@keystrokehq/cli 0.0.31 → 0.0.37

package/README.md

@@ -100,8 +100,27 @@ keystroke --api-key sk_... --server-url https://api.example.com workflows list
 | `keystroke skills sync` | Sync bundled Keystroke agent skills into selected agent skill folders. |
 | `keystroke upgrade` | Upgrade the installed Keystroke CLI package. |
 
+Upgrade examples:
+
+```bash
+keystroke upgrade --dry-run
+keystroke upgrade --package-manager pnpm --to latest --dry-run
+keystroke upgrade --to 1.2.3 --dry-run
+keystroke upgrade --package-manager npm
+```
+
+`--package-manager yarn` requires Yarn Classic (v1). Yarn 2+ does not support global installs; use `npm` or `pnpm` instead.
+
 Run `keystroke <command> --help` for exact arguments and flags.
 
+List locally tracked projects or reset the cache:
+
+```bash
+keystroke projects list
+keystroke projects list --json
+keystroke projects clear-cache
+```
+
 Capture one incoming webhook or API request body:
 
 ```bash
@@ -126,7 +145,9 @@ Skill install methods:
 - `--method symlink` links selected agent skill folders back to the canonical `.agents/skills` copy.
 - `--method copy` writes independent copies for selected agent folders.
 
-Run `keystroke skills sync` with the same `--agent` and `--method` flags to refresh skills in an existing project.
+Run `keystroke skills sync` with the same `--agent` and `--method` flags to refresh skills in an existing project. Cursor and other universal agents read skills from `.agents/skills` (not `.cursor/skills`); agent-specific folders such as `.claude/skills` are created only for adapters that use a separate path.
+
+When stdout is not a TTY (piped or captured), `skills sync` emits JSON automatically; pass `--json` explicitly in interactive terminals.
 
 Build locally:
 
@@ -138,8 +159,8 @@ Inspect what will be deployed:
 
 ```bash
 keystroke workflows list --path ./my-automation
-keystroke workflows inspect <workflow-id-or-name> --path ./my-automation
-keystroke workflows diff <workflow-id-or-name> --path ./my-automation
+keystroke workflows inspect <workflow-id> --path ./my-automation
+keystroke workflows diff <workflow-id> --path ./my-automation
 ```
 
 Deploy:
@@ -153,7 +174,7 @@ keystroke deploy --diff --path ./my-automation
 Test a workflow or agent tool:
 
 ```bash
-keystroke workflows test <workflow-id-or-name> --input '{"example":true}'
+keystroke workflows test <workflow-id> --input '{"example":true}'
 keystroke test tool <tool-name> --agent <agent-id-or-name> --input-file ./input.json
 ```
 

package/dist/{accept.handler-DNfIXPSP.mjs → accept.handler-DCsud1s5.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
-import { a as ui } from "./keystroke.mjs";
-import { i as writeJson } from "./output-BWcVRt-T.mjs";
-import { i as requireClient } from "./context-sgKhRc5v.mjs";
-import { n as isIamJsonMode, t as handleIamError } from "./iam-command-utils-CSZj4XlH.mjs";
+import { p as ui } from "./keystroke.mjs";
+import { i as writeJson } from "./output-DnIFEmi5.mjs";
+import { i as requireClient } from "./context-ebZssGCY.mjs";
+import { n as isIamJsonMode, t as handleIamError } from "./iam-command-utils-DNDN0wT6.mjs";
 //#region src/commands/invites/accept.handler.ts
 async function handleInvitesAccept(options, ctx) {
 	const client = requireClient(ctx);

package/dist/{admin-CJp8XksD.mjs → admin-BaOtHeZ2.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
-import { t as createTypedCommand } from "./commander-BlrSdFcu.mjs";
+import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-DnIFEmi5.mjs";
+import { t as createTypedCommand } from "./commander-C6SSTQJ2.mjs";
 import { t as OrgRoleSchema } from "./schema-Lbp5lGJu.mjs";
 import { z } from "zod";
 //#region src/commands/admin/orgs.command.ts
@@ -28,21 +28,21 @@ function createAdminOrgsCommand() {
 		description: "Manage organizations as a platform admin",
 		schema: AdminOrgsListOptionsSchema,
 		optionsConfig: { ...JSON_OPTION_CONFIG },
-		loadHandler: async () => (await import("./orgs.list.handler--5HutMkl.mjs")).handleAdminOrgsList,
+		loadHandler: async () => (await import("./orgs.list.handler-eCEg5kC1.mjs")).handleAdminOrgsList,
 		subcommands: [
