@intutic/cli 2.7.0 → 2.8.1

package/README.md

@@ -1,6 +1,6 @@
 # @intutic/cli
 
-> AI governance control plane for developer workspaces.
+> AI governance for developer workspaces.
 
 Intutic intercepts agent-to-LLM traffic, enforces SOPs, detects anomalies, and tracks costs — all without changing how your team codes.
 
@@ -21,6 +21,7 @@ intutic start              # Run the proxy standalone — no account needed
 intutic traces list        # See governance verdicts
 ```
 
+<!-- UNRELEASED:cloud
 **With a control plane:**
 
 ```bash
@@ -29,6 +30,7 @@ intutic init               # Detect harnesses, record them for sync
 intutic connect            # Start sync daemon — writes harness rules and gates
 intutic traces list        # See governance verdicts
 ```
+-->
 
 ## Commands
 
@@ -36,13 +38,17 @@ intutic traces list        # See governance verdicts
 |---------|-------------|
 | `intutic init` | Initialize workspace — detect harnesses, record them in `~/.intutic/config.json` |
 | `intutic start` | Start the proxy standalone — no account or control plane needed (`--port`, `--upstream-url`) |
+| `intutic status` | Show workspace status — auth, harnesses, sync state |
+| `intutic disconnect` | Undo `intutic connect` — restore the harness configs it changed, remove its services, log out (`--harness`, `--dry-run`, `--keep-login`) |
+| `intutic doctor` | Diagnose workspace health — proxy, auth, daemon, configs, logs |
+| `intutic traces list` | List execution traces (`--limit`, `--since`, `--action` with a control plane, `--verdict` without one, `--model`, `--json`) |
+| `intutic traces inspect <id>` | Show full detail of a single trace |
+<!-- UNRELEASED:cloud
 | `intutic login` | Authenticate with control plane (`--api-key`, `--control-plane-url`, `--dev`) |
 | `intutic logout` | Clear stored credentials |
-| `intutic status` | Show workspace status — auth, harnesses, sync state |
 | `intutic whoami` | Show current authenticated identity |
 | `intutic connect` | Start sync daemon — bidirectional config sync (`--interval`) |
-| `intutic traces list` | List execution traces (`--limit`, `--since`, `--action`, `--verdict`, `--model`, `--json`) |
-| `intutic traces inspect <id>` | Show full detail of a single trace |
+-->
 
 ## Supported Harnesses
 
@@ -58,7 +64,7 @@ Intutic auto-detects and configures AI coding harnesses, among them:
 | **n8n** | Running n8n instance (`N8N_URL`, default `http://localhost:5678`) | Workflow JSON file + external hook gate `~/.intutic/hooks/n8n-governance-hook.js` |
 | **OpenClaw** | `~/.openclaw/` or `.openclaw/openclaw.json` | `AGENTS.md` section in its agent workspace + `~/.intutic/hooks/openclaw/intutic-governance.cjs` (plugin gate, listed in `~/.openclaw/openclaw.json`) |
 | **Hermes** | `~/.hermes/` or `.hermes/config.yaml` | `AGENTS.md` section + `hooks.pre_tool_call` gate in `~/.hermes/config.yaml` |
-| **OpenCode** | `.opencode/`, `opencode.json`, `~/.config/opencode/` or `opencode` on PATH | `AGENTS.md` + `.opencode/plugins/intutic-governance.js` (plugin gate) |
+| **OpenCode** | `.opencode/`, `opencode.json`, `~/.config/opencode/` or `opencode` on PATH | `AGENTS.md` + `.opencode/plugins/intutic-governance.js` (plugin gate; OpenCode 2.x: `.opencode/plugins/intutic-governance/index.js`) |
 
 ## Trace Inspection
 
@@ -68,13 +74,16 @@ View governance verdicts directly from the terminal:
 # List recent traces (last 24h)
 intutic traces list
 
-# Filter by enforcement action
+# Filter by enforcement action (connected to a control plane)
 intutic traces list --action KILL
 
+# Filter by the proxy's verdict (standalone: `intutic start`, no login)
+intutic traces list --verdict killed
+
 # Filter by model and time window
 intutic traces list --model claude-4 --since 7d
 
-# JSON output for scripting
+# JSON output for scripting (connected; standalone rows carry `.verdict`)
 intutic traces list --json | jq '.traces[] | select(.enforcementAction == "HIJACK")'
 
 # Inspect a specific trace
@@ -93,6 +102,7 @@ Credentials are stored at `~/.intutic/credentials.json` (mode `0600`).
