@overaihq/cli 0.14.15 → 0.15.1

package/dist/index.js

@@ -38129,6 +38129,13 @@ var agentVersionConfigSchema = external_exports.object({
   model: external_exports.string(),
   temperature: external_exports.number(),
   maxTokens: external_exports.number(),
+  /**
+   * Model calls the agent may make in one turn. The last one runs without
+   * tools: a turn that hits the limit mid-investigation would otherwise end on
+   * an unanswered tool call — no reply in chat, and no object at all from
+   * `generate/object`. Defaulted so configs saved before the field still parse.
+   */
+  maxSteps: external_exports.number().int().min(1).max(200).default(20),
   rateLimitRequestsPerMinute: external_exports.number(),
   rateLimitTokensPerMinute: external_exports.number()
 });
@@ -38137,6 +38144,7 @@ var defaultAgentVersionConfig = {
   model: "claude-sonnet-4-6",
   temperature: 0.7,
   maxTokens: 4096,
+  maxSteps: 20,
   rateLimitRequestsPerMinute: 20,
   rateLimitTokensPerMinute: 2e5
 };
@@ -43967,6 +43975,10 @@ var consoleLogsPayloadSchema = external_exports.object({
 var runtimeErrorPayloadSchema = external_exports.object({
   error: external_exports.string().nullable()
 });
+var hostShortcutPayloadSchema = external_exports.enum([
+  "commandPalette",
+  "architect"
+]);
 var pageInteractionPayloadSchema = external_exports.object({
   clicks: external_exports.number().int().min(0),
   keypresses: external_exports.number().int().min(0)
@@ -59728,6 +59740,7 @@ var agentFiles = (v) => ({
     model: v.model,
     temperature: v.temperature,
     maxTokens: v.maxTokens,
+    maxSteps: v.maxSteps,
     rateLimitRequestsPerMinute: v.rateLimitRequestsPerMinute,
     rateLimitTokensPerMinute: v.rateLimitTokensPerMinute,
     functionIds: v.functionIds,
@@ -60187,7 +60200,7 @@ ${findings2.map((f) => `  ${f}`).join("\n")}`
   }
 });
 var agentVersionFields = `
-  versionNumber systemPrompt model temperature maxTokens
+  versionNumber systemPrompt model temperature maxTokens maxSteps
   rateLimitRequestsPerMinute rateLimitTokensPerMinute
   agentVersionFunctionsByAgentIdAndVersionNumber(orderBy: [FUNCTION_ID_ASC]) {
     nodes { functionId }
@@ -60211,6 +60224,7 @@ var flattenAgentVersion = (node2) => ({
   model: node2.model,
   temperature: node2.temperature,
   maxTokens: node2.maxTokens,
+  maxSteps: node2.maxSteps,
   rateLimitRequestsPerMinute: node2.rateLimitRequestsPerMinute,
   rateLimitTokensPerMinute: node2.rateLimitTokensPerMinute,
   functionIds: node2.agentVersionFunctionsByAgentIdAndVersionNumber.nodes.map(
@@ -60305,7 +60319,7 @@ var agentSource = (client) => ({
     const data = await client.graphql(
       `mutation SdkCreateAgentVersion($expectedLatestVersion: Int,
         $agentId: String!, $message: String!, $systemPrompt: String!,
-        $model: String!, $temperature: Float!, $maxTokens: Int!,
+        $model: String!, $temperature: Float!, $maxTokens: Int!, $maxSteps: Int,
         $rateLimitRequestsPerMinute: Int!, $rateLimitTokensPerMinute: Int!,
         $functionIds: [String], $tableSpaceBindings: JSON, $agentIds: [String],
         $knowledgeBaseIds: [String], $builtinToolSets: [String]
@@ -60313,6 +60327,7 @@ var agentSource = (client) => ({
         createAgentVersionWithAttachments(input: { expectedLatestVersion: $expectedLatestVersion,
           agentId: $agentId, message: $message, systemPrompt: $systemPrompt,
           model: $model, temperature: $temperature, maxTokens: $maxTokens,
+          maxSteps: $maxSteps,
           rateLimitRequestsPerMinute: $rateLimitRequestsPerMinute,
           rateLimitTokensPerMinute: $rateLimitTokensPerMinute,
           functionIds: $functionIds, tableSpaceBindings: $tableSpaceBindings,
@@ -60329,6 +60344,8 @@ var agentSource = (client) => ({
         knowledgeBaseIds: input2.knowledgeBaseIds ?? [],
         // Null keeps the current sets; an empty array clears them.
         builtinToolSets: input2.builtinToolSets ?? null,
+        // Null keeps the latest version's limit.
+        maxSteps: input2.maxSteps ?? null,
         expectedLatestVersion: options.expectedLatestVersion
       }
     );
@@ -60691,6 +60708,58 @@ var printablePageRender = (client, id) => ({
   }
 });
 
+// ../sdk/src/references.ts
+var referencesSchema = external_exports.object({
+  inbound: external_exports.array(
+    external_exports.object({
+      resourceId: external_exports.string(),
+      referencerId: external_exports.string(),
+      referencerKind: external_exports.string(),
+      referencerName: external_exports.string(),
+      referencerWorkspaceId: external_exports.string()
+    })
+  ),
+  outbound: external_exports.array(
+    external_exports.object({
+      resourceId: external_exports.string(),
+      targetId: external_exports.string(),
+      targetKind: external_exports.string(),
+      targetName: external_exports.string(),
+      targetWorkspaceId: external_exports.string()
+    })
+  )
+});
+var resourceReferences = async (client, resourceIds, options) => resourceIds.length === 0 ? { inbound: [], outbound: [] } : referencesSchema.parse(
+  await client.trpc("getResourceReferences", {
+    resourceIds,
+    referencerWorkspaceIds: options?.referencerWorkspaceIds
+  })
+);
+var agentToolReachSchema = external_exports.array(
+  external_exports.object({
+    agentId: external_exports.string(),
+    agentName: external_exports.string(),
+    agentWorkspaceId: external_exports.string(),
+    tools: external_exports.array(
+      external_exports.object({
+        kind: external_exports.string(),
+        id: external_exports.string(),
+        name: external_exports.string(),
+        accessMode: external_exports.string().nullable(),
+        isReachable: external_exports.boolean(),
+        isReachableFromTarget: external_exports.boolean().nullable()
+      })
+    ),
+    hiddenCount: external_exports.number(),
+    hiddenUnreachableCount: external_exports.number(),
+    hiddenLostAtTargetCount: external_exports.number(),
+    canShareIntoTarget: external_exports.boolean()
+  })
+);
+var agentToolReach = async (client, agentIds, targetWorkspaceId) => agentToolReachSchema.parse(
+  await client.trpc("getAgentToolReach", { agentIds, targetWorkspaceId })
+);
+
 // ../sdk/src/report.ts
 var report = async (client, kind, details, options) => {
   await client.trpc("architectIssues.report", {
@@ -60855,6 +60924,153 @@ var idTableByPrefix = (id) => {
   return best?.table ?? null;
 };
 
+// ../sdk/src/resourceGroups.ts
+var memberKind = (table) => table.replace(/_(\w)/g, (_, letter) => letter.toUpperCase());
+var resolveMember = async (client, resourceId) => {
+  const row = await client.resource(resourceId).show();
+  const table = idTableByPrefix(row.id);
+  if (table == null) throw new Error(`Unsupported resource id: ${resourceId}`);
+  return {
