@kora-platform/cli 0.7.0-rc1 → 0.8.0-rc2

package/dist/command-registry.js

@@ -6,15 +6,17 @@ const TOP_LEVEL_COMMANDS = [
     "status",
     "activity",
     "workflow",
+    "test",
     "release",
     "run",
+    "audit",
     "artifact",
     "task",
+    "deployment",
+    "environment",
     "org-model",
     "access",
-    "integrations",
-    "mcp",
-    "skills",
+    "extensions",
     "secrets",
     "completion",
     "env",
@@ -31,7 +33,7 @@ export const CLI_ALIASES = Object.freeze({
 });
 const RAW_CLI_COMMANDS = [
     command(["help"], "Show human or machine-readable help for a command path.", {
-        labels: ["read", "help"],
+        labels: ["read", "chat-read", "help"],
         args: [arg("command-path", "Optional command path to inspect.", false)],
         requiresActiveOrg: false
     }),
@@ -63,7 +65,22 @@ const RAW_CLI_COMMANDS = [
         labels: ["local", "auth"]
     }),
     command(["auth", "login"], "Start an interactive login flow and select the active organization.", {
-        labels: ["credential", "auth"]
+        labels: ["credential", "auth"],
+        flags: [
+            flag("base-url", "Platform base URL for this login.", {
+                acceptsValue: true,
+                valueType: "string"
+            })
+        ]
+    }),
+    command(["auth", "signup"], "Create a local account and start a CLI session.", {
+        labels: ["credential", "auth"],
+        flags: [
+            flag("base-url", "Platform base URL for this signup.", {
+                acceptsValue: true,
+                valueType: "string"
+            })
+        ]
     }),
     command(["auth", "logout"], "Clear the current session and revoke the refresh token if possible.", {
         labels: ["credential", "auth"]
@@ -118,32 +135,19 @@ const RAW_CLI_COMMANDS = [
         labels: ["read", "org"],
         requiresActiveOrg: true
     }),
-    command(["org", "import"], "Import an organization bundle from disk.", {
-        labels: ["write", "org"],
-        args: [arg("path", "Path to the import directory or file collection root.")],
-        requiresActiveOrg: true
-    }),
-    command(["org", "bundle", "show"], "Show the current organization bundle snapshot.", {
-        labels: ["read", "org"],
-        flags: [flag("release", "Read a published bundle snapshot.", {
-                acceptsValue: true,
-                valueType: "string"
-            })],
-        requiresActiveOrg: true
-    }),
-    command(["org", "reset"], "Reset the draft project for the active organization.", {
+    command(["org", "reset"], "Reset release, runtime, project, and chat state for the active organization.", {
         labels: ["destructive", "org"],
         destructive: true,
         flags: [flag("yes", "Confirm the destructive operation without an interactive prompt.")],
         requiresActiveOrg: true
     }),
     command(["status"], "Show the current operator home/status summary.", {
-        labels: ["read", "status"],
+        labels: ["read", "chat-read", "status"],
         aliases: [["home"]],
         requiresActiveOrg: true
     }),
     command(["activity", "list"], "List activity events, related tasks, and related runs.", {
-        labels: ["read", "activity"],
+        labels: ["read", "activity", "chat-read"],
         flags: [
             flag("limit", "Maximum number of activity events to return.", {
                 acceptsValue: true,
@@ -165,19 +169,23 @@ const RAW_CLI_COMMANDS = [
             flag("focus-value", "Focused entity name.", {
                 acceptsValue: true,
                 valueType: "string"
+            }),
+            flag("environment", "Filter by environment.", {
+                acceptsValue: true,
+                valueType: "string"
             })
         ],
         paginated: "limit",
         requiresActiveOrg: true
     }),
     command(["activity", "options"], "List valid activity focus filter options.", {
-        labels: ["read", "activity"],
+        labels: ["read", "activity", "chat-read"],
         requiresActiveOrg: true
     }),
     command(["workflow", "list"], "List workflows.", {
         labels: ["read", "workflow"],
         aliases: [["process", "list"]],
-        flags: [flag("release", "Read workflows from a published release.", {
+        flags: [flag("release", "Read workflows from a release.", {
                 acceptsValue: true,
                 valueType: "string"
             })],
@@ -187,7 +195,7 @@ const RAW_CLI_COMMANDS = [
         labels: ["read", "workflow"],
         aliases: [["process", "get"]],
         args: [arg("name", "Workflow name.")],
-        flags: [flag("release", "Read workflow detail from a published release.", {
+        flags: [flag("release", "Read workflow detail from a release.", {
                 acceptsValue: true,
                 valueType: "string"
             })],
@@ -197,7 +205,7 @@ const RAW_CLI_COMMANDS = [
         labels: ["read", "workflow"],
         aliases: [["process", "version", "get"]],
         args: [arg("name", "Workflow name."), arg("version", "Workflow version.")],
-        flags: [flag("release", "Read workflow version from a published release.", {
+        flags: [flag("release", "Read workflow version from a release.", {
                 acceptsValue: true,
                 valueType: "string"
             })],
@@ -207,7 +215,7 @@ const RAW_CLI_COMMANDS = [
         labels: ["read", "workflow"],
         aliases: [["process", "dependencies"]],
         args: [arg("name", "Workflow name."), arg("version", "Workflow version.")],
-        flags: [flag("release", "Read workflow dependencies from a published release.", {
+        flags: [flag("release", "Read workflow dependencies from a release.", {
                 acceptsValue: true,
                 valueType: "string"
             })],
@@ -216,7 +224,7 @@ const RAW_CLI_COMMANDS = [
     command(["workflow", "context"], "Show workflow inspection context.", {
         labels: ["read", "workflow"],
         aliases: [["process", "context"]],
-        flags: [flag("release", "Read workflow context from a published release.", {