 | `INTUTIC_DEV` | `1` targets the local control plane (`http://localhost:3001`), like `--dev` |
 | `INTUTIC_PROXY_URL` | Local proxy URL; its port is the proxy port (default `4000`) |
 
+<!-- UNRELEASED:cloud
 For non-interactive auth, use `intutic login --api-key vk_...`.
 
 ### Development Mode
@@ -104,6 +114,7 @@ intutic login --dev
 intutic connect --dev
 intutic traces list --dev
 ```
+-->
 
 ## Documentation
 

package/dist/cli.js

@@ -9,8 +9,9 @@
  *
  * @module
  */
-import { Command } from 'commander';
+import { Command, Option } from 'commander';
 import { createRequire } from 'node:module';
+import { CLOUD_RELEASED, CONTROL_PLANE_PRODUCT_RELEASED, HOSTED_CONTROL_PLANE_URL, SELF_HOST_RELEASED, } from '@intutic/shared-types';
 import { DEFAULT_SANDBOX_IMAGE } from './lib/sandbox/image.js';
 // Read the version from package.json rather than repeating it here. The literal
 // that used to live below said 1.6.0 for three releases running, so
@@ -20,13 +21,37 @@ import { DEFAULT_SANDBOX_IMAGE } from './lib/sandbox/image.js';
 // but JSON imports still need an assertion on older runtimes.
 const { version } = createRequire(import.meta.url)('../package.json');
 const program = new Command();
+// Release flags (packages/shared-types/src/release.ts). A command that only
+// works against a control plane, or only in the self-hosted distribution, is
+// left out of help until that product is released. Hidden is all it is: the
+// command still parses and runs, so staging and existing users are unaffected.
+const needsControlPlane = { hidden: !CONTROL_PLANE_PRODUCT_RELEASED };
+const needsSelfHost = { hidden: !SELF_HOST_RELEASED };
+/** An option of a visible command that only does anything against a control plane. */
+function controlPlaneOption(flags, description) {
+    const option = new Option(flags, description);
+    return CONTROL_PLANE_PRODUCT_RELEASED ? option : option.hideHelp();
+}
+// A command that needs a control plane, run with none configured, throws
+// NoControlPlaneError (config/paths.ts) from an async action. Say that plainly
+// rather than as an unhandled rejection with a stack; anything else still
+// crashes as before.
+process.on('unhandledRejection', (err) => {
+    if (err instanceof Error && err.name === 'NoControlPlaneError') {
+        console.error(err.message);
+        process.exit(1);
+    }
+    throw err;
+});
 // Positional options: `--version` and `--help` belong to the program only when
 // they come before a subcommand. Without this, commander matches program
 // options anywhere on the line, so a subcommand option named `--version` would
 // print the CLI version and exit before its command ever saw it.
