@prismer/sdk 2.0.6 → 2.0.8

package/dist/cli.js

@@ -36,9 +36,9 @@ __export(cli_exports, {
 });
 module.exports = __toCommonJS(cli_exports);
 var import_commander = require("commander");
-var fs4 = __toESM(require("fs"));
-var path4 = __toESM(require("path"));
-var os2 = __toESM(require("os"));
+var fs7 = __toESM(require("fs"));
+var path5 = __toESM(require("path"));
+var os3 = __toESM(require("os"));
 var TOML2 = __toESM(require("@iarna/toml"));
 
 // src/realtime.ts
@@ -163,7 +163,7 @@ var RealtimeWSClient = class extends TypedEmitter {
     if (this._state === "connected" || this._state === "connecting") return;
     this._state = "connecting";
     this.intentionalClose = false;
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve6, reject) => {
       try {
         this.ws = new this.WS(this.wsUrl);
       } catch (err) {
@@ -185,7 +185,7 @@ var RealtimeWSClient = class extends TypedEmitter {
             this.emit("connected", void 0);
             this.ws.removeEventListener("message", onFirstMessage);
             this.ws.addEventListener("message", this.handleMessage);
-            resolve3();
+            resolve6();
           }
         } catch (_) {
         }
@@ -257,12 +257,12 @@ var RealtimeWSClient = class extends TypedEmitter {
   }
   ping() {
     const requestId = `ping-${++this.pingCounter}`;
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve6, reject) => {
       const timer = setTimeout(() => {
         this.pendingPings.delete(requestId);
         reject(new Error("Ping timeout"));
       }, 1e4);
-      this.pendingPings.set(requestId, { resolve: resolve3, timer });
+      this.pendingPings.set(requestId, { resolve: resolve6, timer });
       this.sendRaw({ type: "ping", payload: { requestId } });
     });
   }
@@ -515,9 +515,9 @@ var WRITE_PATTERNS = [
   { method: "POST", pattern: /\/api\/im\/community\/posts\/[^/]+\/comments$/, opType: "community_comment" },
   { method: "POST", pattern: /\/api\/im\/community\/vote$/, opType: "community_vote" }
 ];
-function matchWriteOp(method, path5) {
+function matchWriteOp(method, path6) {
   for (const { method: m, pattern, opType } of WRITE_PATTERNS) {
-    if (method === m && pattern.test(path5)) return opType;
+    if (method === m && pattern.test(path6)) return opType;
   }
   return null;
 }
@@ -585,18 +585,18 @@ var OfflineManager = class extends OfflineEmitter {
   /**
    * Dispatch an IM request. Write ops go through outbox; reads check local cache.
    */
-  async dispatch(method, path5, body, query) {
-    const opType = matchWriteOp(method, path5);
+  async dispatch(method, path6, body, query) {
+    const opType = matchWriteOp(method, path6);
     if (opType) {
-      return this.dispatchWrite(opType, method, path5, body, query);
+      return this.dispatchWrite(opType, method, path6, body, query);
     }
     if (method === "GET") {
-      const cached = await this.readFromCache(path5, query);
+      const cached = await this.readFromCache(path6, query);
       if (cached !== null) return cached;
     }
     try {
-      const result = await this.networkRequest(method, path5, body, query);
-      if (method === "GET") this.cacheReadResult(path5, query, result);
+      const result = await this.networkRequest(method, path6, body, query);
+      if (method === "GET") this.cacheReadResult(path6, query, result);
       return result;
     } catch {
       if (!this._isOnline) {
@@ -606,7 +606,7 @@ var OfflineManager = class extends OfflineEmitter {
     }
   }
   // ── Outbox: write operations ──────────────────────────────
-  async dispatchWrite(opType, method, path5, body, query) {
+  async dispatchWrite(opType, method, path6, body, query) {
     const clientId = generateId();
     const idempotencyKey = `sdk-${clientId}`;
     let enrichedBody = body;
@@ -620,7 +620,7 @@ var OfflineManager = class extends OfflineEmitter {
     let localMessage;
     if (opType === "message.send" && body && typeof body === "object") {
       const b = body;
-      const convIdMatch = path5.match(/\/(?:messages|direct|groups)\/([^/]+)/);
+      const convIdMatch = path6.match(/\/(?:messages|direct|groups)\/([^/]+)/);
       const conversationId = convIdMatch?.[1] ?? "";
       localMessage = {
         id: `local-${clientId}`,
@@ -641,7 +641,7 @@ var OfflineManager = class extends OfflineEmitter {
       id: clientId,
       type: opType,
       method,
-      path: path5,
+      path: path6,
       body: enrichedBody,
       query,
       status: "pending",
@@ -961,28 +961,28 @@ var OfflineManager = class extends OfflineEmitter {
     return 0;
   }
   // ── Read cache ────────────────────────────────────────────
-  async readFromCache(path5, query) {
-    if (/\/api\/im\/conversations$/.test(path5)) {
+  async readFromCache(path6, query) {
+    if (/\/api\/im\/conversations$/.test(path6)) {
       const convos = await this.storage.getConversations({ limit: 50 });
       if (convos.length > 0) return { ok: true, data: convos };
     }
-    const msgMatch = path5.match(/\/api\/im\/messages\/([^/]+)$/);
+    const msgMatch = path6.match(/\/api\/im\/messages\/([^/]+)$/);
     if (msgMatch) {
       const convId = msgMatch[1];
       const limit = query?.limit ? parseInt(query.limit) : 50;
       const messages = await this.storage.getMessages(convId, { limit, before: query?.before });
       if (messages.length > 0) return { ok: true, data: messages };
     }
-    if (/\/api\/im\/contacts$/.test(path5)) {
+    if (/\/api\/im\/contacts$/.test(path6)) {
       const contacts = await this.storage.getContacts();
       if (contacts.length > 0) return { ok: true, data: contacts };
     }
     return null;
   }
-  async cacheReadResult(path5, _query, result) {
+  async cacheReadResult(path6, _query, result) {
     if (!result?.ok || !result?.data) return;
     try {
-      if (/\/api\/im\/conversations$/.test(path5) && Array.isArray(result.data)) {
+      if (/\/api\/im\/conversations$/.test(path6) && Array.isArray(result.data)) {
         const convos = result.data.map((c) => ({
           id: c.id,
           type: c.type ?? "direct",
@@ -996,7 +996,7 @@ var OfflineManager = class extends OfflineEmitter {
         }));
         await this.storage.putConversations(convos);
       }
-      const msgMatch = path5.match(/\/api\/im\/messages\/([^/]+)$/);
+      const msgMatch = path6.match(/\/api\/im\/messages\/([^/]+)$/);
       if (msgMatch && Array.isArray(result.data)) {
         const messages = result.data.map((m) => ({
           id: m.id,
@@ -1011,7 +1011,7 @@ var OfflineManager = class extends OfflineEmitter {
         }));
         await this.storage.putMessages(messages);
       }
-      if (/\/api\/im\/contacts$/.test(path5) && Array.isArray(result.data)) {
+      if (/\/api\/im\/contacts$/.test(path6) && Array.isArray(result.data)) {
         await this.storage.putContacts(result.data);
       }
     } catch {
@@ -2157,6 +2157,37 @@ var WorkspaceClient = class {
 var TasksClient = class {
   constructor(_r) {
     this._r = _r;
+    // ── release201/10 rev 2 — SPEC.md ─────────────────────────────────────
+    this.spec = {
+      /** Read SPEC.md latest revision. */
+      get: (taskId) => this._r("GET", `/api/im/tasks/${taskId}/spec`),
+      /** Owner sets/updates SPEC.md (writes a new revision). */
+      set: (taskId, input) => this._r("PUT", `/api/im/tasks/${taskId}/spec`, input)
+    };
+    // ── release201/10 rev 2 — TODO.md ─────────────────────────────────────
+    this.todo = {
+      list: (taskId) => this._r("GET", `/api/im/tasks/${taskId}/todo`),
+      add: (taskId, input) => this._r("POST", `/api/im/tasks/${taskId}/todo/items`, input),
+      toggle: (taskId, index, done) => this._r("PATCH", `/api/im/tasks/${taskId}/todo/items/${index}`, { done }),
+      setText: (taskId, index, text) => this._r("PATCH", `/api/im/tasks/${taskId}/todo/items/${index}`, { text }),
+      remove: (taskId, index) => this._r("DELETE", `/api/im/tasks/${taskId}/todo/items/${index}`)
+    };
+    this.criteria = {
+      /** List current criteria via the acceptance view. */
+      list: (taskId) => this._r("GET", `/api/im/tasks/${taskId}/acceptance`),
+      /** Add a criterion (rev 2 — verifyMode + expectation + verifierAgentId). */
+      add: (taskId, input) => this._r("POST", `/api/im/tasks/${taskId}/criteria`, input),
+      /** Update a criterion in place. */
+      update: (taskId, cid, patch) => this._r("PATCH", `/api/im/tasks/${taskId}/criteria/${cid}`, patch),
+      /** Remove a criterion. */
+      remove: (taskId, cid) => this._r("DELETE", `/api/im/tasks/${taskId}/criteria/${cid}`),
+      /**
+       * Unified verify entry (rev 2). Manual reviewer, agent-self-check
+       * report, AND verifier-agent report all use this — cloud routes by
+       * actor identity.
+       */
+      verify: (taskId, cid, input) => this._r("POST", `/api/im/tasks/${taskId}/criteria/${cid}/verify`, input)
+    };
   }
   /** Create a new task */
   async create(options) {
@@ -2176,6 +2207,7 @@ var TasksClient = class {
     if (options?.limit != null) query.limit = String(options.limit);
     if (options?.cursor) query.cursor = options.cursor;
     if (options?.workspaceId) query.workspaceId = options.workspaceId;
+    if (options?.projectId) query.projectId = options.projectId;
     if (options?.conversationId) query.conversationId = options.conversationId;
     return this._r("GET", "/api/im/tasks", void 0, query);
   }
@@ -2211,6 +2243,10 @@ var TasksClient = class {
   async update(taskId, options) {
     return this._r("PATCH", `/api/im/tasks/${taskId}`, options);
   }
+  /** Move a task into a project, or pass null to return it to workspace-level. */
+  async moveProject(taskId, targetProjectId) {
+    return this._r("POST", `/api/im/tasks/${taskId}/move-project`, { targetProjectId });
+  }
   /** Claim a pending task */
   async claim(taskId) {
     return this._r("POST", `/api/im/tasks/${taskId}/claim`);
@@ -2265,6 +2301,39 @@ var TasksClient = class {
   async forceTransition(taskId, options) {
     return this._r("POST", `/api/im/tasks/${taskId}/force-transition`, options);
   }
+  // ── release201/10 — acceptance criteria ──────────────────────────────
+  /** Get rolled-up acceptance + criteria list for a task. */
+  async getAcceptance(taskId) {
+    return this._r("GET", `/api/im/tasks/${taskId}/acceptance`);
+  }
+  /** Copy a template's criteria onto the task. */
+  async applyTemplate(taskId, templateId) {
+    return this._r("POST", `/api/im/tasks/${taskId}/apply-template`, { templateId });
+  }
+};
+var CriteriaTemplatesClient = class {
+  constructor(_r) {
+    this._r = _r;
+  }
+  list(query) {
+    const q = {};
+    if (query?.capability) q.capability = query.capability;
+    if (query?.workspaceId === null) q.workspaceId = "__global";
+    else if (query?.workspaceId) q.workspaceId = query.workspaceId;
+    return this._r("GET", "/api/im/criteria-templates", void 0, q);
+  }
+  get(id) {
+    return this._r("GET", `/api/im/criteria-templates/${id}`);
+  }
+  create(input) {
+    return this._r("POST", "/api/im/criteria-templates", input);
+  }
+  update(id, patch) {
+    return this._r("PATCH", `/api/im/criteria-templates/${id}`, patch);
+  }
+  delete(id) {
+    return this._r("DELETE", `/api/im/criteria-templates/${id}`);
+  }
 };
 var MemoryClient = class {
   constructor(_r) {
@@ -2337,6 +2406,32 @@ var KnowledgeLinkClient = class {
     return this._r("GET", "/api/im/knowledge/links", void 0, { entityType, entityId });
   }
 };
+var MetricsClient = class {
+  constructor(_r) {
+    this._r = _r;
+  }
+  async emit(input) {
+    return this._r("POST", "/api/im/metrics/emit", input);
+  }
+  async batch(events) {
+    return this._r("POST", "/api/im/metrics/batch", { events });
+  }
+  async aggregate(opts) {
+    const query = {
+      namespace: opts.namespace,
+      name: opts.name,
+      agg: opts.agg
+    };
+    if (opts.range) query.range = opts.range;
+    if (opts.from) query.from = opts.from;
+    if (opts.to) query.to = opts.to;
+    if (opts.groupBy && opts.groupBy.length) query.groupBy = opts.groupBy.join(",");
+    if (opts.bucket) query.bucket = opts.bucket;
+    const filterPairs = Object.entries(opts.filter).map(([k, v]) => `${k}:${v}`);
+    if (filterPairs.length) query.filter = filterPairs.join(",");
+    return this._r("GET", "/api/im/metrics/aggregate", void 0, query);
+  }
+};
 var IdentityClient = class {
   constructor(_r) {
     this._r = _r;
@@ -2501,9 +2596,51 @@ var EvolutionSkillsClient = class {
     return this._r("POST", `/api/im/skills/${encodeURIComponent(skillId)}/star`);
   }
 };
+var AgentSkillsClient = class {
+  constructor(_r) {
+    this._r = _r;
+  }
+  /** List skills installed on the agent. */
+  async list(agentId, options) {
+    const query = {};
+    if (options?.workspaceId) query.workspaceId = options.workspaceId;
+    if (options?.includeInactive) query.includeInactive = "true";
+    return this._r("GET", `/api/im/agents/${encodeURIComponent(agentId)}/skills`, void 0, query);
+  }
+  /** Install a published skill onto the agent. */
+  async install(agentId, input) {
+    return this._r("POST", `/api/im/agents/${encodeURIComponent(agentId)}/skills`, input);
+  }
+  /** Uninstall (or disable, for built-ins) a skill from the agent. */
+  async uninstall(agentId, skillIdOrSlug, options) {
+    const query = {};
+    if (options?.workspaceId) query.workspaceId = options.workspaceId;
+    return this._r(
+      "DELETE",
+      `/api/im/agents/${encodeURIComponent(agentId)}/skills/${encodeURIComponent(skillIdOrSlug)}`,
+      void 0,
+      query
+    );
+  }
+  /**
+   * PATCH /api/im/agents/:agentId/skills/:skillId — Update per-skill config.
+   *
+   * Validates against the skill's `executableJson.configSchema` server-side
+   * (release201/13 §3.4 / 07 §2.6). Returns the updated agentSkill row;
+   * `installedRevision` will be null until the next daemon sync poll.
+   */
+  async updateConfig(agentId, skillId, config, options) {
+    return this._r(
+      "PATCH",
+      `/api/im/agents/${encodeURIComponent(agentId)}/skills/${encodeURIComponent(skillId)}`,
+      { config, workspaceId: options?.workspaceId }
+    );
+  }
+};
 var AgentsClient = class {
   constructor(_r) {
     this._r = _r;
+    this.skills = new AgentSkillsClient(_r);
   }
   async spec(agentId, workspaceId) {
     const query = workspaceId ? { workspaceId } : void 0;
@@ -2540,6 +2677,63 @@ var AgentsClient = class {
   async deletePack(packIdOrSlug) {
     return this._r("DELETE", `/api/im/agent-packs/${encodeURIComponent(packIdOrSlug)}`);
   }
+  // release201/09 §9.7.2 Phase 3 — agent quiesce + transfer endpoints.
+  //
+  // pause/resume: workspace owner / orchestrator / admin only. Used by
+  // `prismer agent export` to halt cloud dispatch on the source device
+  // before tarballing the agent dir, and by `prismer agent import` to
+  // resume dispatch on the target device after rebind.
+  async pause(agentId) {
+    return this._r("POST", `/api/im/agents/${encodeURIComponent(agentId)}/pause`, {});
+  }
+  async resume(agentId) {
+    return this._r("POST", `/api/im/agents/${encodeURIComponent(agentId)}/resume`, {});
+  }
+  async transfer(input) {
+    return this._r("POST", "/api/im/agent-bindings/transfer", input);
+  }
+};
+var StudioEvolutionClient = class {
+  constructor(_r) {
+    this._r = _r;
+  }
+  /** List capsules emitted by the target agent (workspace-owner-scoped). */
+  async capsules(agentId, options) {
+    const query = { agentId };
+    if (options?.page != null) query.page = String(options.page);
+    if (options?.limit != null) query.limit = String(options.limit);
+    if (options?.scope) query.scope = options.scope;
+    return this._r("GET", "/api/im/studio/evolution/capsules", void 0, query);
+  }
+  /** List genes owned by the target agent (workspace-owner-scoped). */
+  async genes(agentId, options) {
+    const query = { agentId };
+    if (options?.signals) query.signals = options.signals;
+    return this._r("GET", "/api/im/studio/evolution/genes", void 0, query);
+  }
+};
+var StudioClient = class {
+  constructor(_r) {
+    this._r = _r;
+    this.evolution = new StudioEvolutionClient(_r);
+  }
+  /** Studio overview — counts + recent activity for a workspace. */
+  async getOverview(workspaceId) {
+    const query = workspaceId ? { workspaceId } : void 0;
+    return this._r("GET", "/api/im/studio/overview", void 0, query);
+  }
+  /** Studio Profile domain — agent identity / personality / credits. */
+  async getProfile(agentId) {
+    const query = agentId ? { agentId } : void 0;
+    return this._r("GET", "/api/im/studio/profile", void 0, query);
+  }
+  /** Studio Installed domain — workspace agents + active agent's skills. */
+  async getInstalled(options) {
+    const query = {};
+    if (options?.workspaceId) query.workspaceId = options.workspaceId;
+    if (options?.agentId) query.agentId = options.agentId;
+    return this._r("GET", "/api/im/studio/installed", void 0, query);
+  }
 };
 var EvolutionClient = class {
   constructor(_r) {
@@ -2849,30 +3043,30 @@ var EvolutionClient = class {
     }
     const localPaths = [];
     try {
-      const fs5 = await import("fs");
-      const path5 = await import("path");
-      const os3 = await import("os");
-      const home = os3.homedir();
-      const pluginBase = process.env.PRISMER_PLUGIN_DIR || path5.join(home, ".claude", "plugins", "prismer");
+      const fs8 = await import("fs");
+      const path6 = await import("path");
+      const os4 = await import("os");
+      const home = os4.homedir();
+      const pluginBase = process.env.PRISMER_PLUGIN_DIR || path6.join(home, ".claude", "plugins", "prismer");
       const platformPaths = options?.project ? {
-        "claude-code": path5.join(options.projectRoot || ".", ".claude", "skills", slug),
-        "openclaw": path5.join(options.projectRoot || ".", "skills", slug),
-        "opencode": path5.join(options.projectRoot || ".", ".opencode", "skills", slug),
-        "plugin": path5.join(options.projectRoot || ".", ".claude", "plugins", "prismer", "skills", slug)
+        "claude-code": path6.join(options.projectRoot || ".", ".claude", "skills", slug),
+        "openclaw": path6.join(options.projectRoot || ".", "skills", slug),
+        "opencode": path6.join(options.projectRoot || ".", ".opencode", "skills", slug),
+        "plugin": path6.join(options.projectRoot || ".", ".claude", "plugins", "prismer", "skills", slug)
       } : {
-        "claude-code": path5.join(home, ".claude", "skills", slug),
-        "openclaw": path5.join(home, ".openclaw", "skills", slug),
-        "opencode": path5.join(home, ".config", "opencode", "skills", slug),
-        "plugin": path5.join(pluginBase, "skills", slug)
+        "claude-code": path6.join(home, ".claude", "skills", slug),
+        "openclaw": path6.join(home, ".openclaw", "skills", slug),
+        "opencode": path6.join(home, ".config", "opencode", "skills", slug),
+        "plugin": path6.join(pluginBase, "skills", slug)
       };
       const targets = options?.platforms ?? Object.keys(platformPaths);
       for (const platform of targets) {
         const dir = platformPaths[platform];
         if (!dir) continue;
         try {
-          fs5.mkdirSync(dir, { recursive: true });
-          const filePath = path5.join(dir, "SKILL.md");
-          fs5.writeFileSync(filePath, content, "utf-8");
+          fs8.mkdirSync(dir, { recursive: true });
+          const filePath = path6.join(dir, "SKILL.md");
+          fs8.writeFileSync(filePath, content, "utf-8");
           localPaths.push(filePath);
         } catch {
         }
@@ -2895,21 +3089,21 @@ var EvolutionClient = class {
     const slug = safeSlug(slugOrId);
     if (!slug) return withRemoved(result.data?.uninstalled ?? false, removedPaths);
     try {
-      const fs5 = await import("fs");
-      const path5 = await import("path");
-      const os3 = await import("os");
-      const home = os3.homedir();
-      const pluginBase = process.env.PRISMER_PLUGIN_DIR || path5.join(home, ".claude", "plugins", "prismer");
+      const fs8 = await import("fs");
+      const path6 = await import("path");
+      const os4 = await import("os");
+      const home = os4.homedir();
+      const pluginBase = process.env.PRISMER_PLUGIN_DIR || path6.join(home, ".claude", "plugins", "prismer");
       const dirs = [
-        path5.join(home, ".claude", "skills", slug),
-        path5.join(home, ".openclaw", "skills", slug),
-        path5.join(home, ".config", "opencode", "skills", slug),
-        path5.join(pluginBase, "skills", slug)
+        path6.join(home, ".claude", "skills", slug),
+        path6.join(home, ".openclaw", "skills", slug),
+        path6.join(home, ".config", "opencode", "skills", slug),
+        path6.join(pluginBase, "skills", slug)
       ];
       for (const dir of dirs) {
         try {
-          if (fs5.existsSync(dir)) {
-            fs5.rmSync(dir, { recursive: true });
+          if (fs8.existsSync(dir)) {
+            fs8.rmSync(dir, { recursive: true });
             removedPaths.push(dir);
           }
         } catch {
@@ -2946,25 +3140,25 @@ var EvolutionClient = class {
           failed++;
           continue;
         }
-        const fs5 = await import("fs");
-        const path5 = await import("path");
-        const os3 = await import("os");
-        const home = os3.homedir();
-        const pluginBase = process.env.PRISMER_PLUGIN_DIR || path5.join(home, ".claude", "plugins", "prismer");
+        const fs8 = await import("fs");
+        const path6 = await import("path");
+        const os4 = await import("os");
+        const home = os4.homedir();
+        const pluginBase = process.env.PRISMER_PLUGIN_DIR || path6.join(home, ".claude", "plugins", "prismer");
         const platformPaths = {
-          "claude-code": path5.join(home, ".claude", "skills", slug),
-          "openclaw": path5.join(home, ".openclaw", "skills", slug),
-          "opencode": path5.join(home, ".config", "opencode", "skills", slug),
-          "plugin": path5.join(pluginBase, "skills", slug)
+          "claude-code": path6.join(home, ".claude", "skills", slug),
+          "openclaw": path6.join(home, ".openclaw", "skills", slug),
+          "opencode": path6.join(home, ".config", "opencode", "skills", slug),
+          "plugin": path6.join(pluginBase, "skills", slug)
         };
         const targets = options?.platforms ?? Object.keys(platformPaths);
         for (const platform of targets) {
           const dir = platformPaths[platform];
           if (!dir) continue;
           try {
-            fs5.mkdirSync(dir, { recursive: true });
-            const filePath = path5.join(dir, "SKILL.md");
-            fs5.writeFileSync(filePath, content, "utf-8");
+            fs8.mkdirSync(dir, { recursive: true });
+            const filePath = path6.join(dir, "SKILL.md");
+            fs8.writeFileSync(filePath, content, "utf-8");
             paths.push(filePath);
           } catch {
           }
@@ -3042,6 +3236,8 @@ function safeSlug(input) {
 var WorkspacesClient = class {
   constructor(_r) {
     this._r = _r;
+    this.members = new WorkspaceMembersClient(_r);
+    this.invites = new WorkspaceInvitesClient(_r);
   }
   /** List active workspaces owned by the caller. */
   async list() {
@@ -3097,6 +3293,101 @@ var WorkspacesClient = class {
   async revokeOrchestrator(workspaceId) {
     return this._r("DELETE", `/api/im/workspaces/${workspaceId}/orchestrator`);
   }
+  // Sub-clients `members` / `invites` are declared at the top of the class and
+  // wired up inside the constructor body — see `AgentsClient` for the same
+  // pattern. Declaring them as field initializers that reference `this._r`
+  // hits TS2729 because parameter-property assignment happens after class
+  // field initializers under `useDefineForClassFields`.
