@openwop/cli 0.1.0 → 0.2.0

package/dist/cli.js

@@ -522,7 +522,7 @@ function errText(err) {
 }
 
 // src/constants.ts
-var VERSION = "0.1.0";
+var VERSION = "0.2.0";
 var DEFAULT_BASE_URL = "http://localhost:8080";
 var DEFAULT_REGISTRY_URL = "https://packs.openwop.dev";
 var DEFAULT_API_KEY = "sample-token";
@@ -2317,6 +2317,9 @@ var AGENTS_HELP = `Usage:
   openwop agents list [--json]
   openwop agents info <agentId> [--json]
   openwop agents run <agentId> [--task-json '{...}'] [--tool <id>]... [--threshold <n>] [--no-validate] [--json]
+  openwop agents create --persona <name> [--label <t>] [--description <t>] [--model-class <c>] [--system-prompt <t>] [--tool <id>]... [--threshold <n>] [--json]
+  openwop agents update <agentId> [--persona <n>] [--label <t>] [--description <t>] [--model-class <c>] [--system-prompt <t>] [--tool <id>]... [--threshold <n>] [--json]
+  openwop agents delete <agentId> [--yes]
 
 Manifest agents (RFC 0070). The host loads pack agents[] (RFC 0003) into an
 AgentRegistry and advertises capabilities.agents.manifestRuntime. 'list'/'info'
@@ -2326,10 +2329,17 @@ the agent's toolAllowlist (RFC 0002 \xA7A14), task/return payloads are validated
 against the agent's handoff schemas (RFC 0003 \xA7D, unless --no-validate), and a
 sub-threshold decision escalates rather than proceeding (RFC 0002 \xA7F).
 
-  --task-json J   Inbound task payload (validated against handoff.taskSchemaRef).
-  --tool <id>     A tool the host offers this turn (repeatable); kept only if allowlisted.
-  --threshold <n> Per-run confidence threshold override (default: the agent's).
-  --no-validate   Dispatch with opaque payloads (skip handoff schema validation).
+'create'/'update'/'delete' manage tenant-scoped user-defined agents on the demo
+host (POST/PATCH/DELETE /v1/host/sample/agents) \u2014 distinct from the pack-loaded
+manifest agents that 'list'/'run' operate on.
+
+  --task-json J        Inbound task payload (validated against handoff.taskSchemaRef).
+  --tool <id>          (run) A tool the host offers this turn (repeatable); kept only if allowlisted.
+                       (create/update) An entry in the agent's toolAllowlist (repeatable).
+  --threshold <n>      Confidence threshold (run: per-run override; create/update: the agent's default).
+  --no-validate        (run) Dispatch with opaque payloads (skip handoff schema validation).
+  --persona <name>     (create/update) The agent's persona (required on create).
+  --label / --description / --model-class / --system-prompt  (create/update) Agent metadata.
 
 'run' exits 0 (completed), 3 (escalated), or 1 (failed) so scripts can branch.
 
@@ -2337,10 +2347,12 @@ Examples:
   openwop agents list
   openwop agents info core.openwop.agents.supervisor.default --json
   openwop agents run core.openwop.agents.code-reviewer.default --task-json '{"diff":"..."}' --tool openwop:fs.read
+  openwop agents create --persona "Triage bot" --model-class fast --tool openwop:fs.read
+  openwop agents delete agent_123 --yes
 `;
 async function runAgents(ctx, argv) {
   const sub = argv[0] ?? "list";
-  const args = argv.slice(["list", "info", "run"].includes(sub) ? 1 : 0);
+  const args = argv.slice(["list", "info", "run", "create", "update", "delete"].includes(sub) ? 1 : 0);
   if (sub === "--help" || sub === "-h") {
     write(ctx.io.stdout, AGENTS_HELP);
     return 0;
@@ -2352,11 +2364,84 @@ async function runAgents(ctx, argv) {
       return await runAgentsInfo(ctx, args);
     case "run":
       return await runAgentsRun(ctx, args);
+    case "create":
+      return await runAgentsCreate(ctx, args);
+    case "update":
+      return await runAgentsUpdate(ctx, args);
+    case "delete":
+      return await runAgentsDelete(ctx, args);
     default:
       throw new CliError(`Unknown agents command: ${sub}
 Run \`openwop agents --help\` for usage.`);
   }
 }
+function userAgentBody(options) {
+  const body = {};
+  if (options.persona) body.persona = options.persona;
+  if (options.label) body.label = options.label;
+  if (options.description) body.description = options.description;
+  if (options.modelClass) body.modelClass = options.modelClass;
+  if (options.systemPrompt) body.systemPrompt = options.systemPrompt;
+  if (Array.isArray(options.tool) && options.tool.length) body.toolAllowlist = options.tool;
+  if (options.threshold !== void 0) {
+    const t = Number(options.threshold);
+    if (!Number.isFinite(t) || t < 0 || t > 1) throw new CliError("--threshold must be a number between 0 and 1", 2);
+    body.confidenceThreshold = t;
+  }
+  return body;
+}
+async function runAgentsCreate(ctx, argv) {
+  const { options } = parseOptions(argv, {
+    bool: ["--help"],
+    value: ["--persona", "--label", "--description", "--model-class", "--system-prompt", "--threshold"],
+    multi: ["--tool"]
+  });
+  if (options.help || !options.persona) {
+    write(ctx.io.stdout, "Usage: openwop agents create --persona <name> [--label <t>] [--description <t>] [--model-class <c>] [--system-prompt <t>] [--tool <id>]... [--threshold <n>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await requestJson(ctx, "/v1/host/sample/agents", { method: "POST", body: userAgentBody(options) });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `Created agent ${res.body?.agentId ?? ""} (${res.body?.persona ?? options.persona}).`);
+  return 0;
+}
+async function runAgentsUpdate(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, {
+    bool: ["--help"],
+    value: ["--persona", "--label", "--description", "--model-class", "--system-prompt", "--threshold"],
+    multi: ["--tool"]
+  });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop agents update <agentId> [--persona <n>] [--label <t>] [--description <t>] [--model-class <c>] [--system-prompt <t>] [--tool <id>]... [--threshold <n>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const body = userAgentBody(options);
+  if (Object.keys(body).length === 0) throw new CliError("Nothing to update \u2014 pass at least one field.", 2);
+  const res = await requestJson(ctx, `/v1/host/sample/agents/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `Updated agent ${positionals[0]}.`);
+  return 0;
+}
+async function runAgentsDelete(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop agents delete <agentId> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) {
+    writeLine(ctx.io.stderr, `Refusing to delete agent ${positionals[0]} without --yes.`);
+    return 2;
+  }
+  await requestJson(ctx, `/v1/host/sample/agents/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+  writeLine(ctx.io.stdout, `Deleted agent ${positionals[0]}.`);
+  return 0;
+}
 async function runAgentsList(ctx, argv) {
   const { options } = parseOptions(argv, { bool: ["--help"] });
   if (options.help) {
@@ -2420,9 +2505,9 @@ async function runAgentsRun(ctx, argv) {
   }
   const agentId = positionals[0];
   const body = {};
-  if (options["task-json"] !== void 0) {
+  if (options.taskJson !== void 0) {
     try {
-      body.task = JSON.parse(options["task-json"]);
+      body.task = JSON.parse(options.taskJson);
     } catch {
       throw new CliError("--task-json must be valid JSON", 2);
     }
@@ -2435,7 +2520,7 @@ async function runAgentsRun(ctx, argv) {
     }
     body.confidenceThreshold = t;
   }
-  if (options["no-validate"]) body.validateHandoff = false;
+  if (options.noValidate) body.validateHandoff = false;
   const res = await requestJson(ctx, `/v1/host/sample/agents/${encodeURIComponent(agentId)}/dispatch`, {
     method: "POST",
     body
@@ -2459,85 +2544,1064 @@ async function runAgentsRun(ctx, argv) {
   return r.status === "completed" ? 0 : r.status === "escalated" ? 3 : 1;
 }
 
-// src/cli/conformance.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import { join as join4 } from "node:path";
-var CONFORMANCE_HELP = `Usage: openwop conformance [--offline] [--filter pattern]
+// src/cli/roster.ts
+var ROSTER_HELP = `Usage:
+  openwop roster list [--json]
+  openwop roster get <rosterId> [--json]
+  openwop roster create --persona <name> --agent-ref <agentId> [--agent-version <v> | --agent-channel <c>] [--workflow <id>]... [--label <text>] [--description <text>] [--disabled] [--avatar-url <url>] [--json]
+  openwop roster update <rosterId> [--persona <name>] [--workflow <id>]... [--label <text>] [--description <text>] [--enabled|--disabled] [--avatar-url <url>] [--json]
+  openwop roster delete <rosterId> [--yes]
 
-Runs the in-repo @openwop/openwop-conformance CLI. Without --offline it targets the configured --base-url.
