@rigkit/cli 0.2.2 → 0.2.4

package/README.md

@@ -16,7 +16,7 @@ Interactive terminals use Inquirer prompts and a chalk/log-update run timeline.
 
 Interactive providers can ask the CLI to open provider-owned URLs. For example, Freestyle terminal sessions are served by the Freestyle provider, while the CLI only opens the presented URL in a browser.
 
-`rig ssh <workspace>` runs the workflow's uncached `workspace.onOpen` hook before attaching or printing the SSH command.
+Workspace-specific operations run as `rig <workspace>/<operation>`, for example `rig website-workspace/open-cmux` or `rig website-workspace/remove -y`.
 
 `rig ls` lists workspaces for the selected project. `rig ls snapshots` lists cached snapshot runs, and `rig ls config` shows the resolved project paths.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigkit/cli",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "type": "module",
   "repository": {
     "type": "git",
@@ -25,9 +25,9 @@
     "log-symbols": "^7.0.1",
     "log-update": "^8.0.0",
     "ora": "^9.4.0",
-    "@rigkit/runtime-client": "0.2.2",
-    "@rigkit/provider-cmux": "0.2.2",
-    "@rigkit/engine": "0.2.2"
+    "@rigkit/provider-cmux": "0.2.4",
+    "@rigkit/engine": "0.2.4",
+    "@rigkit/runtime-client": "0.2.4"
   },
   "devDependencies": {
     "@types/bun": "latest",

package/src/cli.test.ts

@@ -83,8 +83,8 @@ describe("CLI entrypoint", () => {
 
       expect(result.exitCode).toBe(0);
       expect(result.stderr).toBe("");
-      expect(result.stdout).toContain("name  resource  snapshot  workflow");
-      expect(result.stdout).toContain("api   vm-api    snap-api  smoke");
+      expect(result.stdout).toContain("name  workflow");
+      expect(result.stdout).toContain("api   smoke");
     });
   });
 
@@ -100,8 +100,7 @@ describe("CLI entrypoint", () => {
         workspaces: [{
           name: "api",
           workflow: "smoke",
-          resourceId: "vm-api",
-          snapshotId: "snap-api",
+          ctx: {},
         }],
       });
     });
@@ -210,14 +209,8 @@ async function withWorkspaceRuntime(
           workspaces: [{
             id: "workspace-api",
             name: "api",
-            providerId: "freestyle",
             workflow: "smoke",
-            resourceId: "vm-api",
-            snapshotId: "snap-api",
-            sourceRef: null,
-            context: {},
-            metadata: {},
-            data: {},
+            ctx: {},
             createdAt: now,
             updatedAt: now,
           }],

package/src/cli.ts

@@ -94,15 +94,8 @@ type EngineProjectInfo = {
 };
 
 type RuntimeOperationManifest = {
-  hostMethods?: {
-    known?: Array<{ id: string; modes?: string[] }>;
-    requiredByOperations?: Record<string, string[]>;
-  };
-  hostCapabilities?: {
-    optional?: Array<{ id: string; schemaHash?: string }>;
-    requiredByOperations?: Record<string, string[]>;
-  };
   operations: RuntimeOperationDefinition[];
+  workspaceOperations?: RuntimeOperationDefinition[];
 };
 
 type RuntimeOperationDefinition = {
@@ -111,8 +104,6 @@ type RuntimeOperationDefinition = {
   title?: string;
   description?: string;
   createsWorkspace?: boolean;
-  requiredHostMethods?: Array<{ id: string; modes?: string[] }>;
-  requiredHostCapabilities?: Array<{ id: string; schemaHash?: string }>;
   cli?: {
     positionals?: Array<{ name: string; index: number }>;
     options?: Array<{
@@ -414,29 +405,29 @@ async function runInit(invocation: CliInvocation, options: InitOptions): Promise
 async function resolveInitAnswers(
   options: InitOptions,
   jsonMode: boolean,
-): Promise<{ name: string; apiKey: string; packageManager: PackageManager }> {
-  if (jsonMode && (options.name === undefined || !options.apiKey?.trim())) {
-    throw new Error(`rig init --json requires --name and --api-key`);
+): Promise<{ name: string; apiKey?: string; packageManager: PackageManager }> {
+  if (jsonMode && options.name === undefined) {
+    throw new Error(`rig init --json requires --name`);
   }
 
   if (jsonMode && options.packageManager && options.packageManager !== "skip") {
     throw new Error(`rig init --json only supports --package-manager skip`);
   }
 
-  if (options.name === undefined || !options.apiKey) {
+  if (options.name === undefined) {
     assertInteractiveInit();
   }
 
   if (!jsonMode) {
     console.log(chalk.bold("Initialize Rigkit"));
-    console.log(chalk.dim("This creates a project folder with rig.config.ts, .env, package.json, and local ignore rules."));
+    console.log(chalk.dim("This creates a project folder with rig.config.ts, package.json, and local ignore rules."));
     console.log("");
   }
 
   const name = options.name !== undefined
     ? normalizeMachineName(options.name)
     : await promptName();
-  const apiKey = options.apiKey?.trim() || await promptRequiredSecret("Freestyle API key");
+  const apiKey = options.apiKey?.trim();
   const packageManager = options.packageManager ?? (jsonMode || !canPrompt() ? "skip" : await promptPackageManager("skip"));
 
   return {
@@ -448,7 +439,7 @@ async function resolveInitAnswers(
 
 function assertInteractiveInit(): void {
   if (canPrompt()) return;
-  throw new Error(`rig init needs --name and --api-key when not running in an interactive terminal`);
+  throw new Error(`rig init needs --name when not running in an interactive terminal`);
 }
 
 function canPrompt(): boolean {
@@ -487,14 +478,6 @@ async function promptName(): Promise<string> {
   return answers.name;
 }
 