+    member: { resourceKind: memberKind(table), resourceId: row.id },
+    workspaceId: row.workspaceId
+  };
+};
+var membershipOf = async (client, member) => {
+  const data = await client.graphql(
+    `query SdkResourceGroupMembership($resourceKind: String!, $resourceId: String!) {
+      resourceGroupMembers(condition: { resourceKind: $resourceKind, resourceId: $resourceId }) {
+        nodes { groupId group { name } }
+      }
+    }`,
+    { ...member }
+  );
+  const row = data.resourceGroupMembers?.nodes[0];
+  return row == null ? null : { ...member, groupId: row.groupId, groupName: row.group?.name ?? null };
+};
+var removeMembership = async (client, member) => {
+  const membership = await membershipOf(client, member);
+  if (membership == null) return null;
+  await client.graphql(
+    `mutation SdkRemoveResourceGroupMember($resourceKind: String!, $resourceId: String!) {
+      deleteResourceGroupMember(input: { resourceKind: $resourceKind, resourceId: $resourceId }) {
+        deletedResourceGroupMemberNodeId
+      }
+    }`,
+    { ...member }
+  );
+  return membership;
+};
+var removeResourceFromGroup = async (client, storedId) => {
+  const table = idTableByPrefix(storedId);
+  return table == null ? null : removeMembership(client, {
+    resourceKind: memberKind(table),
+    resourceId: storedId
+  });
+};
+var resourceGroupCollection = (client) => ({
+  list: async (options) => {
+    const data = await client.graphql(
+      `query SdkResourceGroups($condition: ResourceGroupCondition) {
+        resourceGroups(condition: $condition) {
+          nodes {
+            id name workspaceId
+            resourceGroupMembersByGroupId { nodes { resourceKind resourceId } }
+          }
+        }
+      }`,
+      {
+        condition: options?.workspaceId == null ? null : { workspaceId: options.workspaceId }
+      }
+    );
+    return (data.resourceGroups?.nodes ?? []).map((group) => ({
+      id: group.id,
+      name: group.name,
+      workspaceId: group.workspaceId,
+      members: group.resourceGroupMembersByGroupId.nodes
+    })).sort((a, b) => a.name.localeCompare(b.name));
+  },
+  create: async (input2) => {
+    const data = await client.graphql(
+      `mutation SdkCreateResourceGroup($workspaceId: String!, $name: String!) {
+        createResourceGroup(input: { resourceGroup: { workspaceId: $workspaceId, name: $name } }) {
+          resourceGroup { id }
+        }
+      }`,
+      input2
+    );
+    const id = data.createResourceGroup?.resourceGroup?.id;
+    if (id == null) throw new Error("createResourceGroup returned no group.");
+    return { id };
+  },
+  membershipOf: async (resourceId) => membershipOf(client, (await resolveMember(client, resourceId)).member),
+  removeMember: async (resourceId) => removeMembership(client, (await resolveMember(client, resourceId)).member)
+});
+var resourceGroupResource = (client, id) => ({
+  id,
+  rename: async (name2) => {
+    const data = await client.graphql(
+      `mutation SdkRenameResourceGroup($id: String!, $name: String!) {
+        updateResourceGroup(input: { id: $id, patch: { name: $name } }) { resourceGroup { id } }
+      }`,
+      { id, name: name2 }
+    );
+    if (data.updateResourceGroup?.resourceGroup == null) {
+      throw new Error(`Resource group ${id} was not renamed.`);
+    }
+  },
+  delete: async () => {
+    await client.graphql(
+      `mutation SdkDeleteResourceGroup($id: String!) {
+        deleteResourceGroup(input: { id: $id }) { deletedResourceGroupNodeId }
+      }`,
+      { id }
+    );
+  },
+  add: async (resourceIds) => {
+    const data = await client.graphql(
+      `query SdkResourceGroupWorkspace($id: String!) {
+        resourceGroup(id: $id) { workspaceId }
+      }`,
+      { id }
+    );
+    const groupWorkspaceId = data.resourceGroup?.workspaceId;
+    if (groupWorkspaceId == null) {
+      throw new Error(
+        `Resource group ${id} not found (or not editable by you).`
+      );
+    }
+    const resolved = await Promise.all(
+      resourceIds.map(async (resourceId) => ({
+        resourceId,
+        ...await resolveMember(client, resourceId)
+      }))
+    );
+    const misplaced = resolved.filter(
+      (entry) => entry.workspaceId !== groupWorkspaceId
+    );
+    if (misplaced.length > 0) {
+      throw new Error(
+        `${misplaced.map(
+          (entry) => `${entry.resourceId} is in workspace ${String(entry.workspaceId)}`
+        ).join("; ")}, but group ${id} is in ${groupWorkspaceId}. Move ${misplaced.length === 1 ? "it" : "them"} to that workspace first.`
+      );
+    }
+    const previous = [];
+    for (const { member } of resolved) {
+      previous.push(await removeMembership(client, member));
+      await client.graphql(
+        `mutation SdkAddResourceGroupMember($member: ResourceGroupMemberInput!) {
+          createResourceGroupMember(input: { resourceGroupMember: $member }) {
+            resourceGroupMember { groupId }
+          }
+        }`,
+        { member: { groupId: id, ...member } }
+      );
+    }
+    return previous;
+  }
+});
+
 // ../sdk/src/resourceShow.ts
 var resourceTables = {
   workspace: {
@@ -61018,7 +61234,33 @@ var genericResource = (client, id) => {
         throw new Error(`No supported changes supplied for ${id}.`);
       }
       return show(current.id);
-    }
+    },
+    move: async (workspaceId) => {
+      const resource = resourceTableFor(id);
+      if (resource === resourceTables.workspace) {
+        throw new Error(
+          `${id} is a workspace; reparent it instead of moving it.`
+        );
+      }
+      const current = await show(id);
+      const result = await client.graphql(
+        `mutation SdkMoveResource($id: String!, $workspaceId: String!) {
+          ${resource.mutation}(input: { id: $id, patch: { workspaceId: $workspaceId } }) {
+            updated: ${resource.result} { id workspaceId }
+          }
+        }`,
+        { id: current.id, workspaceId }
+      );
+      const updated = result[resource.mutation]?.updated;
+      if (updated == null) {
+        throw new Error(
+          `Resource ${id} was not moved; check that you can edit both workspaces.`
+        );
+      }
+      const leftGroup = await removeResourceFromGroup(client, current.id);
+      return { ...updated, leftGroup };
+    },
+    references: () => resourceReferences(client, [id])
   };
 };
 
@@ -61321,9 +61563,137 @@ var tableSpaceCredentialResource = (client, credentialId) => {
 var exchangeSchema = external_exports.object({ token: external_exports.string(), expiresIn: external_exports.number() });
 var staticToken = (jwt2) => () => jwt2;
 
+// ../sdk/src/paginate.ts
+var paginate = async (client, query, field, variables = {}) => {
+  const nodes = [];
+  let after = null;
+  do {
+    const data = await client.graphql(
+      query,
