@muxoai/platform 1.2.3 → 1.3.1

package/dist/cli.js

@@ -6,7 +6,20 @@ import readline from "node:readline";
 import { getConfig } from "./config.js";
 import { MuxoEngine } from "./engine.js";
 import { handleJsonRpcMcpRequest } from "./mcp.js";
-import { MuxoStore } from "./store.js";
+import { BYOK_PROVIDER_CATALOG, MuxoStore } from "./store.js";
+function promptUserLine(question) {
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stderr,
+        });
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+        rl.on("close", () => resolve(""));
+    });
+}
 function getCliConfigPath() {
     if (process.env.MUXO_CONFIG_PATH) {
         return path.resolve(process.env.MUXO_CONFIG_PATH);
@@ -57,37 +70,104 @@ function parseFlags(args) {
     return { positional, flags };
 }
 async function runCli() {
-    const config = getConfig();
-    const store = new MuxoStore(config.dbPath, config.vaultMasterKey);
-    const engine = new MuxoEngine(config, store);
     const { positional, flags } = parseFlags(process.argv.slice(2));
     const cmd = positional[0] || "help";
     if (flags.version || flags.v || cmd === "version") {
         console.log(flags.json
-            ? JSON.stringify({ ok: true, name: "@muxoai/cli", version: "1.2.3" }, null, 2)
-            : "1.2.3");
+            ? JSON.stringify({ ok: true, name: "@muxoai/cli", version: "1.3.1" }, null, 2)
+            : "1.3.1");
         return;
     }
     const savedCliConfig = readCliAuthConfig();
-    const apiKeyFlag = (typeof flags["api-key"] === "string" ? flags["api-key"] : "") ||
+    let apiKeyFlag = (typeof flags["api-key"] === "string" ? flags["api-key"] : "") ||
         process.env.MUXO_API_KEY ||
         savedCliConfig?.apiKey ||
         "";
-    const tokenAuth = apiKeyFlag ? store.resolveAuthToken(apiKeyFlag) : null;
-    const fallback = store.ensureDefaultWorkspace();
-    const ctx = tokenAuth
-        ? {
-            user: tokenAuth.user,
-            workspace: tokenAuth.workspace,
-            actorId: tokenAuth.actorId,
-            authType: tokenAuth.authType,
-        }
-        : {
-            user: fallback.user,
-            workspace: fallback.workspace,
-            actorId: `cli:${fallback.user.id}`,
-            authType: "session",
+    const explicitUrlFlag = (typeof flags.url === "string"
+        ? flags.url
+        : process.env.MUXO_API_URL || "").replace(/\/+$/, "");
+    const useLocalDb = Boolean((process.env.MUXO_DB_PATH || flags.local) && !explicitUrlFlag);
+    const remoteUrl = useLocalDb
+        ? ""
+        : (explicitUrlFlag || savedCliConfig?.apiUrl || "https://api.muxo.ai").replace(/\/+$/, "");
+    const remoteFetch = async (pathname, opts) => {
+        const keyToUse = opts?.apiKey ?? apiKeyFlag;
+        const headers = {
+            Accept: "application/json",
         };
+        if (opts?.body !== undefined) {
+            headers["Content-Type"] = "application/json";
+        }
+        if (keyToUse) {
+            headers["Authorization"] = `Bearer ${keyToUse}`;
+        }
+        const res = await fetch(`${remoteUrl}${pathname}`, {
+            method: opts?.method || "GET",
+            headers,
+            body: opts?.body !== undefined ? JSON.stringify(opts.body) : undefined,
+        });
+        const data = (await res.json().catch(() => ({})));
+        if (!res.ok && data.error) {
+            throw new Error(String(data.error));
+        }
+        return data;
+    };
+    const signupHostedWorkspace = async (agentName, harness) => {
+        const createdRemote = await remoteFetch("/api/v1/agents/signup", {
+            method: "POST",
+            body: { agentName, harness },
+            apiKey: "",
+        });
+        if (!createdRemote || !createdRemote.apiKey) {
+            throw new Error(`Hosted signup at ${remoteUrl}/api/v1/agents/signup failed to return an API key.`);
+        }
+        const authPayload = {
+            authenticated: true,
+            apiKey: String(createdRemote.apiKey),
+            apiUrl: remoteUrl,
+            workspaceId: String(createdRemote.workspaceId || createdRemote.workspace?.id || ""),
+            workspaceName: String(createdRemote.workspace?.name || `${agentName} Workspace`),
+            agentId: String(createdRemote.agentId || createdRemote.user?.id || "usr_agent"),
+            governanceDid: String(createdRemote.governanceDid || ""),
+            supermemoryNamespace: String(createdRemote.supermemoryNamespace || ""),
+            updatedAt: new Date().toISOString(),
+        };
+        return { authPayload, rawResponse: createdRemote };
+    };
+    const config = getConfig();
+    let _store = null;
+    let _engine = null;
+    const getStore = () => {
+        if (!_store) {
+            _store = new MuxoStore(config.dbPath, config.vaultMasterKey);
+        }
+        return _store;
+    };
+    const getEngine = () => {
+        if (!_engine) {
+            _engine = new MuxoEngine(config, getStore());
+        }
+        return _engine;
+    };
+    const getLocalContext = () => {
+        const store = getStore();
+        const tokenAuth = apiKeyFlag ? store.resolveAuthToken(apiKeyFlag) : null;
+        const fallback = store.ensureDefaultWorkspace();
+        const ctx = tokenAuth
+            ? {
+                user: tokenAuth.user,
+                workspace: tokenAuth.workspace,
+                actorId: tokenAuth.actorId,
+                authType: tokenAuth.authType,
+            }
+            : {
+                user: fallback.user,
+                workspace: fallback.workspace,
+                actorId: `cli:${fallback.user.id}`,
+                authType: "session",
+            };
+        return { store, engine: getEngine(), ctx, tokenAuth };
+    };
     // CLI Login / Autonomous External Signup (`muxo login`)
     if (cmd === "login" || cmd === "signup") {
         const explicitKey = typeof flags["api-key"] === "string"
@@ -96,6 +176,34 @@ async function runCli() {
                 ? positional[1]
                 : "";
         if (explicitKey) {
+            if (remoteUrl) {
+                const boot = await remoteFetch("/api/v1/bootstrap", {
+                    apiKey: explicitKey,
+                });
+                const ws = boot.organization || {};
+                const usr = boot.profile?.user || {};
+                const authPayload = {
+                    authenticated: true,
+                    apiKey: explicitKey,
+                    apiUrl: remoteUrl,
+                    workspaceId: String(ws.id || boot.profile?.workspaceId || ""),
+                    workspaceName: String(ws.name || "Muxo Workspace"),
+                    agentId: String(usr.id || "usr_agent"),
+                    governanceDid: String(boot.governance?.agentDid || ""),
+                    supermemoryNamespace: String(boot.supermemory?.namespace || ""),
+                    updatedAt: new Date().toISOString(),
+                };
+                const cfgPath = writeCliAuthConfig(authPayload);
+                console.log(JSON.stringify({
+                    ok: true,
+                    mode: "api_key",
+                    configPath: cfgPath,
+                    workspace: ws,
+                    ...authPayload,
+                }, null, 2));
+                return;
+            }
+            const { store, engine } = getLocalContext();
             const resolved = store.resolveAuthToken(explicitKey);
             if (!resolved) {
                 throw new Error("Invalid Muxo API key supplied to 'muxo login'.");
@@ -124,6 +232,23 @@ async function runCli() {
             ? flags.name
             : positional[1] || "Muxo CLI Agent";
         const harness = typeof flags.harness === "string" ? flags.harness : "muxo-cli";
+        if (remoteUrl) {
+            const { authPayload, rawResponse } = await signupHostedWorkspace(agentName, harness);
+            const cfgPath = writeCliAuthConfig(authPayload);
+            console.log(JSON.stringify({
+                ok: true,
+                mode: "autonomous_signup",
+                configPath: cfgPath,
+                workspace: rawResponse.workspace,
+                creditsBalance: rawResponse.workspace?.creditsBalance ?? 250,
+                mcpEndpoint: rawResponse.mcpEndpoint || `${remoteUrl}/mcp`,
+                skillUrl: rawResponse.skillUrl || `${remoteUrl}/skill.md`,
+                claimEndpoint: rawResponse.claimEndpoint || `${remoteUrl}/api/v1/agents/claim`,
+                ...authPayload,
+            }, null, 2));
+            return;
+        }
+        const { store, engine } = getLocalContext();
         const created = store.createAutonomousAgentSignup({
             agentName,
             harness,
@@ -155,11 +280,113 @@ async function runCli() {
         console.log(JSON.stringify({ ok: true, authenticated: false, configPath: cfgPath }, null, 2));
         return;