+Agent roster (RFC 0086). A roster entry is a named, tenant-scoped standing
+agent that owns a portfolio of workflows[]; its triggers compose RFC 0052
+(schedules) + RFC 0083 (the durable trigger bridge), and a run it initiates
+emits the content-free roster.run.initiated attribution event. Drives the
+host-extension surface POST/GET/PATCH/DELETE /v1/host/sample/roster.
+
+  --persona <name>   The agent's display persona (required on create).
+  --agent-ref <id>   The agentId this entry binds to (RFC 0002 AgentRef; required on create).
+  --agent-version <v> | --agent-channel <c>   Pin the AgentRef to a version XOR a channel.
+  --workflow <id>    A workflow in the entry's portfolio (repeatable).
+  --label <text>     Short human label.
+  --description <t>  Longer description.
+  --enabled          (update) Re-enable the entry's triggers + heartbeat.
+  --disabled         Create/leave the entry paused (triggers inert).
+  --avatar-url <url> Photo URL for the entry.
+
+Examples:
+  openwop roster list
+  openwop roster create --persona "Sally" --workflow sample.demo.triage --label "Support lead"
+  openwop roster update r_123 --disabled
+  openwop roster delete r_123 --yes
 `;
-async function runConformance(ctx, argv) {
+async function runRoster(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, ROSTER_HELP);
+    return 0;
+  }
+  const args = argv.slice(["list", "get", "create", "update", "delete"].includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "list":
+      return await rosterList(ctx, args);
+    case "get":
+      return await rosterGet(ctx, args);
+    case "create":
+      return await rosterCreate(ctx, args);
+    case "update":
+      return await rosterUpdate(ctx, args);
+    case "delete":
+      return await rosterDelete(ctx, args);
+    default:
+      throw new CliError(`Unknown roster command: ${sub}
+Run \`openwop roster --help\` for usage.`);
+  }
+}
+async function rosterList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, ROSTER_HELP);
+    return 0;
+  }
+  const res = await requestJson(ctx, "/v1/host/sample/roster");
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const roster = Array.isArray(res.body?.roster) ? res.body.roster : [];
+  if (roster.length === 0) {
+    writeLine(ctx.io.stdout, "No roster entries on this host. Create one with `openwop roster create --persona <name>`.");
+    return 0;
+  }
+  const rows = roster.map((e) => ({
+    rosterId: e.rosterId,
+    persona: e.persona,
+    label: e.label ?? "",
+    workflows: Array.isArray(e.workflows) ? String(e.workflows.length) : "0",
+    enabled: e.enabled === false ? "no" : "yes"
+  }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["rosterId", "persona", "label", "workflows", "enabled"]));
+  return 0;
+}
+async function rosterGet(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop roster get <rosterId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await requestJson(ctx, `/v1/host/sample/roster/${encodeURIComponent(positionals[0])}`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const e = res.body ?? {};
+  writeLine(ctx.io.stdout, `rosterId: ${e.rosterId ?? positionals[0]}`);
+  writeLine(ctx.io.stdout, `persona: ${e.persona ?? ""}`);
+  if (e.label) writeLine(ctx.io.stdout, `label: ${e.label}`);
+  if (e.agentRef) writeLine(ctx.io.stdout, `agentRef: ${typeof e.agentRef === "string" ? e.agentRef : JSON.stringify(e.agentRef)}`);
+  writeLine(ctx.io.stdout, `enabled: ${e.enabled === false ? "no" : "yes"}`);
+  writeLine(ctx.io.stdout, `workflows: ${Array.isArray(e.workflows) && e.workflows.length ? e.workflows.join(", ") : "(none)"}`);
+  if (e.description) writeLine(ctx.io.stdout, `description: ${e.description}`);
+  return 0;
+}
+async function rosterCreate(ctx, argv) {
   const { options } = parseOptions(argv, {
-    bool: ["--help", "--offline"],
-    value: ["--filter"]
+    bool: ["--help", "--disabled"],
+    value: ["--persona", "--agent-ref", "--agent-version", "--agent-channel", "--label", "--description", "--avatar-url"],
+    multi: ["--workflow"]
+  });
+  if (options.help || !options.persona || !options.agentRef) {
+    write(ctx.io.stdout, "Usage: openwop roster create --persona <name> --agent-ref <agentId> [--agent-version <v> | --agent-channel <c>] [--workflow <id>]... [--label <t>] [--description <t>] [--disabled] [--avatar-url <url>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  if (options.agentVersion && options.agentChannel) {
+    throw new CliError("--agent-version and --agent-channel are mutually exclusive (RFC 0082 \xA7A).", 2);
+  }
+  const agentRef = { agentId: options.agentRef };
+  if (options.agentVersion) agentRef.version = options.agentVersion;
+  if (options.agentChannel) agentRef.channel = options.agentChannel;
+  const body = { persona: options.persona, agentRef };
+  if (Array.isArray(options.workflow) && options.workflow.length) body.workflows = options.workflow;
+  if (options.label) body.label = options.label;
+  if (options.description) body.description = options.description;
+  if (options.disabled) body.enabled = false;
+  if (options.avatarUrl) body.avatarUrl = options.avatarUrl;
+  const res = await requestJson(ctx, "/v1/host/sample/roster", { method: "POST", body });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `Created roster entry ${res.body?.rosterId} (${res.body?.persona}).`);
+  return 0;
+}
+async function rosterUpdate(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, {
+    bool: ["--help", "--enabled", "--disabled"],
+    value: ["--persona", "--label", "--description", "--avatar-url"],
+    multi: ["--workflow"]
   });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop roster update <rosterId> [--persona <n>] [--workflow <id>]... [--label <t>] [--description <t>] [--enabled|--disabled] [--avatar-url <url>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  if (options.enabled && options.disabled) throw new CliError("Pass only one of --enabled / --disabled", 2);
+  const body = {};
+  if (options.persona) body.persona = options.persona;
+  if (Array.isArray(options.workflow) && options.workflow.length) body.workflows = options.workflow;
+  if (options.label) body.label = options.label;
+  if (options.description) body.description = options.description;
+  if (options.enabled) body.enabled = true;
+  if (options.disabled) body.enabled = false;
+  if (options.avatarUrl) body.avatarUrl = options.avatarUrl;
+  const res = await requestJson(ctx, `/v1/host/sample/roster/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `Updated roster entry ${res.body?.rosterId ?? positionals[0]}.`);
+  return 0;
+}
+async function rosterDelete(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop roster delete <rosterId> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) {
+    writeLine(ctx.io.stderr, `Refusing to delete ${positionals[0]} without --yes (this removes the roster entry and its triggers).`);
+    return 2;
+  }
+  await requestJson(ctx, `/v1/host/sample/roster/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+  writeLine(ctx.io.stdout, `Deleted roster entry ${positionals[0]}.`);
+  return 0;
+}
+
+// src/cli/orgChart.ts
+import { readFile as readFile2 } from "node:fs/promises";
+var ORG_CHART_HELP = `Usage:
+  openwop org-chart get [--json]
+  openwop org-chart dept <departmentId> [--no-recursive] [--json]
+  openwop org-chart set --file <chart.json> [--json]
+  openwop org-chart clear [--yes]
+
+Org chart (RFC 0087). A purely DESCRIPTIVE map of departments, roles, and
+reportsTo edges \u2014 it confers no authority (the org-position-no-authority-
+escalation invariant: the schema carries no permissions/scopes/canDispatch
+field). Drives the host-extension surface GET/PUT/DELETE
+/v1/host/sample/org-chart. 'set' replaces the whole chart from a JSON file
+with { "departments": [...], "members": [...] }.
