@muxoai/platform 1.3.1 → 1.3.3

package/dist/cli.js

@@ -6,7 +6,10 @@ import readline from "node:readline";
 import { getConfig } from "./config.js";
 import { MuxoEngine } from "./engine.js";
 import { handleJsonRpcMcpRequest } from "./mcp.js";
+import { sanitizePolicyPatch } from "./policy.js";
+import { RING_LABELS } from "./providers/microsoft-governance.js";
 import { BYOK_PROVIDER_CATALOG, MuxoStore } from "./store.js";
+import { MUXO_VERSION } from "./version.js";
 function promptUserLine(question) {
     return new Promise((resolve) => {
         const rl = readline.createInterface({
@@ -74,8 +77,8 @@ async function runCli() {
     const cmd = positional[0] || "help";
     if (flags.version || flags.v || cmd === "version") {
         console.log(flags.json
-            ? JSON.stringify({ ok: true, name: "@muxoai/cli", version: "1.3.1" }, null, 2)
-            : "1.3.1");
+            ? JSON.stringify({ ok: true, name: "@muxoai/cli", version: MUXO_VERSION }, null, 2)
+            : MUXO_VERSION);
         return;
     }
     const savedCliConfig = readCliAuthConfig();
@@ -85,7 +88,7 @@ async function runCli() {
         "";
     const explicitUrlFlag = (typeof flags.url === "string"
         ? flags.url
-        : process.env.MUXO_API_URL || "").replace(/\/+$/, "");
+        : process.env.MUXO_API_URL || process.env.MUXO_CLOUD_URL || "").replace(/\/+$/, "");
     const useLocalDb = Boolean((process.env.MUXO_DB_PATH || flags.local) && !explicitUrlFlag);
     const remoteUrl = useLocalDb
         ? ""
@@ -107,6 +110,9 @@ async function runCli() {
             body: opts?.body !== undefined ? JSON.stringify(opts.body) : undefined,
         });
         const data = (await res.json().catch(() => ({})));
+        if (opts?.acceptPaymentRequired && res.status === 402 && data.checkoutUrl) {
+            return data;
+        }
         if (!res.ok && data.error) {
             throw new Error(String(data.error));
         }
@@ -168,6 +174,23 @@ async function runCli() {
             };
         return { store, engine: getEngine(), ctx, tokenAuth };
     };
+    const maskKey = (key) => `${key.slice(0, 14)}…`;
+    // Hosted Muxo answers purchases with 402 + a Stripe Checkout URL; a self-hosted dev server may grant credits directly.
+    const printBillingResult = (data) => {
+        if (!data.checkoutUrl) {
+            console.log(JSON.stringify(data, null, 2));
+            return;
+        }
+        console.log(JSON.stringify({
+            ok: true,
+            paymentRequired: true,
+            kind: data.kind,
+            credits: data.credits,
+            checkoutUrl: data.checkoutUrl,
+            sessionId: data.sessionId,
+            next: `Open checkoutUrl to pay with Stripe. Muxo adds the credits once Stripe confirms the payment. Check with: muxo billing verify ${data.sessionId}`,
+        }, null, 2));
+    };
     // CLI Login / Autonomous External Signup (`muxo login`)
     if (cmd === "login" || cmd === "signup") {
         const explicitKey = typeof flags["api-key"] === "string"
@@ -200,6 +223,7 @@ async function runCli() {
                     configPath: cfgPath,
                     workspace: ws,
                     ...authPayload,
+                    apiKey: maskKey(explicitKey),
                 }, null, 2));
                 return;
             }
@@ -224,6 +248,7 @@ async function runCli() {
                 mode: "api_key",
                 configPath: cfgPath,
                 ...authPayload,
+                apiKey: maskKey(explicitKey),
             }, null, 2));
             return;
         }
@@ -281,11 +306,52 @@ async function runCli() {
         return;
     }
     // One-command setup (`muxo setup` / `muxo init` / `muxo install`):
-    // 1. Auto-creates or loads ~/.muxo/config.json with 250 starter credits
+    // 1. Auto-creates or loads ~/.muxo/config.json with 250 starter credits (or binds an explicit --api-key)
     // 2. Writes .mcp.json in target directory (or ~/.cursor/mcp.json & ~/.factory/mcp.json if present)
     if (cmd === "setup" || cmd === "init" || cmd === "install") {
+        const explicitKey = typeof flags["api-key"] === "string"
+            ? flags["api-key"].trim()
+            : typeof flags.key === "string"