+      { ...variables, after }
+    );
+    const connection = data[field];
+    if (connection == null) return nodes;
+    nodes.push(...connection.nodes);
+    const page = connection.pageInfo;
+    if (page.hasNextPage && (page.endCursor == null || page.endCursor === after))
+      throw new Error(`${field} pagination did not advance.`);
+    after = page.hasNextPage ? page.endCursor : null;
+  } while (after != null);
+  return nodes;
+};
+
 // ../sdk/src/workspaces.ts
+var SHARE_KINDS = [
+  "table_space",
+  "function",
+  "agent",
+  "integration",
+  "action_runner"
+];
+var SHARE_FIELDS = "id fromWorkspaceId toWorkspaceId resourceKind resourceId fromWorkspace { name } toWorkspace { name }";
+var shareFromRow = (row) => ({
+  id: row.id,
+  fromWorkspaceId: row.fromWorkspaceId,
+  fromWorkspaceName: row.fromWorkspace?.name ?? null,
+  toWorkspaceId: row.toWorkspaceId,
+  toWorkspaceName: row.toWorkspace?.name ?? null,
+  resourceKind: row.resourceKind,
+  resourceId: row.resourceId
+});
+var storedShareEnds = async (client, from, to) => {
+  const data = await client.graphql(
+    `query SdkShareWorkspaceIds($from: String!, $to: String!) {
+      from: workspaces(condition: { idIgnoringCase: $from }, includeArchived: YES, first: 1) { nodes { id } }
+      to: workspaces(condition: { idIgnoringCase: $to }, includeArchived: YES, first: 1) { nodes { id } }
+    }`,
+    { from, to }
+  );
+  const stored = {
+    from: data.from?.nodes[0]?.id,
+    to: data.to?.nodes[0]?.id
+  };
+  if (stored.from == null) {
+    throw new Error(`Workspace ${from} not found (or not visible to you).`);
+  }
+  if (stored.to == null) {
+    throw new Error(`Workspace ${to} not found (or not visible to you).`);
+  }
+  return { from: stored.from, to: stored.to };
+};
+var workspaceTree = async (client, includeArchived) => {
+  const [workspaces, edges, roles] = await Promise.all([
+    paginate(
+      client,
+      `query SdkWorkspaceTreeNodes($after: Cursor, $includeArchived: IncludeArchivedOption!) {
+        workspaces(first: 100, after: $after, includeArchived: $includeArchived) {
+          nodes { id name isArchived }
+          pageInfo { hasNextPage endCursor }
+        }
+      }`,
+      "workspaces",
+      { includeArchived: includeArchived ? "YES" : "NO" }
+    ),
+    paginate(
+      client,
+      `query SdkWorkspaceTreeEdges($after: Cursor) {
+        workspaceWorkspaces(first: 100, after: $after) {
+          nodes { workspaceId parentWorkspaceId }
+          pageInfo { hasNextPage endCursor }
+        }
+      }`,
+      "workspaceWorkspaces"
+    ),
+    client.graphql(
+      `query SdkWorkspaceTreeRoles { myWorkspaceRoles { nodes { workspaceId role } } }`
+    )
+  ]);
+  const role = new Map(
+    roles.myWorkspaceRoles.nodes.map((r) => [r.workspaceId, r.role])
+  );
+  const parentOf = new Map(
+    edges.map((e) => [e.workspaceId, e.parentWorkspaceId])
+  );
+  const nodes = new Map(
+    workspaces.map((w) => [
+      w.id,
+      {
+        id: w.id,
+        name: w.name,
+        isArchived: w.isArchived,
+        role: role.get(w.id) ?? null,
+        parentWorkspaceId: null,
+        children: []
+      }
+    ])
+  );
+  const roots = [...nodes.values()].filter((node2) => {
+    const parent = nodes.get(parentOf.get(node2.id) ?? "");
+    if (parent == null) return true;
+    node2.parentWorkspaceId = parent.id;
+    parent.children.push(node2);
+    return false;
+  });
+  const sort2 = (list) => {
+    list.sort((a, b) => a.name.localeCompare(b.name));
+    list.forEach((node2) => sort2(node2.children));
+    return list;
+  };
+  return sort2(roots);
+};
 var workspaceCollection = (client) => ({
   create: (input2) => createWorkspace(client, input2),
+  tree: (options) => workspaceTree(client, options?.includeArchived === true),
+  shares: async () => (await paginate(
+    client,
+    `query SdkAllWorkspaceShares($after: Cursor) {
+          workspaceResourceShares(first: 100, after: $after) {
+            nodes { ${SHARE_FIELDS} }
+            pageInfo { hasNextPage endCursor }
+          }
+        }`,
+    "workspaceResourceShares"
+  )).map(shareFromRow),
   list: async (options) => {
     const data = await client.graphql(
       `query SdkWorkspaceList($first: Int!, $includeArchived: IncludeArchivedOption!) {
@@ -61397,6 +61767,109 @@ var workspaceResource = (client, id) => ({
         }
       ]
     );
+  },
+  tree: async (options) => {
+    const find2 = (list) => list.map(
+      (node3) => node3.id.toLowerCase() === id.toLowerCase() ? node3 : find2(node3.children)
+    ).find((node3) => node3 != null);
+    const node2 = find2(
+      await workspaceTree(client, options?.includeArchived === true)
+    );
+    if (node2 == null) {
+      throw new Error(`Workspace ${id} not found (or not visible to you).`);
+    }
+    return node2;
+  },
+  setParent: async (parentWorkspaceId) => {
+    const data = await client.graphql(
+      `mutation SdkSetWorkspaceParent($workspaceId: String!, $parentWorkspaceId: String!) {
+        setWorkspaceParent(input: { workspaceId: $workspaceId, parentWorkspaceId: $parentWorkspaceId }) {
+          workspaceWorkspace { workspaceId }
+        }
+      }`,
+      { workspaceId: id, parentWorkspaceId }
+    );
+    if (data.setWorkspaceParent?.workspaceWorkspace == null) {
+      throw new Error(
+        `Workspace ${id} was not moved; check that you manage both workspaces.`
+      );
+    }
+  },
+  moveToRoot: async () => {
+    const data = await client.graphql(
+      `mutation SdkMoveWorkspaceToRoot($workspaceId: String!) {
+        deleteWorkspaceWorkspaceByWorkspaceId(input: { workspaceId: $workspaceId }) {
+          workspaceWorkspace { workspaceId }
+        }
+      }`,
+      { workspaceId: id }
+    );
+    return data.deleteWorkspaceWorkspaceByWorkspaceId?.workspaceWorkspace != null;
+  },
+  shares: async () => {
+    const data = await client.graphql(
+      `query SdkWorkspaceShares($id: String!) {
+        from: workspaceResourceShares(condition: { fromWorkspaceId: $id }) { nodes { ${SHARE_FIELDS} } }
+        to: workspaceResourceShares(condition: { toWorkspaceId: $id }) { nodes { ${SHARE_FIELDS} } }
+      }`,
+      { id }
+    );
+    return [...data.from?.nodes ?? [], ...data.to?.nodes ?? []].map(
+      shareFromRow
+    );
+  },
+  share: async (input2) => {
+    if (!SHARE_KINDS.includes(input2.kind)) {
+      throw new Error(
+        `Unknown share kind "${input2.kind}". Use one of: ${SHARE_KINDS.join(", ")}.`
+      );
+    }
+    const ends = await storedShareEnds(client, id, input2.toWorkspaceId);
+    const data = await client.graphql(
+      `mutation SdkCreateWorkspaceShare($share: WorkspaceResourceShareInput!) {
+        createWorkspaceResourceShare(input: { workspaceResourceShare: $share }) {
+          workspaceResourceShare { id }