+        flags: [flag("release", "Read workflow context from a release.", {
                 acceptsValue: true,
                 valueType: "string"
             })],
@@ -237,7 +245,30 @@ const RAW_CLI_COMMANDS = [
                 knownValues: ["manual", "message"],
                 valueType: "string"
             }),
-            flag("start-event-name", "Published workflow start-event name.", {
+            flag("start-event-name", "Workflow start-event name.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("environment", "Environment whose live deployment starts the workflow.", {
+                acceptsValue: true,
+                valueType: "string"
+            })
+        ],
+        requiresActiveOrg: true
+    }),
+    command(["test", "node"], "Test one workflow node from source files without creating a release.", {
+        labels: ["execution", "chat-execution"],
+        args: [arg("workflow-name", "Workflow name."), arg("node-id", "Workflow node id.")],
+        flags: [
+            flag("workspace", "Path to the source workspace root.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("input", "JSON input as @file.json or - for stdin.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("environment", "Environment used to resolve scoped variables and extension installs.", {
                 acceptsValue: true,
                 valueType: "string"
             })
@@ -245,9 +276,8 @@ const RAW_CLI_COMMANDS = [
         requiresActiveOrg: true
     }),
     command(["release", "list"], "List releases.", {
-        labels: ["read", "release"],
+        labels: ["read", "chat-read", "release"],
         flags: [
-            flag("include-draft", "Include the draft release."),
             flag("limit", "Maximum number of releases to return.", {
                 acceptsValue: true,
                 valueType: "number"
@@ -257,51 +287,90 @@ const RAW_CLI_COMMANDS = [
         requiresActiveOrg: true
     }),
     command(["release", "get"], "Show release detail.", {
-        labels: ["read", "release"],
+        labels: ["read", "chat-read", "release"],
         args: [arg("release-id", "Release id.")],
         requiresActiveOrg: true
     }),
-    command(["release", "changes"], "Show draft changes.", {
-        labels: ["read", "release"],
+    command(["release", "create"], "Create an immutable release artifact from source files; this mutates Platform state and is not a test command.", {
+        labels: ["write", "chat-write", "release"],
+        args: [arg("workspace", "Path to the source folder or zip archive.")],
+        flags: [flag("label", "Human label for the release.", {
+                acceptsValue: true,
+                valueType: "string"
+            })],
         requiresActiveOrg: true
     }),
-    command(["release", "deployment", "get"], "Show deployment detail for a release deployment id.", {
-        labels: ["read", "release"],
-        args: [arg("deployment-id", "Deployment id.")],
+    command(["release", "validate"], "Validate release readiness without deploying.", {
+        labels: ["read", "chat-read", "release"],
+        args: [arg("release-id", "Release id.")],
+        flags: [flag("environment", "Validate against one environment's configuration.", {
+                acceptsValue: true,
+                valueType: "string"
+            })],
         requiresActiveOrg: true
     }),
-    command(["release", "publish"], "Publish the current draft release.", {
-        labels: ["publish", "release"],
-        flags: [flag("reason", "Human reason for the publication.", {
+    command(["release", "source"], "Write frozen release source files to a local directory.", {
+        labels: ["read", "chat-read", "release"],
+        args: [arg("release-id", "Release id.")],
+        flags: [flag("out", "Directory to write the release source into.", {
                 acceptsValue: true,
+                required: true,
                 valueType: "string"
             })],
         requiresActiveOrg: true
     }),
-    command(["release", "retry"], "Retry a failed publication.", {
-        labels: ["publish", "release"],
-        args: [arg("release-id", "Release id.")],
+    command(["environment", "list"], "List environments.", {
+        labels: ["read", "chat-read", "environment"],
         requiresActiveOrg: true
     }),
-    command(["release", "discard"], "Discard the current draft release.", {
-        labels: ["destructive", "release"],
-        destructive: true,
-        flags: [flag("yes", "Confirm the destructive operation without an interactive prompt.")],
+    command(["environment", "get"], "Show environment detail.", {
+        labels: ["read", "chat-read", "environment"],
+        args: [arg("environment", "Environment key.")],
         requiresActiveOrg: true
     }),
-    command(["release", "restore"], "Restore a published release into draft.", {
-        labels: ["destructive", "release"],
-        args: [arg("release-id", "Release id.")],
+    command(["environment", "create"], "Create an environment.", {
+        labels: ["write", "environment"],
+        args: [arg("environment", "Environment key.")],
+        flags: [
+            flag("name", "Display name.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("copy-from", "Environment key or id to copy configuration from.", {
+                acceptsValue: true,
+                valueType: "string"
+            })
+        ],
+        requiresActiveOrg: true
+    }),
+    command(["environment", "rename"], "Rename an environment.", {
+        labels: ["write", "environment"],
+        args: [arg("environment", "Environment key."), arg("name", "New display name.")],
+        requiresActiveOrg: true
+    }),
+    command(["environment", "archive"], "Archive an environment.", {
+        labels: ["destructive", "environment"],
+        args: [arg("environment", "Environment key.")],
         destructive: true,
         flags: [flag("yes", "Confirm the destructive operation without an interactive prompt.")],
         requiresActiveOrg: true
     }),
-    command(["release", "deactivate"], "Deactivate a published release.", {
-        labels: ["destructive", "release"],
