, --member <id>, or --chat-id <id>.\nUse "gr manage" for workspace manager chats.'
-    );
-  }
-  const session = buildWorkspaceSession(ctx, workspace, chat, "Chat");
-  await runChatSession(session, args);
-}
-function buildWorkspaceSession(ctx, workspace, chat, label, extra) {
-  const wsBase = ctx.envConfig.apiUrl.replace(/^https:/, "wss:").replace(/^http:/, "ws:");
-  return {
-    ctx,
-    workspaceUuid: workspace,
-    chatId: chat.id,
-    chatUuid: chat.uuid,
-    chatTitle: chat.title || chat.uuid,
-    aguiEndpointUrl: `${ctx.envConfig.apiUrl}/api/v2/w/${workspace}/web-chat/${chat.id}/chat/agui`,
-    wsUrl: `${wsBase}/api/v2/w/${workspace}/realtime/stream-ws`,
-    loadMessages: () => ctx.apiClient.getChatMessages(workspace, chat.id, 50).catch(() => []),
-    label,
-    model: "manager",
-    ...extra
-  };
-}
-async function getOrCreateChat(ctx, workspace, chatIdArg, asMemberId, chatType, skipSelection = false) {
-  if (chatIdArg) {
-    const chatId = Number(chatIdArg);
-    if (isNaN(chatId)) throw new CLIError("--chat-id must be a number");
-    return ctx.apiClient.getChat(workspace, chatId);
-  }
-  if (skipSelection) {
-    return createManagerChat(ctx.apiClient, workspace, asMemberId);
-  }
-  const chatsResponse = await ctx.apiClient.getChats(workspace, {
-    chatType,
-    sortBy: "updatedAt",
-    sortOrder: "desc",
-    pageSize: 20
-  });
-  const chats = chatsResponse.items || [];
-  const { item: selectedChat, isNew } = await selectFromList(chats, {
-    title: "Select a chat or create a new one",
-    labelFn: (chat) => chat.title || `Chat ${chat.uuid.slice(0, 8)}...`,
-    detailFn: (chat) => {
-      const time = formatTimestamp(chat.updatedAt);
-      const msgCount = chat.messageCount || 0;
-      return `${msgCount} msg${msgCount !== 1 ? "s" : ""} - ${time}`;
-    },
-    emptyMessage: "No existing chats.",
-    allowNew: true,
-    newLabel: "+ Start new chat"
-  });
-  if (!selectedChat && !isNew) {
-    throw new CLIError("No chat selected.");
-  }
-  if (isNew) {
-    return createManagerChat(ctx.apiClient, workspace, asMemberId);
-  }
-  return selectedChat;
-}
-async function createManagerChat(apiClient, workspace, asMemberId) {
-  const data = {
-    chatType: "manager",
-    channel: "web-chat"
-  };
-  if (asMemberId) {
-    data.memberId = Number(asMemberId);
-  }
-  const chat = await apiClient.createChat(workspace, data);
-  process.stderr.write(`Created chat #${chat.id}
-`);
-  return chat;
-}
-async function createAssignmentChat(apiClient, workspace, workflowId, asMemberId) {
-  if (isNaN(workflowId)) throw new CLIError("--workflow must be a number");
-  const data = {
-    chatType: "assignment",
-    channel: "web-chat",
-    workflowId
-  };
-  if (asMemberId) {
-    data.memberId = Number(asMemberId);
-  }
-  const chat = await apiClient.createChat(workspace, data);
-  process.stderr.write(`Created assignment chat #${chat.id} (workflow ${workflowId})
-`);
-  return chat;
-}
-async function createMemberChat(apiClient, workspace, memberId) {
-  const id = Number(memberId);
-  if (isNaN(id)) throw new CLIError("--member must be a number");
-  const data = {
-    chatType: "member",
-    channel: "web-chat",
-    memberId: id
-  };
-  const chat = await apiClient.createChat(workspace, data);
-  process.stderr.write(`Created DM chat #${chat.id} (member ${memberId})
-`);
-  return chat;
-}
-
 // src/commands/organizations.ts
 var COLUMNS34 = [
   { header: "NAME", getValue: (o) => o.organizationName || "", maxWidth: 35 },
@@ -15776,6 +16130,230 @@ async function whoamiCommand(ctx) {
   );
   outputSingle(account, ctx, columns);
 }
+
+// src/top-level-commands.ts
+var topLevelCommands = [
+  {
+    path: ["login"],
+    description: "Authenticate via OAuth",
+    requiresAuth: false,
+    handler: async ({ ctx }) => {
+      await loginCommand(ctx);
+    }
+  },
+  {
+    path: ["logout"],
+    description: "Clear cached credentials",
+    requiresAuth: false,