+                ? flags.key.trim()
+                : "";
         let activeConfig = savedCliConfig;
-        if (!activeConfig || !activeConfig.apiKey || flags.fresh) {
+        if (explicitKey) {
+            const agentName = typeof flags.name === "string" ? flags.name : "Muxo Agent";
+            if (remoteUrl) {
+                apiKeyFlag = explicitKey;
+                const orgRes = (await remoteFetch("/api/v1/organization").catch(() => ({})));
+                const org = orgRes?.organization || orgRes?.workspace || {};
+                activeConfig = {
+                    authenticated: true,
+                    apiKey: explicitKey,
+                    workspaceId: org.id || "ws_remote",
+                    workspaceName: org.name || agentName,
+                    agentId: "usr_remote",
+                    governanceDid: org.governanceDid || `did:muxo:${org.id || "ws_remote"}`,
+                    supermemoryNamespace: `muxo_${org.id || "ws_remote"}`,
+                    updatedAt: new Date().toISOString(),
+                };
+            }
+            else {
+                const { store, engine } = getLocalContext();
+                const auth = store.resolveAuthToken(explicitKey);
+                if (!auth) {
+                    throw new Error(`Invalid API key provided to muxo setup: ${explicitKey.slice(0, 12)}...`);
+                }
+                activeConfig = {
+                    authenticated: true,
+                    apiKey: explicitKey,
+                    workspaceId: auth.workspace.id,
+                    workspaceName: auth.workspace.name,
+                    agentId: auth.user.id,
+                    governanceDid: engine.governance.getStatus(auth.workspace).agentDid,
+                    supermemoryNamespace: engine.supermemory.getWorkspaceNamespace(auth.workspace.id),
+                    updatedAt: new Date().toISOString(),
+                };
+            }
+            writeCliAuthConfig(activeConfig);
+        }
+        else if (!activeConfig || !activeConfig.apiKey || flags.fresh) {
             const agentName = typeof flags.name === "string" ? flags.name : "Muxo Agent";
             if (remoteUrl) {
                 const { authPayload } = await signupHostedWorkspace(agentName, "muxo-setup");
@@ -310,6 +376,7 @@ async function runCli() {
             }
             writeCliAuthConfig(activeConfig);
         }
+        const ensuredConfig = activeConfig;
         const mcpServerUrl = remoteUrl
             ? `${remoteUrl}/mcp`
             : "https://api.muxo.ai/mcp";
@@ -317,7 +384,7 @@ async function runCli() {
             type: "http",
             url: mcpServerUrl,
             headers: {
-                Authorization: `Bearer ${activeConfig.apiKey}`,
+                Authorization: `Bearer ${ensuredConfig.apiKey}`,
             },
         };
         const targetDir = typeof flags.dir === "string" ? path.resolve(flags.dir) : process.cwd();
@@ -344,9 +411,9 @@ async function runCli() {
         mergeMcpJsonFile(path.join(targetDir, ".mcp.json"));
         const resultPayload = {
             ok: true,
-            workspaceId: activeConfig.workspaceId,
-            workspaceName: activeConfig.workspaceName,
-            apiKey: activeConfig.apiKey,
+            workspaceId: ensuredConfig.workspaceId,
+            workspaceName: ensuredConfig.workspaceName,
+            apiKey: ensuredConfig.apiKey,
             mcpUrl: mcpServerUrl,
             configPath: getCliConfigPath(),
             configuredFiles: writtenFiles,
@@ -356,8 +423,8 @@ async function runCli() {
         }
         else {
             console.log(`\n✓ Muxo is ready!`);
-            console.log(`  Workspace : ${activeConfig.workspaceName} (${activeConfig.workspaceId})`);
-            console.log(`  API Key   : ${activeConfig.apiKey}`);
+            console.log(`  Workspace : ${ensuredConfig.workspaceName} (${ensuredConfig.workspaceId})`);
+            console.log(`  API Key   : ${maskKey(ensuredConfig.apiKey)} (saved in ${getCliConfigPath()})`);
             console.log(`  MCP URL   : ${mcpServerUrl}`);
             console.log(`  MCP Config: ${writtenFiles.join(", ")}`);
             console.log(`\nTry it now:`);
