@oxagen/cli 1.0.0 → 2.1.4-363

package/README.md

@@ -1,480 +1,292 @@
-# Oxagen CLI
-
-Command-line interface for the [Oxagen](https://oxagen.ai) platform. Chat with the agent, run workflows, generate content, manage your organization, and integrate external MCP servers — all from your terminal.
-
-## Installation
-
-```bash
-npm install -g @oxagen/cli
-# or
-pnpm add -g @oxagen/cli
-```
+# @oxagen/cli
+
+The governance-operations CLI for the Oxagen control plane: spend ceilings and
+cost, run traces, knowledge-graph grounding, agent memory,
+environments, the credential vault, and audit logs — from the terminal.
+
+Oxagen **governs, grounds, explains, meters/bills and rates** agents; it does
+not run them ([ADR-043](../../docs/adr/ADR-043-runtime-excision.md)). The
+interactive coding agent this CLI used to ship — the REPL, sandboxes, skills,
+slash commands, evals, local rules and settings — is gone. Stella owns all
+things agentic: use the `stella` CLI with the oxagen MCP server. Every removed
+entry point stays registered as a stub that prints exactly that, so a stale
+script fails with guidance instead of an unknown-command error.
+
+Full reference: **https://docs.oxagen.sh/docs/cli**
+
+## Boundary
+
+- **Owns:** the `oxagen` command tree (`src/program.ts`), the browser login
+  with PKCE and a loopback listener (`src/auth/`), the local config and
+  workspace binding (`src/lib/config.ts`, `.oxagen/workspace.json`), the HTTP
+  client for the platform API (`src/lib/api.ts`), output formatting, the
+  retirement stubs for the former coding-agent commands, and anonymous usage
+  telemetry (`src/telemetry/usage.ts`).
+- **Does not own:** any capability logic. Every command that reads or changes
+  platform state calls [`apps/api`](../api/README.md) over HTTP, and the
+  kernel runs there. It also does not own the work behind the machine
+  commands (`oxagen agent enroll`, `oxagen agent run`, `oxagen hook`,
+  `oxagen daemon`, and the rest), which lives in
+  [`@oxagen/recorder`](../../packages/tacho/README.md) (`@oxagen/recorder/cli`),
+  the steering freshness check
+  ([`@oxagen/steering-freshness`](../../packages/steering-freshness/README.md)),
+  or the consent page it opens (`/cli/authorize` in
+  [`apps/app`](../app/README.md)).
+- **Depends on:** `@oxagen/recorder` (the machine commands under
+  `oxagen agent`, and the hidden ones the hooks and the service run),
+  `@oxagen/steering-freshness` (`oxagen steering`),
+  and `@oxagen/billing` (`formatUsd` and the rate card from
+  `@oxagen/billing/rate-card`, for display).
+- **Used by:** no workspace package imports it. It is published as the
+  `oxagen` binary.
+
+## Seams
+
+| Seam | Kind | Source | Wired by |
+|---|---|---|---|
+| Platform API client (`/v1/{org}/{workspace}/…`, `/v1/user/…`, bearer token) | boundary | `apps/cli/src/lib/api.ts` | Commands in `apps/cli/src/commands/`. Served by `apps/api/src/app.ts` |
+| Browser login (`/cli/authorize`, then `POST /v1/auth/cli/token`) | boundary | `apps/cli/src/auth/loopback-login.ts`, `pkce.ts` | `oxagen login` |
+| `CliDeps` from `defaultCliDeps` | adapter | `apps/cli/src/commands/tacho.ts` | `oxagen agent enroll`, `status`, `reassign`, `unenroll`, `export`, `verify`, `hosts`, `run`, and `detect`, and the hidden alias group that keeps the older spelling. The work lives in `@oxagen/recorder/cli` |
+| Machine command dispatch | adapter | `apps/cli/src/index.ts`, `apps/cli/src/machine/` | `oxagen hook`, `daemon`, `mcp-stdio`, `credential`, `github`, and `arp`, which go straight to the recorder before the command tree loads. Hidden from `oxagen --help` |
+| `evaluateGate`, `renderGate`, `installHook` | adapter | `apps/cli/src/commands/steering.ts` | `oxagen steering …`, and each harness's prompt-submit hook |
+| Usage telemetry (`POST /v1/telemetry/usage`) | boundary | `apps/cli/src/telemetry/usage.ts` | Every command, unless `oxagen telemetry off` or `DO_NOT_TRACK=1` |
+| Retired command stubs | registry | `apps/cli/src/commands/retired.ts` | `apps/cli/src/program.ts` |
+
+The CLI bootstraps no kernel gate and registers no handler. Contracts that
+declare the `cli` surface are served through the API, and
+`pnpm check:manifest` counts the `cli` layer as met when a command file exists
+for the capability or a command file names it.
+
+## Entry points
+
+- `bin.oxagen` → `dist/index.js`, built by `tsc` from `src/index.ts`. It
+  sends the machine commands (`hook`, `daemon`, `mcp-stdio`, `credential`,
+  `github`, `arp`) straight to the recorder through `src/machine/`, and every
+  other command to `src/main.ts`, which installs the fatal-error handlers and
+  hands off to `buildProgram()` in `src/program.ts`.
+- `pnpm bundle` → `scripts/bundle.mjs`: the standalone single-file bundle.
+- `pnpm compile` → a single executable, built by `tools/sea/compile.mjs` (see
+  [`tools/sea`](../../tools/sea/README.md)).
+
+## Rules
+
+- The CLI governs agents and runs none (ADR-043). A former coding-agent
+  command stays registered as a stub that points to `stella`.
+- Commands reach platform state through the API only, never through a
+  database client or the kernel.
+- Telemetry never carries code, prompts, file contents, paths, model slugs,
+  or keys.
+
+## Tests
 
 ```bash
-oxagen --version
+pnpm --filter @oxagen/cli test:unit src/commands/steering.test.ts
 ```
 