+};
+var WorkspaceMembersClient = class {
+  constructor(_r) {
+    this._r = _r;
+  }
+  async list(workspaceId) {
+    return this._r("GET", `/api/im/workspaces/${workspaceId}/members`);
+  }
+  async add(workspaceId, options) {
+    return this._r("POST", `/api/im/workspaces/${workspaceId}/members`, options);
+  }
+  async update(workspaceId, memberId, options) {
+    return this._r("PATCH", `/api/im/workspaces/${workspaceId}/members/${memberId}`, options);
+  }
+  async remove(workspaceId, memberId) {
+    return this._r("DELETE", `/api/im/workspaces/${workspaceId}/members/${memberId}`);
+  }
+};
+var WorkspaceInvitesClient = class {
+  constructor(_r) {
+    this._r = _r;
+  }
+  async create(workspaceId, options) {
+    return this._r("POST", `/api/im/workspaces/${workspaceId}/invites`, options);
+  }
+  async list(workspaceId) {
+    return this._r("GET", `/api/im/workspaces/${workspaceId}/invites`);
+  }
+  async revoke(workspaceId, inviteId) {
+    return this._r("DELETE", `/api/im/workspaces/${workspaceId}/invites/${inviteId}`);
+  }
+};
+var InvitesClient = class {
+  constructor(_r) {
+    this._r = _r;
+  }
+  async preview(token) {
+    return this._r("GET", `/api/im/invites/${encodeURIComponent(token)}`);
+  }
+  async accept(token) {
+    return this._r("POST", `/api/im/invites/${encodeURIComponent(token)}/accept`);
+  }
+  async reject(token) {
+    return this._r("POST", `/api/im/invites/${encodeURIComponent(token)}/reject`);
+  }
+};
+var ProjectMembersClient = class {
+  constructor(_r) {
+    this._r = _r;
+  }
+  async list(projectId) {
+    return this._r("GET", `/api/im/projects/${projectId}/members`);
+  }
+  async add(projectId, options) {
+    return this._r("POST", `/api/im/projects/${projectId}/members`, options);
+  }
+  async update(projectId, membershipId, options) {
+    return this._r("PATCH", `/api/im/projects/${projectId}/members/${membershipId}`, options);
+  }
+  async remove(projectId, membershipId) {
+    return this._r("DELETE", `/api/im/projects/${projectId}/members/${membershipId}`);
+  }
+};
+var ProjectsClient = class {
+  constructor(_r) {
+    this._r = _r;
+    this.members = new ProjectMembersClient(_r);
+  }
+  async list(options) {
+    const query = { workspaceId: options.workspaceId };
+    if (options.status) query.status = options.status;
+    if (options.search) query.search = options.search;
+    if (options.limit !== void 0) query.limit = String(options.limit);
+    if (options.offset !== void 0) query.offset = String(options.offset);
+    return this._r("GET", "/api/im/projects", void 0, query);
+  }
+  async create(options) {
+    return this._r("POST", "/api/im/projects", options);
+  }
+  async get(projectId) {
+    return this._r("GET", `/api/im/projects/${projectId}`);
+  }
+  async update(projectId, options) {
+    return this._r("PATCH", `/api/im/projects/${projectId}`, options);
+  }
+  async delete(projectId, options) {
+    const query = {};
+    if (options?.cascade) query.cascade = options.cascade;
+    return this._r("DELETE", `/api/im/projects/${projectId}`, void 0, query);
+  }
 };
 var WorkspaceFilesClient = class {
   constructor(_r) {
@@ -3116,8 +3407,8 @@ var WorkspaceFilesClient = class {
     return this._r("POST", `/api/im/workspaces/${workspaceId}/files`, options);
   }
   /** Soft-delete the active binding at `path`. */
-  async delete(workspaceId, path5) {
-    return this._r("DELETE", `/api/im/workspaces/${workspaceId}/files`, void 0, { path: path5 });
+  async delete(workspaceId, path6) {
+    return this._r("DELETE", `/api/im/workspaces/${workspaceId}/files`, void 0, { path: path6 });
   }
   /** Daemon delta-sync workspace files since an ISO timestamp. */
   async sync(workspaceId, since) {
@@ -3142,8 +3433,8 @@ async function sha256BytesHex(bytes) {
     const digest = await globalThis.crypto.subtle.digest("SHA-256", ab);
     return toHex(new Uint8Array(digest));
   }
-  const { createHash } = await import("crypto");
-  return createHash("sha256").update(bytes).digest("hex");
+  const { createHash: createHash4 } = await import("crypto");
+  return createHash4("sha256").update(bytes).digest("hex");
 }
 function bytesToBlob(bytes, mimeType) {
   const ab = new ArrayBuffer(bytes.byteLength);
@@ -3182,11 +3473,11 @@ async function normalizeAssetUploadInput(input, options) {
   let bytes;
   let fileName;
   if (typeof input === "string") {
-    const fs5 = await import("fs");
-    const path5 = await import("path");
-    const buf = await fs5.promises.readFile(input);
+    const fs8 = await import("fs");
+    const path6 = await import("path");
+    const buf = await fs8.promises.readFile(input);
     bytes = new Uint8Array(buf);
-    fileName = options.fileName || path5.basename(input);
+    fileName = options.fileName || path6.basename(input);
   } else if (typeof Blob !== "undefined" && input instanceof Blob) {
     const ab = await input.arrayBuffer();
     bytes = new Uint8Array(ab);
@@ -3331,8 +3622,8 @@ var AssetsClient = class {
       return null;
     }
   }
-  async _postAssetJson(path5, body) {
-    const response = await this._fetchFn(`${this._baseUrl}/api/im/assets${path5}`, {
+  async _postAssetJson(path6, body) {
+    const response = await this._fetchFn(`${this._baseUrl}/api/im/assets${path6}`, {
       method: "POST",
       headers: {
         ...this._getAuthHeaders(),
@@ -3404,10 +3695,18 @@ var RuntimeInstallationsClient = class {
   constructor(_r) {
     this._r = _r;
   }
-  /** List runtime installations in a workspace. */
+  /**
+   * List runtime installations in a workspace.
+   *
+   * v2.0.8 M448 (release201/20 §1) — `projectId` narrows scope:
+   *   - omitted | `'all'`  → no project filter (legacy behaviour)
+   *   - `'__unscoped'`     → only workspace-level rows (projectId IS NULL)
+   *   - any other string   → exact projectId match
+   */
   async list(workspaceId, options) {
     const query = { workspaceId };
     if (options?.limit != null) query.limit = String(options.limit);
+    if (options?.projectId) query.projectId = options.projectId;
     return this._r("GET", "/api/workspace/runtime-installations", void 0, query);
   }
   /**
@@ -3416,10 +3715,27 @@ var RuntimeInstallationsClient = class {
    * The daemon receives `PRISMER_API_KEY`, `PRISMER_DAEMON_ID`,
    * `PRISMER_BASE_URL`, `PRISMER_WORKSPACE_ID`, and
    * `PRISMER_RUNTIME_KIND=workspace-daemon` env vars.
+   *
+   * v2.0.8 M448 — `options.projectId` (optional) opts into project scope.
+   * Server validates it belongs to the same workspace and is `active`,
+   * otherwise rejects 422 `PROJECT_WORKSPACE_MISMATCH` / `PROJECT_NOT_ACTIVE`.
    */
   async create(options) {
     return this._r("POST", "/api/workspace/runtime-installations", options);
   }
+  /**
+   * v2.0.8 M448 (release201/20 §1) — update the project binding on an
+   * existing runtime installation. Pass `projectId: null` to detach.
+   * No-op when body omits `projectId`. Same workspace/active invariant as
+   * create — returns 422 on mismatch.
+   */
+  async patch(runtimeInstallationId, options) {
+    return this._r(
+      "PATCH",
+      `/api/workspace/runtime-installations/${runtimeInstallationId}`,
+      options
+    );
+  }
   /**
    * Install an agent onto a runtime daemon. Resolves or creates the agent
    * profile, calls the controller's `installAgent` RPC, and stamps
@@ -3516,11 +3832,11 @@ var FilesClient = class {
     let bytes;
     let fileName;
     if (typeof input === "string") {
-      const fs5 = await import("fs");
-      const path5 = await import("path");
-      const buf = await fs5.promises.readFile(input);
+      const fs8 = await import("fs");
+      const path6 = await import("path");
+      const buf = await fs8.promises.readFile(input);
       bytes = new Uint8Array(buf);
-      fileName = opts?.fileName || path5.basename(input);
+      fileName = opts?.fileName || path6.basename(input);
     } else if (typeof Blob !== "undefined" && input instanceof Blob) {
       const ab = await input.arrayBuffer();
       bytes = new Uint8Array(ab);
@@ -3552,6 +3868,19 @@ var FilesClient = class {
    */
   async sendFile(conversationId, input, opts) {
     const uploaded = await this.upload(input, opts);
+    const outboxDir = process.env.PRISMER_OUTBOX_DIR;
+    if (outboxDir) {
+      try {
+        const fsMod = await import("fs");
+        const pathMod = await import("path");
+        const srcPath = typeof input === "string" ? input : input.path;
+        if (srcPath && typeof srcPath === "string") {
+          await fsMod.promises.mkdir(outboxDir, { recursive: true });
+          fsMod.cpSync(srcPath, pathMod.join(outboxDir, pathMod.basename(srcPath)));
+        }
+      } catch {
+      }
+    }
     const msgRes = await this._r("POST", `/api/im/messages/${conversationId}`, {
       content: opts?.content || uploaded.fileName,
       type: "file",
@@ -3760,6 +4089,36 @@ var IMRealtimeClient = class {
     };
   }
 };
+var SkillsDraftClient = class {
+  constructor(_r) {
+    this._r = _r;
+  }
+  /** Create a draft skill from a manifest v1 payload. */
+  async create(input) {
+    return this._r("POST", "/api/im/skills/draft", input);
+  }
+  /** Apply incremental file ops to a draft. */
+  async patch(id, input) {
+    return this._r("PATCH", `/api/im/skills/${id}/draft`, input);
+  }
+  /** Request a regenerate session for a draft. */
+  async regenerate(id, input) {
+    return this._r("POST", `/api/im/skills/${id}/draft/regenerate`, input);
+  }
+  /** Fetch a single draft's manifest + revision history. */
+  async show(id) {
+    return this._r("GET", `/api/im/skills/draft/${id}`);
+  }
+  /** List drafts for a workspace (most-recently-updated first). */
+  async list(workspaceId) {
+    return this._r("GET", "/api/im/skills/drafts", void 0, { workspaceId });
+  }
+};
+var SkillsClient = class {
+  constructor(_r) {
+    this.draft = new SkillsDraftClient(_r);
+  }
+};
 var IMClient = class {
   constructor(request2, wsBase, fetchFn, getAuthHeaders, offlineManager, communityHubConfig) {
     this._request = request2;
@@ -3773,16 +4132,22 @@ var IMClient = class {
     this.credits = new CreditsClient(request2);
     this.workspace = new WorkspaceClient(request2);
     this.workspaces = new WorkspacesClient(request2);
+    this.invites = new InvitesClient(request2);
+    this.projects = new ProjectsClient(request2);
     this.workspaceFiles = new WorkspaceFilesClient(request2);
     this.assets = new AssetsClient(request2, wsBase, fetchFn, getAuthHeaders);
     this.runtimeInstallations = new RuntimeInstallationsClient(request2);
     this.tasks = new TasksClient(request2);
+    this.criteriaTemplates = new CriteriaTemplatesClient(request2);
     this.memory = new MemoryClient(request2);
     this.knowledge = new KnowledgeLinkClient(request2);
+    this.metrics = new MetricsClient(request2);
     this.identity = new IdentityClient(request2);
     this.security = new SecurityClient(request2);
     this.agents = new AgentsClient(request2);
     this.evolution = new EvolutionClient(request2);
+    this.skills = new SkillsClient(request2);
+    this.studio = new StudioClient(request2);
     this.community = new CommunityHub(request2, communityHubConfig ?? void 0);
     this.files = new FilesClient(request2, wsBase, fetchFn, getAuthHeaders);
     this.realtime = new IMRealtimeClient(wsBase, fetchFn);
@@ -3812,8 +4177,8 @@ var IMClient = class {
    *     'POST', '/api/im/approvals', { category, title, context, options },
    *   );
    */
-  async request(method, path5, body, query) {
-    return this._request(method, path5, body, query);
+  async request(method, path6, body, query) {
+    return this._request(method, path6, body, query);
   }
 };
 var PrismerClient = class {
@@ -3832,6 +4197,7 @@ var PrismerClient = class {
     this.timeout = config.timeout || 3e4;
     this.fetchFn = config.fetch || fetch;
     this.imAgent = config.imAgent;
+    this.imWorkspace = config.imWorkspace;
     if (config.identity) {
       if (config.identity === "auto" && this.apiKey) {
         this._identityReady = import_aip_sdk.AIPIdentity.fromApiKey(this.apiKey).then((id) => {
@@ -3865,20 +4231,20 @@ var PrismerClient = class {
     ) : (m, p, b, q, opts) => this._request(m, p, b, q, opts);
     if (config.identity) {
       const baseRequest = imRequest;
-      imRequest = (method, path5, body, query, opts) => {
-        if (method === "POST" && path5.includes("/messages") && body) {
+      imRequest = (method, path6, body, query, opts) => {
+        if (method === "POST" && path6.includes("/messages") && body) {
           const b = body;
           if (!b.signature && !b.skipSigning) {
             const ready = this._identityReady || Promise.resolve();
             return ready.then(() => {
               if (this._identity) {
-                return this._signAndSend(baseRequest, method, path5, b, query, opts);
+                return this._signAndSend(baseRequest, method, path6, b, query, opts);
               }
-              return baseRequest(method, path5, body, query, opts);
+              return baseRequest(method, path6, body, query, opts);
             });
           }
         }
-        return baseRequest(method, path5, body, query, opts);
+        return baseRequest(method, path6, body, query, opts);
       };
     }
     this.im = new IMClient(
@@ -3890,6 +4256,8 @@ var PrismerClient = class {
       config.community ?? null
     );
     this.workspaces = this.im.workspaces;
+    this.invites = this.im.invites;
+    this.projects = this.im.projects;
     this.workspaceFiles = this.im.workspaceFiles;
     this.assets = this.im.assets;
     this.evolution = this.im.evolution;
@@ -3900,9 +4268,9 @@ var PrismerClient = class {
     return this._identity;
   }
   /** Auto-sign a message body and send (v1.8.0 S1) */
-  async _signAndSend(baseRequest, method, path5, body, query, opts) {
+  async _signAndSend(baseRequest, method, path6, body, query, opts) {
     if (this._identityReady) await this._identityReady;
-    if (!this._identity) return baseRequest(method, path5, body, query, opts);
+    if (!this._identity) return baseRequest(method, path6, body, query, opts);
     const content = body.content || "";
     const contentHashBytes = new Uint8Array(
       await crypto.subtle.digest("SHA-256", new TextEncoder().encode(content))
@@ -3912,7 +4280,7 @@ var PrismerClient = class {
     const payload = `1|${this._identity.did}|${body.type || "text"}|${timestamp}|${contentHash}`;
     const payloadBytes = new TextEncoder().encode(payload);
     const signature = await this._identity.sign(payloadBytes);
-    return baseRequest(method, path5, {
+    return baseRequest(method, path6, {
       ...body,
       secVersion: 1,
       senderDid: this._identity.did,
@@ -3926,6 +4294,7 @@ var PrismerClient = class {
     const headers = {};
     if (this.apiKey) headers["Authorization"] = `Bearer ${this.apiKey}`;
     if (this.imAgent) headers["X-IM-Agent"] = this.imAgent;
+    if (this.imWorkspace) headers["X-IM-Workspace"] = this.imWorkspace;
     return headers;
   }
   /**
@@ -3977,11 +4346,11 @@ var PrismerClient = class {
   // --------------------------------------------------------------------------
   // Internal request helper
   // --------------------------------------------------------------------------
-  async _request(method, path5, body, query, opts, _isRetry) {
+  async _request(method, path6, body, query, opts, _isRetry) {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this.timeout);
     try {
-      let url = `${this.baseUrl}${path5}`;
+      let url = `${this.baseUrl}${path6}`;
       if (query && Object.keys(query).length > 0) {
         url += "?" + new URLSearchParams(query).toString();
       }
@@ -3992,6 +4361,9 @@ var PrismerClient = class {
       if (this.imAgent) {
         headers["X-IM-Agent"] = this.imAgent;
       }
+      if (this.imWorkspace) {
+        headers["X-IM-Workspace"] = this.imWorkspace;
+      }
       if (opts?.headers) {
         for (const [k, v] of Object.entries(opts.headers)) headers[k] = v;
       }
@@ -4002,12 +4374,12 @@ var PrismerClient = class {
       }
       const response = await this.fetchFn(url, init);
       const data = await response.json();
-      if (response.status === 401 && this.apiKey.startsWith("eyJ") && !_isRetry && !path5.includes("/token/refresh")) {
+      if (response.status === 401 && this.apiKey.startsWith("eyJ") && !_isRetry && !path6.includes("/token/refresh")) {
         try {
           const refreshRes = await this._request("POST", "/api/im/token/refresh", void 0, void 0, void 0, true);
           if (refreshRes?.ok && refreshRes?.data?.token) {
             this.apiKey = refreshRes.data.token;
-            return this._request(method, path5, body, query, opts, true);
+            return this._request(method, path6, body, query, opts, true);
           }
         } catch {
         }
@@ -5360,7 +5732,7 @@ function register3(parent, getIMClient2, _getAPIClient) {
       const maxIterations = 30;
       let lastStatus;
       for (let i = 0; i < maxIterations; i++) {
-        await new Promise((resolve3) => setTimeout(resolve3, 2e3));
+        await new Promise((resolve6) => setTimeout(resolve6, 2e3));
         if (!opts.json) process.stdout.write(".");
         const statusRes = await client.im.evolution.getReportStatus(traceId);
         if (!statusRes.ok) break;
@@ -5742,15 +6114,162 @@ function register3(parent, getIMClient2, _getAPIClient) {
   });
 }
 
+// src/commands/task.ts
+var import_node_fs = require("fs");
+var import_node_path2 = require("path");
+var import_node_crypto = require("crypto");
+
+// src/commands/deliver-proxy.ts
+var import_node_path = require("path");
+function detectDeliverProxy(opts) {
+  const taskId = (opts?.taskId || opts?.runId || "").trim() || process.env.PRISMER_TASK_ID || process.env.PRISMER_RUN_ID || "";
+  if (!taskId) return null;
+  const port = (opts?.daemonPort || "").trim() || (process.env.PRISMER_DAEMON_PORT ?? "3210").trim() || "3210";
+  const ctx = {
+    daemonUrl: `http://127.0.0.1:${port}`,
+    taskId
+  };
+  const agentUsername = process.env.PRISMER_AGENT_USERNAME;
+  if (agentUsername) ctx.agentUsername = agentUsername;
+  const conversationId = (opts?.conversationId || "").trim() || process.env.PRISMER_CONVERSATION_ID;
+  if (conversationId) ctx.conversationId = conversationId;
+  return ctx;
+}
+async function proxyDeliver(ctx, filePath, mode, conversationId, messageId) {
+  const abs = (0, import_node_path.resolve)(filePath);
+  const body = {
+    taskId: ctx.taskId,
+    path: abs,
+    mode
+  };
+  const conv = conversationId ?? ctx.conversationId;
+  if (mode === "send") {
+    if (!conv) {
+      return { ok: false, status: 400, error: "conversationId is required for send mode" };
+    }
+    body.conversationId = conv;
+  }
+  if (mode === "message-attach") {
+    if (!conv) {
+      return { ok: false, status: 400, error: "conversationId is required for message-attach mode" };
+    }
+    if (!messageId) {
+      return { ok: false, status: 400, error: "messageId is required for message-attach mode" };
+    }
+    body.conversationId = conv;
+    body.messageId = messageId;
+  }
+  if (ctx.agentUsername) body.agentUsername = ctx.agentUsername;
+  let res;
+  try {
+    res = await fetch(`${ctx.daemonUrl}/local/deliver`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+  } catch (err) {
+    return {
+      ok: false,
+      status: 0,
+      error: `daemon unreachable at ${ctx.daemonUrl}/local/deliver: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  let parsed = {};
+  try {
+    parsed = await res.json();
+  } catch {
+  }
+  if (res.ok && parsed.ok) {
+    const out = { ok: true, status: res.status };
+    if (parsed.assetId) out.assetId = parsed.assetId;
+    return out;
+  }
+  return {
+    ok: false,
+    status: res.status,
+    error: parsed.error ?? `daemon returned ${res.status}`
+  };
+}
+
 // src/commands/task.ts
 var TASK_STATUSES = /* @__PURE__ */ new Set(["pending", "assigned", "running", "review", "completed", "failed", "cancelled"]);
 var TASK_PRIORITIES = /* @__PURE__ */ new Set(["low", "medium", "high", "urgent"]);
 var TASK_KINDS = /* @__PURE__ */ new Set(["work_item", "goal"]);
+function assertNotRunId(id) {
+  if (typeof id === "string" && id.startsWith("run_")) {
+    process.stderr.write(
+      `Error: '${id}' is a run id (run_\u2026); a chat reply doesn't need 'cloud task' ops \u2014 the platform closes the turn from your reply.