+
+  --no-recursive   (dept) Show only the named department, not its sub-tree.
+  --file <path>    (set) JSON document with departments[] + members[] arrays.
+
+Examples:
+  openwop org-chart get
+  openwop org-chart dept engineering
+  openwop org-chart set --file ./org.json
+  openwop org-chart clear --yes
+`;
+async function runOrgChart(ctx, argv) {
+  const sub = argv[0] ?? "get";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, ORG_CHART_HELP);
+    return 0;
+  }
+  const args = argv.slice(["get", "dept", "set", "clear"].includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "get":
+      return await orgChartGet(ctx, args);
+    case "dept":
+      return await orgChartDept(ctx, args);
+    case "set":
+      return await orgChartSet(ctx, args);
+    case "clear":
+      return await orgChartClear(ctx, args);
+    default:
+      throw new CliError(`Unknown org-chart command: ${sub}
+Run \`openwop org-chart --help\` for usage.`);
+  }
+}
+async function orgChartGet(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
   if (options.help) {
-    write(ctx.io.stdout, CONFORMANCE_HELP);
+    write(ctx.io.stdout, ORG_CHART_HELP);
     return 0;
   }
-  const root = requireRepoRoot(ctx);
-  const args = ["run", "cli", "--"];
-  if (options.offline) {
-    args.push("--offline");
-  } else {
-    args.push("--base-url", ctx.baseUrl, "--api-key", ctx.apiKey ?? DEFAULT_API_KEY);
+  const res = await requestJson(ctx, "/v1/host/sample/org-chart");
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
   }
-  if (options.filter) args.push("--filter", options.filter);
-  const result = spawnSync2(npmCommand(), args, {
-    cwd: join4(root, "conformance"),
-    stdio: "inherit",
-    env: ctx.env
+  const chart = res.body ?? {};
+  const departments = Array.isArray(chart.departments) ? chart.departments : [];
+  const members = Array.isArray(chart.members) ? chart.members : [];
+  if (departments.length === 0 && members.length === 0) {
+    writeLine(ctx.io.stdout, "Org chart is empty. Populate it with `openwop org-chart set --file <chart.json>`.");
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `Departments (${departments.length}):`);
+  if (departments.length) {
+    writeLine(ctx.io.stdout, formatTable(departments.map((d) => ({
+      departmentId: d.departmentId ?? d.id,
+      name: d.name ?? "",
+      reportsTo: d.reportsTo ?? d.parentId ?? ""
+    })), ["departmentId", "name", "reportsTo"]));
+  }
+  writeLine(ctx.io.stdout, `
+Members (${members.length}):`);
+  if (members.length) {
+    writeLine(ctx.io.stdout, formatTable(members.map((m) => ({
+      memberId: m.memberId ?? m.id,
+      name: m.name ?? m.displayName ?? "",
+      role: m.role ?? "",
+      department: m.departmentId ?? ""
+    })), ["memberId", "name", "role", "department"]));
+  }
+  return 0;
+}
+async function orgChartDept(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--no-recursive"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop org-chart dept <departmentId> [--no-recursive] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const recursive = options.noRecursive ? "false" : "true";
+  const res = await requestJson(ctx, `/v1/host/sample/org-chart/${encodeURIComponent(positionals[0])}?recursive=${recursive}`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeJson(ctx.io.stdout, res.body);
+  return 0;
+}
+async function orgChartSet(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--file"] });
+  if (options.help || !options.file) {
+    write(ctx.io.stdout, "Usage: openwop org-chart set --file <chart.json> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile2(options.file, "utf8"));
+  } catch (err) {
+    throw new CliError(`Could not read/parse ${options.file}: ${err instanceof Error ? err.message : String(err)}`, 2);
+  }
+  if (!Array.isArray(parsed?.departments) || !Array.isArray(parsed?.members)) {
+    throw new CliError("The chart file MUST be a JSON object with `departments` and `members` arrays.", 2);
+  }
+  const res = await requestJson(ctx, "/v1/host/sample/org-chart", {
+    method: "PUT",
+    body: { departments: parsed.departments, members: parsed.members }
   });
-  return result.status ?? 1;
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const chart = res.body ?? {};
+  writeLine(ctx.io.stdout, `Set org chart: ${Array.isArray(chart.departments) ? chart.departments.length : 0} departments, ${Array.isArray(chart.members) ? chart.members.length : 0} members.`);
+  return 0;
+}
+async function orgChartClear(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help", "--yes"] });
+  if (options.help) {
+    write(ctx.io.stdout, "Usage: openwop org-chart clear [--yes]\n");
+    return 0;
+  }
+  if (!options.yes) {
+    writeLine(ctx.io.stderr, "Refusing to clear the org chart without --yes.");
+    return 2;
+  }
+  await requestJson(ctx, "/v1/host/sample/org-chart", { method: "DELETE" });
+  writeLine(ctx.io.stdout, "Cleared the org chart.");
+  return 0;
 }
 
-// src/prompt.ts
-import { createInterface as createInterface3 } from "node:readline";
-async function promptChoice(ctx, label, choices) {
-  writeLine(ctx.io.stdout, label);
-  choices.forEach((c, i) => {
-    const tag = c.recommended ? " (recommended)" : "";
-    writeLine(ctx.io.stdout, `  ${i + 1}) ${c.label}${tag}`);
-  });
-  const defaultIdx = Math.max(0, choices.findIndex((c) => c.recommended));
-  const answer = await promptText(ctx, `Choice [${defaultIdx + 1}]: `, "");
-  const idx = answer.trim() === "" ? defaultIdx : Number(answer.trim()) - 1;
-  if (!Number.isInteger(idx) || idx < 0 || idx >= choices.length) {
-    throw new CliError(`Invalid choice: ${answer}`);
+// src/cli/kanban.ts
+var KANBAN_HELP = `Usage:
+  openwop kanban boards [--json]
+  openwop kanban board <boardId> [--json]
+  openwop kanban board-create --name <name> [--column <id:Label>]... [--trigger-workflow <id>] [--roster <rosterId>] [--json]
+  openwop kanban board-delete <boardId> [--yes]
+  openwop kanban card-add <boardId> --title <text> [--column <columnId>] [--description <text>] [--workflow <id>] [--priority <p>] [--json]
+  openwop kanban card-move <cardId> --column <columnId> [--json]
+  openwop kanban card-update <cardId> [--title <text>] [--description <text>] [--column <columnId>] [--workflow <id>] [--json]
+  openwop kanban card-delete <cardId> [--yes]
+  openwop kanban watch <boardId>
+
+Kanban boards (host-extension under /v1/host/sample/kanban). A board is a lane
+of cards an agent works; a board MAY bind to an RFC 0086 roster entry so its
+To Do column fires the named agent's first portfolio workflow. 'watch' streams
+the board's server-sent card events until interrupted.