 			createTypedCommand({
 				name: "create",
 				description: "Create an organization (requires system.create_org)",
 				schema: AdminOrgsCreateOptionsSchema,
 				optionsConfig: CREATE_OPTIONS_CONFIG,
-				loadHandler: async () => (await import("./orgs.create.handler-BO70zIdp.mjs")).handleAdminOrgsCreate
+				loadHandler: async () => (await import("./orgs.create.handler-BKvSmkU3.mjs")).handleAdminOrgsCreate
 			}),
 			createTypedCommand({
 				name: "list",
 				description: "List organizations (requires system.view_orgs)",
 				schema: AdminOrgsListOptionsSchema,
 				optionsConfig: { ...JSON_OPTION_CONFIG },
-				loadHandler: async () => (await import("./orgs.list.handler--5HutMkl.mjs")).handleAdminOrgsList
+				loadHandler: async () => (await import("./orgs.list.handler-eCEg5kC1.mjs")).handleAdminOrgsList
 			}),
 			createTypedCommand({
 				name: "get",
@@ -54,7 +54,7 @@ function createAdminOrgsCommand() {
 					description: "Organization ID",
 					key: "orgId"
 				},
-				loadHandler: async () => (await import("./orgs.get.handler-BuGg5bc9.mjs")).handleAdminOrgsGet
+				loadHandler: async () => (await import("./orgs.get.handler-BA-CexIY.mjs")).handleAdminOrgsGet
 			})
 		]
 	});
@@ -157,14 +157,14 @@ function createAdminUsersCommand() {
 		description: "Manage platform users",
 		schema: AdminUsersListOptionsSchema,
 		optionsConfig: { ...JSON_OPTION_CONFIG },
-		loadHandler: async () => (await import("./users.list.handler-Dvl90grq.mjs")).handleAdminUsersList,
+		loadHandler: async () => (await import("./users.list.handler-CxbZFgjO.mjs")).handleAdminUsersList,
 		subcommands: [
 			createTypedCommand({
 				name: "list",
 				description: "List platform users",
 				schema: AdminUsersListOptionsSchema,
 				optionsConfig: { ...JSON_OPTION_CONFIG },
-				loadHandler: async () => (await import("./users.list.handler-Dvl90grq.mjs")).handleAdminUsersList
+				loadHandler: async () => (await import("./users.list.handler-CxbZFgjO.mjs")).handleAdminUsersList
 			}),
 			createTypedCommand({
 				name: "get",
@@ -176,7 +176,7 @@ function createAdminUsersCommand() {
 					description: "User ID",
 					key: "userId"
 				},
-				loadHandler: async () => (await import("./users.get.handler-C4t1vXwi.mjs")).handleAdminUsersGet
+				loadHandler: async () => (await import("./users.get.handler-CH1c6Lnj.mjs")).handleAdminUsersGet
 			}),
 			createTypedCommand({
 				name: "set-role",
@@ -188,7 +188,7 @@ function createAdminUsersCommand() {
 					description: "User ID",
 					key: "userId"
 				},
-				loadHandler: async () => (await import("./users.set-role.handler-Djw1_VGf.mjs")).handleAdminUsersSetRole
+				loadHandler: async () => (await import("./users.set-role.handler-CBRE-Ws6.mjs")).handleAdminUsersSetRole
 			})
 		]
 	});

package/dist/{agent-manifest-De5TCxZq.mjs → agent-manifest-DfWD5tvv.mjs}

@@ -100,48 +100,38 @@ const AgentRuntimeSchema = z.object({
 	mode: AgentRuntimeModeSchema,
 	placement: AgentRuntimePlacementSchema
 });
+const AgentSandboxManifestValueSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("literal"),
+	value: z.string()
+}), z.object({
+	kind: z.literal("credential"),
+	credentialSetId: z.string().min(1),
+	key: z.string().min(1)
+})]);
 /**
 * Mirrors `SandboxFileSourceSchema` from `@keystrokehq/core` so this
 * package stays free of a runtime dependency on core. Keep in sync
 * with `packages/core/src/sandbox/schemas.ts`.
 */
-const AgentSandboxFileSourceSchema = z.discriminatedUnion("type", [z.object({
-	type: z.literal("git"),
-	url: z.string().trim().min(1),
-	branch: z.string().optional(),
-	/** Workdir-relative or absolute (under `/workspace`) clone destination. */
-	target: z.string().optional()
-}), z.object({
-	type: z.literal("local"),
-	/** Host source path (resolved against project root at deploy time). */
+const AgentSandboxFileSourceSchema = z.object({
 	path: z.string().trim().min(1),
-	/** Workdir-relative or absolute (under `/workspace`) destination in the VM. */
 	target: z.string().optional()
-})]);
+});
 /**
 * `workdir` here mirrors the core constraint: must be `/workspace`
 * or a subdirectory so it lands inside the persistent bind mount.