-async function promptRequiredSecret(label: string): Promise<string> {
-  for (;;) {
-    const value = (await promptSecret(label)).trim();
-    if (value) return value;
-    console.log(chalk.red(`${label} is required.`));
-  }
-}
-
 async function promptPackageManager(defaultValue: PackageManager): Promise<PackageManager> {
   const choices: Array<{ value: PackageManager; label: string; hint: string }> = [
     { value: "npm", label: "npm", hint: "npm install" },
@@ -516,16 +499,6 @@ async function promptPackageManager(defaultValue: PackageManager): Promise<Packa
   return answers.packageManager;
 }
 
-async function promptSecret(label: string): Promise<string> {
-  const answers = await inquirer.prompt<{ value: string }>([{
-    type: "password",
-    name: "value",
-    message: `${label}:`,
-    mask: "*",
-  }]);
-  return answers.value;
-}
-
 async function runPackageManagerInstall(
   projectDir: string,
   packageManager: PackageManager,
@@ -801,18 +774,18 @@ async function executeRuntimeOperation(
   result: unknown;
 }> {
   const manifest = await readRuntimeOperations(runtime);
-  const operation = findRuntimeOperation(manifest.operations, requestedOperation);
-  if (!operation) {
+  const resolved = findRuntimeOperation(manifest, requestedOperation);
+  if (!resolved) {
     throw new Error(`This project does not define a Rigkit operation named "${requestedOperation}".`);
   }
+  const { operation, runOperation } = resolved;
 
-  preflightHostSupport(operation);
   const parsed = parseOperationArgs(operation, args);
   enforceHostOnlyBooleanGuards(operation, parsed);
 
   const result = await runRuntimeOperation<unknown>(
     runtime,
-    operation.id,
+    runOperation,
     parsed.input,
     { renderEvents: !wantsJson(invocation) },
   );
@@ -821,50 +794,28 @@ async function executeRuntimeOperation(
 }
 
 function findRuntimeOperation(
-  operations: RuntimeOperationDefinition[],
+  manifest: RuntimeOperationManifest,
   requestedOperation: string,
-): RuntimeOperationDefinition | undefined {
-  return operations.find((operation) =>
-    operation.id === requestedOperation || operation.aliases?.includes(requestedOperation)
-  );
-}
-
-function preflightHostSupport(operation: RuntimeOperationDefinition): void {
-  const unsupportedMethod = operation.requiredHostMethods?.find((method) => {
-    const supported = CLI_HOST_METHODS.find((item) => item.id === method.id);
-    return !supported || !supportsModes(supported.modes, method.modes);
-  });
-  if (unsupportedMethod) {
-    throw new Error(
-      `Operation "${operation.id}" requires host method "${formatMethodRequirement(unsupportedMethod)}". ` +
-        `Upgrade Rigkit or use a host that supports this method.`,
-    );
-  }
-
-  const unsupportedCapability = operation.requiredHostCapabilities?.find((capability) => {
-    const supported = CLI_HOST_CAPABILITIES.find((item) => item.id === capability.id);
-    return !supported || (capability.schemaHash && supported.schemaHash !== capability.schemaHash);
-  });
-  if (unsupportedCapability) {
-    throw new Error(
-      `Operation "${operation.id}" requires host capability "${formatCapabilityRequirement(unsupportedCapability)}". ` +
-        `Install or enable a local host capability handler to use it from this host.`,
-    );
+): { operation: RuntimeOperationDefinition; runOperation: string } | undefined {
+  const workspaceOperation = parseWorkspaceOperationId(requestedOperation);
+  if (workspaceOperation) {
+    const operation = (manifest.workspaceOperations ?? []).find((item) => item.id === workspaceOperation.operation);
+    return operation ? { operation, runOperation: requestedOperation } : undefined;
   }
-}
-
-function supportsModes(hostModes: string[] | undefined, requiredModes: string[] | undefined): boolean {
-  if (!requiredModes?.length) return true;
-  const supported = new Set(hostModes ?? []);
-  return requiredModes.every((mode) => supported.has(mode));
-}
 
-function formatMethodRequirement(method: { id: string; modes?: string[] }): string {
-  return method.modes?.length ? `${method.id}:${method.modes.join("|")}` : method.id;
+  const operation = manifest.operations.find((operation) =>
+    operation.id === requestedOperation || operation.aliases?.includes(requestedOperation)
+  );
+  return operation ? { operation, runOperation: operation.id } : undefined;
 }
 
