@ishlabs/cli 0.19.0 → 0.20.0

package/dist/commands/ask.js

@@ -1,7 +1,7 @@
 /**
  * ish ask — Create and run asks (multi-round surveys with variants).
  */
-import { withClient, getWebUrl, terminalLink, resolveWorkspace, resolveAsk, collectRepeatable, parseWaitTimeout, resolvePersonIds, addPersonFilterFlags, } from "../lib/command-helpers.js";
+import { withClient, getWebUrl, terminalLink, resolveWorkspace, resolveAsk, collectRepeatable, parseWaitTimeout, resolvePersonIds, addPersonFilterFlags, confirmDestructive, } from "../lib/command-helpers.js";
 import { resolveId, tagAlias, ALIAS_PREFIX } from "../lib/alias-store.js";
 import { loadConfig, saveConfig } from "../config.js";
 import { formatAskList, formatAskDetail, formatRoundDetail, formatAskResults, output, } from "../lib/output.js";
@@ -927,9 +927,33 @@ Examples:
         .description("Delete an ask and all its rounds, responses, and participants")
         .argument("[id]", "Ask alias or UUID (defaults to active ask)")
         .option("--ask <id>", "Ask ID; alternative to positional argument")
-        .addHelpText("after", "\nExamples:\n  $ ish ask delete a-6ec")
+        .option("-y, --yes", "Skip confirmation prompt (required in --json or non-TTY contexts)")
+        .addHelpText("after", `
+Examples:
+  $ ish ask delete a-6ec             # interactive — prompts for confirmation
+  $ ish ask delete a-6ec --yes       # non-interactive
+  $ ish ask delete a-6ec --json --yes`)
         .action(async (id, opts, cmd) => {
         await withClient(cmd, async (client, globals) => {
+            // Code-review #5: when neither positional id nor --ask is provided,
+            // we fall back to the active ask in config. If config has no active
+            // ask either, the prompt would say "Delete the active ask..." and
+            // then error AFTER confirmation with "No active ask" — confusing.
+            // Detect the empty-ref case BEFORE the prompt so the user sees
+            // the actionable error first.
+            const ref = id ?? opts.ask;
+            if (!ref) {
+                const config = loadConfig();
+                if (!config.ask) {
+                    throw new Error("No active ask to delete. Pass an ask id (positional or --ask <id>), or run `ish ask use <id>` to set one first.");
+                }
+            }
+            // Pattern G follow-up: confirm BEFORE resolving so a typo'd alias
+            // (e.g. `a-fff`) doesn't bypass the guard. Show the raw input in
+            // the prompt; the alias resolution happens after the user
+            // confirms.
+            const displayRef = ref ?? "active ask";
+            await confirmDestructive(`Delete ${displayRef === "active ask" ? "the active ask" : `ask ${displayRef}`} (and all its rounds, responses, participants)? This cannot be undone.`, { yes: opts.yes, json: globals.json });
             const aid = resolveAsk(pickAskRef(id, opts.ask));
             await client.del(`/asks/${aid}`);
             // If we just deleted the active ask, clear it from config.

package/dist/commands/config.js

@@ -12,7 +12,15 @@ export function registerConfigCommands(program) {
 A simulation config tunes how participants behave during a run (model, timing, retries, etc.).
 Pass \`--config <id>\` to \`ish study run\` to override the default for one dispatch.
 
-Configs are global — not scoped to a workspace. The --workspace flag is rejected. Use aliases (c-...) or UUIDs to identify configs.
+Configs are global — not scoped to a workspace. Passing \`--workspace\` to a
+\`config\` command is silently ignored (the global flag is parsed; the value
+has no effect on which configs are returned). Identify configs by alias
+(\`c-...\`) or UUID.
+
+Note: listing simulation configs requires admin privileges. Non-admins get a
+\`forbidden\` (403) envelope on \`ish config list\`. If you need a specific
+config, pass it directly via \`ish study run --config <id>\`; the run-time
+override doesn't require admin access.
 