 */
 const AgentSandboxWorkdirSchema = z.string().trim().min(1).refine((value) => value === "/workspace" || value.startsWith("/workspace/"), { error: "workdir must be \"/workspace\" or a subdirectory of \"/workspace\"" });
 const AgentSandboxSchema = z.object({
-	snapshotId: z.string().optional(),
-	runtime: z.object({
-		/**
-		* Runs every boot (after `setupCommands`, after a snapshot warm-boot
-		* where setupCommands are skipped). Use for `git pull`, `pnpm build`,
-		* etc. Each command runs with `cwd = workdir`.
-		*/
-		runCommands: z.array(z.string()).default([]),
-		env: z.record(z.string(), z.string()).default({}),
-		workdir: AgentSandboxWorkdirSchema.optional()
-	}).optional(),
-	/**
-	* Bootstrap-phase commands. Marker-gated; future snapshot warm-boots skip
-	* these entirely. Use for one-time, cacheable setup (e.g. `npm install -g`).
-	*/
+	id: z.string().optional(),
+	name: z.string().optional(),
+	description: z.string().optional(),
+	workdir: AgentSandboxWorkdirSchema.optional(),
+	runCommands: z.array(z.string()).optional(),
 	setupCommands: z.array(z.string()).optional(),
-	/** File sources resolved at runtime. `git` clones happen in-VM during bootstrap. */
+	env: z.record(z.string(), AgentSandboxManifestValueSchema).optional(),
 	fileSources: z.array(AgentSandboxFileSourceSchema).optional(),
+	snapshotId: z.string().optional(),
 	bootstrapArtifacts: z.array(SandboxBootstrapArtifactSchema).optional(),
 	sandboxBundleStoragePath: z.string().optional()
 });

package/dist/{agents-G37PM35Z.mjs → agents-BVAVfMR_.mjs}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
-import { a as ui, j as throwReportedCliExit, n as style, t as ANSI, y as toErrorMessage } from "./keystroke.mjs";
-import { i as projects } from "./dist-Dw7gCE7y.mjs";
-import { i as writeJson, n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
-import { t as createTypedCommand } from "./commander-BlrSdFcu.mjs";
-import { i as readAgentManifestsFromOutDir } from "./dist-CTEtWDW4.mjs";
-import { t as requireWorkflowsDir } from "./resolve-project-E9mrh_el.mjs";
-import { t as createSpinnerProgress } from "./spinner-progress-lrKDs4YF.mjs";
-import { a as runWorkflowBuild, n as renderBuildFailure } from "./workflow-build-Begvjfq8.mjs";
-import { a as resolveTypeHint } from "./schema-display-FvI8QjOQ.mjs";
+import { N as throwReportedCliExit, n as style, p as ui, t as ANSI, x as toErrorMessage } from "./keystroke.mjs";
+import { i as projects } from "./dist-B5jy238v.mjs";
+import { i as writeJson, n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-DnIFEmi5.mjs";
+import { t as createTypedCommand } from "./commander-C6SSTQJ2.mjs";
+import { i as readAgentManifestsFromOutDir } from "./dist-BmbFJq8U.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-DLKlAy0z.mjs";
+import { t as createSpinnerProgress } from "./spinner-progress-BYxlr3lY.mjs";
+import { a as runWorkflowBuild, n as renderBuildFailure } from "./workflow-build-Bm8JoVv4.mjs";
+import { s as resolveTypeHint } from "./schema-display-sZ6ConJd.mjs";
 import { z } from "zod";
 //#region src/commands/agents/inspect-display.ts
 function renderAgentManifestInspect(manifest, options = {}) {

package/dist/{api-keys-4igNHJ_W.mjs → api-keys-BhEEsHUh.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-BWcVRt-T.mjs";
-import { t as createTypedCommand } from "./commander-BlrSdFcu.mjs";
+import { n as JsonOptionSchema, t as JSON_OPTION_CONFIG } from "./output-DnIFEmi5.mjs";
+import { t as createTypedCommand } from "./commander-C6SSTQJ2.mjs";
 import { z } from "zod";
 //#region src/commands/api-keys/api-keys.command.ts
 const ApiKeysCreateOptionsSchema = JsonOptionSchema.extend({ name: z.string().optional() });
@@ -23,21 +23,21 @@ function createApiKeysCommand() {