 program
     .name('intutic')
-    .description('Intutic CLI — AI governance control plane for developer workspaces')
+    .description(CONTROL_PLANE_PRODUCT_RELEASED
+    ? 'Intutic CLI — AI governance control plane for developer workspaces'
+    : 'Intutic CLI — open-core AI governance for developer workspaces: a local proxy, gates and policy for coding agents')
     .version(version)
     .enablePositionalOptions();
 program
@@ -49,7 +74,7 @@ program
     await runSetup(opts);
 });
 const judgeCmd = program
-    .command('judge')
+    .command('judge', needsSelfHost)
     .description('Configure the LLM-as-judge path');
 judgeCmd
     .command('configure')
@@ -60,7 +85,7 @@ judgeCmd
     await runJudgeConfigure(opts);
 });
 program
-    .command('login')
+    .command('login', needsControlPlane)
     .description('Authenticate with the Intutic control plane')
     .option('--api-key <key>', 'Authenticate with an API key (vk_*)')
     .option('--control-plane-url <url>', 'Control plane to log in to (e.g. a self-hosted one); saved for every later command')
@@ -80,7 +105,7 @@ program
     await runDisconnect({ harness: opts.harness, dryRun: opts.dryRun, keepLogin: opts.keepLogin });
 });
 program
-    .command('logout')
+    .command('logout', needsControlPlane)
     .description('Clear stored credentials')
     .action(async () => {
     const { runLogout } = await import('./commands/logout.js');
@@ -111,7 +136,9 @@ program
 });
 const budgetCmd = program
     .command('budget')
-    .description('Check remaining daily/monthly budget and list active loops; set workspace, key and member budgets')
+    .description(CONTROL_PLANE_PRODUCT_RELEASED
+    ? 'Check remaining daily/monthly budget and list active loops; set workspace, key and member budgets'
+    : 'Check the local spending cap and what this machine has spent today')
     .option('--dev', 'Use local control plane (http://localhost:3001)')
     .option('--watch', 'Continuously print machine-local and workspace spend, one line per tick')
     .option('--interval <seconds>', 'Tick interval in seconds for --watch', String(5))
@@ -125,7 +152,7 @@ const budgetCmd = program
     await runBudget(opts);
 });
 budgetCmd
-    .command('set')
+    .command('set', needsControlPlane)
     .description("Set the workspace's daily and monthly caps, alert threshold and whether each cap refuses requests (OWNER, ADMIN)")
     .option('--daily <usd>', 'Daily cap in USD (0: no daily cap; default: back to the $100 default)')
     .option('--monthly <usd>', 'Monthly cap in USD (0: no monthly cap; default: back to the $500 default)')
@@ -141,7 +168,7 @@ budgetCmd
     await runBudgetSet(cmd.optsWithGlobals());
 });
 budgetCmd
-    .command('keys')
+    .command('keys', needsControlPlane)
     .description("Every virtual key's spend budgets, rate limit and spend today and this month")
     .option('--json', 'Output as JSON')
     .option('--dev', 'Use local control plane (http://localhost:3001)')
@@ -150,7 +177,7 @@ budgetCmd
     await runBudgetKeys(cmd.optsWithGlobals());
 });
 budgetCmd
-    .command('key <keyId>')
+    .command('key <keyId>', needsControlPlane)
     .description("Set a virtual key's spend budgets and rate limit (OWNER, ADMIN)")
     .option('--daily <usd>', 'Day budget in USD, or none to remove it')
     .option('--monthly <usd>', 'Month budget in USD, or none to remove it')
@@ -165,7 +192,7 @@ budgetCmd
     await runBudgetKey(keyId, cmd.optsWithGlobals());
 });
 budgetCmd
-    .command('members')
+    .command('members', needsControlPlane)
     .description("The default member budget, and each member's budgets and spend (Biz Org+)")
     .option('--json', 'Output as JSON')
     .option('--dev', 'Use local control plane (http://localhost:3001)')
@@ -174,7 +201,7 @@ budgetCmd
     await runBudgetMembers(cmd.optsWithGlobals());
 });
 budgetCmd
-    .command('member <memberId>')
+    .command('member <memberId>', needsControlPlane)
     .description("Set a member's spend budgets, or the default member budget with `default` (OWNER, ADMIN; Biz Org+)")
     .option('--daily <usd>', 'Day budget in USD, or none to remove it')
     .option('--monthly <usd>', 'Month budget in USD, or none to remove it')
@@ -187,7 +214,7 @@ budgetCmd
     await runBudgetMember(memberId, cmd.optsWithGlobals());
 });
 program
-    .command('predict-cost')
+    .command('predict-cost', needsControlPlane)
     .description('Pre-flight cost estimate for a prompt/task before it runs (requires `intutic login`). ' +
     "Estimates output tokens from the workspace's recorded usage and prices them with the same " +
     'rate table as every other cost figure the control plane reports.')