-### From source
-
-```bash
-cd oxagen-monorepo
-pnpm install
-pnpm -C apps/cli build
-node apps/cli/dist/index.js --version
-```
-
-## Interactive mode
-
-Run `oxagen` with no arguments in a terminal to open the interactive TUI: an
-ASCII banner and a keyboard-navigable menu of every command group and command.
+Never put `--` before the filename. Tests live in `src/**/__tests__/` and
+beside their sources as `*.test.ts`.
 
-- `↑/↓` move · `↵` select · `Esc` back · `q` quit · type to filter
-- Selecting a command opens a form for its arguments and flags, then runs it.
-- Secret inputs (passwords, tokens) are masked.
-
-Disable it (always print help instead) with `OXAGEN_NO_TUI=1`. Non-interactive
-usage — `oxagen <command> …`, pipes, and CI — is unaffected.
+## Installation
 
-## Authentication
+Three ways, in the order the docs recommend
+(https://docs.oxagen.sh/docs/cli/installation):
 
-### Interactive (default)
+1. **The Oxagen app.** Download it from https://downloads.oxagen.sh/. On first
+   launch it links `oxagen` onto your PATH.
+2. **A single executable.** Each version publishes `oxagen-<rust triple>`
+   (`oxagen-aarch64-apple-darwin`, `oxagen-x86_64-unknown-linux-gnu`, and so
+   on) with a `.sha256` beside it, at
+   `https://downloads.oxagen.sh/latest/<file>` and
+   `https://downloads.oxagen.sh/desktop/<version>/<file>`. It needs no Node.js.
+3. **npm.** `npm install -g @oxagen/cli`. The package on npm lags the app
+   (#4489).
 
-Run `oxagen login` in a terminal. A browser window opens at
-`https://app.oxagen.sh/cli/authorize`. After you approve, the CLI receives
-the token via a local loopback callback and saves the session automatically.
+**From a checkout of this repository** (contributors):
 
 ```bash
-oxagen login       # opens browser, handles the full OAuth + PKCE flow
-oxagen logout      # clear the saved session
+pnpm install
+pnpm --filter @oxagen/cli start -- --version     # run from source (tsx)
+# or
+pnpm --filter @oxagen/cli build                  # compile once
+node apps/cli/dist/index.js --version
 ```
 
-### CI / headless
-
-When running in a non-interactive environment (CI, Docker, SSH pipe), pass
-`--token`, `--org`, and `--workspace` directly:
+**Standalone bundle** (portable, no install, for CI and containers):
 
 ```bash
-oxagen login \
-  --token  oxg_live_... \
-  --org    my-org \
-  --workspace  main
+pnpm --filter @oxagen/cli bundle
+node apps/cli/dist-standalone/oxagen.mjs --version
 ```
 
-You can also set environment variables instead of flags (checked first, before
-config file):
+> The standalone bundle is what
+> `pnpm --filter @oxagen/cli publish:standalone` ships: the single-file bundle
+> plus a clean manifest. Publishing `apps/cli/package.json` as-is does **not**
+> work: its `bin` points at `dist/index.js`, whose shebang is
+> `#!/usr/bin/env tsx`, and its `dependencies` still carry unpublished
+> `workspace:*` packages.
 