+    handler: async ({ ctx }) => {
+      await logoutCommand(ctx);
+    }
+  },
+  {
+    path: ["auth", "browser"],
+    description: "Open an authenticated browser session using CLI credentials",
+    args: [
+      { name: "no-open", description: "Print the URL instead of opening browser", isFlag: true }
+    ],
+    handler: async ({ ctx, args }) => {
+      await authBrowserCommand(requireAuth(ctx), args);
+    }
+  },
+  {
+    path: ["manage"],
+    description: "Interactive workspace manager chat (text, realtime, or voice)",
+    requiresWorkspace: true,
+    mutates: true,
+    args: [
+      { name: "realtime", description: "Use WebSocket realtime connection", isFlag: true },
+      { name: "voice", description: "Enable voice mode (microphone + speaker)", isFlag: true },
+      { name: "message", alias: "m", description: "Single-turn: send one message and exit" },
+      { name: "as-member", description: "Chat as a specific member (by numeric ID)" },
+      { name: "chat-id", description: "Resume an existing chat by numeric ID" },
+      { name: "vad", description: "Voice activity detection: server (default) or client" },
+      { name: "list-devices", description: "List audio devices and exit", isFlag: true },
+      { name: "input-device", description: "Microphone device name or ID" },
+      { name: "output-device", description: "Speaker device name or ID" },
+      { name: "debug", description: "Enable debug logging", isFlag: true },
+      {
+        name: "auto-approve",
+        description: "Auto-approve all tool calls (skip HITL)",
+        isFlag: true
+      },
+      {
+        name: "trust-cwd",
+        description: "Trust files in the current working directory (non-interactive)",
+        isFlag: true
+      },
+      {
+        name: "trust-dir",
+        description: "Trust files in this directory (non-interactive; absolute path)"
+      }
+    ],
+    handler: async (hctx) => {
+      await manageCommand(hctx);
+    }
+  },
+  {
+    path: ["chat"],
+    description: "Chat with a workflow, member, or existing chat (text, realtime, or voice)",
+    requiresWorkspace: true,
+    mutates: true,
+    args: [
+      { name: "workflow", description: "Start assignment chat with workflow (by numeric ID)" },
+      { name: "member", description: "Start DM with a member (by numeric ID)" },
+      { name: "chat-id", description: "Resume an existing chat by numeric ID" },
+      { name: "realtime", description: "Use WebSocket realtime connection", isFlag: true },
+      { name: "voice", description: "Enable voice mode (microphone + speaker)", isFlag: true },
+      { name: "message", alias: "m", description: "Single-turn: send one message and exit" },
+      { name: "vad", description: "Voice activity detection: server (default) or client" },
+      { name: "list-devices", description: "List audio devices and exit", isFlag: true },
+      { name: "input-device", description: "Microphone device name or ID" },
+      { name: "output-device", description: "Speaker device name or ID" },
+      { name: "debug", description: "Enable debug logging", isFlag: true },
+      {
+        name: "auto-approve",
+        description: "Auto-approve all tool calls (skip HITL)",
+        isFlag: true
+      }
+    ],
+    handler: async (hctx) => {
+      await chatCommand(hctx);
+    }
+  },
+  {
+    path: ["get-started"],
+    description: "Bootstrap instructions for new users and LLM agents",
+    requiresAuth: false,
+    args: [
+      {
+        name: "format",
+        description: "Output format: llm (agent-readable) or default (human)"
+      },
+      {
+        name: "agent",
+        description: "Alias for --format llm",
+        isFlag: true
+      }
+    ],
+    handler: async (hctx) => {
+      await getStartedCommand(hctx);
+    }
+  },
+  {
+    path: ["setup"],
+    description: "Alias for get-started \u2014 bootstrap instructions",
+    requiresAuth: false,
+    args: [
+      { name: "format", description: "Output format: llm or default" },