-        args: [arg("release-id", "Release id.")],
+    command(["environment", "deploy"], "Deploy a release to an environment.", {
+        labels: ["write", "chat-write", "environment", "deployment", "release"],
+        args: [arg("environment", "Environment key."), arg("release", "Release id.")],
+        flags: [flag("policy", "Replacement policy for previous live deployment.", {
+                acceptsValue: true,
+                knownValues: ["drain", "terminate-running"],
+                valueType: "string"
+            })],
+        requiresActiveOrg: true
+    }),
+    command(["environment", "undeploy"], "Undeploy the live deployment from an environment.", {
+        labels: ["destructive", "environment", "deployment"],
+        args: [arg("environment", "Environment key.")],
         destructive: true,
         flags: [
-            flag("policy", "Run deactivation policy.", {
+            flag("policy", "Undeploy policy.", {
                 acceptsValue: true,
                 knownValues: ["drain", "terminate-running"],
                 valueType: "string"
@@ -310,9 +379,37 @@ const RAW_CLI_COMMANDS = [
         ],
         requiresActiveOrg: true
     }),
+    command(["deployment", "list"], "List environment deployments.", {
+        labels: ["read", "chat-read", "deployment"],
+        flags: [
+            flag("environment", "Filter by environment.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("limit", "Maximum number of deployments to return.", {
+                acceptsValue: true,
+                valueType: "number"
+            })
+        ],
+        paginated: "limit",
+        requiresActiveOrg: true
+    }),
+    command(["deployment", "get"], "Show environment deployment detail.", {
+        labels: ["read", "chat-read", "deployment"],
+        args: [arg("deployment", "Deployment id.")],
+        flags: [flag("environment", "Validate deployment belongs to environment.", {
+                acceptsValue: true,
+                valueType: "string"
+            })],
+        requiresActiveOrg: true
+    }),
     command(["run", "list"], "List workflow runs.", {
-        labels: ["read", "run"],
+        labels: ["read", "chat-read", "run"],
         flags: [
+            flag("environment", "Filter by environment.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
             flag("limit", "Maximum number of runs to return.", {
                 acceptsValue: true,
                 valueType: "number"
@@ -326,17 +423,17 @@ const RAW_CLI_COMMANDS = [
         requiresActiveOrg: true
     }),
     command(["run", "get"], "Show run detail.", {
-        labels: ["read", "run"],
+        labels: ["read", "chat-read", "run"],
         args: [arg("workflow-id", "Workflow id.")],
         requiresActiveOrg: true
     }),
     command(["run", "state"], "Show run state.", {
-        labels: ["read", "run"],
+        labels: ["read", "chat-read", "run"],
         args: [arg("workflow-id", "Workflow id.")],
         requiresActiveOrg: true
     }),
     command(["run", "steps"], "List run steps.", {
-        labels: ["read", "run"],
+        labels: ["read", "chat-read", "run"],
         args: [arg("workflow-id", "Workflow id.")],
         flags: [
             flag("limit", "Maximum number of steps to return.", {
@@ -374,8 +471,57 @@ const RAW_CLI_COMMANDS = [
         flags: [flag("yes", "Confirm the destructive operation without an interactive prompt.")],
         requiresActiveOrg: true
     }),
-    command(["artifact", "upload"], "Upload one local file as a managed workflow artifact.", {
-        labels: ["execution", "artifact"],
+    command(["audit", "list"], "List organization audit events.", {
+        labels: ["read", "audit"],
+        flags: [
+            flag("action", "Filter by audit action.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("actor", "Filter by actor id.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("category", "Filter by audit category.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("from", "Start timestamp in ISO-8601 format.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("limit", "Maximum number of audit events to return.", {
+                acceptsValue: true,
+                valueType: "number"
+            }),
+            flag("outcome", "Filter by audit outcome.", {
+                acceptsValue: true,
+                knownValues: ["denied", "failed", "succeeded"],
+                valueType: "string"
+            }),
+            flag("resource-id", "Filter by audited resource id.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("resource-type", "Filter by audited resource type.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("to", "End timestamp in ISO-8601 format.", {
+                acceptsValue: true,
+                valueType: "string"
+            })
+        ],
+        paginated: "limit",
+        requiresActiveOrg: true
+    }),
+    command(["audit", "get"], "Show one organization audit event.", {
+        labels: ["read", "audit"],
+        args: [arg("event-id", "Audit event id.")],
+        requiresActiveOrg: true
+    }),
+    command(["artifact", "upload"], "Upload one local file as a managed runtime artifact.", {
+        labels: ["execution", "chat-execution", "artifact"],
         args: [arg("path", "Local file path to upload.")],
         flags: [
             flag("name", "Artifact display name. Defaults to the local file name.", {
@@ -404,7 +550,71 @@ const RAW_CLI_COMMANDS = [
         ],
         requiresActiveOrg: true
     }),
-    command(["artifact", "download"], "Download one managed workflow artifact to a local file.", {
+    command(["artifact", "inventory"], "List organization runtime artifact inventory.", {
+        labels: ["read", "artifact"],
+        flags: [
+            flag("producer-type", "Filter by artifact producer type.", {
+                acceptsValue: true,
+                knownValues: ["workflow_capture", "upload", "review_upload", "workflow_node_test_capture"],
+                valueType: "string"
+            }),
+            flag("association-role", "Filter by artifact association role.", {