-function formatCapabilityRequirement(capability: { id: string; schemaHash?: string }): string {
-  return capability.schemaHash ? `${capability.id}@${capability.schemaHash}` : capability.id;
+function parseWorkspaceOperationId(value: string): { workspace: string; operation: string } | undefined {
+  const slash = value.indexOf("/");
+  if (slash <= 0 || slash === value.length - 1) return undefined;
+  return {
+    workspace: value.slice(0, slash),
+    operation: value.slice(slash + 1),
+  };
 }
 
 function parseOperationArgs(operation: RuntimeOperationDefinition, args: string[]): ParsedOperationInput {
@@ -1016,12 +967,12 @@ async function renderOperationResult(
       console.log("No changes applied.");
       return;
     }
-    console.log(`resolved ${result.plan.workflow} -> ${String(result.snapshotId ?? "no workspace source")}`);
+    console.log(`resolved ${result.plan.workflow}`);
     return;
   }
 
   if (operation.createsWorkspace && isWorkspaceRecord(result)) {
-    console.log(`${result.name} ${result.resourceId}`);
+    console.log(result.name);
     return;
   }
 
@@ -1036,16 +987,8 @@ async function renderOperationResult(
     return;
   }
 
-  if (isRecord(result)) {
-    const metadata = isRecord(result.metadata) ? result.metadata : {};
-    if (typeof metadata.snapshotId === "string") {
-      console.log(metadata.snapshotId);
-      return;
-    }
-  }
-
   if (isWorkspaceRecord(result)) {
-    console.log(`${result.name} ${result.resourceId}`);
+    console.log(result.name);
     return;
   }
 
@@ -1253,10 +1196,12 @@ async function runRuntimeOperation<T>(
       return;
     }
     if (isHostCapabilityRequestEvent(event)) {
-      presenter?.pause();
+      const suspendPresenter = hostCapabilityNeedsTerminal(event);
+      const logger = createHostCapabilityLogger(event, presenter);
+      if (suspendPresenter) presenter?.pause();
       try {
         if (sendSession) {
-          await answerHostCapabilityRequestOverSession(sendSession, event);
+          await answerHostCapabilityRequestOverSession(sendSession, event, { logger });
         } else if (respond) {
           await answerHostCapabilityRequestOverSession((message) => {
             if (isRecord(message) && message.type === "response") {
@@ -1264,12 +1209,12 @@ async function runRuntimeOperation<T>(
               if (id) return respond(id, "error" in message ? { error: message.error } : { result: message.result });
             }
             throw new Error(`Session response channel cannot send ${String(isRecord(message) ? message.type : typeof message)}`);
-          }, event);
+          }, event, { logger });
         } else {
-          await answerHostCapabilityRequest(runtime, event);
+          await answerHostCapabilityRequest(runtime, event, { logger });
         }
       } finally {
-        presenter?.resume();
+        if (suspendPresenter) presenter?.resume();
       }
       return;
     }
@@ -1391,6 +1336,7 @@ type HostCapabilityRequestEvent = {
   type: "host.capability.request";
   requestId?: string;
   id?: string;
+  nodePath?: string;
   capability: string;
   params: unknown;
 };
@@ -1399,6 +1345,15 @@ type HostRequestHandlingOptions = {
   quietOpen?: boolean;
 };
 
+type HostCapabilityLogOptions = {
+  stream?: "stdout" | "stderr" | "info";
+  label?: string;
+};
+
+type HostCapabilityRequestHandlingOptions = {
+  logger?: (data: string, options?: HostCapabilityLogOptions) => void;
+};
+
 class UnsupportedHostCapabilityError extends Error {
   constructor(capability: string) {
     super(
@@ -1446,11 +1401,15 @@ async function answerHostRequestOverSession(
   }
 }
 
-async function answerHostCapabilityRequest(runtime: RuntimeClient, event: HostCapabilityRequestEvent): Promise<void> {
+async function answerHostCapabilityRequest(
+  runtime: RuntimeClient,
+  event: HostCapabilityRequestEvent,
+  options: HostCapabilityRequestHandlingOptions = {},
+): Promise<void> {
   const requestId = event.requestId ?? event.id;
   if (!requestId) throw new Error(`Host capability request is missing requestId`);
   try {
-    const handled = await handleHostCapabilityRequest(event.capability, event.params);
+    const handled = await handleHostCapabilityRequest(event.capability, event.params, options);
     await runtime.control.hostResponse(requestId, { result: handled.result });
   } catch (error) {
     await runtime.control.hostResponse(requestId, {
@@ -1462,11 +1421,12 @@ async function answerHostCapabilityRequest(runtime: RuntimeClient, event: HostCa
 async function answerHostCapabilityRequestOverSession(
   send: (message: unknown) => void | Promise<void>,
   event: HostCapabilityRequestEvent,
+  options: HostCapabilityRequestHandlingOptions = {},
 ): Promise<void> {
   const id = event.id ?? event.requestId;
   if (!id) throw new Error(`Host capability request is missing id`);
   try {
-    const handled = await handleHostCapabilityRequest(event.capability, event.params);
+    const handled = await handleHostCapabilityRequest(event.capability, event.params, options);
     await send({ type: "response", id, result: handled.result });
     if (handled.closed) reportHostCapabilityClosed(send, id, handled.closed);
   } catch (error) {
@@ -1512,6 +1472,34 @@ function hostRequestNeedsTerminal(event: HostRequestEvent): boolean {
   }
 }
 
