@moxt-ai/cli 0.4.0-beta.0 → 0.4.0

package/dist/index.js

@@ -4,204 +4,15 @@
 import updateNotifier from "update-notifier";
 
 // src/program.ts
-import { Command as Command2 } from "commander";
-
-// src/utils/output.ts
-var colors = {
-  bold: "\x1B[1m",
-  blue: "\x1B[1;34m",
-  green: "\x1B[32m",
-  red: "\x1B[31m",
-  cyan: "\x1B[36m",
-  dim: "\x1B[2m",
-  reset: "\x1B[0m"
-};
-function print(message) {
-  console.log(message);
-}
-function printError(message) {
-  console.error(`${colors.red}${message}${colors.reset}`);
-}
-
-// src/utils/runtime-context.ts
-var DEFAULT_USER_HOST = "api.moxt.ai";
-var SANDBOX_ENV_KEYS = [
-  "BASE_API_HOST",
-  "SANDBOX_TOOL_API_TOKEN",
-  "MOXT_REPO_PAYLOAD",
-  "MOXT_WORKSPACE_ID"
-];
-var RuntimeContextError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "RuntimeContextError";
-  }
-};
-function resolveRuntimeContext(env = process.env) {
-  if (hasAnySandboxEnv(env)) {
-    return resolveSandboxRuntimeContext(env);
-  }
-  const apiKey = readNonEmptyEnv(env, "MOXT_API_KEY");
-  if (apiKey) {
-    return {
-      mode: "user",
-      host: readNonEmptyEnv(env, "MOXT_HOST") ?? DEFAULT_USER_HOST,
-      apiKey
-    };
-  }
-  throw new RuntimeContextError("Missing auth. Set sandbox environment variables or MOXT_API_KEY.");
-}
-function resolveSandboxRuntimeContext(env = process.env) {
-  const missingKeys = SANDBOX_ENV_KEYS.filter((key) => !readNonEmptyEnv(env, key));
-  if (missingKeys.length > 0) {
-    throw new RuntimeContextError(`Incomplete sandbox environment. Missing: ${missingKeys.join(", ")}.`);
-  }
-  return {
-    mode: "sandbox",
-    baseApiHost: normalizeBaseApiHost(readRequiredEnv(env, "BASE_API_HOST")),
-    sandboxToolApiToken: readRequiredEnv(env, "SANDBOX_TOOL_API_TOKEN"),
-    workspaceId: readRequiredEnv(env, "MOXT_WORKSPACE_ID"),
-    repoPayload: parseRepoPayload(readRequiredEnv(env, "MOXT_REPO_PAYLOAD"))
-  };
-}
-function parseRepoPayload(raw) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (error) {
-    throw new RuntimeContextError(`MOXT_REPO_PAYLOAD must be valid JSON: ${error instanceof Error ? error.message : String(error)}`);
-  }
-  if (!isRecord(parsed)) {
-    throw new RuntimeContextError("MOXT_REPO_PAYLOAD must be a JSON object.");
-  }
-  const personal = parseRepoEntry(parsed.personal, "personal");
-  const teamsValue = parsed.teams;
-  if (!Array.isArray(teamsValue)) {
-    throw new RuntimeContextError("MOXT_REPO_PAYLOAD.teams must be an array.");
-  }
-  const teams = teamsValue.map((entry, index) => parseRepoEntry(entry, `teams[${index}]`));
-  const workspace = parsed.workspace == null ? null : parseRepoEntry(parsed.workspace, "workspace");
-  return { personal, teams, workspace };
-}
-function normalizeBaseApiHost(value) {
-  const trimmed = value.trim();
-  if (!trimmed) {
-    throw new RuntimeContextError("BASE_API_HOST must not be empty.");
-  }
-  return trimmed.replace(/\/+$/, "");
-}
-function hasAnySandboxEnv(env) {
-  return SANDBOX_ENV_KEYS.some((key) => readNonEmptyEnv(env, key) !== void 0);
-}
-function readRequiredEnv(env, key) {
-  const value = readNonEmptyEnv(env, key);
-  if (!value) {
-    throw new RuntimeContextError(`${key} is required.`);
-  }
-  return value;
-}
-function readNonEmptyEnv(env, key) {
-  const value = env[key];
-  if (typeof value !== "string") return void 0;
-  const trimmed = value.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
-}
-function parseRepoEntry(value, path2) {
-  if (!isRecord(value)) {
-    throw new RuntimeContextError(`MOXT_REPO_PAYLOAD.${path2} must be an object.`);
-  }
-  const repoId = readStringField(value, "repoId", path2);
-  const name = readStringField(value, "name", path2);
-  return { repoId, name };
-}
-function readStringField(record2, field, path2) {
-  const value = record2[field];
-  if (typeof value !== "string" || value.trim().length === 0) {
-    throw new RuntimeContextError(`MOXT_REPO_PAYLOAD.${path2}.${field} must be a non-empty string.`);
-  }
-  return value;
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-// src/utils/sandbox-path.ts
-var WorkspacePathError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "WorkspacePathError";
-  }
-};
-function resolveWorkspacePath(repoPayload, workspacePath) {
-  const normalizedPath = normalizeWorkspacePath(workspacePath);
-  const [repoName, ...repoPathParts] = normalizedPath.split("/");
-  const repoEntries = listRepoEntries(repoPayload);
-  const repo = repoEntries.find((entry) => entry.name === repoName);
-  if (!repo) {
-    throw new WorkspacePathError(`Workspace path must start with one of: ${repoEntries.map((entry) => entry.name).join(", ")}.`);
-  }
-  return {
-    repoId: repo.repoId,
-    repoName: repo.name,
-    repoPath: repoPathParts.join("/")
-  };
-}
-function listRepoEntries(repoPayload) {
-  return [
-    repoPayload.personal,
-    ...repoPayload.teams,
-    ...repoPayload.workspace ? [repoPayload.workspace] : []
-  ];
-}
-function normalizeWorkspacePath(workspacePath) {
-  const trimmed = workspacePath.trim();
-  if (!trimmed) {
-    throw new WorkspacePathError("Workspace path must not be empty.");
-  }
-  if (trimmed.startsWith("/")) {
-    throw new WorkspacePathError("Workspace path must be relative.");
-  }
-  const parts = trimmed.split("/").filter((part) => part.length > 0 && part !== ".");
-  if (parts.length === 0) {
-    throw new WorkspacePathError("Workspace path must include a repo name.");
-  }
-  if (parts.some((part) => part === "..")) {
-    throw new WorkspacePathError('Workspace path must not contain "..".');
-  }
-  return parts.join("/");
-}
-
-// src/commands/auth.ts
-function registerAuthCommand(program2) {
-  const auth = program2.command("auth").description("Authentication utilities");
-  auth.command("status").description("Show CLI authentication mode").action(() => {
-    try {
-      const context = resolveRuntimeContext();
-      if (context.mode === "sandbox") {
-        print(`${colors.bold}Mode${colors.reset}: sandbox`);
-        print(`${colors.bold}Workspace${colors.reset}: ${context.workspaceId}`);
-        print(`${colors.bold}Base API${colors.reset}: ${context.baseApiHost}`);
-        print(`${colors.bold}Repos${colors.reset}:`);
-        for (const repo of listRepoEntries(context.repoPayload)) {
-          print(`  ${repo.name}	${repo.repoId}`);
-        }
-        return;
-      }
-      print(`${colors.bold}Mode${colors.reset}: user`);
-      print(`${colors.bold}Host${colors.reset}: ${context.host}`);
-    } catch (error) {
-      if (error instanceof RuntimeContextError) {
-        printError(error.message);
-        process.exit(1);
-      }
-      throw error;
-    }
-  });
-}
+import { Command } from "commander";
 
 // src/commands/file.ts
 import * as fs2 from "fs";
 
+// src/commands/file-comment.ts
+import * as fs from "fs";
+import { TextDecoder } from "util";
+
 // src/utils/file-selector.ts
 var SpaceOptionsError = class extends Error {
   constructor(message) {
@@ -342,7 +153,7 @@ function getApiKeyOrUndefined() {
 
 // src/utils/http.ts
 function getUserAgent() {
-  return `moxt-cli/${"0.4.0-beta.0"} (${platform()}/${arch()}) node/${process.versions.node}`;
+  return `moxt-cli/${"0.4.0"} (${platform()}/${arch()}) node/${process.versions.node}`;
 }
 async function fetchApi(method, path2, body) {
   const apiKey = getApiKey();
@@ -382,6 +193,9 @@ async function httpPut(path2, body) {
 async function httpPost(path2, body) {
   return request("POST", path2, body);
 }
+async function httpPatch(path2, body) {
+  return request("PATCH", path2, body);
+}
 async function httpDelete(path2, body) {
   return request("DELETE", path2, body);
 }
@@ -395,6 +209,265 @@ async function httpRaw(method, path2, body) {
   };
 }
 
+// src/utils/output.ts
+var colors = {
+  bold: "\x1B[1m",
+  blue: "\x1B[1;34m",
+  green: "\x1B[32m",
+  red: "\x1B[31m",
+  cyan: "\x1B[36m",
+  dim: "\x1B[2m",
+  reset: "\x1B[0m"
+};
+function print(message) {
+  console.log(message);
+}
+function printError(message) {
+  console.error(`${colors.red}${message}${colors.reset}`);
+}
+
+// src/utils/spinner.ts
+var frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+var intervalId = null;
+var frameIndex = 0;
+function startSpinner(message) {
+  frameIndex = 0;
+  process.stdout.write(`${frames[frameIndex]} ${message}`);
+  intervalId = setInterval(() => {
+    frameIndex = (frameIndex + 1) % frames.length;
+    process.stdout.write(`\r${frames[frameIndex]} ${message}`);
+  }, 80);
+}
+function stopSpinner(success, message) {
+  if (intervalId) {
+    clearInterval(intervalId);
+    intervalId = null;
+  }
+  const symbol = success ? "\x1B[32m\u2713\x1B[0m" : "\x1B[31m\u2717\x1B[0m";
+  process.stdout.write(`\x1B[2K\r${symbol} ${message ?? ""}
+`);
+}
+
+// src/commands/file-comment.ts
+var FILE_ID_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var URL_FORMAT_HINT = "Error: invalid Moxt URL format. Expected https://moxt.ai/w/{workspaceId}/{fileId} or https://moxt.ai/w/{workspaceId}/c/{agentId}[/{sessionId}]?file={fileId}";
+var FileCommentOptionsError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "FileCommentOptionsError";
+  }
+};
+function runOrExit(fn) {
+  try {
+    return fn();
+  } catch (err) {
+    if (err instanceof FileCommentOptionsError || err instanceof SpaceOptionsError) {
+      printError(err.message);
+      process.exit(1);
+    }
+    throw err;
+  }
+}
+function parseMoxtFileUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new FileCommentOptionsError(URL_FORMAT_HINT);
+  }
+  const segments = parsed.pathname.split("/").filter(Boolean);
+  if (segments.length < 3 || segments[0] !== "w") {
+    throw new FileCommentOptionsError(URL_FORMAT_HINT);
+  }
+  const workspaceId = segments[1];
+  let fileId;
+  if (segments[2] === "c") {
+    fileId = parsed.searchParams.get("file") ?? void 0;
+  } else if (segments.length === 3) {
+    fileId = segments[2];
+  }
+  if (!fileId || !FILE_ID_UUID_RE.test(fileId)) {
+    throw new FileCommentOptionsError(URL_FORMAT_HINT);
+  }
+  return { workspaceId, fileId };
+}
+async function resolveFileTarget(options) {
+  const mode = runOrExit(() => resolveReadMode(options));
+  if (mode.kind === "by-url") {
+    return runOrExit(() => parseMoxtFileUrl(mode.url));
+  }
+  const spaceParams = runOrExit(() => resolveSpaceSelector(options));
+  const qs = buildFileQueryString(mode.path, spaceParams);
+  startSpinner("Resolving file...");
+  const response = await httpGet(`/workspaces/${mode.workspace}/files/url${qs}`);
+  if (!response.ok) {
+    stopSpinner(false, "Failed");
+    if (response.status === 404) {
+      print(`${colors.red}\u2620 ${mode.path} does not exist${colors.reset}`);
+    } else if (response.status === 400) {
+      printError(`Error: ${JSON.stringify(response.data)}`);
+    } else {
+      printError(`Error [${response.status}]: ${JSON.stringify(response.data)}`);
+    }
+    process.exit(1);
+  }
+  stopSpinner(true, response.data.path);
+  return runOrExit(() => parseMoxtFileUrl(response.data.url));
+}
+function readCommentContentFile(path2) {
+  if (!fs.existsSync(path2)) {
+    throw new FileCommentOptionsError(`Error: comment content file not found: ${path2}`);
+  }
+  const stat = fs.statSync(path2);
+  if (!stat.isFile()) {
+    throw new FileCommentOptionsError(`Error: comment content path is not a file: ${path2}`);
+  }
+  const buffer2 = fs.readFileSync(path2);
+  if (buffer2.includes(0)) {
+    throw new FileCommentOptionsError("Error: comment content file must not contain NUL bytes.");
+  }
+  let content;
+  try {
+    content = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(buffer2);
+  } catch {
+    throw new FileCommentOptionsError("Error: comment content file must contain valid UTF-8 text.");
+  }
+  if (content.length === 0) {
+    throw new FileCommentOptionsError("Error: comment content file must not be empty.");
+  }
+  return content;
+}
+function parseResolveState(state) {
+  if (state === "resolved") return true;
+  if (state === "open") return false;
+  throw new FileCommentOptionsError('Error: --state must be "resolved" or "open".');
+}
+function indentation(size) {
+  return " ".repeat(size);
+}
+function escapeTerminalControlCharacters(value) {
+  return value.replace(/\r\n/g, "\n").replace(
+    /[\u0000-\u0008\u000B-\u001F\u007F-\u009F]/g,
+    (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`
+  );
+}
+function formatDetailScalar(value) {
+  if (value === null) return "null";
+  if (typeof value === "string") {
+    const escaped = escapeTerminalControlCharacters(value);
+    if (escaped === "") return '""';
+    if (/\n/.test(escaped)) return JSON.stringify(escaped);
+    return escaped;
+  }
+  return String(value);
+}
+function printDetailField(name, value, indent = 0) {
+  print(`${indentation(indent)}${name}: ${formatDetailScalar(value)}`);
+}
+function printDetailTextField(name, value, indent = 0) {
+  if (value === null || value === "") {
+    printDetailField(name, value, indent);
+    return;
+  }
+  const escaped = escapeTerminalControlCharacters(value);
+  print(`${indentation(indent)}${name}:`);
+  for (const line of escaped.split("\n")) {
+    print(`${indentation(indent + 2)}${line}`);
+  }
+}
+function printAuthorFields(author, indent) {
+  printDetailField("humanId", author.humanId, indent);
+  printDetailField("assistantId", author.assistantId, indent);
+  printDetailField("teammateId", author.teammateId, indent);
+  printDetailField("authorName", author.authorName, indent);
+  printDetailField("authorAvatarUrl", author.authorAvatarUrl, indent);
+}
+function printCommentItem(item, indent = 0) {
+  print(`${indentation(indent)}${colors.bold}Comment${colors.reset}`);
+  printDetailField("id", item.id, indent + 2);
+  printDetailField("threadId", item.threadId, indent + 2);
+  printAuthorFields(item, indent + 2);
+  printDetailTextField("content", item.content, indent + 2);
+  printDetailField("createdAt", item.createdAt, indent + 2);
+  printDetailField("editedAt", item.editedAt, indent + 2);
+}
+function printThread(thread) {
+  print(`${colors.bold}Thread${colors.reset}`);
+  printDetailField("threadId", thread.threadId, 2);
+  printDetailField("fileId", thread.fileId, 2);
+  printDetailTextField("quotedText", thread.quotedText, 2);
+  printDetailField("resolvedAt", thread.resolvedAt, 2);
+  print(`${indentation(2)}createdBy:`);
+  printAuthorFields(thread.createdBy, 4);
+  printDetailField("createdAt", thread.createdAt, 2);
+  print(`${indentation(2)}comments:`);
+  thread.items.forEach((item) => printCommentItem(item, 4));
+}
+function addFileSelectorOptions(cmd) {
+  return cmd.option("-w, --workspace <workspaceId>", "Workspace ID").option("-s, --space <name>", "Space name (personal or teamspace name)").option("--personal", "Use personal space (default)").option("--team-space-id <teamSpaceId>", "Team space ID").option("--teammate-id <teammateId>", "Teammate ID (teammate space)").option("-p, --path <path>", "File path").option("-u, --url <url>", "Moxt file URL (e.g., https://moxt.ai/w/{workspaceId}/{fileId})");
+}
+function registerFileCommentCommands(file) {
+  const comment = file.command("comment").description("File comment operations");
+  addFileSelectorOptions(
+    comment.command("list").description("List comment threads on a file")
+  ).action(async (options) => {
+    const target = await resolveFileTarget(options);
+    startSpinner("Fetching comments...");
+    const response = await httpGet(
+      `/workspaces/${target.workspaceId}/files/${target.fileId}/comment-threads`
+    );
+    if (!response.ok) {
+      stopSpinner(false, "Failed");
+      printError(`Error [${response.status}]: ${JSON.stringify(response.data)}`);
+      process.exit(1);
+    }
+    if (response.data.items.length === 0) {
+      stopSpinner(true, "No comments found.");
+      return;
+    }
+    stopSpinner(true, `Found ${response.data.items.length} thread(s)`);
+    response.data.items.forEach((thread, index) => {
+      if (index > 0) print("");
+      printThread(thread);
+    });
+  });
+  addFileSelectorOptions(
+    comment.command("update").description("Update a comment you created").argument("<commentId>").requiredOption("--content-path <localPath>", "Local UTF-8 text file for comment content")
+  ).action(async (commentId, options) => {
+    const content = runOrExit(() => readCommentContentFile(options.contentPath));
+    const target = await resolveFileTarget(options);
+    startSpinner("Updating comment...");
+    const response = await httpPatch(
+      `/workspaces/${target.workspaceId}/files/${target.fileId}/comments/${commentId}`,
+      { content }
+    );
+    if (!response.ok) {
+      stopSpinner(false, "Failed");
+      printError(`Error [${response.status}]: ${JSON.stringify(response.data)}`);
+      process.exit(1);
+    }
+    stopSpinner(true, "Comment updated");
+    printCommentItem(response.data);
+  });
+  addFileSelectorOptions(
+    comment.command("resolve").description("Resolve or reopen a comment thread").argument("<threadId>").requiredOption("--state <state>", "Thread state: resolved or open")
+  ).action(async (threadId, options) => {
+    const resolved = runOrExit(() => parseResolveState(options.state));
+    const target = await resolveFileTarget(options);
+    startSpinner(resolved ? "Resolving thread..." : "Reopening thread...");
+    const response = await httpPatch(
+      `/workspaces/${target.workspaceId}/files/${target.fileId}/comment-threads/${threadId}/resolve`,
+      { resolved }
+    );
+    if (!response.ok) {
+      stopSpinner(false, "Failed");
+      printError(`Error [${response.status}]: ${JSON.stringify(response.data)}`);
+      process.exit(1);
+    }
+    stopSpinner(true, resolved ? `Resolved: ${threadId}` : `Reopened: ${threadId}`);
+  });
+}
+
 // src/utils/search-options.ts
 var SearchOptionsError = class extends Error {
   constructor(message) {
@@ -436,7 +509,7 @@ function parseTeammateId(raw) {
 }
 
 // src/utils/run-or-exit.ts
-function runOrExit(fn) {
+function runOrExit2(fn) {
   try {
     return fn();
   } catch (err) {
@@ -448,279 +521,38 @@ function runOrExit(fn) {
   }
 }
 