+        }
+      }`,
+      {
+        share: {
+          fromWorkspaceId: ends.from,
+          toWorkspaceId: ends.to,
+          resourceKind: input2.kind,
+          resourceId: input2.resourceId ?? null
+        }
+      }
+    );
+    const shareId = data.createWorkspaceResourceShare?.workspaceResourceShare?.id;
+    if (shareId == null)
+      throw new Error("createWorkspaceResourceShare returned no share.");
+    return { id: shareId };
+  },
+  unshare: async (input2) => {
+    const ends = await storedShareEnds(client, id, input2.toWorkspaceId);
+    const data = await client.graphql(
+      `query SdkFindWorkspaceShare($from: String!, $to: String!, $kind: String!) {
+        workspaceResourceShares(condition: { fromWorkspaceId: $from, toWorkspaceId: $to, resourceKind: $kind }) {
+          nodes { ${SHARE_FIELDS} }
+        }
+      }`,
+      { from: ends.from, to: ends.to, kind: input2.kind }
+    );
+    const resourceId = input2.resourceId?.toLowerCase() ?? null;
+    const row = data.workspaceResourceShares?.nodes.find(
+      (share) => (share.resourceId?.toLowerCase() ?? null) === resourceId
+    );
+    if (row == null) {
+      throw new Error(
+        `No ${input2.resourceId == null ? `whole-kind ${input2.kind}` : `${input2.kind} ${input2.resourceId}`} share from ${ends.from} to ${ends.to}.`
+      );
+    }
+    await client.graphql(
+      `mutation SdkDeleteWorkspaceShare($id: String!) {
+        deleteWorkspaceResourceShare(input: { id: $id }) { deletedWorkspaceResourceShareNodeId }
+      }`,
+      { id: row.id }
+    );
   }
 });
 
@@ -61515,6 +61988,7 @@ var OverAIClient = class {
   };
   workspaces = workspaceCollection(this);
   runners = runnerCollection(this);
+  resourceGroups = resourceGroupCollection(this);
   storage = storageApi(this);
   /** Its `deploy` checks deployed callers first; see `FunctionResource`. */
   fn(id) {
@@ -61584,6 +62058,20 @@ var OverAIClient = class {
   resource(id) {
     return genericResource(this, id);
   }
+  resourceGroup(id) {
+    return resourceGroupResource(this, id);
+  }
+  /**
+   * References to and from many resources at once (at most 200 ids).
+   * `referencerWorkspaceIds` limits inbound referencers to those workspaces.
+   */
+  resourceReferences(resourceIds, options) {
+    return resourceReferences(this, resourceIds, options);
+  }
+  /** Whether each agent's deployed tools resolve from its workspace and from `targetWorkspaceId`. */
+  agentToolReach(agentIds, targetWorkspaceId) {
+    return agentToolReach(this, agentIds, targetWorkspaceId);
+  }
   /** Claims of the JWT most recently obtained from the token source, or null before any request. Display only. */
   claims() {
     return this.#claims;
@@ -61902,6 +62390,9 @@ var unknownFlags = (args, known, valueFlags = []) => {
   }
   return out;
 };
+var positionals = (args, valueFlags) => args.filter(
+  (arg, index) => !arg.startsWith("-") && !valueFlags.includes(args[index - 1] ?? "")
+);
 var flagValue = (args, ...names) => {
   for (const name2 of names) {
     const i = args.indexOf(name2);
@@ -63206,7 +63697,7 @@ ${lines.join("\n")}
 var runRestore = (args) => {
   const { root, manifest } = openClone();
   const all = args.includes("--all");
-  const filter2 = positionals(args)[0];
+  const filter2 = positionals2(args)[0];
   if (filter2 == null && !all) {
     throw new Error(
       "Usage: overai restore <filter> (resource id, name, or path substring), or --all to discard every local edit."
@@ -63309,7 +63800,7 @@ var runPull = async (clone2) => {
 var resourcesMatching = (manifest, filter2) => Object.entries(manifest.resources).filter(
   ([id, resource]) => filter2 == null || id === filter2 || resource.name.toLowerCase().includes(filter2.toLowerCase()) || resource.files.some((f) => f.includes(filter2))
 );
-var positionals = (args) => {
+var positionals2 = (args) => {
   const valueFlags = /* @__PURE__ */ new Set(["-m", "--message", "-o", "--output"]);
   const out = [];
   for (let i = 0; i < args.length; i++) {
@@ -63351,7 +63842,7 @@ var runPush = async (args, clone2) => {
   const deploy = args.includes("--deploy");
   const force = args.includes("--force");
   const allowBreaking = args.includes("--allow-breaking");
-  const pathFilter = positionals(args)[0];
+  const pathFilter = positionals2(args)[0];
   let pushed = 0;
   for (const [id, resource] of resourcesMatching(manifest, pathFilter)) {
     const { state, changedFiles } = localState(root, resource);
@@ -63434,7 +63925,7 @@ var runPush = async (args, clone2) => {
 };
 var runDeploy = async (args) => {
   const { root, manifest } = openClone();
-  const pathFilter = positionals(args)[0];
+  const pathFilter = positionals2(args)[0];
   const allowBreaking = args.includes("--allow-breaking");
   const pending = resourcesMatching(manifest, pathFilter).filter(
     ([, r]) => r.deployedVersion !== r.baseVersion
@@ -64700,12 +65191,478 @@ var runReport = async (args) => {
   );
 };
 
+// src/commands/move.ts
+var printReport = (args, report2) => {
+  if (flagValue(args, "-o", "--output") === "json") {
+    printResult(report2, "json");
+    return;
+  }
+  process.stdout.write(
+    [
+      ...report2.plan,
+      "",
+      ...report2.warnings.length === 0 ? ["No warnings."] : report2.warnings.map(
+        (line, index) => index === 0 ? line : `  ${line}`
+      ),
+      "",
+      report2.dryRun ? "Dry run: nothing changed." : ""
+    ].join("\n").trimEnd() + "\n"
+  );
+};
+var workspacesById = (forest) => {
+  const byId = /* @__PURE__ */ new Map();
+  const visit2 = (node2) => {
+    byId.set(node2.id.toLowerCase(), node2);
+    node2.children.forEach(visit2);
+  };
+  forest.forEach(visit2);
+  return byId;
+};
+var subtreeIds = (node2) => [
+  node2.id,
+  ...node2.children.flatMap(subtreeIds)
+];
+var userLabel = (user) => user.email ?? user.name ?? user.id;
+var ROLE_ORDER = ["manager", "editor", "viewer", "end_user"];
+var roleRank = (role) => {
+  const rank = role == null ? -1 : ROLE_ORDER.indexOf(role);
+  return rank === -1 ? ROLE_ORDER.length : rank;
+};
+var strongerRole = (a, b) => roleRank(a) <= roleRank(b) ? a : b;
+var reaches = (shares, from, to, kind, resourceId) => {
+  const target = to.toLowerCase();
+  const seen = /* @__PURE__ */ new Set([from.toLowerCase()]);
+  const queue = [from.toLowerCase()];
+  for (let at = queue.shift(); at != null; at = queue.shift()) {
+    if (at === target) return true;
+    shares.filter(
+      (share) => share.fromWorkspaceId.toLowerCase() === at && share.resourceKind === kind && (share.resourceId == null || share.resourceId.toLowerCase() === resourceId.toLowerCase())
+    ).forEach((share) => {
+      const next = share.toWorkspaceId.toLowerCase();
+      if (!seen.has(next)) {
+        seen.add(next);
+        queue.push(next);
+      }
