@runtypelabs/cli 2.29.0 → 2.30.0

package/dist/index.js

@@ -136,8 +136,8 @@ var init_credential_store = __esm({
 });
 
 // src/index.ts
-import { Command as Command38 } from "commander";
-import chalk47 from "chalk";
+import { Command as Command39 } from "commander";
+import chalk48 from "chalk";
 
 // src/lib/load-env.ts
 import { readFileSync } from "fs";
@@ -41975,6 +41975,14 @@ var mcpToolFulfillmentSchema = external_exports.object({
   rung: external_exports.literal("mcp_tool"),
   tool: external_exports.string(),
   args: external_exports.record(external_exports.string(), external_exports.unknown()),
+  /**
+   * Operator-supplied arguments that MUST be merged into `args` before the
+   * call does anything — executing `args` alone is accepted by the tool but
+   * writes nothing, so a consumer that sees this field non-empty must obtain
+   * these values (from the operator or a secret store) first. Keyed by arg
+   * name; the value describes what to supply.
+   */
+  pendingArgs: external_exports.record(external_exports.string(), external_exports.string()).optional(),
   summary: external_exports.string()
 });
 var restFulfillmentSchema = external_exports.object({
@@ -71871,6 +71879,7 @@ function isCI() {
 var SKILLS_OFFER_SKIP_COMMANDS = /* @__PURE__ */ new Set([
   "skills",
   "install-mcp",
+  "onboard",
   "init",
   "login",
   "auth"
@@ -72611,8 +72620,6 @@ function getMcpRestartInstruction(agent) {
 function getMcpSkillsAgentId(agent) {
   return MCP_AGENT_DEFINITIONS[agent].skillsAgentId;
 }
-
-// src/commands/install-mcp.ts
 async function selectAgent(options, tty) {
   if (options.agent) {
     const explicit = normalizeMcpAgent(options.agent);
@@ -72648,6 +72655,8 @@ async function selectAgent(options, tty) {
     { promptLabel: "Agent" }
   );
 }
+
+// src/commands/install-mcp.ts
 async function installSkillsForAgent(agent, jsonMode) {
   const rosieId = getMcpSkillsAgentId(agent);
   try {
@@ -72814,13 +72823,378 @@ Setting up Runtype for ${definition.displayName}\u2026`));
   if (partial2) process.exitCode = 1;
 });
 
-// src/commands/apps.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync20, lstatSync, statSync as statSync7, existsSync as existsSync16 } from "fs";
-import { join as join14, relative as relative7 } from "path";
+// src/commands/onboard.ts
+import { existsSync as existsSync16, readFileSync as readFileSync20 } from "fs";
+import { join as join14 } from "path";
 import { Command as Command34 } from "commander";
 import chalk42 from "chalk";
+
+// ../shared/dist/agent-onboarding-content.mjs
+var AGENT_ONBOARDING_MARKDOWN = `# Runtype for Coding Agents
+
+You are reading the setup script served by \`https://runtype.ai\`. Your durable goal is to leave this coding harness connected to Runtype's hosted MCP server with browser OAuth. Use the Runtype CLI as a bridge during this first session; do not treat it as the final integration.
+
+## Golden path \u2014 do exactly this
+
+If the live Runtype MCP tools are already available in this session, skip setup and go to "After MCP is active" below. Otherwise follow every step in order:
+
+### 1. Install and authenticate the CLI
+
+\`\`\`bash
+npm install -g @runtypelabs/cli
+runtype auth login
+\`\`\`
+
+Complete the browser sign-in when it opens. The CLI makes this first session productive even though a running coding harness often cannot discover a newly installed MCP connection until it restarts.
+
+### 2. Install skills and the OAuth MCP connection
+
+\`\`\`bash
+runtype install-mcp
+\`\`\`
+
+This command detects the current coding harness, installs the Runtype agent skills for it, writes the user-level hosted MCP configuration, and starts the harness's own OAuth flow when possible. If it asks which harness to configure, select the harness running this session. If a browser opens, have the user complete OAuth.
+
+Do not manually create an API key, export the CLI key into MCP, or choose a different setup path merely to avoid a restart. CLI authentication and MCP OAuth are separate on purpose: the CLI is the first-session bridge; client-owned OAuth MCP is the durable connection.
+
+### 3. Keep working in this session with the CLI
+
+Do not stop just because the new MCP connection is not visible yet. Use CLI commands for useful first-session work:
+
+\`\`\`bash
+runtype auth whoami
+runtype agents list
+runtype flows list
+runtype products list
+runtype --help
+\`\`\`
+
+The CLI also supports dispatch, records, validation, product setup, and other account operations. Read command help before mutating resources, and report concrete IDs and URLs to the user.
+
+### 4. Tell the user to restart or reload the harness
+
+Before finishing this session, read the final status and next steps from \`runtype install-mcp\`. Complete any OAuth action it requests and retry any failed skill installation. Do not call setup complete while the command reports \`action-required\`, \`partial\`, or an error.