@@ -474,15 +541,193 @@ async function runCli() {
         return;
     }
     if (cmd === "harness") {
-        let workspaceId = savedCliConfig?.workspaceId || "ws_muxo_default";
-        if (!remoteUrl) {
-            workspaceId = getLocalContext().ctx.workspace.id;
+        const checks = [];
+        const skip = (reason) => ({ skip: reason });
+        const runCheck = async (id, name, fn) => {
+            const started = Date.now();
+            try {
+                const out = await fn();
+                checks.push(typeof out === "string"
+                    ? { id, name, status: "pass", detail: out, ms: Date.now() - started }
+                    : { id, name, status: "skip", detail: out.skip, ms: Date.now() - started });
+            }
+            catch (err) {
+                checks.push({
+                    id,
+                    name,
+                    status: "fail",
+                    detail: String(err?.message || err),
+                    ms: Date.now() - started,
+                });
+            }
+        };
+        const assertCheck = (cond, message) => {
+            if (!cond)
+                throw new Error(message);
+        };
+        const noKeyHint = "No API key. Run `muxo login --signup` to create a workspace.";
+        let workspaceId = savedCliConfig?.workspaceId || null;
+        if (remoteUrl) {
+            let mcpSessionId = "";
+            const harnessFetch = async (pathname, init = {}) => {
+                const headers = { Accept: "application/json" };
+                if (init.body !== undefined)
+                    headers["Content-Type"] = "application/json";
+                if (init.auth !== false && apiKeyFlag)
+                    headers.Authorization = `Bearer ${apiKeyFlag}`;
+                if (pathname === "/mcp" && mcpSessionId)
+                    headers["Mcp-Session-Id"] = mcpSessionId;
+                return fetch(`${remoteUrl}${pathname}`, {
+                    method: init.method || "GET",
+                    headers,
+                    body: init.body !== undefined ? JSON.stringify(init.body) : undefined,
+                    signal: AbortSignal.timeout(15_000),
+                });
+            };
+            const harnessJson = async (pathname, init) => {
+                const res = await harnessFetch(pathname, init);
+                const data = (await res.json().catch(() => ({})));
+                if (!res.ok) {
+                    throw new Error(`HTTP ${res.status}${data.error ? `: ${data.error}` : ""}`);
+                }
+                return data;
+            };
+            const mcpCall = async (id, method, params = {}) => {
+                const res = await harnessFetch("/mcp", {
+                    method: "POST",
+                    body: { jsonrpc: "2.0", id, method, params },
+                });
+                const sid = res.headers.get("mcp-session-id");
+                if (sid)
+                    mcpSessionId = sid;
+                const data = (await res.json().catch(() => ({})));
+                if (!res.ok || data.error) {
+                    throw new Error(data.error?.message || `HTTP ${res.status}`);
+                }
+                return data.result;
+            };
+            await runCheck("api_health", "API is reachable", async () => {
+                const health = await harnessJson("/health", { auth: false });
+                assertCheck(health.ok === true, "Health endpoint did not report ok");
+                return `${health.service || "muxo"} ${health.version || ""} at ${remoteUrl}`.trim();
+            });
+            await runCheck("agent_skill", "Agent skill is published", async () => {
+                const res = await harnessFetch("/skill.md", { auth: false });
+                assertCheck(res.ok, `HTTP ${res.status}`);
+                const body = await res.text();
+                assertCheck(/execute_(read|write)/.test(body), "skill.md is missing the execute_* tools");
+                return `${remoteUrl}/skill.md (${body.length.toLocaleString()} bytes)`;
+            });
+            await runCheck("mcp_initialize", "MCP server accepts a session", async () => {