+
+  --column <id:Label>  (board-create) A column, repeatable; default lanes if omitted.
+  --trigger-workflow   (board-create) Workflow the To Do column fires.
+  --roster <rosterId>  (board-create) Bind the board to a roster entry (RFC 0086).
+  --priority <p>       (card-add) low | normal | high | urgent.
+
+Examples:
+  openwop kanban boards
+  openwop kanban board-create --name "Sally's work" --roster r_123
+  openwop kanban card-add b_1 --title "Triage inbox" --column todo
+  openwop kanban card-move c_9 --column working
+  openwop kanban watch b_1
+`;
+async function runKanban(ctx, argv) {
+  const sub = argv[0] ?? "boards";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, KANBAN_HELP);
+    return 0;
+  }
+  const known = ["boards", "board", "board-create", "board-delete", "card-add", "card-move", "card-update", "card-delete", "watch"];
+  const args = argv.slice(known.includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "boards":
+      return await boardsList(ctx, args);
+    case "board":
+      return await boardGet(ctx, args);
+    case "board-create":
+      return await boardCreate(ctx, args);
+    case "board-delete":
+      return await boardDelete(ctx, args);
+    case "card-add":
+      return await cardAdd(ctx, args);
+    case "card-move":
+      return await cardPatch(ctx, args, true);
+    case "card-update":
+      return await cardPatch(ctx, args, false);
+    case "card-delete":
+      return await cardDelete(ctx, args);
+    case "watch":
+      return await boardWatch(ctx, args);
+    default:
+      throw new CliError(`Unknown kanban command: ${sub}
+Run \`openwop kanban --help\` for usage.`);
   }
-  return choices[idx].key;
 }
-async function promptText(ctx, prompt, defaultValue = "") {
-  ctx.io.stdout.write(prompt);
-  const rl = createInterface3({ input: process.stdin, output: process.stdout, terminal: false });
-  return new Promise((resolve) => {
-    rl.once("line", (line) => {
-      rl.close();
-      resolve(line.length > 0 ? line : defaultValue);
-    });
-  });
+async function boardsList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, KANBAN_HELP);
+    return 0;
+  }
+  const res = await requestJson(ctx, "/v1/host/sample/kanban/boards");
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const boards = Array.isArray(res.body?.boards) ? res.body.boards : Array.isArray(res.body) ? res.body : [];
+  if (boards.length === 0) {
+    writeLine(ctx.io.stdout, "No boards on this host. Create one with `openwop kanban board-create --name <name>`.");
+    return 0;
+  }
+  writeLine(ctx.io.stdout, formatTable(boards.map((b) => ({
+    boardId: b.id ?? b.boardId,
+    name: b.name ?? "",
+    columns: Array.isArray(b.columns) ? String(b.columns.length) : "0",
+    roster: b.rosterId ?? ""
+  })), ["boardId", "name", "columns", "roster"]));
+  return 0;
 }
-async function promptYesNo(ctx, label, defaultYes = true) {
-  const hint = defaultYes ? "[Y/n]" : "[y/N]";
-  const answer = (await promptText(ctx, `${label} ${hint} `, "")).trim().toLowerCase();
-  if (answer === "") return defaultYes;
-  return answer === "y" || answer === "yes";
+async function boardGet(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop kanban board <boardId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await requestJson(ctx, `/v1/host/sample/kanban/boards/${encodeURIComponent(positionals[0])}`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const b = res.body ?? {};
+  writeLine(ctx.io.stdout, `board: ${b.id ?? positionals[0]} \u2014 ${b.name ?? ""}`);
+  if (b.rosterId) writeLine(ctx.io.stdout, `roster: ${b.rosterId}`);
+  const columns = Array.isArray(b.columns) ? b.columns : [];
+  const cards = Array.isArray(b.cards) ? b.cards : [];
+  for (const col of columns) {
+    const inCol = cards.filter((c) => c.columnId === col.id);
+    writeLine(ctx.io.stdout, `
+[${col.name ?? col.id}] (${inCol.length})`);
+    for (const c of inCol) writeLine(ctx.io.stdout, `  \xB7 ${c.id}  ${c.title}`);
+  }
+  return 0;
 }
-async function readSecret(ctx, prompt) {
-  ctx.io.stdout.write(prompt);
-  const stdin = process.stdin;
-  if (!stdin.isTTY) {
-    const rl = createInterface3({ input: stdin, output: process.stdout, terminal: false });
-    return new Promise((resolve) => {
-      rl.once("line", (line) => {
-        rl.close();
-        resolve(line);
-      });
+async function boardCreate(ctx, argv) {
+  const { options } = parseOptions(argv, {
+    bool: ["--help"],
+    value: ["--name", "--trigger-workflow", "--roster"],
+    multi: ["--column"]
+  });
+  if (options.help || !options.name) {
+    write(ctx.io.stdout, "Usage: openwop kanban board-create --name <name> [--column <id:Label>]... [--trigger-workflow <id>] [--roster <rosterId>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const body = { name: options.name };
+  if (Array.isArray(options.column) && options.column.length) {
+    body.columns = options.column.map((spec) => {
+      const [id, ...rest] = spec.split(":");
+      return { id, name: rest.length ? rest.join(":") : id };
     });
   }
-  return new Promise((resolve, reject) => {
-    stdin.setRawMode(true);
-    stdin.resume();
+  if (options.triggerWorkflow) body.triggerWorkflowId = options.triggerWorkflow;
+  if (options.roster) body.rosterId = options.roster;
+  const res = await requestJson(ctx, "/v1/host/sample/kanban/boards", { method: "POST", body });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `Created board ${res.body?.id ?? res.body?.boardId} (${res.body?.name}).`);
+  return 0;
+}
+async function boardDelete(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop kanban board-delete <boardId> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) {
+    writeLine(ctx.io.stderr, `Refusing to delete board ${positionals[0]} without --yes (this removes the board and its cards).`);
+    return 2;
+  }
+  await requestJson(ctx, `/v1/host/sample/kanban/boards/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+  writeLine(ctx.io.stdout, `Deleted board ${positionals[0]}.`);
+  return 0;
+}
+async function cardAdd(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, {
+    bool: ["--help"],
+    value: ["--title", "--column", "--description", "--workflow", "--priority"]
+  });
+  if (options.help || positionals.length !== 1 || !options.title) {
+    write(ctx.io.stdout, "Usage: openwop kanban card-add <boardId> --title <text> [--column <columnId>] [--description <text>] [--workflow <id>] [--priority <p>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const body = { title: options.title };
+  if (options.column) body.columnId = options.column;
+  if (options.description) body.description = options.description;
+  if (options.workflow) body.workflowId = options.workflow;
+  if (options.priority) body.priority = options.priority;
+  const res = await requestJson(ctx, `/v1/host/sample/kanban/boards/${encodeURIComponent(positionals[0])}/cards`, { method: "POST", body });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `Added card ${res.body?.id ?? ""} to board ${positionals[0]}.`);
+  return 0;
+}
+async function cardPatch(ctx, argv, moveOnly) {
+  const { options, positionals } = parseOptions(argv, {
+    bool: ["--help"],
+    value: ["--title", "--description", "--column", "--workflow"]
+  });
+  const usage = moveOnly ? "Usage: openwop kanban card-move <cardId> --column <columnId> [--json]\n" : "Usage: openwop kanban card-update <cardId> [--title <t>] [--description <t>] [--column <columnId>] [--workflow <id>] [--json]\n";
+  if (options.help || positionals.length !== 1 || moveOnly && !options.column) {
+    write(ctx.io.stdout, usage);
+    return options.help ? 0 : 2;
+  }
+  const body = {};
+  if (options.column) body.columnId = options.column;
+  if (!moveOnly) {
+    if (options.title) body.title = options.title;
+    if (options.description) body.description = options.description;
+    if (options.workflow) body.workflowId = options.workflow;
+  }
+  if (Object.keys(body).length === 0) throw new CliError("Nothing to update \u2014 pass at least one field.", 2);
+  const res = await requestJson(ctx, `/v1/host/sample/kanban/cards/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `Updated card ${positionals[0]}.`);
+  return 0;
+}