 Run \`ish docs overview\` for the full mental model.`);
     config

package/dist/commands/docs.js

@@ -85,13 +85,12 @@ export function registerDocsCommands(program) {
     const docs = program
         .command("docs")
         .description("Offline docs for agents — mental model, concept pages, search")
-        .addHelpText("after", `\nSubcommands:
-  overview              Mental model + how to navigate (default)
-  list                  All pages with one-line descriptions
-  get-page <slug>       Full markdown for one page
-  search <query>        Keyword search across all pages
-
-Examples:
+        .addHelpText("after", 
+    // ISSUE-013: dropped the manual "Subcommands:" block — Commander's
+    // auto-generated "Commands:" section already lists the verbs. Keeping
+    // just Examples avoids the near-duplicate that was visible on
+    // `ish docs --help`.
+    `\nExamples:
   $ ish docs                                    # overview
   $ ish docs list
   $ ish docs get-page concepts/study

package/dist/commands/person.js

@@ -2,7 +2,7 @@
  * ish person — Manage people, generation, and source uploads.
  */
 import fs from "node:fs";
-import { withClient, readJsonFileOrStdin, resolveWorkspace } from "../lib/command-helpers.js";
+import { withClient, readJsonFileOrStdin, resolveWorkspace, confirmDestructive, normalizeVisibility } from "../lib/command-helpers.js";
 import { resolveId, tagAlias, ALIAS_PREFIX } from "../lib/alias-store.js";
 import { formatPersonList, output, } from "../lib/output.js";
 import { resolveTextContent } from "../lib/upload.js";
@@ -37,6 +37,12 @@ Concept pages: ish docs get-page concepts/person
         .option("--country <country>", "Filter by country code, e.g. US (repeatable)", collect, [])
         .option("--min-age <n>", "Minimum age")
         .option("--max-age <n>", "Maximum age")
+        // ISSUE-032: asymmetric — `ask create` and `study run` accept
+        // `--visibility workspace|shared|platform` but `person list` didn't,
+        // so a user looking for "people scoped to MY workspace" had to
+        // download all 13k+ platform people and grep client-side. Same
+        // normalizer + flag wording as the sibling commands.
+        .option("--visibility <v>", "Filter by visibility: workspace | shared | platform (legacy 'private'/'public' accepted as aliases)")
         .option("--limit <n>", "Max results (default 50)", "50")
         .option("--offset <n>", "Offset for pagination", "0")
         .addHelpText("after", `
@@ -47,6 +53,8 @@ Examples:
   $ ish person list --occupation founder --occupation designer
   $ ish person list --gender female --gender male --country US --country GB
   $ ish person list --type all --json
+  $ ish person list --visibility workspace            # only workspace-scoped people
+  $ ish person list --visibility platform --country US  # platform pool by country
 