-```bash
-export OXAGEN_API_TOKEN=oxg_live_...
-export OXAGEN_ORG_ID=my-org
-export OXAGEN_WORKSPACE_ID=main
-```
-
-### Opt out of the browser on an interactive TTY
+## Authentication
 
 ```bash
-oxagen login --no-browser   # prompts for token, org, and workspace inline
+oxagen login                                        # opens a browser, OAuth + org/workspace picker
+oxagen login --token oxk_live_… --org acme --workspace main   # CI / headless
+oxagen logout                                        # clear the saved session
+oxagen graph search -q "workspace context" --limit 1 # confirm credentials work
 ```
 
-Your session is written to `~/.config/oxagen/config.json` and reused by all subsequent commands.
-
-## Real-world scenarios
-
-### Chat with the agent
-
-```bash
-# One-shot message
-oxagen chat send "Summarize our Q2 pipeline and flag any blockers"
-
-# Resume an existing conversation
-oxagen chat send "Add the EMEA numbers too" --conversation conv_abc123
+Create an account at https://app.oxagen.sh, mint an API key under
+**Organization → Developer → Tokens**, then see
+https://docs.oxagen.sh/docs/cli/account-setup for the full setup.
 
-# List recent conversations
-oxagen conversation list
+## Commands
 
-# Post directly to a known conversation ID
-oxagen conversation chat --conversation conv_abc123 --message "What changed since Monday?"
+Run `oxagen --help` for the live, authoritative list; append `--help` to any
+command for its flags. The full command tree lives in
+`apps/cli/src/program.ts` and is documented at
+https://docs.oxagen.sh/docs/cli/commands.
 
-# Rename a conversation for future reference
-oxagen conversation rename --conversation conv_abc123 --name "Q2 Pipeline Review"
-```
+Everything except `cost`, `logs` and `telemetry` talks to the platform API and
+needs `oxagen login` first. `oxagen agent enroll` with a one-time enrollment
+token needs no login either.
 
-### Run a workflow from CI/CD
+**Meter and bill**
 
 ```bash
-# Trigger a release-notes workflow from a GitHub Action or deploy hook
-oxagen workflow run \
-  --workflow release-notes-generator \
-  --input '{"version":"2.1.0","repo":"acme/platform"}'
-
-# Poll until it finishes
-oxagen workflow status --id wf_xyz789
-
-# Cancel if something goes wrong mid-run
-oxagen workflow cancel --id wf_xyz789
+oxagen budget show                  # spend ceilings with their live burn
+oxagen budget set --scope org --period month --limit 500
+oxagen cost --in 200000 --out 40000 # project cost from the baked-in rate card
+oxagen cost --rates                 # print the rate card
+oxagen router stats|preview|policy  # the verified-outcome market router
 ```
 
-### Register an external MCP server
-
-Expose your own tools to the Oxagen agent. Once registered, the server appears in the web app's MCP picker and can be toggled on per-conversation.
+**Explain** — traces and audit
 
 ```bash
-# Register a streamable-http server with bearer auth
-oxagen agent mcp register \
-  --name "internal-data-api" \
-  --url https://tools.internal.example.com/mcp \
-  --transport streamable-http \
-  --auth bearer \
-  --auth-config '{"token":"sk-..."}'
-
-# Register a local stdio server
-oxagen agent mcp register \
-  --name "filesystem-tools" \
-  --url file:///usr/local/bin/my-mcp-server \
-  --transport stdio
-
-# Check health and discovered tool counts
-oxagen agent mcp list
+oxagen trace <executionId>          # a run as a span tree (steps, tool calls, children)
+oxagen logs                         # tail the CLI's own debug log
 ```
 
-### Connect Claude Code to Oxagen's MCP server
-
-The Oxagen platform itself is an MCP server. Connect Claude Code, Claude Desktop, or Cursor to it using an API key.
-
-**Claude Code**
+**Ground** — knowledge graph and agent memory
 
 ```bash
-oxagen api-key create   # copy the key that's printed
-
-claude mcp add oxagen \
-  --transport http \
-  --url https://mcp.oxagen.sh/mcp \
-  --header "Authorization: Bearer $OXAGEN_API_KEY"
-```
-
-**Claude Desktop** — add to `claude_desktop_config.json`:
-
-```json
-{
-  "mcpServers": {
-    "oxagen": {
-      "command": "npx",
-      "args": ["-y", "@oxagen/mcp-client"],
-      "env": { "OXAGEN_API_KEY": "your-key-here" }
-    }
-  }
-}
+oxagen graph search -q "…"
+oxagen memory list|show|promote|dismiss|import   # the memories agents wrote in their harnesses
 ```
 