+    });
+  }
+  return false;
+};
+var rowName = (row) => {
+  if (typeof row.name === "string") return row.name;
+  const identity = row.identity;
+  return typeof identity?.name === "string" ? identity.name : row.id;
+};
+var accessibleViews = {
+  function: {
+    collection: "workspaceAccessibleFunctions",
+    idField: "functionId",
+    relation: "function"
+  },
+  table_space: {
+    collection: "workspaceAccessibleTableSpaces",
+    idField: "tableSpaceId",
+    relation: "tableSpace"
+  },
+  agent: {
+    collection: "workspaceAccessibleAgents",
+    idField: "agentId",
+    relation: "agent"
+  },
+  integration: {
+    collection: "workspaceAccessibleIntegrations",
+    idField: "integrationId",
+    relation: "integration"
+  },
+  action_runner: {
+    collection: "workspaceAccessibleActionRunners",
+    idField: "actionRunnerId",
+    relation: "actionRunner"
+  }
+};
+var SHARED_RESOURCE_CAP = 200;
+var sharedResources = async (client, share) => {
+  if (share.resourceId != null) {
+    const row = await client.resource(share.resourceId).show().catch(() => null);
+    return {
+      resources: [
+        {
+          id: share.resourceId,
+          name: row == null ? share.resourceId : rowName(row)
+        }
+      ],
+      total: 1
+    };
+  }
+  const kind = SHARE_KINDS.find((known) => known === share.resourceKind);
+  if (kind == null) return { resources: [], total: 0 };
+  const view = accessibleViews[kind];
+  const data = await client.graphql(
+    `query CliSharedKindResources($workspaceId: String!, $first: Int!) {
+      ${view.collection}(condition: { workspaceId: $workspaceId }, first: $first) {
+        totalCount
+        nodes { ${view.idField} ${view.relation} { ${resourceTables[kind].fields} } }
+      }
+    }`,
+    { workspaceId: share.fromWorkspaceId, first: SHARED_RESOURCE_CAP }
+  );
+  const connection = data[view.collection];
+  return {
+    resources: (connection?.nodes ?? []).map((node2) => {
+      const id = String(node2[view.idField]);
+      const row = node2[view.relation];
+      return { id, name: row == null ? id : rowName(row) };
+    }),
+    total: connection?.totalCount ?? 0
+  };
+};
+var moveWorkspace = async (args) => {
+  const [workspaceId] = positionals(args, ["--to", "-o", "--output"]);
+  const to = flagValue(args, "--to");
+  if (workspaceId == null || to == null) {
+    throw new Error(
+      "Usage: overai workspace move <workspaceId> --to <parentWorkspaceId|root> [--dry-run]"
+    );
+  }
+  const dryRun = args.includes("--dry-run");
+  const client = cliClient();
+  const [forest, allShares] = await Promise.all([
+    client.workspaces.tree({ includeArchived: true }),
+    client.workspaces.shares()
+  ]);
+  const byId = workspacesById(forest);
+  const label = (id) => {
+    if (id == null) return "the top level";
+    const node2 = byId.get(id.toLowerCase());
+    return node2 == null ? id : `"${node2.name}" (${node2.id})`;
+  };
+  const moved = byId.get(workspaceId.toLowerCase());
+  if (moved == null) {
+    throw new Error(
+      `Workspace ${workspaceId} not found (or not visible to you).`
+    );
+  }
+  const newParent = to === "root" ? null : byId.get(to.toLowerCase());
+  if (newParent === void 0) {
+    throw new Error(`Workspace ${to} not found (or not visible to you).`);
+  }
+  const oldParentId = moved.parentWorkspaceId;
+  if (oldParentId != null && oldParentId.toLowerCase() === newParent?.id.toLowerCase()) {
+    (flagValue(args, "-o", "--output") === "json" ? process.stderr : process.stdout).write(
+      `${label(moved.id)} is already under ${label(oldParentId)}; nothing to move.
+`
+    );
+    return;
+  }
+  const subtreeStoredIds = subtreeIds(moved);
+  const subtree = new Set(subtreeStoredIds.map((id) => id.toLowerCase()));
+  const deletedShares = oldParentId == null ? [] : allShares.filter(
+    (share) => share.fromWorkspaceId.toLowerCase() === oldParentId.toLowerCase() && share.toWorkspaceId.toLowerCase() === moved.id.toLowerCase()
+  );
+  const [movedUsers, parentUsers, shared] = await Promise.all([
+    client.workspace(moved.id).users(),
+    newParent == null ? [] : client.workspace(newParent.id).users(),
+    Promise.all(
+      deletedShares.map(async (share) => ({
+        share,
+        ...await sharedResources(client, share)
+      }))
+    )
+  ]);
+  const plan = [
+    `Moving workspace ${label(moved.id)} from ${oldParentId == null ? "the top level (or a parent you cannot see)" : label(oldParentId)} to ${label(newParent?.id ?? null)}.`,
+    oldParentId == null ? "Shares from a parent you cannot see cannot be listed; the database deletes them with the move." : deletedShares.length === 0 ? `No shares from ${label(oldParentId)} into it to delete.` : `Will delete ${String(deletedShares.length)} share${deletedShares.length === 1 ? "" : "s"} from ${label(oldParentId)} into it: ${shared.map(
+      ({ share, resources }) => share.resourceId == null ? `all ${share.resourceKind}` : `${share.resourceKind} "${resources[0]?.name ?? share.resourceId}" (${share.resourceId})`
+    ).join("; ")}.`
+  ];
+  const warnings = [];
+  if (newParent != null && subtree.has(newParent.id.toLowerCase())) {
+    warnings.push(
+      `${label(newParent.id)} is inside ${label(moved.id)}; the database will refuse this move.`
+    );
+  }
+  const movedById = new Map(movedUsers.map((user) => [user.id, user]));
+  const parentById = new Map(parentUsers.map((user) => [user.id, user]));
+  const access = [
+    ...movedUsers,
+    ...parentUsers.filter((user) => !movedById.has(user.id))
+  ].flatMap((user) => {
+    const before = movedById.get(user.id)?.role ?? null;
+    const after = strongerRole(
+      movedById.get(user.id)?.directRole ?? null,
+      parentById.get(user.id)?.role ?? null
+    );
+    if (before === after) return [];
+    if (after == null)
+      return [`${userLabel(user)} loses ${before ?? "access"}`];
+    if (before == null) return [`${userLabel(user)} gains ${after}`];
+    return roleRank(after) > roleRank(before) ? [`${userLabel(user)} drops to ${after} from ${before}`] : [`${userLabel(user)} rises to ${after} from ${before}`];
+  });
+  if (access.length > 0) {
+    warnings.push(
+      `Access on ${label(moved.id)} (from its direct and inherited roles; descendants with their own grants may differ):`,
+      ...access.map((line) => `  ${line}`)
+    );
+  }
+  const sharedIds = shared.flatMap(
+    ({ share, resources }) => resources.map((resource) => ({ ...resource, kind: share.resourceKind }))
+  );
+  const sharedTotal = shared.reduce((sum2, { total }) => sum2 + total, 0);
+  const references = await client.resourceReferences(
+    sharedIds.slice(0, SHARED_RESOURCE_CAP).map((resource) => resource.id),
+    { referencerWorkspaceIds: subtreeStoredIds.slice(0, 500) }
+  ).catch((error62) => {