+async function cardDelete(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop kanban card-delete <cardId> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) {
+    writeLine(ctx.io.stderr, `Refusing to delete card ${positionals[0]} without --yes.`);
+    return 2;
+  }
+  await requestJson(ctx, `/v1/host/sample/kanban/cards/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+  writeLine(ctx.io.stdout, `Deleted card ${positionals[0]}.`);
+  return 0;
+}
+async function boardWatch(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop kanban watch <boardId>\n");
+    return options.help ? 0 : 2;
+  }
+  const url = new URL(`v1/host/sample/kanban/boards/${encodeURIComponent(positionals[0])}/events`, ctx.baseUrl.endsWith("/") ? ctx.baseUrl : `${ctx.baseUrl}/`);
+  const headers = { accept: "text/event-stream" };
+  if (ctx.apiKey) headers.authorization = `Bearer ${ctx.apiKey}`;
+  const res = await ctx.fetchImpl(url, { headers });
+  if (!res.ok || !res.body) {
+    throw new CliError(`Could not open the board event stream (HTTP ${res.status}).`, 1);
+  }
+  writeLine(ctx.io.stdout, `Watching board ${positionals[0]} (Ctrl-C to stop)\u2026`);
+  await consumeSse(res.body, (frame) => {
+    if (ctx.json) {
+      writeLine(ctx.io.stdout, JSON.stringify(frame));
+      return;
+    }
+    const type = frame.event ?? "message";
+    writeLine(ctx.io.stdout, `\xB7 ${type}${frame.data ? `: ${frame.data}` : ""}`);
+  });
+  return 0;
+}
+
+// src/cli/accessControl.ts
+var ORGS_HELP = `Usage:
+  openwop orgs list [--json]
+  openwop orgs get <orgId> [--json]
+  openwop orgs create --name <name> [--description <text>] [--json]
+  openwop orgs update <orgId> [--name <name>] [--description <text>] [--json]
+  openwop orgs delete <orgId> [--yes]
+
+  openwop orgs teams   <orgId> list|create|update|delete [...]
+  openwop orgs groups  <orgId> list|create|update|delete [...]
+  openwop orgs roles   <orgId> list|create|update|delete [...]
+  openwop orgs members <orgId> list|create|update|delete [...]
+
+  openwop orgs role-catalog [--json]          # the host's global role catalog (GET /roles)
+  openwop orgs effective [--subject <id>] [--json]   # effective access for a subject (GET /access/effective)
+
+Organizations + RBAC (RFC 0049, authorization fail-closed). Orgs own teams,
+groups, roles, and members; an effective-access query resolves a subject's
+granted scopes. Drives the host-extension surface under /v1/host/sample/orgs,
+/v1/host/sample/roles, and /v1/host/sample/access/effective.
+
+Nested-entity flags:
+  teams   create/update  --name <n> [--description <t>] [--color <c>]
+  groups  create/update  --name <n> [--description <t>] [--role <id>]... [--member <id>]...
+  roles   create/update  --name <n> [--description <t>] [--scope <s>]...
+  members create         --subject <id> --display-name <n> [--email <e>] [--role <id>]... [--team <id>]...
+  members update         [--display-name <n>] [--email <e>] [--role <id>]... [--team <id>]...
+
+Examples:
+  openwop orgs create --name "Acme"
+  openwop orgs teams o_1 create --name "Support" --color blue
+  openwop orgs roles o_1 create --name "Reviewer" --scope runs:read --scope runs:annotate
+  openwop orgs members o_1 create --subject user:jo --display-name "Jo" --role role_reviewer --team t_support
+  openwop orgs effective --subject user:jo
+`;
+var ENTITIES = ["teams", "groups", "roles", "members"];
+async function runOrgs(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, ORGS_HELP);
+    return 0;
+  }
+  if (ENTITIES.includes(sub)) {
+    return await runEntity(ctx, sub, argv.slice(1));
+  }
+  const args = ["list", "get", "create", "update", "delete", "role-catalog", "effective"].includes(sub) ? argv.slice(1) : argv;
+  switch (sub) {
+    case "list":
+      return await orgsList(ctx, args);
+    case "get":
+      return await orgsGet(ctx, args);
+    case "create":
+      return await orgsCreate(ctx, args);
+    case "update":
+      return await orgsUpdate(ctx, args);
+    case "delete":
+      return await orgsDelete(ctx, args);
+    case "role-catalog":
+      return await roleCatalog(ctx, args);
+    case "effective":
+      return await effectiveAccess(ctx, args);
+    default:
+      throw new CliError(`Unknown orgs command: ${sub}
+Run \`openwop orgs --help\` for usage.`);
+  }
+}
+async function orgsList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, ORGS_HELP);
+    return 0;
+  }
+  const res = await requestJson(ctx, "/v1/host/sample/orgs");
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const orgs = arrayOf(res.body, "orgs");
+  if (orgs.length === 0) {
+    writeLine(ctx.io.stdout, "No organizations. Create one with `openwop orgs create --name <name>`.");
+    return 0;
+  }
+  writeLine(ctx.io.stdout, formatTable(orgs.map((o) => ({
+    orgId: o.orgId ?? o.id,
+    name: o.name ?? "",
+    description: o.description ?? ""
+  })), ["orgId", "name", "description"]));
+  return 0;
+}
+async function orgsGet(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop orgs get <orgId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await requestJson(ctx, `/v1/host/sample/orgs/${encodeURIComponent(positionals[0])}`);
+  writeJson(ctx.io.stdout, res.body);
+  return 0;
+}
+async function orgsCreate(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--name", "--description"] });
+  if (options.help || !options.name) {
+    write(ctx.io.stdout, "Usage: openwop orgs create --name <name> [--description <text>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const body = { name: options.name };
+  if (options.description) body.description = options.description;
+  const res = await requestJson(ctx, "/v1/host/sample/orgs", { method: "POST", body });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `Created org ${res.body?.orgId ?? res.body?.id} (${res.body?.name}).`);
+  return 0;
+}
+async function orgsUpdate(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--name", "--description"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop orgs update <orgId> [--name <name>] [--description <text>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const body = {};
+  if (options.name) body.name = options.name;
+  if (options.description) body.description = options.description;
+  if (Object.keys(body).length === 0) throw new CliError("Nothing to update \u2014 pass --name and/or --description.", 2);
+  const res = await requestJson(ctx, `/v1/host/sample/orgs/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `Updated org ${positionals[0]}.`);
+  return 0;
+}
+async function orgsDelete(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop orgs delete <orgId> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) {
+    writeLine(ctx.io.stderr, `Refusing to delete org ${positionals[0]} without --yes (removes its teams, roles, and memberships).`);
+    return 2;
+  }
+  await requestJson(ctx, `/v1/host/sample/orgs/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+  writeLine(ctx.io.stdout, `Deleted org ${positionals[0]}.`);
+  return 0;
+}
+async function roleCatalog(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, "Usage: openwop orgs role-catalog [--json]\n");
+    return 0;
+  }
+  const res = await requestJson(ctx, "/v1/host/sample/roles");
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const roles = arrayOf(res.body, "roles");
+  writeLine(ctx.io.stdout, formatTable(roles.map((r) => ({
+    roleId: r.roleId ?? r.id,
+    name: r.name ?? "",
+    scopes: Array.isArray(r.scopes) ? r.scopes.join(",") : ""
+  })), ["roleId", "name", "scopes"]));
+  return 0;
+}
+async function effectiveAccess(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--subject"] });
+  if (options.help) {
+    write(ctx.io.stdout, "Usage: openwop orgs effective [--subject <id>] [--json]\n");
+    return 0;
+  }
+  const q = options.subject ? `?subject=${encodeURIComponent(options.subject)}` : "";
+  const res = await requestJson(ctx, `/v1/host/sample/access/effective${q}`);
+  writeJson(ctx.io.stdout, res.body);
+  return 0;
+}
+async function runEntity(ctx, entity, argv) {
+  const orgId = argv[0];
+  const verb = argv[1] ?? "list";
+  if (!orgId || orgId === "--help" || orgId === "-h") {
+    write(ctx.io.stdout, `Usage: openwop orgs ${entity} <orgId> list|create|update|delete [...]