-You can also retrieve connection instructions directly:
+**Govern** — workspace, agents, credentials
 
 ```bash
-oxagen system install instructions
+oxagen init --org <org> --workspace <ws>          # link this project to an org + workspace
+oxagen pull                                       # write the workspace's published steering into .oxagen/
+oxagen steering import <paths...>                 # preview Markdown files as steering records and policies, then --yes opens the PR
+oxagen agent env bind|unbind|list                 # bind an agent to an environment
+oxagen env list|get|create|update|rm|set-default  # workspace environments
+oxagen secret list|set|rm|reveal|import|export    # encrypted credential vault
+oxagen conversation export <id>                   # export a conversation as md/pdf
+oxagen asset upload <url>                         # ingest a binary asset
 ```
 
-### Generate images and media
+**Wrap agents on this machine**
 
 ```bash
-# Generate an image and print the URL
-oxagen image generate --prompt "isometric diagram of a multi-agent system"
-
-# Generate and save to disk
-oxagen image generate \
-  --prompt "product screenshot mockup, clean UI" \
-  --model gpt-image-1 \
-  --output ./assets/hero.png
-
-# Analyze an existing image
-oxagen image analyze --image ./screenshot.png
-
-# Generate a video clip
-oxagen video generate --prompt "short animation of data flowing through a pipeline"
-
-# Generate an SVG illustration
-oxagen svg generate --prompt "simple icon of a robot holding a document"
+oxagen agent enroll --harness claude-code,codex   # hook these harnesses and install the collector service
+oxagen agent status                               # enrollments, collector, hooks, bundle, spool
+oxagen agent verify --harness codex               # one headless turn, confirmed chained
+oxagen agent run --name my-agent -- ./my-agent    # one custom agent session under Oxagen
+oxagen agent detect                               # which harnesses this machine has
+oxagen agent reassign|unenroll|export|hosts       # move, remove, export, list machines
 ```
 
-### Onboard a new team
-
-```bash
-# Create the org and workspace
-oxagen org create --name "Acme Corp"
-oxagen workspace create --name "Engineering" --org acme-corp
-
-# Invite members
-oxagen workspace invite send --email alice@acme.com --org acme-corp --workspace engineering
-oxagen workspace invite send --email bob@acme.com   --org acme-corp --workspace engineering
-
-# Promote to admin after they accept
-oxagen org member role change --user user_alice --role admin --org acme-corp
-
-# List who's in the workspace
-oxagen workspace member list --org acme-corp --workspace engineering
-```
+`oxagen hook`, `oxagen daemon`, `oxagen mcp-stdio`, `oxagen credential`,
+`oxagen github`, and `oxagen arp` are hidden from help. The hooks, the user
+service, and the connected apps that enrollment installs run them.
 
-### Work with documents
+**Telemetry**
 
 ```bash
-# Create a document
-oxagen document create --title "Architecture Overview" --content "# Overview\n..."
-
-# Generate a document from a prompt (agent writes it)
-oxagen documents generate --prompt "Write a technical spec for our billing reconciliation system"
-
-# Export to PDF
-oxagen documents pdf create --document doc_abc123 --output spec.pdf
-
-# List all documents
-oxagen document list
+oxagen telemetry [on|off|status]    # anonymous usage telemetry (on by default)
 ```
 