-// src/utils/sandbox-client.ts
-var DEFAULT_TIMEOUT_MS = 3e4;
-var SandboxApiError = class extends Error {
-  status;
-  body;
-  constructor(status, body) {
-    super(`Sandbox API request failed with ${status}: ${body}`);
-    this.name = "SandboxApiError";
-    this.status = status;
-    this.body = body;
-  }
-};
-var SandboxMoxtClient = class {
-  constructor(context) {
-    this.context = context;
-  }
-  context;
-  async request(method, path2, body, options = {}) {
-    const signal = AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
-    const response = await fetch(`${this.context.baseApiHost}${path2}`, {
-      method,
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${this.context.sandboxToolApiToken}`
-      },
-      body: body === void 0 ? void 0 : JSON.stringify(body),
-      signal
-    });
-    const contentType = response.headers.get("content-type");
-    const data = contentType?.includes("application/json") ? await response.json() : await response.text();
+// src/commands/file.ts
+function addSpaceOptions(cmd) {
+  return cmd.requiredOption("-w, --workspace <workspaceId>", "Workspace ID").option("-s, --space <name>", "Space name (personal or teamspace name)").option("--personal", "Use personal space (default)").option("--team-space-id <teamSpaceId>", "Team space ID").option("--teammate-id <teammateId>", "Teammate ID (teammate space)");
+}
+function registerFileCommand(program2) {
+  const file = program2.command("file").description("File operations");
+  registerFileCommentCommands(file);
+  addSpaceOptions(
+    file.command("search").description("Search files in accessible spaces").argument("<query>", "Search query").option("-l, --limit <limit>", "Maximum number of files to return", "30").option("--mode <mode>", "Keyword matching mode: any or all", "any")
+  ).action(async (query, options) => {
+    const spaceParams = runOrExit2(() => resolveSpaceSelector(options));
+    const limit = runOrExit2(() => parseSearchLimit(options.limit, 30, 80));
+    const mode = runOrExit2(() => parseSearchMode(options.mode));
+    startSpinner("Searching files...");
+    const response = await httpPost(
+      `/workspaces/${options.workspace}/files/search`,
+      {
+        query,
+        limit,
+        mode,
+        ...spaceParams
+      }
+    );
     if (!response.ok) {
-      throw new SandboxApiError(response.status, typeof data === "string" ? data : JSON.stringify(data));
+      stopSpinner(false, "Failed");
+      printError(`Error [${response.status}]: ${JSON.stringify(response.data)}`);
+      process.exit(1);
     }
-    return {
-      status: response.status,
-      data
-    };
-  }
-};
-
-// src/utils/sandbox-file.ts
-import { createHash } from "crypto";
-var MFS_FILE_TYPE_REGULAR = 1;
-var MFS_FILE_SIZE_LIMIT_BYTES = 10 * 1024 * 1024;
-var MFS_FILE_SIZE_LIMIT_LABEL = `${MFS_FILE_SIZE_LIMIT_BYTES / (1024 * 1024)}MB`;
-var SandboxFileError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "SandboxFileError";
-  }
-  code;
-};
-async function readSandboxFile(context, workspacePath) {
-  const resolved = resolveSandboxFilePath(context, workspacePath);
-  const tree = await fetchRepoTree(context, resolved);
-  const entry = findTreeEntry(tree, resolved);
-  if (!entry) {
-    throw new SandboxFileError(`${workspacePath} does not exist`, "not-found");
-  }
-  if (entry.type === "tree") {
-    throw new SandboxFileError(`${workspacePath} is a directory`, "directory");
-  }
-  if (!entry.sha) {
-    throw new SandboxFileError(`${workspacePath} does not have downloadable content`, "remote");
-  }
-  if (entry.size !== null && entry.size > MFS_FILE_SIZE_LIMIT_BYTES) {
-    throw new SandboxFileError(`File too large (max ${MFS_FILE_SIZE_LIMIT_LABEL}): ${workspacePath}`, "too-large");
-  }
-  const client = new SandboxMoxtClient(context);
-  const presign = await client.request(
-    "POST",
-    `/agent/api/pipeline-sandbox/mfs/${encodeURIComponent(resolved.repoId)}/presign-download`,
-    { hashes: [entry.sha] }
-  );
-  const url = presign.data.urls[entry.sha];
-  if (!url) {
-    throw new SandboxFileError(`No download URL returned for ${workspacePath}`, "remote");
-  }
-  const response = await fetch(url);
-  if (!response.ok) {
-    throw new SandboxFileError(`Download failed [${response.status}]`, "remote");
-  }
-  const content = await response.text();
-  const data = Buffer.from(content, "utf8");
-  if (data.length > MFS_FILE_SIZE_LIMIT_BYTES) {
-    throw new SandboxFileError(`File too large (max ${MFS_FILE_SIZE_LIMIT_LABEL}): ${workspacePath}`, "too-large");
-  }
-  const actualSha = createHash("sha256").update(data).digest("hex");
-  if (actualSha !== entry.sha) {
-    throw new SandboxFileError(`Downloaded content hash mismatch: ${workspacePath}`, "remote");
-  }
-  return {
-    path: workspacePath,
-    content,
-    sha: entry.sha,
-    size: data.length,
-    fileId: entry.fileId,
-    fileType: entry.fileType
-  };
-}
-async function writeSandboxFile(context, workspacePath, content, policy) {
-  const data = Buffer.from(content, "utf8");
-  if (data.length > MFS_FILE_SIZE_LIMIT_BYTES) {
-    throw new SandboxFileError(`File too large (max ${MFS_FILE_SIZE_LIMIT_LABEL}): ${workspacePath}`, "too-large");
-  }
-  const resolved = resolveSandboxFilePath(context, workspacePath);
-  const tree = await fetchRepoTree(context, resolved);
-  const existing = findTreeEntry(tree, resolved);
-  if (existing?.type === "tree") {
-    throw new SandboxFileError(`${workspacePath} is a directory`, "directory");
-  }
-  if (existing && !existing.sha) {
-    throw new SandboxFileError(`${workspacePath} does not have base content hash`, "remote");
-  }
-  const baseContentHash = resolveBaseContentHash(workspacePath, existing, policy);
-  const contentHash = createHash("sha256").update(data).digest("hex");
-  const client = new SandboxMoxtClient(context);
-  const presign = await client.request(
-    "POST",
-    `/agent/api/pipeline-sandbox/mfs/${encodeURIComponent(resolved.repoId)}/presign-upload`,
-    { hashes: [contentHash] }
-  );
-  const uploadUrl = presign.data.urls[contentHash];
-  if (!uploadUrl) {
-    throw new SandboxFileError(`No upload URL returned for ${workspacePath}`, "remote");
-  }
-  const upload = await fetch(uploadUrl, {
-    method: "PUT",
-    headers: { "Content-Type": "application/octet-stream" },
-    body: new Uint8Array(data)
-  });
-  if (!upload.ok) {
-    throw new SandboxFileError(`Upload failed [${upload.status}]`, "remote");
-  }
-  const action = existing ? "update" : "create";
-  await client.request(
-    "POST",
-    "/agent/api/pipeline-sandbox/mfs-workspace/unified-push",
-    {
-      message: `moxt file write ${workspacePath}`,
-      repoPushes: [
-        {
-          repoId: resolved.repoId,
-          changes: [
-            {
-              action,
-              ...existing?.fileId ? { fileId: existing.fileId } : {},
-              path: resolved.repoPath,
-              contentHash,
-              ...baseContentHash ? { baseContentHash } : {},
-              size: data.length,
-              fileType: MFS_FILE_TYPE_REGULAR
-            }
-          ]
-        }
-      ],
-      crossRepoMoves: []
-    }
-  );
-  return { path: workspacePath, created: !existing };
-}
-function resolveBaseContentHash(workspacePath, existing, policy) {
-  if (policy.type === "force") return void 0;
-  if (policy.type === "use-current-sha") return existing?.sha ?? void 0;
-  if (policy.type === "create-only") {
-    if (!existing) return void 0;
-    throw new SandboxFileError(
-      `Existing file requires --base-sha or --force: ${workspacePath} (actual ${existing.sha})`,
-      "conflict"
-    );
-  }
-  if (existing?.sha === policy.sha) return policy.sha;
-  throw new SandboxFileError(
-    `File version conflict: ${workspacePath} (expected ${policy.sha}, actual ${existing?.sha ?? "missing"})`,
-    "conflict"
-  );
-}
-function resolveSandboxFilePath(context, workspacePath) {
-  let resolved;
-  try {
-    resolved = resolveWorkspacePath(context.repoPayload, workspacePath);
-  } catch (error) {
-    throw new SandboxFileError(error instanceof Error ? error.message : String(error), "invalid-path");
-  }
-  if (!resolved.repoPath) {
-    throw new SandboxFileError(`${workspacePath} is a directory`, "directory");
-  }
-  return resolved;
-}
-async function fetchRepoTree(context, resolved) {
-  const client = new SandboxMoxtClient(context);
-  const params = new URLSearchParams({ entryFilter: "paths", path: resolved.repoPath });
-  const response = await client.request(
-    "GET",
-    `/agent/api/pipeline-sandbox/mfs/${encodeURIComponent(resolved.repoId)}/tree?${params.toString()}`
-  );
-  return response.data;
-}
-function findTreeEntry(tree, resolved) {
-  return tree.entries.find((entry) => entry.path === resolved.repoPath);
-}
-
-// src/utils/spinner.ts
-var frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-var intervalId = null;
-var frameIndex = 0;
-function startSpinner(message) {
-  frameIndex = 0;
-  process.stdout.write(`${frames[frameIndex]} ${message}`);
-  intervalId = setInterval(() => {
-    frameIndex = (frameIndex + 1) % frames.length;
-    process.stdout.write(`\r${frames[frameIndex]} ${message}`);
-  }, 80);
-}
-function stopSpinner(success, message) {
-  if (intervalId) {
-    clearInterval(intervalId);
-    intervalId = null;
-  }
-  const symbol = success ? "\x1B[32m\u2713\x1B[0m" : "\x1B[31m\u2717\x1B[0m";
-  process.stdout.write(`\x1B[2K\r${symbol} ${message ?? ""}
-`);
-}
-
-// src/utils/write-content.ts
-import * as fs from "fs";
-function readWriteCommandContentOrExit(options, readContentFile, readStdin = () => fs.readFileSync(0, "utf8")) {
-  const inputModes = [options.content !== void 0, options.contentFile !== void 0, options.stdin === true].filter(Boolean);
-  if (inputModes.length > 1) {
-    printError("Only one of --content, --content-file, or --stdin can be used");
-    process.exit(1);
-  }
-  if (options.content !== void 0) {
-    return options.content;
-  }
-  if (options.contentFile !== void 0) {
-    return readContentFile(options.contentFile);
-  }
-  return readStdin();
-}
-
-// src/commands/file.ts
-function addSpaceOptions(cmd) {
-  return cmd.requiredOption("-w, --workspace <workspaceId>", "Workspace ID").option("-s, --space <name>", "Space name (personal or teamspace name)").option("--personal", "Use personal space (default)").option("--team-space-id <teamSpaceId>", "Team space ID").option("--teammate-id <teammateId>", "Teammate ID (teammate space)");
-}
-function registerFileCommand(program2) {
-  const file = program2.command("file").description("File operations");
-  addSpaceOptions(
-    file.command("search").description("Search files in accessible spaces").argument("<query>", "Search query").option("-l, --limit <limit>", "Maximum number of files to return", "30").option("--mode <mode>", "Keyword matching mode: any or all", "any")
-  ).action(async (query, options) => {
-    const spaceParams = runOrExit(() => resolveSpaceSelector(options));
-    const limit = runOrExit(() => parseSearchLimit(options.limit, 30, 80));
-    const mode = runOrExit(() => parseSearchMode(options.mode));
-    startSpinner("Searching files...");
-    const response = await httpPost(
-      `/workspaces/${options.workspace}/files/search`,
-      {
-        query,
-        limit,
-        mode,
-        ...spaceParams
-      }
-    );
-    if (!response.ok) {
-      stopSpinner(false, "Failed");
-      printError(`Error [${response.status}]: ${JSON.stringify(response.data)}`);
-      process.exit(1);
-    }
-    const { items } = response.data;
-    if (items.length === 0) {
-      stopSpinner(true, "No files found.");
-      return;
+    const { items } = response.data;
+    if (items.length === 0) {
+      stopSpinner(true, "No files found.");
+      return;
     }
     stopSpinner(true, `Found ${items.length} file(s)`);
     for (const item of items) {
@@ -736,7 +568,7 @@ function registerFileCommand(program2) {
   addSpaceOptions(
     file.command("get-url").description("Resolve the shareable browser URL for a file").requiredOption("-p, --path <path>", "File path")
   ).action(async (options) => {
-    const spaceParams = runOrExit(() => resolveSpaceSelector(options));
+    const spaceParams = runOrExit2(() => resolveSpaceSelector(options));
     const qs = buildFileQueryString(options.path, spaceParams);
     startSpinner("Resolving URL...");
     const response = await httpGet(
@@ -759,7 +591,7 @@ function registerFileCommand(program2) {
   addSpaceOptions(
     file.command("list").description("List directory contents").option("-p, --path <path>", "Directory path", "/")
   ).action(async (options) => {
-    const spaceParams = runOrExit(() => resolveSpaceSelector(options));
+    const spaceParams = runOrExit2(() => resolveSpaceSelector(options));
     const qs = buildFileQueryString(options.path, spaceParams);
     startSpinner("Listing files...");
     const response = await httpGet(
@@ -788,40 +620,8 @@ function registerFileCommand(program2) {
       }
     }
   });
-  file.command("read").description("Read file content").argument("[workspacePath]", "Workspace path in sandbox mode, e.g. personal/docs/readme.md").option("-w, --workspace <workspaceId>", "Workspace ID").option("-s, --space <name>", "Space name (personal or teamspace name)").option("--personal", "Use personal space (default)").option("--team-space-id <teamSpaceId>", "Team space ID").option("--teammate-id <teammateId>", "Teammate ID (teammate space)").option("-p, --path <path>", "File path").option("-u, --url <url>", "Moxt file URL (e.g., https://moxt.ai/w/{workspaceId}/{fileId})").option("--json", "Print sandbox file content and metadata as JSON").action(async (workspacePath, options) => {
-    const sandboxRuntime = resolveSandboxRuntimeContextOrExit();
-    if (sandboxRuntime) {
-      if (options.url) {
-        printError("--url cannot be used in sandbox mode");
-        process.exit(1);
-      }
-      const path2 = workspacePath ?? options.path;
-      if (!path2) {
-        printError("Workspace path is required in sandbox mode");
-        process.exit(1);
-      }
-      if (!options.json) startSpinner("Reading file...");
-      try {
-        const result = await readSandboxFile(sandboxRuntime, path2);
-        if (options.json) {
-          print(JSON.stringify(result, null, 2));
-        } else {
-          stopSpinner(true, "Done");
-          print(result.content);
-        }
-      } catch (error) {
-        handleSandboxFileError(error, path2);
-      }
-      return;
-    }
-    if (options.json) {
-      printError("--json is only available for sandbox workspace paths");
-      process.exit(1);
-    }
-    if (workspacePath && !options.path) {
-      options.path = workspacePath;
-    }
-    const mode = runOrExit(() => resolveReadMode(options));
+  file.command("read").description("Read file content").option("-w, --workspace <workspaceId>", "Workspace ID").option("-s, --space <name>", "Space name (personal or teamspace name)").option("--personal", "Use personal space (default)").option("--team-space-id <teamSpaceId>", "Team space ID").option("--teammate-id <teammateId>", "Teammate ID (teammate space)").option("-p, --path <path>", "File path").option("-u, --url <url>", "Moxt file URL (e.g., https://moxt.ai/w/{workspaceId}/{fileId})").action(async (options) => {
+    const mode = runOrExit2(() => resolveReadMode(options));
     startSpinner("Reading file...");
     let response;
     let displayPath;
@@ -832,7 +632,7 @@ function registerFileCommand(program2) {
       );
     } else {
       displayPath = mode.path;
-      const spaceParams = runOrExit(() => resolveSpaceSelector(options));
+      const spaceParams = runOrExit2(() => resolveSpaceSelector(options));
       const qs = buildFileQueryString(mode.path, spaceParams);
       response = await httpGet(
         `/workspaces/${mode.workspace}/files/read${qs}`
@@ -856,37 +656,29 @@ function registerFileCommand(program2) {
     stopSpinner(true, "Done");
     print(content ?? "");
   });
-  file.command("put").description("Upload a file").argument("[workspacePath]", "Workspace path in sandbox mode, e.g. personal/docs/readme.md").option("-w, --workspace <workspaceId>", "Workspace ID").option("-s, --space <name>", "Space name (personal or teamspace name)").option("--personal", "Use personal space (default)").option("--team-space-id <teamSpaceId>", "Team space ID").option("--teammate-id <teammateId>", "Teammate ID (teammate space)").option("-p, --path <path>", "Remote file path").option("-u, --url <url>", "Moxt file URL (e.g., https://moxt.ai/w/{workspaceId}/{fileId})").requiredOption("-l, --local-path <localPath>", "Local file path").option("-r, --recursive", "Create parent directories if needed").action(
-    async (workspacePath, options) => {
-      const sandboxRuntime = resolveSandboxRuntimeContextOrExit();
-      if (sandboxRuntime) {
-        if (options.url) {
-          printError("--url cannot be used in sandbox mode");
-          process.exit(1);
-        }
-        const path2 = workspacePath ?? options.path;
-        if (!path2) {
-          printError("Workspace path is required in sandbox mode");
-          process.exit(1);
-        }
-        const { content: content2 } = readLocalTextFileOrExit(options.localPath);
-        startSpinner("Uploading...");
-        try {
-          const response2 = await writeSandboxFile(sandboxRuntime, path2, content2, {
-            type: "use-current-sha"
-          });
-          const action2 = response2.created ? "Created" : "Updated";
-          stopSpinner(true, `${action2}: ${response2.path}`);
-        } catch (error) {
-          handleSandboxFileError(error, path2);
-        }
-        return;
+  file.command("put").description("Upload a file").option("-w, --workspace <workspaceId>", "Workspace ID").option("-s, --space <name>", "Space name (personal or teamspace name)").option("--personal", "Use personal space (default)").option("--team-space-id <teamSpaceId>", "Team space ID").option("--teammate-id <teammateId>", "Teammate ID (teammate space)").option("-p, --path <path>", "Remote file path").option("-u, --url <url>", "Moxt file URL (e.g., https://moxt.ai/w/{workspaceId}/{fileId})").requiredOption("-l, --local-path <localPath>", "Local file path").option("-r, --recursive", "Create parent directories if needed").action(
+    async (options) => {
+      const mode = runOrExit2(() => resolveWriteMode(options));
+      if (!fs2.existsSync(options.localPath)) {
+        print(`${colors.red}\u2620 Local file not found: ${options.localPath}${colors.reset}`);
+        process.exit(1);
       }
-      if (workspacePath && !options.path) {
-        options.path = workspacePath;
+      const stats = fs2.statSync(options.localPath);
+      if (!stats.isFile()) {
+        print(`${colors.red}\u2620 Not a file: ${options.localPath}${colors.reset}`);
+        process.exit(1);
+      }
+      const maxSize = 10 * 1024 * 1024;
+      if (stats.size > maxSize) {
+        print(`${colors.red}\u2620 File too large (max 10MB): ${options.localPath}${colors.reset}`);
+        process.exit(1);
+      }
+      const buffer2 = fs2.readFileSync(options.localPath);
+      if (isBinaryContent(buffer2)) {
+        print(`${colors.red}\u2620 Binary files are not allowed. Only text files can be uploaded.${colors.reset}`);
+        process.exit(1);
       }
-      const mode = runOrExit(() => resolveWriteMode(options));
-      const { content } = readLocalTextFileOrExit(options.localPath);
+      const content = buffer2.toString("utf8");
       startSpinner("Uploading...");
       let response;
       let displayPath;
@@ -898,7 +690,7 @@ function registerFileCommand(program2) {
         });
       } else {
         displayPath = mode.path;
-        const spaceParams = runOrExit(() => resolveSpaceSelector(options));
+        const spaceParams = runOrExit2(() => resolveSpaceSelector(options));
         response = await httpPut(
           `/workspaces/${mode.workspace}/files/write`,
           {
@@ -928,28 +720,11 @@ function registerFileCommand(program2) {
       stopSpinner(true, `${action}: ${response.data.path}`);
     }
   );
-  file.command("write").description("Write file content in sandbox mode").argument("<workspacePath>", "Workspace path, e.g. personal/docs/readme.md").option("--content <content>", "Text content to write").option("--content-file <contentFile>", "Local text file to write").option("--stdin", "Read text content from stdin (default)").option("--base-sha <sha>", "Write only if the remote file still has this SHA").option("--force", "Overwrite an existing remote file without a version condition").action(async (workspacePath, options) => {
-    const runtime = resolveSandboxRuntimeContextOrExit();
-    if (!runtime) {
-      printError("file write is only available in sandbox mode");
-      process.exit(1);
-    }
-    const policy = resolveSandboxFileWritePolicyOrExit(options);
-    const content = readWriteCommandContentOrExit(options, (path2) => readLocalTextFileOrExit(path2).content);
-    startSpinner("Writing file...");
-    try {
-      const response = await writeSandboxFile(runtime, workspacePath, content, policy);
-      const action = response.created ? "Created" : "Updated";
-      stopSpinner(true, `${action}: ${response.path}`);
-    } catch (error) {
-      handleSandboxFileError(error, workspacePath);
-    }
-  });
   addSpaceOptions(
     file.command("mkdir").description("Create a directory").requiredOption("-p, --path <path>", "Directory path").option("-r, --recursive", "Create parent directories if needed")
   ).action(
     async (options) => {
-      const spaceParams = runOrExit(() => resolveSpaceSelector(options));
+      const spaceParams = runOrExit2(() => resolveSpaceSelector(options));
       startSpinner("Creating directory...");
       const response = await httpPost(
         `/workspaces/${options.workspace}/files/mkdir`,
@@ -978,7 +753,7 @@ function registerFileCommand(program2) {
     file.command("del").description("Delete a file or empty directory").requiredOption("-p, --path <path>", "File or directory path")
   ).action(
     async (options) => {
-      const spaceParams = runOrExit(() => resolveSpaceSelector(options));
+      const spaceParams = runOrExit2(() => resolveSpaceSelector(options));
       startSpinner("Deleting...");
       const response = await httpDelete(
         `/workspaces/${options.workspace}/files/delete`,
@@ -1002,90 +777,14 @@ function registerFileCommand(program2) {
     }
   );
 }
-function resolveSandboxFileWritePolicyOrExit(options) {
-  if (options.baseSha && options.force) {
-    printError("Only one of --base-sha or --force can be used");
-    process.exit(1);
-  }
-  if (options.baseSha) {
-    if (!/^[a-f0-9]{64}$/.test(options.baseSha)) {
-      printError("--base-sha must be a lowercase SHA-256 hash");
-      process.exit(1);
-    }
-    return { type: "base-sha", sha: options.baseSha };
-  }
-  return options.force ? { type: "force" } : { type: "create-only" };
-}
-function resolveRuntimeContextOrExit() {
-  try {
-    return resolveRuntimeContext();
-  } catch (error) {
-    if (error instanceof RuntimeContextError) {
-      printError(error.message);
-      process.exit(1);
-    }
-    throw error;
-  }
-}
-function resolveSandboxRuntimeContextOrExit() {
-  if (!SANDBOX_ENV_KEYS.some((key) => (process.env[key] ?? "").trim().length > 0)) {
-    return void 0;
-  }
-  const context = resolveRuntimeContextOrExit();
-  return context.mode === "sandbox" ? context : void 0;
-}
-function readLocalTextFileOrExit(localPath) {
-  if (!fs2.existsSync(localPath)) {
-    print(`${colors.red}\u2620 Local file not found: ${localPath}${colors.reset}`);
-    process.exit(1);
-  }
-  const stats = fs2.statSync(localPath);
-  if (!stats.isFile()) {
-    print(`${colors.red}\u2620 Not a file: ${localPath}${colors.reset}`);
-    process.exit(1);
-  }
-  if (stats.size > MFS_FILE_SIZE_LIMIT_BYTES) {
-    print(`${colors.red}\u2620 File too large (max ${MFS_FILE_SIZE_LIMIT_LABEL}): ${localPath}${colors.reset}`);
-    process.exit(1);
-  }
-  const buffer2 = fs2.readFileSync(localPath);
-  if (isBinaryContent(buffer2)) {
-    print(`${colors.red}\u2620 Binary files are not allowed. Only text files can be uploaded.${colors.reset}`);
-    process.exit(1);
-  }
-  return { content: buffer2.toString("utf8") };
-}
-function handleSandboxFileError(error, displayPath) {
-  stopSpinner(false, "Failed");
-  if (error instanceof SandboxFileError) {
-    if (error.code === "not-found") {
-      print(`${colors.red}\u2620 ${displayPath} does not exist${colors.reset}`);
-    } else if (error.code === "directory") {
-      print(`${colors.red}\u2620 ${displayPath} is a directory${colors.reset}`);
-    } else {
-      printError(error.message);
-    }
-    process.exit(1);
-  }
-  if (error instanceof SandboxApiError) {
-    printError(`Sandbox API error [${error.status}]: ${error.body}`);
-    process.exit(1);
-  }
-  if (error instanceof Error) {
-    printError(`Sandbox file operation failed: ${error.message}`);
-    process.exit(1);
-  }
-  printError(`Sandbox file operation failed: ${String(error)}`);
-  process.exit(1);
-}
 