+    warnings.push(
+      `Could not check references: ${error62 instanceof Error ? error62.message : String(error62)}`
+    );
+    return null;
+  });
+  const sharedById = new Map(
+    sharedIds.map((resource) => [resource.id.toLowerCase(), resource])
+  );
+  const brokenReferences = (references?.inbound ?? []).flatMap((ref) => {
+    const resource = sharedById.get(ref.resourceId.toLowerCase());
+    return resource != null && subtree.has(ref.referencerWorkspaceId.toLowerCase()) ? [
+      `${ref.referencerKind} "${ref.referencerName}" (${ref.referencerId}) in ${label(ref.referencerWorkspaceId)} references ${resource.kind} "${resource.name}" (${resource.id}), shared by a share this move deletes`
+    ] : [];
+  });
+  if (brokenReferences.length > 0) {
+    warnings.push(
+      "May stop resolving (deployed content found by id; another share path may still reach it):",
+      ...brokenReferences.map((line) => `  ${line}`)
+    );
+  }
+  if (sharedTotal > SHARED_RESOURCE_CAP) {
+    warnings.push(
+      `Checked references for the first ${String(SHARED_RESOURCE_CAP)} of ${String(sharedTotal)} shared resources.`
+    );
+  }
+  printReport(args, {
+    plan,
+    warnings: warnings.length === 0 ? [] : ["WARN", ...warnings],
+    dryRun
+  });
+  if (dryRun) return;
+  const didMove = newParent == null ? await client.workspace(moved.id).moveToRoot() : await client.workspace(moved.id).setParent(newParent.id).then(() => true);
+  (flagValue(args, "-o", "--output") === "json" ? process.stderr : process.stdout).write(
+    didMove ? `Moved ${label(moved.id)}.
+` : `${label(moved.id)} was already at the top level, or its parent is not visible to you; nothing changed.
+`
+  );
+};
+var moveResource = async (args) => {
+  const [id] = positionals(args, ["--to", "-o", "--output"]);
+  const to = flagValue(args, "--to");
+  if (id == null || to == null) {
+    throw new Error(
+      "Usage: overai resource move <id> --to <workspaceId> [--dry-run]"
+    );
+  }
+  const dryRun = args.includes("--dry-run");
+  const client = cliClient();
+  const row = await client.resource(id).show();
+  const kind = idTableByPrefix(row.id);
+  const fromId = typeof row.workspaceId === "string" ? row.workspaceId : null;
+  if (kind == null || kind === "workspace" || fromId == null) {
+    throw new Error(
+      `${id} cannot be moved; use overai workspace move for a workspace.`
+    );
+  }
+  const [forest, allShares, membership] = await Promise.all([
+    client.workspaces.tree({ includeArchived: true }),
+    client.workspaces.shares(),
+    client.resourceGroups.membershipOf(row.id)
+  ]);
+  const byId = workspacesById(forest);
+  const label = (workspaceId) => {
+    const node2 = byId.get(workspaceId.toLowerCase());
+    return node2 == null ? workspaceId : `"${node2.name}" (${node2.id})`;
+  };
+  const destination = byId.get(to.toLowerCase());
+  if (destination == null) {
+    throw new Error(`Workspace ${to} not found (or not visible to you).`);
+  }
+  const subject = `${kind} "${rowName(row)}" (${row.id})`;
+  if (destination.id.toLowerCase() === fromId.toLowerCase()) {
+    (flagValue(args, "-o", "--output") === "json" ? process.stderr : process.stdout).write(`${subject} is already in ${label(fromId)}; nothing to move.
+`);
+    return;
+  }
+  const ownShares = allShares.filter(
+    (share) => share.resourceKind === kind && share.resourceId?.toLowerCase() === row.id.toLowerCase()
+  );
+  const plan = [
+    `Moving ${subject} from ${label(fromId)} to ${label(destination.id)}.`,
+    membership == null ? "It is in no resource group." : `Will remove it from group "${membership.groupName ?? membership.groupId}" (${membership.groupId}); a group holds only its own workspace's resources.`,
+    ownShares.length === 0 ? "No shares name it." : `Will delete ${String(ownShares.length)} share${ownShares.length === 1 ? "" : "s"} naming it: ${ownShares.map(
+      (share) => `${label(share.fromWorkspaceId)} \u2192 ${label(share.toWorkspaceId)}`
+    ).join("; ")}.`
+  ];
+  const warnings = [];
+  const failed = (what) => (error62) => {
+    warnings.push(
+      `Could not check ${what}: ${error62 instanceof Error ? error62.message : String(error62)}`
+    );
+    return null;
+  };
+  const [references, reach] = await Promise.all([
+    client.resource(row.id).references().catch(failed("references")),
+    kind === "agent" ? client.agentToolReach([row.id], destination.id).catch(failed("agent tool reach")) : null
+  ]);
+  const sharesAfter = allShares.filter((share) => !ownShares.includes(share));
+  const lostReach = [
+    ...(references?.inbound ?? []).flatMap(
+      (ref) => reaches(allShares, fromId, ref.referencerWorkspaceId, kind, row.id) && !reaches(
+        sharesAfter,
+        destination.id,
+        ref.referencerWorkspaceId,
+        kind,
+        row.id
+      ) ? [
+        `${ref.referencerKind} "${ref.referencerName}" (${ref.referencerId}) in ${label(ref.referencerWorkspaceId)} will no longer reach ${subject}`
+      ] : []
+    ),
+    ...(references?.outbound ?? []).flatMap(
+      (ref) => reaches(
+        allShares,
+        ref.targetWorkspaceId,
+        fromId,
+        ref.targetKind,
+        ref.targetId
+      ) && !reaches(
+        allShares,
+        ref.targetWorkspaceId,
+        destination.id,
+        ref.targetKind,
+        ref.targetId
+      ) ? [
+        `${subject} will no longer reach ${ref.targetKind} "${ref.targetName}" (${ref.targetId}) in ${label(ref.targetWorkspaceId)}`
+      ] : []
+    )
+  ];
+  if (lostReach.length > 0) {
+    warnings.push(
+      "References by id in deployed content (heuristic: same workspace, or a chain of shares of that kind):",
+      ...lostReach.map((line) => `  ${line}`)
+    );
+  }
+  const tools2 = (reach ?? []).flatMap((agent) => [
+    ...agent.tools.filter(
+      (tool) => tool.isReachable && tool.isReachableFromTarget === false
+    ).map(
+      (tool) => `${subject} will lose tool ${tool.kind} "${tool.name}" (${tool.id})`
+    ),
+    ...agent.hiddenLostAtTargetCount > 0 ? [
+      `${subject} will lose ${String(agent.hiddenLostAtTargetCount)} tool${agent.hiddenLostAtTargetCount === 1 ? "" : "s"} you cannot see`
+    ] : []
+  ]);
+  if (tools2.length > 0) {
+    warnings.push(
+      "Agent tools (from the server):",
+      ...tools2.map((line) => `  ${line}`)
+    );
+  }
+  printReport(args, {
+    plan,
+    warnings: warnings.length === 0 ? [] : ["WARN", ...warnings],
+    dryRun
+  });
+  if (dryRun) return;
+  const result = await client.resource(row.id).move(destination.id);
+  (flagValue(args, "-o", "--output") === "json" ? process.stderr : process.stdout).write(
+    `Moved ${subject} to ${label(result.workspaceId)}${result.leftGroup == null ? "" : `; it left group "${result.leftGroup.groupName ?? result.leftGroup.groupId}"`}.