+      { name: "agent", description: "Alias for --format llm", isFlag: true }
+    ],
+    handler: async (hctx) => {
+      await getStartedCommand(hctx);
+    }
+  },
+  {
+    path: ["concierge"],
+    description: "Call or SMS your verified phone via the Concierge (server-side)",
+    requiresWorkspace: false,
+    mutates: true,
+    args: [
+      { name: "call", description: "Ring your verified account phone", isFlag: true },
+      { name: "sms", description: "Start an SMS thread on your verified phone", isFlag: true }
+    ],
+    handler: async (hctx) => {
+      await conciergeOutboundCommand(hctx);
+    }
+  },
+  {
+    path: ["account", "verify-phone"],
+    description: "Verify your account phone for concierge chat --call / --sms",
+    requiresWorkspace: false,
+    mutates: true,
+    args: [{ name: "phone", description: "E.164 phone number (optional; prompts if omitted)" }],
+    handler: async (hctx) => {
+      const { accountVerifyPhoneCommand } = await import("./account-verify-phone-TC73QIIE.js");
+      await accountVerifyPhoneCommand(hctx);
+    }
+  },
+  {
+    path: ["concierge", "chat"],
+    description: "Interactive concierge chat (text, realtime, or voice)",
+    requiresWorkspace: false,
+    mutates: true,
+    args: [
+      { name: "realtime", description: "Use WebSocket realtime connection", isFlag: true },
+      { name: "voice", description: "Enable voice mode (microphone + speaker)", isFlag: true },
+      {
+        name: "call",
+        description: "Ring your verified account phone (server-side)",
+        isFlag: true
+      },
+      {
+        name: "sms",
+        description: "SMS your verified account phone (server-side)",
+        isFlag: true
+      },
+      {
+        name: "message",
+        alias: "m",
+        description: 'Single-turn: send one message and exit. With --call: the "why I am calling" anchor for the opening self-introduction.'
+      },
+      { name: "chat-id", description: "Resume an existing chat by numeric ID" },
+      { name: "vad", description: "Voice activity detection: server (default) or client" },
+      { name: "list-devices", description: "List audio devices and exit", isFlag: true },
+      { name: "input-device", description: "Microphone device name or ID" },
+      { name: "output-device", description: "Speaker device name or ID" },
+      { name: "debug", description: "Enable debug logging", isFlag: true },
+      {
+        name: "auto-approve",
+        description: "Auto-approve all tool calls (skip HITL)",
+        isFlag: true
+      },
+      {
+        name: "trust-cwd",
+        description: "Trust files in the current working directory (non-interactive)",
+        isFlag: true
+      },
+      {
+        name: "trust-dir",
+        description: "Trust files in this directory (non-interactive; absolute path)"
+      }
+    ],
+    handler: async (hctx) => {
+      await conciergeCommand(hctx);
+    }
+  },
+  {
+    path: ["dev", "import-local"],
+    description: "Import remote workspace locally",
+    requiresWorkspace: true,
+    handler: async ({ ctx, workspace }) => {
+      await devImportLocalCommand(requireAuth(ctx), workspace);
+    }
+  },
+  {
+    path: ["whoami"],
+    description: "Show current user info",
+    handler: async ({ ctx }) => {
+      await whoamiCommand(requireAuth(ctx));
+    }
+  },
+  {
+    path: ["organizations", "list"],
+    description: "List organizations",
+    handler: async ({ ctx }) => {
+      await organizationsListCommand(requireAuth(ctx));
+    }
+  },
+  {
+    path: ["orgs", "list"],
+    description: "List organizations",
+    handler: async ({ ctx }) => {
+      await organizationsListCommand(requireAuth(ctx));
+    }
+  }
+];
 export {
   AuthRequiredError,
   CLIError,
@@ -15834,6 +16412,7 @@ export {
   simpleCrudCommands,
   startAccountPhoneVerify,
   stderr,
+  topLevelCommands,
   unwrapItems,
   waitForOutboundPhoneCallOutcome,
   whoamiCommand