+`
+    );
+    process.exit(1);
+  }
+}
 function parseTaskStatus(raw) {
   if (!raw) return void 0;
   if (TASK_STATUSES.has(raw)) return raw;
   throw new Error(`Invalid task status "${raw}".`);
 }
+function normalizeProjectForCreate(raw) {
+  const value = raw ?? process.env.PRISMER_ACTIVE_PROJECT_ID;
+  if (!value) return void 0;
+  const trimmed = value.trim();
+  if (!trimmed || trimmed === "all") return void 0;
+  if (trimmed === "__unscoped" || trimmed === "_unscoped" || trimmed === "none" || trimmed === "null") return null;
+  return trimmed;
+}
+function normalizeProjectForList(raw) {
+  const value = raw ?? process.env.PRISMER_ACTIVE_PROJECT_ID;
+  if (!value) return void 0;
+  const trimmed = value.trim();
+  if (!trimmed) return void 0;
+  if (trimmed === "_unscoped" || trimmed === "none" || trimmed === "null") return "__unscoped";
+  return trimmed;
+}
+async function runReviewCheckpoint(taskId, toStatus) {
+  const port = process.env.PRISMER_DAEMON_PORT ?? "3210";
+  const url = `http://127.0.0.1:${port}/v1/checkpoints/pre_status_change`;
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ taskId, toStatus })
+    });
+  } catch (err) {
+    return {
+      ok: false,
+      indeterminate: true,
+      message: `daemon unreachable at ${url}: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    body = {};
+  }
+  if (response.status === 200 && body.ok === true) {
+    return { ok: true };
+  }
+  if (response.status === 409 && Array.isArray(body.pendingFiles)) {
+    return {
+      ok: false,
+      pendingFiles: body.pendingFiles,
+      message: body.error?.message ?? "pending_attach"
+    };
+  }
+  if (response.status === 503) {
+    return {
+      ok: false,
+      indeterminate: true,
+      message: body.error?.message ?? `daemon returned 503`
+    };
+  }
+  return {
+    ok: false,
+    message: body.error?.message ?? `daemon returned ${response.status}`
+  };
+}
 async function resolveAssigneeId(client, name) {
   const needle = name.trim().toLowerCase();
   const normalized = needle.replace(/^@/, "");
@@ -5773,7 +6292,7 @@ async function resolveAssigneeId(client, name) {
 }
 function register4(parent, getIMClient2, _getAPIClient) {
   const task = parent.command("task").description("Manage tasks in the task marketplace");
-  task.command("create").description("Create a new task").requiredOption("--title <title>", "task title").option("--description <description>", "task description").option("--capability <capability>", "required agent capability").option("--budget <budget>", "budget in credits", parseFloat).option("--reward <reward>", "alias for --budget (credits offered for completion)", parseFloat).option("--priority <priority>", "task priority: low | medium | high | urgent").option("--assignee-id <imUserId>", "directly assign to a specific agent by IM user id").option("--assignee-name <name>", "assign by @username / display name (resolved via discover)").option("--conversation-id <id>", "pin task to a conversation/session").option("--kind <kind>", "board projection kind: work_item (default) | goal", "work_item").option("--schedule-at <iso>", "one-shot ISO 8601 scheduled time (sets scheduleType=once)").option("--schedule-cron <expr>", "cron expression (sets scheduleType=cron)").option("--json", "output raw JSON response").action(async (opts) => {
+  task.command("create").description("Create a new task").requiredOption("--title <title>", "task title").option("--description <description>", "task description").option("--capability <capability>", "required agent capability").option("--budget <budget>", "budget in credits", parseFloat).option("--reward <reward>", "alias for --budget (credits offered for completion)", parseFloat).option("--priority <priority>", "task priority: low | medium | high | urgent").option("--assignee-id <imUserId>", "directly assign to a specific agent by IM user id").option("--assignee-name <name>", "assign by @username / display name (resolved via discover)").option("--conversation-id <id>", "pin task to a conversation/session").option("--project <id>", "scope task to project id; use __unscoped/none for workspace-level").option("--kind <kind>", "board projection kind: work_item (default) | goal", "work_item").option("--schedule-at <iso>", "one-shot ISO 8601 scheduled time (sets scheduleType=once)").option("--schedule-cron <expr>", "cron expression (sets scheduleType=cron)").option("--json", "output raw JSON response").action(async (opts) => {
     const client = getIMClient2();
     try {
       if (opts.priority && !TASK_PRIORITIES.has(opts.priority)) {
@@ -5817,6 +6336,8 @@ function register4(parent, getIMClient2, _getAPIClient) {
       };
       if (assigneeId) createOpts.assigneeId = assigneeId;
       if (opts.conversationId) createOpts.conversationId = opts.conversationId;
+      const projectId = normalizeProjectForCreate(opts.project);
+      if (projectId !== void 0) createOpts.projectId = projectId;
       if (opts.scheduleAt) {
         createOpts.scheduleType = "once";
         createOpts.scheduleAt = opts.scheduleAt;
@@ -5858,12 +6379,13 @@ function register4(parent, getIMClient2, _getAPIClient) {
       process.exit(1);
     }
   });
-  task.command("list").description("List tasks").option("--status <status>", "filter by status").option("--capability <capability>", "filter by required capability").option("-n, --limit <n>", "maximum number of tasks to return", "20").option("--json", "output raw JSON response").action(async (opts) => {
+  task.command("list").description("List tasks").option("--status <status>", "filter by status").option("--capability <capability>", "filter by required capability").option("--project <id>", "filter by project id; use all or __unscoped").option("-n, --limit <n>", "maximum number of tasks to return", "20").option("--json", "output raw JSON response").action(async (opts) => {
     const client = getIMClient2();
     try {
       const res = await client.im.tasks.list({
         status: parseTaskStatus(opts.status),
         capability: opts.capability,
+        projectId: normalizeProjectForList(opts.project),
         limit: parseInt(opts.limit, 10)
       });
       if (opts.json) {
@@ -5884,9 +6406,9 @@ function register4(parent, getIMClient2, _getAPIClient) {
       const statusW = 12;
       const titleW = 40;
       const header = "ID".padEnd(idW) + "STATUS".padEnd(statusW) + "TITLE";
-      const sep = "-".repeat(idW + statusW + titleW);
+      const sep3 = "-".repeat(idW + statusW + titleW);
       process.stdout.write(header + "\n");
-      process.stdout.write(sep + "\n");
+      process.stdout.write(sep3 + "\n");
       for (const t of tasks) {
         const title = t.title.length > titleW ? t.title.slice(0, titleW - 3) + "..." : t.title;
         process.stdout.write(
@@ -5895,6 +6417,33 @@ function register4(parent, getIMClient2, _getAPIClient) {
       }
       process.stdout.write(`
 ${tasks.length} task(s) listed.
+`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`Error: ${message}
+`);
+      process.exit(1);
+    }
+  });
+  task.command("move-project <task-id> [project-id]").description("Move a task to a project, or use --unscoped to return it to workspace-level").option("--unscoped", "set projectId to null", false).option("--json", "output raw JSON response").action(async (taskId, projectId, opts) => {
+    assertNotRunId(taskId);
+    const client = getIMClient2();
+    try {
+      if (!opts.unscoped && !projectId) {
+        throw new Error("Provide <project-id> or pass --unscoped.");
+      }
+      const targetProjectId = opts.unscoped ? null : projectId.trim();
+      const res = await client.im.tasks.moveProject(taskId, targetProjectId);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error?.message || "Unknown error"}
+`);
+        process.exit(1);
+      }
+      process.stdout.write(`Task ${taskId} project: ${targetProjectId ?? "(workspace-level)"}
 `);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -5904,6 +6453,7 @@ ${tasks.length} task(s) listed.
     }
   });
   task.command("get <task-id>").description("Get task details and logs").option("--json", "output raw JSON response").action(async (taskId, opts) => {
+    assertNotRunId(taskId);
     const client = getIMClient2();
     try {
       const res = await client.im.tasks.get(taskId);
@@ -5968,6 +6518,7 @@ Logs (${logs.length}):
     }
   });
   task.command("claim <task-id>").description("Claim a pending task").option("--json", "output raw JSON response").action(async (taskId, opts) => {
+    assertNotRunId(taskId);
     const client = getIMClient2();
     try {
       const res = await client.im.tasks.claim(taskId);
@@ -5997,9 +6548,38 @@ Logs (${logs.length}):
       process.exit(1);
     }
   });
-  task.command("update <task-id>").description("Update a task").option("--title <title>", "new title").option("--description <description>", "new description").option("--status <status>", "new status").option("--progress <progress>", "progress (0.0 to 1.0)", parseFloat).option("--status-message <statusMessage>", "status message").option("--json", "output raw JSON response").action(async (taskId, opts) => {
+  task.command("update <task-id>").description("Update a task").option("--title <title>", "new title").option("--description <description>", "new description").option("--status <status>", "new status").option("--progress <progress>", "progress (0.0 to 1.0)", parseFloat).option("--status-message <statusMessage>", "status message").option("--skip-checkpoint", "bypass local daemon checkpoint when transitioning to review (release201/09 \xA79.4a.7)", false).option("--json", "output raw JSON response").action(async (taskId, opts) => {
+    assertNotRunId(taskId);
     const client = getIMClient2();
     try {
+      if (opts.status === "review" && !opts.skipCheckpoint) {
+        const checkpoint = await runReviewCheckpoint(taskId, opts.status);
+        if (!checkpoint.ok) {
+          if (checkpoint.pendingFiles && checkpoint.pendingFiles.length > 0) {
+            process.stderr.write(
+              `[checkpoint] artifacts/ \u542B ${checkpoint.pendingFiles.length} \u4E2A\u672A attach \u6587\u4EF6:
+`
+            );
+            for (const f of checkpoint.pendingFiles) {
+              const sizeKb = (f.sizeBytes / 1024).toFixed(1);
+              process.stderr.write(`  - ${f.path} (sha256=${f.sha256.slice(0, 12)}\u2026, ${sizeKb}KB)
+`);
+            }
+            process.stderr.write(
+              "\u8BF7 attach \u5B83\u4EEC\u518D retry status change, \u6216\u52A0 --skip-checkpoint \u663E\u5F0F\u5FFD\u7565\n"
+            );
+          } else if (checkpoint.indeterminate) {
+            process.stderr.write(
+              `[checkpoint] daemon unreachable or cloud lookup failed (${checkpoint.message}); pass --skip-checkpoint to bypass
+`
+            );
+          } else {
+            process.stderr.write(`[checkpoint] failed: ${checkpoint.message ?? "unknown"}
+`);
+          }
+          process.exit(12);
+        }
+      }
       const res = await client.im.tasks.update(taskId, {
         title: opts.title,
         description: opts.description,
@@ -6038,6 +6618,7 @@ Logs (${logs.length}):
     }
   });
   task.command("complete <task-id>").description("Mark a task as complete").option("--result <result>", "result or output of the task").option("--json", "output raw JSON response").action(async (taskId, opts) => {
+    assertNotRunId(taskId);
     const client = getIMClient2();
     try {
       const res = await client.im.tasks.complete(taskId, {
@@ -6072,6 +6653,7 @@ Logs (${logs.length}):
     }
   });
   task.command("fail <task-id>").description("Mark a task as failed").requiredOption("--error <error>", "error message describing why the task failed").option("--json", "output raw JSON response").action(async (taskId, opts) => {
+    assertNotRunId(taskId);
     const client = getIMClient2();
     try {
       const res = await client.im.tasks.fail(taskId, opts.error);
@@ -6104,6 +6686,7 @@ Logs (${logs.length}):
     }
   });
   task.command("approve <task-id>").description("Approve a completed task").option("--json", "output raw JSON response").action(async (taskId, opts) => {
+    assertNotRunId(taskId);
     const client = getIMClient2();
     try {
       const res = await client.im.tasks.approve(taskId);
@@ -6134,6 +6717,7 @@ Logs (${logs.length}):
     }
   });
   task.command("reject <task-id>").description("Reject a task").requiredOption("--reason <reason>", "reason for rejection").option("--json", "output raw JSON response").action(async (taskId, opts) => {
+    assertNotRunId(taskId);
     const client = getIMClient2();
     try {
       const res = await client.im.tasks.reject(taskId, opts.reason);
@@ -6163,28 +6747,463 @@ Logs (${logs.length}):
       process.exit(1);
     }
   });
-  task.command("cancel <task-id>").description("Cancel a task").option("--json", "output raw JSON response").action(async (taskId, opts) => {
-    const client = getIMClient2();
-    try {
-      const res = await client.im.tasks.cancel(taskId);
+  task.command("attach <path>").description("Attach a file to a task as a user-deliverable (release201/09 \xA79.4a.5)").option("--task <taskId>", "target task id; defaults to PRISMER_TASK_ID env").option("--name <displayName>", "override the display filename; defaults to basename(path)").option("--run-id <id>", "dispatch task id (alias for --task; from <execution_context>; env fallback PRISMER_TASK_ID)").option("--daemon-port <port>", "daemon local-server port (env fallback PRISMER_DAEMON_PORT, default 3210)").option("--json", "output raw JSON response").action(async (filePath, opts) => {
+    const targetTaskId = opts.task ?? opts.runId ?? process.env.PRISMER_TASK_ID;
+    if (!targetTaskId) {
+      process.stderr.write("Error: --task is required (or set PRISMER_TASK_ID env)\n");
+      process.exit(1);
+    }
+    assertNotRunId(targetTaskId);
+    const proxy = detectDeliverProxy({
+      taskId: targetTaskId,
+      daemonPort: opts.daemonPort
+    });
+    if (proxy) {
+      const result = await proxyDeliver(proxy, filePath, "task-attach");
+      if (!result.ok) {
+        process.stderr.write(`Error: ${result.error ?? "task attach failed"}
+`);
+        process.exit(1);
+      }
       if (opts.json) {
-        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
         return;
       }
-      if (!res.ok) {
-        process.stderr.write(`Error: ${res.error?.message || "Unknown error"}
+      process.stdout.write(`Attached to task ${targetTaskId} (assetId: ${result.assetId ?? "-"})
+`);
+      return;
+    }
+    const client = getIMClient2();
+    try {
+      const getRes = await client.im.tasks.get(targetTaskId);
+      if (!getRes.ok || !getRes.data) {
+        process.stderr.write(`Error: task ${targetTaskId} not found: ${getRes.error?.message ?? "unknown"}
 `);
         process.exit(1);
       }
-      const t = res.data;
-      process.stdout.write(`Task cancelled
-
-`);
-      process.stdout.write(`ID:     ${t.id}
-`);
-      process.stdout.write(`Title:  ${t.title}
+      const wsId = getRes.data.task?.workspaceId;
+      if (!wsId) {
+        process.stderr.write(`Error: task ${targetTaskId} has no workspaceId; cannot upload
 `);
-      process.stdout.write(`Status: ${t.status}
+        process.exit(1);
+      }
+      let bytes;
+      try {
+        bytes = await import_node_fs.promises.readFile(filePath);
+      } catch (err) {
+        process.stderr.write(`Error: cannot read ${filePath}: ${err instanceof Error ? err.message : String(err)}
+`);
+        process.exit(1);
+      }
+      const contentHash = (0, import_node_crypto.createHash)("sha256").update(bytes).digest("hex");
+      const displayName = opts.name ?? (0, import_node_path2.basename)(filePath);
+      const uploadRes = await client.im.assets.upload(bytes, {
+        workspaceId: wsId,
+        sourceTaskId: targetTaskId,
+        kind: "agent-output",
+        fileName: displayName,
+        metadata: {
+          // boundKind stamped via metadata so service-side cloud code can
+          // mirror onto the column. Service POST handler reads this and
+          // populates IMAsset.boundKind='task-bound'.