 // src/commands/memory.ts
 function registerMemoryCommand(program2) {
   const memory = program2.command("memory").description("Memory operations");
   memory.command("search").description("Search archived agent memory").requiredOption("-w, --workspace <workspaceId>", "Workspace ID").option("--teammate-id <teammateId>", "Search a managed AI teammate memory").option("-l, --limit <limit>", "Maximum number of memory chunks to return", "5").argument("<query>", "Search query").action(
     async (query, options) => {
-      const limit = runOrExit(() => parseSearchLimit(options.limit, 5, 10));
-      const teammateId = runOrExit(() => parseTeammateId(options.teammateId));
+      const limit = runOrExit2(() => parseSearchLimit(options.limit, 5, 10));
+      const teammateId = runOrExit2(() => parseTeammateId(options.teammateId));
       startSpinner("Searching memory...");
       const response = await httpPost(
         `/workspaces/${options.workspace}/memory/search`,
@@ -1191,7 +890,7 @@ function isAllowedMiniappDbUserEmail(email) {
 }
 
 // src/commands/miniapp.ts
-function runOrExit2(fn) {
+function runOrExit3(fn) {
   try {
     return fn();
   } catch (err) {
@@ -1251,14 +950,14 @@ function registerMiniappCommand(program2) {
   addMiniappDbTargetOptions(
     db.command("post").description("Create miniapp data through PostgREST").argument("<path>", "PostgREST path, for example /todos").requiredOption("--body <json>", "JSON object or array request body").option("--pretty", "Pretty-print JSON responses")
   ).action(async (postgrestPath, options) => {
-    const body = runOrExit2(() => parseJsonBody(options.body ?? ""));
+    const body = runOrExit3(() => parseJsonBody(options.body ?? ""));
     await requestDataApi("POST", postgrestPath, options, body);
   });
   addMiniappDbTargetOptions(
     db.command("patch").description("Update miniapp data through PostgREST").argument("<path>", "PostgREST path with a filter, for example /todos?id=eq.1").requiredOption("--body <json>", "JSON object or array request body").option("--pretty", "Pretty-print JSON responses")
   ).action(async (postgrestPath, options) => {
-    runOrExit2(() => assertPostgrestFilter(postgrestPath, "PATCH"));
-    const body = runOrExit2(() => parseJsonBody(options.body ?? ""));
+    runOrExit3(() => assertPostgrestFilter(postgrestPath, "PATCH"));
+    const body = runOrExit3(() => parseJsonBody(options.body ?? ""));
     await requestDataApi("PATCH", postgrestPath, options, body);
   });
   addMiniappDbTargetOptions(
@@ -1268,1558 +967,1167 @@ function registerMiniappCommand(program2) {
       printError("Error: delete requires --yes.");
       process.exit(1);
     }
-    runOrExit2(() => assertPostgrestFilter(postgrestPath, "DELETE"));
+    runOrExit3(() => assertPostgrestFilter(postgrestPath, "DELETE"));
     await requestDataApi("DELETE", postgrestPath, options);
   });
 }
 
-// src/commands/pull.ts
-import { isAbsolute as isAbsolute3 } from "path";
-import { Option } from "commander";
-
-// src/utils/sandbox-pull.ts
-import { createHash as createHash2 } from "crypto";
-import { lstat, mkdir as mkdir2, readFile as readFile2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname2, isAbsolute as isAbsolute2, relative, resolve } from "path";
-
-// src/utils/checkout-state.ts
-import { randomUUID } from "crypto";
-import { homedir } from "os";
-import { dirname, isAbsolute, join, posix } from "path";
-import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
-var CheckoutStateError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "CheckoutStateError";
-  }
-};
-function getCheckoutStatePath() {
-  return join(homedir(), ".moxt", "checkout-state.json");
+// src/telemetry/config.ts
+import * as fs3 from "fs";
+import * as os from "os";
+import * as path from "path";
+function getConfigPath() {
+  return path.join(os.homedir(), ".moxt", "config.json");
 }
-async function loadCheckoutState(statePath = getCheckoutStatePath()) {
-  let raw;
-  try {
-    raw = await readFile(statePath, "utf8");
-  } catch (error) {
-    if (isNodeError(error) && error.code === "ENOENT") return void 0;
-    throw new CheckoutStateError(`Failed to read checkout state: ${errorMessage(error)}`);
-  }
-  let value;
+function readTelemetryConfig() {
   try {
-    value = JSON.parse(raw);
+    const raw = fs3.readFileSync(getConfigPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    return parsed.telemetry ?? {};
   } catch {
-    throw new CheckoutStateError(`Checkout state is not valid JSON: ${statePath}`);
+    return {};
   }
-  return validateCheckoutState(value);
 }
-async function saveCheckoutState(state, statePath = getCheckoutStatePath()) {
-  const validState = validateCheckoutState(state);
-  const stateDir = dirname(statePath);
-  const temporaryPath = `${statePath}.${process.pid}.${randomUUID()}.tmp`;
-  await mkdir(stateDir, { recursive: true });
+function writeTelemetryConfig(update) {
+  const configPath = getConfigPath();
+  let existing = {};
   try {
-    await writeFile(temporaryPath, `${JSON.stringify(validState, null, 2)}
-`, { mode: 384 });
-    await rename(temporaryPath, statePath);
-  } catch (error) {
-    await rm(temporaryPath, { force: true });
-    throw new CheckoutStateError(`Failed to save checkout state: ${errorMessage(error)}`);
-  }
-}
-function isCheckoutPathIncluded(state, workspacePath) {
-  if (state.mode === "full") return true;
-  return state.checkedOutScopes.some(
-    (scope) => workspacePath === scope || workspacePath.startsWith(`${scope}/`)
-  );
-}
-function doesCheckoutPathIntersect(state, workspacePath) {
-  if (state.mode === "full") return true;
-  return state.checkedOutScopes.some(
-    (scope) => workspacePath === scope || workspacePath.startsWith(`${scope}/`) || scope.startsWith(`${workspacePath}/`)
-  );
-}
-function validateCheckoutState(value) {
-  const state = requireRecord(value, "Checkout state");
-  if (state.version !== 1) {
-    throw new CheckoutStateError(`Unsupported checkout state version: ${String(state.version)}`);
-  }
-  const workspaceId = requireNonEmptyString(state.workspaceId, "workspaceId");
-  const checkoutRoot = requireNonEmptyString(state.checkoutRoot, "checkoutRoot");
-  if (!isAbsolute(checkoutRoot)) throw new CheckoutStateError("checkoutRoot must be an absolute path");
-  if (state.mode !== "partial" && state.mode !== "full") {
-    throw new CheckoutStateError("mode must be partial or full");
-  }
-  if (!Array.isArray(state.checkedOutScopes)) {
-    throw new CheckoutStateError("checkedOutScopes must be an array");
-  }
-  const checkedOutScopes = state.checkedOutScopes.map(
-    (scope, index) => requireWorkspacePath(scope, `checkedOutScopes[${index}]`)
-  );
-  if (new Set(checkedOutScopes).size !== checkedOutScopes.length) {
-    throw new CheckoutStateError("checkedOutScopes must not contain duplicates");
-  }
-  const reposValue = requireRecord(state.repos, "repos");
-  const repos = {};
-  for (const [repoId, rawRepo] of Object.entries(reposValue)) {
-    requireNonEmptyString(repoId, "repo id");
-    const repo = requireRecord(rawRepo, `repos.${repoId}`);
-    const name = requireRepoName(repo.name, `repos.${repoId}.name`);
-    repos[repoId] = {
-      name,
-      treeSha: requireNonEmptyString(repo.treeSha, `repos.${repoId}.treeSha`)
-    };
-  }
-  const filesValue = requireRecord(state.files, "files");
-  const files = {};
-  for (const [workspacePath, rawFile] of Object.entries(filesValue)) {
-    requireWorkspacePath(workspacePath, `files.${workspacePath}`);
-    const file = requireRecord(rawFile, `files.${workspacePath}`);
-    const repoId = requireNonEmptyString(file.repoId, `files.${workspacePath}.repoId`);
-    const repo = repos[repoId];
-    if (!repo) throw new CheckoutStateError(`File references unknown repo: ${workspacePath}`);
-    const repoPath = requireWorkspacePath(file.repoPath, `files.${workspacePath}.repoPath`);
-    if (workspacePath !== `${repo.name}/${repoPath}`) {
-      throw new CheckoutStateError(`File path does not match its repo: ${workspacePath}`);
-    }
-    const fileId = file.fileId === null ? null : requireNonEmptyString(file.fileId, `files.${workspacePath}.fileId`);
-    const sha = requireNonEmptyString(file.sha, `files.${workspacePath}.sha`);
-    if (!/^[a-f0-9]{64}$/.test(sha)) throw new CheckoutStateError(`Invalid file SHA: ${workspacePath}`);
-    files[workspacePath] = {
-      repoId,
-      repoPath,
-      fileId,
-      sha,
-      size: requireNonNegativeInteger(file.size, `files.${workspacePath}.size`),
-      fileType: requireNonNegativeInteger(file.fileType, `files.${workspacePath}.fileType`)
-    };
-  }
-  return {
-    version: 1,
-    workspaceId,
-    checkoutRoot,
-    mode: state.mode,
-    checkedOutScopes,
-    repos,
-    files
-  };
-}
-function requireRecord(value, field) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new CheckoutStateError(`${field} must be an object`);
+    existing = JSON.parse(fs3.readFileSync(configPath, "utf8"));
+  } catch {
+    existing = {};
   }
-  return value;
+  const currentTelemetry = existing.telemetry ?? {};
+  const next = { ...existing, telemetry: { ...currentTelemetry, ...update } };
+  fs3.mkdirSync(path.dirname(configPath), { recursive: true });
+  fs3.writeFileSync(configPath, JSON.stringify(next, null, 2));
 }
-function requireNonEmptyString(value, field) {
-  if (typeof value !== "string" || value.length === 0) {
-    throw new CheckoutStateError(`${field} must be a non-empty string`);
-  }
-  return value;
+
+// src/telemetry/opt-out.ts
+function isCiEnvironment() {
+  return process.env.CI === "true" || process.env.CI === "1";
 }
-function requireWorkspacePath(value, field) {
-  const path2 = requireNonEmptyString(value, field);
-  if (path2.includes("\\") || path2.includes("\0") || posix.isAbsolute(path2) || posix.normalize(path2) !== path2) {
-    throw new CheckoutStateError(`${field} must be a normalized relative path`);
+function isTelemetryDisabled() {
+  if (process.env.MOXT_TELEMETRY_DISABLED === "1" || process.env.MOXT_TELEMETRY_DISABLED === "true") {
+    return true;
   }
-  return path2;
-}
-function requireRepoName(value, field) {
-  const name = requireWorkspacePath(value, field);
-  if (name.includes("/")) throw new CheckoutStateError(`${field} must be a single path segment`);
-  return name;
-}
-function requireNonNegativeInteger(value, field) {
-  if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
-    throw new CheckoutStateError(`${field} must be a non-negative integer`);
+  if (process.env.DO_NOT_TRACK === "1" || process.env.DO_NOT_TRACK === "true") {
+    return true;
   }
-  return value;
-}
-function isNodeError(error) {
-  return error instanceof Error && "code" in error;
-}
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
+  return readTelemetryConfig().disabled === true;
 }
 