+function hostCapabilityNeedsTerminal(event: HostCapabilityRequestEvent): boolean {
+  switch (event.capability) {
+    case "cmux.open":
+      return false;
+    default:
+      return true;
+  }
+}
+
+function createHostCapabilityLogger(
+  event: HostCapabilityRequestEvent,
+  presenter: RunPresenter | undefined,
+): (data: string, options?: HostCapabilityLogOptions) => void {
+  return (data, options = {}) => {
+    if (presenter) {
+      presenter.render({
+        type: "log.output",
+        nodePath: event.nodePath ?? "runtime",
+        stream: options.stream ?? "info",
+        label: options.label ?? event.capability,
+        data,
+      });
+      return;
+    }
+    console.error(data);
+  };
+}
+
 function isTrustedCaptureHostCommand(params: unknown): boolean {
   return process.env.RIGKIT_TRUST_HOST_COMMANDS === "1" &&
     isRecord(params) &&
@@ -1523,12 +1511,18 @@ type HandledHostCapability = {
   closed?: Promise<void>;
 };
 
-async function handleHostCapabilityRequest(capability: string, params: unknown): Promise<HandledHostCapability> {
+async function handleHostCapabilityRequest(
+  capability: string,
+  params: unknown,
+  options: HostCapabilityRequestHandlingOptions = {},
+): Promise<HandledHostCapability> {
   const handler = CLI_HOST_CAPABILITY_HANDLERS.get(capability);
   if (!handler) {
     throw new UnsupportedHostCapabilityError(capability);
   }
-  return normalizeHostCapabilityResult(await handler.handle(params));
+  return normalizeHostCapabilityResult(await handler.handle(params, {
+    log: (data, logOptions) => options.logger?.(data, logOptions),
+  }));
 }
 
 function normalizeHostCapabilityResult(value: unknown): HandledHostCapability {
@@ -1724,6 +1718,7 @@ function isHostCapabilityRequestEvent(value: unknown): value is HostCapabilityRe
   return isRecord(value) &&
     value.type === "host.capability.request" &&
     (typeof value.requestId === "string" || typeof value.id === "string") &&
+    (value.nodePath === undefined || typeof value.nodePath === "string") &&
     typeof value.capability === "string";
 }
 
@@ -1738,8 +1733,8 @@ function isWorkflowPlan(value: unknown): value is WorkflowPlan {
 function isWorkspaceRecord(value: unknown): value is WorkspaceRecord {
   return isRecord(value) &&
     typeof value.name === "string" &&
-    typeof value.resourceId === "string" &&
-    typeof value.workflow === "string";
+    typeof value.workflow === "string" &&
+    isRecord(value.ctx);
 }
 
 function isDevMachineEvent(value: unknown): value is DevMachineEvent {
@@ -1791,7 +1786,7 @@ function printPlan(plan: WorkflowPlan): void {
 }
 
 function printWorkspaces(
-  workspaces: ReadonlyArray<Pick<WorkspaceRecord, "name" | "workflow" | "snapshotId" | "createdAt"> & { resourceId?: string }>,
+  workspaces: ReadonlyArray<Pick<WorkspaceRecord, "name" | "workflow" | "createdAt">>,
 ): void {
   if (workspaces.length === 0) {
     console.log("No workspaces.");
@@ -1799,17 +1794,35 @@ function printWorkspaces(
   }
 
   printTable(
-    ["name", "resource", "snapshot", "workflow", "created"],
+    ["name", "workflow", "created", "age"],
     workspaces.map((workspace) => [
       workspace.name,
-      workspace.resourceId ?? "",
-      workspace.snapshotId ?? "",
       workspace.workflow,
       workspace.createdAt,
+      formatWorkspaceAge(workspace.createdAt),
     ]),
   );
 }
 
+function formatWorkspaceAge(createdAt: string): string {
+  const createdTime = Date.parse(createdAt);
+  if (Number.isNaN(createdTime)) return chalk.dim("unknown");
+
+  const ageMs = Math.max(0, Date.now() - createdTime);
+  const minute = 60 * 1000;
+  const hour = 60 * minute;
+  const day = 24 * hour;
+  const label = ageMs < hour
+    ? `${Math.max(1, Math.floor(ageMs / minute))}m`
+    : ageMs < day
+      ? `${Math.floor(ageMs / hour)}h`
+      : `${Math.floor(ageMs / day)}d`;
+
+  if (ageMs < day) return chalk.green(label);
+  if (ageMs <= 3 * day) return chalk.yellow(label);
+  return chalk.red(label);
+}
+
 function printSnapshots(snapshots: SnapshotRecord[]): void {
   if (snapshots.length === 0) {
     console.log("No snapshots.");
@@ -1903,7 +1916,7 @@ function renderEvent(event: DevMachineEvent): void {
       console.error(`artifact ${event.providerId}:${event.kind}`);
       return;
     case "workspace.ready":
-      console.error(`workspace ${event.workspaceId} -> ${event.resourceId}`);
+      console.error(`workspace ${event.workspaceId} ready`);
       return;
     default:
       return;