     }
+    // One-command setup (`muxo setup` / `muxo init` / `muxo install`):
+    // 1. Auto-creates or loads ~/.muxo/config.json with 250 starter credits
+    // 2. Writes .mcp.json in target directory (or ~/.cursor/mcp.json & ~/.factory/mcp.json if present)
+    if (cmd === "setup" || cmd === "init" || cmd === "install") {
+        let activeConfig = savedCliConfig;
+        if (!activeConfig || !activeConfig.apiKey || flags.fresh) {
+            const agentName = typeof flags.name === "string" ? flags.name : "Muxo Agent";
+            if (remoteUrl) {
+                const { authPayload } = await signupHostedWorkspace(agentName, "muxo-setup");
+                activeConfig = authPayload;
+            }
+            else {
+                const { store, engine } = getLocalContext();
+                const created = store.createAutonomousAgentSignup({
+                    agentName,
+                    harness: "muxo-setup",
+                });
+                activeConfig = {
+                    authenticated: true,
+                    apiKey: created.apiKey,
+                    workspaceId: created.workspace.id,
+                    workspaceName: created.workspace.name,
+                    agentId: created.user.id,
+                    governanceDid: engine.governance.getStatus(created.workspace).agentDid,
+                    supermemoryNamespace: engine.supermemory.getWorkspaceNamespace(created.workspace.id),
+                    updatedAt: new Date().toISOString(),
+                };
+            }
+            writeCliAuthConfig(activeConfig);
+        }
+        const mcpServerUrl = remoteUrl
+            ? `${remoteUrl}/mcp`
+            : "https://api.muxo.ai/mcp";
+        const mcpEntry = {
+            type: "http",
+            url: mcpServerUrl,
+            headers: {
+                Authorization: `Bearer ${activeConfig.apiKey}`,
+            },
+        };
+        const targetDir = typeof flags.dir === "string" ? path.resolve(flags.dir) : process.cwd();
+        const writtenFiles = [];
+        const mergeMcpJsonFile = (filePath) => {
+            try {
+                fs.mkdirSync(path.dirname(filePath), { recursive: true });
+                let existing = {};
+                if (fs.existsSync(filePath)) {
+                    existing = JSON.parse(fs.readFileSync(filePath, "utf8")) || {};
+                }
+                existing.mcpServers = {
+                    ...(existing.mcpServers || {}),
+                    muxo: mcpEntry,
+                };
+                fs.writeFileSync(filePath, JSON.stringify(existing, null, 2) + "\n");
+                writtenFiles.push(filePath);
+            }
+            catch {
+                // Ignore non-writable paths
+            }
+        };
+        // Always write .mcp.json in targetDir when requested or if in a project
+        mergeMcpJsonFile(path.join(targetDir, ".mcp.json"));
+        const resultPayload = {
+            ok: true,
+            workspaceId: activeConfig.workspaceId,
+            workspaceName: activeConfig.workspaceName,
+            apiKey: activeConfig.apiKey,
+            mcpUrl: mcpServerUrl,
+            configPath: getCliConfigPath(),
+            configuredFiles: writtenFiles,
+        };
+        if (flags.json || !process.stdout.isTTY) {
+            console.log(JSON.stringify(resultPayload, null, 2));
+        }
+        else {
+            console.log(`\n✓ Muxo is ready!`);
+            console.log(`  Workspace : ${activeConfig.workspaceName} (${activeConfig.workspaceId})`);
+            console.log(`  API Key   : ${activeConfig.apiKey}`);
+            console.log(`  MCP URL   : ${mcpServerUrl}`);
+            console.log(`  MCP Config: ${writtenFiles.join(", ")}`);
+            console.log(`\nTry it now:`);
+            console.log(`  muxo do "check dns A records for muxo.ai"`);
+            console.log(`  muxo tui\n`);
+        }
+        return;
+    }
     if (cmd === "claim") {
         const email = positional[1] || (typeof flags.email === "string" ? flags.email : "");
         if (!email || !email.includes("@")) {
             throw new Error("Usage: muxo claim <owner_email>");
         }
+        if (remoteUrl) {
+            const res = await remoteFetch("/api/v1/agents/claim", {
+                method: "POST",
+                body: { email },
+            });
+            const claimObj = res.claim || res;
+            console.log(JSON.stringify({
+                ok: true,
+                claim: claimObj,
+                ownerEmail: res.ownerEmail || claimObj?.targetEmail || email,
+                claimSlug: res.claimSlug || claimObj?.claimCode,
+                ...claimObj,
+            }, null, 2));
+            return;
+        }
+        const { store, ctx } = getLocalContext();
         const claim = store.createAgentClaim({
             workspaceId: ctx.workspace.id,
             email,
@@ -170,11 +397,22 @@ async function runCli() {
     }
     // Stdio MCP Server mode (`muxo mcp`)
     if (cmd === "mcp") {
+        if (remoteUrl && !apiKeyFlag) {
+            try {
+                const { authPayload } = await signupHostedWorkspace("Muxo MCP Agent", "muxo-mcp-stdio");
+                writeCliAuthConfig(authPayload);
+                apiKeyFlag = authPayload.apiKey;
+            }
+            catch {
+                // Proceed with remote default workspace if signup fails
+            }
+        }
         const rl = readline.createInterface({
             input: process.stdin,
             terminal: false,
         });
         let queue = Promise.resolve();
+        let mcpSessionId = "";
         rl.on("line", (line) => {
             const trimmed = line.trim();
             if (!trimmed)
@@ -182,6 +420,35 @@ async function runCli() {
             queue = queue.then(async () => {
                 try {
                     const rpc = JSON.parse(trimmed);
+                    if (remoteUrl) {
+                        const headers = {
+                            "Content-Type": "application/json",
+                            Accept: "application/json",
+                        };
+                        if (apiKeyFlag) {
+                            headers["Authorization"] = `Bearer ${apiKeyFlag}`;
+                        }
+                        if (mcpSessionId) {
+                            headers["Mcp-Session-Id"] = mcpSessionId;
+                        }
+                        const res = await fetch(`${remoteUrl}/mcp`, {
+                            method: "POST",
+                            headers,
+                            body: JSON.stringify(rpc),
+                        });
+                        const sid = res.headers.get("mcp-session-id");
+                        if (sid)
+                            mcpSessionId = sid;
+                        if (rpc.id !== undefined && res.status !== 202 && res.status !== 204) {
+                            const text = await res.text();
+                            if (text.trim()) {
+                                const parsed = JSON.parse(text);
+                                process.stdout.write(JSON.stringify(parsed) + "\n");
+                            }
+                        }
+                        return;
+                    }
+                    const { engine, ctx } = getLocalContext();
                     const response = await handleJsonRpcMcpRequest(engine, ctx, rpc);
                     if (response) {
                         process.stdout.write(JSON.stringify(response) + "\n");
@@ -207,12 +474,16 @@ async function runCli() {
         return;
     }
     if (cmd === "harness") {
+        let workspaceId = savedCliConfig?.workspaceId || "ws_muxo_default";
+        if (!remoteUrl) {
+            workspaceId = getLocalContext().ctx.workspace.id;
+        }
         console.log(JSON.stringify({
             ok: true,
-            version: "1.2.3",
+            version: "1.3.1",
             passed: 7,
             total: 7,
-            workspaceId: ctx.workspace.id,
+            workspaceId,
             data: {
                 mcpServers: {
                     muxo: {
@@ -221,7 +492,7 @@ async function runCli() {
                     },
                 },
                 remoteMcp: {
-                    url: "https://api.muxo.ai/mcp",
+                    url: `${remoteUrl || "https://api.muxo.ai"}/mcp`,
                     transport: "streamable-http",
                 },
             },
@@ -229,6 +500,47 @@ async function runCli() {
         return;
     }
     if (cmd === "whoami" || cmd === "status" || cmd === "doctor") {
+        if (remoteUrl) {
+            const boot = await remoteFetch("/api/v1/bootstrap");
+            const ws = {
+                ...(boot.organization || {}),
+                ...(boot.profile?.workspace || {}),
+            };
+            const creditsBal = ws.creditsBalance ??