@@ -201,7 +228,7 @@ program
     await runPredictCost(opts);
 });
 const sopsCmd = program
-    .command('sops')
+    .command('sops', needsControlPlane)
     .description('Manage local and global SOP rules');
 sopsCmd
     .command('push <name>')
@@ -247,11 +274,35 @@ sopsCmd
     const { runSopsOrgRm } = await import('./commands/sops.js');
     await runSopsOrgRm(orgSopId, opts);
 });
+// ── SOP Optimizer approval mode ──────────────────────────────────────────
+const optimizerCmd = program
+    .command('optimizer', needsControlPlane)
+    .description("Read and set the SOP Optimizer's approval mode (whether it may auto-apply strengthening proposals)");
+optimizerCmd
+    .command('settings')
+    .description('Print the approval mode and the auto-apply threshold')
+    .option('--json', 'Output as JSON')
+    .option('--dev', 'Use local control plane (http://localhost:3001)')
+    .action(async (opts) => {
+    const { runOptimizerSettings } = await import('./commands/optimizer.js');
+    await runOptimizerSettings(opts);
+});
+optimizerCmd
+    .command('set')
+    .description('Set the approval mode, and optionally the auto-apply threshold (OWNER, ADMIN)')
+    .requiredOption('--mode <mode>', 'manual (nothing is auto-applied) or auto')
+    .option('--auto-threshold <n>', 'Score from 0 to 1 a proposal needs to be auto-applied (default: keep the current one)')
+    .option('--json', 'Output as JSON')
+    .option('--dev', 'Use local control plane (http://localhost:3001)')
+    .action(async (opts) => {
+    const { runOptimizerSet } = await import('./commands/optimizer.js');
+    await runOptimizerSet(opts);
+});
 const policyCmd = program
     .command('policy')
-    .description('WASM rules and the policy snapshot');
+    .description(CONTROL_PLANE_PRODUCT_RELEASED ? 'WASM rules and the policy snapshot' : 'WASM rules: compile, test and install them locally');
 policyCmd
-    .command('snapshot')
+    .command('snapshot', needsControlPlane)
     .description('Compile workspace policy to ~/.intutic/hooks/policy-snapshot.rules — the file every gate reads.\n' +
     '\n' +
     '  Does only that. \'intutic connect\' writes it too, but as one step of\n' +
@@ -274,10 +325,10 @@ policyCmd
     .command('compile')
     .description('Compile an AssemblyScript rule to WASM (wraps asc)')
     .option('--src <path>', 'Rule source entry file (default: assembly/index.ts)')
-    .option('--out <path>', 'Output .wasm path (default: build/rule.wasm, or build/<candidate>.wasm with --candidate)')
+    .option('--out <path>', `Output .wasm path (default: build/rule.wasm${CONTROL_PLANE_PRODUCT_RELEASED ? ', or build/<candidate>.wasm with --candidate' : ''})`)
     .option('--debug', 'Include debug info and source maps')
-    .option('--candidate <id>', 'Compile a rule candidate from its source of record on the control plane (fetched and hash-verified; not with --src)')
-    .option('--upload', 'With --candidate: upload the bundle to the candidate with its source hash and print the gate results')
+    .addOption(controlPlaneOption('--candidate <id>', 'Compile a rule candidate from its source of record on the control plane (fetched and hash-verified; not with --src)'))
+    .addOption(controlPlaneOption('--upload', 'With --candidate: upload the bundle to the candidate with its source hash and print the gate results'))
     .option('--dev', 'Use local control plane (http://localhost:3001)')
     .action(async (opts) => {
     const { runPolicyCompile } = await import('./commands/policy.js');
@@ -301,7 +352,7 @@ policyCmd
     await runPolicyListLocal();
 });
 policyCmd
-    .command('replay <ruleId>')
+    .command('replay <ruleId>', needsControlPlane)
     .description("Replay a rule (installed or not) against this workspace's own recent traffic and report " +
     'what it would have done, without touching enforcement.')