+
+Only after skills and OAuth both succeed, tell the user exactly what changed and ask them to restart or reload the coding harness. Use direct language such as:
+
+> Runtype skills and the OAuth MCP connection are installed. Please restart or reload this coding agent (or start a new session) so it can activate the new MCP tools. I used the CLI to keep this first session productive; after restart I will use MCP by default.
+
+If an action remains, report that exact action instead of using the success wording above. Do not claim the running agent can use MCP until its Runtype tools actually appear.
+
+### 5. Switch to MCP after restart
+
+In the next session, use Runtype MCP first. Do not fall back to the CLI just because it worked previously. Start by calling:
+
+\`\`\`json
+{
+  "task": "build-product",
+  "description": "Describe the user's product goal here"
+}
+\`\`\`
+
+with \`get_build_instructions\`. Then use \`get_platform_documentation\` for exact schemas and catalogs, create or update resources with MCP tools, validate them, and test the result with a real run.
+
+## If the install needs recovery
+
+\`runtype install-mcp\` intentionally changes one confidently selected harness, not every agent config it can find. If detection is ambiguous, re-run it with one explicit id:
+
+\`\`\`bash
+runtype install-mcp --agent claude
+runtype install-mcp --agent codex
+runtype install-mcp --agent cursor
+runtype install-mcp --agent gemini
+runtype install-mcp --agent opencode
+runtype install-mcp --agent vscode
+\`\`\`
+
+Use only the line for the current harness. Follow the command's OAuth and restart instructions. Use \`--force\` only when the command reports that an existing MCP server named \`runtype\` points to a different URL and the user agrees to replace it.
+
+## Headless exception \u2014 not the normal path
+
+Only use an API key when browser OAuth is genuinely impossible in the user's environment, not merely inconvenient. Ask the user before switching authentication modes, then follow the canonical headless registration and claim protocol at \`https://runtype.com/auth.md\`. Never print a secret into the transcript or write a bearer token directly into a committed config file.
+
+The hosted MCP endpoint is \`https://api.runtype.com/v1/mcp/protocol\`. A user-supplied \`RUNTYPE_API_KEY\` can authenticate CLI commands in a headless environment, but return to client-owned OAuth MCP when the harness can support it.
+
+## After MCP is active
+
+- Call \`get_build_instructions\` before building.
+- Use \`get_platform_documentation\` instead of inventing payload shapes.
+- Let the installed Runtype skills route task-specific work: product builds, live account operations, Persona embeds, templates, and SDK/CLI workflows.
+- If the user gives you a \`use.runtype.com/now?...\`, example, or template/FPO link, use the Runtype template skill and MCP tools rather than opening the login-gated dashboard page.
+- Validate before shipping and test with a real execution.
+
+Runtype MCP can create and operate agents, flows, products, records, secrets, evals, and surfaces; attach built-in, HTTP, MCP, flow, and subagent tools; and ship chat, API, webhook, messaging, schedule, MCP, and hosted-page experiences.
+
+Docs: [runtype.com](https://runtype.com)
+Dashboard: [use.runtype.com](https://use.runtype.com)
+API: [api.runtype.com](https://api.runtype.com)
+`;
+
+// src/commands/onboard.ts
+init_credential_store();
+var AUTH_LOGIN_INSTRUCTION = "Sign in to Runtype: run `runtype auth login` (or set RUNTYPE_API_KEY), then re-run `runtype onboard`.";
+var AFTER_RESTART_STEPS = [
+  "Use the Runtype MCP server first for all Runtype work.",
+  "Start with the get_build_instructions tool before creating or changing resources.",
+  "Do not fall back to the Runtype CLI once the MCP connection is active."
+];
+var EXISTING_PROJECT_ADVICE = "Building AI features into an existing codebase? After restart, decide with the user whether flow/agent config should be hosted (dashboard-editable, called via the dispatch API) or code-first in this repo via the TypeScript SDK. They run on the same platform and can be mixed.";
+function detectExistingProject(cwd = process.cwd()) {
+  const packageJsonPath = join14(cwd, "package.json");
+  const hasPackageJson = existsSync16(packageJsonPath);
+  if (!hasPackageJson && !existsSync16(join14(cwd, ".git"))) return false;
+  if (hasPackageJson) {
+    try {
+      const parsed = JSON.parse(readFileSync20(packageJsonPath, "utf8"));
+      if (parsed.name === "@runtypelabs/cli") return false;
+    } catch {
+    }
+  }
+  return true;
+}
+var defaultDependencies = {
+  getEnvApiKey: () => getRuntimeApiKey(),
+  getStoredCredentials: async () => {
+    const credentials = await new CredentialStore().getCredentials();
+    if (!credentials) return null;
+    return { userId: credentials.userId, orgId: credentials.orgId };