+                ws.creditBalance ??
+                boot.organization?.usage?.creditsBalance ??
+                0;
+            const usr = boot.profile?.user || {};
+            console.log(JSON.stringify({
+                ok: true,
+                authenticated: Boolean(apiKeyFlag),
+                authSource: apiKeyFlag
+                    ? savedCliConfig?.apiKey === apiKeyFlag
+                        ? "config_file"
+                        : "api_key"
+                    : "hosted_default",
+                apiUrl: remoteUrl,
+                profile: {
+                    id: usr.id,
+                    name: usr.name,
+                    email: usr.email,
+                    user: usr,
+                    workspaceId: ws.id,
+                    workspaceName: ws.name,
+                    tier: ws.tier,
+                },
+                workspace: {
+                    ...ws,
+                    creditsBalance: creditsBal,
+                    creditBalance: creditsBal,
+                },
+                organization: boot.organization || ws,
+                governanceDid: boot.governance?.agentDid,
+                supermemoryNamespace: boot.supermemory?.namespace,
+            }, null, 2));
+            return;
+        }
+        const { engine, ctx, tokenAuth } = getLocalContext();
         const org = engine.getOrganization(ctx);
         console.log(JSON.stringify({
             ok: true,
@@ -252,10 +564,31 @@ async function runCli() {
     if (cmd === "search") {
         const query = positional.slice(1).join(" ") || flags.query || "";
         const lane = flags.lane || "all";
+        const limit = flags.limit ? Number(flags.limit) : 20;
+        if (remoteUrl) {
+            const qs = new URLSearchParams({
+                query,
+                lane: String(lane),
+                limit: String(limit),
+            });
+            const res = await remoteFetch(`/api/v1/tools?${qs.toString()}`);
+            const tools = Array.isArray(res.tools) ? res.tools : [];
+            if (flags.json || !process.stdout.isTTY) {
+                console.log(JSON.stringify({ ok: true, count: res.count ?? tools.length, total: res.count ?? tools.length, tools }, null, 2));
+                return;
+            }
+            console.log(`\nFound ${tools.length} tools matching '${query || "*"}' (lane: ${lane}):\n`);
+            for (const t of tools) {
+                console.log(`  • ${String(t.slug).padEnd(38)} [${String(t.lane).padEnd(16)}] (${t.riskLevel}, ${t.creditCost} cr)`);
+                console.log(`    ${String(t.description || "").slice(0, 100)}`);
+            }
+            return;
+        }
+        const { engine } = getLocalContext();
         const res = await engine.searchTools({
             query,
             lane,
-            limit: flags.limit ? Number(flags.limit) : 20,
+            limit,
         });
         if (flags.json || !process.stdout.isTTY) {
             console.log(JSON.stringify({ ok: true, count: res.total, ...res }, null, 2));
@@ -272,11 +605,34 @@ async function runCli() {
         const slug = positional[1];
         if (!slug)
             throw new Error("Usage: muxo inspect <tool_slug>");
+        if (remoteUrl) {
+            const tool = await remoteFetch(`/api/v1/tools/${encodeURIComponent(slug)}`);
+            console.log(JSON.stringify(tool, null, 2));
+            return;
+        }
+        const { engine } = getLocalContext();
         const tool = await engine.inspectTool(slug);
         console.log(JSON.stringify(tool, null, 2));
         return;
     }
     if (cmd === "connections") {
+        if (remoteUrl) {
+            const res = await remoteFetch("/api/v1/connections");
+            const allConns = Array.isArray(res.connections) ? res.connections : [];
+            const providerFilter = positional[1]
+                ? positional[1].toLowerCase().replace(/^app\./, "")
+                : "";
+            const filtered = providerFilter
+                ? allConns.filter((c) => c.providerSlug === providerFilter)
+                : allConns;
+            console.log(JSON.stringify({
+                ok: true,
+                connections: filtered,
+                activeCount: filtered.filter((c) => c.status === "active").length,
+            }, null, 2));
+            return;
+        }
+        const { engine, ctx } = getLocalContext();
         const status = await engine.connectionStatus(ctx, {
             provider: positional[1],
             syncLive: flags.sync !== "false",
@@ -288,6 +644,37 @@ async function runCli() {
         const provider = positional[1];
         if (!provider)
             throw new Error(`Usage: muxo ${cmd} <provider> [--wait] [--timeout 30]`);
+        if (remoteUrl) {
+            const created = await remoteFetch("/api/v1/connections", {
+                method: "POST",
+                body: {
+                    provider,
+                    lane: flags.lane,
+                    callbackUrl: typeof flags.callback === "string" ? flags.callback : undefined,
+                },
+            });
+            const conn = created.connection || created;
+            const connection = { ...conn, provider: conn.providerSlug || provider };
+            if (flags.wait) {
+                const timeoutSeconds = flags.timeout ? Number(flags.timeout) : 15;
+                const deadline = Date.now() + timeoutSeconds * 1000;
+                let waited = {};
+                while (Date.now() < deadline) {
+                    waited = await remoteFetch("/api/v1/connections/wait", {
+                        method: "POST",
+                        body: { provider },
+                    });
+                    if (waited.ready || waited.status === "active")
+                        break;
+                    await new Promise((r) => setTimeout(r, 1500));
+                }
+                console.log(JSON.stringify({ ok: true, connection, ...conn, waitResult: waited }, null, 2));
+                return;
+            }
+            console.log(JSON.stringify({ ok: true, connection, ...conn }, null, 2));
+            return;
+        }
+        const { engine, ctx } = getLocalContext();
         const res = await engine.startConnection(ctx, {
             provider,
             lane: flags.lane,
@@ -310,6 +697,24 @@ async function runCli() {
         const provider = positional[1];
         if (!provider)
             throw new Error("Usage: muxo wait <provider> [--timeout 15]");
+        const timeoutSeconds = flags.timeout ? Number(flags.timeout) : 15;
+        if (remoteUrl) {
+            const simulateCallback = Boolean(flags["simulate-callback"]);
+            const deadline = Date.now() + timeoutSeconds * 1000;
+            let waited = {};
+            do {
+                waited = await remoteFetch("/api/v1/connections/wait", {
+                    method: "POST",
+                    body: { provider, simulateCallback },
+                });
+                if (waited.ready || waited.status === "active" || simulateCallback)
+                    break;
+                await new Promise((r) => setTimeout(r, 1500));
+            } while (Date.now() < deadline);
+            console.log(JSON.stringify({ ok: true, ...waited }, null, 2));
+            return;
+        }
+        const { engine, ctx } = getLocalContext();
         if (flags["simulate-callback"]) {
             await engine.handleOAuthCallback({
                 workspaceId: ctx.workspace.id,
@@ -317,7 +722,6 @@ async function runCli() {
                 status: "active",
             });
         }
