@great-arrow/cli 0.1.20 → 0.1.25

package/README.md

@@ -1,6 +1,6 @@
 # @great-arrow/cli (`gad`)
 
-Terminal-based access to the Great Arrow Digital platform — memory management, workspace administration, integration diagnostics, MCP tooling, and deployment operations.
+Terminal-based access to the Great Arrow Digital platform — memory management, workspace administration, integration diagnostics, and MCP tooling.
 
 ## Install
 
@@ -109,6 +109,14 @@ override: `ALLOW_FOREIGN_WORKTREE=1`.
 # Full health check (token, API, integrations, MCP)
 gad doctor
 
+# Claude Code surface: server entry, hook wiring, hook credential — and
+# whether every hook you have CONFIGURED can actually run. That last check
+# reads all four settings scopes (managed, user, project, local), because a
+# hook that cannot execute fails silently on every single session and no
+# repo-side test can see your user or local file.
+gad doctor claude
+gad doctor claude --enforce   # back up and repair what is repairable
+
 # Integration management
 gad integrations list
 gad integrations sync github
@@ -145,7 +153,31 @@ gad mcp install gemini
 ```
 
 `gad mcp install codex` writes Codex's native `~/.codex/config.toml` server
-entry and stores the bearer token in `~/.codex/.env`.
+entry and stores the bearer token in `~/.codex/.env`. The entry launches the
+stdio bridge, which detects the current checkout's git origin for every Codex
+session; it does not pin one repository in the global config.
+
+Workspace targeting precedence is explicit command target, current git repo,
+then the saved default outside a repo:
+
+```bash
+# One command only; accepts an id, slug, or exact name.
+gad --workspace great-arrow-digital todo list
+
+# Save a default and see the previous/current workspace in the confirmation.
+gad workspace switch great-arrow-digital
+
+# Inside a linked git checkout, the repo workspace wins over that saved default.
+gad workspace list
+```
+
+`workspace_list` and `tools_discover` are compact by default. MCP callers can
+request `detail:"full"` when diagnostics are needed; when a stable tool name is
+known, `tools_discover({ tool_name: exactName })` returns one schema without
+walking the full catalog or performing session/recommendation datastore reads.
+High-frequency `todo_log` and `work_heartbeat` calls skip the enrichment batch
+and render a single branded line, preserving the current workspace cue without
+repeating board/status payloads.
 
 #### Keeping local MCP installs current
 
@@ -175,12 +207,9 @@ gad agent invoke research-analyst --task "Summarize Q2 metrics"
 gad ask "What did we decide about the caching layer?"
 ```
 
-### Deployment & Operations
+### Operations
 
 ```bash
-gad deploy              # Interactive confirmation
-gad deploy --confirm    # CI/CD (no prompt)
-gad migrate             # Run pending DB migrations
 gad smoke               # MCP smoke test suite
 ```
 