+                const result = await mcpCall(1, "initialize", {
+                    protocolVersion: "2025-06-18",
+                    capabilities: {},
+                    clientInfo: { name: "muxo-cli-harness", version: MUXO_VERSION },
+                });
+                assertCheck(result?.serverInfo?.name, "initialize returned no serverInfo");
+                return `${result.serverInfo.name} ${result.serverInfo.version || ""} (protocol ${result.protocolVersion})`.trim();
+            });
+            await runCheck("mcp_tools", "MCP tools are listed", async () => {
+                const result = await mcpCall(2, "tools/list");
+                const count = Array.isArray(result?.tools) ? result.tools.length : 0;
+                assertCheck(count > 0, "tools/list returned no tools");
+                return `${count} tools`;
+            });
+            await runCheck("auth", "API key opens a workspace", async () => {
+                if (!apiKeyFlag)
+                    return skip(noKeyHint);
+                const boot = await harnessJson("/api/v1/bootstrap");
+                const ws = { ...(boot.organization || {}), ...(boot.profile?.workspace || {}) };
+                assertCheck(ws.id, "bootstrap returned no workspace");
+                workspaceId = String(ws.id);
+                return `${ws.name || ws.id} (${ws.tier || "free"})`;
+            });
+            await runCheck("governance", "Agents are allowed to act", async () => {
+                if (!apiKeyFlag)
+                    return skip(noKeyHint);
+                const res = await harnessJson("/api/v1/governance");
+                const g = res.governance || {};
+                if (g.killSwitch?.active) {
+                    throw new Error(`Kill switch is on${g.killSwitch.reason ? ` (${g.killSwitch.reason})` : ""}. Run \`muxo governance resume\`.`);
+                }
+                const chainOk = g.auditChain?.chainVerified ?? g.auditChainIntegrity ?? g.auditIntegrityValid;
+                assertCheck(chainOk !== false, "Audit hash chain failed verification");
+                return `Running, audit chain verified, policy ${res.workspacePolicy?.mode || "enforce"}`;
+            });
+            await runCheck("catalog", "Tool catalog search works", async () => {
+                if (!apiKeyFlag)
+                    return skip(noKeyHint);
+                const res = await harnessJson("/api/v1/tools?lane=composio_instant&limit=5");
+                const count = Array.isArray(res.tools) ? res.tools.length : 0;
+                assertCheck(count > 0, "Catalog search returned no tools");
+                return `${count} instant tools returned`;
+            });
         }
+        else {
+            const local = getLocalContext();
+            workspaceId = local.ctx.workspace.id;
+            await runCheck("local_store", "Local workspace database opens", async () => {
+                const ws = local.store.getWorkspace(local.ctx.workspace.id);
+                assertCheck(ws, "Workspace not found in local database");
+                return `${ws.name} at ${config.dbPath}`;
+            });
+            await runCheck("mcp_initialize", "MCP server accepts a session", async () => {
+                const res = await handleJsonRpcMcpRequest(local.engine, local.ctx, {
+                    jsonrpc: "2.0",
+                    id: 1,
+                    method: "initialize",
+                    params: { protocolVersion: "2025-06-18", capabilities: {} },
+                });
+                const info = res?.result?.serverInfo;
+                assertCheck(info?.name, "initialize returned no serverInfo");
+                return `${info.name} ${info.version || ""}`.trim();
+            });
+            await runCheck("mcp_tools", "MCP tools are listed", async () => {
+                const res = await handleJsonRpcMcpRequest(local.engine, local.ctx, {
+                    jsonrpc: "2.0",
+                    id: 2,
+                    method: "tools/list",
+                });
+                const count = (res?.result?.tools || []).length;
+                assertCheck(count > 0, "tools/list returned no tools");
+                return `${count} tools`;