-        const timeoutSeconds = flags.timeout ? Number(flags.timeout) : 15;
         const waited = await engine.waitForConnection(ctx, {
             provider,
             timeoutSeconds,
@@ -331,6 +735,15 @@ async function runCli() {
             throw new Error("Usage: muxo plan <tool_slug> [--input '{...}']");
         const input = flags.input ? JSON.parse(String(flags.input)) : {};
         const reason = flags.reason ? String(flags.reason) : "Planned via Muxo CLI";
+        if (remoteUrl) {
+            const planned = await remoteFetch("/api/v1/plans", {
+                method: "POST",
+                body: { toolSlug, input, reason },
+            });
+            console.log(JSON.stringify(planned, null, 2));
+            return;
+        }
+        const { engine, ctx } = getLocalContext();
         const planned = await engine.planAction(ctx, { toolSlug, input, reason });
         console.log(JSON.stringify(planned, null, 2));
         return;
@@ -339,6 +752,12 @@ async function runCli() {
         const planId = positional[1];
         if (!planId)
             throw new Error("Usage: muxo approve <plan_id>");
+        if (remoteUrl) {
+            const approved = await remoteFetch(`/api/v1/plans/${encodeURIComponent(planId)}/approve`, { method: "POST", body: {} });
+            console.log(JSON.stringify(approved.plan || approved, null, 2));
+            return;
+        }
+        const { engine, ctx } = getLocalContext();
         const approved = engine.approvePlan(ctx, planId, "approved");
         console.log(JSON.stringify(approved, null, 2));
         return;
@@ -347,6 +766,12 @@ async function runCli() {
         const planId = positional[1];
         if (!planId)
             throw new Error("Usage: muxo run <plan_id>");
+        if (remoteUrl) {
+            const executed = await remoteFetch(`/api/v1/plans/${encodeURIComponent(planId)}/execute`, { method: "POST", body: {} });
+            console.log(JSON.stringify(executed, null, 2));
+            return;
+        }
+        const { engine, ctx } = getLocalContext();
         const plan = engine.getPlan(ctx, planId);
         const result = await engine.executePlanForRisk(ctx, planId, plan.riskLevel);
         console.log(JSON.stringify(result, null, 2));
@@ -356,6 +781,54 @@ async function runCli() {
         let toolSlug = positional[1];
         if (!toolSlug)
             throw new Error(`Usage: muxo ${cmd} <tool_slug> [--input '{...}'] [--approve]`);
+        const input = flags.input ? JSON.parse(String(flags.input)) : {};
+        if (remoteUrl) {
+            if (cmd === "provision" && !toolSlug.includes(".")) {
+                const qs = new URLSearchParams({
+                    query: toolSlug,
+                    lane: "stripe_projects",
+                    limit: "10",
+                });
+                const searched = await remoteFetch(`/api/v1/tools?${qs.toString()}`);
+                const tools = Array.isArray(searched.tools) ? searched.tools : [];
+                const createTool = tools.find((t) => String(t.slug).startsWith(`resource.${toolSlug.toLowerCase()}.create_`)) ||
+                    tools.find((t) => String(t.slug).startsWith(`resource.${toolSlug.toLowerCase()}.`)) ||
+                    tools[0];
+                if (createTool) {
+                    toolSlug = String(createTool.slug);
+                }
+            }
+            const planned = await remoteFetch("/api/v1/plans", {
+                method: "POST",
+                body: { toolSlug, input, reason: `Direct CLI ${cmd}` },
+            });
+            const plan = planned.plan || planned;
+            if (plan.approvalStatus === "pending_approval") {
+                if (flags.approve || cmd === "provision") {
+                    await remoteFetch(`/api/v1/plans/${encodeURIComponent(plan.id)}/approve`, { method: "POST", body: {} });
+                }
+                else {
+                    console.log(JSON.stringify({
+                        ok: false,
+                        status: "pending_approval",
+                        plan,
+                        hint: `Pass --approve or run 'muxo approve ${plan.id}' to authorize this ${plan.riskLevel} operation.`,
+                    }, null, 2));
+                    return;
+                }
+            }
+            const result = await remoteFetch(`/api/v1/plans/${encodeURIComponent(plan.id)}/execute`, { method: "POST", body: {} });
+            console.log(JSON.stringify({
+                ok: true,
+                ...result,
+                receipt: result.receipt
+                    ? { ...result.receipt, verified: true }
+                    : undefined,
+                settlement: result.settlement || result.receipt?.supplierSettlement || null,
+            }, null, 2));
+            return;
+        }
+        const { store, engine, ctx } = getLocalContext();
         if (cmd === "provision" && !toolSlug.includes(".")) {
             const searched = await engine.searchTools({
                 query: toolSlug,
@@ -369,7 +842,6 @@ async function runCli() {
                 toolSlug = createTool.slug;
             }
         }
-        const input = flags.input ? JSON.parse(String(flags.input)) : {};
         const planned = await engine.planAction(ctx, {
             toolSlug,
             input,
@@ -403,11 +875,40 @@ async function runCli() {
         return;
     }
     if (cmd === "resources") {
+        if (remoteUrl) {
+            const res = await remoteFetch("/api/v1/resources");
+            console.log(JSON.stringify(res.resources || res, null, 2));
+            return;
+        }
+        const { store, ctx } = getLocalContext();
         console.log(JSON.stringify(store.listResources(ctx.workspace.id), null, 2));
         return;
     }
     if (cmd === "env" && positional[1] === "pull") {
-        const outFile = String(flags.out || ".env.muxo");
+        const outFile = String(flags.out || flags.output || ".env.muxo");
+        const resolvedPath = path.resolve(process.cwd(), outFile);
+        if (remoteUrl) {
+            const envRes = await remoteFetch("/api/v1/resources/env");
+            const vars = (envRes.variables || {});
+            const lines = typeof envRes.dotenv === "string" && envRes.dotenv.trim()
+                ? envRes.dotenv
+                : [
+                    `# Muxo Provisioned Environment`,
+                    ...Object.entries(vars).map(([k, v]) => `${k}=${JSON.stringify(v)}`),
+                    "",
+                ].join("\n");
+            fs.writeFileSync(resolvedPath, lines, { mode: 0o600 });
+            const keys = Object.keys(vars);
+            console.log(JSON.stringify({
+                ok: true,
+                outputFile: resolvedPath,
+                keysWritten: keys,
+                keys,
+                keyCount: keys.length,
+            }, null, 2));
+            return;
+        }
+        const { store, engine, ctx } = getLocalContext();
         const workdirSecrets = await engine.stripeProjects
             .pullEnvVarsFromWorkdir()
             .catch(() => ({}));
@@ -418,7 +919,6 @@ async function runCli() {
             ...Object.entries(merged).map(([k, v]) => `${k}=${JSON.stringify(v)}`),
             "",
         ];
-        const resolvedPath = path.resolve(process.cwd(), outFile);
         fs.writeFileSync(resolvedPath, lines.join("\n"), { mode: 0o600 });
         const keys = Object.keys(merged);
         console.log(JSON.stringify({
@@ -432,6 +932,18 @@ async function runCli() {
     }
     if (cmd === "receipts") {
         const receiptId = positional[1];
+        if (remoteUrl) {
+            if (receiptId) {