package/src/completion.test.ts

@@ -6,7 +6,7 @@ import { projectIdFor, runtimeFingerprintFor, runtimePaths, SUPPORTED_RUNTIME_AP
 import { completeRig, formatCompletionItems, renderCompletionScript } from "./completion.ts";
 
 describe("CLI completion", () => {
-  test("completes ssh workspace targets from the runtime", async () => {
+  test("completes workspace targets from the runtime", async () => {
     const projectDir = mkdtempSync(join(tmpdir(), "rigkit-completion-"));
     await withWorkspaceRuntime({ projectDir }, async () => {
       const items = await completeRig({
@@ -16,11 +16,11 @@ describe("CLI completion", () => {
       });
 
       expect(items.map((item) => item.value)).toEqual(["api", "web"]);
-      expect(items[0]?.description).toBe("vm-api");
+      expect(items[0]?.description).toBe("smoke");
     });
   });
 
-  test("completes ssh resource ids when the current token starts like a resource id", async () => {
+  test("does not complete provider resource ids as workspace targets", async () => {
     const projectDir = mkdtempSync(join(tmpdir(), "rigkit-completion-"));
     await withWorkspaceRuntime({ projectDir }, async () => {
       const items = await completeRig({
@@ -29,7 +29,7 @@ describe("CLI completion", () => {
         currentIndex: 2,
       });
 
-      expect(items.map((item) => item.value)).toEqual(["vm-api", "vm-web"]);
+      expect(items).toEqual([]);
     });
   });
 
@@ -47,6 +47,26 @@ describe("CLI completion", () => {
     });
   });
 
+  test("completes workspace operation targets", async () => {
+    const projectDir = mkdtempSync(join(tmpdir(), "rigkit-completion-"));
+    await withWorkspaceRuntime({ projectDir }, async () => {
+      const roots = await completeRig({
+        cwd: projectDir,
+        words: ["rig", "run", ""],
+        currentIndex: 2,
+      });
+      expect(roots.map((item) => item.value)).toContain("api/");
+      expect(roots.map((item) => item.value)).toContain("ssh");
+
+      const operations = await completeRig({
+        cwd: projectDir,
+        words: ["rig", "run", "api/"],
+        currentIndex: 2,
+      });
+      expect(operations.map((item) => item.value)).toEqual(["api/remove", "api/open-cmux"]);
+    });
+  });
+
   test("formats shell completion items", () => {
     const items = [{ value: "api", description: "vm-api" }];
 
@@ -110,26 +130,16 @@ async function withWorkspaceRuntime(
             {
               id: "workspace-api",
               name: "api",
-              providerId: "freestyle",
               workflow: "smoke",
-              resourceId: "vm-api",
-              sourceRef: null,
-              context: {},
-              metadata: {},
-              data: {},
+              ctx: {},
               createdAt: now,
               updatedAt: now,
             },
             {
               id: "workspace-web",
               name: "web",
-              providerId: "freestyle",
               workflow: "smoke",
-              resourceId: "vm-web",
-              sourceRef: null,
-              context: {},
-              metadata: {},
-              data: {},
+              ctx: {},
               createdAt: now,
               updatedAt: now,
             },
@@ -138,14 +148,6 @@ async function withWorkspaceRuntime(
       }
       if (pathname === "/operations") {
         return runtimeJson({
-          hostMethods: {
-            known: [],
-            requiredByOperations: {},
-          },
-          hostCapabilities: {
-            optional: [],
-            requiredByOperations: {},
-          },
           operations: [
             {
               id: "ssh",
@@ -166,6 +168,35 @@ async function withWorkspaceRuntime(
               },
             },
           ],
+          workspaceOperations: [
+            {
+              id: "remove",
+              kind: "workspace-action",
+              source: "core",
+              title: "Remove",
+              description: "remove workspace",
+              cli: {
+                options: [{ name: "yes", flag: "--yes", aliases: ["-y"], type: "boolean", runtime: false }],
+              },
+              inputSchema: {
+                type: "object",
+                additionalProperties: false,
+                properties: {},
+              },
+            },
+            {
+              id: "open-cmux",
+              kind: "workspace-action",
+              source: "config",
+              title: "Open cmux",
+              description: "open cmux",
+              inputSchema: {
+                type: "object",
+                additionalProperties: false,
+                properties: {},
+              },
+            },
+          ],
         });
       }
       return runtimeJson({ error: { message: "Not found" } }, { status: 404 });

package/src/completion.ts

@@ -17,6 +17,7 @@ type CompleteRigInput = {
 const COMMANDS: CompletionItem[] = [
   { value: "help", description: "show CLI help" },
   { value: "init", description: "initialize a Rigkit project" },
+  { value: "run", description: "run a project operation" },
   { value: "ls", description: "list project workspaces" },
   { value: "projects", description: "discover Rigkit projects" },
   { value: "doctor", description: "show runtime diagnostics" },
@@ -77,6 +78,7 @@ const OPTIONS_WITH_VALUES = new Set([
 
 type RuntimeOperationManifest = {
   operations: RuntimeOperationDefinition[];
+  workspaceOperations?: RuntimeOperationDefinition[];
 };
 