package/dist/index.js

@@ -9399,7 +9399,7 @@ function isNodeError(value) {
 
 // src/lib/version.ts
 var CLI_PACKAGE_NAME = "@great-arrow/cli";
-var CLI_VERSION = "0.1.20";
+var CLI_VERSION = "0.1.25";
 var GAD_INSTALL_VERSION = "2026.08.08";
 var GAD_INSTALL_MIN_VERSION = "2026.06.22";
 var GAD_INSTALL_HEADER = "X-GAD-Install-Version";
@@ -9427,9 +9427,10 @@ var ACCOUNT = "api-token";
 function credentialFilePath() {
   return join(homedir(), ".great-arrow", "credential");
 }
-async function loadKeytar() {
+async function loadEntry() {
   try {
-    return await import("keytar");
+    const { AsyncEntry } = await import("@napi-rs/keyring");
+    return new AsyncEntry(SERVICE, ACCOUNT);
   } catch {
     return null;
   }
@@ -9444,10 +9445,10 @@ async function readFileFallback() {
   }
 }
 async function getToken() {
-  const keytar = await loadKeytar();
-  if (keytar) {
+  const entry = await loadEntry();
+  if (entry) {
     try {
-      const value = await keytar.getPassword(SERVICE, ACCOUNT);
+      const value = await entry.getPassword();
       if (value) return value;
     } catch (err) {
       debugSwallow("keychain.getToken", err);
@@ -9456,10 +9457,10 @@ async function getToken() {
   return readFileFallback();
 }
 async function setToken(token) {
-  const keytar = await loadKeytar();
-  if (keytar) {
+  const entry = await loadEntry();
+  if (entry) {
     try {
-      await keytar.setPassword(SERVICE, ACCOUNT, token);
+      await entry.setPassword(token);
       return true;
     } catch (err) {
       debugSwallow("keychain.setToken", err);
@@ -9475,10 +9476,10 @@ async function setToken(token) {
   }
 }
 async function deleteToken() {
-  const keytar = await loadKeytar();
-  if (keytar) {
+  const entry = await loadEntry();
+  if (entry) {
     try {
-      await keytar.deletePassword(SERVICE, ACCOUNT);
+      await entry.deletePassword();
     } catch (err) {
       debugSwallow("keychain.deleteToken", err);
     }
@@ -10507,6 +10508,17 @@ async function captureCliEvent(input) {
   }
 }
 
+// src/lib/workspace-target.ts
+var commandWorkspaceTarget;
+var savedWorkspaceTarget;
+function setCommandWorkspaceTarget(target, savedDefault) {
+  commandWorkspaceTarget = target?.trim() || void 0;
+  savedWorkspaceTarget = savedDefault?.trim() || void 0;
+}
+function getCommandWorkspaceTarget(options = {}) {
+  return commandWorkspaceTarget ?? (options.hasRepo ? void 0 : savedWorkspaceTarget);
+}
+
 // src/lib/client.ts
 var DEFAULT_TIMEOUT_MS2 = 3e4;
 var MAX_RETRIES = 5;
@@ -10559,11 +10571,13 @@ var GadClient = class {
   token;
   apiUrl;
   repoUrl;
+  workspaceId;
   timeout;
   constructor(options) {
     this.token = options.token;
     this.apiUrl = options.apiUrl.replace(/\/$/, "");