 		description: "Manage API keys for your organization",
 		schema: JsonOptionSchema,
 		optionsConfig: { ...JSON_OPTION_CONFIG },
-		loadHandler: async () => (await import("./list.handler-BiY5NFWd.mjs")).handleApiKeysList,
+		loadHandler: async () => (await import("./list.handler-Bchcr3-e.mjs")).handleApiKeysList,
 		subcommands: [
 			createTypedCommand({
 				name: "list",
 				description: "List all API keys for your organization",
 				schema: JsonOptionSchema,
 				optionsConfig: { ...JSON_OPTION_CONFIG },
-				loadHandler: async () => (await import("./list.handler-BiY5NFWd.mjs")).handleApiKeysList
+				loadHandler: async () => (await import("./list.handler-Bchcr3-e.mjs")).handleApiKeysList
 			}),
 			createTypedCommand({
 				name: "create",
 				description: "Create a new API key (raw key shown once)",
 				schema: ApiKeysCreateOptionsSchema,
 				optionsConfig: CREATE_OPTIONS_CONFIG,
-				loadHandler: async () => (await import("./create.handler-BovbO_g0.mjs")).handleApiKeysCreate
+				loadHandler: async () => (await import("./create.handler-CAWJAGzQ.mjs")).handleApiKeysCreate
 			}),
 			createTypedCommand({
 				name: "delete",
@@ -49,7 +49,7 @@ function createApiKeysCommand() {
 					description: "API key ID to delete",
 					key: "apiKeyId"
 				},
-				loadHandler: async () => (await import("./delete.handler-DkAK396w.mjs")).handleApiKeysDelete
+				loadHandler: async () => (await import("./delete.handler-C-5XFkgN.mjs")).handleApiKeysDelete
 			})
 		]
 	});

package/dist/{api-BK3EhPvs.mjs → api-sWkB_Wta.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { n as CredentialConnectionIdSchema, r as CredentialScopeSchema, t as ConnectionStatusSchema } from "./schema-DFJiNWyd.mjs";
-import { t as CatalogDefinitionSourceSchema } from "./schemas-4Mq_bxob.mjs";
+import { t as CatalogDefinitionSourceSchema } from "./schemas-8nhXlXWh.mjs";
 import { z } from "zod";
 //#region ../../packages/shared-types/src/operations/operations.ts
 const JsonRecordSchema = z.record(z.string(), z.unknown());

package/dist/{auth-CIOmmV4x.mjs → auth-BnsitjzT.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 import { n as DEFAULT_CLI_WEB_URL } from "./default-urls-BoSm4s9C.mjs";
-import { b as AUTH_TIMEOUT_SECONDS } from "./keystroke.mjs";
-import { t as createTypedCommand } from "./commander-BlrSdFcu.mjs";
+import { S as AUTH_TIMEOUT_SECONDS } from "./keystroke.mjs";
+import { t as createTypedCommand } from "./commander-C6SSTQJ2.mjs";
 import { z } from "zod";
 //#region src/commands/auth/auth.command.ts
 const AuthOptionsSchema = z.object({
@@ -31,7 +31,7 @@ function createAuthCommand() {
 		schema: AuthOptionsSchema,
 		optionsConfig: AUTH_OPTIONS_CONFIG,
 		contextMode: "auth-metadata",
-		loadHandler: async () => (await import("./auth.handler-CznN_vfz.mjs")).handleAuth,
+		loadHandler: async () => (await import("./auth.handler-W_xk14TL.mjs")).handleAuth,
 		subcommands: [
 			createTypedCommand({
 				name: "clear",
@@ -39,21 +39,21 @@ function createAuthCommand() {
 				schema: AuthClearOptionsSchema,
 				optionsConfig: AUTH_CLEAR_OPTIONS_CONFIG,
 				contextMode: "auth-metadata",
-				loadHandler: async () => (await import("./clear.handler-PsA5QKHx.mjs")).handleAuthClear
+				loadHandler: async () => (await import("./clear.handler-_sR33Hp8.mjs")).handleAuthClear
 			}),
 			createTypedCommand({
 				name: "test",
 				description: "Verify that the saved API key is valid",
 				schema: z.object({}),
 				optionsConfig: {},
-				loadHandler: async () => (await import("./test.handler-BCW0YBPd.mjs")).handleAuthTest
+				loadHandler: async () => (await import("./test.handler-BdCYcwR4.mjs")).handleAuthTest
 			}),
 			createTypedCommand({
 				name: "status",