 type RuntimeOperationDefinition = {
@@ -121,7 +123,12 @@ export async function completeRig(input: CompleteRigInput): Promise<CompletionIt
       }
       return [];
     }
-    return filterItems(current.startsWith("-") ? GLOBAL_OPTIONS : [...COMMANDS, ...await safeOperationTargets(resolveProjectDir(words, cwd)), ...GLOBAL_OPTIONS], current);
+    return filterItems(
+      current.startsWith("-")
+        ? GLOBAL_OPTIONS
+        : [...COMMANDS, ...await safeOperationTargets(resolveProjectDir(words, cwd), current), ...GLOBAL_OPTIONS],
+      current,
+    );
   }
 
   if (current.startsWith("-")) {
@@ -147,7 +154,7 @@ export async function completeRig(input: CompleteRigInput): Promise<CompletionIt
   if (command === "run") {
     const run = parseRunCommand(before);
     if (!run.operation) {
-      return filterItems(await safeOperationTargets(resolveProjectDir(words, cwd)), current);
+      return filterItems(await safeOperationTargets(resolveProjectDir(words, cwd), current), current);
     }
     const operation = await safeResolveRuntimeOperation(resolveProjectDir(words, cwd), run.operation);
     const operationPositionalCount = countRunOperationPositionals(run.args);
@@ -355,48 +362,65 @@ function projectPaths(projectDir: string): { projectDir: string; configPath: str
 
 async function workspaceTargets(
   paths: { projectDir: string; configPath: string },
-  current: string,
-  includeVmIds: boolean,
+  _current: string,
+  _includeVmIds: boolean,
 ): Promise<CompletionItem[]> {
   const workspaces = await readWorkspaces(paths);
   const items = workspaces.map((workspace) => ({
     value: workspace.name,
-    description: workspace.resourceId,
+    description: workspace.workflow,
   }));
 
-  if (includeVmIds && current.length > 0) {
-    for (const workspace of workspaces) {
-      if (!workspace.resourceId) continue;
-      items.push({
-        value: workspace.resourceId,
-        description: workspace.name,
-      });
-    }
-  }
-
   return dedupeItems(items);
 }
 
-async function readWorkspaces(paths: { projectDir: string; configPath: string }): Promise<Array<{ name: string; resourceId?: string }>> {
+async function readWorkspaces(paths: { projectDir: string; configPath: string }): Promise<Array<{ name: string; workflow: string }>> {
   const runtime = await getOrStartRuntime(paths);
   const { workspaces } = await runtime.control.workspaces();
   return workspaces.map((workspace) => ({
     name: workspace.name,
-    resourceId: workspace.resourceId,
+    workflow: workspace.workflow,
   }));
 }
 
-async function operationTargets(paths: { projectDir: string; configPath: string }): Promise<CompletionItem[]> {
+async function operationTargets(
+  paths: { projectDir: string; configPath: string },
+  current: string,
+): Promise<CompletionItem[]> {
   const manifest = await readOperations(paths);
+  if (current.includes("/")) {
+    return workspaceOperationTargets(manifest, current);
+  }
+  const workspaces = await readWorkspaces(paths).catch(() => []);
   return manifest.operations.flatMap((operation) => [
     { value: operation.id, description: operation.description },
     ...(operation.aliases ?? []).map((alias) => ({ value: alias, description: operation.description })),
+  ]).concat(workspaces.map((workspace) => ({
+    value: `${workspace.name}/`,
+    description: `workspace ${workspace.workflow}`,
+  })));
+}
+
+function workspaceOperationTargets(manifest: RuntimeOperationManifest, current: string): CompletionItem[] {
+  const slash = current.indexOf("/");
+  if (slash < 0) return [];
+  const workspace = current.slice(0, slash);
+  if (!workspace) return [];
+  return (manifest.workspaceOperations ?? []).flatMap((operation) => [
+    { value: `${workspace}/${operation.id}`, description: operation.description ?? "workspace operation" },
+    ...(operation.aliases ?? []).map((alias) => ({
+      value: `${workspace}/${alias}`,
+      description: operation.description ?? "workspace operation",
+    })),
   ]);
 }
 
-async function safeOperationTargets(paths: { projectDir: string; configPath: string }): Promise<CompletionItem[]> {
+async function safeOperationTargets(
+  paths: { projectDir: string; configPath: string },
+  current: string,
+): Promise<CompletionItem[]> {
   try {
-    return await operationTargets(paths);
+    return await operationTargets(paths, current);
   } catch {
     return [];
   }
@@ -407,6 +431,12 @@ async function resolveRuntimeOperation(
   operationId: string,
 ): Promise<RuntimeOperationDefinition | undefined> {
   const manifest = await readOperations(paths);
+  const workspaceOperation = parseWorkspaceOperationId(operationId);
+  if (workspaceOperation) {
+    return (manifest.workspaceOperations ?? []).find((operation) =>
+      operation.id === workspaceOperation.operation || operation.aliases?.includes(workspaceOperation.operation)
+    );
+  }
   return manifest.operations.find((operation) =>
     operation.id === operationId || operation.aliases?.includes(operationId)
   );
@@ -428,6 +458,15 @@ async function readOperations(paths: { projectDir: string; configPath: string })
   return await runtime.control.operations() as unknown as RuntimeOperationManifest;
 }
 