     .option('--limit <n>', 'Max sampled contexts to replay against (default 500, capped at 5000)')
@@ -347,7 +398,7 @@ rulesCmd
 // `intutic sops` is files on disk; this namespace is the cited guardrails
 // extracted from policy documents and their shadow -> promote lifecycle.
 const guardrailsCmd = program
-    .command('guardrails')
+    .command('guardrails', needsControlPlane)
     .description('Policy documents, cited clauses and the guardrails compiled from them');
 const guardrailsSourcesCmd = guardrailsCmd
     .command('sources')
@@ -590,7 +641,7 @@ guardrailsCmd
     await runGuardrailsPull(opts);
 });
 program
-    .command('whoami')
+    .command('whoami', needsControlPlane)
     .description('Show current authenticated identity')
     .option('--dev', 'Use local control plane (http://localhost:3001)')
     .action(async (opts) => {
@@ -633,7 +684,7 @@ for (const [action, desc] of [
     });
 }
 enforceCmd
-    .command('report')
+    .command('report', needsControlPlane)
     .description('Report locally recorded enforcement state (firewall/CA-trust/system-hooks) to the control plane. ' +
     'No privilege needed — for when apply/remove ran elevated and could not reach stored credentials.')
     .action(async () => {
@@ -646,7 +697,7 @@ enforceCmd
 // tools/scripts/intutic-enterprise-install.sh, an unrelated air-gapped
 // docker-compose installer. Does not touch the host firewall; see `enforce`.
 const enterpriseCmd = program
-    .command('enterprise')
+    .command('enterprise', needsControlPlane)
     .description('Enterprise fleet rollout: CA trust, Cursor system hooks, MDM manifests');
 enterpriseCmd
     .command('install')
@@ -685,7 +736,7 @@ envCmd
     await runEnvClear();
 });
 program
-    .command('connect')
+    .command('connect', needsControlPlane)
     .description('Start sync daemon — bidirectional config sync with control plane (requires an account)')
     .option('--dev', 'Use local control plane (http://localhost:3001)')
     .option('--interval <ms>', 'Poll interval in milliseconds', '30000')
@@ -697,7 +748,7 @@ program
     await runConnect(opts);
 });
 program
-    .command('sync-context')
+    .command('sync-context', needsControlPlane)
     .description('Record the Git branch and commit in .intutic/git-context.json, which a running `intutic connect` reports')
     .option('--git', 'Read the branch and commit from the repository (for any not given below)')
     .option('--branch <name>', 'Current Git branch name')
@@ -707,7 +758,7 @@ program
     await runSyncContext(opts);
 });
 program
-    .command('decisions-log-refresh')
+    .command('decisions-log-refresh', needsControlPlane)
     .description('One-shot refresh of the governed decisions log (.intutic/DECISIONS.md, and the recent ' +
     'entries in each governed harness\'s instructions file) — no-ops if decisionsLogEnabled is off. Invoked by the optional ' +
     'post-merge Git hook `intutic init` installs; safe to run manually.')
@@ -809,7 +860,7 @@ traces
 });
 // ── Findings (detector_findings adjudication) ───────────────────────────────
 const findings = program
-    .command('findings')
+    .command('findings', needsControlPlane)
     .description('Query and adjudicate detector findings — the TP/FP labeling surface');
 findings
     .command('list')
@@ -856,7 +907,7 @@ findings
 });
 // ── Governance incidents ───────────────────────────────────────────────────
 const incidentsCmd = program
-    .command('incidents')
+    .command('incidents', needsControlPlane)
     .description('Governance incidents, as on Findings › Incidents (OWNER, ADMIN, EM)');
 incidentsCmd
     .command('list')
@@ -883,7 +934,7 @@ incidentsCmd
 });
 // ── Trace integrity ────────────────────────────────────────────────────────
 const integrity = program
-    .command('integrity')
+    .command('integrity', needsControlPlane)
     .description('Verify sealed trace roots — list, re-derive, walk the root chain, and walk the config snapshot chain');
 integrity
     .command('roots')
@@ -926,7 +977,7 @@ integrity
 });
 // ── Routing reports ─────────────────────────────────────────────────────────
 const routing = program
-    .command('routing')
+    .command('routing', needsControlPlane)
     .description('Read-only reports for the routing subsystem');
 routing
     .command('adoption-report')
@@ -965,7 +1016,7 @@ function defineDaemonInstall(cmd) {
         '  Use \'intutic daemon stop\' or \'intutic daemon uninstall\'.')