 				description: "Show the current signed-in identity and organization context",
 				schema: z.object({}),
 				optionsConfig: {},
-				loadHandler: async () => (await import("./status.handler-Ch_DtyBp.mjs")).handleAuthStatus
+				loadHandler: async () => (await import("./status.handler-DAId4bVU.mjs")).handleAuthStatus
 			})
 		]
 	});

package/dist/{auth.handler-CznN_vfz.mjs → auth.handler-W_xk14TL.mjs}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
 import { n as DEFAULT_CLI_WEB_URL, t as DEFAULT_CLI_SERVER_URL } from "./default-urls-BoSm4s9C.mjs";
-import { C as CALLBACK_LOOPBACK_ORIGIN, D as CliExitError, P as logger, S as CALLBACK_LOOPBACK_HOST, T as CLI_AUTH_COMMAND, a as ui, d as resolveCliWebUrl, u as resolveCliServerUrl, w as CALLBACK_PATH, x as AUTH_URL_PATH, y as toErrorMessage } from "./keystroke.mjs";
-import { n as credentials } from "./dist-Dw7gCE7y.mjs";
+import { C as AUTH_URL_PATH, D as CLI_AUTH_COMMAND, E as CALLBACK_PATH, I as logger, T as CALLBACK_LOOPBACK_ORIGIN, d as resolveCliWebUrl, k as CliExitError, p as ui, u as resolveCliServerUrl, w as CALLBACK_LOOPBACK_HOST, x as toErrorMessage } from "./keystroke.mjs";
+import { n as credentials } from "./dist-B5jy238v.mjs";
 import { t as openBrowser } from "./browser-Dvv5OQrt.mjs";
 import { hostname } from "node:os";
-import { z } from "zod";
 import { confirm, isCancel } from "@clack/prompts";
+import { z } from "zod";
 import { randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 //#region src/commands/auth/device-auth.ts

package/dist/authored-workflow-ref-fkHEEVnd.mjs

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+
+import { M as WorkflowResolutionError, N as throwReportedCliExit, p as ui } from "./keystroke.mjs";
+import { t as assertWorkflowProjectRoot } from "./project-config-DudGRFPO.mjs";
+import { a as readManifestsFromOutDir } from "./dist-BmbFJq8U.mjs";
+import { t as requireWorkflowsDir } from "./resolve-project-DLKlAy0z.mjs";
+import { t as createSpinnerProgress } from "./spinner-progress-BYxlr3lY.mjs";
+import { a as runWorkflowBuild, n as renderBuildFailure } from "./workflow-build-Bm8JoVv4.mjs";
+import { i as formatWorkflowInputFlag } from "./schema-display-sZ6ConJd.mjs";
+//#region src/commands/workflows/_shared/authored-workflow-ref.ts
+function workflowIdCommand(label, example) {
+	return {
+		label,
+		example
+	};
+}
+/** Command-specific hints when a display name is passed instead of an authored workflow id. */
+const WORKFLOW_ID_COMMANDS = {
+	run: workflowIdCommand("keystroke workflows run", (id, inputSchema) => `$ keystroke workflows run ${id} ${formatWorkflowInputFlag(inputSchema)}`),
+	test: workflowIdCommand("keystroke workflows test", (id, inputSchema) => `$ keystroke workflows test ${id} ${formatWorkflowInputFlag(inputSchema)}`),
+	diff: workflowIdCommand("keystroke workflows diff", (id) => `$ keystroke workflows diff ${id}`),
+	inspect: workflowIdCommand("keystroke workflows inspect", (id) => `$ keystroke workflows inspect ${id}`),
+	inspectDeployed: workflowIdCommand("keystroke workflows inspect --deployed", (id) => `$ keystroke workflows inspect ${id} --deployed`),
+	validate: workflowIdCommand("keystroke workflows validate", (id) => `$ keystroke workflows validate ${id}`),
+	build: workflowIdCommand("keystroke workflows build", (id) => `$ keystroke workflows build --id ${id}`),
+	env: workflowIdCommand("keystroke workflows env", (id) => `$ keystroke workflows env ${id}`),
+	logs: workflowIdCommand("keystroke workflows logs", (id) => `$ keystroke workflows logs ${id}`),
+	paused: workflowIdCommand("keystroke workflows paused", (id) => `$ keystroke workflows paused ${id}`)
+};
+/**
+* Rejects refs that match a local manifest display name but not an authored workflow id.