     this.repoUrl = options.repoUrl ?? detectGitOrigin();
+    this.workspaceId = options.workspaceId?.trim() || getCommandWorkspaceTarget({ hasRepo: Boolean(this.repoUrl) }) || null;
     this.timeout = options.timeout ?? DEFAULT_TIMEOUT_MS2;
   }
   /**
@@ -10581,6 +10595,9 @@ var GadClient = class {
     if (this.repoUrl) {
       headers["X-Repo-URL"] = this.repoUrl;
     }
+    if (this.workspaceId) {
+      headers["X-Workspace-Id"] = this.workspaceId;
+    }
     return headers;
   }
   /**
@@ -11136,11 +11153,22 @@ var switchCommand = new Command("switch").description("Set the active workspace
     noColor: false
   });
   const client = await createClient();
-  await client.mcpCall("workspace_switch", { workspaceId: nameOrId });
+  const result = await client.mcpCall("workspace_switch", {
+    workspaceId: nameOrId
+  });
+  const payload = typeof result === "object" && result !== null ? result : {};
+  const current = typeof payload.current_workspace === "object" && payload.current_workspace !== null ? payload.current_workspace : null;
+  const resolvedId = typeof current?.id === "string" ? current.id : nameOrId;
+  const resolvedName = typeof current?.name === "string" ? current.name : nameOrId;
   const config = await loadConfig();
-  config.default_workspace = nameOrId;
+  config.default_workspace = resolvedId;
   await saveConfig(config);
-  fmt.success(`Switched to workspace: ${nameOrId}`);
+  const previous = typeof payload.previous_workspace === "object" && payload.previous_workspace !== null ? payload.previous_workspace : null;
+  const previousName = typeof previous?.name === "string" ? previous.name : null;
+  const previousId = typeof previous?.id === "string" ? previous.id : void 0;
+  fmt.success(
+    previousName && previousId && previousName !== resolvedName ? `Switched workspace: ${previousName} \u2192 ${resolvedName} (use '${previousId}' to switch back)` : `Working in workspace: ${resolvedName}`
+  );
 });
 var infoColumns = [
   { key: "name", header: "Name" },
@@ -12669,6 +12697,7 @@ import { dirname as dirname4, join as join5 } from "node:path";
 import { execFileSync as execFileSync5 } from "node:child_process";
 var CODEX_SERVER_NAME = "great-arrow";
 var CODEX_CLIENT_ID = "codex-cli";
+var CODEX_APPROVAL_POLICY = 'approval_policy = "never"';
 var SAFE_GLOBAL_MCP_SERVERS = /* @__PURE__ */ new Set([
   CODEX_SERVER_NAME,
   "great-arrow-kiro-terminal",
@@ -12744,19 +12773,19 @@ function repoKey(repoUrl) {
     return null;
   }
 }
-function generateCodexConfigToml(apiUrl, repoUrl) {
-  const repoHeader = repoUrl ? `X-Repo-URL = "${tomlEscape(repoUrl)}"
-` : "";
-  return `approval_policy = "never"
+function generateCodexConfigToml(apiUrl, _repoUrl) {
+  return `${CODEX_APPROVAL_POLICY}
 