         .option('--workspace-id <id>', 'Workspace ID (e.g. wk_xxxx) — required unless --proxy')
         .option('--api-key <key>', 'Workspace API key (e.g. vk_xxxx) — required unless --proxy')
-        .option('--control-plane-url <url>', 'Control plane the daemon connects to (default: $INTUTIC_CONTROL_PLANE_URL, then a workspace set up with `intutic init --dev`, then the URL saved by `intutic login`, then https://api.intutic.ai)')
+        .option('--control-plane-url <url>', `Control plane the daemon connects to (default: $INTUTIC_CONTROL_PLANE_URL, then a workspace set up with \`intutic init --dev\`, then the URL saved by \`intutic login\`${CLOUD_RELEASED ? `, then ${HOSTED_CONTROL_PLANE_URL}` : ''})`)
         .option('--binary-path <path>', 'Path to intutic CLI binary (defaults to current process); with --proxy, absolute path to intutic-proxy')
         .option('--dry-run', 'Print what would be done without writing files')
         .option('--system', 'Install as a system-level service (LaunchDaemon on macOS, systemd system unit on Linux)')
@@ -1098,7 +1149,7 @@ skillCmd
 });
 // ── Loop commands ──────────────────────────────────────────────────────────
 const loopCmd = program
-    .command('loop')
+    .command('loop', needsControlPlane)
     .description('Manage and execute recursive agent loops with budget limits');
 loopCmd
     .command('start')
@@ -1166,7 +1217,7 @@ loopCmd
 // module doc for why `intutic loop review` was never the right command for
 // this — it addresses a different id space (Loop Runs, not decisions).
 const decisionCmd = program
-    .command('decision')
+    .command('decision', needsControlPlane)
     .description('Approve or reject a decision (e.g. a review_before hold) held for human review');
 decisionCmd
     .command('approve <holdId>')
@@ -1192,7 +1243,7 @@ decisionCmd
 // hand-written curl against services/control-plane/src/routes/gateways.ts —
 // see commands/gateway.ts's module doc.
 const gatewayCmd = program
-    .command('gateway')
+    .command('gateway', needsControlPlane)
     .description('Manage self-hosted gateway registrations (Docker / Kubernetes / bare metal)');
 gatewayCmd
     .command('register')
@@ -1290,7 +1341,7 @@ gatewayCmd
 // Provision a workspace's own upstream provider keys — the BYO-key wizard's
 // API, previously dashboard-only. See commands/credentials.ts's module doc.
 const credentialsCmd = program
-    .command('credentials')
+    .command('credentials', needsControlPlane)
     .description('Manage this workspace\'s own upstream provider API keys (BYO-key)');
 credentialsCmd
     .command('list')
@@ -1334,7 +1385,7 @@ credentialsCmd
 // "CLI mints, dashboard audits": this is the mint/inspect half. See
 // commands/attenuate.ts's module doc.