-// src/utils/sandbox-pull.ts
-var SandboxPullError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "SandboxPullError";
-  }
-  code;
-};
-async function pullSandboxWorkspace(context, targetDir, options = {}) {
-  const resolvedTargetDir = resolve(targetDir);
-  const repos = listRepoEntries(context.repoPayload);
-  const previousState = await loadCheckoutState();
-  const compatibleState = resolveCompatibleState(previousState, context, resolvedTargetDir, repos);
-  const previousFiles = compatibleState?.files ?? {};
-  const selection = resolvePullSelection(context, options.scopes);
-  const repoById = new Map(selection.repos.map((repo) => [repo.repoId, repo]));
-  const tree = await fetchWorkspaceTree(context, selection);
-  const stateRepos = resolveStateRepos(tree, selection.repos);
-  const entries = [...tree.entries].sort((a, b) => a.prefixedPath.localeCompare(b.prefixedPath));
-  const directoryPaths = selection.repos.map((repo) => ({
-    workspacePath: repo.name,
-    localPath: resolveSafeLocalPath(resolvedTargetDir, repo.name, "")
-  }));
-  const blobEntries = [];
-  const remoteBlobPaths = /* @__PURE__ */ new Set();
-  const remotePaths = /* @__PURE__ */ new Set();
-  const matchedScopes = /* @__PURE__ */ new Set();
-  for (const entry of entries) {
-    const repo = repoById.get(entry.repoId);
-    if (!repo) {
-      throw new SandboxPullError(`Remote tree returned unknown repo: ${entry.repoId}`, "remote");
-    }
-    const expectedWorkspacePath = entry.path ? `${repo.name}/${entry.path}` : repo.name;
-    if (entry.prefixedPath !== expectedWorkspacePath) {
-      throw new SandboxPullError(`Remote tree returned inconsistent path: ${entry.prefixedPath}`, "remote");
-    }
-    if (remotePaths.has(expectedWorkspacePath)) {
-      throw new SandboxPullError(`Remote tree returned duplicate path: ${expectedWorkspacePath}`, "remote");
-    }
-    remotePaths.add(expectedWorkspacePath);
-    const localPath = resolveSafeLocalPath(resolvedTargetDir, repo.name, entry.path);
-    for (const scope of selection.scopes) {
-      if (pathIsIncluded(scope, expectedWorkspacePath)) matchedScopes.add(scope);
-    }
-    if (!selection.scopes.some((scope) => pathsIntersect(scope, expectedWorkspacePath))) continue;
-    if (entry.type === "tree") {
-      directoryPaths.push({ workspacePath: entry.prefixedPath, localPath });
-      continue;
-    }
-    if (!entry.sha) {
-      throw new SandboxPullError(`${entry.prefixedPath} does not have downloadable content`, "remote");
-    }
-    if (entry.fileId !== null && (typeof entry.fileId !== "string" || entry.fileId.length === 0)) {
-      throw new SandboxPullError(`${entry.prefixedPath} has invalid file metadata`, "remote");
-    }
-    if (entry.fileType !== null && (!Number.isInteger(entry.fileType) || entry.fileType < 0)) {
-      throw new SandboxPullError(`${entry.prefixedPath} has invalid file metadata`, "remote");
-    }
-    if (entry.size !== null && (!Number.isInteger(entry.size) || entry.size < 0)) {
-      throw new SandboxPullError(`${entry.prefixedPath} has invalid file metadata`, "remote");
-    }
-    if (entry.size !== null && entry.size > MFS_FILE_SIZE_LIMIT_BYTES) {
-      throw new SandboxPullError(`File too large (max ${MFS_FILE_SIZE_LIMIT_LABEL}): ${entry.prefixedPath}`, "too-large");
-    }
-    remoteBlobPaths.add(entry.prefixedPath);
-    blobEntries.push({ entry, localPath });
-  }
-  if (selection.mode === "partial") {
-    for (const scope of selection.scopes) {
-      const repoRoot = selection.repos.some((repo) => repo.name === scope);
-      const previouslyTracked = Object.keys(previousFiles).some((workspacePath) => pathIsIncluded(scope, workspacePath));
-      if (!repoRoot && !matchedScopes.has(scope) && !previouslyTracked) {
-        throw new SandboxPullError(`Workspace path does not exist: ${scope}`, "invalid-path");
-      }
+// src/commands/telemetry.ts
+function registerTelemetryCommand(program2) {
+  const telemetry = program2.command("telemetry").description("Manage Moxt CLI telemetry");
+  telemetry.command("status").description("Show telemetry status").action(() => {
+    const cfg = readTelemetryConfig();
+    const envOverride = process.env.MOXT_TELEMETRY_DISABLED === "1" || process.env.MOXT_TELEMETRY_DISABLED === "true" || process.env.DO_NOT_TRACK === "1" || process.env.DO_NOT_TRACK === "true";
+    const state = isTelemetryDisabled() ? "disabled" : "enabled";
+    print(`telemetry: ${state}`);
+    if (envOverride) {
+      print("(disabled via environment variable)");
+    } else if (cfg.disabled) {
+      print("(disabled via config file)");
     }
-  }
-  const plannedBlobs = [];
-  for (const { entry, localPath } of blobEntries) {
-    plannedBlobs.push({
-      entry,
-      localPath,
-      shouldWrite: await shouldWritePulledFile(
-        localPath,
-        requireBlobSha(entry),
-        entry.prefixedPath,
-        previousFiles[entry.prefixedPath],
-        Boolean(options.force)
-      )
-    });
-  }
-  const plannedDeletions = await planRemoteDeletions(
-    compatibleState,
-    selection,
-    resolvedTargetDir,
-    remoteBlobPaths,
-    Boolean(options.force)
-  );
-  for (const directory of directoryPaths) {
-    await assertCanCreateDirectory(directory.localPath, directory.workspacePath);
-  }
-  const blobsToDownload = plannedBlobs.filter((planned) => planned.shouldWrite);
-  const downloadUrls = await presignDownloads(context, blobsToDownload.map(({ entry }) => entry));
-  const downloadedEntries = [];
-  for (const planned of blobsToDownload) {
-    const { entry, localPath } = planned;
-    const remoteContent = await downloadBlob(entry, downloadUrls);
-    downloadedEntries.push({ ...planned, content: remoteContent });
-  }
-  for (const deletion of plannedDeletions) {
-    await rm2(deletion.localPath);
-  }
-  for (const directory of directoryPaths) {
-    await mkdir2(directory.localPath, { recursive: true });
-  }
-  for (const downloaded of downloadedEntries) {
-    await writePulledFile(downloaded.localPath, downloaded.content);
-  }
-  const downloadedContentByPath = new Map(
-    downloadedEntries.map(({ entry, content }) => [entry.prefixedPath, content])
-  );
-  const pulledFiles = Object.fromEntries(await Promise.all(plannedBlobs.map(async ({ entry, localPath }) => {
-    const content = downloadedContentByPath.get(entry.prefixedPath);
-    return [
-      entry.prefixedPath,
-      {
-        repoId: entry.repoId,
-        repoPath: entry.path,
-        fileId: entry.fileId,
-        sha: requireBlobSha(entry),
-        size: content?.length ?? entry.size ?? previousFiles[entry.prefixedPath]?.size ?? await localFileSize(localPath, entry.prefixedPath),
-        fileType: entry.fileType ?? 1
-      }
-    ];
-  })));
-  await saveCheckoutState(buildNextCheckoutState({
-    context,
-    checkoutRoot: resolvedTargetDir,
-    allRepos: repos,
-    selection,
-    previousState: compatibleState,
-    pulledRepos: stateRepos,
-    pulledFiles
-  }));
-  return {
-    fileCount: blobEntries.length,
-    targetDir: resolvedTargetDir
-  };
-}
-function resolveCompatibleState(state, context, checkoutRoot, repos) {
-  if (!state || state.workspaceId !== context.workspaceId || state.checkoutRoot !== checkoutRoot) return void 0;
-  const currentRepos = new Map(repos.map((repo) => [repo.repoId, repo.name]));
-  const stateMatchesRepos = Object.entries(state.repos).every(
-    ([repoId, repo]) => currentRepos.get(repoId) === repo.name
-  );
-  return stateMatchesRepos ? state : void 0;
-}
-function resolvePullSelection(context, requestedScopes) {
-  const repos = listRepoEntries(context.repoPayload);
-  if (!requestedScopes || requestedScopes.length === 0) {
-    return { mode: "full", scopes: repos.map((repo) => repo.name), repos };
-  }
-  const resolvedScopes = requestedScopes.map((scope) => {
-    const resolved = resolveWorkspacePath(context.repoPayload, scope);
-    return {
-      path: resolved.repoPath ? `${resolved.repoName}/${resolved.repoPath}` : resolved.repoName,
-      repoId: resolved.repoId
-    };
   });
-  const scopes = collapseScopes(resolvedScopes.map((scope) => scope.path));
-  const repoIds = new Set(resolvedScopes.map((scope) => scope.repoId));
-  return {
-    mode: "partial",
-    scopes,
-    repos: repos.filter((repo) => repoIds.has(repo.repoId))
-  };
-}
-function buildNextCheckoutState(input) {
-  const { context, checkoutRoot, allRepos, selection, previousState, pulledRepos, pulledFiles } = input;
-  if (selection.mode === "full") {
-    return {
-      version: 1,
-      workspaceId: context.workspaceId,
-      checkoutRoot,
-      mode: "full",
-      checkedOutScopes: selection.scopes,
-      repos: pulledRepos,
-      files: pulledFiles
-    };
-  }
-  const previousFiles = previousState?.files ?? {};
-  const preservedFiles = Object.fromEntries(
-    Object.entries(previousFiles).filter(
-      ([workspacePath]) => !selection.scopes.some((scope) => pathIsIncluded(scope, workspacePath))
-    )
-  );
-  const checkedOutScopes = collapseScopes([...previousState?.checkedOutScopes ?? [], ...selection.scopes]);
-  const mode = allRepos.every((repo) => checkedOutScopes.includes(repo.name)) ? "full" : "partial";
-  return {
-    version: 1,
-    workspaceId: context.workspaceId,
-    checkoutRoot,
-    mode,
-    checkedOutScopes,
-    repos: { ...previousState?.repos ?? {}, ...pulledRepos },
-    files: { ...preservedFiles, ...pulledFiles }
-  };
+  telemetry.command("enable").description("Enable telemetry").action(() => {
+    writeTelemetryConfig({ disabled: false });
+    print("telemetry: enabled");
+  });
+  telemetry.command("disable").description("Disable telemetry").action(() => {
+    writeTelemetryConfig({ disabled: true });
+    print("telemetry: disabled");
+  });
 }
-function collapseScopes(scopes) {
-  const result = [];
-  for (const scope of scopes) {
-    if (result.some((existing) => pathIsIncluded(existing, scope))) continue;
-    for (let index = result.length - 1; index >= 0; index--) {
-      if (pathIsIncluded(scope, result[index])) result.splice(index, 1);
+
+// src/commands/whoami.ts
+function registerWhoamiCommand(program2) {
+  program2.command("whoami").description("Show current user information").action(async () => {
+    startSpinner("Fetching user info...");
+    const response = await httpGet("/users/whoami");
+    if (response.ok) {
+      stopSpinner(true, "Done");
+      print(`${colors.bold}Nickname${colors.reset}: ${response.data.nickname}`);
+      print(`${colors.bold}Email${colors.reset}: ${response.data.email}`);
+    } else {
+      stopSpinner(false, "Failed");
+      printError(`Error [${response.status}]: ${JSON.stringify(response.data)}`);
+      process.exit(1);
     }
-    result.push(scope);
-  }
-  return result;
-}
-function pathsIntersect(left, right) {
-  return pathIsIncluded(left, right) || pathIsIncluded(right, left);
-}
-function pathIsIncluded(scope, workspacePath) {
-  return workspacePath === scope || workspacePath.startsWith(`${scope}/`);
+  });
 }
-function resolveStateRepos(tree, repos) {
-  const knownRepoIds = new Set(repos.map((repo) => repo.repoId));
-  for (const repoId of Object.keys(tree.repos)) {
-    if (!knownRepoIds.has(repoId)) {
-      throw new SandboxPullError(`Remote tree returned unknown repo: ${repoId}`, "remote");
-    }
-  }
-  return Object.fromEntries(repos.map((repo) => {
-    const remoteRepo = tree.repos[repo.repoId];
-    if (!remoteRepo) {
-      throw new SandboxPullError(`Remote tree did not return repo: ${repo.repoId}`, "remote");
+
+// src/commands/workspace.ts
+var emailRegex = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;
+function isValidEmail(email) {
+  return emailRegex.test(email);
+}
+function registerWorkspaceCommand(program2) {
+  const workspace = program2.command("workspace").description("Workspace management");
+  workspace.command("list").description("List all workspaces you belong to").action(async () => {
+    startSpinner("Fetching workspaces...");
+    const response = await httpGet("/workspaces");
+    if (response.ok) {
+      const { workspaces } = response.data;
+      if (workspaces.length === 0) {
+        stopSpinner(true, "No workspaces found.");
+        return;
+      }
+      stopSpinner(true, `Found ${workspaces.length} workspace(s)`);
+      for (const ws of workspaces) {
+        print(`${colors.bold}${ws.workspaceId}${colors.reset}	${ws.name}`);
+      }
+    } else {
+      stopSpinner(false, "Failed");
+      printError(`Error [${response.status}]: ${JSON.stringify(response.data)}`);
+      process.exit(1);
+    }
+  });
+  const members = program2.command("members").description("Manage workspace members");
+  members.command("list").description("List all members in a workspace").requiredOption("-w, --workspace <workspaceId>", "Workspace ID").action(async (options) => {
+    const { workspace: workspaceId } = options;
+    startSpinner("Fetching workspace members...");
+    const response = await httpGet(`/workspaces/${workspaceId}/members`);
+    if (!response.ok) {
+      stopSpinner(false, "Failed to fetch members");
+      printError(`Error [${response.status}]: ${JSON.stringify(response.data)}`);
+      process.exit(1);
     }
-    if (remoteRepo.prefix !== repo.name) {
-      throw new SandboxPullError(`Remote tree returned unexpected prefix for repo ${repo.repoId}`, "remote");
+    const { members: members2 } = response.data;
+    if (members2.length === 0) {
+      stopSpinner(true, "No members found.");
+      return;
     }
-    if (typeof remoteRepo.sha !== "string" || remoteRepo.sha.length === 0) {
-      throw new SandboxPullError(`Remote tree did not return a version for repo ${repo.repoId}`, "remote");
+    stopSpinner(true, `Found ${members2.length} member(s)`);
+    for (const member of members2) {
+      const name = member.displayName || "-";
+      print(`${colors.bold}${member.email}${colors.reset}	${name}	${member.role}`);
     }
-    return [repo.repoId, { name: repo.name, treeSha: remoteRepo.sha }];
-  }));
-}
-async function fetchWorkspaceTree(context, selection) {
-  const client = new SandboxMoxtClient(context);
-  const results = await Promise.all(selection.repos.map(async (repo) => {
-    const filter = resolveRepoTreeFilter(repo, selection);
-    const params = new URLSearchParams({ entryFilter: filter.type });
-    if (filter.type === "paths") {
-      for (const path2 of filter.paths) params.append("path", path2);
+  });
+  members.command("remove").description("Remove members from a workspace").requiredOption("-w, --workspace <workspaceId>", "Workspace ID").argument("<emails>", "Emails to remove (comma-separated)").action(async (emailsArg, options) => {
+    const { workspace: workspaceId } = options;
+    const emails = emailsArg.split(",").map((e) => e.trim()).filter(Boolean);
+    if (emails.length === 0) {
+      printError("No valid emails provided");
+      process.exit(1);
     }
-    const response = await client.request(
-      "GET",
-      `/agent/api/pipeline-sandbox/mfs/${encodeURIComponent(repo.repoId)}/tree?${params.toString()}`
-    );
-    return { repo, tree: response.data };
-  }));
-  return {
-    repos: Object.fromEntries(
-      results.map(({ repo, tree }) => [repo.repoId, { sha: tree.sha, prefix: repo.name }])
-    ),
-    entries: results.flatMap(
-      ({ repo, tree }) => tree.entries.map((entry) => ({
-        ...entry,
-        repoId: repo.repoId,
-        prefixedPath: entry.path ? `${repo.name}/${entry.path}` : repo.name
-      }))
-    )
-  };
-}
-function resolveRepoTreeFilter(repo, selection) {
-  if (selection.mode === "full") return { type: "all" };
-  const repoPaths = [];
-  for (const scope of selection.scopes) {
-    if (scope === repo.name) return { type: "all" };
-    if (scope.startsWith(`${repo.name}/`)) repoPaths.push(scope.slice(repo.name.length + 1));
-  }
-  if (repoPaths.length === 0) {
-    throw new SandboxPullError(`No pull scope resolved for repo: ${repo.name}`, "invalid-path");
-  }
-  return { type: "paths", paths: repoPaths };
-}
-async function presignDownloads(context, entries) {
-  const client = new SandboxMoxtClient(context);
-  const entriesByRepo = /* @__PURE__ */ new Map();
-  for (const entry of entries) {
-    const existing = entriesByRepo.get(entry.repoId) ?? [];
-    existing.push(entry);
-    entriesByRepo.set(entry.repoId, existing);
-  }
-  const urls = /* @__PURE__ */ new Map();
-  for (const [repoId, repoEntries] of entriesByRepo) {
-    const hashes = [...new Set(repoEntries.map((entry) => entry.sha).filter((sha) => Boolean(sha)))];
-    if (hashes.length === 0) continue;
-    const response = await client.request(
-      "POST",
-      `/agent/api/pipeline-sandbox/mfs/${encodeURIComponent(repoId)}/presign-download`,
-      { hashes }
-    );
-    for (const hash of hashes) {
-      const url = response.data.urls[hash];
-      if (!url) {
-        throw new SandboxPullError(`No download URL returned for ${hash}`, "remote");
+    const invalidEmails = emails.filter((e) => !isValidEmail(e));
+    if (invalidEmails.length > 0) {
+      for (const email of invalidEmails) {
+        printError(`Invalid email format: ${email}`);
+      }
+      process.exit(1);
+    }
+    startSpinner("Fetching workspace members...");
+    const membersResponse = await httpGet(`/workspaces/${workspaceId}/members`);
+    if (!membersResponse.ok) {
+      stopSpinner(false, "Failed to fetch members");
+      printError(`Error [${membersResponse.status}]: ${JSON.stringify(membersResponse.data)}`);
+      process.exit(1);
+    }
+    stopSpinner(true, "Members fetched");
+    const { members: members2 } = membersResponse.data;
+    const emailToMember = new Map(members2.map((m) => [m.email.toLowerCase(), m]));
+    for (const email of emails) {
+      const member = emailToMember.get(email.toLowerCase());
+      if (!member) {
+        print(`${colors.red}\u2717${colors.reset} ${email} - not found in workspace`);
+        continue;
+      }
+      const deleteResponse = await httpDelete(`/workspaces/${workspaceId}/members/${member.userId}`);
+      if (deleteResponse.ok) {
+        print(`${colors.green}\u2713${colors.reset} ${email} - removed`);
+      } else {
+        print(`${colors.red}\u2717${colors.reset} ${email} - failed: ${JSON.stringify(deleteResponse.data)}`);
       }
-      urls.set(hash, url);
     }
-  }
-  return urls;
-}
-async function downloadBlob(entry, urls) {
-  const hash = entry.sha;
-  if (!hash) {
-    throw new SandboxPullError(`${entry.prefixedPath} does not have downloadable content`, "remote");
-  }
-  const url = urls.get(hash);
-  if (!url) {
-    throw new SandboxPullError(`No download URL returned for ${entry.prefixedPath}`, "remote");
-  }
-  const response = await fetch(url);
-  if (!response.ok) {
-    throw new SandboxPullError(`Download failed [${response.status}]: ${entry.prefixedPath}`, "remote");
-  }
-  const content = Buffer.from(await response.arrayBuffer());
-  if (content.length > MFS_FILE_SIZE_LIMIT_BYTES) {
-    throw new SandboxPullError(`File too large (max ${MFS_FILE_SIZE_LIMIT_LABEL}): ${entry.prefixedPath}`, "too-large");
-  }
-  const contentHash = createHash2("sha256").update(content).digest("hex");
-  if (contentHash !== hash) {
-    throw new SandboxPullError(`Downloaded content hash mismatch: ${entry.prefixedPath}`, "remote");
-  }
-  return content;
-}
-async function shouldWritePulledFile(localPath, remoteContentHash, workspacePath, previousFile, force) {
-  const existing = await lstat(localPath).catch((error) => {
-    if (isNodeError2(error) && error.code === "ENOENT") return void 0;
-    throw error;
   });
-  if (existing && !existing.isFile()) {
-    throw new SandboxPullError(`Refusing to overwrite local path: ${workspacePath}`, "directory-conflict");
-  }
-  if (!existing) {
-    if (force || !previousFile) return true;
-    if (remoteContentHash === previousFile.sha) return false;
-    throw new SandboxPullError(
-      `Local file was deleted but remote file changed: ${workspacePath}`,
-      "file-conflict"
-    );
-  }
-  if (force) return true;
-  const localContentHash = await hashLocalFile(localPath);
-  if (localContentHash === remoteContentHash) return false;
-  if (!previousFile) {
-    throw new SandboxPullError(
-      `Refusing to overwrite modified local file: ${workspacePath}. Use --force to overwrite.`,
-      "file-conflict"
-    );
-  }
-  const localChanged = localContentHash !== previousFile.sha;
-  const remoteChanged = remoteContentHash !== previousFile.sha;
-  if (!localChanged && remoteChanged) return true;
-  if (localChanged && !remoteChanged) return false;
-  if (localChanged && remoteChanged) {
-    throw new SandboxPullError(
-      `Local and remote file both changed since checkout: ${workspacePath}`,
-      "file-conflict"
+  const space = program2.command("space").description("Manage spaces");
+  space.command("list").description("List accessible spaces in a workspace").requiredOption("-w, --workspace <workspaceId>", "Workspace ID").action(async (options) => {
+    const { workspace: workspaceId } = options;
+    startSpinner("Fetching spaces...");
+    const response = await httpGet(`/workspaces/${workspaceId}/spaces`);
+    if (!response.ok) {
+      stopSpinner(false, "Failed to fetch spaces");
+      printError(`Error [${response.status}]: ${JSON.stringify(response.data)}`);
+      process.exit(1);
+    }
+    const { spaces } = response.data;
+    if (spaces.length === 0) {
+      stopSpinner(true, "No spaces found.");
+      return;
+    }
+    stopSpinner(true, `Found ${spaces.length} space(s)`);
+    print(
+      `${colors.bold}TYPE${colors.reset}	${colors.bold}TEAM_SPACE_ID${colors.reset}	${colors.bold}TEAMMATE_ID${colors.reset}	${colors.bold}NAME${colors.reset}`
     );
-  }
-  return false;
+    for (const s of spaces) {
+      const teamSpaceId = s.teamSpaceId ?? "";
+      const teammateId = s.agentId != null ? String(s.agentId) : "";
+      print(`${s.type}	${teamSpaceId}	${teammateId}	${s.name}`);
+    }
+  });
 }
-async function planRemoteDeletions(previousState, selection, checkoutRoot, remoteBlobPaths, force) {
-  if (!previousState) return [];
-  const deletions = [];
-  for (const [workspacePath, previousFile] of Object.entries(previousState.files)) {
-    if (!selection.scopes.some((scope) => pathIsIncluded(scope, workspacePath))) continue;
-    if (remoteBlobPaths.has(workspacePath)) continue;
-    const repo = previousState.repos[previousFile.repoId];
-    if (!repo) {
-      throw new SandboxPullError(`Checkout baseline references unknown repo: ${workspacePath}`, "remote");
-    }
-    const localPath = resolveSafeLocalPath(checkoutRoot, repo.name, previousFile.repoPath);
-    const existing = await lstat(localPath).catch((error) => {
-      if (isNodeError2(error) && error.code === "ENOENT") return void 0;
-      throw error;
-    });
-    if (!existing) continue;
-    if (!existing.isFile()) {
-      throw new SandboxPullError(`Refusing to overwrite local path: ${workspacePath}`, "directory-conflict");
-    }
-    if (!force && await hashLocalFile(localPath) !== previousFile.sha) {
-      throw new SandboxPullError(
-        `Remote file was deleted but local file changed: ${workspacePath}`,
-        "file-conflict"
-      );
+
+// src/commands/workflow.ts
+import * as fs4 from "fs";
+import { TextDecoder as TextDecoder2 } from "util";
+var MAX_DESC_LENGTH = 5e3;
+var MAX_COMMENT_CONTENT_LENGTH = 5e3;
+var MAX_COMMENT_CONTENT_BYTES = MAX_COMMENT_CONTENT_LENGTH * 4;
+var WorkflowOptionsError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "WorkflowOptionsError";
+  }
+};
+function runOrExit4(fn) {
+  try {
+    return fn();
+  } catch (err) {
+    if (err instanceof WorkflowOptionsError || err instanceof SpaceOptionsError || err instanceof SearchOptionsError) {
+      printError(err.message);
+      process.exit(1);
     }
-    deletions.push({ localPath });
+    throw err;
   }
-  return deletions;
 }
-async function hashLocalFile(localPath) {
-  return createHash2("sha256").update(await readFile2(localPath)).digest("hex");
+function addWorkspaceOption(command) {
+  return command.requiredOption("-w, --workspace <workspaceId>", "Workspace ID");
 }
-async function localFileSize(localPath, workspacePath) {
-  const stats = await lstat(localPath);
-  if (!stats.isFile()) {
-    throw new SandboxPullError(`Cannot determine local file size: ${workspacePath}`, "directory-conflict");
-  }
-  return stats.size;
-}
-function requireBlobSha(entry) {
-  if (!entry.sha) {
-    throw new SandboxPullError(`${entry.prefixedPath} does not have downloadable content`, "remote");
-  }
-  return entry.sha;
+function addSpaceOptions2(command) {
+  return addWorkspaceOption(command).option("-s, --space <name>", "Space name (personal or teamspace name)").option("--personal", "Use personal space (default)").option("--team-space-id <teamSpaceId>", "Team space ID").option("--teammate-id <teammateId>", "Teammate ID (teammate space)");
 }
-async function assertCanCreateDirectory(localPath, workspacePath) {
-  const existing = await lstat(localPath).catch((error) => {
-    if (isNodeError2(error) && error.code === "ENOENT") return void 0;
-    throw error;
-  });
-  if (existing && !existing.isDirectory()) {
-    throw new SandboxPullError(`Refusing to overwrite local path: ${workspacePath}`, "directory-conflict");
-  }
+function addAssigneeOptions(command) {
+  return command.option("--human-id <humanId>", "Human assignee ID").option("--assistant-id <assistantId>", "AI assistant assignee ID").option("--teammate-id <teammateId>", "AI teammate assignee ID");
 }
-async function writePulledFile(localPath, remoteContent) {
-  await mkdir2(dirname2(localPath), { recursive: true });
-  await writeFile2(localPath, remoteContent);
+function addPreferredAssigneeOptions(command) {