   # Pagination: default --limit is 50, iterate with --offset.
   $ ish person list --limit 100
@@ -75,6 +83,9 @@ Examples:
                 params.min_age = opts.minAge;
             if (opts.maxAge)
                 params.max_age = opts.maxAge;
+            const normVis = normalizeVisibility(opts.visibility);
+            if (normVis)
+                params.visibility = normVis;
             const data = await client.get("/people", params);
             formatPersonList(data, globals.json, parseInt(opts.limit, 10));
             // Pattern H1: when there's more data, surface a stderr hint so agents
@@ -104,13 +115,110 @@ Examples:
     });
     person
         .command("create")
-        .description("Create a person from an exact JSON spec (no LLM)")
-        .requiredOption("--file <path>", "JSON file with person data")
+        .description("Create a person from an exact JSON spec (no LLM). Accepts inline flags or --file.")
+        // ISSUE-033: previously --file was the ONLY accepted input — asymmetric
+        // with `person update` which has a rich inline-flag surface. First-time
+        // users reading `person update --help` reasonably expected the same on
+        // create. Now mirrored: --file is optional, inline flags compose into
+        // the body, inline flags override --file values.
+        .option("--file <path>", "JSON file with person data (or '-' for stdin). Escape hatch for fields not covered by inline flags.")
+        .option("--name <text>", "Person name (required if --file omitted)")
+        .option("--type <value>", "Person type: ai | human (default: ai when --file omitted)")
+        .option("--description <text>", "Person description")
+        .option("--bio <text>", "Person bio")
+        .option("--occupation <text>", "Occupation")
+        .option("--country <code>", "Country code, e.g. US")
+        .option("--gender <g>", "Gender, e.g. female")
+        .option("--date-of-birth <YYYY-MM-DD>", "Date of birth")
+        .option("--education-level <value>", `Education level. One of: ${EDUCATION_LEVELS.join(", ")}`)
+        .option("--household <value>", `Household composition (MECE). One of: ${HOUSEHOLDS.join(", ")}. A couple raising children is couple_with_kids, not couple_no_kids; "single" means lives alone with no partner, roommates, parents, or children in the household.`)
+        .option("--locale-type <value>", `Self-described neighborhood type. One of: ${LOCALE_TYPES.join(", ")}`)
+        .option("--income-level <value>", `Self-identified relative socioeconomic position. One of: ${INCOME_LEVELS.join(", ")}`)
+        .option("--employment-status <value>", `Primary daytime activity / labor-force status. One of: ${EMPLOYMENT_STATUSES.join(", ")}`)
+        .option("--accessibility-profile <json-or-path>", "AccessibilityProfile v1.0 as an inline JSON string OR a path to a JSON file. Empty object {} is the canonical default. Validated client-side against the spec before submit.")
         .option("--workspace <id>", "Workspace (product) ID; falls back to active workspace")
-        .addHelpText("after", "\nExamples:\n  $ ish person create --file profile.json\n\n  Expected JSON: { \"name\": \"...\", \"type\": \"ai\", \"gender\": \"female\", \"country\": \"US\", \"occupation\": \"...\", \"bio\": \"...\" }")
+        .addHelpText("after", `
+Examples:
+  # Inline (mirrors person update):
+  $ ish person create --name "Alice" --type ai --country US
+  $ ish person create --name "Bob" --gender male --country GB --occupation founder \\
+      --household single --locale-type urban --income-level middle \\
+      --employment-status employed_full_time --bio "..."
+
+  # From file:
+  $ ish person create --file profile.json
+
+  # From stdin:
+  $ cat profile.json | ish person create --file -
+
+  # Compose file + inline (inline overrides):
+  $ ish person create --file profile.json --bio "Updated bio for this run"
+
+Inline flags compose into the create body. --file is an escape hatch for
+fields not covered by inline flags. When both are provided, inline flags
+override values from --file.
+
+Minimum required (when --file omitted): --name (--type defaults to "ai").
+
+Household MECE rule: a couple raising children is \`couple_with_kids\`, not
+\`couple_no_kids\`. \`single\` means lives alone with no partner, roommates,
+parents, or children sharing the household.
+
+\`--accessibility-profile\` accepts either an inline JSON string OR a path to
+a JSON file. Schema: https://ishlabs.io/spec/accessibility-profile-schema.v1.json`)
         .action(async (opts, cmd) => {
         await withClient(cmd, async (client, globals) => {
-            const body = await readJsonFileOrStdin(opts.file);
+            let body = {};
+            if (opts.file) {
+                body = (await readJsonFileOrStdin(opts.file));
+            }
+            // Inline flags compose / override the file body (mirrors person update).
+            if (opts.name !== undefined)
+                body.name = opts.name;
+            if (opts.type !== undefined)