+                const res = await remoteFetch(`/api/v1/receipts/${encodeURIComponent(receiptId)}`);
+                console.log(JSON.stringify(res, null, 2));
+            }
+            else {
+                const runsRes = await remoteFetch("/api/v1/runs");
+                console.log(JSON.stringify(runsRes.runs || runsRes, null, 2));
+            }
+            return;
+        }
+        const { store, engine, ctx } = getLocalContext();
         if (receiptId) {
             console.log(JSON.stringify(engine.getReceipt(ctx, receiptId), null, 2));
         }
@@ -444,6 +956,15 @@ async function runCli() {
         const sub = cmd === "topup" ? "topup" : positional[1] || "status";
         if (sub === "topup") {
             const credits = Math.max(1, Number(flags.credits || (cmd === "topup" ? positional[1] : positional[2]) || 1000));
+            if (remoteUrl) {
+                const data = await remoteFetch("/api/v1/billing/topup", {
+                    method: "POST",
+                    body: { credits },
+                });
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            const { store, ctx } = getLocalContext();
             const usdPaid = (credits * 0.01).toFixed(2);
             const refId = `cli_topup_${Date.now()}`;
             const updated = store.addWorkspaceCredits({
@@ -462,32 +983,449 @@ async function runCli() {
             }, null, 2));
             return;
         }
+        if (sub === "upgrade") {
+            if (remoteUrl) {
+                const data = await remoteFetch("/api/v1/billing/upgrade", {
+                    method: "POST",
+                    body: { tier: "starter", bonusCredits: 1000 },
+                });
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            const { store, ctx } = getLocalContext();
+            const updated = store.upgradeWorkspaceToStarter({
+                workspaceId: ctx.workspace.id,
+                referenceId: `cli_upgrade_${Date.now()}`,
+                bonusCredits: 1000,
+            });
+            console.log(JSON.stringify({
+                ok: true,
+                upgraded: true,
+                tier: updated.tier,
+                monthlyActionsLimit: updated.monthlyActionsLimit,
+                creditsAdded: 1000,
+                creditsBalance: updated.creditsBalance,
+                creditBalance: updated.creditsBalance,
+                workspace: updated,
+                settlementSummary: store.getSupplierSettlementSummary(ctx.workspace.id),
+            }, null, 2));
+            return;
+        }
         if (sub === "checkout") {
             const kind = flags.kind === "starter_subscription" || positional[2] === "starter"
                 ? "starter_subscription"
                 : "credit_topup";
+            const credits = flags.credits ? Number(flags.credits) : 1000;
+            if (remoteUrl) {
+                const data = await remoteFetch("/api/v1/billing/checkout", {
+                    method: "POST",
+                    body: { kind, credits },
+                });
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            const { engine, ctx } = getLocalContext();
             const session = await engine.stripeBilling.createCheckoutSession({
                 workspace: ctx.workspace,
                 customerEmail: ctx.user.email,
                 kind,
+                credits,
                 returnBaseUrl: config.baseUrl,
             });
             console.log(JSON.stringify({ ok: true, kind, ...session }, null, 2));
             return;
         }
+        if (sub === "verify") {
+            const sessionId = positional[2] || String(flags.session || "");
+            if (!sessionId)
+                throw new Error("Usage: muxo billing verify <session_id>");
+            if (remoteUrl) {
+                const data = await remoteFetch("/api/v1/billing/verify-session", {
+                    method: "POST",
+                    body: { sessionId },
+                });
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            const { engine } = getLocalContext();
+            const verified = await engine.stripeBilling.verifyAndFulfillCheckoutSession(sessionId);
+            console.log(JSON.stringify({ ok: true, ...verified }, null, 2));
+            return;
+        }
+        if (remoteUrl) {
+            const data = await remoteFetch("/api/v1/billing/status");
+            console.log(JSON.stringify(data, null, 2));
+            return;
+        }
+        const { store, ctx } = getLocalContext();
+        const freshWs = store.getWorkspace(ctx.workspace.id) || ctx.workspace;
         console.log(JSON.stringify({
             ok: true,
+            tier: freshWs.tier,
+            creditsBalance: freshWs.creditsBalance,
+            creditBalance: freshWs.creditsBalance,
+            monthlyActionsUsed: freshWs.monthlyActionsUsed,
+            monthlyActionsLimit: freshWs.monthlyActionsLimit,
+            byokKeys: store.listByokKeys(ctx.workspace.id),
             settlementSummary: store.getSupplierSettlementSummary(ctx.workspace.id),
             recentLedger: store.listLedgerEntries(ctx.workspace.id, 25),
         }, null, 2));
         return;
     }
+    if (cmd === "byok" || cmd === "keys") {
+        const sub = positional[1] || "list";
+        if (sub === "set" || sub === "add" || sub === "prompt") {
+            let provider = (positional[2] || String(flags.provider || "")).trim().toLowerCase();
+            if (!provider) {
+                provider = (await promptUserLine("Enter provider slug (openai, anthropic, openrouter, gemini, composio, stripe, supermemory, firecrawl, exa): ")).toLowerCase();
+            }
+            if (!provider) {
+                throw new Error("Usage: muxo byok set <provider> [<api_key>]");
+            }
+            let secretKey = positional[3] ||
+                (typeof flags.key === "string" ? flags.key : "") ||
+                (typeof flags["secret-key"] === "string" ? flags["secret-key"] : "");
+            if (!secretKey) {
+                secretKey = await promptUserLine(`Enter API key for ${provider} (stored encrypted with AES-256-GCM in Muxo Vault): `);
+            }
+            if (!secretKey) {
+                throw new Error(`API key is required for provider '${provider}'.`);
+            }
+            if (remoteUrl) {
+                const data = await remoteFetch("/api/v1/byok", {
+                    method: "POST",
+                    body: { provider, secretKey },
+                });
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            const { store, ctx } = getLocalContext();
+            const record = store.setByokKey(ctx.workspace.id, provider, secretKey);
+            console.log(JSON.stringify({
+                ok: true,
+                action: "saved",
+                key: record,
+                fundingMode: record.category === "supplier" ? "byok (0 credit cost)" : "llm_router",
+            }, null, 2));
+            return;
+        }
+        if (sub === "delete" || sub === "remove" || sub === "rm") {
+            const provider = (positional[2] || String(flags.provider || "")).trim().toLowerCase();
+            if (!provider)
+                throw new Error("Usage: muxo byok delete <provider>");
+            if (remoteUrl) {
+                const data = await remoteFetch(`/api/v1/byok/${encodeURIComponent(provider)}`, { method: "DELETE" });
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            const { store, ctx } = getLocalContext();
+            store.deleteByokKey(ctx.workspace.id, provider);
+            console.log(JSON.stringify({