+  },
+  ensureAuth,
+  selectAgent,
+  configureMcp: (agent, options) => configureMcpAgent(agent, options),
+  authenticateMcp: (agent, options) => authenticateMcpAgent(agent, options),
+  installSkills: installSkillsForAgent,
+  isExistingProject: detectExistingProject,
+  setExitCode: (code) => {
+    process.exitCode = code;
+  }
+};
+async function resolveAuth(dependencies, options) {
+  if (dependencies.getEnvApiKey()) {
+    return { authenticated: true, method: "env" };
+  }
+  const stored = await dependencies.getStoredCredentials();
+  if (stored) {
+    return { authenticated: true, method: "stored", userId: stored.userId, orgId: stored.orgId };
+  }
+  if (!options.interactiveLogin) {
+    return { authenticated: false, instruction: AUTH_LOGIN_INSTRUCTION };
+  }
+  const apiKey = await dependencies.ensureAuth({ exitOnFailure: false });
+  if (!apiKey) {
+    return { authenticated: false, instruction: AUTH_LOGIN_INSTRUCTION };
+  }
+  const after = await dependencies.getStoredCredentials();
+  return {
+    authenticated: true,
+    method: "browser-login",
+    userId: after?.userId,
+    orgId: after?.orgId
+  };
+}
+function printAuthLine(auth) {
+  if (!auth.authenticated) {
+    console.log(chalk42.yellow(`! Not signed in. ${auth.instruction}`));
+    return;
+  }
+  if (auth.method === "env") {
+    console.log(chalk42.green("\u2713 Signed in with RUNTYPE_API_KEY from the environment."));
+    return;
+  }
+  const identity = auth.userId ? ` (user ${auth.userId}${auth.orgId ? `, org ${auth.orgId}` : ""})` : "";
+  if (auth.method === "stored") {
+    console.log(chalk42.green(`\u2713 Already signed in${identity}.`));
+  } else {
+    console.log(chalk42.green(`\u2713 Signed in${identity}.`));
+  }
+}
+function createOnboardCommand(overrides = {}) {
+  const dependencies = { ...defaultDependencies, ...overrides };
+  return new Command34("onboard").description("Set up Runtype for this coding agent: sign in, install skills and OAuth MCP").option("--agent <id>", "Coding agent to configure (auto-detected by default)").option("--force", 'Replace a conflicting MCP server named "runtype"').option("--dry-run", "Show the selected agent and planned changes without writing them").option("--no-login", "Skip browser sign-in and MCP OAuth").option("--no-skills", "Skip installing Runtype agent skills").option("--json", "Structured JSON output; implies --no-login").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").option("--print-instructions", "Print the canonical agent onboarding markdown and exit").action(async (options, cmd) => {
+    if (options.printInstructions) {
+      console.log(AGENT_ONBOARDING_MARKDOWN);
+      return;
+    }
+    const globals = cmd.optsWithGlobals();
+    const jsonMode = !!(options.json ?? globals.json);
+    const tty = isTTY(options);
+    const loginAllowed = !jsonMode && tty && options.login !== false;
+    if (!jsonMode) {
+      console.log(chalk42.cyan("\nRuntype onboarding"));
+      console.log(
+        "Runtype is a platform for building AI products: agents, flows, evals, and surfaces your team ships to its own users."
+      );
+      console.log(
+        chalk42.dim(
+          "This command signs you in, installs Runtype skills and the hosted OAuth MCP server, then prints next steps.\n"
+        )
+      );
+    }
+    let auth;
+    try {
+      auth = await resolveAuth(dependencies, {
+        interactiveLogin: loginAllowed && !options.dryRun
+      });
+    } catch (error51) {
+      const message = error51 instanceof Error ? error51.message : String(error51);
+      if (jsonMode) {
+        printJson({ status: "error", code: "AUTH_RESOLUTION_FAILED", error: message });
+      } else {
+        console.error(chalk42.red(`Could not read Runtype credentials: ${message}`));
+      }
+      dependencies.setExitCode(1);
+      return;
+    }
+    if (!jsonMode) printAuthLine(auth);
+    let agent;
+    try {
+      agent = await dependencies.selectAgent({ agent: options.agent, json: jsonMode }, tty);
+    } catch (error51) {
+      const message = error51 instanceof Error ? error51.message : String(error51);
+      if (jsonMode) {
+        printJson({ status: "error", code: "AGENT_DETECTION_FAILED", auth, error: message });
+      } else {
+        console.error(chalk42.red(message));
+      }
+      dependencies.setExitCode(1);
+      return;
+    }
+    const definition = MCP_AGENT_DEFINITIONS[agent];
+    if (!jsonMode) {
+      console.log(chalk42.cyan(`
+Setting up Runtype for ${definition.displayName}\u2026`));
+    }
+    const configuration = await dependencies.configureMcp(agent, {
+      force: options.force,
+      dryRun: options.dryRun
+    });
+    if (!configuration.configured) {
+      if (jsonMode) {
+        printJson({ status: "error", code: "MCP_CONFIG_FAILED", agent, auth, configuration });