 [mcp_servers.${CODEX_SERVER_NAME}]
-url = "${tomlEscape(mcpEndpoint(apiUrl))}"
-bearer_token_env_var = "GREAT_ARROW_TOKEN"
+command = "npx"
+args = ["-y", "@great-arrow/cli", "mcp", "start"]
+env_vars = ["GREAT_ARROW_TOKEN"]
 
-[mcp_servers.${CODEX_SERVER_NAME}.http_headers]
-X-MCP-Client = "${CODEX_CLIENT_ID}"
+[mcp_servers.${CODEX_SERVER_NAME}.env]
+GAD_API_URL = "${tomlEscape(normalizeApiUrl(apiUrl))}"
+GAD_MCP_CLIENT = "${CODEX_CLIENT_ID}"
 ${GAD_INSTALL_HEADER} = "${GAD_INSTALL_VERSION}"
-${repoHeader}`;
+`;
 }
 function generateCodexEnv(token) {
   return `GREAT_ARROW_TOKEN=${token}
@@ -12768,8 +12797,10 @@ function extractCodexGreatArrowApiUrl(content) {
   );
   if (!text2) return null;
   const match = text2.match(/^\s*url\s*=\s*"([^"]+)"\s*$/m);
-  if (!match?.[1]) return null;
-  const url = match[1].trim();
+  const dynamicMatch = text2.match(/^\s*GAD_API_URL\s*=\s*"([^"]+)"\s*$/m);
+  const configured = match?.[1] ?? dynamicMatch?.[1];
+  if (!configured) return null;
+  const url = configured.trim();
   return url.endsWith("/api/mcp") ? url.slice(0, -"/api/mcp".length) : url.replace(/\/+$/, "");
 }
 function splitTomlSections(content) {
@@ -12818,14 +12849,20 @@ function removeServerSections(content, servers) {
   }).map((section) => section.text).join("").replace(/\n{3,}/g, "\n\n");
 }
 function upsertCodexServerBlock(existingContent, apiUrl, repoUrl) {
-  const block = generateCodexConfigToml(apiUrl, repoUrl).trimEnd();
+  const block = generateCodexConfigToml(apiUrl, repoUrl).replace(/^approval_policy\s*=.*\n\n/, "").trimEnd();
   const withoutGreatArrow = removeServerSections(
     existingContent,
     /* @__PURE__ */ new Set([CODEX_SERVER_NAME])
-  ).replace(/\s*$/, "");
-  if (!withoutGreatArrow) return `${block}
+  ).replace(/^\s*approval_policy\s*=.*(?:\n|$)/gm, "").replace(/^\s+/, "").replace(/\s*$/, "");
+  if (!withoutGreatArrow) {
+    return `${CODEX_APPROVAL_POLICY}
+
+${block}
 `;
-  return `${withoutGreatArrow}
+  }
+  return `${CODEX_APPROVAL_POLICY}
+
+${withoutGreatArrow}
 