+            });
+            await runCheck("auth", "API key opens a workspace", async () => {
+                if (!apiKeyFlag)
+                    return skip("No API key. Using the local default workspace.");
+                assertCheck(local.tokenAuth, "API key is not valid for this local database");
+                return local.ctx.workspace.name;
+            });
+            await runCheck("governance", "Agents are allowed to act", async () => {
+                const ws = local.store.getWorkspace(local.ctx.workspace.id) || local.ctx.workspace;
+                const status = local.engine.governance.getGovernanceStatus(ws);
+                if (status.killSwitch?.active) {
+                    throw new Error("Kill switch is on. Run `muxo governance resume`.");
+                }
+                assertCheck(status.auditChain?.chainVerified !== false, "Audit hash chain failed verification");
+                return `Running, audit chain verified, policy ${ws.policy.mode}`;
+            });
+            await runCheck("catalog", "Tool catalog search works", async () => {
+                const res = await local.engine.searchTools({ lane: "composio_instant", limit: 5 });
+                assertCheck(res.tools.length > 0, "Catalog search returned no tools");
+                return `${res.tools.length} instant tools returned`;
+            });
+        }
+        const passed = checks.filter((c) => c.status === "pass").length;
+        const failed = checks.filter((c) => c.status === "fail").length;
+        const skipped = checks.filter((c) => c.status === "skip").length;
+        if (failed > 0)
+            process.exitCode = 1;
         console.log(JSON.stringify({
-            ok: true,
-            version: "1.3.1",
-            passed: 7,
-            total: 7,
+            ok: failed === 0,
+            version: MUXO_VERSION,
+            mode: remoteUrl ? "hosted" : "local",
+            apiUrl: remoteUrl || null,
+            passed,
+            failed,
+            skipped,
+            total: checks.length,
+            checks,
             workspaceId,
             data: {
                 mcpServers: {
@@ -960,8 +1205,9 @@ async function runCli() {
                 const data = await remoteFetch("/api/v1/billing/topup", {
                     method: "POST",
                     body: { credits },
+                    acceptPaymentRequired: true,
                 });
-                console.log(JSON.stringify(data, null, 2));
+                printBillingResult(data);
                 return;
             }
             const { store, ctx } = getLocalContext();
@@ -988,8 +1234,9 @@ async function runCli() {
                 const data = await remoteFetch("/api/v1/billing/upgrade", {
                     method: "POST",
                     body: { tier: "starter", bonusCredits: 1000 },
+                    acceptPaymentRequired: true,
                 });
-                console.log(JSON.stringify(data, null, 2));
+                printBillingResult(data);
                 return;
             }
             const { store, ctx } = getLocalContext();
@@ -1173,6 +1420,9 @@ async function runCli() {
                 method: "POST",
                 body: {
                     prompt: promptText,
+                    dryRun: planOnly,
+                    planOnly,
+                    autoApprove,
                     autoExecute: !planOnly,
                     approveRisky: autoApprove,
                     fundingMode,
@@ -1257,21 +1507,18 @@ async function runCli() {
             }
             if (choice === "3") {
                 const action = (await promptUserLine("Type 'upgrade' for Starter Plan or credit amount (default 1000): ")).toLowerCase();
-                if (action === "upgrade") {
-                    const up = await remoteFetch("/api/v1/billing/upgrade", {
+                const up = action === "upgrade"
+                    ? await remoteFetch("/api/v1/billing/upgrade", {
                         method: "POST",
                         body: { tier: "starter", bonusCredits: 1000 },
-                    });
-                    console.log(JSON.stringify(up, null, 2));
-                }
-                else {