+          boundKind: "task-bound",
+          filename: displayName,
+          attachedBy: "cloud-task-attach"
+        }
+      });
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(uploadRes, null, 2) + "\n");
+        return;
+      }
+      if (!uploadRes.ok || !uploadRes.data) {
+        process.stderr.write(`Error: attach failed: ${uploadRes.error?.message ?? "unknown"}
+`);
+        process.exit(1);
+      }
+      const dedupHit = Boolean(uploadRes.meta?.dedup);
+      const asset = uploadRes.data;
+      process.stdout.write(`Attached ${displayName}
+
+`);
+      process.stdout.write(`AssetId:      ${asset.id}
+`);
+      process.stdout.write(`Task:         ${targetTaskId}
+`);
+      process.stdout.write(`ContentHash:  ${contentHash}
+`);
+      process.stdout.write(`SizeBytes:    ${bytes.length}
+`);
+      process.stdout.write(`Dedup:        ${dedupHit ? "true (existing IMAsset row)" : "false (created)"}
+`);
+      if (asset.cdnUrl) process.stdout.write(`CDN URL:      ${asset.cdnUrl}
+`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`Error: ${message}
+`);
+      process.exit(1);
+    }
+  });
+  task.command("cancel <task-id>").description("Cancel a task").option("--json", "output raw JSON response").action(async (taskId, opts) => {
+    assertNotRunId(taskId);
+    const client = getIMClient2();
+    try {
+      const res = await client.im.tasks.cancel(taskId);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error?.message || "Unknown error"}
+`);
+        process.exit(1);
+      }
+      const t = res.data;
+      process.stdout.write(`Task cancelled
+
+`);
+      process.stdout.write(`ID:     ${t.id}
+`);
+      process.stdout.write(`Title:  ${t.title}
+`);
+      process.stdout.write(`Status: ${t.status}
+`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`Error: ${message}
+`);
+      process.exit(1);
+    }
+  });
+  task.command("spec-set <task-id>").description("Owner writes / updates SPEC.md for a task").option("-f, --file <path>", "read SPEC.md content from a file").option("-m, --markdown <markdown>", "inline SPEC.md content").option("--json", "output raw JSON response").action(async (taskId, opts) => {
+    assertNotRunId(taskId);
+    const client = getIMClient2();
+    try {
+      let md = "";
+      if (opts.file) {
+        md = await import_node_fs.promises.readFile(opts.file, "utf-8");
+      } else if (opts.markdown) {
+        md = opts.markdown;
+      } else {
+        throw new Error("one of --file or --markdown is required");
+      }
+      const res = await client.im.tasks.spec.set(taskId, { markdown: md });
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error?.message || "Unknown error"}
+`);
+        process.exit(1);
+      }
+      const v = res.data;
+      process.stdout.write(`SPEC.md saved (revision ${v.revision})
+`);
+    } catch (err) {
+      process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.exit(1);
+    }
+  });
+  task.command("spec-show <task-id>").description("Print SPEC.md content for a task").option("--json", "output raw JSON response").action(async (taskId, opts) => {
+    assertNotRunId(taskId);
+    const client = getIMClient2();
+    try {
+      const res = await client.im.tasks.spec.get(taskId);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error?.message || "Unknown error"}
+`);
+        process.exit(1);
+      }
+      const v = res.data;
+      process.stdout.write(v.markdown);
+      if (!v.markdown.endsWith("\n")) process.stdout.write("\n");
+      process.stdout.write(`# revision ${v.revision}
+`);
+    } catch (err) {
+      process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.exit(1);
+    }
+  });
+  task.command("todo-add <task-id> <text...>").description("Append an item to the task TODO.md (assignee)").option("--depth <n>", "nesting depth (0..3)", (v) => parseInt(v, 10), 0).option("--json", "output raw JSON response").action(async (taskId, text, opts) => {
+    assertNotRunId(taskId);
+    const client = getIMClient2();
+    try {
+      const res = await client.im.tasks.todo.add(taskId, {
+        text: text.join(" "),
+        depth: opts.depth
+      });
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error?.message || "Unknown error"}
+`);
+        process.exit(1);
+      }
+      const v = res.data;
+      process.stdout.write(`TODO item added \u2014 ${v.doneCount}/${v.totalCount} (rev ${v.revision})
+`);
+    } catch (err) {
+      process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.exit(1);
+    }
+  });
+  task.command("todo-done <task-id> <index>").description("Mark a TODO item as done").option("--json", "output raw JSON response").action(async (taskId, indexRaw, opts) => {
+    assertNotRunId(taskId);
+    const client = getIMClient2();
+    try {
+      const idx = parseInt(indexRaw, 10);
+      if (!Number.isFinite(idx) || idx < 0) throw new Error("index must be a non-negative integer");
+      const res = await client.im.tasks.todo.toggle(taskId, idx, true);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error?.message || "Unknown error"}
+`);
+        process.exit(1);
+      }
+      const v = res.data;
+      process.stdout.write(
+        `TODO[${idx}] \u2192 done. progress ${v.doneCount}/${v.totalCount} (${Math.round(v.progressPct * 100)}%)
+`
+      );
+    } catch (err) {
+      process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.exit(1);
+    }
+  });
+  task.command("todo-uncheck <task-id> <index>").description("Un-tick a TODO item").option("--json", "output raw JSON response").action(async (taskId, indexRaw, opts) => {
+    assertNotRunId(taskId);
+    const client = getIMClient2();
+    try {
+      const idx = parseInt(indexRaw, 10);
+      if (!Number.isFinite(idx) || idx < 0) throw new Error("index must be a non-negative integer");
+      const res = await client.im.tasks.todo.toggle(taskId, idx, false);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error?.message || "Unknown error"}
+`);
+        process.exit(1);
+      }
+      const v = res.data;
+      process.stdout.write(`TODO[${idx}] \u2192 pending. progress ${v.doneCount}/${v.totalCount}
+`);
+    } catch (err) {
+      process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.exit(1);
+    }
+  });
+  task.command("todo-show <task-id>").description("Render TODO.md checklist + progress for a task").option("--json", "output raw JSON response").action(async (taskId, opts) => {
+    assertNotRunId(taskId);
+    const client = getIMClient2();
+    try {
+      const res = await client.im.tasks.todo.list(taskId);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error?.message || "Unknown error"}
+`);
+        process.exit(1);
+      }
+      const v = res.data;
+      process.stdout.write(
+        `TODO progress: ${v.doneCount}/${v.totalCount} (${Math.round(v.progressPct * 100)}%) \xB7 rev ${v.revision}
+`
+      );
+      for (const it of v.items) {
+        const tick = it.status === "done" ? "\u2611" : "\u2610";
+        const indent = "  ".repeat(it.depth);
+        process.stdout.write(`  ${indent}${tick} [${it.index}] ${it.text}
+`);
+      }
+    } catch (err) {
+      process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.exit(1);
+    }
+  });
+  task.command("acceptance <task-id>").description("Show acceptance criteria + rolled-up status for a task").option("--json", "output raw JSON response").action(async (taskId, opts) => {
+    assertNotRunId(taskId);
+    const client = getIMClient2();
+    try {
+      const res = await client.im.tasks.getAcceptance(taskId);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error?.message || "Unknown error"}
+`);
+        process.exit(1);
+      }
+      const v = res.data;
+      process.stdout.write(`Acceptance for ${taskId}: ${v.overall} (${v.completedCount}/${v.totalCount})
+`);
+      for (const c of v.criteria) {
+        const mark = c.status === "passed" ? "\u2713" : c.status === "failed" ? "\u2717" : c.status === "n/a" ? "\xB7" : "\u25EF";
+        const req = c.required === false ? " [optional]" : "";
+        const ver = c.verifierAgentId ? ` @${c.verifierAgentId}` : "";
+        process.stdout.write(`  ${mark} [${c.verifyMode}${ver}] ${c.expectation}${req} (${c.status}) \u2014 ${c.id}
+`);
+      }
+    } catch (err) {
+      process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.exit(1);
+    }
+  });
+  task.command("add-criterion <task-id>").description("Add an acceptance criterion to a task (rev 2 \u2014 verifyMode + expectation)").requiredOption(
+    "--mode <mode>",
+    "verifyMode: qualitative | quantitative | agent-self-check | manual"
+  ).requiredOption("--expectation <markdown>", "markdown describing what done looks like").option("--verifier-agent <agentId>", "verifier agent id (default = creator)").option("--weight <n>", "weight (numeric, default 1)", parseFloat).option("--optional", "mark this criterion optional (default required)").option("--json", "output raw JSON response").action(async (taskId, opts) => {
+    assertNotRunId(taskId);
+    const client = getIMClient2();
+    try {
+      const VALID = ["qualitative", "quantitative", "agent-self-check", "manual"];
+      if (!VALID.includes(opts.mode)) {
+        throw new Error(`--mode must be one of ${VALID.join(" | ")}`);
+      }
+      const res = await client.im.tasks.criteria.add(taskId, {
+        verifyMode: opts.mode,
+        expectation: opts.expectation,
+        verifierAgentId: opts.verifierAgent ?? null,
+        weight: opts.weight ?? 1,
+        required: !opts.optional
+      });
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error?.message || "Unknown error"}
+`);
+        process.exit(1);
+      }
+      const { criterion } = res.data;
+      process.stdout.write(`Added criterion ${criterion.id} to task ${taskId}
+`);
+    } catch (err) {
+      process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.exit(1);
+    }
+  });
+  task.command("verify <task-id>").description(
+    "Assignee self-check: list all agent-self-check criteria + mark them passed (run before status=review)"
+  ).option("--note <note>", "note to attach to each self-check", "agent self-check via `cloud task verify`").option("--json", "output raw JSON response").action(async (taskId, opts) => {
+    assertNotRunId(taskId);
+    const client = getIMClient2();
+    try {
+      const view = await client.im.tasks.getAcceptance(taskId);
+      if (!view.ok) {
+        process.stderr.write(`Error: ${view.error?.message || "Unknown error"}
+`);
+        process.exit(1);
+      }
+      const v = view.data;
+      const targets = v.criteria.filter(
+        (c) => c.verifyMode === "agent-self-check" && c.status === "pending"
+      );
+      if (targets.length === 0) {
+        process.stdout.write("No pending agent-self-check criteria.\n");
+        return;
+      }
+      const results = [];
+      let anyFailed = false;
+      for (const c of targets) {
+        const r = await client.im.tasks.criteria.verify(taskId, c.id, {
+          outcome: "passed",
+          note: opts.note
+        });
+        results.push({ id: c.id, outcome: r.ok ? "passed" : "error" });
+        if (!r.ok) anyFailed = true;
+      }
+      if (opts.json) {
+        process.stdout.write(JSON.stringify({ ok: !anyFailed, results }, null, 2) + "\n");
+        return;
+      }
+      for (const r of results) {
+        process.stdout.write(`  ${r.outcome === "passed" ? "\u2713" : "\u2717"} ${r.id}
+`);
+      }
+      if (anyFailed) process.exit(1);
+    } catch (err) {
+      process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.exit(1);
+    }
+  });
+  task.command("verify-criterion <task-id> <criterion-id>").description(
+    "Report verify outcome for one criterion. Used by reviewers (manual), verifier agents, and assignees (self-check)."
+  ).requiredOption("--outcome <outcome>", "passed | failed | n/a | waived").option("--note <note>", "free-form markdown: method + result + repro steps").option("--evidence <ref...>", "evidence refs (repeatable; e.g. asset:<id>, url:..., taskRun:<id>)").option("--waive-reason <reason>", "required when --outcome waived").option("--json", "output raw JSON response").action(async (taskId, criterionId, opts) => {
+    assertNotRunId(taskId);
+    const client = getIMClient2();
+    try {
+      const VALID = ["passed", "failed", "n/a", "waived"];
+      if (!VALID.includes(opts.outcome)) {
+        throw new Error(`--outcome must be one of ${VALID.join(" | ")}`);
+      }
+      if (opts.outcome === "waived" && !opts.waiveReason) {
+        throw new Error("--waive-reason is required when --outcome waived");
+      }
+      const outcome = opts.outcome;
+      const res = await client.im.tasks.criteria.verify(taskId, criterionId, {
+        outcome,
+        note: opts.note,
+        evidenceRefs: opts.evidence,
+        waiveReason: opts.waiveReason
+      });
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error?.message || "Unknown error"}
+`);
+        process.exit(1);
+      }
+      process.stdout.write(`Criterion ${criterionId} \u2192 ${opts.outcome}
+`);
+    } catch (err) {
+      process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.exit(1);
+    }
+  });
+  task.command("apply-template <task-id>").description("Apply an acceptance criteria template to a task").requiredOption("--template <templateId>", "template id to apply").option("--json", "output raw JSON response").action(async (taskId, opts) => {
+    assertNotRunId(taskId);
+    const client = getIMClient2();
+    try {
+      const res = await client.im.tasks.applyTemplate(taskId, opts.template);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error?.message || "Unknown error"}
+`);
+        process.exit(1);
+      }
+      const v = res.data;
+      process.stdout.write(`Applied template ${opts.template} (${v.totalCount} criteria total)
 `);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -6496,7 +7515,7 @@ function printFileTable(files) {
   const idLen = Math.max(2, ...files.map((f) => f.id.length));
   const scopeLen = Math.max(5, ...files.map((f) => f.scope.length));
   const pathLen = Math.max(4, ...files.map((f) => f.path.length));
-  const row = (id, scope, path5) => `${id.padEnd(idLen)}  ${scope.padEnd(scopeLen)}  ${path5.padEnd(pathLen)}`;
+  const row = (id, scope, path6) => `${id.padEnd(idLen)}  ${scope.padEnd(scopeLen)}  ${path6.padEnd(pathLen)}`;
   process.stdout.write(row("ID", "SCOPE", "PATH") + "\n");
   process.stdout.write(`${"-".repeat(idLen)}  ${"-".repeat(scopeLen)}  ${"-".repeat(pathLen)}
 `);
@@ -6679,88 +7698,544 @@ ${result.content}
 `);
       }
     } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      process.stderr.write(`Error: ${message}
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`Error: ${message}
+`);
+      process.exit(1);
+    }
+  });
+  skill.command("uninstall <slug>").description("Uninstall a skill").option("--no-local", "cloud-only uninstall, do not remove local files").option("--json", "output raw JSON response").action(async (slug, opts) => {
+    const client = getIMClient2();
+    try {
+      let res;
+      if (!opts.local) {
+        res = await client.im.evolution.uninstallSkill(slug);
+      } else {
+        res = await client.im.evolution.uninstallSkillLocal(slug);
+      }
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      const result = res;
+      if (result?.ok === false) {
+        process.stderr.write(`Uninstall failed.
+`);
+        process.exit(1);
+      }
+      process.stdout.write(`Uninstalled: ${slug}
+`);
+      const removedPaths = result?.data?.removedPaths ?? [];
+      if (removedPaths.length > 0) {
+        process.stdout.write("Local files removed:\n");
+        for (const p of removedPaths) {
+          process.stdout.write(`  ${p}
+`);
+        }
+      } else if (!opts.local) {
+        process.stdout.write("Cloud-only uninstall complete (no local files removed).\n");
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`Error: ${message}
+`);
+      process.exit(1);
+    }
+  });
+  skill.command("sync").description("Re-sync all installed skills to local filesystem").option("--platform <platform>", "target platform: claude-code, openclaw, opencode, or all", "all").option("--json", "output raw JSON response").action(async (opts) => {
+    const client = getIMClient2();
+    try {
+      const platforms = parsePlatforms(opts.platform);
+      const res = await client.im.evolution.syncSkillsLocal({ platforms });
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      const result = res;
+      const synced = result?.synced ?? 0;
+      const failed = result?.failed ?? 0;
+      process.stdout.write(`Synced: ${synced} skill(s)`);
+      if (failed > 0) {
+        process.stdout.write(`, failed: ${failed}`);
+      }
+      process.stdout.write("\n");
+      const paths = result?.paths ?? [];
+      if (paths.length > 0) {
+        process.stdout.write("Files written:\n");
+        for (const p of paths) {
+          process.stdout.write(`  ${p}
+`);
+        }
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`Error: ${message}
+`);
+      process.exit(1);
+    }
+  });
+}
+
+// src/commands/skill-draft.ts
+var fs3 = __toESM(require("fs"));
+function register7(parent, getIMClient2, _getAPIClient) {
+  const skill = parent.commands.find((c) => c.name() === "skill") ?? parent.command("skill");
+  const draft = skill.command("draft").description("Author / patch / regenerate / show / list skill drafts (release201/07)");
+  draft.command("create").description("Submit a new skill draft from a manifest.json file").option("--slug <slug>", "Draft slug (overrides manifest.slug)").option("--manifest <path>", "Path to manifest.json containing slug/name/description/files[]/...").option("--workspace <id>", "Override manifest.workspaceId").option("--owner-agent <id>", "Override manifest.ownerAgentId").option("--json", "Output raw JSON response").action(async (opts) => {
+    if (!opts.manifest) {
+      process.stderr.write("Error: --manifest <path-to-manifest.json> is required\n");
+      process.exit(1);
+    }
+    let manifest;
+    try {
+      manifest = JSON.parse(fs3.readFileSync(opts.manifest, "utf-8"));
+    } catch (err) {
+      process.stderr.write(`Error: failed to read manifest ${opts.manifest}: ${err.message}
+`);
+      process.exit(1);
+    }
+    const slug = opts.slug ?? manifest.slug;
+    const workspaceId = opts.workspace ?? manifest.workspaceId;
+    const ownerAgentId = opts.ownerAgent ?? manifest.ownerAgentId;
+    if (!slug || !manifest.name || !manifest.description) {
+      process.stderr.write("Error: manifest must include slug, name, description\n");
+      process.exit(1);
+    }
+    if (!workspaceId) {
+      process.stderr.write("Error: --workspace <id> or manifest.workspaceId is required\n");
+      process.exit(1);
+    }
+    if (!Array.isArray(manifest.files) || manifest.files.length < 2) {
+      process.stderr.write("Error: manifest.files[] must include at least SKILL.md + skill.json\n");
+      process.exit(1);
+    }
+    const client = getIMClient2();
+    try {
+      const res = await client.im.skills.draft.create({
+        slug,
+        name: manifest.name,
+        description: manifest.description,
+        workspaceId,
+        ownerAgentId,
+        files: manifest.files,
+        metadata: manifest.metadata
+      });
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error ?? "create failed"}
+`);
+        process.exit(1);
+      }
+      const data = res.data ?? res;
+      process.stdout.write(`Draft submitted.
+`);
+      process.stdout.write(`  id:                ${data.id}
+`);
+      process.stdout.write(`  slug:              ${data.slug}
+`);
+      process.stdout.write(`  manifest revision: ${data.manifestRevision}
+`);
+      if (data.reviewTaskId) {
+        process.stdout.write(`  review task:       ${data.reviewTaskId}
+`);
+      }
+      const warnings = data.validationWarnings ?? [];
+      if (warnings.length > 0) {
+        process.stdout.write(`  warnings:
+`);
+        for (const w of warnings) {
+          process.stdout.write(`    [${w.gate}] ${w.message}
+`);
+        }
+      }
+    } catch (err) {
+      process.stderr.write(`Error: ${err.message}
+`);
+      process.exit(1);
+    }
+  });
+  draft.command("patch <draft-id>").description("Patch a draft \u2014 add / update / delete a single file").option("--file <path>", "Manifest file path inside the draft (e.g. SKILL.md or references/foo.md)").option("--op <op>", "Operation: add | update | delete", "update").option("--content <text>", "New utf-8 content for add/update (omit for --content-file)").option("--content-file <path>", "Read content from a local file").option("--reason <text>", "Free-form reason recorded in revision history").option("--json", "Output raw JSON response").action(async (draftId, opts) => {
+    if (!opts.file) {
+      process.stderr.write("Error: --file <path> is required\n");
+      process.exit(1);
+    }
+    if (!["add", "update", "delete"].includes(opts.op)) {
+      process.stderr.write(`Error: --op must be add | update | delete (got ${opts.op})
+`);
+      process.exit(1);
+    }
+    let content;
+    if (opts.op !== "delete") {
+      if (opts.contentFile) {
+        try {
+          content = fs3.readFileSync(opts.contentFile, "utf-8");
+        } catch (err) {
+          process.stderr.write(`Error: failed to read --content-file: ${err.message}
+`);
+          process.exit(1);
+        }
+      } else if (opts.content !== void 0) {
+        content = opts.content;
+      } else {
+        process.stderr.write("Error: --content or --content-file is required for add/update\n");
+        process.exit(1);
+      }
+    }
+    const client = getIMClient2();
+    try {
+      const res = await client.im.skills.draft.patch(draftId, {
+        files: [{ path: opts.file, op: opts.op, content }],
+        reason: opts.reason
+      });
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error ?? "patch failed"}
+`);
+        process.exit(1);
+      }
+      const data = res.data ?? res;
+      process.stdout.write(`Patch applied.
+`);
+      process.stdout.write(`  id:                ${data.id}
+`);
+      process.stdout.write(`  manifest revision: ${data.manifestRevision}
+`);
+    } catch (err) {
+      process.stderr.write(`Error: ${err.message}
+`);
+      process.exit(1);
+    }
+  });
+  draft.command("regenerate <draft-id>").description("Request a regenerate session for a draft (does not delete current manifest)").option("--reason <text>", "Why the draft needs regeneration").option("--json", "Output raw JSON response").action(async (draftId, opts) => {
+    if (!opts.reason) {
+      process.stderr.write("Error: --reason <text> is required\n");
+      process.exit(1);
+    }
+    const client = getIMClient2();
+    try {
+      const res = await client.im.skills.draft.regenerate(draftId, { reason: opts.reason });
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error ?? "regenerate failed"}
+`);
+        process.exit(1);
+      }
+      const data = res.data ?? res;
+      process.stdout.write(`Regenerate requested.