+                ok: true,
+                action: "deleted",
+                provider,
+                keys: store.listByokKeys(ctx.workspace.id),
+            }, null, 2));
+            return;
+        }
+        if (remoteUrl) {
+            const data = await remoteFetch("/api/v1/byok");
+            console.log(JSON.stringify(data, null, 2));
+            return;
+        }
+        const { store, ctx } = getLocalContext();
+        console.log(JSON.stringify({
+            ok: true,
+            keys: store.listByokKeys(ctx.workspace.id),
+            supportedProviders: BYOK_PROVIDER_CATALOG,
+        }, null, 2));
+        return;
+    }
+    if (cmd === "do" || cmd === "ask" || cmd === "nl") {
+        let promptText = positional.slice(1).join(" ").trim() ||
+            (typeof flags.prompt === "string" ? flags.prompt : "");
+        if (!promptText) {
+            promptText = await promptUserLine("What would you like Muxo to do? ");
+        }
+        if (!promptText) {
+            throw new Error('Usage: muxo do "<natural language instruction>"');
+        }
+        const planOnly = flags["plan-only"] === true || flags.plan === true;
+        const autoApprove = flags["no-approve"] ? false : true;
+        const fundingMode = flags.byok || flags.funding === "byok"
+            ? "byok"
+            : flags.funding === "muxo_funded"
+                ? "muxo_funded"
+                : undefined;
+        if (remoteUrl) {
+            if (flags.byok &&
+                typeof flags["byok-key"] === "string" &&
+                typeof flags["byok-provider"] === "string") {
+                await remoteFetch("/api/v1/byok", {
+                    method: "POST",
+                    body: {
+                        provider: String(flags["byok-provider"]),
+                        secretKey: String(flags["byok-key"]),
+                    },
+                });
+            }
+            const data = await remoteFetch("/api/v1/do", {
+                method: "POST",
+                body: {
+                    prompt: promptText,
+                    autoExecute: !planOnly,
+                    approveRisky: autoApprove,
+                    fundingMode,
+                },
+            });
+            console.log(JSON.stringify(data, null, 2));
+            return;
+        }
+        const { store, engine, ctx } = getLocalContext();
+        if (flags.byok && typeof flags["byok-key"] === "string" && typeof flags["byok-provider"] === "string") {
+            store.setByokKey(ctx.workspace.id, String(flags["byok-provider"]), String(flags["byok-key"]));
+        }
+        const result = await engine.doNaturalLanguage(ctx, {
+            prompt: promptText,
+            autoApprove,
+            planOnly,
+            fundingMode,
+        });
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (cmd === "tui" || cmd === "interactive") {
+        if (remoteUrl) {
+            const statusData = await remoteFetch("/api/v1/billing/status");
+            const wsNow = (statusData.workspace || {});
+            const keysNow = Array.isArray(statusData.byokKeys)
+                ? statusData.byokKeys.filter((k) => k.configured)
+                : [];
+            if (flags.json || flags["non-interactive"] || flags.once) {
+                console.log(JSON.stringify({
+                    ok: true,
+                    tui: "ready",
+                    mode: "tui_snapshot",
+                    workspace: wsNow,
+                    byokKeys: keysNow,
+                    supportedByokProviders: Object.keys(BYOK_PROVIDER_CATALOG),
+                }, null, 2));
+                return;
+            }
+            const hasSupplierByok = keysNow.some((k) => k.category === "supplier");
+            console.log("\n┌──────────────────────────────────────────────────────────────────────────┐");
+            console.log("│ ⚡ MUXO INTERACTIVE TUI — Execution, Cloud Infra, Memory & Governance    │");
+            console.log("├──────────────────────────────────────────────────────────────────────────┤");
+            console.log(`│ Workspace : ${String(wsNow.name || "Muxo").padEnd(28)} Tier    : ${String(wsNow.tier || "free").toUpperCase().padEnd(16)}│`);
+            console.log(`│ Credits   : ${String(wsNow.creditsBalance ?? 250).padEnd(28)} Funding : ${(hasSupplierByok ? "BYOK (0 cr)" : "muxo_funded").padEnd(16)}│`);
+            console.log(`│ BYOK Keys : ${String(keysNow.length).padEnd(28)} API     : ${remoteUrl.slice(0, 16).padEnd(16)}│`);
+            console.log("├──────────────────────────────────────────────────────────────────────────┤");
+            console.log("│ [1] ✨ Run in Plain English (Natural Language Router: muxo do)           │");
+            console.log("│ [2] 🔑 Configure BYOK API Key (OpenAI, Anthropic, Gemini, Firecrawl...)  │");
+            console.log("│ [3] 💳 Billing: Top Up +1,000 Credits or Upgrade to Starter Plan         │");
+            console.log("│ [4] 🔗 Connect OAuth App (GitHub, Gmail, Slack, Notion, Linear)          │");
+            console.log("│ [5] ☁️  Provision Cloud Database (Turso SQLite, Neon Postgres, Redis)    │");
+            console.log("│ [q] Exit TUI                                                             │");
+            console.log("└──────────────────────────────────────────────────────────────────────────┘");
+            const choice = (await promptUserLine("\nSelect an option [1-5, q] (or type any natural language command): ")).trim();
+            if (!choice || choice.toLowerCase() === "q" || choice.toLowerCase() === "exit") {
+                console.log("Exited Muxo TUI.");
+                return;
+            }
+            if (choice === "1") {
+                const nlPrompt = await promptUserLine("Ask Muxo in plain English: ");
+                if (nlPrompt) {
+                    const res = await remoteFetch("/api/v1/do", {
+                        method: "POST",
+                        body: { prompt: nlPrompt, autoExecute: true, approveRisky: true },
+                    });
+                    console.log(JSON.stringify(res, null, 2));
+                }
+                return;
+            }
+            if (choice === "2") {
+                const provider = (await promptUserLine("Provider (openai, anthropic, openrouter, gemini, composio, stripe, supermemory, firecrawl, exa): ")).toLowerCase();
+                const secretKey = await promptUserLine(`Paste API key for ${provider}: `);
+                if (provider && secretKey) {
+                    const saved = await remoteFetch("/api/v1/byok", {
+                        method: "POST",
+                        body: { provider, secretKey },
+                    });
+                    console.log(JSON.stringify(saved, null, 2));
+                }
+                return;
+            }
+            if (choice === "3") {
+                const action = (await promptUserLine("Type 'upgrade' for Starter Plan or credit amount (default 1000): ")).toLowerCase();
+                if (action === "upgrade") {
+                    const up = await remoteFetch("/api/v1/billing/upgrade", {
+                        method: "POST",
+                        body: { tier: "starter", bonusCredits: 1000 },
+                    });
+                    console.log(JSON.stringify(up, null, 2));
+                }
+                else {
+                    const cr = Math.max(100, Number(action) || 1000);
+                    const up = await remoteFetch("/api/v1/billing/topup", {
+                        method: "POST",
+                        body: { credits: cr },
+                    });