-### Manage plugins
+**Auth**
 
 ```bash
-# Browse what's available
-oxagen plugin catalog browse
-
-# Install for the org
-oxagen plugin org install --listing listing_linear
-
-# Enable for a specific workspace only
-oxagen plugin workspace set-enabled --plugin plugin_xyz --enabled true
-
-# Set OAuth credentials
-oxagen plugin credential set-secret --plugin plugin_linear --key access_token --value sk-...
-
-# List what's installed
-oxagen plugin org list
-
-# Remove
-oxagen plugin org uninstall --listing listing_linear
-```
-
-### Run background agent tasks
-
-```bash
-# Start a long-running analysis task
-oxagen agent task background start \
-  --description "Analyze all GitHub issues opened this week and produce a triage report"
-
-# Check progress
-oxagen agent task background read --task task_abc123
-
-# Cancel
-oxagen agent task background cancel --task task_abc123
-```
-
-### Automations
-
-```bash
-# Create a scheduled automation
-oxagen automation create \
-  --name "daily-standup-summary" \
-  --trigger '{"type":"cron","schedule":"0 9 * * 1-5"}'
-
-# Trigger manually (e.g., from a webhook handler)
-oxagen automation trigger --automation auto_abc123
-
-# List all automations
-oxagen automation list
-```
-
----
-
-## All commands
-
-```
 oxagen login / logout
-
-oxagen chat send
-oxagen conversation list / rename / archive / delete / purge / chat
-
-oxagen workflow run / status / cancel
-oxagen automation create / list / trigger
-
-oxagen agent mcp register / list
-oxagen agent memory recall / write
-oxagen agent skill list
-oxagen agent task background start / read / cancel
-oxagen agent tool list
-oxagen agent plan create / approve
-oxagen agent approval resolve
-
-oxagen image generate / analyze / create / list
-oxagen video generate
-oxagen svg generate
-oxagen documents generate / pdf create
-oxagen document create / list / read
-oxagen archive create
-oxagen asset upload
-oxagen form create / fill / submit
-
-oxagen org create / list
-oxagen org member add / remove / role change / invite accept / invite decline
-oxagen workspace create / list
-oxagen workspace invite send
-oxagen workspace member list
-oxagen workspace model settings read / write
-
-oxagen plugin catalog browse / get
-oxagen plugin org install / install-bulk / uninstall / list / set-enabled
-oxagen plugin workspace set-enabled
-oxagen plugin registry add / list / remove / sync
-oxagen plugin credential reauth / set-secret
-oxagen plugin denylist add / remove
-oxagen plugin settings set-auth-alerts
-
-oxagen billing status
-oxagen billing credits purchase
-oxagen billing subscription read / upgrade start
-
-oxagen api-key create / revoke
-
-oxagen skill workspace list
-oxagen user preferences read / write
-oxagen notifications list / mark
-oxagen privacy export / erase
-oxagen system install instructions
 ```
 
-Pass `--help` to any command for flags and usage:
+### Retired commands
 
-```bash
-oxagen workflow run --help
-```
+`sandbox`, `sandbox-template`, `code`, `eval`, `file-lock`, `a2a`, `models`,
+`skill`, `prompt`, `command`, `rules`, `settings`, `config`, `mcp`, `import`,
+`pr`, `recover`, `lineage`, plus the interactive surfaces (`view`, `agents`, `solve`,
+`replay`, `fleet`) and a bare `oxagen "<prompt>"`. Each prints a
+retirement notice and exits non-zero. Use the `stella` CLI instead.
 
----
+The CLI no longer reads `.oxagen/settings.json` — that file configured the
+local coding agent. The only project-local state it writes is
+`.oxagen/workspace.json` (the org + workspace binding `oxagen init` creates).
 
 ## Configuration
 
-Session token and defaults are stored in `~/.config/oxagen/`. To avoid passing org and workspace IDs on every command, set these environment variables:
+Session token and defaults live in `~/.config/oxagen/config.json`. Set these
+to avoid passing org/workspace on every command (env vars win over the config
+file):
 
 ```bash
-export OXAGEN_ORG_ID=org_abc123
-export OXAGEN_WORKSPACE_ID=ws_xyz789
-export OXAGEN_API_TOKEN=sk-...
+export OXAGEN_ORG_ID=your-org-slug
+export OXAGEN_WORKSPACE_ID=your-workspace-slug
+export OXAGEN_API_TOKEN=oxk_live_…
+export OXAGEN_API_URL=https://api.oxagen.sh    # default; override for self-hosted/staging
 ```
 
-The CLI checks environment variables first, then falls back to saved config, then to command-line flags:
-
-```bash
-# Uses OXAGEN_WORKSPACE_ID env var if set, falls back to ~/.config/oxagen/config.json
-oxagen automation list
-
-# Overrides env var with explicit flag
-oxagen automation list --workspace ws_different456
-
-# Authenticate and save defaults to config (opens browser)
-oxagen login
-```
-
----
-
 ## Telemetry
 