 const attenuateCmd = program
-    .command('attenuate')
+    .command('attenuate', needsControlPlane)
     .description('Attenuate one of your API keys to a child key with narrower scopes (and an optional TTL)')
     .option('--parent-key <keyId>', 'Parent API key ID to attenuate')
     .option('--caps <scopes>', 'Comma-separated API key scopes for the child key (e.g. gateway:use,traces:read); each must be granted by the parent key')
@@ -1352,9 +1403,54 @@ attenuateCmd
     const { runAttenuateChain } = await import('./commands/attenuate.js');
     await runAttenuateChain(chainId, opts);
 });
+// ── API keys and their scopes ────────────────────────────────────────────
+const keysCmd = program
+    .command('keys', needsControlPlane)
+    .description('List, create, re-scope and revoke your API keys');
+keysCmd
+    .command('list')
+    .description('List your API keys with their scopes and expiry')
+    .option('--json', 'Output as JSON')
+    .option('--dev', 'Use local control plane (http://localhost:3001)')
+    .action(async (opts) => {
+    const { runKeysList } = await import('./commands/keys.js');
+    await runKeysList(opts);
+});
+keysCmd
+    .command('create')
+    .description('Create an API key and print it once')
+    .requiredOption('--label <label>', 'A name for the key')
+    .option('--scopes <scopes>', 'Comma-separated API key scopes (default: *, everything your role allows)')
+    .option('--expires-in-days <n>', 'Expire the key after this many days (1-365; default: never)')
+    .option('--service-account', 'An automation key: exempt from the SSO idle-key check')
+    .option('--json', 'Output as JSON')
+    .option('--dev', 'Use local control plane (http://localhost:3001)')
+    .action(async (opts) => {
+    const { runKeysCreate } = await import('./commands/keys.js');
+    await runKeysCreate(opts);
+});
+keysCmd
+    .command('update <keyId>')
+    .description("Replace a key's scopes (OWNER, ADMIN)")
+    .requiredOption('--scopes <scopes>', 'Comma-separated API key scopes the key will hold')
+    .option('--json', 'Output as JSON')
+    .option('--dev', 'Use local control plane (http://localhost:3001)')
+    .action(async (keyId, opts) => {
+    const { runKeysUpdate } = await import('./commands/keys.js');
+    await runKeysUpdate(keyId, opts);
+});
+keysCmd
+    .command('revoke <keyId>')
+    .description('Revoke one of your API keys')
+    .option('--json', 'Output as JSON')
+    .option('--dev', 'Use local control plane (http://localhost:3001)')
+    .action(async (keyId, opts) => {
+    const { runKeysRevoke } = await import('./commands/keys.js');
+    await runKeysRevoke(keyId, opts);
+});
 // ── Org signup + team management ─────────────────────────────────────────
 const orgCmd = program
-    .command('org')
+    .command('org', needsControlPlane)
     .description('Create and manage orgs');
 orgCmd
     .command('create')
@@ -1369,7 +1465,7 @@ orgCmd
     await runOrgCreate(opts);
 });
 const teamCmd = program
-    .command('team')
+    .command('team', needsControlPlane)
     .description('Manage teams and workspaces under an org');
 teamCmd
     .command('list')
@@ -1418,7 +1514,7 @@ teamCmd
 // route. Previously dashboard-only. See commands/apiCommand.ts for the shape
 // they share.
 const settingsCmd = program
-    .command('settings')
+    .command('settings', needsControlPlane)
     .description('Read and change workspace settings (MCP policy, budgets, group policy, config content upload, ...)');
 settingsCmd
     .command('get [key]')
@@ -1440,7 +1536,7 @@ settingsCmd
     await runSettingsSet(key, value, opts);
 });
 const mcpCmd = program
-    .command('mcp')
+    .command('mcp', needsControlPlane)
     .description('Review the MCP servers the workspace\'s MCP proxies have seen, and decide on them');
 mcpCmd
     .command('list')
@@ -1481,7 +1577,7 @@ for (const [action, enabled, desc] of [
     });
 }
 const notificationsCmd = program
-    .command('notifications')
+    .command('notifications', needsControlPlane)
     .description('Manage notification rules: which events go to Slack, email, a webhook or PagerDuty');
 function ruleOptions(cmd) {
     return cmd
@@ -1543,7 +1639,7 @@ notificationsCmd
     await runNotificationsRotateSecret(ruleId, opts);
 });
 const siemCmd = program
-    .command('siem')