 ${block}
 `;
@@ -12879,6 +12916,7 @@ function inspectCodexConfig(content, expectedRepoUrl) {
   const hasGreatArrowServer = grouped.has(CODEX_SERVER_NAME);
   const greatArrowInstallVersion = extractInstallVersion(greatArrowText);
   const greatArrowRepoKeys = extractConfiguredRepoKeys(greatArrowText);
+  const greatArrowUsesDynamicRepo = /^\s*command\s*=\s*"npx"\s*$/m.test(greatArrowText) && /@great-arrow\/cli/.test(greatArrowText) && /"mcp"\s*,\s*"start"/.test(greatArrowText) && !/(?:MEMORY_REPO_URL|GAD_REPO_URL)\s*=/.test(greatArrowText);
   const greatArrowHasRepoHeader = Boolean(
     expectedRepoKey && greatArrowRepoKeys.includes(expectedRepoKey)
   );
@@ -12908,10 +12946,10 @@ function inspectCodexConfig(content, expectedRepoUrl) {
   );
   if (expectedRepoKey) {
     issues.push(
-      greatArrowHasRepoHeader ? {
-        code: "repo_header_present",
+      greatArrowHasRepoHeader || greatArrowUsesDynamicRepo ? {
+        code: greatArrowUsesDynamicRepo ? "repo_routing_dynamic" : "repo_header_present",
         level: "pass",
-        message: `Great Arrow is pinned to ${expectedRepoUrl}.`
+        message: greatArrowUsesDynamicRepo ? "Great Arrow detects the current git origin for each Codex session." : `Great Arrow is pinned to ${expectedRepoUrl}.`
       } : {
         code: "repo_header_missing",
         level: "warn",
@@ -12977,6 +13015,7 @@ function inspectCodexConfig(content, expectedRepoUrl) {
     expectedRepoKey,
     hasGreatArrowServer,
     greatArrowHasRepoHeader,
+    greatArrowUsesDynamicRepo,
     greatArrowInstallVersion,
     greatArrowInstallVersionCurrent: Boolean(greatArrowInstallVersion) && compareVersion(greatArrowInstallVersion, GAD_INSTALL_VERSION) >= 0,
     unmanagedServers,
@@ -13361,6 +13400,62 @@ function inspectHookConfig(content) {
   }
   return { parseError: false, url, token, issues };
 }
+function collectConfiguredHooks(scope, file, content) {
+  let parsed;
+  try {
+    parsed = content.trim() ? JSON.parse(content) : {};
+  } catch {
+    return [];
+  }
+  const hooks = asObject(asObject(parsed)?.hooks ?? null);
+  if (!hooks) return [];
+  const out = [];
+  for (const [event, groups] of Object.entries(hooks)) {
+    if (!Array.isArray(groups)) continue;
+    for (const group of groups) {
+      if (!group || !Array.isArray(group.hooks)) continue;
+      for (const hook of group.hooks) {
+        if (hook && typeof hook.command === "string" && hook.command.trim()) {
+          out.push({ scope, file, event, command: hook.command });
+        }
+      }
+    }
+  }
+  return out;
+}
+function nodeScriptTarget(command) {
+  const m = command.match(/\bnode\s+(?:"([^"]+)"|'([^']+)'|(\S+))/);
+  return m ? m[1] ?? m[2] ?? m[3] ?? null : null;
+}
+function gadVerb(command) {
+  return command.match(/(?:^|[;&|]\s*)gad\s+([a-z][a-z-]*)/)?.[1] ?? null;
+}
+function inspectConfiguredHooks(hooks, deps) {
+  const issues = [];
+  for (const hook of hooks) {
+    const where = `${hook.event} hook in ${hook.file}`;
+    const verb = gadVerb(hook.command);
+    if (verb !== null && !deps.knownGadVerbs.has(verb)) {
+      issues.push({
+        code: "hook_unknown_gad_verb",
+        level: "fail",
+        message: `${where} runs \`gad ${verb}\`, which this CLI does not define \u2014 it fails on every ${hook.event}`,
+        hint: `Remove that hook from ${hook.file}, or correct the verb (\`gad --help\` lists them).`
+      });
+      continue;
+    }
+    const script = nodeScriptTarget(hook.command);
+    if (script && !script.includes("$") && !deps.fileExists(script)) {
+      issues.push({
+        code: "hook_script_missing",
+        level: "fail",
+        message: `${where} runs a script that does not exist: ${script}`,
+        hint: `Re-run the installer to restore it, or remove the hook from ${hook.file}.`
+      });
+    }
+  }
+  return issues;
+}
 