+function parseWorkspaceOperationId(value: string): { workspace: string; operation: string } | undefined {
+  const slash = value.indexOf("/");
+  if (slash <= 0 || slash === value.length - 1) return undefined;
+  return {
+    workspace: value.slice(0, slash),
+    operation: value.slice(slash + 1),
+  };
+}
+
 function filterItems(items: CompletionItem[], current: string): CompletionItem[] {
   return dedupeItems(items).filter((item) => item.value.startsWith(current));
 }

package/src/init.test.ts

@@ -3,7 +3,12 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { initProject, normalizeMachineName } from "./init.ts";
-import { FREESTYLE_PROVIDER_PACKAGE_NAME, PROJECT_PACKAGE_NAME } from "./project.ts";
+import {
+  FREESTYLE_PROVIDER_PACKAGE_NAME,
+  FREESTYLE_SDK_PACKAGE_NAME,
+  FREESTYLE_SDK_PACKAGE_VERSION,
+  PROJECT_PACKAGE_NAME,
+} from "./project.ts";
 import { RIGKIT_CLI_VERSION } from "./version.ts";
 
 describe("initProject", () => {
@@ -14,7 +19,6 @@ describe("initProject", () => {
       projectDir,
       configPath: join(projectDir, "rig.config.ts"),
       name: "Platform API",
-      apiKey: "fs_test_123",
     });
 
     expect(result.name).toBe("platform-api");
@@ -22,16 +26,18 @@ describe("initProject", () => {
     expect(existsSync(projectDir)).toBe(true);
     expect(result.created).toEqual({
       config: true,
-      env: true,
-      envExample: true,
+      env: false,
+      envExample: false,
       gitignore: true,
       packageJson: true,
     });
 
     expect(readFileSync(join(projectDir, "rig.config.ts"), "utf8")).toContain('sequence("platform-api"');
     expect(readFileSync(join(projectDir, "rig.config.ts"), "utf8")).toContain("defineConfig({");
-    expect(readFileSync(join(projectDir, ".env"), "utf8")).toBe("FREESTYLE_API_KEY=fs_test_123\n");
-    expect(readFileSync(join(projectDir, ".env.example"), "utf8")).toBe("FREESTYLE_API_KEY=\n");
+    expect(readFileSync(join(projectDir, "rig.config.ts"), "utf8")).toContain("new VmSpec()");
+    expect(readFileSync(join(projectDir, "rig.config.ts"), "utf8")).not.toContain("FREESTYLE_API_KEY");
+    expect(existsSync(join(projectDir, ".env"))).toBe(false);
+    expect(existsSync(join(projectDir, ".env.example"))).toBe(false);
     expect(readFileSync(join(projectDir, ".gitignore"), "utf8")).toContain(".env\n.rigkit/\n");
 
     const pkg = JSON.parse(readFileSync(join(projectDir, "package.json"), "utf8"));
@@ -40,6 +46,7 @@ describe("initProject", () => {
     expect(pkg.scripts.apply).toBe("rig apply");
     expect(pkg.devDependencies[PROJECT_PACKAGE_NAME]).toBe(RIGKIT_CLI_VERSION);
     expect(pkg.devDependencies[FREESTYLE_PROVIDER_PACKAGE_NAME]).toBe(RIGKIT_CLI_VERSION);
+    expect(pkg.devDependencies[FREESTYLE_SDK_PACKAGE_NAME]).toBe(FREESTYLE_SDK_PACKAGE_VERSION);
   });
 
   test("updates existing project files without replacing package metadata", () => {

package/src/init.ts

@@ -1,13 +1,18 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { RIGKIT_CLI_VERSION } from "./version.ts";
-import { FREESTYLE_PROVIDER_PACKAGE_NAME, PROJECT_PACKAGE_NAME } from "./project.ts";
+import {
+  FREESTYLE_PROVIDER_PACKAGE_NAME,
+  FREESTYLE_SDK_PACKAGE_NAME,
+  FREESTYLE_SDK_PACKAGE_VERSION,
+  PROJECT_PACKAGE_NAME,
+} from "./project.ts";
 
 export type InitProjectInput = {
   projectDir: string;
   configPath: string;
   name: string;
-  apiKey: string;
+  apiKey?: string;
   force?: boolean;
 };
 
@@ -47,11 +52,14 @@ export function initProject(input: InitProjectInput): InitProjectResult {
     writeFileSync(input.configPath, starterConfig(name));
   }
 
+  const apiKey = input.apiKey?.trim();
   const envPath = join(input.projectDir, ".env");
-  const env = writeEnvFile(envPath, input.apiKey);
+  const env = apiKey
+    ? writeEnvFile(envPath, apiKey)
+    : { created: false, updated: false };
 
   const envExamplePath = join(input.projectDir, ".env.example");
-  const wroteEnvExample = !existsSync(envExamplePath);
+  const wroteEnvExample = Boolean(apiKey) && !existsSync(envExamplePath);
   if (wroteEnvExample) {
     writeFileSync(envExamplePath, "FREESTYLE_API_KEY=\n");
   }
@@ -94,32 +102,47 @@ export function normalizeMachineName(value: string): string {
 export function starterConfig(name: string): string {
   const workflowName = JSON.stringify(normalizeMachineName(name));
 