+                body.type = opts.type;
+            if (opts.description !== undefined)
+                body.description = opts.description;
+            if (opts.bio !== undefined)
+                body.bio = opts.bio;
+            if (opts.occupation !== undefined)
+                body.occupation = opts.occupation;
+            if (opts.country !== undefined)
+                body.country = opts.country;
+            if (opts.gender !== undefined)
+                body.gender = opts.gender;
+            if (opts.dateOfBirth !== undefined)
+                body.date_of_birth = opts.dateOfBirth;
+            if (opts.educationLevel !== undefined) {
+                body.education_level = assertEnumValue(opts.educationLevel, EDUCATION_LEVELS, "--education-level");
+            }
+            if (opts.household !== undefined) {
+                body.household = assertEnumValue(opts.household, HOUSEHOLDS, "--household");
+            }
+            if (opts.localeType !== undefined) {
+                body.locale_type = assertEnumValue(opts.localeType, LOCALE_TYPES, "--locale-type");
+            }
+            if (opts.incomeLevel !== undefined) {
+                body.income_level = assertEnumValue(opts.incomeLevel, INCOME_LEVELS, "--income-level");
+            }
+            if (opts.employmentStatus !== undefined) {
+                body.employment_status = assertEnumValue(opts.employmentStatus, EMPLOYMENT_STATUSES, "--employment-status");
+            }
+            if (opts.accessibilityProfile !== undefined) {
+                body.accessibility_profile = parseAccessibilityProfileFlag(opts.accessibilityProfile);
+            }
+            // Type default — keeps the inline-only path ergonomic without
+            // requiring `--type ai` on every minimal create.
+            if (body.name && body.type === undefined) {
+                body.type = "ai";
+            }
+            // Without --file AND with no inline flags, the body has only
+            // product_id — that would 422 server-side with no useful guidance.
+            // Provide a clear local error first.
+            if (!opts.file && body.name === undefined) {
+                throw new Error("Nothing to create. Provide --file <path> or at least --name (plus optional inline flags). " +
+                    "Run `ish person create --help` for the full inline-flag set.");
+            }
             if (opts.workspace || body.product_id == null) {
                 body.product_id = resolveWorkspace(opts.workspace);
             }
@@ -135,7 +243,7 @@ Examples:
         .option("--no-scenarios", "Skip fetching the evidence-grounded scenarios for each generated person")
         .option("--no-wait", "Don't poll source-processing status. Only relevant when --source is a local path (paths get auto-uploaded and processed).")
         .option("--source-timeout <seconds>", "Source-processing poll timeout in seconds. Only relevant when --source is a local path.", "300")
-        .option("--timeout <seconds>", "Generation-job poll timeout in seconds (default 600). The job keeps running server-side past this; re-poll, don't re-enqueue.", "600")
+        .option("--timeout <seconds>", "Generation-job poll timeout in seconds (default 180; pass a larger value for long-running jobs). The job keeps running server-side past this; re-poll later or re-run with a longer --timeout — don't re-enqueue, that would duplicate the work.", "180")
         .addHelpText("after", `
 Generation is an async job: ish enqueues it, polls until the people plus
 their evidence-grounded scenarios are ready (~30-60s), then prints them. The
@@ -428,12 +536,18 @@ Schema: https://ishlabs.io/spec/accessibility-profile-schema.v1.json`)
         .description("Delete a person")
         .argument("<id>", "Person ID")
         .option("--workspace <id>", "Workspace ID; accepted for consistency (workspace is inferred from the person)")
-        .addHelpText("after", "\nExamples:\n  $ ish person delete <id>")
-        .action(async (id, _opts, cmd) => {
+        .option("-y, --yes", "Skip confirmation prompt (required in --json or non-TTY contexts)")
+        .addHelpText("after", `
+Examples:
+  $ ish person delete <id>             # interactive — prompts for confirmation
+  $ ish person delete <id> --yes       # non-interactive
+  $ ish person delete <id> --json --yes`)
+        .action(async (id, opts, cmd) => {
         await withClient(cmd, async (client, globals) => {
             const rid = resolveId(id);
+            await confirmDestructive(`Delete person ${tagAlias(ALIAS_PREFIX.person, rid)}? This cannot be undone.`, { yes: opts.yes, json: globals.json });
             await client.del(`/people/${rid}`);
-            output({ id: rid, alias: tagAlias(ALIAS_PREFIX.person, rid), message: "Profile deleted" }, globals.json, { writePath: true });
+            output({ id: rid, alias: tagAlias(ALIAS_PREFIX.person, rid), message: "Person deleted" }, globals.json, { writePath: true });
         });
     });
     person