+`
+  );
+};
+
 // src/commands/resource.ts
+var GROUP_USAGE = `Usage:
+  overai resource group list [--workspace <id>]
+  overai resource group create --workspace <id> --name <name>
+  overai resource group rename <groupId> --name <name>
+  overai resource group delete <groupId>
+  overai resource group add <groupId> <resourceId>...
+  overai resource group remove <resourceId>...
+`;
+var runGroup = async (args) => {
+  const [operation, ...rest] = args;
+  const ids = positionals(rest, ["--workspace", "--name", "-o", "--output"]);
+  const name2 = flagValue(rest, "--name");
+  const client = cliClient();
+  if (operation === "list") {
+    const workspaceId = flagValue(rest, "--workspace");
+    printResult(
+      (await client.resourceGroups.list({ workspaceId })).map((group) => ({
+        id: group.id,
+        name: group.name,
+        workspaceId: group.workspaceId,
+        resources: group.members.map((member) => member.resourceId).join(" ")
+      })),
+      resolveFormat(flagValue(rest, "-o", "--output"))
+    );
+    return;
+  }
+  if (operation === "create" && name2 != null) {
+    const workspaceId = flagValue(rest, "--workspace") ?? openClone().manifest.workspaceId;
+    const { id } = await client.resourceGroups.create({ workspaceId, name: name2 });
+    process.stdout.write(
+      `Created group "${name2}" (${id}) in ${workspaceId}.
+`
+    );
+    return;
+  }
+  const [groupId, ...resourceIds] = ids;
+  if (operation === "rename" && groupId != null && name2 != null) {
+    await client.resourceGroup(groupId).rename(name2);
+    process.stdout.write(`Renamed group ${groupId} to "${name2}".
+`);
+    return;
+  }
+  if (operation === "delete" && groupId != null) {
+    await client.resourceGroup(groupId).delete();
+    process.stdout.write(
+      `Deleted group ${groupId}; its resources stay in the workspace.
+`
+    );
+    return;
+  }
+  if (operation === "add" && groupId != null && resourceIds.length > 0) {
+    const previous = await client.resourceGroup(groupId).add(resourceIds);
+    resourceIds.forEach((resourceId, index) => {
+      const from = previous[index];
+      process.stdout.write(
+        `Added ${resourceId} to group ${groupId}${from == null || from.groupId === groupId ? "" : ` (left group "${from.groupName ?? from.groupId}")`}.
+`
+      );
+    });
+    return;
+  }
+  if (operation === "remove" && ids.length > 0) {
+    for (const resourceId of ids) {
+      const membership = await client.resourceGroups.removeMember(resourceId);
+      process.stdout.write(
+        membership == null ? `${resourceId} is in no group.
+` : `Removed ${resourceId} from group "${membership.groupName ?? membership.groupId}".
+`
+      );
+    }
+    return;
+  }
+  throw new Error(GROUP_USAGE.trimEnd());
+};
 var runResource = async (args) => {
   const [operation, id] = args;
+  if (operation === "move") {
+    await moveResource(args.slice(1));
+    return;
+  }
+  if (operation === "group") {
+    await runGroup(args.slice(1));
+    return;
+  }
   if (operation !== "show" && operation !== "update" || id == null) {
     throw new Error(
-      "Usage: overai resource show <id> | resource update <id> [--name <name>] [--description <text>] [--archive|--restore] [--enable|--disable] [--active|--inactive]"
+      `Usage: overai resource show <id> | resource update <id> [--name <name>] [--description <text>] [--archive|--restore] [--enable|--disable] [--active|--inactive] | resource move <id> --to <workspaceId> [--dry-run]
+${GROUP_USAGE}`
     );
   }
   const resource = resourceTableFor(id);
@@ -66377,6 +67334,10 @@ var webPagesDoc = {
   body: `
 Saves reject a stale editing base without discarding your draft. Incorporate the latest saved changes before retrying; never retry with a newer base unless those changes have been reconciled. A save conflict does not deploy anything.
 
+## Platform shortcuts
+
+In React pages (v1 and v2), Cmd/Ctrl+K toggles the command palette and Cmd/Ctrl+I toggles the Architect when the host provides them, including while typing in inputs. These combinations are reserved for OverAI; use other keys for page actions. Other keys stay inside the page. Pressing inside a page dismisses outside host dropdowns without cancelling the page interaction. Nested third-party iframes do not forward these events.
+
 ## Available Global Variables and Hooks
 
 \`\`\`typescript
@@ -66798,6 +67759,8 @@ Resources (functions, tablespaces, integrations, agents, action runners, librari
 
 To share a resource, go to the Workspace Overview page, and then click "Resource sharing" (Managers only) in the top bar.
 
+Moves clear sharing. Reparenting a workspace deletes the shares its old parent made into it, and moving a resource to another workspace deletes the shares that name it specifically and takes it out of its resource group. Re-share what the new location needs.
+
 Resources shared into a workspace appear in its Workspace Overview resource table alongside its own, each marked "Shared from <parent workspace>" ("Shared from another workspace" when the viewer can't see the parent), and the "Shared" filter chip narrows the table to them. They are read-only there: no action menu, no activity stats. A shared resource's name links to its page only when the viewer holds a builder role in the workspace that owns it; otherwise the row is listed but not clickable. A shared library is the exception: it always opens, read-only, viewed from the child workspace. To change or unshare it, a manager of the parent workspace uses "Resource sharing" there.
 
 An agent's tools (functions, tablespaces, sub-agents, knowledge bases) resolve from the agent's own workspace, never the caller's. Sharing an agent therefore lets the recipient use its tools through it without those tools being shared. A library's own imports work the same way: sharing a library brings what it imports along. Moving an agent to a workspace that can't reach a tool silently drops that tool at runtime; the agent page header shows "N tools unavailable" when this has happened. Fix it by sharing the tool into the agent's workspace or moving the tool, not by detaching it.