+`);
+    return orgId ? 0 : 2;
+  }
+  const rest = argv.slice(2);
+  const base = `/v1/host/sample/orgs/${encodeURIComponent(orgId)}/${entity}`;
+  switch (verb) {
+    case "list": {
+      const res = await requestJson(ctx, base);
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      const items = arrayOf(res.body, entity);
+      if (items.length === 0) {
+        writeLine(ctx.io.stdout, `No ${entity} in org ${orgId}.`);
+        return 0;
+      }
+      writeJson(ctx.io.stdout, items);
+      return 0;
+    }
+    case "create": {
+      const { body, ok: ok3 } = entityBody(ctx, entity, rest, true);
+      if (!ok3) return 2;
+      const res = await requestJson(ctx, base, { method: "POST", body });
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      writeLine(ctx.io.stdout, `Created ${singular(entity)} in org ${orgId}.`);
+      return 0;
+    }
+    case "update": {
+      const { positionals } = parseOptions(rest, { bool: ["--help"], value: passThroughValues(entity), multi: passThroughMulti(entity) });
+      if (positionals.length !== 1) {
+        writeLine(ctx.io.stderr, `Usage: openwop orgs ${entity} <orgId> update <${singular(entity)}Id> [...]`);
+        return 2;
+      }
+      const { body, ok: ok3 } = entityBody(ctx, entity, rest, false);
+      if (!ok3) return 2;
+      const res = await requestJson(ctx, `${base}/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body });
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, res.body);
+        return 0;
+      }
+      writeLine(ctx.io.stdout, `Updated ${singular(entity)} ${positionals[0]}.`);
+      return 0;
+    }
+    case "delete": {
+      const { options, positionals } = parseOptions(rest, { bool: ["--help", "--yes"] });
+      if (options.help || positionals.length !== 1) {
+        writeLine(ctx.io.stderr, `Usage: openwop orgs ${entity} <orgId> delete <${singular(entity)}Id> [--yes]`);
+        return options.help ? 0 : 2;
+      }
+      if (!options.yes) {
+        writeLine(ctx.io.stderr, `Refusing to delete ${singular(entity)} ${positionals[0]} without --yes.`);
+        return 2;
+      }
+      await requestJson(ctx, `${base}/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+      writeLine(ctx.io.stdout, `Deleted ${singular(entity)} ${positionals[0]}.`);
+      return 0;
+    }
+    default:
+      throw new CliError(`Unknown ${entity} verb: ${verb}`);
+  }
+}
+function passThroughValues(entity) {
+  switch (entity) {
+    case "teams":
+      return ["--name", "--description", "--color"];
+    case "groups":
+      return ["--name", "--description"];
+    case "roles":
+      return ["--name", "--description"];
+    case "members":
+      return ["--subject", "--display-name", "--email"];
+  }
+}
+function passThroughMulti(entity) {
+  switch (entity) {
+    case "groups":
+      return ["--role", "--member"];
+    case "roles":
+      return ["--scope"];
+    case "members":
+      return ["--role", "--team"];
+    default:
+      return [];
+  }
+}
+function entityBody(ctx, entity, argv, requireName) {
+  const { options } = parseOptions(argv, { bool: ["--help", "--yes"], value: passThroughValues(entity), multi: passThroughMulti(entity) });
+  const body = {};
+  const setIf = (k, v) => {
+    if (v !== void 0) body[k] = v;
+  };
+  switch (entity) {
+    case "teams":
+      setIf("name", options.name);
+      setIf("description", options.description);
+      setIf("color", options.color);
+      break;
+    case "roles":
+      setIf("name", options.name);
+      setIf("description", options.description);
+      if (Array.isArray(options.scope) && options.scope.length) body.scopes = options.scope;
+      break;
+    case "groups":
+      setIf("name", options.name);
+      setIf("description", options.description);
+      if (Array.isArray(options.role) && options.role.length) body.roles = options.role;
+      if (Array.isArray(options.member) && options.member.length) body.memberIds = options.member;
+      break;
+    case "members":
+      setIf("subject", options.subject);
+      setIf("displayName", options.displayName);
+      setIf("email", options.email);
+      if (Array.isArray(options.role) && options.role.length) body.roles = options.role;
+      if (Array.isArray(options.team) && options.team.length) body.teamIds = options.team;
+      break;
+  }
+  if (requireName) {
+    if (entity === "members") {
+      if (!body.subject || !body.displayName) {
+        writeLine(ctx.io.stderr, "members create requires --subject and --display-name.");
+        return { body, ok: false };
+      }
+    } else if (!body.name) {
+      writeLine(ctx.io.stderr, `${entity} create requires --name.`);
+      return { body, ok: false };
+    }
+  } else if (Object.keys(body).length === 0) {
+    writeLine(ctx.io.stderr, `Nothing to update \u2014 pass at least one field for ${entity}.`);
+    return { body, ok: false };
+  }
+  return { body, ok: true };
+}
+function singular(entity) {
+  return entity === "teams" ? "team" : entity === "groups" ? "group" : entity === "roles" ? "role" : "member";
+}
+function arrayOf(body, key) {
+  if (Array.isArray(body)) return body;
+  if (body && Array.isArray(body[key])) return body[key];
+  return [];
+}
+
+// src/cli/workspace.ts
+import { readFile as readFile3 } from "node:fs/promises";
+var WORKSPACE_HELP = `Usage:
+  openwop workspace list [--prefix <p>] [--json]
+  openwop workspace get <path> [--json]
+  openwop workspace put <path> (--content <text> | --file <localPath>) [--content-type <ct>] [--if-match <etag>] [--json]
+  openwop workspace delete <path> [--yes]
+
+Agent workspace (RFC 0059 \xA7C). A tenant-scoped file area an agent reads and
+writes during a run, with optimistic concurrency via ETag / If-Match (WCT-1
+cross-owner isolation is enforced host-side). Drives the real CRUD surface
+GET/PUT/DELETE /v1/host/workspace/files. (The /v1/host/sample/workspace/op
+cross-owner seam is a conformance-only test seam and is intentionally not
+exposed here.)