 // src/lib/mcp-doctor.ts
 import { createHash as createHash2 } from "node:crypto";
@@ -14395,6 +14490,49 @@ function claudeCommand() {
         }
       }
     }
+    {
+      let root = command;
+      while (root.parent) root = root.parent;
+      const knownGadVerbs = /* @__PURE__ */ new Set();
+      for (const sub of root.commands) {
+        knownGadVerbs.add(sub.name());
+        for (const alias of sub.aliases()) knownGadVerbs.add(alias);
+      }
+      const cwd = process.cwd();
+      const scopes = [
+        { scope: "managed", file: "/etc/claude-code/managed-settings.json" },
+        {
+          scope: "managed",
+          file: "/Library/Application Support/ClaudeCode/managed-settings.json"
+        },
+        { scope: "user", file: settingsPath },
+        { scope: "project", file: join5(cwd, ".claude", "settings.json") },
+        { scope: "local", file: join5(cwd, ".claude", "settings.local.json") }
+      ];
+      const configured = [];
+      for (const { scope, file } of scopes) {
+        if (!existsSync3(file)) continue;
+        configured.push(
+          ...collectConfiguredHooks(
+            scope,
+            file,
+            await readFile3(file, "utf8")
+          )
+        );
+      }
+      const hookIssues = inspectConfiguredHooks(configured, {
+        knownGadVerbs,
+        fileExists: existsSync3
+      });
+      toChecks("Configured hooks", hookIssues);
+      if (configured.length > 0 && hookIssues.length === 0) {
+        checks.push({
+          name: "Configured hooks: all runnable",
+          status: "pass",
+          message: `${configured.length} command hook(s) across ${new Set(configured.map((h) => h.file)).size} settings file(s) resolve`
+        });
+      }
+    }
     if (options.enforce) {
       const enforcement = {
         name: "Claude surface: enforcement",
@@ -14814,7 +14952,8 @@ async function resolveBridgeAuth(options = {}) {
   const explicit = [
     [options.tokenFlag, "flag"],
     [env4.GAD_API_TOKEN, "GAD_API_TOKEN"],
-    [env4.GAD_TOKEN, "GAD_TOKEN"]
+    [env4.GAD_TOKEN, "GAD_TOKEN"],
+    [env4.GREAT_ARROW_TOKEN, "GREAT_ARROW_TOKEN"]
   ];
   for (const [raw, source] of explicit) {
     const token = raw?.trim();
@@ -14859,12 +14998,15 @@ function buildBridgeHeaders(options) {
     accept: "application/json",
     authorization: `Bearer ${options.token}`,
     "user-agent": `gad-cli/${CLI_VERSION} gad-install/${GAD_INSTALL_VERSION}`,
-    "x-mcp-client": BRIDGE_CLIENT_ID,
+    "x-mcp-client": options.clientId?.trim().slice(0, 64) || BRIDGE_CLIENT_ID,
     [GAD_CLI_VERSION_HEADER]: CLI_VERSION,
     [GAD_INSTALL_HEADER]: GAD_INSTALL_VERSION
   };
   if (options.repoUrl) headers["x-repo-url"] = options.repoUrl;
+  if (options.workspaceId) headers["x-workspace-id"] = options.workspaceId;
   if (options.sessionId) headers["x-mcp-session-id"] = options.sessionId;
+  if (options.deviceName) headers["x-device-name"] = options.deviceName;
+  if (options.machineId) headers["x-machine-id"] = options.machineId;
   return headers;
 }
 function rpcError(id, code, message) {
@@ -14946,13 +15088,18 @@ async function runStdioBridge(options) {
   const timeoutMs = Number(env4.MEMORY_TIMEOUT_MS ?? DEFAULT_TIMEOUT_MS3);
   const sessionId = (env4.GAD_SESSION_ID ?? env4.MEMORY_SESSION_ID)?.trim() || `${BRIDGE_CLIENT_ID}:${Date.now()}-${randomUUID().slice(0, 8)}`;
   const repoUrl = (env4.GAD_REPO_URL ?? env4.MEMORY_REPO_URL)?.trim() || detectGitOrigin3();
+  const workspaceId = (env4.GAD_WORKSPACE_ID ?? env4.GAD_WORKSPACE)?.trim() || getCommandWorkspaceTarget({ hasRepo: Boolean(repoUrl) });
   const headers = buildBridgeHeaders({
     token: options.auth.token,
     repoUrl,
-    sessionId
+    workspaceId,
+    sessionId,
+    clientId: env4.GAD_MCP_CLIENT,
+    deviceName: env4.GAD_DEVICE_NAME,
+    machineId: env4.GAD_MACHINE_ID
   });
   writeErr(
-    `[gad mcp] Bridging stdio \u2194 ${endpoint} (auth: ${options.auth.source}${repoUrl ? `, repo: ${repoUrl}` : ""})`
+    `[gad mcp] Bridging stdio \u2194 ${endpoint} (auth: ${options.auth.source}${workspaceId ? `, workspace: ${workspaceId}` : ""}${repoUrl ? `, repo: ${repoUrl}` : ""})`
   );
   const config = { endpoint, headers, timeoutMs };
   const rl = createInterface2({ input, crlfDelay: Infinity });
@@ -15444,8 +15591,9 @@ async function readIfExists(path10) {
 }
 async function readKeychainOnly() {
   try {
-    const keytar = await import("keytar");
-    return await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    const { AsyncEntry } = await import("@napi-rs/keyring");
+    const entry = new AsyncEntry(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    return await entry.getPassword() ?? null;
   } catch {
     return null;
   }
@@ -15716,135 +15864,6 @@ ${c.dim("Credential migration")}
 var mcpCommand = new Command("mcp").description("Manage and diagnose the MCP server connection").addCommand(startCommand).addCommand(statusCommand).addCommand(logsCommand).addCommand(testCommand).addCommand(doctorSubcommand).addCommand(installCommand);
 var mcp_default = mcpCommand;
 