+                acceptsValue: true,
+                knownValues: ["input", "output", "review"],
+                valueType: "string"
+            }),
+            flag("association-kind", "Filter by artifact association kind.", {
+                acceptsValue: true,
+                knownValues: ["origin", "usage"],
+                valueType: "string"
+            }),
+            flag("run-id", "Filter by workflow run id.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("workflow-id", "Filter by workflow definition id.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("workflow-node-test-id", "Filter by workflow-node test id.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("node-id", "Filter by node id.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("media-type", "Filter by artifact media type.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("lifecycle-status", "Filter by artifact lifecycle status.", {
+                acceptsValue: true,
+                knownValues: ["active", "archived", "purged", "all"],
+                valueType: "string"
+            }),
+            flag("created-after", "Filter to artifacts created at or after this ISO-8601 timestamp.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("created-before", "Filter to artifacts created before this ISO-8601 timestamp.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("limit", "Maximum number of artifacts to return.", {
+                acceptsValue: true,
+                valueType: "number"
+            })
+        ],
+        paginated: "limit",
+        requiresActiveOrg: true
+    }),
+    command(["artifact", "inspect"], "Inspect one runtime artifact and its associations.", {
+        labels: ["read", "artifact"],
+        args: [arg("artifact-id", "Artifact id.")],
+        requiresActiveOrg: true
+    }),
+    command(["artifact", "download"], "Download one managed runtime artifact to a local file.", {
         labels: ["execution", "artifact"],
         args: [arg("artifact-id", "Artifact id.")],
         flags: [
@@ -427,6 +637,23 @@ const RAW_CLI_COMMANDS = [
         ],
         requiresActiveOrg: true
     }),
+    command(["artifact", "archive"], "Archive one runtime artifact so it remains inspectable but cannot be downloaded or reused.", {
+        labels: ["execution", "artifact"],
+        args: [arg("artifact-id", "Artifact id.")],
+        requiresActiveOrg: true
+    }),
+    command(["artifact", "restore"], "Restore one archived runtime artifact to active use.", {
+        labels: ["execution", "artifact"],
+        args: [arg("artifact-id", "Artifact id.")],
+        requiresActiveOrg: true
+    }),
+    command(["artifact", "purge"], "Purge runtime artifact bytes while preserving provenance metadata.", {
+        labels: ["destructive", "artifact"],
+        args: [arg("artifact-id", "Artifact id.")],
+        destructive: true,
+        flags: [flag("yes", "Confirm the destructive operation without an interactive prompt.")],
+        requiresActiveOrg: true
+    }),
     command(["task", "list"], "List tasks.", {
         labels: ["read", "task"],
         aliases: [["inbox", "list"]],
@@ -521,22 +748,6 @@ const RAW_CLI_COMMANDS = [
         args: [arg("name", "Operation name.")],
         requiresActiveOrg: true
     }),
-    command(["org-model", "connectors", "list"], "List connectors.", {
-        labels: ["read", "org-model"], requiresActiveOrg: true
-    }),
-    command(["org-model", "connectors", "get"], "Show one connector.", {
-        labels: ["read", "org-model"],
-        args: [arg("name", "Connector name.")],
-        requiresActiveOrg: true
-    }),
-    command(["org-model", "mcp-servers", "list"], "List MCP servers.", {
-        labels: ["read", "org-model"], requiresActiveOrg: true
-    }),
-    command(["org-model", "mcp-servers", "get"], "Show one MCP server.", {
-        labels: ["read", "org-model"],
-        args: [arg("name", "MCP server name.")],
-        requiresActiveOrg: true
-    }),
     command(["access", "members", "list"], "List organization members.", {
         labels: ["read", "access"],
         flags: [
@@ -658,220 +869,247 @@ const RAW_CLI_COMMANDS = [
         flags: [flag("yes", "Confirm the destructive operation without an interactive prompt.")],
         requiresActiveOrg: true
     }),
-    command(["integrations", "list"], "List backend-discovered integrations that can be used in this organization.", {
-        labels: ["read", "integration"],
-        requiresActiveOrg: true
-    }),
-    command(["integrations", "diagnostics"], "List backend-discovered integration setup diagnostics.", {
-        labels: ["read", "integration"],
-        requiresActiveOrg: true
-    }),
-    command(["integrations", "get"], "Show one backend-discovered integration.", {
-        labels: ["read", "integration"],
-        args: [arg("integration-id", "Integration id.")],
-        requiresActiveOrg: true
-    }),
-    command(["integrations", "connections"], "List connected accounts for one backend-discovered integration.", {
-        labels: ["read", "integration"],
-        args: [arg("integration-id", "Integration id.")],
-        requiresActiveOrg: true
-    }),
-    command(["integrations", "actions"], "List backend action descriptors for one integration.", {
-        labels: ["read", "integration"],
-        args: [arg("integration-id", "Integration id.")],
+    command(["extensions", "validate"], "Validate an extension package directory or archive-expanded root.", {
+        labels: ["read", "chat-read", "extension"],
+        args: [arg("path", "Path to an extension package directory.")],
+        flags: [
+            flag("subdir", "Validate a subdirectory from a zip archive.", {
+                acceptsValue: true,
+                valueType: "string"
+            })
+        ],
         requiresActiveOrg: true
     }),
-    command(["integrations", "action"], "Run one CLI-safe backend action for an integration.", {
-        labels: ["action", "integration"],
-        args: [
-            arg("integration-id", "Integration id."),
-            arg("action-id", "Backend action id.")