 The CLI collects anonymous usage telemetry (command names, durations, coarse
-success/error categories, OS/arch) to improve the product. It **never**
-collects code, prompts, file contents, file paths, model slugs, API keys, or
-any other personal or identifying data — see [TELEMETRY.md](../../TELEMETRY.md)
-for the exact field list.
-
-Telemetry is **on by default**. Opt out any time:
-
-```bash
-oxagen telemetry off       # persists the choice to ~/.config/oxagen/config.json
-oxagen telemetry status    # show enabled/disabled, install id, ingest endpoint
-oxagen telemetry on        # re-enable
-
-# or, without touching config:
-export OXAGEN_TELEMETRY=0
-export DO_NOT_TRACK=1      # https://consoledonottrack.com/
-```
-
----
-
-## Troubleshooting
-
-**`command not found: oxagen`** — ensure global install succeeded:
+success/error categories, OS/arch) to improve the product. It never collects
+code, prompts, file contents, file paths, model slugs, API keys, or other
+personal data. On by default:
 
 ```bash
-npm list -g @oxagen/cli
-npm install -g @oxagen/cli
+oxagen telemetry off
+oxagen telemetry status
+export DO_NOT_TRACK=1   # https://consoledonottrack.com/
 ```
 
-**Auth failures** — clear and re-authenticate:
-
-```bash
-oxagen logout && oxagen login
-```
-
----
-
 ## Development
 
-### Install the `oxagen` binary onto your PATH (live, auto-rebuilding)
-
-Run this once from the **repo root** and leave it running:
+Run this once from the **repo root** and leave it running — it builds the
+package, installs an `oxagen` binary onto your PATH, then watches
+`apps/cli/src/**` and rebuilds on every save:
 
 ```bash
 pnpm cli:dev
 ```
 
-This builds the package, installs an `oxagen` binary onto your PATH, then watches
-`apps/cli/src/**` and rebuilds on every save. After it prints `watching for
-changes…`, open a second terminal and use `oxagen` like a published binary — every
-source edit is live on the next invocation, with no reinstall step:
-
-```bash
-oxagen --version
-oxagen --help
-oxagen login
-```
-
-**How it works.** The installed binary is a symlink from a PATH directory
-(`~/.local/bin/oxagen` when that's on your PATH) into the package's build output
-(`apps/cli/dist/index.js`). `tsc --watch` rewrites `dist/` in place on every change,
-and because a symlink always resolves to its target's current contents, the on-PATH
-`oxagen` is always the freshly-built code — the "reinstall" is automatic.
-
-Want a one-shot install without the watcher (build once, link, exit)?
+Open a second terminal and use `oxagen` like a published binary; every source
+edit is live on the next invocation. One-shot install without the watcher:
 
 ```bash
 pnpm cli:install
 ```
 
-If `cli:dev` warns that the chosen directory isn't on your PATH, add it to your shell
-profile (the script prints the exact line), e.g.:
+Other workflows:
 
 ```bash
-export PATH="$HOME/.local/bin:$PATH"
+pnpm -C apps/cli dev -- graph search -q "workspace context" --limit 1
+pnpm -C apps/cli build                  # compile to dist/ once
+pnpm -C apps/cli bundle                 # standalone single-file bundle
+pnpm -C apps/cli test:unit src/commands/steering.test.ts   # one file; CI runs the suite
+pnpm -C apps/cli lint                   # lint (zero warnings enforced)
+pnpm -C apps/cli typecheck              # type-check
 ```
 
-To uninstall the dev binary, remove the symlink: `rm "$(command -v oxagen)"`.
-
-### Other workflows
-
-```bash
-pnpm -C apps/cli dev -- auth whoami   # run a single command from source with tsx
-pnpm -C apps/cli build                # compile to dist/ once
-pnpm -C apps/cli test:unit            # run unit tests
-pnpm -C apps/cli lint                 # lint (zero warnings enforced)
-pnpm -C apps/cli typecheck            # type-check
-```
-
-Releases are managed monorepo-wide via `pnpm release:patch|minor|major`, which bumps all packages to the same version and syncs to Vercel.
-
-### Known gaps
-
-See [`GAPS.md`](./GAPS.md) for the tracked completeness, capability-parity, and `--help`
-documentation gaps and their prioritized fix plan.
-
----
+Releases are managed monorepo-wide via `pnpm release:patch|minor|major`, which
+bumps all packages to the same version and syncs it to Vercel.
 
 ## Support
 
 - Docs: https://docs.oxagen.sh
-- Issues: https://github.com/oxagen/oxagen-monorepo/issues
-- Email: support@oxagen.ai
+- Issues: https://github.com/oxageninc/product/issues
 
 ## License
 
-MIT
+Proprietary — see [`LICENSE`](../../LICENSE).