+  return command.option("--preferred-human-id <humanId>", "Preferred human assignee ID").option("--preferred-assistant-id <assistantId>", "Preferred AI assistant assignee ID").option("--preferred-teammate-id <teammateId>", "Preferred AI teammate assignee ID");
 }
-function resolveSafeLocalPath(targetDir, repoName, repoPath) {
-  const pathParts = [repoName, ...repoPath.split("/").filter((part) => part.length > 0)];
-  if (pathParts.some((part) => part === "." || part === ".." || part.includes("/") || part.includes("\\") || part.includes("\0"))) {
-    throw new SandboxPullError(`Remote path is unsafe: ${[repoName, repoPath].filter(Boolean).join("/")}`, "invalid-path");
-  }
-  const resolved = resolve(targetDir, ...pathParts);
-  const relativePath = relative(targetDir, resolved);
-  if (relativePath.startsWith("..") || isAbsolute2(relativePath)) {
-    throw new SandboxPullError(`Remote path escapes target directory: ${repoName}/${repoPath}`, "invalid-path");
+function parsePositiveInteger(raw, label) {
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0 || String(parsed) !== raw) {
+    throw new WorkflowOptionsError(`Error: ${label} must be a positive integer, got "${raw}".`);
   }
-  return resolved;
+  return parsed;
 }
-function isNodeError2(error) {
-  return error instanceof Error && "code" in error;
+function parseOptionalPositiveInteger(raw, label) {
+  if (raw == null || raw === "") return void 0;
+  return parsePositiveInteger(raw, label);
 }
-
-// src/commands/pull.ts
-function registerPullCommand(program2) {
-  program2.command("pull").description("Pull workspace files into the local checkout").argument("[workspacePath]", "Workspace file or directory to pull").option("--all", "Pull the entire workspace").option("--force", "Overwrite changed local files").addOption(new Option("--dir <dir>").hideHelp()).addOption(new Option("--scope <workspacePath>").argParser(collectScope).default([]).hideHelp()).action(async (workspacePath, options) => {
-    const context = resolveSandboxRuntimeContextOrExit2();
-    try {
-      const invocation = await resolvePullInvocation(context, workspacePath, options);
-      const result = await pullSandboxWorkspace(context, invocation.targetDir, {
-        force: Boolean(options.force),
-        scopes: invocation.scopes
-      });
-      print(`Pulled ${result.fileCount} ${result.fileCount === 1 ? "file" : "files"} to ${result.targetDir}`);
-    } catch (error) {
-      handlePullError(error);
-    }
-  });
+function parseStatusType(raw) {
+  if (raw == null || raw === "") return void 0;
+  const parsed = Number.parseInt(raw, 10);
+  if ((parsed === 1 || parsed === 2 || parsed === 3) && String(parsed) === raw) return parsed;
+  throw new WorkflowOptionsError("Error: --type must be one of 1 (todo), 2 (in-progress), or 3 (done).");
 }
-async function resolvePullInvocation(context, argument, options) {
-  const legacyTargetDir = argument && isLegacyTargetDirectory(argument) ? argument : void 0;
-  const workspacePath = legacyTargetDir ? void 0 : argument;
-  if (workspacePath && options.all) {
-    throw new Error("Specify either a workspace path or --all, not both");
-  }
-  if (options.scope.length > 0 && (workspacePath || options.all)) {
-    throw new Error("Legacy --scope cannot be combined with a workspace path or --all");
+function parseRequiredStatusType(raw) {
+  const value = parseStatusType(raw);
+  if (value === void 0) {
+    throw new WorkflowOptionsError("Error: --type is required.");
   }
-  if (legacyTargetDir && options.dir) {
-    throw new Error("Specify the local checkout directory only once");
-  }
-  const state = await loadCheckoutState();
-  if (state) validateCheckoutStateContext(state, context);
-  const targetDir = options.dir ?? legacyTargetDir ?? state?.checkoutRoot ?? ".";
-  if (options.all || legacyTargetDir && options.scope.length === 0) {
-    return { targetDir };
-  }
-  if (workspacePath) return { targetDir, scopes: [workspacePath] };
-  if (options.scope.length > 0) return { targetDir, scopes: options.scope };
-  if (!state || state.checkedOutScopes.length === 0) {
-    throw new Error("Checkout is not initialized. Run moxt pull <workspace-path> or moxt pull --all first.");
-  }
-  return {
-    targetDir: state.checkoutRoot,
-    scopes: state.mode === "full" ? void 0 : state.checkedOutScopes
-  };
-}
-function isLegacyTargetDirectory(value) {
-  return value === "." || value.startsWith("./") || value.startsWith("../") || isAbsolute3(value);
+  return value;
 }
-function validateCheckoutStateContext(state, context) {
-  if (state.workspaceId !== context.workspaceId) {
-    throw new Error(`Checkout state belongs to workspace ${state.workspaceId}, not ${context.workspaceId}`);
-  }
-  const currentRepos = new Map(listRepoEntries(context.repoPayload).map((repo) => [repo.repoId, repo.name]));
-  for (const [repoId, repo] of Object.entries(state.repos)) {
-    const currentName = currentRepos.get(repoId);
-    if (!currentName) throw new Error(`Checkout state contains unknown repo: ${repoId}`);
-    if (currentName !== repo.name) {
-      throw new Error(`Checkout state repo name does not match current workspace: ${repo.name}`);
-    }
+function parsePriority(raw) {
+  if (raw == null || raw === "") return void 0;
+  if (raw === "urgent") return 0;
+  if (raw === "high") return 1;
+  if (raw === "medium") return 2;
+  if (raw === "low") return 3;
+  throw new WorkflowOptionsError('Error: --priority must be "urgent", "high", "medium", or "low".');
+}
+function parseRequiredPriority(raw) {
+  return parsePriority(raw ?? "medium") ?? 2;
+}
+function parseWorkflowScope(raw) {
+  if (raw == null || raw === "") return "all";
+  if (raw === "all" || raw === "owner_is_me") return raw;
+  throw new WorkflowOptionsError('Error: --scope must be "all" or "owner_is_me".');
+}
+function parseTaskScope(raw) {
+  if (raw == null || raw === "") return "all";
+  if (raw === "all" || raw === "assigned_to_me" || raw === "subscribed_by_me" || raw === "owner_is_me") {
+    return raw;
   }
+  throw new WorkflowOptionsError(
+    'Error: --scope must be "all", "assigned_to_me", "subscribed_by_me", or "owner_is_me".'
+  );
 }
-function collectScope(value, previous) {
-  return [...previous, value];
-}
-function resolveSandboxRuntimeContextOrExit2() {
-  let context;
-  try {
-    context = resolveRuntimeContext();
-  } catch (error) {
-    if (error instanceof RuntimeContextError) {
-      printError(error.message);
-      process.exit(1);
-    }
-    throw error;
+function parseFileIds(raw, label = "--file-ids") {
+  if (raw == null || raw === "") return void 0;
+  const ids = raw.split(",").map((item) => item.trim()).filter(Boolean);
+  if (ids.length === 0) {
+    throw new WorkflowOptionsError(`Error: ${label} must include at least one file ID.`);
   }
-  if (context.mode !== "sandbox") {
-    printError("moxt pull is only available in sandbox mode");
-    process.exit(1);
-  }
-  return context;
+  return ids;
 }
-function handlePullError(error) {
-  if (error instanceof Error) {
-    printError(error.message);
-    process.exit(1);
+function readDescFile(path2) {
+  if (path2 == null || path2 === "") return void 0;
+  if (!fs4.existsSync(path2)) {
+    throw new WorkflowOptionsError(`Error: desc file not found: ${path2}`);
   }
-  throw error;
-}
-
-// src/utils/sandbox-push.ts
-import { createHash as createHash3 } from "crypto";
-import { lstat as lstat2, readFile as readFile3, readdir } from "fs/promises";
-import { isAbsolute as isAbsolute4, join as join2, relative as relative2, resolve as resolve2 } from "path";
-
-// src/utils/concurrency.ts
-async function runWithConcurrency(items, concurrency, action) {
-  if (!Number.isInteger(concurrency) || concurrency < 1) {
-    throw new RangeError("Concurrency must be a positive integer");
+  const stat = fs4.statSync(path2);
+  if (!stat.isFile()) {
+    throw new WorkflowOptionsError(`Error: desc file is not a file: ${path2}`);
   }
-  let nextIndex = 0;
-  async function worker() {
-    while (nextIndex < items.length) {
-      const item = items[nextIndex];
-      nextIndex += 1;
-      await action(item);
-    }
+  const buffer2 = fs4.readFileSync(path2);
+  if (isBinaryContent(buffer2)) {
+    throw new WorkflowOptionsError("Error: desc file must be UTF-8 text, not binary content.");
   }
-  const workerCount = Math.min(concurrency, items.length);
-  await Promise.all(Array.from({ length: workerCount }, () => worker()));
+  const content = buffer2.toString("utf8");
+  if (content.length > MAX_DESC_LENGTH) {
+    throw new WorkflowOptionsError(`Error: desc file must be at most ${MAX_DESC_LENGTH} characters.`);
+  }
+  return content;
 }
-
-// src/utils/sandbox-push.ts
-var MFS_FILE_TYPE_REGULAR2 = 1;
-var MAX_CONCURRENT_UPLOADS = 8;
-var SandboxPushError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "SandboxPushError";
+function readCommentContentFile2(path2) {
+  if (!fs4.existsSync(path2)) {
+    throw new WorkflowOptionsError(`Error: comment content file not found: ${path2}`);
   }
-  code;
-};
-async function pushSandboxWorkspace(context, sourceDir, options) {
-  const resolvedSourceDir = resolve2(sourceDir);
-  await assertWorkspaceRoot(resolvedSourceDir);
-  const repos = listRepoEntries(context.repoPayload);
-  for (const repo of repos) {
-    assertSafeRepoName(resolvedSourceDir, repo.name);
-  }
-  const state = await resolveCheckoutState(context, resolvedSourceDir, repos);
-  const checkoutRepos = repos.filter(
-    (repo) => state.repos[repo.repoId] && doesCheckoutPathIntersect(state, repo.name)
-  );
-  if (checkoutRepos.length === 0) {
-    throw new SandboxPushError("Checkout state does not contain a pushable scope", "invalid-path");
-  }
-  const tree = await fetchWorkspaceTree2(context, checkoutRepos);
-  const remoteEntries = indexRemoteEntries(tree, checkoutRepos);
-  const localFiles = await collectLocalFiles(resolvedSourceDir, checkoutRepos, remoteEntries, state);
-  const { changes, reconciledFiles, removedWorkspacePaths } = planChanges(
-    localFiles,
-    remoteEntries,
-    state,
-    checkoutRepos
-  );
-  let pushResponse;
-  if (changes.length > 0) {
-    await uploadChangedFiles(context, changes);
-    pushResponse = await pushChanges(context, checkoutRepos, changes, options.message);
+  const stat = fs4.statSync(path2);
+  if (!stat.isFile()) {
+    throw new WorkflowOptionsError(`Error: comment content path is not a file: ${path2}`);
   }
-  if (changes.length > 0 || reconciledFiles.length > 0 || removedWorkspacePaths.length > 0) {
-    await updateCheckoutState(state, changes, reconciledFiles, removedWorkspacePaths, pushResponse);
+  if (stat.size > MAX_COMMENT_CONTENT_BYTES) {
+    throw new WorkflowOptionsError(
+      `Error: comment content file must be at most ${MAX_COMMENT_CONTENT_LENGTH} characters.`
+    );
   }
-  return {
-    changes: changes.map((change) => ({ action: change.action, workspacePath: change.workspacePath })),
-    sourceDir: resolvedSourceDir
-  };
-}
-async function resolveCheckoutState(context, sourceDir, repos) {
-  const state = await loadCheckoutState();
-  if (!state) {
-    throw new SandboxPushError("Checkout is not initialized. Run moxt pull first.", "invalid-path");
+  const buffer2 = fs4.readFileSync(path2);
+  if (buffer2.includes(0)) {
+    throw new WorkflowOptionsError("Error: comment content file must not contain NUL bytes.");
   }
-  if (state.workspaceId !== context.workspaceId) {
-    throw new SandboxPushError(
-      `Checkout state belongs to workspace ${state.workspaceId}, not ${context.workspaceId}`,
-      "invalid-path"
-    );
+  if (isBinaryContent(buffer2)) {
+    throw new WorkflowOptionsError("Error: comment content file must be UTF-8 text, not binary content.");
   }
-  if (state.checkoutRoot !== sourceDir) {
-    throw new SandboxPushError(
-      `Checkout root is ${state.checkoutRoot}, not ${sourceDir}`,
-      "invalid-path"
-    );
+  let content;
+  try {
+    content = new TextDecoder2("utf-8", { fatal: true, ignoreBOM: true }).decode(buffer2);
+  } catch {
+    throw new WorkflowOptionsError("Error: comment content file must contain valid UTF-8 text.");
   }
-  const currentRepos = new Map(repos.map((repo) => [repo.repoId, repo.name]));
-  for (const [repoId, repo] of Object.entries(state.repos)) {
-    if (currentRepos.get(repoId) !== repo.name) {
-      throw new SandboxPushError(`Checkout state contains unknown repo: ${repoId}`, "invalid-path");
-    }
+  if (content.length === 0) {
+    throw new WorkflowOptionsError("Error: comment content file must not be empty.");
   }
-  for (const scope of state.checkedOutScopes) {
-    const hasRepo = Object.values(state.repos).some(
-      (repo) => scope === repo.name || scope.startsWith(`${repo.name}/`)
+  if (content.length > MAX_COMMENT_CONTENT_LENGTH) {
+    throw new WorkflowOptionsError(
+      `Error: comment content file must be at most ${MAX_COMMENT_CONTENT_LENGTH} characters.`
     );
-    if (!hasRepo) throw new SandboxPushError(`Checkout state contains invalid scope: ${scope}`, "invalid-path");
   }
-  return state;
+  return content;
 }
-async function assertWorkspaceRoot(sourceDir) {
-  const stats = await lstat2(sourceDir).catch((error) => {
-    if (isNodeError3(error) && error.code === "ENOENT") {
-      throw new SandboxPushError(`Local workspace directory does not exist: ${sourceDir}`, "invalid-path");
-    }
-    throw error;
-  });
-  if (!stats.isDirectory()) {
-    throw new SandboxPushError(`Local workspace path is not a directory: ${sourceDir}`, "invalid-path");
-  }
+function parseAssigneeBody(options, allowClear) {
+  const hasClear = options.clear === true;
+  const humanId = parseOptionalPositiveInteger(options.humanId, "--human-id");
+  const assistantId = parseOptionalPositiveInteger(options.assistantId, "--assistant-id");
+  const teammateId = parseOptionalPositiveInteger(options.teammateId, "--teammate-id");
+  const count = (humanId !== void 0 ? 1 : 0) + (assistantId !== void 0 ? 1 : 0) + (teammateId !== void 0 ? 1 : 0);
+  if (hasClear && !allowClear) {
+    throw new WorkflowOptionsError("Error: --clear is not supported here.");
+  }
+  if (hasClear && count > 0) {
+    throw new WorkflowOptionsError("Error: --clear cannot be used with assignee ID options.");
+  }
+  if (count > 1) {
+    throw new WorkflowOptionsError("Error: assignee ID options are mutually exclusive.");
+  }
+  if (hasClear) return {};
+  if (humanId !== void 0) return { assigneeHumanId: humanId };
+  if (assistantId !== void 0) return { assigneeAiAssistantId: assistantId };
+  if (teammateId !== void 0) return { assigneeAiTeammateId: teammateId };
+  return {};
 }
-async function fetchWorkspaceTree2(context, repos) {
-  const client = new SandboxMoxtClient(context);
-  const response = await client.request(
-    "POST",
-    "/agent/api/pipeline-sandbox/mfs-workspace/batch-trees",
-    {
-      repos: repos.map((repo) => ({ repoId: repo.repoId, prefix: repo.name }))
-    }
-  );
-  return response.data;
-}
-function indexRemoteEntries(tree, repos) {
-  const knownRepoIds = new Set(repos.map((repo) => repo.repoId));
-  const entries = /* @__PURE__ */ new Map();
-  for (const entry of tree.entries) {
-    if (!knownRepoIds.has(entry.repoId)) {
-      throw new SandboxPushError(`Remote tree returned unknown repo: ${entry.repoId}`, "remote");
-    }
-    const key = remoteEntryKey(entry.repoId, entry.path);
-    if (entries.has(key)) {
-      throw new SandboxPushError(`Remote tree returned duplicate path: ${entry.prefixedPath}`, "remote");
-    }
-    entries.set(key, entry);
-  }
-  return entries;
-}
-async function collectLocalFiles(sourceDir, repos, remoteEntries, state) {
-  const files = [];
-  for (const repo of repos) {
-    const repoRoot = resolveSafeRepoRoot(sourceDir, repo.name);
-    const stats = await lstat2(repoRoot).catch((error) => {
-      if (isNodeError3(error) && error.code === "ENOENT") return void 0;
-      throw error;
-    });
-    if (!stats) continue;
-    if (!stats.isDirectory()) {
-      throw new SandboxPushError(`Local repo path is not a directory: ${repo.name}`, "invalid-path");
-    }
-    await collectRepoFiles(repoRoot, repo, "", remoteEntries, state, files);
-  }
-  return files;
-}
-async function collectRepoFiles(repoRoot, repo, relativeDir, remoteEntries, state, files) {
-  const localDir = relativeDir ? join2(repoRoot, ...relativeDir.split("/")) : repoRoot;
-  const entries = await readdir(localDir, { withFileTypes: true });
-  entries.sort((a, b) => a.name.localeCompare(b.name));
-  for (const entry of entries) {
-    if (entry.name === ".git") continue;
-    const repoPath = relativeDir ? `${relativeDir}/${entry.name}` : entry.name;
-    const workspacePath = `${repo.name}/${repoPath}`;
-    assertSafePathPart(entry.name, workspacePath);
-    if (!doesCheckoutPathIntersect(state, workspacePath)) continue;
-    if (entry.isSymbolicLink()) {
-      throw new SandboxPushError(`Refusing to push symbolic link: ${workspacePath}`, "invalid-file");
-    }
-    if (entry.isDirectory()) {
-      const remote = remoteEntries.get(remoteEntryKey(repo.repoId, repoPath));
-      if (remote?.type === "blob") {
-        throw new SandboxPushError(`Local directory conflicts with remote file: ${workspacePath}`, "invalid-file");
-      }
-      await collectRepoFiles(repoRoot, repo, repoPath, remoteEntries, state, files);
-      continue;
-    }
-    if (!entry.isFile()) {
-      throw new SandboxPushError(`Refusing to push unsupported file: ${workspacePath}`, "invalid-file");
-    }
-    const localPath = join2(repoRoot, ...repoPath.split("/"));
-    const stats = await lstat2(localPath);
-    if (!stats.isFile()) {
-      const kind = stats.isSymbolicLink() ? "symbolic link" : "unsupported file";
-      throw new SandboxPushError(`Refusing to push ${kind}: ${workspacePath}`, "invalid-file");
-    }
-    if (stats.size > MFS_FILE_SIZE_LIMIT_BYTES) {
-      throw new SandboxPushError(
-        `File too large (max ${MFS_FILE_SIZE_LIMIT_LABEL}): ${workspacePath}`,
-        "too-large"
-      );
-    }
-    const content = await readFile3(localPath);
-    if (content.length > MFS_FILE_SIZE_LIMIT_BYTES) {
-      throw new SandboxPushError(
-        `File too large (max ${MFS_FILE_SIZE_LIMIT_LABEL}): ${workspacePath}`,
-        "too-large"
-      );
-    }
-    if (!isCheckoutPathIncluded(state, workspacePath)) continue;
-    files.push({
-      repo,
-      repoPath,
-      workspacePath,
-      localPath,
-      contentHash: createHash3("sha256").update(content).digest("hex"),
-      size: content.length
-    });
-  }
+function parsePreferredAssigneeBody(options) {
+  const hasClear = options.clearPreferredAssignee === true;
+  const humanId = parseOptionalPositiveInteger(options.preferredHumanId, "--preferred-human-id");
+  const assistantId = parseOptionalPositiveInteger(options.preferredAssistantId, "--preferred-assistant-id");
+  const teammateId = parseOptionalPositiveInteger(options.preferredTeammateId, "--preferred-teammate-id");
+  const count = (humanId !== void 0 ? 1 : 0) + (assistantId !== void 0 ? 1 : 0) + (teammateId !== void 0 ? 1 : 0);
+  if (hasClear && count > 0) {
+    throw new WorkflowOptionsError("Error: --clear-preferred-assignee cannot be used with preferred assignee ID options.");
+  }
+  if (count > 1) {
+    throw new WorkflowOptionsError("Error: preferred assignee ID options are mutually exclusive.");
+  }
+  if (hasClear) return { preferredAssigneeHumanId: null };
+  if (humanId !== void 0) return { preferredAssigneeHumanId: humanId };
+  if (assistantId !== void 0) return { preferredAssigneeAiAssistantId: assistantId };
+  if (teammateId !== void 0) return { preferredAssigneeAiTeammateId: teammateId };
+  return {};
 }
-function planChanges(localFiles, remoteEntries, state, repos) {
-  const changes = [];
-  const reconciledFiles = [];
-  const removedWorkspacePaths = [];
-  const localWorkspacePaths = new Set(localFiles.map((file) => file.workspacePath));
-  const reposById = new Map(repos.map((repo) => [repo.repoId, repo]));
-  for (const file of localFiles) {
-    const baseline = state.files[file.workspacePath];
-    if (baseline?.sha === file.contentHash) continue;
-    const existing = remoteEntries.get(remoteEntryKey(file.repo.repoId, file.repoPath));
-    if (existing?.type === "tree") {
-      throw new SandboxPushError(`Local file conflicts with remote directory: ${file.workspacePath}`, "invalid-file");
-    }
-    if (existing?.sha === file.contentHash) {
-      reconciledFiles.push({ ...file, remote: existing });
-      continue;
-    }
-    if (existing && !existing.sha) {
-      throw new SandboxPushError(`${file.workspacePath} does not have a base content hash`, "remote");
-    }
-    if (baseline && existing?.sha !== baseline.sha) {
-      throw new SandboxPushError(`Remote file changed since checkout: ${file.workspacePath}`, "conflict");
-    }
-    if (!baseline && existing) {
-      throw new SandboxPushError(`Remote file changed since checkout: ${file.workspacePath}`, "conflict");
-    }
-    changes.push({
-      ...file,
-      action: existing ? "update" : "create",
-      ...existing ? { existing } : {}
-    });
-  }
-  for (const [workspacePath, baseline] of Object.entries(state.files)) {
-    if (localWorkspacePaths.has(workspacePath) || !isCheckoutPathIncluded(state, workspacePath)) continue;
-    const repo = reposById.get(baseline.repoId);
-    if (!repo) continue;
-    const existing = remoteEntries.get(remoteEntryKey(baseline.repoId, baseline.repoPath));
-    if (!existing) {
-      removedWorkspacePaths.push(workspacePath);
-      continue;
-    }
-    if (existing.type !== "blob" || existing.sha !== baseline.sha) {
-      throw new SandboxPushError(`Remote file changed since checkout: ${workspacePath}`, "conflict");
-    }
-    changes.push({
-      action: "delete",
-      repo,
-      repoPath: baseline.repoPath,
-      workspacePath,
-      fileId: validFileId(existing.fileId) ?? baseline.fileId
-    });
+function assertNonEmptyBody(body) {
+  if (Object.keys(body).length === 0) {
+    throw new WorkflowOptionsError("Error: at least one update option must be provided.");
   }
-  return { changes, reconciledFiles, removedWorkspacePaths };
-}
-async function uploadChangedFiles(context, changes) {
-  const writeChanges = changes.filter(isWriteChange);
-  if (writeChanges.length === 0) return;
-  const client = new SandboxMoxtClient(context);
-  const changesByRepo = groupChangesByRepo(writeChanges);
-  const uploadUrlsByRepo = await Promise.all(
-    [...changesByRepo].map(async ([repoId, repoChanges]) => {
-      const hashes = [...new Set(repoChanges.map((change) => change.contentHash))];
-      const response = await client.request(
-        "POST",
-        `/agent/api/pipeline-sandbox/mfs/${encodeURIComponent(repoId)}/presign-upload`,
-        { hashes }
-      );
-      return [repoId, response.data.urls];
-    })
-  );
-  const uploadUrls = new Map(uploadUrlsByRepo);
-  await runWithConcurrency(writeChanges, MAX_CONCURRENT_UPLOADS, async (change) => {
-    const uploadUrl = uploadUrls.get(change.repo.repoId)?.[change.contentHash];
-    if (!uploadUrl) {
-      throw new SandboxPushError(`No upload URL returned for ${change.workspacePath}`, "remote");
-    }
-    const content = await readFile3(change.localPath);
-    const currentHash = createHash3("sha256").update(content).digest("hex");
-    if (content.length !== change.size || currentHash !== change.contentHash) {
-      throw new SandboxPushError(`Local file changed while pushing: ${change.workspacePath}`, "invalid-file");
-    }
-    const upload = await fetch(uploadUrl, {
-      method: "PUT",
-      headers: { "Content-Type": "application/octet-stream" },
-      body: new Uint8Array(content)
-    });
-    if (!upload.ok) {
-      throw new SandboxPushError(`Upload failed [${upload.status}]: ${change.workspacePath}`, "remote");
-    }
-  });
 }
-async function pushChanges(context, repos, changes, message) {
-  const client = new SandboxMoxtClient(context);
-  const changesByRepo = groupChangesByRepo(changes);
-  const response = await client.request(
-    "POST",
-    "/agent/api/pipeline-sandbox/mfs-workspace/unified-push",
-    {
-      message,
-      repoPushes: repos.flatMap((repo) => {
-        const repoChanges = changesByRepo.get(repo.repoId);
-        if (!repoChanges) return [];
-        return [{
-          repoId: repo.repoId,
-          changes: repoChanges.map((change) => {
-            if (change.action === "delete") {
-              return {
-                action: change.action,
-                ...change.fileId ? { fileId: change.fileId } : {},
-                path: change.repoPath
-              };
-            }
-            return {
-              action: change.action,
-              ...change.existing?.fileId ? { fileId: change.existing.fileId } : {},
-              path: change.repoPath,
-              contentHash: change.contentHash,
-              ...change.existing?.sha ? { baseContentHash: change.existing.sha } : {},
-              size: change.size,
-              fileType: MFS_FILE_TYPE_REGULAR2
-            };
-          })
-        }];
-      }),
-      crossRepoMoves: []
-    }
-  );
-  return response.data;
-}
-async function updateCheckoutState(state, changes, reconciledFiles, removedWorkspacePaths, response) {
-  const files = { ...state.files };
-  for (const workspacePath of removedWorkspacePaths) delete files[workspacePath];
-  for (const file of reconciledFiles) {
-    files[file.workspacePath] = checkoutStateFile(
-      file,
-      validFileId(file.remote.fileId),
-      validFileType(file.remote.fileType)
-    );
-  }
-  for (const change of changes) {
-    if (change.action === "delete") {
-      delete files[change.workspacePath];
-      continue;
+function buildQuery(params) {
+  const query = new URLSearchParams();