-  return `import { defineConfig, env, sequence } from "@rigkit/sdk";
-import { freestyle } from "@rigkit/provider-freestyle";
+  return `import { defineConfig, sequence } from "@rigkit/sdk";
+import { freestyle, VmBaseImage, VmSpec } from "@rigkit/provider-freestyle";
 
-const freestyleProvider = freestyle.provider({
-  apiKey: () => env.secret("FREESTYLE_API_KEY"),
-  image: "node-22",
-});
+const vmIdleTimeoutSeconds = 3600;
+const vmSpec = new VmSpec()
+  .baseImage(new VmBaseImage("FROM node:22"))
+  .idleTimeoutSeconds(vmIdleTimeoutSeconds);
+
+const freestyleProvider = freestyle.provider();
 
 const dev = sequence(${workflowName})
-  .step("verify-node-22", async ({ providers }) => {
-    const vm = await providers.freestyle.vms.create();
-    const result = await vm.probe("node --version", { name: "node is v22" });
-    if (!result.ok || !result.stdout.trim().startsWith("v22.")) {
-      throw new Error(\`Expected Node.js v22, got: \${result.stdout}\${result.stderr}\`);
+  .step("verify-node-22", async ({ providers, step }) => {
+    const { vm, vmId } = await providers.freestyle.client.vms.create({
+      spec: vmSpec,
+      logger: step.log,
+    });
+    try {
+      const result = await vm.exec("node --version");
+      if ((result.statusCode ?? 0) !== 0 || !result.stdout.trim().startsWith("v22.")) {
+        throw new Error(\`Expected Node.js v22, got: \${result.stdout}\${result.stderr}\`);
+      }
+      const snapshot = await vm.snapshot();
+      return { ctx: { snapshotId: snapshot.snapshotId } };
+    } finally {
+      await providers.freestyle.client.vms.delete({ vmId });
     }
-    return { vm: await vm.snapshotRef() };
   })
-  .create(async ({ ctx, name, providers }) => {
-    const vm = await providers.freestyle.vms.fromSnapshot(ctx.vm);
-    return {
-      name,
-      providerId: "freestyle",
-      resourceId: vm.vmId,
-      vmId: vm.vmId,
-      sourceRef: ctx.vm,
-    };
+  .workspace({
+    create: async ({ workflow, providers, step }) => {
+      const { vmId } = await providers.freestyle.client.vms.create({
+        snapshotId: workflow.ctx.snapshotId,
+        idleTimeoutSeconds: vmIdleTimeoutSeconds,
+        logger: step.log,
+      });
+      return {
+        vmId,
+      };
+    },
+    remove: async ({ providers, workspace }) => {
+      await providers.freestyle.client.vms.delete({ vmId: workspace.ctx.vmId });
+    },
   });
 
 export default defineConfig({
@@ -217,11 +240,13 @@ function ensureProjectPackageJson(
   const devDependencies = isRecord(pkg.devDependencies) ? pkg.devDependencies : {};
   const sdkDependencyChanged =
     devDependencies[PROJECT_PACKAGE_NAME] !== RIGKIT_CLI_VERSION ||
-    devDependencies[FREESTYLE_PROVIDER_PACKAGE_NAME] !== RIGKIT_CLI_VERSION;
+    devDependencies[FREESTYLE_PROVIDER_PACKAGE_NAME] !== RIGKIT_CLI_VERSION ||
+    devDependencies[FREESTYLE_SDK_PACKAGE_NAME] !== FREESTYLE_SDK_PACKAGE_VERSION;
   if (sdkDependencyChanged) {
     delete devDependencies["@rigkit/runtime"];
     devDependencies[PROJECT_PACKAGE_NAME] = RIGKIT_CLI_VERSION;
     devDependencies[FREESTYLE_PROVIDER_PACKAGE_NAME] = RIGKIT_CLI_VERSION;
+    devDependencies[FREESTYLE_SDK_PACKAGE_NAME] = FREESTYLE_SDK_PACKAGE_VERSION;
     updated = true;
   }
   pkg.devDependencies = sortObject(devDependencies);

package/src/project.ts

@@ -4,6 +4,8 @@ import { existsSync, readdirSync } from "node:fs";
 export const DEFAULT_CONFIG_FILE = "rig.config.ts";
 export const PROJECT_PACKAGE_NAME = "@rigkit/sdk";
 export const FREESTYLE_PROVIDER_PACKAGE_NAME = "@rigkit/provider-freestyle";
+export const FREESTYLE_SDK_PACKAGE_NAME = "freestyle";
+export const FREESTYLE_SDK_PACKAGE_VERSION = "^0.1.51";
 
 export type ConfigPathOptions = {
   project?: string;

package/src/run-presenter.ts

@@ -146,7 +146,7 @@ export function createRunPresenter(operation: string): RunPresenter | undefined
           );
           break;
         case "workspace.ready":
-          phase = `Workspace ${String(event.resourceId ?? event.workspaceId ?? "ready")} ready`;
+          phase = `Workspace ${String(event.workspaceId ?? "ready")} ready`;
           break;
         case "run.completed":
           finalStatus = "completed";

package/src/version.ts

@@ -1 +1 @@
-export const RIGKIT_CLI_VERSION = "0.2.2";
+export const RIGKIT_CLI_VERSION = "0.2.4";