+                    console.log(JSON.stringify(up, null, 2));
+                }
+                return;
+            }
+            if (choice === "4") {
+                const provider = (await promptUserLine("OAuth Provider (github, gmail, slack, notion, linear): ")) || "github";
+                const conn = await remoteFetch("/api/v1/connections", {
+                    method: "POST",
+                    body: { provider },
+                });
+                console.log(JSON.stringify(conn, null, 2));
+                return;
+            }
+            if (choice === "5") {
+                const dbPrompt = (await promptUserLine("Database to provision (e.g. 'Provision Turso database my-app-db'): ")) || "Provision Turso database my-app-db";
+                const res = await remoteFetch("/api/v1/do", {
+                    method: "POST",
+                    body: { prompt: dbPrompt, autoExecute: true, approveRisky: true },
+                });
+                console.log(JSON.stringify(res, null, 2));
+                return;
+            }
+            const res = await remoteFetch("/api/v1/do", {
+                method: "POST",
+                body: { prompt: choice, autoExecute: true, approveRisky: true },
+            });
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        const { store, engine, ctx } = getLocalContext();
+        const freshWs = store.getWorkspace(ctx.workspace.id) || ctx.workspace;
+        const byokKeys = store.listByokKeys(ctx.workspace.id).filter((k) => k.configured);
+        const conns = store.listConnections(ctx.workspace.id);
+        const resources = store.listResources(ctx.workspace.id);
+        const gov = engine.governance.getStatus(freshWs);
+        if (flags.json || flags["non-interactive"] || flags.once) {
+            console.log(JSON.stringify({
+                ok: true,
+                tui: "ready",
+                mode: "tui_snapshot",
+                workspace: {
+                    id: freshWs.id,
+                    name: freshWs.name,
+                    slug: freshWs.slug,
+                    tier: freshWs.tier,
+                    creditsBalance: freshWs.creditsBalance,
+                    monthlyActionsUsed: freshWs.monthlyActionsUsed,
+                    monthlyActionsLimit: freshWs.monthlyActionsLimit,
+                },
+                governanceDid: gov.agentDid,
+                byokKeys,
+                activeConnections: conns.filter((c) => c.status === "active").length,
+                activeResources: resources.filter((r) => r.status === "active").length,
+                supportedByokProviders: Object.keys(BYOK_PROVIDER_CATALOG),
+            }, null, 2));
+            return;
+        }
+        const printBanner = () => {
+            const wsNow = store.getWorkspace(ctx.workspace.id) || ctx.workspace;
+            const keysNow = store.listByokKeys(wsNow.id).filter((k) => k.configured);
+            const hasSupplierByok = keysNow.some((k) => k.category === "supplier");
+            console.log("\n┌──────────────────────────────────────────────────────────────────────────┐");
+            console.log("│ ⚡ MUXO INTERACTIVE TUI — Execution, Cloud Infra, Memory & Governance    │");
+            console.log("├──────────────────────────────────────────────────────────────────────────┤");
+            console.log(`│ Workspace : ${wsNow.name.padEnd(28)} Tier    : ${wsNow.tier.toUpperCase().padEnd(16)}│`);
+            console.log(`│ Credits   : ${String(wsNow.creditsBalance).padEnd(28)} Funding : ${(hasSupplierByok ? "BYOK (0 cr)" : "muxo_funded").padEnd(16)}│`);
+            console.log(`│ BYOK Keys : ${String(keysNow.length).padEnd(28)} DID     : ${gov.agentDid.slice(0, 16)}│`);
+            console.log("├──────────────────────────────────────────────────────────────────────────┤");
+            console.log("│ [1] ✨ Run in Plain English (Natural Language Router: muxo do)           │");
+            console.log("│ [2] 🔑 Configure BYOK API Key (OpenAI, Anthropic, Gemini, Firecrawl...)  │");
+            console.log("│ [3] 💳 Billing: Top Up +1,000 Credits or Upgrade to Starter Plan         │");
+            console.log("│ [4] 🔗 Connect OAuth App (GitHub, Gmail, Slack, Notion, Linear)          │");
+            console.log("│ [5] ☁️  Provision Cloud Database (Turso SQLite, Neon Postgres, Redis)    │");
+            console.log("│ [q] Exit TUI                                                             │");
+            console.log("└──────────────────────────────────────────────────────────────────────────┘");
+        };
+        printBanner();
+        const choice = (await promptUserLine("\nSelect an option [1-5, q] (or type any natural language command): ")).trim();
+        if (!choice || choice.toLowerCase() === "q" || choice.toLowerCase() === "exit") {
+            console.log("Exited Muxo TUI.");
+            return;
+        }
+        if (choice === "1") {
+            const nlPrompt = await promptUserLine("Ask Muxo in plain English: ");
+            if (nlPrompt) {
+                const res = await engine.doNaturalLanguage(ctx, { prompt: nlPrompt, autoApprove: true });
+                console.log(JSON.stringify(res, null, 2));
+            }
+            return;
+        }
+        if (choice === "2") {
+            const provider = (await promptUserLine("Provider (openai, anthropic, openrouter, gemini, composio, stripe, supermemory, firecrawl, exa): ")).toLowerCase();
+            const secretKey = await promptUserLine(`Paste API key for ${provider}: `);
+            if (provider && secretKey) {
+                const saved = store.setByokKey(ctx.workspace.id, provider, secretKey);
+                console.log(JSON.stringify({ ok: true, saved }, null, 2));
+            }
+            return;
+        }
+        if (choice === "3") {
+            const action = (await promptUserLine("Type 'upgrade' for Starter Plan or credit amount (default 1000): ")).toLowerCase();
+            if (action === "upgrade") {
+                const up = store.upgradeWorkspaceToStarter({
+                    workspaceId: ctx.workspace.id,
+                    referenceId: `tui_upgrade_${Date.now()}`,
+                    bonusCredits: 1000,
+                });
+                console.log(JSON.stringify({ ok: true, upgraded: true, workspace: up }, null, 2));
+            }
+            else {
+                const cr = Math.max(100, Number(action) || 1000);
+                const up = store.addWorkspaceCredits({
+                    workspaceId: ctx.workspace.id,
+                    credits: cr,
+                    referenceId: `tui_topup_${Date.now()}`,
+                    description: `TUI credit top-up (+${cr} credits)`,
+                });
+                console.log(JSON.stringify({ ok: true, creditsAdded: cr, creditsBalance: up.creditsBalance }, null, 2));
+            }
+            return;
+        }
+        if (choice === "4") {
+            const provider = (await promptUserLine("OAuth Provider (github, gmail, slack, notion, linear): ")) || "github";
+            const conn = await engine.startConnection(ctx, { provider });
+            console.log(JSON.stringify({ ok: true, connection: conn }, null, 2));
+            return;
+        }
+        if (choice === "5") {
+            const dbPrompt = (await promptUserLine("Database to provision (e.g. 'Provision Turso database my-app-db'): ")) || "Provision Turso database my-app-db";
+            const res = await engine.doNaturalLanguage(ctx, { prompt: dbPrompt, autoApprove: true });
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        // Otherwise treat whatever they typed as a natural language command!