@@ -67445,10 +68408,99 @@ var listWorkspaceUsers = async (args) => {
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
+var printTree = async (args) => {
+  const [workspaceId] = positionals(args, ["-o", "--output"]);
+  const includeArchived = args.includes("--archived");
+  const client = cliClient();
+  const roots = workspaceId == null ? await client.workspaces.tree({ includeArchived }) : [await client.workspace(workspaceId).tree({ includeArchived })];
+  if (resolveFormat(flagValue(args, "-o", "--output")) !== "table") {
+    printResult(roots, "json");
+    return;
+  }
+  const lines = (node2, depth) => [
+    `${"  ".repeat(depth)}${node2.name}  ${node2.id}${node2.role == null ? "" : `  ${node2.role}`}${node2.isArchived ? "  archived" : ""}`,
+    ...node2.children.flatMap((child) => lines(child, depth + 1))
+  ];
+  process.stdout.write(
+    `${roots.flatMap((root) => lines(root, 0)).join("\n") || "(no workspaces)"}
+`
+  );
+};
+var listShares = async (args) => {
+  const workspaceId = workspaceIdFrom(args);
+  const client = cliClient();
+  const shares = await client.workspace(workspaceId).shares();
+  const names = new Map(
+    await Promise.all(
+      shares.flatMap(
+        (share) => share.resourceId == null ? [] : [
+          client.resource(share.resourceId).show().then(
+            (row) => [
+              share.resourceId,
+              typeof row.name === "string" ? row.name : ""
+            ],
+            () => [share.resourceId, ""]
+          )
+        ]
+      )
+    )
+  );
+  printResult(
+    shares.map((share) => ({
+      from: `${share.fromWorkspaceName ?? ""} (${share.fromWorkspaceId})`,
+      to: `${share.toWorkspaceName ?? ""} (${share.toWorkspaceId})`,
+      kind: share.resourceKind,
+      resource: share.resourceId == null ? `all ${share.resourceKind}` : `${names.get(share.resourceId) ?? ""} (${share.resourceId})`
+    })),
+    resolveFormat(flagValue(args, "-o", "--output"))
+  );
+};
+var shareResource = async (args) => {
+  const [fromId] = positionals(args, [
+    "--to",
+    "--kind",
+    "--resource",
+    "-o",
+    "--output"
+  ]);
+  const to = flagValue(args, "--to");
+  const kind = flagValue(args, "--kind");
+  if (fromId == null || to == null || kind == null) {
+    throw new Error(
+      "Usage: overai workspace share <fromWorkspaceId> --to <childWorkspaceId> --kind <kind> [--resource <id>] [--remove]"
+    );
+  }
+  const shareKind = SHARE_KINDS.find((known) => known === kind);
+  if (shareKind == null) {
+    throw new Error(
+      `Unknown share kind "${kind}". Use one of: ${SHARE_KINDS.join(", ")}.`
+    );
+  }
+  const client = cliClient();
+  const typedResourceId = flagValue(args, "--resource");
+  const resourceId = typedResourceId == null ? null : (await client.resource(typedResourceId).show()).id;
+  const what = resourceId == null ? `all ${shareKind}` : `${shareKind} ${resourceId}`;
+  const input2 = { toWorkspaceId: to, kind: shareKind, resourceId };
+  if (args.includes("--remove")) {
+    await client.workspace(fromId).unshare(input2);
+    process.stdout.write(
+      `Stopped sharing ${what} from ${fromId} into ${to}.
+`
+    );
+    return;
+  }
+  await client.workspace(fromId).share(input2);
+  process.stdout.write(`Shared ${what} from ${fromId} into ${to}.
+`);
+};
 var USAGE5 = `Usage:
   overai workspace list [--archived] [--limit <n>]
   overai workspace show [workspaceId]
   overai workspace users [workspaceId]
+  overai workspace tree [workspaceId] [--archived]
+  overai workspace move <workspaceId> --to <parentWorkspaceId|root> [--dry-run]
+  overai workspace shares [workspaceId]
+  overai workspace share <fromWorkspaceId> --to <childWorkspaceId> --kind <${SHARE_KINDS.join("|")}> [--resource <id>] [--remove]
 `;
 var runWorkspace = async (args) => {
   if (args[0] === "list") {
@@ -67463,6 +68515,22 @@ var runWorkspace = async (args) => {
     await listWorkspaceUsers(args.slice(1));
     return;
   }
+  if (args[0] === "tree") {
+    await printTree(args.slice(1));
+    return;
+  }
+  if (args[0] === "move") {
+    await moveWorkspace(args.slice(1));
+    return;
+  }
+  if (args[0] === "shares") {
+    await listShares(args.slice(1));
+    return;
+  }
+  if (args[0] === "share") {
+    await shareResource(args.slice(1));
+    return;
+  }
   process.stderr.write(USAGE5);
   process.exitCode = 1;
 };
@@ -67566,10 +68634,33 @@ Usage:
   overai workspace show [workspaceId]  Show a workspace's name and overview
   overai workspace users [workspaceId] List users and effective/direct roles
                                        (workspaceId defaults from a clone)
+  overai workspace tree [workspaceId] [--archived]
+                                       Print the workspace hierarchy; no id
+                                       prints every top-level workspace
+  overai workspace move <workspaceId> --to <parentId|root> [--dry-run]
+                                       Reparent a workspace; prints the shares
+                                       it loses and who gains or loses access
+  overai workspace shares [workspaceId] List shares from and into a workspace
+  overai workspace share <fromWorkspaceId> --to <childWorkspaceId> --kind <kind> [--resource <id>] [--remove]
+                                       Share a kind (table_space, function,
+                                       agent, integration, action_runner), or
+                                       one resource, into a direct child
   overai create <type> [--workspace <id>] [--name <name>]
                                        Create a complete, usable resource
   overai resource show <id>             Show metadata for any resource
   overai resource update <id> [...]     Edit metadata, state, or archive status
+  overai resource move <id> --to <workspaceId> [--dry-run]
+                                       Move a resource to another workspace;
+                                       prints the group and shares it loses and
+                                       references that may stop resolving
+  overai resource group list [--workspace <id>]
+  overai resource group create --workspace <id> --name <name>
+  overai resource group rename <groupId> --name <name>
+  overai resource group delete <groupId>
+  overai resource group add <groupId> <resourceId>...
+  overai resource group remove <resourceId>...
+                                       Side-navigation groups: flat, one per
+                                       resource, same workspace
   overai graphql -q '<query>' | -f <file> [--variables <json>] [--v1]
                                        Run a GraphQL operation (/v2; --v1 = legacy Hasura)
   overai fn <functionId> [--method GET] [--path /features/123] [--input k=v ... | -]

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@overaihq/cli",
-  "version": "0.14.15",
+  "version": "0.15.1",
   "description": "Create, edit, deploy, and run OverAI workspace resources from the command line",
   "type": "module",
   "homepage": "https://overai.com",
   "engines": {
-    "node": ">=24.22.0"
+    "node": ">=24.22.1"
   },
   "bin": {
     "overai": "./dist/index.js"
@@ -20,7 +20,7 @@
     "access": "public"
   },
   "devDependencies": {
-    "@overaihq/sdk": "0.4.0",
+    "@overaihq/sdk": "0.5.1",
     "@perygee/common": "0.0.0",
     "@types/node": "^24.19.2",
     "@types/proper-lockfile": "^4.1.4",