-        ],
+    command(["extensions", "export"], "Export extension package source files.", {
+        labels: ["read", "extension"],
         flags: [
-            flag("connection", "Connection reference to bind to this action.", {
+            flag("install", "Export the revision currently used by an install id or slug.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("environment", "Target environment when exporting by install.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("revision", "Export a package revision by id.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("package", "Export a package by name. Use with --latest.", {
                 acceptsValue: true,
                 valueType: "string"
             }),
-            flag("input", "Structured JSON action input via @file.json or - for stdin.", {
+            flag("latest", "Export the latest revision for --package."),
+            flag("out", "Directory to write the exported files and .kora/export.json metadata.", {
                 acceptsValue: true,
                 valueType: "string"
             }),
-            flag("open", "Open returned external URLs in a browser."),
-            flag("no-open", "Do not open returned external URLs in a browser.")
+            flag("format", "Output format.", {
+                acceptsValue: true,
+                knownValues: ["json", "zip"],
+                valueType: "string"
+            })
         ],
         requiresActiveOrg: true
     }),
-    command(["mcp", "list"], "List organization-managed MCP servers.", {
-        labels: ["read", "mcp"],
-        requiresActiveOrg: true
-    }),
-    command(["mcp", "get"], "Show one organization-managed MCP server.", {
-        labels: ["read", "mcp"],
-        args: [arg("server", "MCP server id or slug.")],
+    command(["extensions", "publish"], "Publish a validated extension package revision.", {
+        labels: ["write", "chat-write", "extension"],
+        args: [arg("path", "Path to an extension package directory.")],
+        flags: [
+            flag("subdir", "Publish a subdirectory from a zip archive.", {
+                acceptsValue: true,
+                valueType: "string"
+            })
+        ],
         requiresActiveOrg: true
     }),
-    command(["mcp", "create"], "Create an organization-managed MCP server.", {
-        labels: ["write", "mcp"],
+    command(["extensions", "install"], "Install a published extension package revision.", {
+        labels: ["write", "extension"],
+        args: [
+            arg("package-revision", "Extension package revision id."),
+            arg("slug", "Install slug.")
+        ],
         flags: [
-            flag("name", "MCP server display name.", {
+            flag("environment", "Target environment.", {
                 acceptsValue: true,
                 required: true,
                 valueType: "string"
             }),
-            flag("slug", "MCP server slug.", {
+            flag("permissions", "Granted permissions JSON via @file.json or - for stdin.", {
+                acceptsValue: true,
+                valueType: "string"
+            })
+        ],
+        requiresActiveOrg: true
+    }),
+    command(["extensions", "grant"], "Replace the granted permissions for an extension install.", {
+        labels: ["write", "extension"],
+        args: [arg("install", "Extension install id or slug.")],
+        flags: [
+            flag("environment", "Target environment.", {
                 acceptsValue: true,
                 required: true,
                 valueType: "string"
             }),
-            flag("url", "Streamable HTTP MCP server URL.", {
+            flag("permissions", "Granted permissions JSON via @file.json or - for stdin.", {
                 acceptsValue: true,
                 required: true,
                 valueType: "string"
             }),
-            flag("auth-mode", "MCP auth mode.", {
+            flag("base-package-revision", "Expected current package revision id precondition.", {
                 acceptsValue: true,
-                knownValues: ["none", "oauth"],
                 valueType: "string"
             }),
-            flag("timeout-ms", "Connection timeout in milliseconds.", {
+            flag("base-updated-at", "Expected current install updatedAt precondition.", {
                 acceptsValue: true,
-                valueType: "number"
+                valueType: "string"
             })
         ],
         requiresActiveOrg: true
     }),
-    command(["mcp", "update"], "Update an organization-managed MCP server.", {
-        labels: ["write", "mcp"],
-        args: [arg("server", "MCP server id or slug.")],
+    command(["extensions", "update"], "Update an extension install to another package revision.", {
+        labels: ["write", "extension"],
+        args: [arg("install", "Extension install id or slug.")],
         flags: [
-            flag("name", "MCP server display name.", {
+            flag("environment", "Target environment.", {
                 acceptsValue: true,
+                required: true,
                 valueType: "string"
             }),
-            flag("url", "Streamable HTTP MCP server URL.", {
+            flag("revision", "Target extension package revision id.", {
                 acceptsValue: true,
+                required: true,
                 valueType: "string"
             }),
-            flag("auth-mode", "MCP auth mode.", {
+            flag("dry-run", "Plan the install update without mutating it."),
+            flag("base-package-revision", "Expected current package revision id precondition.", {
                 acceptsValue: true,
-                knownValues: ["none", "oauth"],
                 valueType: "string"
             }),