+`);
+      process.stdout.write(`  id:         ${data.id}
+`);
+      process.stdout.write(`  session id: ${data.sessionId}
+`);
+    } catch (err) {
+      process.stderr.write(`Error: ${err.message}
+`);
+      process.exit(1);
+    }
+  });
+  draft.command("show <draft-id>").description("Show a draft's manifest + revision history").option("--json", "Output raw JSON response").action(async (draftId, opts) => {
+    const client = getIMClient2();
+    try {
+      const res = await client.im.skills.draft.show(draftId);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error ?? "show failed"}
+`);
+        process.exit(1);
+      }
+      const data = res.data ?? res;
+      process.stdout.write(`Draft ${data.id}
+`);
+      process.stdout.write(`  slug:        ${data.slug}
+`);
+      process.stdout.write(`  name:        ${data.name}
+`);
+      process.stdout.write(`  status:      ${data.status}
+`);
+      process.stdout.write(`  workspace:   ${data.workspaceId}
+`);
+      process.stdout.write(`  ownerAgent:  ${data.ownerAgentId}
+`);
+      process.stdout.write(`  revision:    ${data.manifestRevision}
+`);
+      process.stdout.write(`  license:     ${data.license}
+`);
+      process.stdout.write(`  compatibility: ${(data.compatibility ?? []).join(", ")}
+`);
+      process.stdout.write(`  files:
+`);
+      for (const f of data.files ?? []) {
+        process.stdout.write(`    ${f.path} (${f.size}B, sha256:${(f.sha256 ?? "").slice(0, 8)}\u2026)
+`);
+      }
+    } catch (err) {
+      process.stderr.write(`Error: ${err.message}
+`);
+      process.exit(1);
+    }
+  });
+  draft.command("list").description("List drafts in a workspace").option("--workspace <id>", "Workspace id (required)").option("--json", "Output raw JSON response").action(async (opts) => {
+    if (!opts.workspace) {
+      process.stderr.write("Error: --workspace <id> is required\n");
+      process.exit(1);
+    }
+    const client = getIMClient2();
+    try {
+      const res = await client.im.skills.draft.list(opts.workspace);
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+        return;
+      }
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error ?? "list failed"}
+`);
+        process.exit(1);
+      }
+      const drafts = res.data ?? [];
+      if (drafts.length === 0) {
+        process.stdout.write("No drafts in this workspace.\n");
+        return;
+      }
+      process.stdout.write(`Drafts (${drafts.length}):
+`);
+      for (const d of drafts) {
+        process.stdout.write(`  ${d.id}  ${d.slug}  ${(d.name ?? "").slice(0, 32)}  rev:${(d.contentManifestRevision ?? "").slice(0, 8)}\u2026  updated:${d.updatedAt}
+`);
+      }
+    } catch (err) {
+      process.stderr.write(`Error: ${err.message}
+`);
+      process.exit(1);
+    }
+  });
+}
+
+// src/commands/code-grep.ts
+var fs4 = __toESM(require("fs"));
+var path2 = __toESM(require("path"));
+var crypto2 = __toESM(require("crypto"));
+var os = __toESM(require("os"));
+var DEFAULT_MAX_MATCHES = 50;
+var SCRATCH_DIR_GLOB = path2.join(os.homedir(), ".prismer", "agents");
+function isPathWhitelisted(repo) {
+  const abs = path2.resolve(repo);
+  const workspaceRoot = process.env.PRISMER_WORKSPACE_ROOT;
+  if (workspaceRoot) {
+    const wsAbs = path2.resolve(workspaceRoot);
+    if (abs === wsAbs || abs.startsWith(wsAbs + path2.sep)) return true;
+  }
+  if (abs.startsWith(SCRATCH_DIR_GLOB + path2.sep)) {
+    const rel = abs.slice(SCRATCH_DIR_GLOB.length + 1);
+    const parts = rel.split(path2.sep);
+    if (parts.length >= 2 && parts[1] === "scratch") return true;
+  }
+  return false;
+}
+function walk(dir, glob, acc) {
+  let entries;
+  try {
+    entries = fs4.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    const full = path2.join(dir, e.name);
+    if (e.isDirectory()) {
+      if (e.name === "node_modules" || e.name === ".git" || e.name === "dist" || e.name === "build") continue;
+      walk(full, glob, acc);
+    } else if (e.isFile()) {
+      if (!glob || matchGlob(e.name, glob)) acc.push(full);
+    }
+  }
+}
+function matchGlob(name, glob) {
+  if (glob.startsWith("*.")) {
+    return name.endsWith(glob.slice(1));
+  }
+  return name === glob;
+}
+function register8(parent, _getIMClient, _getAPIClient) {
+  const code = parent.command("code").description("Local code-source helpers for skill-authoring (release201/07)");
+  code.command("grep <pattern>").description("Grep a whitelisted repo path for a pattern; output matched snippets as JSON").option("--repo <abs-path>", "Absolute repo path (must be inside PRISMER_WORKSPACE_ROOT or ~/.prismer/agents/<id>/scratch)").option("--glob <pattern>", "File-name glob (e.g. *.ts)").option("--max-matches <n>", "Maximum number of matches to return", String(DEFAULT_MAX_MATCHES)).option("--json", "Output JSON (default)", true).action(async (pattern, opts) => {
+    if (!opts.repo) {
+      process.stderr.write("Error: --repo <abs-path> is required\n");
+      process.exit(1);
+    }
+    if (!isPathWhitelisted(opts.repo)) {
+      process.stderr.write(
+        `Error: --repo path ${opts.repo} is not whitelisted; only PRISMER_WORKSPACE_ROOT or ~/.prismer/agents/<id>/scratch are allowed
+`
+      );
+      process.exit(1);
+    }
+    const maxMatches = parseInt(opts.maxMatches, 10) || DEFAULT_MAX_MATCHES;
+    let re;
+    try {
+      re = new RegExp(pattern);
+    } catch (err) {
+      process.stderr.write(`Error: invalid regex pattern: ${err.message}
 `);
       process.exit(1);
     }
-  });
-  skill.command("uninstall <slug>").description("Uninstall a skill").option("--no-local", "cloud-only uninstall, do not remove local files").option("--json", "output raw JSON response").action(async (slug, opts) => {
-    const client = getIMClient2();
-    try {
-      let res;
-      if (!opts.local) {
-        res = await client.im.evolution.uninstallSkill(slug);
-      } else {
-        res = await client.im.evolution.uninstallSkillLocal(slug);
+    const files = [];
+    walk(opts.repo, opts.glob, files);
+    const results = [];
+    for (const file of files) {
+      if (results.length >= maxMatches) break;
+      let body;
+      try {
+        body = fs4.readFileSync(file, "utf-8");
+      } catch {
+        continue;
       }
-      if (opts.json) {
-        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
-        return;
+      const lines = body.split("\n");
+      for (let i = 0; i < lines.length; i++) {
+        if (re.test(lines[i])) {
+          const startLine = Math.max(0, i - 1);
+          const endLine = Math.min(lines.length, i + 4);
+          const snippet = lines.slice(startLine, endLine).join("\n");
+          const sha256 = crypto2.createHash("sha256").update(snippet).digest("hex");
+          results.push({
+            path: path2.relative(opts.repo, file),
+            line: i + 1,
+            snippet,
+            sha256
+          });
+          if (results.length >= maxMatches) break;
+        }
       }
-      const result = res;
-      if (result?.ok === false) {
-        process.stderr.write(`Uninstall failed.
-`);
-        process.exit(1);
+    }
+    process.stdout.write(JSON.stringify(results, null, 2) + "\n");
+  });
+}
+
+// src/commands/service-introspect.ts
+var FETCH_TIMEOUT_MS = 1e4;
+async function fetchWithTimeout(url, init = {}) {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: ctrl.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function probeOpenApi(url) {
+  const base = url.replace(/\/$/, "");
+  const candidates = [
+    `${base}/openapi.json`,
+    `${base}/swagger.json`,
+    `${base}/api/openapi.json`,
+    `${base}/.well-known/openapi.json`
+  ];
+  for (const candidate of candidates) {
+    try {
+      const res = await fetchWithTimeout(candidate, { headers: { Accept: "application/json" } });
+      if (res.ok) {
+        const spec = await res.json();
+        if (spec && (spec.openapi || spec.swagger)) {
+          return { found: true, spec, specUrl: candidate };
+        }
       }
-      process.stdout.write(`Uninstalled: ${slug}
-`);
-      const removedPaths = result?.data?.removedPaths ?? [];
-      if (removedPaths.length > 0) {
-        process.stdout.write("Local files removed:\n");
-        for (const p of removedPaths) {
-          process.stdout.write(`  ${p}
-`);
+    } catch {
+    }
+  }
+  return { found: false };
+}
+async function probeMcp(url) {
+  try {
+    const res = await fetchWithTimeout(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" })
+    });
+    if (!res.ok) return { found: false };
+    const body = await res.json();
+    if (body?.result?.tools) {
+      let resources = [];
+      try {
+        const r = await fetchWithTimeout(url, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "resources/list" })
+        });
+        if (r.ok) {
+          const rb = await r.json();
+          if (Array.isArray(rb?.result?.resources)) resources = rb.result.resources;
         }
-      } else if (!opts.local) {
-        process.stdout.write("Cloud-only uninstall complete (no local files removed).\n");
+      } catch {
       }
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      process.stderr.write(`Error: ${message}
+      return { found: true, tools: body.result.tools, resources };
+    }
+  } catch {
+  }
+  return { found: false };
+}
+function register9(parent, _getIMClient, _getAPIClient) {
+  const svc = parent.command("service").description("Local service-endpoint helpers for skill-authoring (release201/07)");
+  svc.command("introspect <url>").description("Probe an HTTP / MCP / OpenAPI endpoint and emit a tool/endpoint catalog").option("--protocol <kind>", "Force protocol: auto | mcp | openapi", "auto").option("--json", "Output JSON (default)", true).action(async (url, opts) => {
+    const protocol = opts.protocol ?? "auto";
+    if (protocol !== "auto" && protocol !== "mcp" && protocol !== "openapi") {
+      process.stderr.write(`Error: --protocol must be auto | mcp | openapi (got ${protocol})
 `);
       process.exit(1);
     }
-  });
-  skill.command("sync").description("Re-sync all installed skills to local filesystem").option("--platform <platform>", "target platform: claude-code, openclaw, opencode, or all", "all").option("--json", "output raw JSON response").action(async (opts) => {
-    const client = getIMClient2();
-    try {
-      const platforms = parsePlatforms(opts.platform);
-      const res = await client.im.evolution.syncSkillsLocal({ platforms });
-      if (opts.json) {
-        process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+    const result = { kind: "unknown", tools: [], endpoints: [], probedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    if (protocol === "mcp" || protocol === "auto") {
+      const mcp = await probeMcp(url);
+      if (mcp.found) {
+        result.kind = "mcp";
+        result.tools = mcp.tools ?? [];
+        result.resources = mcp.resources ?? [];
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
         return;
       }
-      const result = res;
-      const synced = result?.synced ?? 0;
-      const failed = result?.failed ?? 0;
-      process.stdout.write(`Synced: ${synced} skill(s)`);
-      if (failed > 0) {
-        process.stdout.write(`, failed: ${failed}`);
-      }
-      process.stdout.write("\n");
-      const paths = result?.paths ?? [];
-      if (paths.length > 0) {
-        process.stdout.write("Files written:\n");
-        for (const p of paths) {
-          process.stdout.write(`  ${p}
-`);
+    }
+    if (protocol === "openapi" || protocol === "auto") {
+      const oa = await probeOpenApi(url);
+      if (oa.found) {
+        result.kind = "openapi";
+        result.specUrl = oa.specUrl;
+        const paths = oa.spec?.paths ?? {};
+        for (const p of Object.keys(paths)) {
+          for (const method of Object.keys(paths[p])) {
+            if (["get", "post", "put", "delete", "patch"].includes(method.toLowerCase())) {
+              const op = paths[p][method];
+              result.endpoints.push({
+                path: p,
+                method: method.toUpperCase(),
+                operationId: op?.operationId ?? null,
+                summary: op?.summary ?? null
+              });
+            }
+          }
         }
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return;
       }
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      process.stderr.write(`Error: ${message}
-`);
-      process.exit(1);
     }
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
   });
 }
 
 // src/commands/files.ts
-function register7(parent, getIMClient2, _getAPIClient) {
+function register10(parent, getIMClient2, _getAPIClient) {
   const file = parent.command("file").description("File upload, transfer, quota, and type management");
-  file.command("upload <path>").description("Upload a file and get its upload ID and CDN URL").option("--mime <type>", "Override MIME type (e.g. image/png)").option("--json", "Output raw JSON response").action(async (filePath, opts) => {
+  file.command("upload <path>").description(
+    "Upload bytes only \u2192 returns an upload ID + CDN URL. NOT a delivery: nothing reaches the user. To deliver an artifact use `cloud deliver <path>`."
+  ).option("--mime <type>", "Override MIME type (e.g. image/png)").option("--json", "Output raw JSON response").action(async (filePath, opts) => {
     const client = getIMClient2();
     try {
       const uploadOpts = {};
@@ -6780,13 +8255,39 @@ function register7(parent, getIMClient2, _getAPIClient) {
 `);
       process.stdout.write(`MIME:      ${res.mimeType}
 `);
+      process.stdout.write(
+        "Note: this only uploaded bytes \u2014 nothing was delivered to the user. To deliver an artifact, run `cloud deliver <abs-path>`.\n"
+      );
     } catch (err) {
       process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
 `);
       process.exit(1);
     }
   });
-  file.command("send <conversation-id> <path>").description("Upload a file and send it as a message in a conversation").option("-c, --content <text>", "Optional text caption to accompany the file").option("--mime <type>", "Override MIME type").option("--json", "Output raw JSON response").action(async (conversationId, filePath, opts) => {
+  file.command("send <conversation-id> <path>").description(
+    "Send a file as its OWN standalone message (ad-hoc sharing). For a final deliverable use `cloud deliver` instead \u2014 do not run both on the same file (double-delivery)."
+  ).option("-c, --content <text>", "Optional text caption to accompany the file").option("--mime <type>", "Override MIME type").option("--run-id <id>", "dispatch run/task id (from <execution_context>; env fallback PRISMER_TASK_ID/RUN_ID)").option("--conversation-id <id>", "conversation id (alternative source; positional <conversation-id> takes precedence)").option("--daemon-port <port>", "daemon local-server port (env fallback PRISMER_DAEMON_PORT, default 3210)").option("--json", "Output raw JSON response").action(async (conversationIdArg, filePath, opts) => {
+    const conversationId = conversationIdArg || opts.conversationId || "";
+    const proxy = detectDeliverProxy({
+      runId: opts.runId,
+      conversationId,
+      daemonPort: opts.daemonPort
+    });
+    if (proxy) {
+      const result = await proxyDeliver(proxy, filePath, "send", conversationId);
+      if (!result.ok) {
+        process.stderr.write(`Error: ${result.error ?? "delivery failed"}
+`);
+        process.exit(1);
+      }
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return;
+      }
+      process.stdout.write(`File sent to conversation ${conversationId} (assetId: ${result.assetId ?? "-"})
+`);
+      return;
+    }
     const client = getIMClient2();
     try {
       const sendOpts = {};
@@ -6872,8 +8373,43 @@ function register7(parent, getIMClient2, _getAPIClient) {
 }
 
 // src/commands/workspace.ts
-function register8(parent, getIMClient2, _getAPIClient) {
-  const workspace = parent.command("workspace").description("Workspace management \u2014 init, groups, and agent assignment");
+function fail(message) {
+  process.stderr.write(`Error: ${message}
+`);
+  process.exit(1);
+}
+function emitJson(data, json, fallback) {
+  if (json) {
+    process.stdout.write(JSON.stringify(data, null, 2) + "\n");
+    return;
+  }
+  fallback();
+}
+function parseAdminMemberRole(raw) {
+  if (raw === "admin" || raw === "member") return raw;
+  if (raw === void 0) return "member";
+  if (raw === "owner") {
+    fail("--role=owner is not allowed via CLI; use ownership transfer (v2.1+ RFC, release201/16 \xA75.2)");
+  }
+  fail("--role must be admin|member");
+}
+function printMemberList(items) {
+  if (items.length === 0) {
+    process.stdout.write("No members in this workspace.\n");
+    return;
+  }
+  process.stdout.write(
+    "ID".padEnd(28) + "ROLE".padEnd(10) + "IM_USER_ID".padEnd(38) + "JOINED\n"
+  );
+  for (const m of items) {
+    process.stdout.write(
+      `${m.id.padEnd(28)}${m.role.padEnd(10)}${m.memberImUserId.padEnd(38)}${m.joinedAt}
+`
+    );
+  }
+}
+function register11(parent, getIMClient2, _getAPIClient) {
+  const workspace = parent.command("workspace").description("Workspace management \u2014 init, groups, agent assignment, and members (release201/16)");
   workspace.command("init <name>").description("Initialize a workspace with a user and agent").requiredOption("--user-id <id>", "User ID").requiredOption("--user-name <name>", "User display name").requiredOption("--agent-id <id>", "Agent ID").requiredOption("--agent-name <name>", "Agent display name").option("--agent-type <type>", "Agent type", "assistant").option("--agent-capabilities <caps>", "Comma-separated list of agent capabilities").option("--json", "Output raw JSON response").action(async (name, opts) => {
     const client = getIMClient2();
     try {
@@ -6934,62 +8470,299 @@ function register8(parent, getIMClient2, _getAPIClient) {
       process.exit(1);
     }
   });
-  workspace.command("add-agent <workspace-id> <agent-id>").description("Add an agent to a workspace").option("--json", "Output raw JSON response").action(async (workspaceId, agentId, opts) => {
+  workspace.command("add-agent <workspace-id> <agent-id>").description("Add an agent to a workspace").option("--json", "Output raw JSON response").action(async (workspaceId, agentId, opts) => {
+    const client = getIMClient2();
+    try {
+      const res = await client.im.workspace.addAgent(workspaceId, agentId);
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error?.message || JSON.stringify(res.error)}
+`);
+        process.exit(1);
+      }
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(res.data, null, 2) + "\n");
+        return;
+      }
+      process.stdout.write(`Agent ${agentId} added to workspace ${workspaceId}.