-// src/commands/deploy.ts
-var DEPLOY_TIMEOUT_MS = 9e4;
-function deployCommand() {
-  const cmd = new Command("deploy").description("Trigger a production deployment").option("--confirm", "Skip interactive confirmation (required in CI)").option("--json", "Output as JSON").option("--quiet", "Suppress decorative output").option("--no-color", "Disable color output").action(async (options, command) => {
-    const g = globalOutputOpts(command);
-    const fmt = createFormatter({
-      json: g.json,
-      quiet: g.quiet,
-      isTTY: isTTY(),
-      noColor: g.noColor
-    });
-    if (!options.confirm) {
-      if (!isTTY()) {
-        fmt.error(
-          "Cannot deploy without confirmation in non-interactive mode."
-        );
-        fmt.info("Pass --confirm to bypass interactive confirmation in CI.");
-        process.exit(3 /* VALIDATION_ERROR */);
-      }
-      const confirmed = await confirm(
-        "\u26A0\uFE0F  This will deploy to production. Continue?"
-      );
-      if (!confirmed) {
-        fmt.info("Deploy cancelled.");
-        return;
-      }
-    }
-    const auth = await resolveAuth();
-    const client = new GadClient({
-      token: auth.token,
-      apiUrl: auth.apiUrl,
-      timeout: DEPLOY_TIMEOUT_MS
-    });
-    if (!options.quiet) {
-      fmt.info("Deploying to production...");
-    }
-    const result = await client.mcpCall("deploy_to_vercel", {});
-    if (g.json) {
-      process.stdout.write(JSON.stringify(result) + "\n");
-      return;
-    }
-    if (result.error) {
-      fmt.error(`Deployment failed: ${result.error}`);
-      process.exit(2 /* NETWORK_ERROR */);
-    }
-    if (result.url) {
-      fmt.success(`Deployment triggered successfully`);
-      fmt.info(`URL: ${result.url}`);
-    } else {
-      fmt.success("Deployment triggered successfully");
-    }
-    if (result.status) {
-      fmt.info(`Status: ${result.status}`);
-    }
-    if (result.buildId) {
-      fmt.info(`Build ID: ${result.buildId}`);
-    }
-  });
-  return cmd;
-}
-
-// src/commands/migrate.ts
-async function ensureConfirmation(hasConfirmFlag, tty2) {
-  if (hasConfirmFlag) {
-    return true;
-  }
-  if (!tty2) {
-    process.stderr.write(
-      "\u2717 --confirm flag is required in non-interactive environments.\n  Use: gad migrate --confirm\n"
-    );
-    process.exit(3 /* VALIDATION_ERROR */);
-  }
-  const confirmed = await confirm(
-    "This will run pending database migrations. Continue?"
-  );
-  if (!confirmed) {
-    process.stderr.write("Aborted.\n");
-  }
-  return confirmed;
-}
-function displayResults(result, fmt) {
-  const applied = result?.applied ?? 0;
-  const migrations = result?.migrations;
-  if (applied === 0) {
-    fmt.success("No pending migrations. Database is up to date.");
-    return;
-  }
-  fmt.success(
-    `${applied} migration${applied === 1 ? "" : "s"} applied successfully.`
-  );
-  if (migrations && migrations.length > 0) {
-    fmt.table(migrations, [
-      { key: "name", header: "Migration", width: 40 },
-      { key: "status", header: "Status", width: 12 }
-    ]);
-  }
-}
-var migrateCommand = new Command("migrate").description("Run pending database migrations").option("--confirm", "Skip confirmation prompt (required in non-TTY)").option("--json", "Output results as JSON").option("--quiet", "Suppress decorative output").action(async (opts, command) => {
-  const g = globalOutputOpts(command);
-  const tty2 = isTTY();
-  const fmt = createFormatter({
-    json: g.json,
-    quiet: g.quiet,
-    isTTY: tty2,
-    noColor: !tty2
-  });
-  const confirmed = await ensureConfirmation(Boolean(opts.confirm), tty2);
-  if (!confirmed) {
-    return;
-  }
-  const auth = await resolveAuth();
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
-  fmt.info("Running pending migrations\u2026");
-  const result = await client.mcpCall("apply_migration", {});
-  if (g.json) {
-    const applied = result?.applied ?? 0;
-    const status = result?.status ?? "complete";
-    fmt.table(
-      [{ applied, status }],
-      [
-        { key: "applied", header: "Applied" },
-        { key: "status", header: "Status" }
-      ]
-    );
-  } else {
-    displayResults(result, fmt);
-  }
-});
-
 // src/commands/smoke.ts
 var SMOKE_TESTS = [
   {
@@ -17350,10 +17369,12 @@ function renderFooter(payload, apiUrl) {
   lines.push(`${c.dim("\u2192")} ${c.cyan("gad status")} for the full picture.`);
   process.stderr.write("\n" + brandedBlock("needs you", lines) + "\n");
 }
+var GAD_LOGO = `<img src="https://www.greatarrow.ai/icon.svg" width="16" alt="Great Arrow" style="vertical-align:middle;display:inline-block;margin-right:4px;" />`;
 function brandedBlock(title, lines) {
-  const header = `\u{1F3F9} Great Arrow \xB7 ${title}`;
-  const rule = "\u2500".repeat(Math.min(60, header.length));
-  return [header, rule, ...lines].join("\n");
+  const header = `${GAD_LOGO} **Great Arrow** \xB7 ${title}`;
+  const visualLength = header.replace(GAD_LOGO, "  ").length;
+  const rule = "\u2500".repeat(Math.min(60, visualLength));
+  return [header, rule, ...lines].join("\\n");
 }
 