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0) {
+      query.set(key, String(value));
     }
-    const returnedFileId = validFileId(response?.fileMap?.[change.repo.repoId]?.[change.repoPath]);
-    const fileId = returnedFileId ?? change.existing?.fileId ?? state.files[change.workspacePath]?.fileId ?? null;
-    files[change.workspacePath] = checkoutStateFile(change, validFileId(fileId), validFileType(change.existing?.fileType));
   }
-  await saveCheckoutState({ ...state, files });
-}
-function isWriteChange(change) {
-  return change.action !== "delete";
-}
-function checkoutStateFile(file, fileId, fileType) {
-  return {
-    repoId: file.repo.repoId,
-    repoPath: file.repoPath,
-    fileId,
-    sha: file.contentHash,
-    size: file.size,
-    fileType: fileType ?? MFS_FILE_TYPE_REGULAR2
-  };
+  const text = query.toString();
+  return text ? `?${text}` : "";
 }
-function validFileId(fileId) {
-  return typeof fileId === "string" && fileId.length > 0 ? fileId : null;
+function failResponse(response) {
+  printError(`Error [${response.status}]: ${JSON.stringify(response.data)}`);
+  process.exit(1);
 }
-function validFileType(fileType) {
-  return typeof fileType === "number" && Number.isInteger(fileType) && fileType >= 0 ? fileType : null;
+function priorityLabel(value) {
+  switch (value) {
+    case 0:
+      return "urgent";
+    case 1:
+      return "high";
+    case 2:
+      return "medium";
+    case 3:
+      return "low";
+    default: {
+      const unsupportedValue = value;
+      throw new Error(`Unsupported workflow task priority: ${String(unsupportedValue)}`);
+    }
+  }
+}
+function statusTypeLabel(value) {
+  switch (value) {
+    case 1:
+      return "todo";
+    case 2:
+      return "in-progress";
+    case 3:
+      return "done";
+    default: {
+      const unsupportedValue = value;
+      throw new Error(`Unsupported workflow status type: ${String(unsupportedValue)}`);
+    }
+  }
+}
+function formatAssignee(assignee) {
+  if (!assignee) return "-";
+  if (assignee.type === "human") return assignee.displayName ?? `human:${assignee.humanId}`;
+  if (assignee.type === "assistant") return assignee.displayName ?? `assistant:${assignee.aiAssistantId}`;
+  if (assignee.type === "teammate") return assignee.displayName ?? `teammate:${assignee.aiTeammateId}`;
+  return "unknown";
+}
+function printWorkflow(item) {
+  print(`${colors.bold}${item.fileId}${colors.reset}	owner=${item.ownerHumanId ?? "-"}	desc=${item.desc ?? "-"}`);
+}
+function indentation2(size) {
+  return " ".repeat(size);
+}
+function escapeTerminalControlCharacters2(value) {
+  return value.replace(/\r\n/g, "\n").replace(
+    /[\u0000-\u0008\u000B-\u001F\u007F-\u009F]/g,
+    (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`
+  );
 }
-function groupChangesByRepo(changes) {
-  const result = /* @__PURE__ */ new Map();
-  for (const change of changes) {
-    const repoChanges = result.get(change.repo.repoId) ?? [];
-    repoChanges.push(change);
-    result.set(change.repo.repoId, repoChanges);
+function formatDetailScalar2(value) {
+  if (value === null) return "null";
+  if (typeof value === "string") {
+    const escaped = escapeTerminalControlCharacters2(value);
+    if (escaped === "") return '""';
+    if (/\n/.test(escaped)) return JSON.stringify(escaped);
+    return escaped;
   }
-  return result;
+  return String(value);
 }
-function remoteEntryKey(repoId, repoPath) {
-  return `${repoId}\0${repoPath}`;
+function printDetailField2(name, value, indent = 0) {
+  print(`${indentation2(indent)}${name}: ${formatDetailScalar2(value)}`);
 }
-function assertSafePathPart(part, workspacePath) {
-  if (part === "." || part === ".." || part.includes("/") || part.includes("\\") || part.includes("\0")) {
-    throw new SandboxPushError(`Local path is unsafe: ${workspacePath}`, "invalid-path");
+function printDetailTextField2(name, value, indent = 0) {
+  if (value === null || value === "") {
+    printDetailField2(name, value, indent);
+    return;
   }
-}
-function assertSafeRepoName(sourceDir, repoName) {
-  resolveSafeRepoRoot(sourceDir, repoName);
-}
-function resolveSafeRepoRoot(sourceDir, repoName) {
-  assertSafePathPart(repoName, repoName);
-  const repoRoot = resolve2(sourceDir, repoName);
-  const relativePath = relative2(sourceDir, repoRoot);
-  if (relativePath.startsWith("..") || isAbsolute4(relativePath)) {
-    throw new SandboxPushError(`Repo path escapes local workspace: ${repoName}`, "invalid-path");
+  const escaped = escapeTerminalControlCharacters2(value);
+  print(`${indentation2(indent)}${name}:`);
+  for (const line of escaped.split("\n")) {
+    print(`${indentation2(indent + 2)}${line}`);
   }
-  return repoRoot;
 }
-function isNodeError3(error) {
-  return error instanceof Error && "code" in error;
+function printAssigneeDetail(name, assignee, indent = 0) {
+  if (assignee === null) {
+    printDetailField2(name, null, indent);
+    return;
+  }
+  print(`${indentation2(indent)}${name}:`);
+  printDetailField2("type", assignee.type, indent + 2);
+  switch (assignee.type) {
+    case "human":
+      printDetailField2("humanId", assignee.humanId, indent + 2);
+      printDetailField2("displayName", assignee.displayName, indent + 2);
+      printDetailField2("avatarUrl", assignee.avatarUrl, indent + 2);
+      return;
+    case "assistant":
+      printDetailField2("aiAssistantId", assignee.aiAssistantId, indent + 2);
+      printDetailField2("displayName", assignee.displayName, indent + 2);
+      printDetailField2("avatarUrl", assignee.avatarUrl, indent + 2);
+      return;
+    case "teammate":
+      printDetailField2("aiTeammateId", assignee.aiTeammateId, indent + 2);
+      printDetailField2("displayName", assignee.displayName, indent + 2);
+      printDetailField2("avatarUrl", assignee.avatarUrl, indent + 2);
+      return;
+    case "unknown":
+      printDetailField2("humanId", assignee.humanId, indent + 2);
+      printDetailField2("aiAssistantId", assignee.aiAssistantId, indent + 2);
+      printDetailField2("aiTeammateId", assignee.aiTeammateId, indent + 2);
+  }
+}
+function printStatusRemainingFields(item, indent) {
+  printDetailField2("name", item.name, indent);
+  printDetailTextField2("desc", item.desc, indent);
+  printDetailField2("type", `${item.type} (${statusTypeLabel(item.type)})`, indent);
+  printAssigneeDetail("preferredAssignee", item.preferredAssignee, indent);
+  printDetailField2("order", item.order, indent);
+}
+function printStatusDetail(item) {
+  print(`${colors.bold}Status${colors.reset}`);
+  printDetailField2("scopedId", item.scopedId);
+  printStatusRemainingFields(item, 0);
+}
+function printWorkflowDetail(item) {
+  print(`${colors.bold}Workflow${colors.reset}`);
+  printDetailField2("fileId", item.fileId);
+  printDetailField2("ownerHumanId", item.ownerHumanId);
+  printDetailTextField2("desc", item.desc);
+  if (item.statusList.length === 0) {
+    print("statusList: []");
+  } else {
+    print("statusList:");
+    for (const status of item.statusList) {
+      print(`  - scopedId: ${status.scopedId}`);
+      printStatusRemainingFields(status, 4);
+    }
+  }
+  if (item.transitions.length === 0) {
+    print("transitions: []");
+  } else {
+    print("transitions:");
+    for (const transition of item.transitions) {
+      print(`  - statusFromScopedId: ${transition.statusFromScopedId}`);
+      printDetailField2("statusToScopedId", transition.statusToScopedId, 4);
+    }
+  }
+}
+function printTaskSummary(item) {
+  const runIds = item.agentRuns.map((run) => run.pipelineTriggerId).join(",") || "-";
+  print(
+    `${colors.bold}#${item.scopedId}${colors.reset}	${item.title}	status=${item.statusScopedId}	priority=${priorityLabel(item.priority)}	assignee=${formatAssignee(item.assignee)}	runs=${runIds}`
+  );
 }
-
-// src/commands/push.ts
-function registerPushCommand(program2) {
-  program2.command("push").description("Push local workspace files to the sandbox workspace").argument("[dir]", "Local workspace directory", ".").option("-m, --message <message>", "Push message", "moxt push").action(async (sourceDir, options) => {
-    const context = resolveSandboxRuntimeContextOrExit3();
-    try {
-      const result = await pushSandboxWorkspace(context, sourceDir, { message: options.message });
-      for (const change of result.changes) {
-        print(`${change.action} ${change.workspacePath}`);
-      }
-      if (result.changes.length === 0) {
-        print("No changes to push");
-        return;
-      }
-      const fileLabel = result.changes.length === 1 ? "file" : "files";
-      print(`Pushed ${result.changes.length} ${fileLabel} from ${result.sourceDir}`);
-    } catch (error) {
-      handlePushError(error);
+function printTaskDetail(item) {
+  print(`${colors.bold}Task${colors.reset}`);
+  printDetailField2("scopedId", item.scopedId);
+  printDetailField2("workflowFileId", item.workflowFileId);
+  printDetailField2("ownerHumanId", item.ownerHumanId);
+  printDetailField2("title", item.title);
+  printDetailTextField2("desc", item.desc);
+  printDetailField2("statusScopedId", item.statusScopedId);
+  printDetailField2("priority", `${item.priority} (${priorityLabel(item.priority)})`);
+  printAssigneeDetail("assignee", item.assignee);
+  if (item.linkedFileIds.length === 0) {
+    print("linkedFileIds: []");
+  } else {
+    print("linkedFileIds:");
+    for (const fileId of item.linkedFileIds) print(`  - ${fileId}`);
+  }
+  printDetailField2("subscribed", item.subscribed);
+  if (item.agentRuns.length === 0) {
+    print("agentRuns: []");
+  } else {
+    print("agentRuns:");
+    for (const run of item.agentRuns) {
+      print(`  - pipelineTriggerId: ${run.pipelineTriggerId}`);
+      printAssigneeDetail("executor", run.executor, 4);
+    }
+  }
+  printDetailField2("createdAt", item.createdAt);
+  printDetailField2("latestActAt", item.latestActAt);
+}
+function printCommentDetail(item) {
+  print(`${colors.bold}Comment${colors.reset}`);
+  printDetailField2("id", item.id);
+  printDetailField2("workflowFileId", item.workflowFileId);
+  printDetailField2("workflowTaskScopedId", item.workflowTaskScopedId);
+  printDetailTextField2("content", item.content);
+  printAssigneeDetail("createdBy", item.createdBy);
+  printDetailField2("createdAt", item.createdAt);
+  printDetailField2("updatedAt", item.updatedAt);
+}
+function registerWorkflowCommand(program2) {
+  const workflow = program2.command("workflow").description("Workflow operations");
+  addWorkspaceOption(
+    workflow.command("list").description("List accessible workflows").option("--scope <scope>", "Workflow scope: all or owner_is_me", "all")
+  ).action(async (options) => {
+    const scope = runOrExit4(() => parseWorkflowScope(options.scope));
+    startSpinner("Fetching workflows...");
+    const response = await httpGet(
+      `/workspaces/${options.workspace}/workflows${buildQuery({ scope })}`
+    );
+    if (!response.ok) {
+      stopSpinner(false, "Failed");
+      failResponse(response);
     }
-  });
-}
-function resolveSandboxRuntimeContextOrExit3() {
-  let context;
-  try {
-    context = resolveRuntimeContext();
-  } catch (error) {
-    if (error instanceof RuntimeContextError) {
-      printError(error.message);
-      process.exit(1);
+    if (response.data.workflows.length === 0) {
+      stopSpinner(true, "No workflows found.");
+      return;
     }
-    throw error;
-  }
-  if (context.mode !== "sandbox") {
-    printError("moxt push is only available in sandbox mode");
-    process.exit(1);
-  }
-  return context;
-}
-function handlePushError(error) {
-  if (error instanceof Error) {
-    printError(error.message);
-    process.exit(1);
-  }
-  throw error;
-}
-
-// src/utils/checkout-status.ts
-import { createHash as createHash4 } from "crypto";
-import { createReadStream } from "fs";
-import { lstat as lstat3, readdir as readdir2 } from "fs/promises";
-import { join as join3 } from "path";
-var CheckoutStatusError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "CheckoutStatusError";
-  }
-};
-async function inspectCheckoutStatus(state) {
-  await requireCheckoutDirectory(state.checkoutRoot);
-  const localFiles = /* @__PURE__ */ new Map();
-  for (const repo of Object.values(state.repos)) {
-    await scanDirectory(state, repo.name, join3(state.checkoutRoot, repo.name), localFiles);
-  }
-  const changes = [];
-  for (const [path2, sha] of localFiles) {
-    const baseline = state.files[path2];
-    if (!baseline) changes.push({ action: "added", path: path2 });
-    else if (baseline.sha !== sha) changes.push({ action: "modified", path: path2 });
-  }
-  for (const path2 of Object.keys(state.files)) {
-    if (isCheckoutPathIncluded(state, path2) && !localFiles.has(path2)) changes.push({ action: "deleted", path: path2 });
-  }
-  return changes.sort((left, right) => left.path.localeCompare(right.path));
-}
-async function requireCheckoutDirectory(checkoutRoot) {
-  let stats;
-  try {
-    stats = await lstat3(checkoutRoot);
-  } catch (error) {
-    throw new CheckoutStatusError(`Checkout root is not available: ${errorMessage2(error)}`);
-  }
-  if (stats.isSymbolicLink()) throw new CheckoutStatusError(`Refusing to inspect symbolic link: ${checkoutRoot}`);
-  if (!stats.isDirectory()) throw new CheckoutStatusError(`Checkout root is not a directory: ${checkoutRoot}`);
-}
-async function scanDirectory(state, workspacePath, localPath, files) {
-  let entries;
-  try {
-    entries = await readdir2(localPath, { withFileTypes: true });
-  } catch (error) {
-    if (isNodeError4(error) && error.code === "ENOENT") return;
-    throw new CheckoutStatusError(`Failed to inspect ${workspacePath}: ${errorMessage2(error)}`);
-  }
-  for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
-    if (entry.name === ".git") continue;
-    const childWorkspacePath = `${workspacePath}/${entry.name}`;
-    if (!doesCheckoutPathIntersect(state, childWorkspacePath)) continue;
-    const childLocalPath = join3(localPath, entry.name);
-    const stats = await lstat3(childLocalPath);
-    if (stats.isSymbolicLink()) {
-      throw new CheckoutStatusError(`Refusing to inspect symbolic link: ${childWorkspacePath}`);
+    stopSpinner(true, `Found ${response.data.workflows.length} workflow(s)`);
+    for (const item of response.data.workflows) printWorkflow(item);
+  });
+  addSpaceOptions2(
+    workflow.command("create").description("Create a blank workflow").requiredOption("-p, --path <path>", "Target .workflow path").option("--desc-file <localPath>", "Local UTF-8 text file for workflow description").option("--owner-human-id <humanId>", "Workflow owner human ID")
+  ).action(async (options) => {
+    const body = runOrExit4(() => {
+      const next = {
+        path: options.path,
+        ...resolveSpaceSelector(options)
+      };
+      const desc = readDescFile(options.descFile);
+      if (desc !== void 0) next.desc = desc;
+      const ownerHumanId = parseOptionalPositiveInteger(options.ownerHumanId, "--owner-human-id");
+      if (ownerHumanId !== void 0) next.ownerHumanId = ownerHumanId;
+      return next;
+    });
+    startSpinner("Creating workflow...");
+    const response = await httpPost(`/workspaces/${options.workspace}/workflows`, body);
+    if (!response.ok) {
+      stopSpinner(false, "Failed");
+      failResponse(response);
     }
-    if (stats.isDirectory()) {
-      await scanDirectory(state, childWorkspacePath, childLocalPath, files);
-    } else if (stats.isFile() && isCheckoutPathIncluded(state, childWorkspacePath)) {
-      files.set(childWorkspacePath, await hashFile(childLocalPath));
+    stopSpinner(true, "Workflow created");
+    printWorkflow(response.data);
+  });
+  addWorkspaceOption(workflow.command("get").description("Get a workflow").argument("<workflowFileId>")).action(
+    async (workflowFileId, options) => {
+      startSpinner("Fetching workflow...");
+      const response = await httpGet(
+        `/workspaces/${options.workspace}/workflows/${workflowFileId}`
+      );
+      if (!response.ok) {
+        stopSpinner(false, "Failed");
+        failResponse(response);
+      }
+      stopSpinner(true, "Workflow fetched");
+      printWorkflowDetail(response.data);
     }
-  }
-}
-async function hashFile(path2) {
-  const hash = createHash4("sha256");
-  const stream = createReadStream(path2);
-  for await (const chunk of stream) hash.update(chunk);
-  return hash.digest("hex");
-}
-function isNodeError4(error) {
-  return error instanceof Error && "code" in error;
-}
-function errorMessage2(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-
-// src/commands/status.ts
-function registerStatusCommand(program2) {
-  program2.command("status").description("Show Moxt workspace checkout status").option("--json", "Print machine-readable status").action(async (options) => {
-    const context = resolveRuntimeContextOrExit2();
-    if (context.mode !== "sandbox") {
-      printError("moxt status is only available in sandbox mode");
-      process.exit(1);
+  );
+  addWorkspaceOption(
+    workflow.command("update").description("Update workflow metadata").argument("<workflowFileId>").option("--desc-file <localPath>", "Local UTF-8 text file for workflow description").option("--owner-human-id <humanId>", "Workflow owner human ID")
+  ).action(async (workflowFileId, options) => {
+    const body = runOrExit4(() => {
+      const next = {};
+      const desc = readDescFile(options.descFile);
+      if (desc !== void 0) next.desc = desc;
+      const ownerHumanId = parseOptionalPositiveInteger(options.ownerHumanId, "--owner-human-id");
+      if (ownerHumanId !== void 0) next.ownerHumanId = ownerHumanId;
+      assertNonEmptyBody(next);
+      return next;
+    });
+    startSpinner("Updating workflow...");
+    const response = await httpPatch(`/workspaces/${options.workspace}/workflows/${workflowFileId}`, body);
+    if (!response.ok) {
+      stopSpinner(false, "Failed");
+      failResponse(response);
     }
-    const status = await buildSandboxStatusOrExit(context);
-    if (options.json) {
-      print(JSON.stringify(status, null, 2));
-      return;
+    stopSpinner(true, "Workflow updated");
+    printWorkflow(response.data);
+  });
+  addWorkspaceOption(
+    workflow.command("delete").description("Delete a workflow").argument("<workflowFileId>").option("--message <message>", "Commit message")
+  ).action(async (workflowFileId, options) => {
+    startSpinner("Deleting workflow...");
+    const response = await httpDelete(
+      `/workspaces/${options.workspace}/workflows/${workflowFileId}`,
+      options.message ? { message: options.message } : {}
+    );
+    if (!response.ok) {
+      stopSpinner(false, "Failed");
+      failResponse(response);
     }
-    print(`${colors.bold}Workspace${colors.reset}: ${status.workspaceId}`);
-    print(`${colors.bold}Mode${colors.reset}: sandbox`);
-    print(`${colors.bold}Checkout${colors.reset}: ${formatCheckoutMode(status.checkout.mode)}`);
-    if (status.checkout.mode !== "not_initialized") {
-      print(`${colors.bold}Root${colors.reset}: ${status.checkout.root}`);
-    }
-    print("");
-    print(`${colors.bold}Repos${colors.reset}:`);
-    const repoNameWidth = status.repos.reduce((width, repo) => Math.max(width, repo.name.length), 0);
-    for (const repo of status.repos) {
-      print(`  ${repo.name.padEnd(repoNameWidth)}  ${repo.repoId}`);
-    }
-    print("");
-    if (status.checkout.mode === "not_initialized") {
-      print(`${colors.bold}Checked out scopes${colors.reset}: none`);
-      print(`${colors.bold}Local changes${colors.reset}: not tracked`);
-      return;
+    stopSpinner(true, `Deleted: ${response.data.fileId}`);
+  });
+  addWorkspaceOption(workflow.command("duplicate").description("Duplicate a workflow").argument("<workflowFileId>")).action(
+    async (workflowFileId, options) => {
+      startSpinner("Duplicating workflow...");
+      const response = await httpPost(
+        `/workspaces/${options.workspace}/workflows/${workflowFileId}/duplicate`,
+        {}
+      );
+      if (!response.ok) {
+        stopSpinner(false, "Failed");
+        failResponse(response);
+      }
+      stopSpinner(true, "Workflow duplicated");
+      printWorkflow(response.data);
     }
-    print(`${colors.bold}Checked out scopes${colors.reset}:`);
-    for (const scope of status.checkout.checkedOutScopes) print(`  ${scope}`);
-    print(`${colors.bold}Local changes${colors.reset}:${status.checkout.changes.length === 0 ? " none" : ""}`);
-    for (const change of status.checkout.changes) {
-      print(`  ${change.action.padEnd(8)}  ${change.path}`);
+  );
+  registerStatusCommands(workflow);
+  registerTransitionCommands(workflow);
+  registerTaskCommands(workflow);
+  registerCommentCommands(workflow);
+  registerRunCommands(workflow);
+}
+function registerStatusCommands(workflow) {
+  const status = workflow.command("status").description("Workflow status operations");
+  addPreferredAssigneeOptions(
+    addWorkspaceOption(
+      status.command("create").description("Create a workflow status").argument("<workflowFileId>").requiredOption("--name <name>", "Status name").requiredOption("--type <type>", "Status type value: 1=todo, 2=in-progress, 3=done").option("--desc-file <localPath>", "Local UTF-8 text file for status description")
+    )
+  ).action(
+    async (workflowFileId, options) => {
+      const body = runOrExit4(() => {
+        const next = {
+          name: options.name,
+          type: parseRequiredStatusType(options.type)
+        };
+        const desc = readDescFile(options.descFile);
+        if (desc !== void 0) next.desc = desc;
+        Object.assign(next, parsePreferredAssigneeBody(options));
+        return next;
+      });
+      startSpinner("Creating status...");
+      const response = await httpPost(
+        `/workspaces/${options.workspace}/workflows/${workflowFileId}/statuses`,
+        body
+      );
+      if (!response.ok) {
+        stopSpinner(false, "Failed");
+        failResponse(response);
+      }
+      stopSpinner(true, "Status created");
+      printStatusDetail(response.data);
     }
-  });
-}
-async function buildSandboxStatusOrExit(context) {
-  const repos = listRepoEntries(context.repoPayload).map((repo) => ({
-    name: repo.name,
-    repoId: repo.repoId
-  }));
-  try {
-    const state = await loadCheckoutState();
-    if (!state) return buildUninitializedStatus(context.workspaceId, repos);
-    validateStateContext(state, context);
-    return {
-      mode: "sandbox",
-      workspaceId: context.workspaceId,
-      checkout: {
-        mode: state.mode,
-        root: state.checkoutRoot,
-        checkedOutScopes: state.checkedOutScopes,
-        localChangesTracked: true,
-        changes: await inspectCheckoutStatus(state)
-      },
-      repos
-    };
-  } catch (error) {
-    printError(error instanceof Error ? error.message : String(error));
-    process.exit(1);
-  }
-}
-function buildUninitializedStatus(workspaceId, repos) {
-  return {
-    mode: "sandbox",
-    workspaceId,
-    checkout: {
-      mode: "not_initialized",
-      checkedOutScopes: [],
-      localChangesTracked: false
-    },
-    repos
-  };
-}
-function validateStateContext(state, context) {
-  if (state.workspaceId !== context.workspaceId) {
-    throw new Error(`Checkout state belongs to workspace ${state.workspaceId}, not ${context.workspaceId}`);
-  }
-  const currentRepos = new Map(listRepoEntries(context.repoPayload).map((repo) => [repo.repoId, repo.name]));
-  for (const [repoId, repo] of Object.entries(state.repos)) {
-    const currentName = currentRepos.get(repoId);
-    if (!currentName) throw new Error(`Checkout state contains unknown repo: ${repoId}`);
-    if (currentName !== repo.name) {
-      throw new Error(`Checkout state repo name does not match current workspace: ${repo.name}`);
+  );
+  addPreferredAssigneeOptions(
+    addWorkspaceOption(
+      status.command("update").description("Update a workflow status").argument("<workflowFileId>").argument("<statusScopedId>").option("--name <name>", "Status name").option("--type <type>", "Status type value: 1=todo, 2=in-progress, 3=done").option("--desc-file <localPath>", "Local UTF-8 text file for status description").option("--clear-desc", "Clear status description").option("--clear-preferred-assignee", "Clear preferred assignee")
+    )
+  ).action(
+    async (workflowFileId, statusScopedId, options) => {
+      const body = runOrExit4(() => {
+        if (options.descFile && options.clearDesc) {
+          throw new WorkflowOptionsError("Error: --desc-file cannot be used with --clear-desc.");
+        }
+        const next = {};
+        if (options.name) next.name = options.name;
+        const type = parseStatusType(options.type);
+        if (type !== void 0) next.type = type;
+        const desc = readDescFile(options.descFile);
+        if (desc !== void 0) next.desc = desc;
+        if (options.clearDesc) next.desc = null;
+        Object.assign(next, parsePreferredAssigneeBody(options));
+        assertNonEmptyBody(next);
+        return next;
+      });
+      const id = runOrExit4(() => parsePositiveInteger(statusScopedId, "statusScopedId"));
+      startSpinner("Updating status...");
+      const response = await httpPatch(
+        `/workspaces/${options.workspace}/workflows/${workflowFileId}/statuses/${id}`,
+        body
+      );
+      if (!response.ok) {
+        stopSpinner(false, "Failed");
+        failResponse(response);
+      }
+      stopSpinner(true, "Status updated");
+      printStatusDetail(response.data);
     }
-  }
-}
-function resolveRuntimeContextOrExit2() {
-  try {
-    return resolveRuntimeContext();
-  } catch (error) {
-    if (error instanceof RuntimeContextError) {
-      printError(error.message);
-      process.exit(1);
+  );
+  addWorkspaceOption(