+`);
+    } catch (err) {
+      process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.exit(1);
+    }
+  });
+  workspace.command("agents <workspace-id>").description("List agents in a workspace").option("--json", "Output raw JSON response").action(async (workspaceId, opts) => {
+    const client = getIMClient2();
+    try {
+      const res = await client.im.workspace.listAgents(workspaceId);
+      if (!res.ok) {
+        process.stderr.write(`Error: ${res.error?.message || JSON.stringify(res.error)}
+`);
+        process.exit(1);
+      }
+      const agents = res.data || [];
+      if (opts.json) {
+        process.stdout.write(JSON.stringify(agents, null, 2) + "\n");
+        return;
+      }
+      if (agents.length === 0) {
+        process.stdout.write("No agents in this workspace.\n");
+        return;
+      }
+      process.stdout.write("Agent ID".padEnd(36) + "Type".padEnd(14) + "Name\n");
+      for (const a of agents) {
+        process.stdout.write(
+          `${(a.agentId || a.id || "").padEnd(36)}${(a.agentType || "").padEnd(14)}${a.name || a.displayName || ""}
+`
+        );
+      }
+    } catch (err) {
+      process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.exit(1);
+    }
+  });
+  const member = workspace.command("member").description("Workspace membership management (release201/16)");
+  member.command("list <workspaceId>").description("List members of a workspace (any member can read)").option("--json", "Output JSON").action(async (workspaceId, opts) => {
+    const client = getIMClient2();
+    const res = await client.workspaces.members.list(workspaceId);
+    if (!res.ok || !res.data) fail(res.error?.message || "list members failed");
+    emitJson(res.data, opts.json === true, () => printMemberList(res.data));
+  });
+  member.command("add <workspaceId>").description("Add an existing user to a workspace as admin or member (owner only)").requiredOption("--user <imUserId>", "IM user id of the new member").option("--role <role>", "admin | member (default member)").option("--json", "Output JSON").action(async (workspaceId, opts) => {
+    const role = parseAdminMemberRole(opts.role);
+    const client = getIMClient2();
+    const res = await client.workspaces.members.add(workspaceId, {
+      memberImUserId: opts.user.trim(),
+      role
+    });
+    if (!res.ok || !res.data) fail(res.error?.message || "add member failed");
+    emitJson(res.data, opts.json === true, () => {
+      const m = res.data;
+      process.stdout.write(`Member added: ${m.memberImUserId} \u2192 ${m.role} (${m.id})
+`);
+    });
+  });
+  member.command("update <workspaceId> <memberId>").description("Change a member role (owner only; owner row is immutable)").requiredOption("--role <role>", "admin | member").option("--json", "Output JSON").action(async (workspaceId, memberId, opts) => {
+    const role = parseAdminMemberRole(opts.role);
+    const client = getIMClient2();
+    const res = await client.workspaces.members.update(workspaceId, memberId, { role });
+    if (!res.ok || !res.data) fail(res.error?.message || "update member failed");
+    emitJson(res.data, opts.json === true, () => {
+      const m = res.data;
+      process.stdout.write(`Member ${m.id} role \u2192 ${m.role}
+`);
+    });
+  });
+  member.command("remove <workspaceId> <memberId>").description("Remove a member (owner only); cascades project memberships in the same workspace").option("--json", "Output JSON").action(async (workspaceId, memberId, opts) => {
+    const client = getIMClient2();
+    const res = await client.workspaces.members.remove(workspaceId, memberId);
+    if (!res.ok || !res.data) fail(res.error?.message || "remove member failed");
+    emitJson(res.data, opts.json === true, () => {
+      const r = res.data;
+      process.stdout.write(
+        `Member removed: ${r.removed.memberImUserId} (${r.removed.id}); project memberships cascaded: ${r.projectMembershipsRemoved}
+`
+      );
+    });
+  });
+}
+
+// src/commands/project.ts
+function fail2(message) {
+  process.stderr.write(`Error: ${message}
+`);
+  process.exit(1);
+}
+function emit(data, json, lines) {
+  if (json) {
+    process.stdout.write(JSON.stringify(data, null, 2) + "\n");
+    return;
+  }
+  lines();
+}
+function parsePrincipal(raw) {
+  const idx = raw.indexOf(":");
+  if (idx <= 0) fail2("--principal must be `user:<id>` or `agent:<id>`");
+  const kind = raw.slice(0, idx);
+  const id = raw.slice(idx + 1).trim();
+  if (kind !== "user" && kind !== "agent") fail2("principal kind must be user|agent");
+  if (!id) fail2("principal id must be non-empty");
+  return { kind, id };
+}
+function parseRole(raw) {
+  if (raw === void 0) return void 0;
+  if (raw === "owner" || raw === "contributor" || raw === "observer") return raw;
+  fail2("--role must be owner|contributor|observer");
+}
+function printProjectList(items) {
+  if (items.length === 0) {
+    process.stdout.write("No projects found.\n");
+    return;
+  }
+  process.stdout.write(
+    "ID".padEnd(28) + "SLUG".padEnd(20) + "STATUS".padEnd(10) + "MEMBERS".padEnd(10) + "NAME\n"
+  );
+  for (const p of items) {
+    process.stdout.write(
+      `${p.id.padEnd(28)}${p.slug.padEnd(20)}${p.status.padEnd(10)}${String(p.memberCount).padEnd(10)}${p.name}
+`
+    );
+  }
+}
+function printProject(p, heading = "Project") {
+  process.stdout.write(`${heading}: ${p.name}
+`);
+  process.stdout.write(`  id           ${p.id}
+`);
+  process.stdout.write(`  slug         ${p.slug}
+`);
+  process.stdout.write(`  workspaceId  ${p.workspaceId}
+`);
+  process.stdout.write(`  status       ${p.status}
+`);
+  process.stdout.write(`  owner        ${p.ownerUserId}
+`);
+  if ("memberCount" in p) process.stdout.write(`  members      ${p.memberCount}
+`);
+  if (p.description) process.stdout.write(`  description  ${p.description}
+`);
+  if (p.archivedAt) process.stdout.write(`  archivedAt   ${p.archivedAt}
+`);
+  process.stdout.write(`  createdAt    ${p.createdAt}
+`);
+  process.stdout.write(`  updatedAt    ${p.updatedAt}
+`);
+}
+function printMemberList2(items) {
+  if (items.length === 0) {
+    process.stdout.write("No members in this project.\n");
+    return;
+  }
+  process.stdout.write(
+    "ID".padEnd(28) + "KIND".padEnd(8) + "PRINCIPAL".padEnd(38) + "ROLE".padEnd(14) + "JOINED\n"
+  );
+  for (const m of items) {
+    process.stdout.write(
+      `${m.id.padEnd(28)}${m.principalKind.padEnd(8)}${m.principalId.padEnd(38)}${m.role.padEnd(14)}${m.joinedAt}
+`
+    );
+  }
+}
+function register12(parent, getIMClient2, _getAPIClient) {
+  const project = parent.command("project").description("Project scope (release201/09) \u2014 CRUD + membership management");
+  project.command("list").description("List projects in a workspace").requiredOption("--workspace <id>", "Workspace id").option("--status <status>", "Filter by status: active|archived").option("--search <q>", "Search name/slug substring").option("--limit <n>", "Page size (1-200)", (v) => Number(v)).option("--offset <n>", "Page offset", (v) => Number(v)).option("--json", "Output JSON").action(async (opts) => {
+    if (opts.status && opts.status !== "active" && opts.status !== "archived") {
+      fail2("--status must be active|archived");
+    }
+    const client = getIMClient2();
+    const res = await client.projects.list({
+      workspaceId: opts.workspace,
+      status: opts.status,
+      search: opts.search,
+      limit: opts.limit,
+      offset: opts.offset
+    });
+    if (!res.ok || !res.data) fail2(res.error?.message || "list failed");
+    const data = res.data;
+    emit(data, opts.json === true, () => {
+      printProjectList(data.items);
+      process.stdout.write(`
+Total: ${data.total}
+`);
+    });
+  });
+  project.command("create").description("Create a project in a workspace").requiredOption("--workspace <id>", "Workspace id").requiredOption("--slug <slug>", "Project slug (1-64 chars, [a-z0-9-])").requiredOption("--name <name>", "Project display name").option("--description <text>", "Project description").option("--json", "Output JSON").action(async (opts) => {
+    const client = getIMClient2();
+    const res = await client.projects.create({
+      workspaceId: opts.workspace,
+      slug: opts.slug,
+      name: opts.name,
+      description: opts.description ?? null
+    });
+    if (!res.ok || !res.data) fail2(res.error?.message || "create failed");
+    emit(res.data, opts.json === true, () => printProject(res.data, "Project created"));
+  });
+  project.command("show <projectId>").description("Show a project (with member count)").option("--json", "Output JSON").action(async (projectId, opts) => {
+    const client = getIMClient2();
+    const res = await client.projects.get(projectId);
+    if (!res.ok || !res.data) fail2(res.error?.message || "show failed");
+    emit(res.data, opts.json === true, () => printProject(res.data));
+  });
+  project.command("update <projectId>").description("Update project name / description / status").option("--name <name>", "New display name").option("--description <text>", "New description (empty string to clear)").option("--archive", "Set status=archived").option("--unarchive", "Set status=active").option("--json", "Output JSON").action(async (projectId, opts) => {
+    if (opts.archive && opts.unarchive) fail2("--archive and --unarchive are mutually exclusive");
+    const patch = {};
+    if (opts.name !== void 0) patch.name = opts.name;
+    if (opts.description !== void 0) patch.description = opts.description === "" ? null : opts.description;
+    if (opts.archive) patch.status = "archived";
+    if (opts.unarchive) patch.status = "active";
+    if (Object.keys(patch).length === 0) fail2("Nothing to update \u2014 pass --name / --description / --archive / --unarchive");
     const client = getIMClient2();
-    try {
-      const res = await client.im.workspace.addAgent(workspaceId, agentId);
-      if (!res.ok) {
-        process.stderr.write(`Error: ${res.error?.message || JSON.stringify(res.error)}
+    const res = await client.projects.update(projectId, patch);
+    if (!res.ok || !res.data) fail2(res.error?.message || "update failed");
+    emit(res.data, opts.json === true, () => printProject(res.data, "Project updated"));
+  });
+  project.command("delete <projectId>").description("Soft-delete a project (default cascade=archive). cascade=hard is reserved for v2.0.8+.").option("--cascade <mode>", "archive | null | hard", "archive").option("--json", "Output JSON").action(async (projectId, opts) => {
+    const cascade = opts.cascade ?? "archive";
+    if (cascade !== "archive" && cascade !== "null" && cascade !== "hard") {
+      fail2("--cascade must be archive|null|hard");
+    }
+    const client = getIMClient2();
+    const res = await client.projects.delete(projectId, { cascade });
+    if (!res.ok) fail2(res.error?.message || "delete failed");
+    emit(res.data, opts.json === true, () => {
+      if (res.data) {
+        printProject(res.data, "Project archived");
+      } else {
+        process.stdout.write(`Project ${projectId} archived.
 `);
-        process.exit(1);
-      }
-      if (opts.json) {
-        process.stdout.write(JSON.stringify(res.data, null, 2) + "\n");
-        return;
       }
-      process.stdout.write(`Agent ${agentId} added to workspace ${workspaceId}.
-`);
-    } catch (err) {
-      process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
+    });
+  });
+  const members = project.command("members").description("Manage project memberships");
+  members.command("list <projectId>").description("List members of a project").option("--json", "Output JSON").action(async (projectId, opts) => {
+    const client = getIMClient2();
+    const res = await client.projects.members.list(projectId);
+    if (!res.ok || !res.data) fail2(res.error?.message || "list members failed");
+    emit(res.data, opts.json === true, () => printMemberList2(res.data));
+  });
+  members.command("add <projectId>").description("Add a user or agent to the project").requiredOption("--principal <p>", "Principal in `user:<id>` or `agent:<id>` form").option("--role <role>", "owner | contributor | observer (default contributor)").option("--json", "Output JSON").action(async (projectId, opts) => {
+    const { kind, id } = parsePrincipal(opts.principal);
+    const role = parseRole(opts.role);
+    const client = getIMClient2();
+    const res = await client.projects.members.add(projectId, { principalKind: kind, principalId: id, role });
+    if (!res.ok || !res.data) fail2(res.error?.message || "add member failed");
+    emit(res.data, opts.json === true, () => {
+      const m = res.data;
+      process.stdout.write(`Member added: ${m.principalKind}:${m.principalId} \u2192 ${m.role} (${m.id})
 `);
-      process.exit(1);
-    }
+    });
   });
-  workspace.command("agents <workspace-id>").description("List agents in a workspace").option("--json", "Output raw JSON response").action(async (workspaceId, opts) => {
+  members.command("update <projectId> <membershipId>").description("Change a member role").requiredOption("--role <role>", "owner | contributor | observer").option("--json", "Output JSON").action(async (projectId, membershipId, opts) => {
+    const role = parseRole(opts.role);
+    if (!role) fail2("--role is required");
     const client = getIMClient2();
-    try {
-      const res = await client.im.workspace.listAgents(workspaceId);
-      if (!res.ok) {
-        process.stderr.write(`Error: ${res.error?.message || JSON.stringify(res.error)}
+    const res = await client.projects.members.update(projectId, membershipId, { role });
+    if (!res.ok || !res.data) fail2(res.error?.message || "update member failed");
+    emit(res.data, opts.json === true, () => {
+      const m = res.data;
+      process.stdout.write(`Member ${m.id} role \u2192 ${m.role}
 `);
-        process.exit(1);
-      }
-      const agents = res.data || [];
-      if (opts.json) {
-        process.stdout.write(JSON.stringify(agents, null, 2) + "\n");
-        return;
-      }
-      if (agents.length === 0) {
-        process.stdout.write("No agents in this workspace.\n");
-        return;
-      }
-      process.stdout.write("Agent ID".padEnd(36) + "Type".padEnd(14) + "Name\n");
-      for (const a of agents) {
-        process.stdout.write(
-          `${(a.agentId || a.id || "").padEnd(36)}${(a.agentType || "").padEnd(14)}${a.name || a.displayName || ""}
-`
-        );
-      }
-    } catch (err) {
-      process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
+    });
+  });
+  members.command("remove <projectId> <membershipId>").description("Remove a member from the project").option("--json", "Output JSON").action(async (projectId, membershipId, opts) => {
+    const client = getIMClient2();
+    const res = await client.projects.members.remove(projectId, membershipId);
+    if (!res.ok) fail2(res.error?.message || "remove member failed");
+    emit({ ok: true }, opts.json === true, () => {
+      process.stdout.write(`Membership ${membershipId} removed.
 `);
-      process.exit(1);
-    }
+    });
   });
 }
 
 // src/commands/security.ts
-function register9(parent, getIMClient2, _getAPIClient) {
+function register13(parent, getIMClient2, _getAPIClient) {
   const security = parent.command("security").description("Per-conversation encryption and key management");
   security.command("get <conversation-id>").description("Get security settings for a conversation").option("--json", "Output raw JSON response").action(async (convId, opts) => {
     const client = getIMClient2();
@@ -7269,7 +9042,7 @@ function register9(parent, getIMClient2, _getAPIClient) {
 }
 
 // src/commands/community.ts
-var import_node_fs = require("fs");
+var import_node_fs2 = require("fs");
 function printJson(res, opts) {
   if (opts.json) {
     console.log(JSON.stringify(res, null, 2));
@@ -7296,7 +9069,7 @@ _Next cursor:_ \`${d.nextCursor}\`
 `;
   return t;
 }
-function register10(parent, getIMClient2, _getAPIClient) {
+function register14(parent, getIMClient2, _getAPIClient) {
   const comm = parent.command("community").description("Evolution community forum \u2014 feed, ask, search, notify");
   comm.command("feed").description("Browse posts (uses hub cache when fresh)").option("-b, --board <id>", "Board: showcase, genelab, helpdesk, ideas, changelog").option("-n, --limit <n>", "Max posts", "15").option("--json", "JSON output").action(async (opts) => {
     const c = getIMClient2();
@@ -7315,7 +9088,7 @@ function register10(parent, getIMClient2, _getAPIClient) {
     process.stdout.write(formatPostsMarkdown(res.data));
   });
   comm.command("ask").description("Post a helpdesk question").argument("<title>", "Title").argument("[body]", "Body (Markdown); omit if using --file").option("-f, --file <path>", "Read body from file").option("--tags <csv>", "Comma-separated tags").option("--json", "JSON output").action(async (title, body, opts) => {
-    const content = opts.file ? (0, import_node_fs.readFileSync)(opts.file, "utf8") : body || "(no body)";
+    const content = opts.file ? (0, import_node_fs2.readFileSync)(opts.file, "utf8") : body || "(no body)";
     const tags = opts.tags?.split(",").map((s) => s.trim()).filter(Boolean);
     const c = getIMClient2();
     const res = await c.im.community.ask(title, content, tags);
@@ -7397,8 +9170,8 @@ function register10(parent, getIMClient2, _getAPIClient) {
 }
 
 // src/commands/asset.ts
-var fs2 = __toESM(require("fs"));
-var path2 = __toESM(require("path"));
+var fs5 = __toESM(require("fs"));
+var path3 = __toESM(require("path"));
 function resolveWorkspaceId(flag) {
   if (flag) return flag;
   if (typeof process !== "undefined" && process.env?.PRISMER_WORKSPACE_ID) {
@@ -7432,7 +9205,7 @@ function formatBytes(n) {
   if (n == null) return "-";
   return String(n);
 }
-function register11(parent, getIMClient2, _getAPIClient) {
+function register15(parent, getIMClient2, _getAPIClient) {
   const asset = parent.command("asset").description("Inspect and manage workspace assets (content-addressed)");
   asset.command("list").description("List assets in a workspace").option("--workspace-id <id>", "workspace id (defaults to PRISMER_WORKSPACE_ID env)").option("--filename <glob>", 'filter by filename glob (client-side, e.g. "design-doc*")').option("--mime <type>", 'filter by MIME type prefix (e.g. "application/pdf")').option("--kind <kind>", "filter by row-level kind (e.g. file, image, sandbox-output)").option("--updated-after <iso>", "filter to assets created/updated after this ISO timestamp").option("--task-id <id>", "filter by source task id").option("-n, --limit <n>", "maximum results to return", "50").option("--json", "output raw JSON response").action(async (opts) => {
     const wsId = requireWorkspaceId(opts.workspaceId);
@@ -7592,7 +9365,7 @@ ${rows.length} asset(s) listed.
   });
   asset.command("upload <path>").description("Upload a local file as a workspace asset").option("--workspace-id <id>", "workspace id (defaults to PRISMER_WORKSPACE_ID env)").option("--conversation-id <id>", "pin upload to a conversation (stored in metadata)").option("--kind <kind>", "asset kind label", "user-upload").option("--task-id <id>", "source task id").option("--mime <type>", "override detected MIME type").option("--filename <name>", "override filename").option("--json", "output raw JSON response").action(async (filePath, opts) => {
     const wsId = requireWorkspaceId(opts.workspaceId);
-    if (!fs2.existsSync(filePath)) {
+    if (!fs5.existsSync(filePath)) {
       process.stderr.write(`Error: file not found: ${filePath}
 `);
       process.exit(1);
@@ -7622,7 +9395,7 @@ ${rows.length} asset(s) listed.
         process.exit(1);
       }
       const a = res.data;
-      process.stdout.write(`Uploaded ${path2.basename(filePath)}
+      process.stdout.write(`Uploaded ${path3.basename(filePath)}
 `);
       process.stdout.write(`  ID:    ${a.id}
 `);
@@ -7649,7 +9422,7 @@ ${rows.length} asset(s) listed.