+
+  --prefix <p>      (list) Only files whose path starts with this prefix.
+  --content <text>  (put) Inline file content.
+  --file <path>     (put) Read content from a local file instead of --content.
+  --content-type    (put) MIME type to store.
+  --if-match <etag> (put) Only write if the current ETag matches (optimistic lock).
+
+Examples:
+  openwop workspace list
+  openwop workspace put notes/todo.md --content "- ship it"
+  openwop workspace get notes/todo.md
+  openwop workspace delete notes/todo.md --yes
+`;
+async function runWorkspace(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, WORKSPACE_HELP);
+    return 0;
+  }
+  const args = argv.slice(["list", "get", "put", "delete"].includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "list":
+      return await wsList(ctx, args);
+    case "get":
+      return await wsGet(ctx, args);
+    case "put":
+      return await wsPut(ctx, args);
+    case "delete":
+      return await wsDelete(ctx, args);
+    default:
+      throw new CliError(`Unknown workspace command: ${sub}
+Run \`openwop workspace --help\` for usage.`);
+  }
+}
+async function wsList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--prefix"] });
+  if (options.help) {
+    write(ctx.io.stdout, WORKSPACE_HELP);
+    return 0;
+  }
+  const q = options.prefix ? `?prefix=${encodeURIComponent(options.prefix)}` : "";
+  const res = await requestJson(ctx, `/v1/host/workspace/files${q}`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const files = Array.isArray(res.body?.files) ? res.body.files : [];
+  if (files.length === 0) {
+    writeLine(ctx.io.stdout, "No files in the workspace.");
+    return 0;
+  }
+  writeLine(ctx.io.stdout, formatTable(files.map((f) => ({
+    path: f.path ?? f.name ?? "",
+    size: f.size ?? (typeof f.content === "string" ? String(f.content.length) : ""),
+    contentType: f.contentType ?? "",
+    etag: f.etag ?? ""
+  })), ["path", "size", "contentType", "etag"]));
+  return 0;
+}
+async function wsGet(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop workspace get <path> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await requestJson(ctx, `/v1/host/workspace/files/${encodeURIComponent(positionals[0])}`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const f = res.body ?? {};
+  if (f.etag) writeLine(ctx.io.stderr, `# etag: ${f.etag}${f.contentType ? `  contentType: ${f.contentType}` : ""}`);
+  write(ctx.io.stdout, typeof f.content === "string" ? f.content : JSON.stringify(f, null, 2));
+  if (typeof f.content === "string" && !f.content.endsWith("\n")) write(ctx.io.stdout, "\n");
+  return 0;
+}
+async function wsPut(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--content", "--file", "--content-type", "--if-match"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop workspace put <path> (--content <text> | --file <localPath>) [--content-type <ct>] [--if-match <etag>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  let content;
+  if (options.file !== void 0) {
+    try {
+      content = await readFile3(options.file, "utf8");
+    } catch (err) {
+      throw new CliError(`Could not read ${options.file}: ${err instanceof Error ? err.message : String(err)}`, 2);
+    }
+  } else if (options.content !== void 0) {
+    content = options.content;
+  } else {
+    throw new CliError("Pass either --content <text> or --file <localPath>.", 2);
+  }
+  const body = { content };
+  if (options.contentType) body.contentType = options.contentType;
+  const headers = {};
+  if (options.ifMatch) headers["if-match"] = options.ifMatch;
+  const res = await requestJson(ctx, `/v1/host/workspace/files/${encodeURIComponent(positionals[0])}`, { method: "PUT", body, headers });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `Wrote ${positionals[0]}${res.body?.etag ? ` (etag ${res.body.etag})` : ""}.`);
+  return 0;
+}
+async function wsDelete(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop workspace delete <path> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) {
+    writeLine(ctx.io.stderr, `Refusing to delete ${positionals[0]} without --yes.`);
+    return 2;
+  }
+  await requestJson(ctx, `/v1/host/workspace/files/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+  writeLine(ctx.io.stdout, `Deleted ${positionals[0]}.`);
+  return 0;
+}
+
+// src/prompt.ts
+import { createInterface as createInterface3 } from "node:readline";
+async function promptChoice(ctx, label, choices) {
+  writeLine(ctx.io.stdout, label);
+  choices.forEach((c, i) => {
+    const tag = c.recommended ? " (recommended)" : "";
+    writeLine(ctx.io.stdout, `  ${i + 1}) ${c.label}${tag}`);
+  });
+  const defaultIdx = Math.max(0, choices.findIndex((c) => c.recommended));
+  const answer = await promptText(ctx, `Choice [${defaultIdx + 1}]: `, "");
+  const idx = answer.trim() === "" ? defaultIdx : Number(answer.trim()) - 1;
+  if (!Number.isInteger(idx) || idx < 0 || idx >= choices.length) {
+    throw new CliError(`Invalid choice: ${answer}`);
+  }
+  return choices[idx].key;
+}
+async function promptText(ctx, prompt, defaultValue = "") {
+  ctx.io.stdout.write(prompt);
+  const rl = createInterface3({ input: process.stdin, output: process.stdout, terminal: false });
+  return new Promise((resolve) => {
+    rl.once("line", (line) => {
+      rl.close();
+      resolve(line.length > 0 ? line : defaultValue);
+    });
+  });
+}
+async function promptYesNo(ctx, label, defaultYes = true) {
+  const hint = defaultYes ? "[Y/n]" : "[y/N]";
+  const answer = (await promptText(ctx, `${label} ${hint} `, "")).trim().toLowerCase();
+  if (answer === "") return defaultYes;
+  return answer === "y" || answer === "yes";
+}
+async function readSecret(ctx, prompt) {
+  ctx.io.stdout.write(prompt);
+  const stdin = process.stdin;
+  if (!stdin.isTTY) {
+    const rl = createInterface3({ input: stdin, output: process.stdout, terminal: false });
+    return new Promise((resolve) => {
+      rl.once("line", (line) => {
+        rl.close();
+        resolve(line);
+      });
+    });
+  }
+  return new Promise((resolve, reject) => {
+    stdin.setRawMode(true);
+    stdin.resume();
     stdin.setEncoding("utf8");
     let value = "";
     const cleanup = () => {
@@ -2570,6 +3634,137 @@ async function readSecret(ctx, prompt) {
   });
 }
 
+// src/cli/byok.ts
+var BYOK_HELP = `Usage:
+  openwop byok list [--json]
+  openwop byok set --ref <credentialRef> [--value <secret>] [--json]
+  openwop byok delete <credentialRef> [--yes]
+
+Bring-your-own-key secret store (host-side). The host holds the secret; the
+credential-payload-redaction invariant (RFC 0046) means a value is NEVER
+returned over the wire \u2014 'list' shows only refs, and 'set' echoes only a
+masked preview. Drives /v1/host/sample/byok/secrets. If --value is omitted,
+'set' prompts for it without echoing to the terminal.