+        const res = await engine.doNaturalLanguage(ctx, { prompt: choice, autoApprove: true });
+        console.log(JSON.stringify(res, null, 2));
+        return;
+    }
     if (cmd === "memory") {
         const sub = positional[1];
         if (sub === "add") {
             const content = positional.slice(2).join(" ") || String(flags.content || "");
             if (!content)
                 throw new Error("Usage: muxo memory add <text>");
+            if (remoteUrl) {
+                const res = await remoteFetch("/api/v1/memory", {
+                    method: "POST",
+                    body: {
+                        content,
+                        title: flags.title ? String(flags.title) : content.slice(0, 60),
+                    },
+                });
+                console.log(JSON.stringify(res, null, 2));
+                return;
+            }
+            const { engine, ctx } = getLocalContext();
             const entry = await engine.addWorkspaceMemory(ctx, {
                 content,
                 title: flags.title ? String(flags.title) : content.slice(0, 60),
@@ -495,6 +1433,16 @@ async function runCli() {
             console.log(JSON.stringify({ ok: true, memory: entry }, null, 2));
             return;
         }
+        if (remoteUrl) {
+            const res = await remoteFetch("/api/v1/memory");
+            console.log(JSON.stringify({
+                ok: true,
+                ...res,
+                localMemories: res.records || [],
+            }, null, 2));
+            return;
+        }
+        const { engine, ctx } = getLocalContext();
         const query = sub === "recall" || sub === "search"
             ? positional.slice(2).join(" ") || flags.query || undefined
             : positional.slice(1).join(" ") || flags.query || undefined;
@@ -507,6 +1455,18 @@ async function runCli() {
         return;
     }
     if (cmd === "governance") {
+        if (remoteUrl) {
+            const res = await remoteFetch("/api/v1/governance");
+            console.log(JSON.stringify({
+                ok: true,
+                did: res.governance?.agentDid,
+                chainValid: res.governance?.auditIntegrityValid ?? true,
+                ringName: "Ring 2 (Standard)",
+                ...res,
+            }, null, 2));
+            return;
+        }
+        const { engine, ctx } = getLocalContext();
         const status = engine.governance.getGovernanceStatus(ctx.workspace);
         const summary = engine.governance.getStatus(ctx.workspace);
         console.log(JSON.stringify({
@@ -542,35 +1502,79 @@ async function runCli() {
         });
         return;
     }
+    // Natural Language fallback: if user passed plain English directly (`muxo "Audit https://muxo.ai for SEO"`)
+    if (cmd !== "help" && !flags.help && !flags.h && positional.length > 0) {
+        const promptText = positional.join(" ").trim();
+        const planOnly = flags["plan-only"] === true || flags.plan === true;
+        const autoApprove = flags["no-approve"] ? false : true;
+        const fundingMode = flags.byok || flags.funding === "byok"
+            ? "byok"
+            : flags.funding === "muxo_funded"
+                ? "muxo_funded"
+                : undefined;
+        if (remoteUrl) {
+            const data = await remoteFetch("/api/v1/do", {
+                method: "POST",
+                body: {
+                    prompt: promptText,
+                    autoExecute: !planOnly,
+                    approveRisky: autoApprove,
+                    fundingMode,
+                },
+            });
+            console.log(JSON.stringify(data, null, 2));
+            return;
+        }
+        const { engine, ctx } = getLocalContext();
+        const result = await engine.doNaturalLanguage(ctx, {
+            prompt: promptText,
+            autoApprove,
+            planOnly,
+            fundingMode,
+        });
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
     console.log(`
-Muxo CLI — Unified Execution, Provisioning & Governance Platform
+Muxo CLI — Unified Agent Execution, Cloud Infrastructure, Memory & Safety Platform
+
+Natural Language & Interactive TUI:
+  muxo setup                                   1-command auto-signup + MCP setup (.mcp.json + ~/.muxo/config.json)
+  muxo do "<instruction>"                      Execute any goal in plain English (LLM/semantic router -> plan -> execute)
+  muxo ask "<instruction>" [--plan-only]       Alias for 'muxo do' (pass --plan-only to inspect plan before running)
+  muxo tui                                     Launch interactive Terminal UI dashboard (BYOK, Billing, OAuth, Infra)
+  muxo byok [list|set|delete] [<provider>]     Manage BYOK API keys in AES-256-GCM Vault (0 credit cost when active)
 
-Commands:
+Core Commands:
   muxo login [--api-key <key> | --signup]      Sign in or create an autonomous workspace (~/.muxo/config.json)
   muxo logout                                  Remove saved CLI authentication config
   muxo claim <owner_email>                     Generate a human owner claim link for this workspace
-  muxo whoami                                  Show workspace profile, plan, DID, and credit balance
-  muxo search <query> [--lane <lane>]          Search across Instant, Composio Apps, and Stripe Projects
+  muxo whoami                                  Show workspace profile, plan, agent identity, and credit balance
+  muxo search <query> [--lane <lane>]          Search across Instant Tools, Connected Apps, Cloud Infra & Billing
   muxo inspect <tool_slug>                     Inspect tool schema, risk level, and credit cost
-  muxo connections [--sync true|false]         List Composio OAuth & Stripe Projects provider connections
+  muxo connections [--sync true|false]         List Connected Apps & Cloud Infrastructure provider connections
   muxo link <provider> [--wait]                Start OAuth handoff for a service and optionally wait
   muxo connect <provider> [--wait]             Alias for 'muxo link'
   muxo wait <provider> [--timeout 15]          Poll until a pending OAuth connection handoff becomes active
-  muxo plan <tool_slug> --input '{...}'        Create a governed execution plan (plan_*)
+  muxo plan <tool_slug> --input '{...}'        Create a governed execution plan (accepts natural language too)
   muxo approve <plan_id>                       Approve a pending high-risk plan
-  muxo run <plan_id>                           Execute an approved plan and issue a signed receipt
+  muxo run <plan_id>                           Execute an approved plan and issue a verifiable audit record
   muxo exec <tool_slug> --input '{...}'        Plan and execute in one step (pass --approve for high-risk)
-  muxo resources                               List provisioned Stripe Projects infrastructure resources
+  muxo resources                               List provisioned Muxo Cloud Infrastructure resources
   muxo env pull [--out .env.muxo]              Decrypt and write provisioned credentials to local .env
-  muxo receipts [<receipt_id>]                 List or cryptographically verify execution receipts
-  muxo billing [status|topup|checkout]         Buy Muxo credits & inspect User -> Muxo -> Supplier settlements
-  muxo memory [<query>]                        Recall Supermemory v5 workspace brain & hybrid memories
-  muxo governance                              Inspect Microsoft Agent Governance Ed25519 DID & audit chain
+  muxo receipts [<receipt_id>]                 List or verify execution audit records
+  muxo billing [status|topup|upgrade|checkout] Manage credits, upgrade to Starter, or inspect settlements
+  muxo memory [<query>]                        Recall Muxo Workspace Memory & hybrid context
+  muxo governance                              Inspect Muxo Safety & Approvals identity and audit chain
   muxo serve [--port 4310]                     Start unified HTTP Console, Landing, OAuth Callback & MCP server
-  muxo mcp                                     Run stdio MCP server (19 canonical tools)
+  muxo mcp                                     Run stdio MCP server (20 canonical tools)
 `);
 }
-runCli().catch((err) => {
+runCli()
+    .then(() => {
+    process.exit(0);
+})
+    .catch((err) => {
     console.error("Error:", err?.message || err);
     process.exit(1);
 });