         opts.length
       );
       if (opts.out) {
-        fs2.writeFileSync(opts.out, bytes);
+        fs5.writeFileSync(opts.out, bytes);
         const range = describeRange(opts.offset, opts.length, bytes.byteLength);
         process.stderr.write(
           `Downloaded ${assetId} -> ${opts.out} (${bytes.byteLength} bytes${range ? `, ${range}` : ""}${truncated ? ", truncated" : ""}${totalSize != null ? `, total=${totalSize}` : ""})
@@ -7797,7 +9570,7 @@ function resolveWorkspaceId2(flag) {
   }
   return void 0;
 }
-function register12(parent, getIMClient2, _getAPIClient) {
+function register16(parent, getIMClient2, _getAPIClient) {
   const approval = parent.command("approval").description("Submit and manage human approval requests");
   approval.command("request-human").description("Submit a human approval request and stop the current turn").requiredOption("--action <text>", "one-sentence summary of the gated action").requiredOption("--context <text>", "multi-sentence framing for the human").requiredOption("--risk <text>", "what breaks if approved wrongly; what is reversible").option("--options <opt...>", "explicit choice values (defaults to approve/reject if omitted)").option("--task-id <id>", "task to resume when the human decides").option("--conversation-id <id>", "conversation context for the request").option("--workspace-id <id>", "workspace id (defaults to PRISMER_WORKSPACE_ID env)").option("--category <category>", "approval category label", "human-approval").option("--expires-in <seconds>", "expiration window in seconds (default 24h)", parseIntOpt2).option("--json", "output raw JSON response").action(async (opts) => {
     if (!opts.conversationId && !opts.taskId) {
@@ -7875,7 +9648,69 @@ function parseIntOpt2(value) {
 }
 
 // src/commands/agent.ts
-function register13(parent, getIMClient2, _getAPIClient) {
+var import_node_crypto2 = require("crypto");
+var import_node_fs3 = require("fs");
+var import_node_os = require("os");
+var import_node_path3 = require("path");
+var import_node_child_process = require("child_process");
+function resolvePrismerRoot() {
+  return process.env.PRISMER_HOME ? (0, import_node_path3.resolve)(process.env.PRISMER_HOME) : (0, import_node_path3.join)((0, import_node_os.homedir)(), ".prismer");
+}
+function readDaemonConfig() {
+  const path6 = (0, import_node_path3.join)(resolvePrismerRoot(), "config.toml");
+  if (!(0, import_node_fs3.existsSync)(path6)) {
+    throw new Error(`${path6} not found. Run \`prismer setup\` first.`);
+  }
+  const raw = (0, import_node_fs3.readFileSync)(path6, "utf8");
+  const idMatch = raw.match(/^daemon_id\s*=\s*"([^"]+)"/m);
+  const keyMatch = raw.match(/^api_key\s*=\s*"([^"]+)"/m);
+  if (!idMatch || !keyMatch) {
+    throw new Error(`config.toml missing daemon_id or api_key (${path6})`);
+  }
+  return { daemonId: idMatch[1], apiKey: keyMatch[1] };
+}
+function resolveAgentDir(daemonId, agentId) {
+  return (0, import_node_path3.join)(resolvePrismerRoot(), "devices", daemonId, "agents", agentId);
+}
+function collectFiles(root, excludeBasenames) {
+  const out = [];
+  function walk2(dir) {
+    let entries;
+    try {
+      entries = (0, import_node_fs3.readdirSync)(dir);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      if (excludeBasenames.has(name)) continue;
+      const full = (0, import_node_path3.join)(dir, name);
+      let st;
+      try {
+        st = (0, import_node_fs3.statSync)(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) walk2(full);
+      else if (st.isFile()) {
+        const buf = (0, import_node_fs3.readFileSync)(full);
+        const sha = (0, import_node_crypto2.createHash)("sha256").update(buf).digest("hex");
+        out.push({
+          rel: (0, import_node_path3.relative)(root, full).split(import_node_path3.sep).join("/"),
+          sha,
+          size: buf.byteLength
+        });
+      }
+    }
+  }
+  walk2(root);
+  out.sort((a, b) => a.rel.localeCompare(b.rel));
+  return out;
+}
+function computeMerkle(files) {
+  const lines = files.map((f) => `${f.rel}:${f.sha}`).join("\n");
+  return (0, import_node_crypto2.createHash)("sha256").update(lines).digest("hex");
+}
+function register17(parent, getIMClient2, _getAPIClient) {
   const agent = parent.command("agent").description("Manage agent specs, snapshots, publish, and fork");
   agent.command("spec <agent-id>").description("Read an AgentSpec 4-tuple").option("--workspace-id <id>", "Workspace scope").option("--json", "Output raw JSON response").action(async (agentId, opts) => {
     const res = await getIMClient2().im.agents.spec(agentId, opts.workspaceId);
@@ -7954,6 +9789,244 @@ function register13(parent, getIMClient2, _getAPIClient) {
       }
     });
   });
+  agent.command("export <agent-id>").description("release201/09 \xA79.7 \u2014 quiesce + tar an agent directory for transfer").requiredOption("--output <file>", "Output tar.gz path").option("--force", "Skip cloud pause (use when source device is offline)").option("--json", "Output raw JSON result").action(async (agentId, opts) => {
+    const { daemonId, apiKey } = readDaemonConfig();
+    const agentDir = resolveAgentDir(daemonId, agentId);
+    if (!(0, import_node_fs3.existsSync)(agentDir)) {
+      process.stderr.write(`Error: agent dir not found at ${agentDir}
+`);
+      process.exit(1);
+    }
+    if (!opts.force) {
+      const res = await getIMClient2().im.agents.pause(agentId);
+      if (!res.ok) {
+        process.stderr.write(
+          `Error: pause failed (${res.error?.message ?? "unknown"}); pass --force to export anyway
+`
+        );
+        process.exit(1);
+      }
+    }
+    const excludeBasenames = /* @__PURE__ */ new Set(["transfer-manifest.json"]);
+    const files = collectFiles(agentDir, excludeBasenames);
+    const sha256 = computeMerkle(files);
+    const signature = (0, import_node_crypto2.createHmac)("sha256", apiKey).update(sha256).digest("hex");
+    const manifest = {
+      version: 1,
+      agentId,
+      fromDaemonId: daemonId,
+      exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      includes: ["profile.json", "skills/**", "memory/**", "outbox/*"],
+      excludes: ["cache/ (daemon-level blob pool)", "local.db (daemon-level)"],
+      sha256,
+      signature
+    };
+    (0, import_node_fs3.writeFileSync)((0, import_node_path3.join)(agentDir, "transfer-manifest.json"), JSON.stringify(manifest, null, 2) + "\n", "utf8");
+    const parentOfAgents = (0, import_node_path3.join)(resolvePrismerRoot(), "devices", daemonId);
+    const outputAbs = (0, import_node_path3.resolve)(opts.output);
+    try {
+      (0, import_node_child_process.execFileSync)("tar", ["-czf", outputAbs, "-C", parentOfAgents, (0, import_node_path3.join)("agents", agentId)], { stdio: "inherit" });
+    } catch (err) {
+      process.stderr.write(`Error: tar failed: ${err.message}
+`);
+      process.exit(1);
+    }
+    const result = {
+      agentId,
+      fromDaemonId: daemonId,
+      output: outputAbs,
+      manifestSha256: sha256,
+      filesIncluded: files.length,
+      totalBytes: files.reduce((s, f) => s + f.size, 0),
+      paused: !opts.force
+    };
+    if (opts.json) {
+      process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    } else {
+      console.log(`Exported agent ${agentId}`);
+      console.log(`  output:        ${result.output}`);
+      console.log(`  files:         ${result.filesIncluded}`);
+      console.log(`  total bytes:   ${result.totalBytes}`);
+      console.log(`  manifestSha:   ${result.manifestSha256.slice(0, 16)}\u2026`);
+      console.log(`  cloud paused:  ${result.paused ? "yes" : "no (--force)"}`);
+      console.log("");
+      console.log("Next: copy the tar.gz to the target device and run:");
+      console.log(`  prismer agent import ${result.output}`);
+    }
+  });
+  agent.command("import <tar-file>").description("release201/09 \xA79.7 \u2014 extract + rebind an agent transferred from another device").option("--json", "Output raw JSON result").action(async (tarFile, opts) => {
+    const tarAbs = (0, import_node_path3.resolve)(tarFile);
+    if (!(0, import_node_fs3.existsSync)(tarAbs)) {
+      process.stderr.write(`Error: tar file not found: ${tarAbs}
+`);
+      process.exit(1);
+    }
+    const { daemonId: toDaemonId, apiKey } = readDaemonConfig();
+    const tmpRoot = (0, import_node_path3.join)(resolvePrismerRoot(), ".transfer-staging", `${Date.now()}`);
+    (0, import_node_fs3.mkdirSync)(tmpRoot, { recursive: true });
+    try {
+      (0, import_node_child_process.execFileSync)("tar", ["-xzf", tarAbs, "-C", tmpRoot], { stdio: "inherit" });
+    } catch (err) {
+      (0, import_node_fs3.rmSync)(tmpRoot, { recursive: true, force: true });
+      process.stderr.write(`Error: tar extract failed: ${err.message}
+`);
+      process.exit(1);
+    }
+    const agentsRoot = (0, import_node_path3.join)(tmpRoot, "agents");
+    if (!(0, import_node_fs3.existsSync)(agentsRoot)) {
+      (0, import_node_fs3.rmSync)(tmpRoot, { recursive: true, force: true });
+      process.stderr.write("Error: tar layout invalid \u2014 no agents/ root inside archive\n");
+      process.exit(1);
+    }
+    const entries = (0, import_node_fs3.readdirSync)(agentsRoot);
+    if (entries.length !== 1) {
+      (0, import_node_fs3.rmSync)(tmpRoot, { recursive: true, force: true });
+      process.stderr.write(`Error: expected exactly 1 agent in archive, got ${entries.length}
+`);
+      process.exit(1);
+    }
+    const agentId = entries[0];
+    const stagedAgentDir = (0, import_node_path3.join)(agentsRoot, agentId);
+    const manifestPath = (0, import_node_path3.join)(stagedAgentDir, "transfer-manifest.json");
+    if (!(0, import_node_fs3.existsSync)(manifestPath)) {
+      (0, import_node_fs3.rmSync)(tmpRoot, { recursive: true, force: true });
+      process.stderr.write("Error: transfer-manifest.json missing from archive\n");
+      process.exit(1);
+    }
+    let manifest;
+    try {
+      manifest = JSON.parse((0, import_node_fs3.readFileSync)(manifestPath, "utf8"));
+    } catch (err) {
+      (0, import_node_fs3.rmSync)(tmpRoot, { recursive: true, force: true });
+      process.stderr.write(`Error: manifest parse failed: ${err.message}
+`);
+      process.exit(1);
+    }
+    const expectedSig = (0, import_node_crypto2.createHmac)("sha256", apiKey).update(manifest.sha256).digest("hex");
+    if (expectedSig !== manifest.signature) {
+      (0, import_node_fs3.rmSync)(tmpRoot, { recursive: true, force: true });
+      process.stderr.write(
+        "Error: manifest signature verification failed \u2014 refusing to import (different workspace, or tampered archive)\n"
+      );
+      process.exit(1);
+    }
+    if (manifest.agentId !== agentId) {
+      (0, import_node_fs3.rmSync)(tmpRoot, { recursive: true, force: true });
+      process.stderr.write(
+        `Error: manifest agentId (${manifest.agentId}) != extracted dir name (${agentId})
+`
+      );
+      process.exit(1);
+    }
+    if (manifest.fromDaemonId === toDaemonId) {
+      (0, import_node_fs3.rmSync)(tmpRoot, { recursive: true, force: true });
+      process.stderr.write(
+        `Error: fromDaemonId == toDaemonId (${toDaemonId}); nothing to transfer.
+`
+      );
+      process.exit(1);
+    }
+    const targetAgentDir = resolveAgentDir(toDaemonId, agentId);
+    if ((0, import_node_fs3.existsSync)(targetAgentDir)) {
+      (0, import_node_fs3.rmSync)(tmpRoot, { recursive: true, force: true });
+      process.stderr.write(
+        `Error: target dir already exists at ${targetAgentDir}. Run \`prismer agent remove ${agentId}\` (TODO) or move it aside first.
+`
+      );
+      process.exit(1);
+    }
+    (0, import_node_fs3.mkdirSync)((0, import_node_path3.join)(resolvePrismerRoot(), "devices", toDaemonId, "agents"), { recursive: true });
+    try {
+      (0, import_node_child_process.execFileSync)("mv", [stagedAgentDir, targetAgentDir]);
+    } catch {
+      try {
+        (0, import_node_child_process.execFileSync)("cp", ["-R", stagedAgentDir, targetAgentDir]);
+        (0, import_node_fs3.rmSync)(stagedAgentDir, { recursive: true, force: true });
+      } catch (err) {
+        (0, import_node_fs3.rmSync)(tmpRoot, { recursive: true, force: true });
+        process.stderr.write(`Error: failed to install agent dir: ${err.message}
+`);
+        process.exit(1);
+      }
+    }
+    (0, import_node_fs3.rmSync)(tmpRoot, { recursive: true, force: true });
+    const rebind = await getIMClient2().im.agents.transfer({
+      agentId,
+      fromDaemonId: manifest.fromDaemonId,
+      toDaemonId,
+      manifestSha256: manifest.sha256
+    });
+    if (!rebind.ok || !rebind.data) {
+      process.stderr.write(
+        `Warning: cloud rebind failed (${rebind.error?.message ?? "unknown"}). Agent files are on disk at ${targetAgentDir} but cloud still routes to ${manifest.fromDaemonId}.
+        Manual fix: POST /api/im/agent-bindings/transfer or rebind via the Devices UI.
+`
+      );
+      process.exit(2);
+    }
+    await getIMClient2().im.agents.resume(agentId);
+    const result = {
+      agentId,
+      fromDaemonId: manifest.fromDaemonId,
+      toDaemonId,
+      targetDir: targetAgentDir,
+      manifestSha256: manifest.sha256,
+      boundDaemonId: rebind.data.boundDaemonId,
+      boundBy: rebind.data.boundBy
+    };
+    if (opts.json) {
+      process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    } else {
+      console.log(`Imported agent ${agentId}`);
+      console.log(`  from device:  ${result.fromDaemonId}`);
+      console.log(`  to device:    ${result.toDaemonId}`);
+      console.log(`  target dir:   ${result.targetDir}`);
+      console.log(`  cloud bound:  ${result.boundDaemonId} (${result.boundBy})`);
+    }
+  });
+  agent.command("cleanup-orphan").description("release201/09 \xA79.7.3 \u2014 list devices/*/agents/* dirs whose cloud binding points elsewhere").option("--delete", "Actually remove orphan dirs (default: dry-run)").option("--json", "Output raw JSON list").action(async (opts) => {
+    const { daemonId } = readDaemonConfig();
+    const devicesRoot = (0, import_node_path3.join)(resolvePrismerRoot(), "devices");
+    if (!(0, import_node_fs3.existsSync)(devicesRoot)) {
+      if (opts.json) process.stdout.write("[]\n");
+      else console.log("No devices/ dir yet.");
+      return;
+    }
+    const orphans = [];
+    for (const did of (0, import_node_fs3.readdirSync)(devicesRoot)) {
+      if (did === daemonId) continue;
+      const agentsRoot = (0, import_node_path3.join)(devicesRoot, did, "agents");
+      if (!(0, import_node_fs3.existsSync)(agentsRoot)) continue;
+      for (const aid of (0, import_node_fs3.readdirSync)(agentsRoot)) {
+        const dir = (0, import_node_path3.join)(agentsRoot, aid);
+        try {
+          const st = (0, import_node_fs3.statSync)(dir);
+          if (!st.isDirectory()) continue;
+          const files = collectFiles(dir, /* @__PURE__ */ new Set());
+          const sizeBytes = files.reduce((s, f) => s + f.size, 0);
+          orphans.push({ daemonId: did, agentId: aid, dir, sizeBytes });
+        } catch {
+        }
+      }
+    }
+    if (opts.delete) {
+      for (const o of orphans) {
+        (0, import_node_fs3.rmSync)(o.dir, { recursive: true, force: true });
+      }
+    }
+    if (opts.json) {
+      process.stdout.write(JSON.stringify({ orphans, deleted: Boolean(opts.delete) }, null, 2) + "\n");
+    } else {
+      if (orphans.length === 0) {
+        console.log("No orphan agent dirs.");
+      } else {
+        console.log(`Found ${orphans.length} orphan agent dir(s)${opts.delete ? " (DELETED)" : " (dry-run; pass --delete to remove)"}:`);
+        for (const o of orphans) {
+          console.log(`  ${o.daemonId}/${o.agentId}  ${o.sizeBytes} bytes  ${o.dir}`);
+        }
+      }
+    }
+  });
   agent.command("fork <pack-id-or-slug>").description("Fork an Agent Pack into a workspace").requiredOption("--workspace-id <id>", "Target workspace id").option("--display-name <name>", "New agent display name").option("--json", "Output raw JSON response").action(async (packId, opts) => {
     const res = await getIMClient2().im.agents.forkPack(packId, {
       targetWorkspaceId: opts.workspaceId,
@@ -7979,32 +10052,168 @@ function printOrExit(res, json, print) {
   print(res.data);
 }
 
+// src/commands/metric.ts
+var AGG_FUNCS = ["sum", "count", "avg", "min", "max", "p50", "p95", "p99"];
+var BUCKETS = ["5m", "1h", "1d"];
+function splitFqName(fqName) {
+  const i = fqName.lastIndexOf(".");
+  if (i <= 0 || i === fqName.length - 1) {
+    throw new Error(`metric name must be in form "namespace.name" (got "${fqName}")`);
+  }
+  return { namespace: fqName.slice(0, i), name: fqName.slice(i + 1) };
+}
+function parseDimFlags(dimArr) {
+  const dims = {};
+  for (const raw of dimArr ?? []) {
+    const i = raw.indexOf("=");
+    if (i <= 0) throw new Error(`--dim "${raw}" must be in form key=value`);
+    const key = raw.slice(0, i);
+    const value = raw.slice(i + 1);
+    if (/^-?\d+(?:\.\d+)?$/.test(value)) dims[key] = Number(value);
+    else if (value === "true" || value === "false") dims[key] = value === "true";
+    else dims[key] = value;
+  }
+  return dims;
+}
+async function runEmit(fqName, opts, getIMClient2) {
+  const client = getIMClient2();
+  const { namespace, name } = splitFqName(fqName);
+  const dims = parseDimFlags(opts.dim);
+  if (!dims.workspaceId) {
+    throw new Error("--dim workspaceId=<id> is required (server rejects emits without it)");
+  }
+  let value;
+  if (opts.value !== void 0) {
+    value = /^-?\d+(?:\.\d+)?$/.test(opts.value) ? Number(opts.value) : opts.value;
+  }
+  const input = {
+    namespace,
+    name,
+    ts: opts.ts,
+    value,
+    dims
+  };
+  const res = await client.im.metrics.emit(input);
+  if (opts.json) {
+    process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+    return;
+  }
+  if (!res.ok) {
+    process.stderr.write(`Error: ${res.error?.message ?? "unknown error"}
+`);
+    process.exit(1);
+  }
+  process.stdout.write(`emitted ${namespace}.${name}
+`);
+}
+async function runAgg(fqName, opts, getIMClient2) {
+  const client = getIMClient2();
+  const { namespace, name } = splitFqName(fqName);
+  if (!AGG_FUNCS.includes(opts.agg)) {
+    throw new Error(`--agg must be one of ${AGG_FUNCS.join("|")}`);
+  }
+  if (opts.bucket && !BUCKETS.includes(opts.bucket)) {
+    throw new Error(`--bucket must be one of ${BUCKETS.join("|")}`);
+  }
+  const filter = {};
+  for (const raw of (opts.filter ?? "").split(",").filter(Boolean)) {
+    const i = raw.indexOf(":");
+    if (i <= 0) throw new Error(`--filter "${raw}" must be in form key:value`);
+    filter[raw.slice(0, i)] = raw.slice(i + 1);
+  }
+  if (!filter.workspaceId) {
+    throw new Error("--filter must include workspaceId:<id> (cross-workspace queries are admin-only)");
+  }
+  const groupBy = opts.groupBy ? opts.groupBy.split(",").filter(Boolean) : void 0;
+  const res = await client.im.metrics.aggregate({
+    namespace,
+    name,
+    agg: opts.agg,
+    range: opts.range,
+    from: opts.from,
+    to: opts.to,
+    groupBy,
+    filter,
+    bucket: opts.bucket
+  });
+  if (opts.json) {
+    process.stdout.write(JSON.stringify(res, null, 2) + "\n");
+    return;
+  }
+  if (!res.ok) {
+    process.stderr.write(`Error: ${res.error?.message ?? "unknown error"}
+`);
+    process.exit(1);
+  }
+  const data = res.data;
+  if (!data) {
+    process.stdout.write("(no data)\n");
+    return;
+  }
+  process.stdout.write(
+    `${data.namespace}.${data.name} ${data.agg} [${data.range.from} \u2192 ${data.range.to}]
+`
+  );
+  for (const bucket of data.buckets) {
+    const tsLabel = bucket.ts ? `${bucket.ts}` : "(all)";
+    for (const g of bucket.groups) {
+      const keyLabel = Object.entries(g.groupKey).map(([k, v]) => `${k}=${v ?? "\u2205"}`).join(" ");
+      process.stdout.write(`  ${tsLabel}  ${keyLabel || "(no group)"}  \u2192  ${g.value ?? "\u2205"}
+`);
+    }
+  }
+}
+function register18(parent, getIMClient2, _getAPIClient) {
+  const metric = parent.command("metric").description("Emit metric events and query aggregations (release201/11)");
+  metric.command("emit <namespace.name>").description("Emit a single metric event").option("--value <value>", "metric value (number or string)").option("--dim <k=v>", "dimension (repeatable; workspaceId is required)", (val, prev = []) => {
+    prev.push(val);
+    return prev;
+  }).option("--ts <iso>", "business timestamp in ISO 8601 (defaults to now)").option("--json", "output raw JSON response").action(async (fqName, opts) => {
+    try {
+      await runEmit(fqName, opts, getIMClient2);
+    } catch (err) {
+      process.stderr.write(`Error: ${err.message}