+      } else {
+        console.error(chalk42.red(configuration.error ?? "Could not configure Runtype MCP."));
+      }
+      dependencies.setExitCode(1);
+      return;
+    }
+    if (!jsonMode) {
+      if (options.dryRun) {
+        console.log(chalk42.green("\u2713 Would install the user-level Runtype MCP connection."));
+      } else if (configuration.changed) {
+        console.log(chalk42.green("\u2713 Installed the user-level Runtype MCP connection."));
+      } else {
+        console.log(chalk42.green("\u2713 Runtype MCP is already configured at the correct URL."));
+      }
+      if (configuration.configPath) {
+        console.log(chalk42.dim(`  ${configuration.configPath}`));
+      }
+      if (configuration.backupPath) {
+        console.log(chalk42.dim(`  Backup: ${configuration.backupPath}`));
+      }
+    }
+    const authentication = await dependencies.authenticateMcp(agent, {
+      login: loginAllowed,
+      dryRun: options.dryRun
+    });
+    if (!jsonMode && !options.dryRun) {
+      if (authentication.authenticated) {
+        console.log(chalk42.green("\u2713 MCP OAuth completed."));
+      } else if (authentication.error) {
+        console.log(chalk42.yellow(`! ${authentication.error}`));
+      } else if (authentication.instruction) {
+        console.log(chalk42.yellow(`! OAuth action required: ${authentication.instruction}`));
+      }
+    }
+    const skills = options.skills === false || options.dryRun ? {
+      status: options.dryRun ? "planned" : "skipped",
+      installedAgents: [],
+      failedAgents: []
+    } : await dependencies.installSkills(agent, jsonMode);
+    if (!jsonMode && !options.dryRun && skills.status === "error") {
+      console.log(
+        chalk42.yellow(
+          `! Runtype MCP is configured, but skill installation failed: ${skills.error ?? "unknown error"}`
+        )
+      );
+    }
+    const restartInstruction = getMcpRestartInstruction(agent);
+    const existingProject = dependencies.isExistingProject();
+    const nextSteps = [];
+    if (options.dryRun) {
+      nextSteps.push(
+        `Re-run \`runtype onboard --agent ${agent}\` without --dry-run to sign in, install skills, and configure MCP.`
+      );
+    } else {
+      if (!auth.authenticated && auth.instruction) nextSteps.push(auth.instruction);
+      if (authentication.instruction) nextSteps.push(authentication.instruction);
+      if (authentication.error && !authentication.instruction) {
+        nextSteps.push("Resolve the OAuth blocker reported above, then re-run `runtype onboard`.");
+      }
+      if (skills.status === "error") {
+        nextSteps.push(
+          `Retry skill installation with \`runtype skills install --agent ${getMcpSkillsAgentId(agent)}\`.`
+        );
+      } else if (skills.status === "skipped") {
+        nextSteps.push(
+          `Install the Runtype skills with \`runtype skills install --agent ${getMcpSkillsAgentId(agent)}\`.`
+        );
+      }
+      nextSteps.push(
+        "Continue this first session with the Runtype CLI; this running agent may not see the new MCP connection yet."
+      );
+      if (auth.authenticated && authentication.authenticated && skills.status !== "error") {
+        nextSteps.push(
+          `Tell the user that Runtype is set up, then ask them to restart or reload ${definition.displayName}.`
+        );
+      } else {
+        nextSteps.push(
+          "Tell the user that setup still has the action(s) above; do not call onboarding complete yet."
+        );
+      }
+      nextSteps.push(`After completing any action above, ${restartInstruction}`);
+    }
+    const partial2 = !options.dryRun && (Boolean(authentication.error) || skills.status === "error");
+    const status = options.dryRun ? "planned" : partial2 ? "partial" : auth.authenticated && authentication.authenticated ? "ok" : "action-required";
+    if (jsonMode) {
+      printJson({
+        status,
+        agent,
+        auth,
+        configuration,
+        authentication,
+        skills,
+        activation: options.dryRun ? "not-configured" : "restart-required",
+        restartInstruction,
+        afterRestart: AFTER_RESTART_STEPS,
+        ...existingProject ? { existingProjectAdvice: EXISTING_PROJECT_ADVICE } : {},
+        nextSteps
+      });
+    } else {
+      console.log(chalk42.bold(`
+Onboarding status: ${status}`));
+      console.log(chalk42.bold("\nDo exactly this next:"));
+      nextSteps.forEach((step, index) => console.log(`  ${index + 1}. ${step}`));
+      console.log(chalk42.bold(`
+After restarting ${definition.displayName}:`));
+      AFTER_RESTART_STEPS.forEach((step) => console.log(`  - ${step}`));
+      if (existingProject) {
+        console.log(`
+${EXISTING_PROJECT_ADVICE}`);
+      }
+      console.log("");
+    }
+    if (partial2) dependencies.setExitCode(1);
+  });
+}
+var onboardCommand = createOnboardCommand();