+*/
+async function assertAuthoredWorkflowId(workflowRef, workflowsDir, command, options = {}) {
+	let manifests = await readManifestsFromOutDir(workflowsDir);
+	if (isAuthoredWorkflowId(workflowRef, manifests)) return;
+	rejectDisplayNameRefIfFound(workflowRef, manifests, command);
+	if (!options.refreshManifests) return;
+	try {
+		await runWorkflowBuild({
+			workflowsDir,
+			verbose: false,
+			force: false
+		});
+	} catch {
+		return;
+	}
+	manifests = await readManifestsFromOutDir(workflowsDir);
+	if (isAuthoredWorkflowId(workflowRef, manifests)) return;
+	rejectDisplayNameRefIfFound(workflowRef, manifests, command);
+}
+function rejectDisplayNameRefIfFound(workflowRef, manifests, command) {
+	const match = findUniqueDisplayNameMatch(workflowRef, manifests);
+	if (!match) return;
+	const authoredWorkflowId = match.manifest.id;
+	const inputSchema = match.manifest.workflowSchemas?.input;
+	ui.error(`\`${command.label}\` expects the workflow id "${authoredWorkflowId}", not display name "${workflowRef}".`);
+	ui.hint(command.example(authoredWorkflowId, inputSchema));
+	throwReportedCliExit(`\`${command.label}\` expects the workflow id "${authoredWorkflowId}", not display name "${workflowRef}".`);
+}
+function isAuthoredWorkflowId(workflowRef, manifests) {
+	return manifests.some(({ manifest }) => manifest.id === workflowRef);
+}
+function findUniqueDisplayNameMatch(workflowRef, manifests) {
+	const nameMatches = manifests.filter(({ manifest }) => manifest.name === workflowRef);
+	if (nameMatches.length !== 1) return null;
+	return nameMatches[0] ?? null;
+}
+async function requireLocalWorkflowManifest(options) {
+	const workflowsDir = await requireWorkflowsDir(options.path);
+	await assertAuthoredWorkflowId(options.authoredWorkflowId, workflowsDir, options.command);
+	return resolveLocalWorkflowManifest(options.authoredWorkflowId, workflowsDir, { jsonMode: options.jsonMode });
+}
+async function resolveLocalWorkflowManifest(authoredWorkflowId, workflowsDir, options) {
+	let results = await readManifestsFromOutDir(workflowsDir, authoredWorkflowId);
+	if (results.length === 0) {
+		const spinner = !options?.jsonMode ? createSpinnerProgress("[resolve]") : void 0;
+		spinner?.start(`Building "${authoredWorkflowId}" to resolve manifest...`);
+		try {
+			await runWorkflowBuild({
+				workflowsDir,
+				workflowRef: authoredWorkflowId,
+				verbose: false,
+				force: false
+			});
+			spinner?.stop();
+		} catch (error) {
+			spinner?.stop();
+			renderBuildFailure(error);
+			throw new WorkflowResolutionError(`Build failed for "${authoredWorkflowId}"`);
+		}
+		results = await readManifestsFromOutDir(workflowsDir, authoredWorkflowId);
+	}
+	const found = results[0];
+	if (!found) {
+		ui.error(`Workflow "${authoredWorkflowId}" not found.`);
+		throw new WorkflowResolutionError(`Workflow "${authoredWorkflowId}" not found.`);
+	}
+	const manifestId = typeof found.manifest.id === "string" && found.manifest.id.length > 0 ? found.manifest.id : null;
+	if (!manifestId) {
+		ui.error(`Workflow "${authoredWorkflowId}" is missing an authored workflow ID.`);
+		throw new WorkflowResolutionError(`Workflow "${authoredWorkflowId}" is missing an authored workflow ID.`);
+	}
+	const projectConfig = await assertWorkflowProjectRoot(workflowsDir);
+	return {
+		workflowsDir,
+		organizationId: projectConfig.organizationId,
+		projectId: projectConfig.projectId,
+		authoredWorkflowId: manifestId,
+		manifest: found.manifest
+	};
+}
+//#endregion
+export { assertAuthoredWorkflowId as n, requireLocalWorkflowManifest as r, WORKFLOW_ID_COMMANDS as t };

package/dist/{build-agents-DseUtzd4-CSGpNXur.mjs → build-agents-CUzBnlAG-3ePFZiJ6.mjs}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 import { n as readOptionalJsonSchemaKeys, t as manifestToDeclaredCredentialRequirement } from "./declared-credential-requirements-B6h4WRv4.mjs";
-import { t as AgentVersionManifestSchema } from "./agent-manifest-De5TCxZq.mjs";