-            flag("disable", "Disable the MCP server until it is explicitly enabled again."),
-            flag("enable", "Enable a disabled MCP server as draft; test it before use."),
-            flag("timeout-ms", "Connection timeout in milliseconds.", {
+            flag("base-updated-at", "Expected current install updatedAt precondition.", {
                 acceptsValue: true,
-                valueType: "number"
+                valueType: "string"
             })
         ],
         requiresActiveOrg: true
     }),
-    command(["mcp", "test"], "Test one organization-managed MCP server.", {
-        labels: ["probe", "mcp"],
-        args: [arg("server", "MCP server id or slug.")],
-        requiresActiveOrg: true
-    }),
-    command(["mcp", "discover-tools"], "Discover tools for one organization-managed MCP server.", {
-        labels: ["probe", "mcp"],
-        args: [arg("server", "MCP server id or slug.")],
+    command(["extensions", "built-ins", "list"], "List available built-in extensions.", {
+        labels: ["read", "extension"],
+        flags: [flag("environment", "Target environment.", {
+                acceptsValue: true,
+                valueType: "string"
+            })],
         requiresActiveOrg: true
     }),
-    command(["mcp", "connect"], "Start OAuth for one organization-managed MCP server.", {
-        labels: ["credential", "mcp"],
-        args: [arg("server", "MCP server id or slug.")],
+    command(["extensions", "built-ins", "install"], "Install a built-in extension.", {
+        labels: ["write", "extension"],
+        args: [arg("built-in", "Built-in extension slug.")],
         flags: [
-            flag("open", "Open the authorization URL in a browser."),
-            flag("no-open", "Do not open the authorization URL in a browser."),
-            flag("wait", "Poll until the OAuth session is connected or failed.")
+            flag("environment", "Target environment.", {
+                acceptsValue: true,
+                required: true,
+                valueType: "string"
+            }),
+            flag("slug", "Install slug. Defaults to the built-in slug.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("permissions", "Granted permissions JSON via @file.json or - for stdin.", {
+                acceptsValue: true,
+                valueType: "string"
+            })
         ],
         requiresActiveOrg: true
     }),
-    command(["mcp", "oauth-status"], "Show OAuth status for one organization-managed MCP server.", {
-        labels: ["read", "mcp"],
-        args: [arg("server", "MCP server id or slug.")],
-        requiresActiveOrg: true
-    }),
-    command(["mcp", "disconnect"], "Disconnect OAuth for one organization-managed MCP server.", {
-        labels: ["destructive", "mcp"],
-        args: [arg("server", "MCP server id or slug.")],
-        destructive: true,
-        flags: [flag("yes", "Confirm the destructive operation without an interactive prompt.")],
-        requiresActiveOrg: true
-    }),
-    command(["mcp", "delete"], "Delete an organization-managed MCP server.", {
-        labels: ["destructive", "mcp"],
-        args: [arg("server", "MCP server id or slug.")],
-        destructive: true,
-        flags: [flag("yes", "Confirm the destructive operation without an interactive prompt.")],
-        requiresActiveOrg: true
-    }),
-    command(["skills", "list"], "List organization-managed skill packages.", {
-        labels: ["read", "skill"],
+    command(["extensions", "list"], "List extension installs.", {
+        labels: ["read", "chat-read", "extension"],
+        flags: [flag("environment", "Target environment.", {
+                acceptsValue: true,
+                valueType: "string"
+            })],
         requiresActiveOrg: true
     }),
-    command(["skills", "get"], "Show one organization-managed skill package.", {
-        labels: ["read", "skill"],
-        args: [arg("skill", "Skill package id or slug.")],
+    command(["extensions", "inspect"], "Show one extension install.", {
+        labels: ["read", "chat-read", "extension"],
+        args: [arg("install", "Extension install id or slug.")],
+        flags: [flag("environment", "Target environment.", {
+                acceptsValue: true,
+                required: true,
+                valueType: "string"
+            })],
         requiresActiveOrg: true
     }),
-    command(["skills", "create"], "Create an organization-managed skill package.", {
-        labels: ["write", "skill"],
-        flags: [
-            flag("slug", "Skill package slug.", { acceptsValue: true, required: true, valueType: "string" }),
-            flag("name", "Skill package display name.", { acceptsValue: true, required: true, valueType: "string" }),
-            flag("description", "Skill package description.", { acceptsValue: true, valueType: "string" }),
-            flag("dir", "Optional directory containing SKILL.md and related package files for the initial revision.", { acceptsValue: true, valueType: "string" })
-        ],
+    command(["extensions", "detail"], "Show extension install detail including registered functions, tools, and settings views.", {
+        labels: ["read", "chat-read", "extension"],
+        args: [arg("install", "Extension install id or slug.")],
+        flags: [flag("environment", "Target environment.", {
+                acceptsValue: true,
+                required: true,
+                valueType: "string"
+            })],
         requiresActiveOrg: true
     }),
-    command(["skills", "upload"], "Upload a new revision for an organization-managed skill package.", {
-        labels: ["write", "skill"],
-        args: [arg("skill", "Skill package id or slug.")],
-        flags: [