+    status.command("move-after").description("Move a workflow status after another status").argument("<workflowFileId>").argument("<statusScopedId>").option("--after <statusScopedId>", "Anchor status scoped ID").option("--first", "Move to first position")
+  ).action(
+    async (workflowFileId, statusScopedId, options) => {
+      const { id, anchoredStatusScopedId } = runOrExit4(() => {
+        if (options.after && options.first) {
+          throw new WorkflowOptionsError("Error: --after cannot be used with --first.");
+        }
+        if (!options.after && !options.first) {
+          throw new WorkflowOptionsError("Error: either --after or --first is required.");
+        }
+        return {
+          id: parsePositiveInteger(statusScopedId, "statusScopedId"),
+          anchoredStatusScopedId: options.first ? null : parsePositiveInteger(options.after, "--after")
+        };
+      });
+      startSpinner("Moving status...");
+      const response = await httpPost(
+        `/workspaces/${options.workspace}/workflows/${workflowFileId}/statuses/${id}/move-after`,
+        { anchoredStatusScopedId }
+      );
+      if (!response.ok) {
+        stopSpinner(false, "Failed");
+        failResponse(response);
+      }
+      stopSpinner(true, "Status moved");
     }
-    throw error;
-  }
-}
-function formatCheckoutMode(mode) {
-  return mode === "not_initialized" ? "not initialized" : `${mode} checkout`;
-}
-
-// src/telemetry/config.ts
-import * as fs3 from "fs";
-import * as os from "os";
-import * as path from "path";
-function getConfigPath() {
-  return path.join(os.homedir(), ".moxt", "config.json");
-}
-function readTelemetryConfig() {
-  try {
-    const raw = fs3.readFileSync(getConfigPath(), "utf8");
-    const parsed = JSON.parse(raw);
-    return parsed.telemetry ?? {};
-  } catch {
-    return {};
-  }
-}
-function writeTelemetryConfig(update) {
-  const configPath = getConfigPath();
-  let existing = {};
-  try {
-    existing = JSON.parse(fs3.readFileSync(configPath, "utf8"));
-  } catch {
-    existing = {};
-  }
-  const currentTelemetry = existing.telemetry ?? {};
-  const next = { ...existing, telemetry: { ...currentTelemetry, ...update } };
-  fs3.mkdirSync(path.dirname(configPath), { recursive: true });
-  fs3.writeFileSync(configPath, JSON.stringify(next, null, 2));
-}
-
-// src/telemetry/opt-out.ts
-function isCiEnvironment() {
-  return process.env.CI === "true" || process.env.CI === "1";
+  );
+  addWorkspaceOption(
+    status.command("delete").description("Delete a workflow status").argument("<workflowFileId>").argument("<statusScopedId>")
+  ).action(async (workflowFileId, statusScopedId, options) => {
+    const id = runOrExit4(() => parsePositiveInteger(statusScopedId, "statusScopedId"));
+    startSpinner("Deleting status...");
+    const response = await httpDelete(
+      `/workspaces/${options.workspace}/workflows/${workflowFileId}/statuses/${id}`
+    );
+    if (!response.ok) {
+      stopSpinner(false, "Failed");
+      failResponse(response);
+    }
+    stopSpinner(true, `Deleted: ${response.data.scopedId}`);
+  });
 }
-function isTelemetryDisabled() {
-  if (process.env.MOXT_TELEMETRY_DISABLED === "1" || process.env.MOXT_TELEMETRY_DISABLED === "true") {
-    return true;
-  }
-  if (process.env.DO_NOT_TRACK === "1" || process.env.DO_NOT_TRACK === "true") {
-    return true;
+function registerTransitionCommands(workflow) {
+  const transition = workflow.command("transition").description("Workflow transition operations");
+  for (const action of ["create", "delete"]) {
+    addWorkspaceOption(
+      transition.command(action).description(`${action === "create" ? "Create" : "Delete"} a workflow transition`).argument("<workflowFileId>").requiredOption("--from <statusScopedId>", "Source status scoped ID").requiredOption("--to <statusScopedId>", "Target status scoped ID")
+    ).action(async (workflowFileId, options) => {
+      const body = runOrExit4(() => ({
+        statusFromScopedId: parsePositiveInteger(options.from, "--from"),
+        statusToScopedId: parsePositiveInteger(options.to, "--to")
+      }));
+      startSpinner(`${action === "create" ? "Creating" : "Deleting"} transition...`);
+      const response = action === "create" ? await httpPost(
+        `/workspaces/${options.workspace}/workflows/${workflowFileId}/transitions`,
+        body
+      ) : await httpDelete(
+        `/workspaces/${options.workspace}/workflows/${workflowFileId}/transitions`,
+        body
+      );
+      if (!response.ok) {
+        stopSpinner(false, "Failed");
+        failResponse(response);
+      }
+      stopSpinner(true, action === "create" ? "Transition created" : "Transition deleted");
+      print(`${response.data.statusFromScopedId} -> ${response.data.statusToScopedId}`);
+    });
   }
-  return readTelemetryConfig().disabled === true;
 }
-
-// src/commands/telemetry.ts
-function registerTelemetryCommand(program2) {
-  const telemetry = program2.command("telemetry").description("Manage Moxt CLI telemetry");
-  telemetry.command("status").description("Show telemetry status").action(() => {
-    const cfg = readTelemetryConfig();
-    const envOverride = process.env.MOXT_TELEMETRY_DISABLED === "1" || process.env.MOXT_TELEMETRY_DISABLED === "true" || process.env.DO_NOT_TRACK === "1" || process.env.DO_NOT_TRACK === "true";
-    const state = isTelemetryDisabled() ? "disabled" : "enabled";
-    print(`telemetry: ${state}`);
-    if (envOverride) {
-      print("(disabled via environment variable)");
-    } else if (cfg.disabled) {
-      print("(disabled via config file)");
+function registerTaskCommands(workflow) {
+  const task = workflow.command("task").description("Workflow task operations");
+  addWorkspaceOption(
+    task.command("list").description("List workflow tasks").option("--workflow-file-id <workflowFileId>", "Filter by workflow file ID").option("--scope <scope>", "Task scope", "all").option("-l, --limit <limit>", "Maximum number of tasks to return", "20").option("--cursor <cursor>", "Pagination cursor")
+  ).action(
+    async (options) => {
+      const query = runOrExit4(() => buildQuery({
+        scope: parseTaskScope(options.scope),
+        limit: parseSearchLimit(options.limit, 20, 100),
+        cursor: options.cursor,
+        workflowFileId: options.workflowFileId
+      }));
+      startSpinner("Fetching workflow tasks...");
+      const response = await httpGet(`/workspaces/${options.workspace}/workflow-tasks${query}`);
+      if (!response.ok) {
+        stopSpinner(false, "Failed");
+        failResponse(response);
+      }
+      if (response.data.tasks.length === 0) {
+        stopSpinner(true, "No workflow tasks found.");
+        return;
+      }
+      stopSpinner(true, `Found ${response.data.tasks.length} task(s)`);
+      for (const item of response.data.tasks) printTaskSummary(item);
+      if (response.data.nextCursor) print(`${colors.dim}nextCursor=${response.data.nextCursor}${colors.reset}`);
     }
-  });
-  telemetry.command("enable").description("Enable telemetry").action(() => {
-    writeTelemetryConfig({ disabled: false });
-    print("telemetry: enabled");
-  });
-  telemetry.command("disable").description("Disable telemetry").action(() => {
-    writeTelemetryConfig({ disabled: true });
-    print("telemetry: disabled");
-  });
-}
-
-// src/commands/whoami.ts
-function registerWhoamiCommand(program2) {
-  program2.command("whoami").description("Show current user information").action(async () => {
-    startSpinner("Fetching user info...");
-    const response = await httpGet("/users/whoami");
-    if (response.ok) {
-      stopSpinner(true, "Done");
-      print(`${colors.bold}Nickname${colors.reset}: ${response.data.nickname}`);
-      print(`${colors.bold}Email${colors.reset}: ${response.data.email}`);
-    } else {
+  );
+  addWorkspaceOption(
+    task.command("get").description("Get a workflow task").argument("<workflowFileId>").argument("<taskScopedId>")
+  ).action(async (workflowFileId, taskScopedId, options) => {
+    const id = runOrExit4(() => parsePositiveInteger(taskScopedId, "taskScopedId"));
+    startSpinner("Fetching task...");
+    const response = await httpGet(
+      `/workspaces/${options.workspace}/workflows/${workflowFileId}/tasks/${id}`
+    );
+    if (!response.ok) {
       stopSpinner(false, "Failed");
-      printError(`Error [${response.status}]: ${JSON.stringify(response.data)}`);
-      process.exit(1);
+      failResponse(response);
     }
+    stopSpinner(true, "Task fetched");
+    printTaskDetail(response.data);
   });
-}
-
-// src/commands/workspace.ts
-var emailRegex = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;
-function isValidEmail(email) {
-  return emailRegex.test(email);
-}
-function registerWorkspaceCommand(program2) {
-  const workspace = program2.command("workspace").description("Workspace management");
-  workspace.command("list").description("List all workspaces you belong to").action(async () => {
-    startSpinner("Fetching workspaces...");
-    const response = await httpGet("/workspaces");
-    if (response.ok) {
-      const { workspaces } = response.data;
-      if (workspaces.length === 0) {
-        stopSpinner(true, "No workspaces found.");
-        return;
+  addAssigneeOptions(
+    addWorkspaceOption(
+      task.command("create").description("Create a workflow task").argument("<workflowFileId>").requiredOption("--title <title>", "Task title").requiredOption("--status <statusScopedId>", "Status scoped ID").option("--priority <priority>", "Priority: urgent, high, medium, or low", "medium").option("--desc-file <localPath>", "Local UTF-8 text file for task description").option("--owner-human-id <humanId>", "Task owner human ID")
+    )
+  ).action(
+    async (workflowFileId, options) => {
+      const body = runOrExit4(() => {
+        const next = {
+          title: options.title,
+          statusScopedId: parsePositiveInteger(options.status, "--status"),
+          priority: parseRequiredPriority(options.priority)
+        };
+        const desc = readDescFile(options.descFile);
+        if (desc !== void 0) next.desc = desc;
+        const ownerHumanId = parseOptionalPositiveInteger(options.ownerHumanId, "--owner-human-id");
+        if (ownerHumanId !== void 0) next.ownerHumanId = ownerHumanId;
+        Object.assign(next, parseAssigneeBody(options, false));
+        return next;
+      });
+      startSpinner("Creating task...");
+      const response = await httpPost(
+        `/workspaces/${options.workspace}/workflows/${workflowFileId}/tasks`,
+        body
+      );
+      if (!response.ok) {
+        stopSpinner(false, "Failed");
+        failResponse(response);
       }
-      stopSpinner(true, `Found ${workspaces.length} workspace(s)`);
-      for (const ws of workspaces) {
-        print(`${colors.bold}${ws.workspaceId}${colors.reset}	${ws.name}`);
+      stopSpinner(true, "Task created");
+      printTaskDetail(response.data);
+    }
+  );
+  addWorkspaceOption(
+    task.command("update").description("Update workflow task metadata").argument("<workflowFileId>").argument("<taskScopedId>").option("--title <title>", "Task title").option("--priority <priority>", "Priority: urgent, high, medium, or low").option("--desc-file <localPath>", "Local UTF-8 text file for task description").option("--clear-desc", "Clear task description").option("--owner-human-id <humanId>", "Task owner human ID")
+  ).action(
+    async (workflowFileId, taskScopedId, options) => {
+      const body = runOrExit4(() => {
+        if (options.descFile && options.clearDesc) {
+          throw new WorkflowOptionsError("Error: --desc-file cannot be used with --clear-desc.");
+        }
+        const next = {};
+        if (options.title) next.title = options.title;
+        const priority = parsePriority(options.priority);
+        if (priority !== void 0) next.priority = priority;
+        const desc = readDescFile(options.descFile);
+        if (desc !== void 0) next.desc = desc;
+        if (options.clearDesc) next.desc = null;
+        const ownerHumanId = parseOptionalPositiveInteger(options.ownerHumanId, "--owner-human-id");
+        if (ownerHumanId !== void 0) next.ownerHumanId = ownerHumanId;
+        assertNonEmptyBody(next);
+        return next;
+      });
+      const id = runOrExit4(() => parsePositiveInteger(taskScopedId, "taskScopedId"));
+      startSpinner("Updating task...");
+      const response = await httpPatch(
+        `/workspaces/${options.workspace}/workflows/${workflowFileId}/tasks/${id}/metadata`,
+        body
+      );
+      if (!response.ok) {
+        stopSpinner(false, "Failed");
+        failResponse(response);
       }
-    } else {
+      stopSpinner(true, "Task updated");
+      printTaskDetail(response.data);
+    }
+  );
+  for (const action of ["add-linked-files", "remove-linked-files"]) {
+    addWorkspaceOption(
+      task.command(action).description(`${action === "add-linked-files" ? "Add" : "Remove"} linked files on a workflow task`).argument("<workflowFileId>").argument("<taskScopedId>").requiredOption("--file-ids <ids>", "Comma-separated file IDs")
+    ).action(
+      async (workflowFileId, taskScopedId, options) => {
+        const { id, fileIds } = runOrExit4(() => ({
+          id: parsePositiveInteger(taskScopedId, "taskScopedId"),
+          fileIds: parseFileIds(options.fileIds, "--file-ids")
+        }));
+        startSpinner(action === "add-linked-files" ? "Adding linked files..." : "Removing linked files...");
+        const path2 = `/workspaces/${options.workspace}/workflows/${workflowFileId}/tasks/${id}/linked-files`;
+        const response = action === "add-linked-files" ? await httpPost(path2, { fileIds }) : await httpDelete(path2, { fileIds });
+        if (!response.ok) {
+          stopSpinner(false, "Failed");
+          failResponse(response);
+        }
+        stopSpinner(true, action === "add-linked-files" ? "Linked files added" : "Linked files removed");
+        printTaskDetail(response.data);
+      }
+    );
+  }
+  addWorkspaceOption(
+    task.command("move").description("Move a workflow task to another status").argument("<workflowFileId>").argument("<taskScopedId>").requiredOption("--status <statusScopedId>", "Target status scoped ID")
+  ).action(
+    async (workflowFileId, taskScopedId, options) => {
+      const { id, statusScopedId } = runOrExit4(() => ({
+        id: parsePositiveInteger(taskScopedId, "taskScopedId"),
+        statusScopedId: parsePositiveInteger(options.status, "--status")
+      }));
+      startSpinner("Moving task...");
+      const response = await httpPatch(
+        `/workspaces/${options.workspace}/workflows/${workflowFileId}/tasks/${id}/status`,
+        { statusScopedId }
+      );
+      if (!response.ok) {
+        stopSpinner(false, "Failed");
+        failResponse(response);
+      }
+      stopSpinner(true, "Task moved");
+      printTaskDetail(response.data);
+    }
+  );
+  addAssigneeOptions(
+    addWorkspaceOption(
+      task.command("assign").description("Update workflow task assignee").argument("<workflowFileId>").argument("<taskScopedId>").option("--clear", "Clear assignee")
+    )
+  ).action(
+    async (workflowFileId, taskScopedId, options) => {
+      const body = runOrExit4(() => {
+        const next = parseAssigneeBody(options, true);
+        if (Object.keys(next).length === 0 && options.clear !== true) assertNonEmptyBody(next);
+        return next;
+      });
+      const id = runOrExit4(() => parsePositiveInteger(taskScopedId, "taskScopedId"));
+      startSpinner("Updating task assignee...");
+      const response = await httpPatch(
+        `/workspaces/${options.workspace}/workflows/${workflowFileId}/tasks/${id}/assignee`,
+        body
+      );
+      if (!response.ok) {
+        stopSpinner(false, "Failed");
+        failResponse(response);
+      }
+      stopSpinner(true, "Task assignee updated");
+      printTaskDetail(response.data);
+    }
+  );
+  addWorkspaceOption(
+    task.command("delete").description("Delete a workflow task").argument("<workflowFileId>").argument("<taskScopedId>")
+  ).action(async (workflowFileId, taskScopedId, options) => {
+    const id = runOrExit4(() => parsePositiveInteger(taskScopedId, "taskScopedId"));
+    startSpinner("Deleting task...");
+    const response = await httpDelete(
+      `/workspaces/${options.workspace}/workflows/${workflowFileId}/tasks/${id}`
+    );
+    if (!response.ok) {
       stopSpinner(false, "Failed");
-      printError(`Error [${response.status}]: ${JSON.stringify(response.data)}`);
-      process.exit(1);
+      failResponse(response);
     }
+    stopSpinner(true, `Deleted: ${response.data.scopedId}`);
   });
-  const members = program2.command("members").description("Manage workspace members");
-  members.command("list").description("List all members in a workspace").requiredOption("-w, --workspace <workspaceId>", "Workspace ID").action(async (options) => {
-    const { workspace: workspaceId } = options;
-    startSpinner("Fetching workspace members...");
-    const response = await httpGet(`/workspaces/${workspaceId}/members`);
+}
+function registerCommentCommands(workflow) {
+  const comment = workflow.command("comment").description("Workflow task comment operations");
+  addWorkspaceOption(
+    comment.command("create").description("Create a workflow task comment").argument("<workflowFileId>").argument("<taskScopedId>").requiredOption("--content-path <localPath>", "Local UTF-8 text file for comment content")
+  ).action(
+    async (workflowFileId, taskScopedId, options) => {
+      const { id, content } = runOrExit4(() => ({
+        id: parsePositiveInteger(taskScopedId, "taskScopedId"),
+        content: readCommentContentFile2(options.contentPath)
+      }));
+      startSpinner("Creating comment...");
+      const response = await httpPost(
+        `/workspaces/${options.workspace}/workflows/${workflowFileId}/tasks/${id}/comments`,
+        { content }
+      );
+      if (!response.ok) {
+        stopSpinner(false, "Failed");
+        failResponse(response);
+      }
+      stopSpinner(true, "Comment created");
+      printCommentDetail(response.data);
+    }
+  );
+  addWorkspaceOption(
+    comment.command("list").description("List workflow task comments").argument("<workflowFileId>").argument("<taskScopedId>")
+  ).action(async (workflowFileId, taskScopedId, options) => {
+    const id = runOrExit4(() => parsePositiveInteger(taskScopedId, "taskScopedId"));
+    startSpinner("Fetching comments...");
+    const response = await httpGet(
+      `/workspaces/${options.workspace}/workflows/${workflowFileId}/tasks/${id}/comments`
+    );
     if (!response.ok) {
-      stopSpinner(false, "Failed to fetch members");
-      printError(`Error [${response.status}]: ${JSON.stringify(response.data)}`);
-      process.exit(1);
+      stopSpinner(false, "Failed");
+      failResponse(response);
     }
-    const { members: members2 } = response.data;
-    if (members2.length === 0) {
-      stopSpinner(true, "No members found.");
+    if (response.data.items.length === 0) {
+      stopSpinner(true, "No comments found.");
       return;
     }
-    stopSpinner(true, `Found ${members2.length} member(s)`);
-    for (const member of members2) {
-      const name = member.displayName || "-";
-      print(`${colors.bold}${member.email}${colors.reset}	${name}	${member.role}`);
-    }
+    stopSpinner(true, `Found ${response.data.items.length} comment(s)`);
+    response.data.items.forEach((item, index) => {
+      if (index > 0) print("");
+      printCommentDetail(item);
+    });
   });
-  members.command("remove").description("Remove members from a workspace").requiredOption("-w, --workspace <workspaceId>", "Workspace ID").argument("<emails>", "Emails to remove (comma-separated)").action(async (emailsArg, options) => {
-    const { workspace: workspaceId } = options;
-    const emails = emailsArg.split(",").map((e) => e.trim()).filter(Boolean);
-    if (emails.length === 0) {
-      printError("No valid emails provided");
-      process.exit(1);
-    }
-    const invalidEmails = emails.filter((e) => !isValidEmail(e));
-    if (invalidEmails.length > 0) {
-      for (const email of invalidEmails) {
-        printError(`Invalid email format: ${email}`);
+  addWorkspaceOption(
+    comment.command("delete").description("Delete a workflow task comment").argument("<workflowFileId>").argument("<taskScopedId>").argument("<commentId>")
+  ).action(
+    async (workflowFileId, taskScopedId, commentId, options) => {
+      const ids = runOrExit4(() => ({
+        task: parsePositiveInteger(taskScopedId, "taskScopedId"),
+        comment: parsePositiveInteger(commentId, "commentId")
+      }));
+      startSpinner("Deleting comment...");
+      const response = await httpDelete(
+        `/workspaces/${options.workspace}/workflows/${workflowFileId}/tasks/${ids.task}/comments/${ids.comment}`
+      );
+      if (!response.ok) {
+        stopSpinner(false, "Failed");
+        failResponse(response);
       }
-      process.exit(1);
+      stopSpinner(true, `Deleted: ${response.data.id}`);
     }
-    startSpinner("Fetching workspace members...");
-    const membersResponse = await httpGet(`/workspaces/${workspaceId}/members`);
-    if (!membersResponse.ok) {
-      stopSpinner(false, "Failed to fetch members");
-      printError(`Error [${membersResponse.status}]: ${JSON.stringify(membersResponse.data)}`);
-      process.exit(1);
+  );
+}
+function registerRunCommands(workflow) {
+  const run = workflow.command("run").description("Workflow agent run operations");
+  addWorkspaceOption(
+    run.command("status").description("Get workflow agent run statuses").argument("<workflowFileId>").argument("<triggerIds...>")
+  ).action(async (workflowFileId, triggerIds, options) => {
+    const workflowPipelineTriggerIds = runOrExit4(
+      () => triggerIds.map((triggerId) => parsePositiveInteger(triggerId, "workflowPipelineTriggerId"))
+    );
+    startSpinner("Fetching run statuses...");
+    const response = await httpPost(
+      `/workspaces/${options.workspace}/workflows/${workflowFileId}/pipeline/triggers/statuses`,
+      { workflowPipelineTriggerIds }
+    );
+    if (!response.ok) {
+      stopSpinner(false, "Failed");
+      failResponse(response);
     }
-    stopSpinner(true, "Members fetched");
-    const { members: members2 } = membersResponse.data;
-    const emailToMember = new Map(members2.map((m) => [m.email.toLowerCase(), m]));
-    for (const email of emails) {
-      const member = emailToMember.get(email.toLowerCase());
-      if (!member) {
-        print(`${colors.red}\u2717${colors.reset} ${email} - not found in workspace`);
-        continue;
-      }
-      const deleteResponse = await httpDelete(`/workspaces/${workspaceId}/members/${member.userId}`);
-      if (deleteResponse.ok) {
-        print(`${colors.green}\u2713${colors.reset} ${email} - removed`);
-      } else {
-        print(`${colors.red}\u2717${colors.reset} ${email} - failed: ${JSON.stringify(deleteResponse.data)}`);
-      }
+    stopSpinner(true, `Found ${response.data.length} run status item(s)`);
+    for (const item of response.data) {
+      print(`${colors.bold}${item.workflowPipelineTriggerId}${colors.reset}	${item.pipelineStatus}`);
     }
   });
-  const space = program2.command("space").description("Manage spaces");
-  space.command("list").description("List accessible spaces in a workspace").requiredOption("-w, --workspace <workspaceId>", "Workspace ID").action(async (options) => {
-    const { workspace: workspaceId } = options;
-    startSpinner("Fetching spaces...");
-    const response = await httpGet(`/workspaces/${workspaceId}/spaces`);
+  addWorkspaceOption(
+    run.command("output").description("Get workflow agent run output events").argument("<workflowFileId>").argument("<triggerId>")
+  ).action(async (workflowFileId, triggerId, options) => {
+    const id = runOrExit4(() => parsePositiveInteger(triggerId, "workflowPipelineTriggerId"));
+    startSpinner("Fetching run output...");
+    const response = await httpGet(
+      `/workspaces/${options.workspace}/workflows/${workflowFileId}/pipeline/trigger/${id}/output`
+    );
     if (!response.ok) {
-      stopSpinner(false, "Failed to fetch spaces");
-      printError(`Error [${response.status}]: ${JSON.stringify(response.data)}`);
-      process.exit(1);
-    }
-    const { spaces } = response.data;
-    if (spaces.length === 0) {
-      stopSpinner(true, "No spaces found.");
-      return;
+      stopSpinner(false, "Failed");
+      failResponse(response);
     }
-    stopSpinner(true, `Found ${spaces.length} space(s)`);
-    print(
-      `${colors.bold}TYPE${colors.reset}	${colors.bold}TEAM_SPACE_ID${colors.reset}	${colors.bold}TEAMMATE_ID${colors.reset}	${colors.bold}NAME${colors.reset}`
+    stopSpinner(true, `Run ${response.data.workflowPipelineTriggerId}`);
+    for (const event of response.data.pipelineEvents) print(event);
+  });
+  addWorkspaceOption(
+    run.command("abort").description("Abort a workflow agent run").argument("<workflowFileId>").argument("<triggerId>")
+  ).action(async (workflowFileId, triggerId, options) => {
+    const id = runOrExit4(() => parsePositiveInteger(triggerId, "workflowPipelineTriggerId"));
+    startSpinner("Aborting run...");
+    const response = await httpPost(
+      `/workspaces/${options.workspace}/workflows/${workflowFileId}/pipeline/trigger/${id}/abort`,
+      {}
     );
-    for (const s of spaces) {
-      const teamSpaceId = s.teamSpaceId ?? "";
-      const teammateId = s.agentId != null ? String(s.agentId) : "";
-      print(`${s.type}	${teamSpaceId}	${teammateId}	${s.name}`);
+    if (!response.ok) {
+      stopSpinner(false, "Failed");
+      failResponse(response);
     }
+    stopSpinner(true, `Abort accepted: ${id}`);
   });
 }
 