+    .command('siem', needsControlPlane)
     .description('Manage SIEM export destinations and the event sources each receives');
 function destinationOptions(cmd) {
     return cmd
@@ -1617,8 +1713,53 @@ siemCmd
     const { runSiemRotateSecret } = await import('./commands/siem.js');
     await runSiemRotateSecret(destinationId, opts);
 });
+const tasksCmd = program
+    .command('tasks', needsControlPlane)
+    .description('Manage task-management connections (Jira Cloud, Linear, PagerDuty) that attach ticket context to sessions');
+tasksCmd
+    .command('list')
+    .description('List task-management connections (tokens are never returned)')
+    .option('--json', 'Output as JSON')
+    .option('--dev', 'Use local control plane (http://localhost:3001)')
+    .action(async (opts) => {
+    const { runTasksList } = await import('./commands/tasks.js');
+    await runTasksList(opts);
+});
+tasksCmd
+    .command('add')
+    .description('Connect Jira Cloud, Linear or PagerDuty; the API token is read from --token or --token-file, never echoed')
+    .requiredOption('--provider <provider>', 'jira, linear or pagerduty')
+    .requiredOption('--base-url <url>', 'The provider\'s base URL (e.g. https://acme.atlassian.net)')
+    .requiredOption('--project-key <key>', 'Jira project key, Linear team key or PagerDuty service key')
+    .option('--account-email <email>', 'Jira only (required): the Atlassian account the API token belongs to')
+    .option('--token <token>', 'Provider API token')
+    .option('--token-file <path>', 'Read the API token from a file')
+    .option('--json', 'Output as JSON')
+    .option('--dev', 'Use local control plane (http://localhost:3001)')
+    .action(async (opts) => {
+    const { runTasksAdd } = await import('./commands/tasks.js');
+    await runTasksAdd(opts);
+});
+tasksCmd
+    .command('test <connectionId>')
+    .description('Check that the provider still accepts a connection\'s stored credentials')
+    .option('--json', 'Output as JSON')
+    .option('--dev', 'Use local control plane (http://localhost:3001)')
+    .action(async (connectionId, opts) => {
+    const { runTasksTest } = await import('./commands/tasks.js');
+    await runTasksTest(connectionId, opts);
+});
+tasksCmd
+    .command('remove <connectionId>')
+    .description('Remove a task-management connection and its stored token')
+    .option('--json', 'Output as JSON')
+    .option('--dev', 'Use local control plane (http://localhost:3001)')
+    .action(async (connectionId, opts) => {
+    const { runTasksRemove } = await import('./commands/tasks.js');
+    await runTasksRemove(connectionId, opts);
+});
 const complianceCmd = program
-    .command('compliance')
+    .command('compliance', needsControlPlane)
     .description('Compliance framework reports and the evidence archive');
 complianceCmd
     .command('coverage <framework_id>')
@@ -1663,7 +1804,7 @@ complianceCmd
     await runComplianceVerify(file, opts);
 });
 const usageCmd = program
-    .command('usage')
+    .command('usage', needsControlPlane)
     .description('LLM usage across the fleet, by member, team, branch, commit or pull request');
 for (const [view, handler, desc] of [
     ['members', 'runUsageMembers', 'Usage per member'],
@@ -1694,7 +1835,7 @@ usageCmd
     await runUsagePullRequests(opts);
 });
 const githubWebhookCmd = program
-    .command('github')
+    .command('github', needsControlPlane)
     .description('GitHub integration for cost per pull request')
     .command('webhook')
     .description('The pull-request webhook: payload URL and signing secret');
@@ -1717,7 +1858,7 @@ githubWebhookCmd
     await runGithubWebhookRotateSecret(opts);
 });
 const inventoryCmd = program
-    .command('inventory')
+    .command('inventory', needsControlPlane)
     .description('AI harnesses, MCP servers and skills on connected developer machines, governed or not');
 inventoryCmd
     .command('summary')
@@ -1779,7 +1920,7 @@ inventoryCmd
     await runInventoryDisconnects(opts);
 });
 program
-    .command('gate-liveness')
+    .command('gate-liveness', needsControlPlane)
     .description('Whether each installed harness\'s gate is reporting, and any open silent-gate alert')
     .option('--json', 'Output as JSON')
     .option('--dev', 'Use local control plane (http://localhost:3001)')