-            flag("dir", "Directory containing SKILL.md and related package files.", { acceptsValue: true, required: true, valueType: "string" })
-        ],
+    command(["extensions", "disable"], "Disable an extension install.", {
+        labels: ["write", "extension"],
+        args: [arg("install", "Extension install id or slug.")],
+        flags: [flag("environment", "Target environment.", {
+                acceptsValue: true,
+                required: true,
+                valueType: "string"
+            })],
         requiresActiveOrg: true
     }),
-    command(["skills", "download"], "Download a skill package revision to a directory.", {
-        labels: ["output", "skill"],
-        args: [arg("skill", "Skill package id or slug.")],
-        flags: [
-            flag("revision", "Revision number to download. Defaults to the current revision.", { acceptsValue: true, valueType: "number" }),
-            flag("dir", "Destination directory.", { acceptsValue: true, required: true, valueType: "string" })
-        ],
+    command(["extensions", "enable"], "Enable an extension install.", {
+        labels: ["write", "extension"],
+        args: [arg("install", "Extension install id or slug.")],
+        flags: [flag("environment", "Target environment.", {
+                acceptsValue: true,
+                required: true,
+                valueType: "string"
+            })],
         requiresActiveOrg: true
     }),
-    command(["skills", "update"], "Update organization-managed skill package metadata.", {
-        labels: ["write", "skill"],
-        args: [arg("skill", "Skill package id or slug.")],
+    command(["extensions", "delete"], "Delete an extension install.", {
+        labels: ["destructive", "extension"],
+        args: [arg("install", "Extension install id or slug.")],
+        destructive: true,
         flags: [
-            flag("name", "Skill package display name.", { acceptsValue: true, valueType: "string" }),
-            flag("description", "Skill package description.", { acceptsValue: true, valueType: "string" }),
-            flag("disable", "Disable the skill package until it is explicitly enabled again."),
-            flag("enable", "Enable a disabled skill package.")
+            flag("environment", "Target environment.", {
+                acceptsValue: true,
+                required: true,
+                valueType: "string"
+            }),
+            flag("yes", "Confirm the destructive operation without an interactive prompt.")
         ],
         requiresActiveOrg: true
     }),
-    command(["skills", "delete"], "Delete an organization-managed skill package.", {
-        labels: ["destructive", "skill"],
-        args: [arg("skill", "Skill package id or slug.")],
-        destructive: true,
-        flags: [flag("yes", "Confirm the destructive operation without an interactive prompt.")],
-        requiresActiveOrg: true
-    }),
     command(["env", "list"], "List runtime variables.", {
         labels: ["read", "env"],
+        flags: [flag("environment", "Target environment.", {
+                acceptsValue: true,
+                valueType: "string"
+            })],
         requiresActiveOrg: true
     }),
     command(["env", "get"], "Show one runtime variable.", {
         labels: ["read", "env"],
         args: [arg("name", "Variable name.")],
+        flags: [flag("environment", "Target environment.", {
+                acceptsValue: true,
+                required: true,
+                valueType: "string"
+            })],
         requiresActiveOrg: true
     }),
     command(["env", "replace"], "Replace the full runtime environment from JSON.", {
         labels: ["destructive", "env"],
         destructive: true,
         flags: [
+            flag("environment", "Target environment.", {
+                acceptsValue: true,
+                required: true,
+                valueType: "string"
+            }),
             flag("file", "Environment definition via @env.json or - for stdin.", {
                 acceptsValue: true,
                 required: true,
@@ -884,22 +1122,43 @@ const RAW_CLI_COMMANDS = [
     command(["env", "import"], "Import runtime variables from a .env file.", {
         labels: ["write", "env"],
         args: [arg("path-to-.env", "Path to a .env file.")],
+        flags: [flag("environment", "Target environment.", {
+                acceptsValue: true,
+                required: true,
+                valueType: "string"
+            })],
         requiresActiveOrg: true
     }),
     command(["secrets", "list"], "List organization secret names without values.", {
         labels: ["read", "secret"],
+        flags: [flag("environment", "Target environment.", {
+                acceptsValue: true,
+                valueType: "string"
+            })],
         requiresActiveOrg: true
     }),
     command(["secrets", "set"], "Create or replace one organization secret from stdin.", {
         labels: ["credential", "secret"],
         args: [arg("name", "Secret name.")],
+        flags: [flag("environment", "Target environment.", {
+                acceptsValue: true,
+                required: true,
+                valueType: "string"
+            })],
         requiresActiveOrg: true
     }),
     command(["secrets", "delete"], "Delete one organization secret.", {
         labels: ["destructive", "secret"],
         args: [arg("name", "Secret name.")],
         destructive: true,
-        flags: [flag("yes", "Confirm the destructive operation without an interactive prompt.")],
+        flags: [
+            flag("environment", "Target environment.", {
+                acceptsValue: true,
+                required: true,
+                valueType: "string"
+            }),
+            flag("yes", "Confirm the destructive operation without an interactive prompt.")