+import { t as AgentVersionManifestSchema } from "./agent-manifest-DfWD5tvv.mjs";
 import { i as createAgentSandboxPackage, n as AGENT_VM_PI_SKILLS_ROOT, r as AGENT_VM_TOOLS_RUNTIME_RELATIVE_PATH, t as AGENT_VM_HOST_CALL_RELATIVE_PATH } from "./agent-bundle-package-DWV6B_5q-B-qzc3zC.mjs";
-import { t as readCredentialKeysFromSchemaObject } from "./read-credential-keys-77a91T8M-DGK5XTQp.mjs";
-import { t as bundleSandboxAgentTarget } from "./workflow-bundler-BzHk73PM-muPv1yGG.mjs";
+import { t as readCredentialKeysFromSchemaObject } from "./read-credential-keys-77a91T8M-I07NYwfH.mjs";
+import { t as bundleSandboxAgentTarget } from "./workflow-bundler-Bs3zQNQv-Dy7lXxy3.mjs";
 import { builtinModules } from "node:module";
 import path from "node:path";
 import { lstat, readFile, readdir, realpath } from "node:fs/promises";
@@ -166,7 +166,7 @@ const HOST_CALL_STUB_SOURCE = [
 	"}"
 ].join("\n");
 //#endregion
-//#region ../../packages/workflow-builder/dist/build-agents-DseUtzd4.mjs
+//#region ../../packages/workflow-builder/dist/build-agents-CUzBnlAG.mjs
 const STAGED_LOCAL_SOURCES_PREFIX = ".keystroke/staged-local-sources";
 function normalizeRelativeSandboxPath(targetPath) {
 	const normalized = path.posix.normalize(targetPath);
@@ -258,11 +258,10 @@ function resolveSkillSourceTarget(absolutePath) {
 	return normalizeRelativeSandboxPath(path.posix.join(relativeSkillsRoot, skillDirName));
 }
 async function collectSandboxSourceFiles(projectRoot, source) {
-	if (source.type === "local") return collectBootstrapFilesFromPath({
+	return collectBootstrapFilesFromPath({
 		absolutePath: resolveLocalFilesystemPath(projectRoot, source.path),
 		targetPath: resolveLocalSourceTarget(source.path)
 	});
-	return [];
 }
 async function collectSkillSourceFiles(projectRoot, skill) {
 	const absolutePath = await resolveSkillSourceDirectory(projectRoot, skill.path);
@@ -320,14 +319,16 @@ function createSandboxBlock(agentManifest) {
 	const sandbox = agentManifest.sandbox;
 	if (!sandbox) return void 0;
 	const setupCommands = sandbox.setupCommands ? [...sandbox.setupCommands] : [];
+	const runCommands = sandbox.runCommands ? [...sandbox.runCommands] : [];
 	const fileSources = sandbox.fileSources ? [...sandbox.fileSources] : [];
 	return {
-		...sandbox.runtime ? { runtime: {
-			runCommands: sandbox.runtime.runCommands ?? [],
-			env: sandbox.runtime.env ?? {},
-			...sandbox.runtime.workdir ? { workdir: sandbox.runtime.workdir } : {}
-		} } : {},
+		id: sandbox.id,
+		name: sandbox.name,
+		...sandbox.description ? { description: sandbox.description } : {},
+		...sandbox.workdir ? { workdir: sandbox.workdir } : {},
 		...setupCommands.length > 0 ? { setupCommands } : {},
+		...runCommands.length > 0 ? { runCommands } : {},
+		...sandbox.env ? { env: sandbox.env } : {},
 		...fileSources.length > 0 ? { fileSources } : {}
 	};
 }

package/dist/{build-progress-DLM1Bt4T.mjs → build-progress-CM-b6Bby.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { P as logger } from "./keystroke.mjs";
-import { n as formatProgressDuration, t as createSpinnerProgress } from "./spinner-progress-lrKDs4YF.mjs";
+import { I as logger } from "./keystroke.mjs";
+import { n as formatProgressDuration, t as createSpinnerProgress } from "./spinner-progress-BYxlr3lY.mjs";
 //#region src/lib/build-progress.ts
 const NEW_STAGE_LABELS = {
 	start: "Starting build",

package/dist/{build-tasks-C09SdfjC-BmAVLTtQ.mjs → build-tasks-5eOvI19S-tbN6CRx9.mjs}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
-import { n as TaskBuildManifestSchema } from "./task-BWuIKWh4.mjs";
-import { n as bundleWorkflowTarget } from "./workflow-bundler-BzHk73PM-muPv1yGG.mjs";
-import { t as buildTriggerArtifacts } from "./trigger-artifacts-BcRScRSp-BiD2h6do.mjs";
+import { n as TaskBuildManifestSchema } from "./task-DTvLzUkA.mjs";
+import { n as bundleWorkflowTarget } from "./workflow-bundler-Bs3zQNQv-Dy7lXxy3.mjs";