package/dist/commands/secret.js

@@ -16,7 +16,7 @@
  *     of shell history.
  *   - No interactive prompts (CLI is for autonomous agents).
  */
-import { withClient, resolveWorkspace, readFileOrStdin } from "../lib/command-helpers.js";
+import { withClient, resolveWorkspace, readFileOrStdin, confirmDestructive } from "../lib/command-helpers.js";
 import { output } from "../lib/output.js";
 const RESERVED_SITE_ACCESS_KEYS = new Set([
     "BASIC_AUTH_USERNAME",
@@ -127,6 +127,8 @@ Examples:
         .option("--workspace <id>", "Workspace ID; defaults to active workspace")
         .addHelpText("after", `
 Pick exactly one of: positional <value>, --value-file <path>, --value-stdin.
+Bare \`-\` as the positional value is accepted as an alias for --value-stdin
+(matches the \`--value-file -\` convention).
 Stdin and --value-file are preferred for real keys so the value never lands
 in shell history.
 
@@ -138,6 +140,16 @@ Examples:
         .action(async (key, value, opts, cmd) => {
         await withClient(cmd, async (client, globals) => {
             validateKey(key);
+            // ISSUE-019: bare `-` as the positional value is a common Unix
+            // shorthand for "read from stdin" (matches `--value-file -`'s
+            // existing convention). Previously bare `-` was silently stored
+            // as the literal string "-" — undocumented + surprising. Treat
+            // it as an alias for --value-stdin so the convention matches
+            // user expectation. Documented in --help below.
+            if (value === "-") {
+                value = undefined;
+                opts.valueStdin = true;
+            }
             // Exactly one input source.
             const sources = [
                 value !== undefined,
@@ -212,7 +224,12 @@ Examples:
         .description("Delete a workspace secret by key")
         .argument("<key>", "Secret key to delete")
         .option("--workspace <id>", "Workspace ID; defaults to active workspace")
-        .addHelpText("after", "\nExamples:\n  $ ish secret delete GROQ_API_KEY")
+        .option("-y, --yes", "Skip confirmation prompt (required in --json or non-TTY contexts)")
+        .addHelpText("after", `
+Examples:
+  $ ish secret delete GROQ_API_KEY              # interactive — prompts for confirmation
+  $ ish secret delete GROQ_API_KEY --yes        # non-interactive
+  $ ish secret delete GROQ_API_KEY --json --yes`)
         .action(async (key, opts, cmd) => {
         await withClient(cmd, async (client, globals) => {
             if (!KEY_PATTERN.test(key)) {
@@ -220,6 +237,12 @@ Examples:
                 err.name = "ValidationError";
                 throw err;
             }
+            // Pattern G follow-up: the original Pattern G fix covered
+            // workspace/person/source delete (commit 891b22d), then a
+            // follow-up added ask delete. `secret delete` was the seventh
+            // destructive op and slipped through; rolling the guard in
+            // for full consistency.
+            await confirmDestructive(`Delete secret "${key}"? This cannot be undone.`, { yes: opts.yes, json: globals.json });
             const wid = resolveWorkspace(opts.workspace);
             const all = await client.get(`/products/${wid}/secrets`);
             const match = all.find((s) => s.key === key);

package/dist/commands/source.d.ts

@@ -2,7 +2,7 @@
  * ish source — Upload and inspect participant attachments used as generation inputs.
  *
  * Attachments (transcripts, audio, images, PDFs) are inputs to `ish person
- * generate`. For one-shot generation, `profile generate --source <path>`
+ * generate`. For one-shot generation, `ish person generate --source <path>`
  * auto-uploads. Use these commands to upload once and reuse across multiple
  * generation runs, or to inspect processing status.
  *