+        ],
         requiresActiveOrg: true
     }),
     command(["chat", "health"], "Show chat health.", {
@@ -920,49 +1179,86 @@ const RAW_CLI_COMMANDS = [
         flags: [flag("yes", "Confirm the destructive operation without an interactive prompt.")],
         requiresActiveOrg: true
     }),
-    command(["chat", "changes"], "Show chat session changes.", {
-        labels: ["local", "chat"],
-        args: [arg("session-id", "Session id.")],
-        requiresActiveOrg: true
+    command(["schema", "list"], "List resource schemas exposed by the CLI.", {
+        labels: ["read", "schema", "chat-read"],
+        requiresActiveOrg: false
     }),
-    command(["chat", "validation"], "Show chat session validation.", {
-        labels: ["local", "chat"],
-        args: [arg("session-id", "Session id.")],
-        requiresActiveOrg: true
+    command(["schema", "get"], "Show one resource schema.", {
+        labels: ["read", "schema", "chat-read"],
+        args: [arg("resource-name", "Schema resource name.")],
+        requiresActiveOrg: false
     }),
-    command(["chat", "draft", "get"], "Show the chat draft snapshot.", {
-        labels: ["local", "chat"],
-        args: [arg("session-id", "Session id.")],
+    command(["admin", "usage", "summary"], "Show agent LLM usage totals for an organization.", {
+        labels: ["admin", "read"],
+        flags: [
+            flag("from", "Start timestamp in ISO-8601 format.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("to", "End timestamp in ISO-8601 format.", {
+                acceptsValue: true,
+                valueType: "string"
+            })
+        ],
         requiresActiveOrg: true
     }),
-    command(["chat", "draft", "apply"], "Apply a chat draft.", {
-        labels: ["destructive", "chat"],
-        args: [arg("session-id", "Session id.")],
-        destructive: true,
-        flags: [flag("yes", "Confirm the destructive operation without an interactive prompt.")],
+    command(["admin", "usage", "workflows"], "List agent LLM usage grouped by workflow.", {
+        labels: ["admin", "read"],
+        flags: [
+            flag("from", "Start timestamp in ISO-8601 format.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("to", "End timestamp in ISO-8601 format.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("limit", "Maximum number of workflows to return.", {
+                acceptsValue: true,
+                valueType: "number"
+            })
+        ],
+        paginated: "limit",
         requiresActiveOrg: true
     }),
-    command(["chat", "draft", "refresh"], "Refresh a chat draft.", {
-        labels: ["destructive", "chat"],
-        args: [arg("session-id", "Session id.")],
-        destructive: true,
-        flags: [flag("yes", "Confirm the destructive operation without an interactive prompt.")],
+    command(["admin", "usage", "tools"], "List agent tool calls grouped by tool.", {
+        labels: ["admin", "read"],
+        flags: [
+            flag("from", "Start timestamp in ISO-8601 format.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("to", "End timestamp in ISO-8601 format.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("limit", "Maximum number of tools to return.", {
+                acceptsValue: true,
+                valueType: "number"
+            })
+        ],
+        paginated: "limit",
         requiresActiveOrg: true
     }),
-    command(["chat", "workspace-state"], "Show chat workspace state.", {
-        labels: ["local", "chat"],
-        args: [arg("session-id", "Session id.")],
+    command(["admin", "usage", "events"], "List recent metered agent executions.", {
+        labels: ["admin", "read"],
+        flags: [
+            flag("from", "Start timestamp in ISO-8601 format.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("to", "End timestamp in ISO-8601 format.", {
+                acceptsValue: true,
+                valueType: "string"
+            }),
+            flag("limit", "Maximum number of events to return.", {
+                acceptsValue: true,
+                valueType: "number"
+            })
+        ],
+        paginated: "limit",
         requiresActiveOrg: true
     }),
-    command(["schema", "list"], "List resource schemas exposed by the CLI.", {
-        labels: ["read", "schema"],
-        requiresActiveOrg: false
-    }),
-    command(["schema", "get"], "Show one resource schema.", {
-        labels: ["read", "schema"],
-        args: [arg("resource-name", "Schema resource name.")],
-        requiresActiveOrg: false
-    }),
     command(["admin", "org", "deleted", "list"], "List deleted organizations.", {
         labels: ["admin"],
         requiresActiveOrg: false
@@ -1067,7 +1363,7 @@ export function buildHelpJson(path, input = {}) {
             description: definition.description,
             destructive: definition.destructive,
             examples: definition.examples,
-            flags: definition.flags,
+            flags: buildHelpFlags(definition.flags, Boolean(input.commandFilter)),
             name: definition.path.join(" "),
             paginated: definition.paginated,
             requiresActiveOrg: definition.requiresActiveOrg,
@@ -1082,7 +1378,7 @@ export function buildHelpJson(path, input = {}) {
             : describeCommandGroup(resolveCommandAliases(path)),
         destructive: false,
         examples: [],
-        flags: [flag("json", "Render help as machine-readable JSON.")],
+        flags: buildHelpFlags([flag("json", "Render help as machine-readable JSON.")], false),
         name: path.length === 0 ? "kora" : resolveCommandAliases(path).join(" "),
         paginated: "none",
         requiresActiveOrg: false,
@@ -1093,3 +1389,12 @@ export function buildHelpJson(path, input = {}) {
         supportsJson: true
     };
 }
+function buildHelpFlags(flags, filtered) {
+    return flags
+        .filter((entry) => !filtered || !entry.hiddenWhenCommandFiltered)
+        .map((entry) => {
+        const { hiddenWhenCommandFiltered, ...helpFlag } = entry;
+        void hiddenWhenCommandFiltered;
+        return helpFlag;
+    });
+}