-                    const cr = Math.max(100, Number(action) || 1000);
-                    const up = await remoteFetch("/api/v1/billing/topup", {
+                        acceptPaymentRequired: true,
+                    })
+                    : await remoteFetch("/api/v1/billing/topup", {
                         method: "POST",
-                        body: { credits: cr },
+                        body: { credits: Math.max(100, Number(action) || 1000) },
+                        acceptPaymentRequired: true,
                     });
-                    console.log(JSON.stringify(up, null, 2));
-                }
+                printBillingResult(up);
                 return;
             }
             if (choice === "4") {
@@ -1410,6 +1657,47 @@ async function runCli() {
     }
     if (cmd === "memory") {
         const sub = positional[1];
+        if (sub === "facts") {
+            const query = positional.slice(2).join(" ") || (typeof flags.query === "string" ? flags.query : "");
+            const includeHistorical = !flags.current;
+            if (remoteUrl) {
+                const params = new URLSearchParams({ historical: includeHistorical ? "true" : "false" });
+                if (query)
+                    params.set("query", query);
+                const res = await remoteFetch(`/api/v1/memory/facts?${params.toString()}`);
+                console.log(JSON.stringify(res, null, 2));
+                return;
+            }
+            const { store, ctx } = getLocalContext();
+            const facts = store.listTemporalFacts(ctx.workspace.id, {
+                includeHistorical,
+                query: query || undefined,
+            });
+            console.log(JSON.stringify({
+                ok: true,
+                activeFacts: facts.filter((f) => f.validTo === null),
+                historicalFacts: facts.filter((f) => f.validTo !== null),
+                facts,
+            }, null, 2));
+            return;
+        }
+        if (sub === "forget") {
+            const query = positional.slice(2).join(" ").trim() || String(flags.query || "").trim();
+            if (!query)
+                throw new Error("Usage: muxo memory forget <text>");
+            if (remoteUrl) {
+                const res = await remoteFetch("/api/v1/memory/forget", {
+                    method: "POST",
+                    body: { query },
+                });
+                console.log(JSON.stringify(res, null, 2));
+                return;
+            }
+            const { engine, ctx } = getLocalContext();
+            const pruned = await engine.forgetWorkspaceMemoryMatching(ctx, query);
+            console.log(JSON.stringify({ ok: true, ...pruned }, null, 2));
+            return;
+        }
         if (sub === "add") {
             const content = positional.slice(2).join(" ") || String(flags.content || "");
             if (!content)
@@ -1433,8 +1721,26 @@ async function runCli() {
             console.log(JSON.stringify({ ok: true, memory: entry }, null, 2));
             return;
         }
+        if (sub === "delete" || sub === "rm" || sub === "remove") {
+            const id = positional[2] || String(flags.id || "");
+            if (!id)
+                throw new Error("Usage: muxo memory delete <memory_id>");
+            if (remoteUrl) {
+                const res = await remoteFetch(`/api/v1/memory/${encodeURIComponent(id)}`, { method: "DELETE" });
+                console.log(JSON.stringify(res, null, 2));
+                return;
+            }
+            const { engine, ctx } = getLocalContext();
+            const deleted = await engine.deleteWorkspaceMemory(ctx, id);
+            console.log(JSON.stringify({ ok: true, ...deleted }, null, 2));
+            return;
+        }
         if (remoteUrl) {
-            const res = await remoteFetch("/api/v1/memory");
+            const query = sub === "recall" || sub === "search"
+                ? positional.slice(2).join(" ") || flags.query || undefined
+                : positional.slice(1).join(" ") || flags.query || undefined;
+            const suffix = query ? `?query=${encodeURIComponent(query)}` : "";
+            const res = await remoteFetch(`/api/v1/memory${suffix}`);