+
+  --ref <credentialRef>  Opaque ref a workflow/pack uses to fetch the secret
+                         (matches [a-zA-Z0-9_.:-]{1,128}).
+  --value <secret>       The secret material. Prefer the interactive prompt
+                         (omit this flag) so the secret never lands in shell history.
+
+Examples:
+  openwop byok list
+  openwop byok set --ref anthropic-prod          # prompts for the value
+  openwop byok delete anthropic-prod --yes
+`;
+async function runByok(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, BYOK_HELP);
+    return 0;
+  }
+  const args = argv.slice(["list", "set", "delete"].includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "list":
+      return await byokList(ctx, args);
+    case "set":
+      return await byokSet(ctx, args);
+    case "delete":
+      return await byokDelete(ctx, args);
+    default:
+      throw new CliError(`Unknown byok command: ${sub}
+Run \`openwop byok --help\` for usage.`);
+  }
+}
+async function byokList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, BYOK_HELP);
+    return 0;
+  }
+  const res = await requestJson(ctx, "/v1/host/sample/byok/secrets");
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const refs = Array.isArray(res.body?.credentialRefs) ? res.body.credentialRefs : [];
+  if (refs.length === 0) {
+    writeLine(ctx.io.stdout, "No BYOK secrets stored. Add one with `openwop byok set --ref <name>`.");
+    return 0;
+  }
+  const rows = refs.map((r) => typeof r === "string" ? { credentialRef: r, masked: "", createdAt: "" } : { credentialRef: r.credentialRef ?? "", masked: r.masked ?? "", createdAt: r.createdAt ?? "" });
+  writeLine(ctx.io.stdout, formatTable(rows, ["credentialRef", "masked", "createdAt"]));
+  return 0;
+}
+async function byokSet(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--ref", "--value"] });
+  if (options.help || !options.ref) {
+    write(ctx.io.stdout, "Usage: openwop byok set --ref <credentialRef> [--value <secret>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  let value = options.value;
+  if (value === void 0) {
+    const entered = await readSecret(ctx, `Secret value for "${options.ref}": `);
+    value = typeof entered === "string" ? entered : String(entered ?? "");
+  }
+  if (!value) throw new CliError("A non-empty --value (or prompted secret) is required.", 2);
+  const res = await requestJson(ctx, "/v1/host/sample/byok/secrets", {
+    method: "POST",
+    body: { credentialRef: options.ref, value }
+  });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `Stored ${res.body?.credentialRef ?? options.ref} (${res.body?.masked ?? "masked"}).`);
+  return 0;
+}
+async function byokDelete(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop byok delete <credentialRef> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) {
+    writeLine(ctx.io.stderr, `Refusing to delete secret ${positionals[0]} without --yes.`);
+    return 2;
+  }
+  await requestJson(ctx, `/v1/host/sample/byok/secrets/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+  writeLine(ctx.io.stdout, `Deleted secret ref ${positionals[0]}.`);
+  return 0;
+}
+
+// src/cli/conformance.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { join as join4 } from "node:path";
+var CONFORMANCE_HELP = `Usage: openwop conformance [--offline] [--filter pattern]
+
+Runs the in-repo @openwop/openwop-conformance CLI. Without --offline it targets the configured --base-url.
+`;
+async function runConformance(ctx, argv) {
+  const { options } = parseOptions(argv, {
+    bool: ["--help", "--offline"],
+    value: ["--filter"]
+  });
+  if (options.help) {
+    write(ctx.io.stdout, CONFORMANCE_HELP);
+    return 0;
+  }
+  const root = requireRepoRoot(ctx);
+  const args = ["run", "cli", "--"];
+  if (options.offline) {
+    args.push("--offline");
+  } else {
+    args.push("--base-url", ctx.baseUrl, "--api-key", ctx.apiKey ?? DEFAULT_API_KEY);
+  }
+  if (options.filter) args.push("--filter", options.filter);
+  const result = spawnSync2(npmCommand(), args, {
+    cwd: join4(root, "conformance"),
+    stdio: "inherit",
+    env: ctx.env
+  });
+  return result.status ?? 1;
+}
+
 // src/cli/account.ts
 var ACCOUNT_HELP = `Usage:
   openwop account delete [--confirm] [--json]
@@ -5544,6 +6739,21 @@ async function runCli(argv, options = {}) {
       case "agents":
       case "agent":
         return await runAgents(ctx, commandArgs);
+      case "roster":
+        return await runRoster(ctx, commandArgs);
+      case "org-chart":
+      case "orgchart":
+        return await runOrgChart(ctx, commandArgs);
+      case "kanban":
+      case "boards":
+        return await runKanban(ctx, commandArgs);
+      case "orgs":
+      case "org":
+        return await runOrgs(ctx, commandArgs);
+      case "workspace":
+        return await runWorkspace(ctx, commandArgs);
+      case "byok":
+        return await runByok(ctx, commandArgs);
       case "config":
         return await runConfig(ctx, commandArgs);
       case "webhooks":
@@ -5606,6 +6816,15 @@ function showHelp(io, command) {
     provider: PROVIDERS_HELP,
     agents: AGENTS_HELP,
     agent: AGENTS_HELP,
+    roster: ROSTER_HELP,
+    "org-chart": ORG_CHART_HELP,
+    orgchart: ORG_CHART_HELP,
+    kanban: KANBAN_HELP,
+    boards: KANBAN_HELP,
+    orgs: ORGS_HELP,
+    org: ORGS_HELP,
+    workspace: WORKSPACE_HELP,
+    byok: BYOK_HELP,
     config: CONFIG_HELP,
     doctor: DOCTOR_HELP,
     health: HEALTH_HELP,
@@ -5685,8 +6904,31 @@ Commands:
   memory get          Show one memory entry
   memory delete       Delete one memory entry
   runs ancestry       Show a run's cross-host parent chain (RFC 0040)
-  agents list         List agent-attributed node roles on the host
-  agents info         Show one agent role's details
+  agents list         List manifest agents (RFC 0070) on the host
+  agents info         Show one agent's details
+  agents create       Create a tenant-scoped user-defined agent
+  agents update       Update a user-defined agent
+  agents delete       Delete a user-defined agent
+  roster list         List named standing agents + their workflow portfolio (RFC 0086)
+  roster create       Create a roster entry
+  roster update       Update / pause / re-enable a roster entry
+  roster delete       Delete a roster entry
+  org-chart get       Show the descriptive department/reporting structure (RFC 0087)
+  org-chart set       Replace the org chart from a JSON file
+  kanban boards       List agent task boards
+  kanban board-create Create a board (optionally bound to a roster entry)
+  kanban card-add     Add a card to a board
+  kanban card-move    Move a card between columns
+  kanban watch        Stream a board's card events
+  orgs list           List organizations (RFC 0049 RBAC)
+  orgs create         Create an organization
+  orgs teams|groups|roles|members  Manage org teams/groups/roles/members
+  orgs effective      Resolve a subject's effective access
+  workspace list      List per-tenant agent workspace files (RFC 0059)
+  workspace put|get   Write / read a workspace file
+  byok list           List BYOK credential refs (never values)
+  byok set            Store a BYOK secret (prompts if --value omitted)
+  byok delete         Remove a BYOK secret ref
   webhooks list       List webhook subscriptions
   webhooks add        Register a webhook subscription
   webhooks remove     Delete a webhook subscription