+import { t as buildTriggerArtifacts } from "./trigger-artifacts-BcRScRSp-BRpU-He5.mjs";
 import { performance } from "node:perf_hooks";
-//#region ../../packages/workflow-builder/dist/build-tasks-C09SdfjC.mjs
+//#region ../../packages/workflow-builder/dist/build-tasks-5eOvI19S.mjs
 async function buildTaskArtifact(options) {
 	const { discoveredWorkflow, taskMetadata, projectRoot } = options;
 	const totalStartedAt = performance.now();

package/dist/{build-workflows-BZ_m97Pr-BiyptCrn.mjs → build-workflows-C-gQM3l5-_zcBHE3M.mjs}

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 
-import { p as deduplicateCredentialRequirementEntries } from "./credential-requirements-D0mavK8j-CFMf0Xwu.mjs";
-import { r as WorkflowBuildManifestSchema, t as WORKFLOW_MANIFEST_GENERATOR } from "./workflow-build-manifest-1sC52TIG.mjs";
+import { p as deduplicateCredentialRequirementEntries } from "./credential-requirements-B5Alhu1v-DanlSKnT.mjs";
+import { r as WorkflowBuildManifestSchema, t as WORKFLOW_MANIFEST_GENERATOR } from "./workflow-build-manifest-CV6bBmDO.mjs";
 import { a as MANIFEST_FILE_NAME, i as FLOW_FILE_NAME, r as BUNDLE_FILE_NAME, s as SOURCE_MAP_FILE_NAME, t as BUILD_DIR_NAME } from "./layout-B95Tku8F.mjs";
 import { t as runWithConcurrency } from "./concurrency-gXn9Rw8x-CnBnF2cg.mjs";
-import { n as WorkflowLoaderProtocolError, r as WorkflowMetadataLoadError, s as createLoaderProtocolFailure } from "./import-module-y0glInUe-DV_3dsU0.mjs";
+import { n as WorkflowLoaderProtocolError, r as WorkflowMetadataLoadError, s as createLoaderProtocolFailure } from "./import-module-y0glInUe-EuAWaw9g.mjs";
 import { r as toRelativeFilePath } from "./normalize-path-CojS-CgQ-aOM0agxS.mjs";
-import { n as bundleWorkflowTarget } from "./workflow-bundler-BzHk73PM-muPv1yGG.mjs";
-import { t as buildTriggerArtifacts } from "./trigger-artifacts-BcRScRSp-BiD2h6do.mjs";
+import { n as bundleWorkflowTarget } from "./workflow-bundler-Bs3zQNQv-Dy7lXxy3.mjs";
+import { t as buildTriggerArtifacts } from "./trigger-artifacts-BcRScRSp-BRpU-He5.mjs";
 import * as path$1 from "node:path";
 import { readFile } from "node:fs/promises";
 import { realpathSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { performance } from "node:perf_hooks";
-//#region ../../packages/workflow-builder/dist/build-workflows-BZ_m97Pr.mjs
+//#region ../../packages/workflow-builder/dist/build-workflows-C-gQM3l5.mjs
 /**
 * Resolves and categorizes all dependencies for a workflow manifest.
 * - Local files: relative paths with SHA256 content hashes
@@ -136,13 +136,18 @@ async function buildWorkflowArtifacts(options) {
 			workflowCount: options.workflowCount,
 			elapsedMs: 0
 		});
+		let workflowWithId = discoveredWorkflow;
 		try {
 			const { manifest: loadedManifest, flowGraph, triggers: sameFileTriggers, credentialsByCallsiteFingerprint, credentialAttributionWarnings, timing } = metadata;
+			workflowWithId = {
+				...discoveredWorkflow,
+				workflowId: loadedManifest.id
+			};
 			const nestingErrors = flowGraph.diagnostics?.filter((d) => d.startsWith("[nesting-error]"));
 			if (nestingErrors && nestingErrors.length > 0) {
 				for (const nestingError of nestingErrors) failures.push({
 					kind: "workflow",
-					workflow: discoveredWorkflow,
+					workflow: workflowWithId,
 					phase: "flow-graph",
 					error: nestingError.replace("[nesting-error] ", "")
 				});
@@ -204,7 +209,7 @@ async function buildWorkflowArtifacts(options) {
 		} catch (error) {
 			const failure = {
 				kind: "workflow",
-				workflow: discoveredWorkflow,
+				workflow: workflowWithId,
 				phase: "bundle",
 				error: error instanceof Error ? error.message : String(error)
 			};
@@ -212,7 +217,7 @@ async function buildWorkflowArtifacts(options) {
 			options.onProgressEvent?.({
 				phase: "workflow-stage",
 				stage: "failure",
-				workflow: discoveredWorkflow,
+				workflow: workflowWithId,
 				workflowIndex,
 				workflowCount: options.workflowCount,
 				elapsedMs: 0,