package/dist/commands/source.js

@@ -2,7 +2,7 @@
  * ish source — Upload and inspect participant attachments used as generation inputs.
  *
  * Attachments (transcripts, audio, images, PDFs) are inputs to `ish person
- * generate`. For one-shot generation, `profile generate --source <path>`
+ * generate`. For one-shot generation, `ish person generate --source <path>`
  * auto-uploads. Use these commands to upload once and reuse across multiple
  * generation runs, or to inspect processing status.
  *
@@ -10,7 +10,7 @@
  * existing scripts and agents; internally we call the unified
  * /people/attachments/* endpoint family (see ADR-0034).
  */
-import { withClient, resolveWorkspace } from "../lib/command-helpers.js";
+import { withClient, resolveWorkspace, confirmDestructive } from "../lib/command-helpers.js";
 import { resolveId, tagAlias, ALIAS_PREFIX } from "../lib/alias-store.js";
 import { normalizeEnumValue } from "../lib/enums.js";
 import { formatAttachment, output } from "../lib/output.js";
@@ -24,7 +24,7 @@ export function registerSourceCommands(program) {
 A source — internally a participant attachment — is an input to \`ish person generate\`:
 transcript, audio, image, or PDF. Use \`source upload\` when you want to reuse the
 same attachment across multiple generation runs; otherwise pass a local path directly
-to \`profile generate --source\` and it auto-uploads.
+to \`person generate --source\` and it auto-uploads.
 
 Concept pages: ish docs get-page concepts/source
                 ish docs get-page concepts/profile`);
@@ -86,21 +86,25 @@ Examples:
         .command("delete")
         .description("Delete a participant attachment plus its uploaded file")
         .argument("<id>", "Attachment ID or alias")
+        .option("-y, --yes", "Skip confirmation prompt (required in --json or non-TTY contexts)")
         .addHelpText("after", `
 The backend ref-counts attachment deletes: the file row + storage object are
 removed only when no profile mappings remain. Profiles already generated from
 this attachment keep their seed mapping until they themselves are deleted.
 
 Examples:
-  $ ish source delete ps-3a4`)
-        .action(async (id, _opts, cmd) => {
+  $ ish source delete ps-3a4             # interactive — prompts for confirmation
+  $ ish source delete ps-3a4 --yes       # non-interactive
+  $ ish source delete ps-3a4 --json --yes`)
+        .action(async (id, opts, cmd) => {
         await withClient(cmd, async (client, globals) => {
             const rid = resolveId(id);
+            await confirmDestructive(`Delete source ${tagAlias(ALIAS_PREFIX.personSource, rid)}? This cannot be undone.`, { yes: opts.yes, json: globals.json });
             await client.del(`/people/attachments/${rid}`);
             output({
                 id: rid,
                 alias: tagAlias(ALIAS_PREFIX.personSource, rid),
-                message: "Attachment deleted",
+                message: "Source deleted",
             }, globals.json, { writePath: true });
         });
     });

package/dist/commands/study.js

@@ -544,8 +544,18 @@ Next: configure a run with \`ish iteration create --study <id>\`,
             const data = await client.post(`/products/${resolvedWs}/studies`, body);
             if (data.id) {
                 const config = loadConfig();
+                const prevStudy = config.study;
                 config.study = data.id;
                 saveConfig(config);
+                // Auto-activating the new study is intentional ergonomics (the
+                // common next step is `ish iteration create --study <new>`), but
+                // it was previously silent — surprised users who had set a
+                // different active study just before (ISSUE-030). Always
+                // surface the side-effect on stderr.
+                if (!globals.json) {
+                    const verb = prevStudy && prevStudy !== data.id ? "replaced" : "set";
+                    console.error(`Active study ${verb} to "${data.name || data.id}".`);
+                }
             }
             const result = data;
             if (result.id)
@@ -856,6 +866,15 @@ checklists ("steps") ride along when present in the JSON forms
                 json: globals.json,
             });
             await client.del(`/studies/${rid}`);
+            // If the deleted study was active, clear it (Pattern A — parallel to
+            // ask delete and chat endpoint delete which already do this).
+            const config = loadConfig();
+            if (config.study === rid) {
+                delete config.study;
+                saveConfig(config);
+                if (!globals.json)
+                    console.error("(Cleared active study.)");
+            }
             output({ id: rid, alias: tagAlias(ALIAS_PREFIX.study, rid), message: "Study deleted" }, globals.json, { writePath: true });
         });
     });