+
+// src/commands/apps.ts
+import { readdirSync as readdirSync7, readFileSync as readFileSync21, lstatSync, statSync as statSync7, existsSync as existsSync17 } from "fs";
+import { join as join15, relative as relative7 } from "path";
+import { Command as Command35 } from "commander";
+import chalk43 from "chalk";
 import { zipSync } from "fflate";
-var appsCommand = new Command34("apps").description(
+var appsCommand = new Command35("apps").description(
   "Manage Runtype Apps (hosted AI apps on *.runtype.run)"
 );
 var MANIFEST_FILENAME = "runtype.app.json";
@@ -72829,14 +73203,14 @@ function collectBundleFiles(dir) {
   const walk = (current) => {
     for (const entry of readdirSync7(current)) {
       if (entry.startsWith(".")) continue;
-      const full = join14(current, entry);
+      const full = join15(current, entry);
       const stat2 = lstatSync(full);
       if (stat2.isSymbolicLink()) continue;
       if (stat2.isDirectory()) {
         if (entry === "node_modules") continue;
         walk(full);
       } else {
-        zippable[relative7(dir, full).split("\\").join("/")] = readFileSync20(full);
+        zippable[relative7(dir, full).split("\\").join("/")] = readFileSync21(full);
       }
     }
   };
@@ -72847,7 +73221,7 @@ function fail(message, jsonMode, code) {
   if (jsonMode) {
     printJson({ status: "error", error: message, code });
   } else {
-    console.error(chalk42.red(message));
+    console.error(chalk43.red(message));
   }
   process.exit(1);
 }
@@ -72872,13 +73246,13 @@ appsCommand.command("list").description("List your apps").option("--json", "Stru
       return;
     }
     if (data.length === 0) {
-      console.log(chalk42.yellow("No apps yet. Create one with `runtype apps create`."));
+      console.log(chalk43.yellow("No apps yet. Create one with `runtype apps create`."));
       return;
     }
     for (const app of data) {
-      const status = app.status === "suspended" ? chalk42.red("suspended") : chalk42.green("active");
-      const serving = app.activeVersionId ? "" : chalk42.dim(" (no active version)");
-      console.log(`${chalk42.bold(app.name)} ${chalk42.dim(app.id)}`);
+      const status = app.status === "suspended" ? chalk43.red("suspended") : chalk43.green("active");
+      const serving = app.activeVersionId ? "" : chalk43.dim(" (no active version)");
+      console.log(`${chalk43.bold(app.name)} ${chalk43.dim(app.id)}`);
       console.log(`  ${app.url}  ${status}  ${app.visibility}${serving}`);
     }
   } catch (error51) {
@@ -72907,9 +73281,9 @@ appsCommand.command("create").description("Create an app (the hostname is {slug}
         printJson(app);
         return;
       }
-      console.log(chalk42.green(`Created ${app.name} (${app.id})`));
+      console.log(chalk43.green(`Created ${app.name} (${app.id})`));
       console.log(`  ${app.url}`);
-      console.log(chalk42.dim("  Deploy a bundle with `runtype apps deploy <dir> --app " + app.id + "`"));
+      console.log(chalk43.dim("  Deploy a bundle with `runtype apps deploy <dir> --app " + app.id + "`"));
     } catch (error51) {
       fail(
         `Failed to create app: ${error51 instanceof Error ? error51.message : String(error51)}`,
@@ -72925,7 +73299,7 @@ appsCommand.command("deploy <dir>").description("Zip a bundle directory, upload
     const jsonMode = !!(options.json ?? globals.json);
     const apiKey = await ensureAuth();
     if (!apiKey) return;
-    if (!existsSync16(dir) || !statSync7(dir).isDirectory()) {
+    if (!existsSync17(dir) || !statSync7(dir).isDirectory()) {
       fail(`Not a directory: ${dir}`, jsonMode, "INVALID_DIR");
     }
     let bundleFiles = {};
@@ -72955,7 +73329,7 @@ appsCommand.command("deploy <dir>").description("Zip a bundle directory, upload
     const client = createCliClient(apiKey);
     try {
       const zipBytes = zipSync(bundleFiles);
-      if (!jsonMode) console.log(chalk42.dim(`Uploading ${(zipBytes.byteLength / 1024).toFixed(1)} KB bundle...`));
+      if (!jsonMode) console.log(chalk43.dim(`Uploading ${(zipBytes.byteLength / 1024).toFixed(1)} KB bundle...`));
       const version2 = await appsApi.uploadVersion(client, options.app, zipBytes);
       let app;
       if (options.activate) {
@@ -72973,8 +73347,8 @@ appsCommand.command("deploy <dir>").description("Zip a bundle directory, upload
               activated: false
             });
           } else {
-            console.error(chalk42.red(`Uploaded version ${version2.versionNumber}, but activation failed: ${message}`));
-            console.error(chalk42.dim(`  Retry with \`runtype apps activate ${options.app} ${version2.id}\` (no re-upload needed).`));
+            console.error(chalk43.red(`Uploaded version ${version2.versionNumber}, but activation failed: ${message}`));
+            console.error(chalk43.dim(`  Retry with \`runtype apps activate ${options.app} ${version2.id}\` (no re-upload needed).`));