+`);
+      process.exit(1);
+    }
+  });
+  metric.command("agg <namespace.name>").description("Aggregate metric events (release201/11 \xA75)").requiredOption("--agg <fn>", `one of ${AGG_FUNCS.join("|")}`).option("--range <Nh|Nd>", "lookback window (e.g. 24h, 7d)").option("--from <iso>", "window start (ISO, paired with --to)").option("--to <iso>", "window end (ISO, paired with --from)").option("--groupBy <k1,k2>", "csv of dim keys to group by").option("--filter <k1:v1,k2:v2>", "csv k:v filters (workspaceId is required)").option("--bucket <5m|1h|1d>", "timeseries bucket size").option("--json", "output raw JSON response").action(async (fqName, opts) => {
+    try {
+      await runAgg(fqName, opts, getIMClient2);
+    } catch (err) {
+      process.stderr.write(`Error: ${err.message}
+`);
+      process.exit(1);
+    }
+  });
+}
+
 // src/daemon.ts
-var fs3 = __toESM(require("fs"));
-var path3 = __toESM(require("path"));
+var fs6 = __toESM(require("fs"));
+var path4 = __toESM(require("path"));
 var import_path = require("path");
-var os = __toESM(require("os"));
+var os2 = __toESM(require("os"));
 var import_os = require("os");
 var http = __toESM(require("http"));
 var import_http = require("http");
 var import_child_process = require("child_process");
 var TOML = __toESM(require("@iarna/toml"));
-var CONFIG_DIR = path3.join(os.homedir(), ".prismer");
-var CONFIG_PATH = path3.join(CONFIG_DIR, "config.toml");
-var PID_PATH = path3.join(CONFIG_DIR, "daemon.pid");
-var PORT_PATH = path3.join(CONFIG_DIR, "daemon.port");
-var CACHE_DIR = path3.join(CONFIG_DIR, "cache");
-var EVOLUTION_CACHE_PATH = path3.join(CACHE_DIR, "evolution.json");
-var OUTBOX_PATH = path3.join(CACHE_DIR, "outbox.json");
+var CONFIG_DIR = path4.join(os2.homedir(), ".prismer");
+var CONFIG_PATH = path4.join(CONFIG_DIR, "config.toml");
+var PID_PATH = path4.join(CONFIG_DIR, "daemon.pid");
+var PORT_PATH = path4.join(CONFIG_DIR, "daemon.port");
+var CACHE_DIR = path4.join(CONFIG_DIR, "cache");
+var EVOLUTION_CACHE_PATH = path4.join(CACHE_DIR, "evolution.json");
+var OUTBOX_PATH = path4.join(CACHE_DIR, "outbox.json");
 var SYNC_INTERVAL_MS = 6e4;
 var FLUSH_INTERVAL_MS = 3e4;
 var API_TIMEOUT_MS = 1e4;
 var EVENTS_FILE = (0, import_path.join)(CACHE_DIR, "events.json");
 var MAX_EVENTS = 1e3;
 function loadConfig() {
-  if (!fs3.existsSync(CONFIG_PATH)) return null;
+  if (!fs6.existsSync(CONFIG_PATH)) return null;
   try {
-    const raw = fs3.readFileSync(CONFIG_PATH, "utf-8");
+    const raw = fs6.readFileSync(CONFIG_PATH, "utf-8");
     const parsed = TOML.parse(raw);
     const apiKey = parsed?.default?.api_key || "";
     const baseUrl = parsed?.default?.base_url || "https://prismer.cloud";
@@ -8015,13 +10224,13 @@ function loadConfig() {
   }
 }
 function ensureCacheDir() {
-  if (!fs3.existsSync(CACHE_DIR)) {
-    fs3.mkdirSync(CACHE_DIR, { recursive: true });
+  if (!fs6.existsSync(CACHE_DIR)) {
+    fs6.mkdirSync(CACHE_DIR, { recursive: true });
   }
 }
 function loadEvents() {
   try {
-    return JSON.parse(fs3.readFileSync(EVENTS_FILE, "utf-8"));
+    return JSON.parse(fs6.readFileSync(EVENTS_FILE, "utf-8"));
   } catch {
     return [];
   }
@@ -8030,7 +10239,7 @@ function appendEvent(event) {
   const events = loadEvents();
   events.push(event);
   if (events.length > MAX_EVENTS) events.splice(0, events.length - MAX_EVENTS);
-  fs3.writeFileSync(EVENTS_FILE, JSON.stringify(events), { encoding: "utf-8", mode: 384 });
+  fs6.writeFileSync(EVENTS_FILE, JSON.stringify(events), { encoding: "utf-8", mode: 384 });
 }
 function emitSyncEvent(genesCount) {
   if (genesCount > 0) {
@@ -8045,9 +10254,9 @@ function emitSyncEvent(genesCount) {
   }
 }
 function readPid() {
-  if (!fs3.existsSync(PID_PATH)) return null;
+  if (!fs6.existsSync(PID_PATH)) return null;
   try {
-    const raw = fs3.readFileSync(PID_PATH, "utf-8").trim();
+    const raw = fs6.readFileSync(PID_PATH, "utf-8").trim();
     const pid = parseInt(raw, 10);
     return isNaN(pid) ? null : pid;
   } catch {
@@ -8055,9 +10264,9 @@ function readPid() {
   }
 }
 function readPort() {
-  if (!fs3.existsSync(PORT_PATH)) return null;
+  if (!fs6.existsSync(PORT_PATH)) return null;
   try {
-    const raw = fs3.readFileSync(PORT_PATH, "utf-8").trim();
+    const raw = fs6.readFileSync(PORT_PATH, "utf-8").trim();
     const port = parseInt(raw, 10);
     return isNaN(port) ? null : port;
   } catch {
@@ -8074,28 +10283,28 @@ function isProcessRunning(pid) {
 }
 function writePid(pid) {
   ensureCacheDir();
-  if (!fs3.existsSync(CONFIG_DIR)) {
-    fs3.mkdirSync(CONFIG_DIR, { recursive: true });
+  if (!fs6.existsSync(CONFIG_DIR)) {
+    fs6.mkdirSync(CONFIG_DIR, { recursive: true });
   }
-  fs3.writeFileSync(PID_PATH, String(pid), { encoding: "utf-8", mode: 384 });
+  fs6.writeFileSync(PID_PATH, String(pid), { encoding: "utf-8", mode: 384 });
 }
 function writePort(port) {
-  if (!fs3.existsSync(CONFIG_DIR)) {
-    fs3.mkdirSync(CONFIG_DIR, { recursive: true });
+  if (!fs6.existsSync(CONFIG_DIR)) {
+    fs6.mkdirSync(CONFIG_DIR, { recursive: true });
   }
-  fs3.writeFileSync(PORT_PATH, String(port), { encoding: "utf-8", mode: 384 });
+  fs6.writeFileSync(PORT_PATH, String(port), { encoding: "utf-8", mode: 384 });
 }
 function cleanupPidFiles() {
   try {
-    if (fs3.existsSync(PID_PATH)) fs3.unlinkSync(PID_PATH);
+    if (fs6.existsSync(PID_PATH)) fs6.unlinkSync(PID_PATH);
   } catch {
   }
   try {
-    if (fs3.existsSync(PORT_PATH)) fs3.unlinkSync(PORT_PATH);
+    if (fs6.existsSync(PORT_PATH)) fs6.unlinkSync(PORT_PATH);
   } catch {
   }
 }
-async function fetchWithTimeout(url, options, timeoutMs = API_TIMEOUT_MS) {
+async function fetchWithTimeout2(url, options, timeoutMs = API_TIMEOUT_MS) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
@@ -8114,9 +10323,9 @@ async function runDaemonProcess() {
   let lastSync = 0;
   let syncCount = 0;
   let evolutionCursor = 0;
-  if (fs3.existsSync(EVOLUTION_CACHE_PATH)) {
+  if (fs6.existsSync(EVOLUTION_CACHE_PATH)) {
     try {
-      const cached = JSON.parse(fs3.readFileSync(EVOLUTION_CACHE_PATH, "utf-8"));
+      const cached = JSON.parse(fs6.readFileSync(EVOLUTION_CACHE_PATH, "utf-8"));
       if (typeof cached?.cursor === "number") evolutionCursor = cached.cursor;
     } catch {
     }
@@ -8124,9 +10333,9 @@ async function runDaemonProcess() {
   const server = (0, import_http.createServer)((req, res) => {
     if (req.method === "GET" && req.url === "/health") {
       let outboxSize = 0;
-      if (fs3.existsSync(OUTBOX_PATH)) {
+      if (fs6.existsSync(OUTBOX_PATH)) {
         try {
-          const entries = JSON.parse(fs3.readFileSync(OUTBOX_PATH, "utf-8"));
+          const entries = JSON.parse(fs6.readFileSync(OUTBOX_PATH, "utf-8"));
           if (Array.isArray(entries)) outboxSize = entries.length;
         } catch {
         }
@@ -8167,7 +10376,7 @@ async function runDaemonProcess() {
   process.on("SIGTERM", shutdown);
   const doEvolutionSync = async () => {
     try {
-      const res = await fetchWithTimeout(
+      const res = await fetchWithTimeout2(
         `${cfg.baseUrl}/api/im/evolution/sync`,
         {
           method: "POST",
@@ -8189,7 +10398,7 @@ async function runDaemonProcess() {
         }
         ensureCacheDir();
         const pulled = data?.data || data;
-        fs3.writeFileSync(
+        fs6.writeFileSync(
           EVOLUTION_CACHE_PATH,
           JSON.stringify({ cursor: evolutionCursor, lastSync, data: pulled }, null, 2),
           { encoding: "utf-8", mode: 384 }
@@ -8200,16 +10409,16 @@ async function runDaemonProcess() {
     }
   };
   const doOutboxFlush = async () => {
-    if (!fs3.existsSync(OUTBOX_PATH)) return;
+    if (!fs6.existsSync(OUTBOX_PATH)) return;
     let entries = [];
     try {
-      entries = JSON.parse(fs3.readFileSync(OUTBOX_PATH, "utf-8"));
+      entries = JSON.parse(fs6.readFileSync(OUTBOX_PATH, "utf-8"));
       if (!Array.isArray(entries) || entries.length === 0) return;
     } catch {
       return;
     }
     try {
-      const res = await fetchWithTimeout(
+      const res = await fetchWithTimeout2(
         `${cfg.baseUrl}/api/im/evolution/sync`,
         {
           method: "POST",
@@ -8224,7 +10433,7 @@ async function runDaemonProcess() {
         }
       );
       if (res.ok) {
-        fs3.writeFileSync(OUTBOX_PATH, "[]", { encoding: "utf-8", mode: 384 });
+        fs6.writeFileSync(OUTBOX_PATH, "[]", { encoding: "utf-8", mode: 384 });
       }
     } catch {
     }
@@ -8342,7 +10551,7 @@ function resolveNpxPath() {
   } catch {
     for (const p of ["/usr/local/bin/npx", "/opt/homebrew/bin/npx", `${(0, import_os.homedir)()}/.nvm/current/bin/npx`]) {
       try {
-        fs3.accessSync(p);
+        fs6.accessSync(p);
         return p;
       } catch {
       }
@@ -8384,8 +10593,8 @@ function installLaunchd() {
   <string>${(0, import_path.join)((0, import_os.homedir)(), ".prismer", "daemon.stderr.log")}</string>
 </dict>
 </plist>`;
-  fs3.mkdirSync((0, import_path.dirname)(plistPath), { recursive: true });
-  fs3.writeFileSync(plistPath, plist, { mode: 384 });
+  fs6.mkdirSync((0, import_path.dirname)(plistPath), { recursive: true });
+  fs6.writeFileSync(plistPath, plist, { mode: 384 });
   try {
     (0, import_child_process.execSync)(`launchctl load ${plistPath}`, { stdio: "pipe" });
     console.log("[prismer] Daemon service installed and started (launchd)");
@@ -8401,7 +10610,7 @@ function uninstallLaunchd() {
   } catch {
   }
   try {
-    fs3.unlinkSync(plistPath);
+    fs6.unlinkSync(plistPath);
   } catch {
   }
   console.log("[prismer] Daemon service uninstalled (launchd)");
@@ -8426,8 +10635,8 @@ RestartSec=10
 [Install]
 WantedBy=default.target
 `;
-  fs3.mkdirSync(serviceDir, { recursive: true });
-  fs3.writeFileSync(servicePath, unit, { mode: 420 });
+  fs6.mkdirSync(serviceDir, { recursive: true });
+  fs6.writeFileSync(servicePath, unit, { mode: 420 });
   try {
     (0, import_child_process.execSync)("systemctl --user daemon-reload", { stdio: "pipe" });
     (0, import_child_process.execSync)("systemctl --user enable prismer-daemon", { stdio: "pipe" });
@@ -8450,7 +10659,7 @@ function uninstallSystemd() {
   }
   const servicePath = (0, import_path.join)((0, import_os.homedir)(), ".config", "systemd", "user", "prismer-daemon.service");
   try {
-    fs3.unlinkSync(servicePath);
+    fs6.unlinkSync(servicePath);
   } catch {
   }
   try {
@@ -8490,21 +10699,21 @@ if (process.env["PRISMER_DAEMON"] === "1") {
 // src/cli.ts
 var cliVersion = "1.7.2";
 try {
-  const pkgPath = path4.join(__dirname, "..", "package.json");
-  const pkg = JSON.parse(fs4.readFileSync(pkgPath, "utf8"));
+  const pkgPath = path5.join(__dirname, "..", "package.json");
+  const pkg = JSON.parse(fs7.readFileSync(pkgPath, "utf8"));
   cliVersion = pkg.version || cliVersion;
 } catch {
 }
-var CONFIG_DIR2 = process.env.PRISMER_HOME ? path4.resolve(process.env.PRISMER_HOME) : path4.join(os2.homedir(), ".prismer");
-var CONFIG_PATH2 = path4.join(CONFIG_DIR2, "config.toml");
+var CONFIG_DIR2 = process.env.PRISMER_HOME ? path5.resolve(process.env.PRISMER_HOME) : path5.join(os3.homedir(), ".prismer");
+var CONFIG_PATH2 = path5.join(CONFIG_DIR2, "config.toml");
 function ensureConfigDir() {
-  if (!fs4.existsSync(CONFIG_DIR2)) {
-    fs4.mkdirSync(CONFIG_DIR2, { recursive: true });
+  if (!fs7.existsSync(CONFIG_DIR2)) {
+    fs7.mkdirSync(CONFIG_DIR2, { recursive: true });
   }
 }
 function readConfig() {
-  if (!fs4.existsSync(CONFIG_PATH2)) return {};
-  const raw = fs4.readFileSync(CONFIG_PATH2, "utf-8");
+  if (!fs7.existsSync(CONFIG_PATH2)) return {};
+  const raw = fs7.readFileSync(CONFIG_PATH2, "utf-8");
   const parsed = TOML2.parse(raw);
   const flatApiKey = parsed.api_key;
   const flatBaseUrl = parsed.cloud_api_base ?? parsed.base_url;
@@ -8522,7 +10731,7 @@ function readConfig() {
 }
 function writeConfig(config) {
   ensureConfigDir();
-  fs4.writeFileSync(CONFIG_PATH2, TOML2.stringify(config), { encoding: "utf-8", mode: 384 });
+  fs7.writeFileSync(CONFIG_PATH2, TOML2.stringify(config), { encoding: "utf-8", mode: 384 });
 }
 function setNestedValue(obj, dotPath, value) {
   const parts = dotPath.split(".");
@@ -8538,16 +10747,32 @@ function getIMClient() {
   const cfg = readConfig();
   const env = cfg?.default?.environment || "production";
   const baseUrl = cfg?.default?.base_url || "";
+  const agentUsername = process.env.PRISMER_AGENT_USERNAME;
+  const imAgentOpt = agentUsername ? { imAgent: agentUsername } : {};
+  const workspaceId = process.env.PRISMER_WORKSPACE_ID;
+  const imWorkspaceOpt = workspaceId ? { imWorkspace: workspaceId } : {};
   const imToken = cfg?.auth?.im_token;
   if (imToken) {
-    return new PrismerClient({ apiKey: imToken, environment: env, ...baseUrl ? { baseUrl } : {} });
+    return new PrismerClient({
+      apiKey: imToken,
+      environment: env,
+      ...baseUrl ? { baseUrl } : {},
+      ...imAgentOpt,
+      ...imWorkspaceOpt
+    });
   }
   const apiKey = cfg?.default?.api_key;
   if (!apiKey) {
     errorLine('No credentials. Run "cloud setup" first (or "cloud setup --agent" / "cloud register <username>" for IM-JWT path).');
     process.exit(1);
   }
-  return new PrismerClient({ apiKey, environment: env, ...baseUrl ? { baseUrl } : {} });
+  return new PrismerClient({
+    apiKey,
+    environment: env,
+    ...baseUrl ? { baseUrl } : {},
+    ...imAgentOpt,
+    ...imWorkspaceOpt
+  });
 }
 function getAPIClient() {
   const cfg = readConfig();
@@ -8558,7 +10783,11 @@ function getAPIClient() {
   }
   const env = cfg?.default?.environment || "production";
   const baseUrl = cfg?.default?.base_url || "";
-  return new PrismerClient({ apiKey, environment: env, ...baseUrl ? { baseUrl } : {} });
+  const agentUsername = process.env.PRISMER_AGENT_USERNAME;
+  const imAgentOpt = agentUsername ? { imAgent: agentUsername } : {};
+  const workspaceId = process.env.PRISMER_WORKSPACE_ID;
+  const imWorkspaceOpt = workspaceId ? { imWorkspace: workspaceId } : {};
+  return new PrismerClient({ apiKey, environment: env, ...baseUrl ? { baseUrl } : {}, ...imAgentOpt, ...imWorkspaceOpt });
 }
 var program = new import_commander.Command();
 program.name("cloud").description("Prismer Cloud SDK CLI").version(cliVersion);
@@ -8685,8 +10914,8 @@ async function runSetup(opts, apiKey) {
     return;
   }
   const http2 = require("http");
-  const crypto2 = require("crypto");
-  const state = crypto2.randomBytes(16).toString("hex");
+  const crypto3 = require("crypto");
+  const state = crypto3.randomBytes(16).toString("hex");
   let resolved = false;
   const server = http2.createServer((req, res) => {
     const url = new URL(req.url, `http://localhost`);
@@ -8855,11 +11084,11 @@ program.command("status").description("Show current config and live info").actio
 });
 var configCmd = program.command("config").description("Manage config file");
 configCmd.command("show").description("Print config file").action(() => {
-  if (!fs4.existsSync(CONFIG_PATH2)) {
+  if (!fs7.existsSync(CONFIG_PATH2)) {
     warn('No config file. Run "cloud setup" to create one.');
     return;
   }
-  console.log(fs4.readFileSync(CONFIG_PATH2, "utf-8"));
+  console.log(fs7.readFileSync(CONFIG_PATH2, "utf-8"));
 });
 configCmd.command("set <key> <value>").description("Set a config value (e.g. default.base_url)").action((key, value) => {
   const config = readConfig();
@@ -8904,6 +11133,11 @@ register10(program, getIMClient, getAPIClient);
 register11(program, getIMClient, getAPIClient);
 register12(program, getIMClient, getAPIClient);
 register13(program, getIMClient, getAPIClient);
+register14(program, getIMClient, getAPIClient);
+register15(program, getIMClient, getAPIClient);
+register16(program, getIMClient, getAPIClient);
+register17(program, getIMClient, getAPIClient);
+register18(program, getIMClient, getAPIClient);
 program.command("send").description("Send a direct message (shortcut for: im send)").argument("<user-id-or-username>", "Target user/agent IM user ID (or username with --by-username)").argument("<message>", "Message content").option("-t, --type <type>", "Message type: text, markdown, code, etc.", "text").option("--reply-to <id>", "Reply to a message ID").option("--conversation-id <id>", "Pin message to a specific conversation/session").option("--asset-id <id>", "Attach a previously uploaded asset (treats type as file)").option("--by-username", "Treat the first argument as a username; resolve to imUserId first").option("--json", "JSON output").action(async (target, message, opts) => {
   const client = getIMClient();
   let userId = target;
@@ -8952,6 +11186,70 @@ program.command("send").description("Send a direct message (shortcut for: im sen
   }
   success(`Message sent (conversation: ${res.data?.conversationId})`);
 });
+program.command("deliver <path>").description("Attach a file you wrote to your current reply (in-container explicit delivery)").option("--run-id <id>", "dispatch run/task id (from <execution_context>; env fallback PRISMER_TASK_ID/RUN_ID)").option("--conversation-id <id>", "conversation id (from <execution_context>; env fallback PRISMER_CONVERSATION_ID)").option("--daemon-port <port>", "daemon local-server port (env fallback PRISMER_DAEMON_PORT, default 3210)").option("--json", "JSON output").action(async (filePath, opts) => {
+  const proxy = detectDeliverProxy({
+    runId: opts.runId,
+    conversationId: opts.conversationId,
+    daemonPort: opts.daemonPort
+  });
+  if (!proxy) {
+    errorLine(
+      "cloud deliver only works inside a daemon dispatch (no PRISMER_TASK_ID/PRISMER_RUN_ID, and no --run-id flag). On hermes, pass --run-id <id> (and --conversation-id <id>) copied from <execution_context>. Outside a dispatch, use `cloud file send <conversationId> <path>`."
+    );
+    process.exit(1);
+  }
+  const result = await proxyDeliver(proxy, filePath, "attach");
+  if (!result.ok) {
+    errorLine(`Delivery failed: ${result.error ?? `daemon returned ${result.status}`}`);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  success(`Attached to your reply (assetId: ${result.assetId ?? "-"})`);
+});
+program.command("attach <messageId> <path>").description("Attach a file to a message you ALREADY sent (by its messageId)").option("--run-id <id>", "dispatch run/task id (from <execution_context>; env fallback PRISMER_TASK_ID/RUN_ID)").option("--conversation-id <id>", "conversation id of the target message (from <execution_context>; env fallback PRISMER_CONVERSATION_ID)").option("--daemon-port <port>", "daemon local-server port (env fallback PRISMER_DAEMON_PORT, default 3210)").option("--json", "JSON output").action(async (messageId, filePath, opts) => {
+  const proxy = detectDeliverProxy({
+    runId: opts.runId,
+    conversationId: opts.conversationId,
+    daemonPort: opts.daemonPort
+  });
+  if (!proxy) {
+    errorLine(
+      "cloud attach only works inside a daemon dispatch (no PRISMER_TASK_ID/PRISMER_RUN_ID, and no --run-id flag). On hermes, pass --run-id <id> and --conversation-id <id> copied from <execution_context>."
+    );
+    process.exit(1);
+  }
+  const conversationId = (opts.conversationId || proxy.conversationId || "").trim();
+  if (!conversationId) {
+    errorLine(
+      "cloud attach needs the conversation id of the target message. Set PRISMER_CONVERSATION_ID or pass --conversation-id <id> (copy it from <execution_context>)."
+    );
+    process.exit(1);
+  }
+  const result = await proxyDeliver(proxy, filePath, "message-attach", conversationId, messageId);
+  if (!result.ok) {
+    errorLine(`Attach failed: ${result.error ?? `daemon returned ${result.status}`}`);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  success(`Attached to message ${messageId} (assetId: ${result.assetId ?? "-"})`);
+});
+program.command("emit <namespace.name>").description("Emit a metric event (shortcut for: metric emit)").option("--value <value>", "metric value (number or string)").option("--dim <k=v>", "dimension (repeatable; workspaceId is required)", (val, prev = []) => {
+  prev.push(val);
+  return prev;
+}).option("--ts <iso>", "business timestamp in ISO 8601 (defaults to now)").option("--json", "output raw JSON response").action(async (fqName, opts) => {
+  try {
+    await runEmit(fqName, opts, getIMClient);
+  } catch (err) {
+    errorLine(`Error: ${err.message}`);
+    process.exit(1);
+  }
+});
 program.command("load").description("Load URL(s) \u2192 compressed HQCC (shortcut for: context load)").argument("<urls...>", "One or more URLs").option("-f, --format <fmt>", "Return format: hqcc, raw, both", "hqcc").option("--json", "JSON output").action(async (urls, opts) => {
   const client = getAPIClient();
   const input = urls.length === 1 ? urls[0] : urls;