             console.log(JSON.stringify({
                 ok: true,
                 ...res,
@@ -1455,25 +1761,125 @@ async function runCli() {
         return;
     }
     if (cmd === "governance") {
+        const sub = positional[1];
+        const ringLabel = (policy) => policy?.executionRing !== undefined
+            ? RING_LABELS[policy.executionRing] || `Ring ${policy.executionRing}`
+            : "Per action (set by risk level)";
+        if (sub === "pause" || sub === "kill-switch" || sub === "kill" || sub === "quarantine") {
+            const reason = positional.slice(2).join(" ").trim() ||
+                (typeof flags.reason === "string" ? flags.reason : "") ||
+                "Paused from the Muxo CLI";
+            if (remoteUrl) {
+                const res = await remoteFetch("/api/v1/governance/kill-switch", {
+                    method: "POST",
+                    body: { action: "quarantine", reason },
+                });
+                console.log(JSON.stringify(res, null, 2));
+                return;
+            }
+            const { engine, ctx } = getLocalContext();
+            const out = await engine.activateWorkspaceKillSwitch(ctx, { reason });
+            console.log(JSON.stringify({ ok: true, ...out }, null, 2));
+            return;
+        }
+        if (sub === "resume") {
+            if (remoteUrl) {
+                const res = await remoteFetch("/api/v1/governance/kill-switch", {
+                    method: "POST",
+                    body: { action: "resume" },
+                });
+                console.log(JSON.stringify(res, null, 2));
+                return;
+            }
+            const { engine, ctx } = getLocalContext();
+            const out = engine.resumeWorkspaceKillSwitch(ctx);
+            console.log(JSON.stringify({ ok: true, ...out }, null, 2));
+            return;
+        }
+        if (sub === "scan") {
+            const content = positional.slice(2).join(" ").trim() || String(flags.content || "").trim();
+            if (!content)
+                throw new Error("Usage: muxo governance scan <text>");
+            if (remoteUrl) {
+                const res = await remoteFetch("/api/v1/governance/scan-context", {
+                    method: "POST",
+                    body: { content, sessionId: "cli" },
+                });
+                console.log(JSON.stringify(res, null, 2));
+                return;
+            }
+            const { engine, ctx } = getLocalContext();
+            const scan = engine.governance.scanMemoryContent({
+                workspaceId: ctx.workspace.id,
+                sessionId: "cli",
+                role: "user",
+                content,
+            });
+            console.log(JSON.stringify({ ok: true, scan }, null, 2));
+            return;
+        }
+        if (sub === "policy") {
+            const patch = {};
+            if (typeof flags.mode === "string")
+                patch.mode = flags.mode;
+            if (flags.ring !== undefined)
+                patch.executionRing = Number(flags.ring);
+            if (typeof flags["require-approval"] === "string") {
+                const raw = flags["require-approval"].trim();
+                patch.requireApprovalFor =
+                    raw === "none" ? [] : raw.split(",").map((r) => r.trim()).filter(Boolean);
+            }
+            if (flags["block-destructive-sql"] !== undefined) {
+                patch.blockDestructiveSql =
+                    flags["block-destructive-sql"] === true || flags["block-destructive-sql"] === "true";
+            }
+            if (flags["max-credits"] !== undefined)
+                patch.maxCreditsPerRun = Number(flags["max-credits"]);
+            if (Object.keys(patch).length === 0) {
+                if (remoteUrl) {
+                    const res = await remoteFetch("/api/v1/governance");
+                    const policy = res.workspacePolicy || {};
+                    console.log(JSON.stringify({ ok: true, ringName: ringLabel(policy), policy }, null, 2));
+                    return;
+                }
+                const { store, ctx } = getLocalContext();