package/dist/commands/workspace.js

@@ -1,7 +1,7 @@
 /**
  * ish workspace — Manage workspaces (API: /products).
  */
-import { withClient, getWebUrl, terminalLink, resolveWorkspace } from "../lib/command-helpers.js";
+import { withClient, getWebUrl, terminalLink, resolveWorkspace, confirmDestructive } from "../lib/command-helpers.js";
 import { resolveId, tagAlias, ALIAS_PREFIX } from "../lib/alias-store.js";
 import { loadConfig, saveConfig } from "../config.js";
 import { formatWorkspaceList, formatWorkspaceDetail, formatSiteAccessStatus, output } from "../lib/output.js";
@@ -134,13 +134,35 @@ existing workspace was returned. On creation, \`reused: false\`.`)
     });
     workspace
         .command("delete")
-        .description("Delete a workspace")
+        .description("Delete a workspace (and ALL nested studies, asks, people, secrets, configs, sources, chat endpoints)")
         .argument("<id>", "Workspace ID")
-        .addHelpText("after", "\nExamples:\n  $ ish workspace delete <id>")
-        .action(async (id, _opts, cmd) => {
+        .option("-y, --yes", "Skip confirmation prompt (required in --json or non-TTY contexts)")
+        .addHelpText("after", `
+Deleting a workspace is the highest-blast-radius destructive op in the CLI:
+it removes ALL nested studies, asks, people, secrets, configs, sources, and
+chat endpoints. This cannot be undone.
+
+Examples:
+  $ ish workspace delete <id>             # interactive — prompts for confirmation
+  $ ish workspace delete <id> --yes       # non-interactive
+  $ ish workspace delete <id> --json --yes`)
+        .action(async (id, opts, cmd) => {
         await withClient(cmd, async (client, globals) => {
             const rid = resolveId(id);
+            await confirmDestructive(`Delete workspace ${tagAlias(ALIAS_PREFIX.workspace, rid)}? This will delete ALL nested studies, asks, people, secrets, configs, sources, and chat endpoints. This cannot be undone.`, { yes: opts.yes, json: globals.json });
             await client.del(`/products/${rid}`);
+            // If the deleted workspace was active, clear it + its scoped children
+            // so subsequent commands don't render orphan refs (Pattern A).
+            const config = loadConfig();
+            if (config.workspace === rid) {
+                delete config.workspace;
+                delete config.study;
+                delete config.ask;
+                delete config.chat_endpoint;
+                saveConfig(config);
+                if (!globals.json)
+                    console.error("(Cleared active workspace + study / ask / chat endpoint.)");
+            }
             output({ id: rid, alias: tagAlias(ALIAS_PREFIX.workspace, rid), message: "Workspace deleted" }, globals.json, { writePath: true });
         });
     });
@@ -187,9 +209,12 @@ Examples:
         if (opts.clear) {
             const config = loadConfig();
             delete config.workspace;
+            // workspace-scoped children: clearing the workspace orphans them all.
             delete config.study;
+            delete config.ask;
+            delete config.chat_endpoint;
             saveConfig(config);
-            console.error("Cleared active workspace (and study).");
+            console.error("Cleared active workspace (and active study / ask / chat endpoint).");
             return;
         }
         if (!id) {
@@ -199,10 +224,20 @@ Examples:
             const rid = resolveId(id);
             const data = await client.get(`/products/${rid}`);
             const config = loadConfig();
+            const switched = config.workspace !== rid;
             config.workspace = rid;
-            delete config.study; // study belongs to workspace
+            if (switched) {
+                // Switching workspaces orphans all workspace-scoped active refs;
+                // dropping them avoids silent cross-workspace footguns (ISSUE-004).
+                delete config.study;
+                delete config.ask;
+                delete config.chat_endpoint;
+            }
             saveConfig(config);
             console.error(`Active workspace set to "${data.name || rid}".`);
+            if (switched) {
+                console.error("(Cleared active study / ask / chat endpoint — they belonged to the previous workspace.)");
+            }
         });
     });
 }