           }
           process.exit(1);
         }
@@ -72984,14 +73358,14 @@ appsCommand.command("deploy <dir>").description("Zip a bundle directory, upload
         return;
       }
       console.log(
-        chalk42.green(
+        chalk43.green(
           `Deployed version ${version2.versionNumber} (${version2.fileCount} files, ${(version2.sizeBytes / 1024).toFixed(1)} KB)`
         )
       );
       if (app) {
-        console.log(`  Live at ${chalk42.bold(app.url)}`);
+        console.log(`  Live at ${chalk43.bold(app.url)}`);
       } else {
-        console.log(chalk42.dim(`  Uploaded but not activated. Activate with \`runtype apps activate ${options.app} ${version2.id}\``));
+        console.log(chalk43.dim(`  Uploaded but not activated. Activate with \`runtype apps activate ${options.app} ${version2.id}\``));
       }
     } catch (error51) {
       fail(
@@ -73015,13 +73389,13 @@ appsCommand.command("versions <appId>").description("List an app's versions, new
       return;
     }
     if (data.length === 0) {
-      console.log(chalk42.yellow("No versions uploaded yet."));
+      console.log(chalk43.yellow("No versions uploaded yet."));
       return;
     }
     for (const version2 of data) {
-      const marker = version2.status === "active" ? chalk42.green(" (active)") : "";
+      const marker = version2.status === "active" ? chalk43.green(" (active)") : "";
       console.log(
-        `v${version2.versionNumber} ${chalk42.dim(version2.id)} ${version2.fileCount} files, ${(version2.sizeBytes / 1024).toFixed(1)} KB${marker}`
+        `v${version2.versionNumber} ${chalk43.dim(version2.id)} ${version2.fileCount} files, ${(version2.sizeBytes / 1024).toFixed(1)} KB${marker}`
       );
     }
   } catch (error51) {
@@ -73044,8 +73418,8 @@ appsCommand.command("activate <appId> <versionId>").description("Activate an upl
       printJson({ app, version: version2 });
       return;
     }
-    console.log(chalk42.green(`Activated version ${version2.versionNumber}`));
-    console.log(`  Live at ${chalk42.bold(app.url)}`);
+    console.log(chalk43.green(`Activated version ${version2.versionNumber}`));
+    console.log(`  Live at ${chalk43.bold(app.url)}`);
   } catch (error51) {
     fail(
       `Activation failed: ${error51 instanceof Error ? error51.message : String(error51)}`,
@@ -73066,7 +73440,7 @@ appsCommand.command("delete <appId>").description("Permanently delete an app, it
       printJson({ status: "deleted", appId });
       return;
     }
-    console.log(chalk42.green(`Deleted ${appId}`));
+    console.log(chalk43.green(`Deleted ${appId}`));
   } catch (error51) {
     fail(
       `Delete failed: ${error51 instanceof Error ? error51.message : String(error51)}`,
@@ -73077,17 +73451,17 @@ appsCommand.command("delete <appId>").description("Permanently delete an app, it
 });
 
 // src/commands/update.ts
-import chalk44 from "chalk";
-import { Command as Command35 } from "commander";
+import chalk45 from "chalk";
+import { Command as Command36 } from "commander";
 
 // src/lib/auto-update.ts
 import { spawn as spawn2 } from "child_process";
 import {
   closeSync,
-  existsSync as existsSync17,
+  existsSync as existsSync18,
   mkdirSync as mkdirSync12,
   openSync,
-  readFileSync as readFileSync21,
+  readFileSync as readFileSync22,
   readdirSync as readdirSync8,
   realpathSync as realpathSync3,
   renameSync,
@@ -73096,10 +73470,10 @@ import {
   writeFileSync as writeFileSync10
 } from "fs";
 import { constants as osConstants } from "os";
-import { dirname as dirname10, isAbsolute as isAbsolute4, join as join15, relative as relative8, resolve as resolve12, sep as sep6 } from "path";
+import { dirname as dirname10, isAbsolute as isAbsolute4, join as join16, relative as relative8, resolve as resolve12, sep as sep6 } from "path";
 
 // src/lib/update-check.ts
-import chalk43 from "chalk";
+import chalk44 from "chalk";
 import Conf3 from "conf";
 var UPDATE_CHECK_INTERVAL_MS = 60 * 60 * 1e3;
 var UPDATE_NOTIFY_INTERVAL_MS = 24 * 60 * 60 * 1e3;
@@ -73193,7 +73567,7 @@ function notifyFromCachedCliUpdate(args, options = {}) {
     console.error(message);
   });
   notify(
-    `${chalk43.yellow("Update available:")} ${chalk43.red(currentVersion)} ${chalk43.gray("->")} ${chalk43.green(latestVersion)}  ${chalk43.gray(`(${getUpgradeCommand()})`)}`
+    `${chalk44.yellow("Update available:")} ${chalk44.red(currentVersion)} ${chalk44.gray("->")} ${chalk44.green(latestVersion)}  ${chalk44.gray(`(${getUpgradeCommand()})`)}`
   );
   store.set("lastNotifiedAt", now.toISOString());
   store.set("lastNotifiedVersion", latestVersion);
@@ -73252,32 +73626,32 @@ function isStableCliVersion(version2) {
   return Boolean(version2 && /^\d+\.\d+\.\d+$/.test(version2));
 }
 function getManagedCliPaths(homeDir = getRuntypeHomeDir()) {