+                const policy = (store.getWorkspace(ctx.workspace.id) || ctx.workspace).policy;
+                console.log(JSON.stringify({ ok: true, ringName: ringLabel(policy), policy }, null, 2));
+                return;
+            }
+            if (remoteUrl) {
+                const res = await remoteFetch("/api/v1/policy", { method: "POST", body: patch });
+                const policy = res.workspace?.policy || {};
+                console.log(JSON.stringify({ ok: true, ringName: ringLabel(policy), policy }, null, 2));
+                return;
+            }
+            const { store, ctx } = getLocalContext();
+            const updated = store.updateWorkspacePolicy(ctx.workspace.id, sanitizePolicyPatch(patch));
+            console.log(JSON.stringify({ ok: true, ringName: ringLabel(updated.policy), policy: updated.policy }, null, 2));
+            return;
+        }
         if (remoteUrl) {
             const res = await remoteFetch("/api/v1/governance");
             console.log(JSON.stringify({
                 ok: true,
                 did: res.governance?.agentDid,
-                chainValid: res.governance?.auditIntegrityValid ?? true,
-                ringName: "Ring 2 (Standard)",
+                chainValid: res.governance?.auditChain?.chainVerified ??
+                    res.governance?.auditIntegrityValid ??
+                    true,
+                ringName: ringLabel(res.workspacePolicy),
                 ...res,
             }, null, 2));
             return;
         }
-        const { engine, ctx } = getLocalContext();
-        const status = engine.governance.getGovernanceStatus(ctx.workspace);
-        const summary = engine.governance.getStatus(ctx.workspace);
+        const { engine, ctx, store } = getLocalContext();
+        const ws = store.getWorkspace(ctx.workspace.id) || ctx.workspace;
+        const status = engine.governance.getGovernanceStatus(ws);
+        const summary = engine.governance.getStatus(ws);
         console.log(JSON.stringify({
             ok: true,
             did: summary.agentDid,
             chainValid: summary.auditChainIntegrity,
-            ringName: "Ring 2 (Standard)",
+            ringName: ringLabel(ws.policy),
             ...status,
         }, null, 2));
         return;
@@ -1517,6 +1923,9 @@ async function runCli() {
                 method: "POST",
                 body: {
                     prompt: promptText,
+                    dryRun: planOnly,
+                    planOnly,
+                    autoApprove,
                     autoExecute: !planOnly,
                     approveRisky: autoApprove,
                     fundingMode,
@@ -1565,14 +1974,22 @@ Core Commands:
   muxo receipts [<receipt_id>]                 List or verify execution audit records
   muxo billing [status|topup|upgrade|checkout] Manage credits, upgrade to Starter, or inspect settlements
   muxo memory [<query>]                        Recall Muxo Workspace Memory & hybrid context
+  muxo memory add <text> | delete <id>         Save or delete a workspace memory
+  muxo memory facts [<query>] [--current]      List temporal facts with their history (or only current facts)
+  muxo memory forget <text>                    Delete memories and retire facts that match <text>
   muxo governance                              Inspect Muxo Safety & Approvals identity and audit chain
+  muxo governance pause [<reason>] | resume    Turn the workspace kill switch on or off
+  muxo governance scan <text>                  Check text for prompt injection before storing or sending it
+  muxo governance policy [--mode enforce|monitor] [--ring 0-3] [--require-approval write,admin|none]
+                         [--block-destructive-sql true|false] [--max-credits <n>]
+  muxo harness                                 Check API, MCP, auth, governance and catalog; print MCP config
   muxo serve [--port 4310]                     Start unified HTTP Console, Landing, OAuth Callback & MCP server
   muxo mcp                                     Run stdio MCP server (20 canonical tools)
 `);
 }
 runCli()
     .then(() => {
-    process.exit(0);
+    process.exit(Number(process.exitCode ?? 0));
 })
     .catch((err) => {
     console.error("Error:", err?.message || err);