 // src/commands/status.ts
@@ -17632,8 +17653,6 @@ var COMMANDS = [
   "doctor",
   "integrations",
   "mcp",
-  "deploy",
-  "migrate",
   "smoke",
   "agent",
   "ask",
@@ -17706,8 +17725,6 @@ _gad() {
     'doctor:Run health checks'
     'integrations:Manage integrations (list, sync)'
     'mcp:MCP server management (status, logs, test, install)'
-    'deploy:Deploy to production'
-    'migrate:Run database migrations'
     'smoke:Run smoke tests'
     'agent:Manage agents (list, invoke)'
     'ask:Ask the orchestrator a question'
@@ -17766,8 +17783,6 @@ function generateFish() {
     doctor: "Run health checks",
     integrations: "Manage integrations",
     mcp: "MCP server management",
-    deploy: "Deploy to production",
-    migrate: "Run database migrations",
     smoke: "Run smoke tests",
     agent: "Manage agents",
     ask: "Ask the orchestrator a question",
@@ -21243,7 +21258,18 @@ if (shouldRunUpdateNotifier(process.argv)) {
     pkg: { name: CLI_PACKAGE_NAME, version: CLI_VERSION }
   }).notify();
 }
-var program2 = new Command().name("gad").description("Great Arrow Digital CLI \u2014 terminal access to the GAD platform").version(CLI_VERSION, "-v, --version").option("--json", "Output as JSON").option("--quiet", "Suppress decorative output").option("--no-color", "Disable color output").option("--no-glance", "Suppress the ambient proactive footer");
+var program2 = new Command().name("gad").description("Great Arrow Digital CLI \u2014 terminal access to the GAD platform").version(CLI_VERSION, "-v, --version").option("--json", "Output as JSON").option("--quiet", "Suppress decorative output").option("--no-color", "Disable color output").option("--no-glance", "Suppress the ambient proactive footer").option(
+  "--workspace <id-or-slug-or-name>",
+  "Target one accessible workspace for this command without changing the saved default"
+);
+program2.hook(
+  "preAction",
+  async (_thisCommand, actionCommand) => {
+    const options = actionCommand.optsWithGlobals();
+    const config = await loadConfig();
+    setCommandWorkspaceTarget(options.workspace, config.default_workspace);
+  }
+);
 void captureCliEvent({
   apiUrl: process.env.GAD_API_URL ?? "https://www.greatarrow.ai",
   name: "startup",
@@ -21268,8 +21294,6 @@ program2.addCommand(mcp_default);
 program2.addCommand(agentCommand);
 program2.addCommand(askCommand());
 program2.addCommand(localCommand());
-program2.addCommand(deployCommand());
-program2.addCommand(migrateCommand);
 program2.addCommand(smokeCommand());
 program2.addCommand(openCommand());
 program2.addCommand(completionsCommand());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@great-arrow/cli",
-  "version": "0.1.20",
+  "version": "0.1.25",
   "description": "GreatArrow.ai CLI tool",
   "type": "module",
   "bin": {
@@ -17,11 +17,13 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@napi-rs/keyring": "1.3.0",
     "commander": "^15.0.0",
-    "update-notifier": "^7.3.1"
+    "update-notifier": "^7.3.1",
+    "nanoid": "^3.3.18"
   },
   "devDependencies": {
-    "@types/node": "^26.1.1",
+    "@types/node": "^26.1.2",
     "esbuild": "^0.28.1",
     "fast-check": "^4.9.0",
     "typescript": "^7.0.2",
@@ -44,11 +46,8 @@
     "url": "https://www.greatarrow.ai/support"
   },
   "author": "GreatArrow.ai <support@greatarrow.ai>",
-  "optionalDependencies": {
-    "keytar": "^7.9.0"
-  },
   "overrides": {
     "postcss": ">=8.5.23",
-    "nanoid": "^3.3.17"
+    "nanoid": "^3.3.18"
   }
 }