-  const root = join15(homeDir, "cli");
+  const root = join16(homeDir, "cli");
   return {
     home: homeDir,
     root,
-    versions: join15(root, "versions"),
-    state: join15(root, "current.json"),
-    lock: join15(root, "update.lock"),
-    log: join15(root, "update.log")
+    versions: join16(root, "versions"),
+    state: join16(root, "current.json"),
+    lock: join16(root, "update.lock"),
+    log: join16(root, "update.log")
   };
 }
 function getVersionRoot(paths, version2) {
   if (!isStableCliVersion(version2)) {
     throw new Error(`Invalid CLI version: ${version2}`);
   }
-  return join15(paths.versions, version2);
+  return join16(paths.versions, version2);
 }
 function getVersionPackageRoot(paths, version2) {
-  return join15(getVersionRoot(paths, version2), "node_modules", "@runtypelabs", "cli");
+  return join16(getVersionRoot(paths, version2), "node_modules", "@runtypelabs", "cli");
 }
 function getVersionEntrypoint(paths, version2) {
-  return join15(getVersionPackageRoot(paths, version2), "dist", "index.js");
+  return join16(getVersionPackageRoot(paths, version2), "dist", "index.js");
 }
 function getManagedCliState(homeDir = getRuntypeHomeDir()) {
   const { state } = getManagedCliPaths(homeDir);
   try {
-    const parsed = JSON.parse(readFileSync21(state, "utf8"));
+    const parsed = JSON.parse(readFileSync22(state, "utf8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch {
     return {};
@@ -73296,7 +73670,7 @@ function writeManagedCliState(paths, state) {
 }
 function readInstalledPackageVersion(packageRoot) {
   try {
-    const pkg = JSON.parse(readFileSync21(join15(packageRoot, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync22(join16(packageRoot, "package.json"), "utf8"));
     if (pkg.name === CLI_PACKAGE_NAME && isStableCliVersion(pkg.version)) {
       return pkg.version;
     }
@@ -73307,7 +73681,7 @@ function readInstalledPackageVersion(packageRoot) {
 function isHealthyManagedVersion(paths, version2) {
   if (!isStableCliVersion(version2)) return false;
   const packageRoot = getVersionPackageRoot(paths, version2);
-  return readInstalledPackageVersion(packageRoot) === version2 && existsSync17(getVersionEntrypoint(paths, version2));
+  return readInstalledPackageVersion(packageRoot) === version2 && existsSync18(getVersionEntrypoint(paths, version2));
 }
 function isPathInside(parent, child) {
   const canonicalize = (path20) => {
@@ -73323,7 +73697,7 @@ function isPathInside(parent, child) {
 function isSourceCheckout(entrypoint) {
   let current = dirname10(entrypoint);
   for (let depth = 0; depth < 8; depth += 1) {
-    if (existsSync17(join15(current, ".git")) || existsSync17(join15(current, "pnpm-workspace.yaml"))) {
+    if (existsSync18(join16(current, ".git")) || existsSync18(join16(current, "pnpm-workspace.yaml"))) {
       return true;
     }
     const parent = dirname10(current);
@@ -73335,7 +73709,7 @@ function isSourceCheckout(entrypoint) {
 function findProjectRoot(cwd) {
   let current = resolve12(cwd);
   while (true) {
-    if (existsSync17(join15(current, "package.json")) || existsSync17(join15(current, "pnpm-workspace.yaml"))) {
+    if (existsSync18(join16(current, "package.json")) || existsSync18(join16(current, "pnpm-workspace.yaml"))) {
       return current;
     }
     const parent = dirname10(current);
@@ -73353,7 +73727,7 @@ function shouldManageInstalledCli(context = {}) {
   const env = context.env ?? process.env;
   const entrypoint = context.entrypoint ?? process.argv[1];
   const cwd = context.cwd ?? process.cwd();
-  if (!entrypoint || !existsSync17(entrypoint)) return false;
+  if (!entrypoint || !existsSync18(entrypoint)) return false;
   if (env.NODE_ENV === "test" || Boolean(env.CI)) return false;
   if (env.RUNTYPE_DISABLE_AUTO_UPDATE === "true") return false;
   if (isEphemeralPackageRun(entrypoint, env)) return false;
@@ -73553,7 +73927,7 @@ async function installAndActivateCliVersion(version2, options = {}) {
   if (!releaseLock) return "busy";
   const commandRunner = options.commandRunner ?? defaultCommandRunner;
   const finalRoot = getVersionRoot(paths, version2);
-  const temporaryRoot = join15(paths.versions, `.${version2}-${process.pid}-${now.getTime()}`);
+  const temporaryRoot = join16(paths.versions, `.${version2}-${process.pid}-${now.getTime()}`);
   let installed = false;
   try {
     mkdirSync12(paths.versions, { recursive: true });
@@ -73583,9 +73957,9 @@ async function installAndActivateCliVersion(version2, options = {}) {
       if (installResult.status !== 0) {
         throw installResult.error ?? new Error(`npm install exited with ${installResult.status}`);
       }
-      const temporaryPackageRoot = join15(temporaryRoot, "node_modules", "@runtypelabs", "cli");
-      const temporaryEntrypoint = join15(temporaryPackageRoot, "dist", "index.js");