 // src/program.ts
 function createProgram(version) {
-  const program2 = new Command2();
+  const program2 = new Command();
   program2.name("moxt").description("Moxt CLI - AI Workspace").version(version).action(() => {
     program2.help();
   });
-  registerAuthCommand(program2);
   registerWhoamiCommand(program2);
   registerWorkspaceCommand(program2);
   registerFileCommand(program2);
   registerMemoryCommand(program2);
+  registerWorkflowCommand(program2);
   registerMiniappCommand(program2);
-  registerPullCommand(program2);
-  registerPushCommand(program2);
-  registerStatusCommand(program2);
   registerTelemetryCommand(program2);
   return program2;
 }
@@ -2831,7 +2139,7 @@ var FLUSH_TIMEOUT_MS = 3e3;
 var MAX_BATCH_SIZE = 100;
 function commonLabels() {
   return {
-    cli_version: "0.4.0-beta.0",
+    cli_version: "0.4.0",
     node_version: process.versions.node,
     os: platform2(),
     arch: arch2(),
@@ -2877,7 +2185,7 @@ async function flush() {
   }
   const batch = buffer.splice(0, MAX_BATCH_SIZE);
   const payload = {
-    release_id: "0.4.0-beta.0",
+    release_id: "0.4.0",
     client_type: "cli",
     metric_data_list: batch.map((m) => ({
       profile: "cli",
@@ -3018,9 +2326,9 @@ function installExitHandler() {
 
 // src/index.ts
 updateNotifier({
-  pkg: { name: "@moxt-ai/cli", version: "0.4.0-beta.0" }
+  pkg: { name: "@moxt-ai/cli", version: "0.4.0" }
 }).notify();
-var program = createProgram("0.4.0-beta.0");
+var program = createProgram("0.4.0");
 instrumentProgram(program);
 installExitHandler();
 program.parseAsync(process.argv).then(async () => {