-      if (readInstalledPackageVersion(temporaryPackageRoot) !== version2 || !existsSync17(temporaryEntrypoint)) {
+      const temporaryPackageRoot = join16(temporaryRoot, "node_modules", "@runtypelabs", "cli");
+      const temporaryEntrypoint = join16(temporaryPackageRoot, "dist", "index.js");
+      if (readInstalledPackageVersion(temporaryPackageRoot) !== version2 || !existsSync18(temporaryEntrypoint)) {
         throw new Error(
           `Installed package did not contain a healthy ${CLI_PACKAGE_NAME}@${version2}`
         );
@@ -73610,7 +73984,7 @@ async function installAndActivateCliVersion(version2, options = {}) {
           `Installed CLI verification failed (expected ${version2}, got ${verifyResult.stdout.trim() || "no version"})`
         );
       }
-      if (existsSync17(finalRoot)) {
+      if (existsSync18(finalRoot)) {
         const corruptRoot = `${finalRoot}.replaced-${now.getTime()}`;
         renameSync(finalRoot, corruptRoot);
         try {
@@ -73657,7 +74031,7 @@ function isAutoUpdateWorkerInvocation(args, env = process.env) {
 function spawnAutoUpdateWorker(version2, context = {}) {
   if (!isStableCliVersion(version2)) return false;
   const entrypoint = context.entrypoint ?? process.argv[1];
-  if (!entrypoint || !existsSync17(entrypoint)) return false;
+  if (!entrypoint || !existsSync18(entrypoint)) return false;
   const paths = getManagedCliPaths();
   mkdirSync12(paths.root, { recursive: true });
   const logDescriptor = openSync(paths.log, "a", 384);
@@ -73749,9 +74123,9 @@ function rollbackManagedCli(homeDir = getRuntypeHomeDir()) {
 }
 
 // src/commands/update.ts
-var updateCommand = new Command35("update").description("Check for, install, or roll back CLI updates").option("--check", "Check for an update without installing it").option("--rollback", "Roll back the most recent managed update").action(async (options) => {
+var updateCommand = new Command36("update").description("Check for, install, or roll back CLI updates").option("--check", "Check for an update without installing it").option("--rollback", "Roll back the most recent managed update").action(async (options) => {
   if (options.check && options.rollback) {
-    console.error(chalk44.red("Use either --check or --rollback, not both"));
+    console.error(chalk45.red("Use either --check or --rollback, not both"));
     process.exitCode = 1;
     return;
   }
@@ -73759,10 +74133,10 @@ var updateCommand = new Command35("update").description("Check for, install, or
     try {
       const result = rollbackManagedCli();
       const target = result.to ?? "the package-manager-installed version";
-      console.log(chalk44.green(`Rolled back ${result.from} -> ${target}`));
-      console.log(chalk44.gray("The rollback will be used on the next invocation."));
+      console.log(chalk45.green(`Rolled back ${result.from} -> ${target}`));
+      console.log(chalk45.gray("The rollback will be used on the next invocation."));
     } catch (error51) {
-      console.error(chalk44.red(error51 instanceof Error ? error51.message : String(error51)));
+      console.error(chalk45.red(error51 instanceof Error ? error51.message : String(error51)));
       process.exitCode = 1;
     }
     return;
@@ -73770,19 +74144,19 @@ var updateCommand = new Command35("update").description("Check for, install, or
   const currentVersion = getCliVersion();
   const latestVersion = await refreshCliUpdateMetadata({ force: true });
   if (!latestVersion) {
-    console.error(chalk44.red("Unable to determine the latest CLI version from npm"));
+    console.error(chalk45.red("Unable to determine the latest CLI version from npm"));
     process.exitCode = 1;
     return;
   }
   const comparison = compareVersions(latestVersion, currentVersion);
   if (comparison <= 0) {
     const status = comparison === 0 ? "up to date" : "newer than the latest published version";
-    console.log(chalk44.green(`Runtype CLI ${currentVersion} is ${status}.`));
+    console.log(chalk45.green(`Runtype CLI ${currentVersion} is ${status}.`));
     return;
   }
   if (options.check) {
     console.log(
-      `${chalk44.yellow("Update available:")} ${chalk44.red(currentVersion)} ${chalk44.gray("->")} ${chalk44.green(latestVersion)}`
+      `${chalk45.yellow("Update available:")} ${chalk45.red(currentVersion)} ${chalk45.gray("->")} ${chalk45.green(latestVersion)}`
     );
     return;
   }
@@ -73790,22 +74164,22 @@ var updateCommand = new Command35("update").description("Check for, install, or
   try {
     const result = await installAndActivateCliVersion(latestVersion);
     if (result === "busy") {
-      console.log(chalk44.yellow("Another CLI update is already in progress."));
+      console.log(chalk45.yellow("Another CLI update is already in progress."));
       return;
     }
-    console.log(chalk44.green(`Runtype CLI ${latestVersion} is ready.`));
-    console.log(chalk44.gray("It will be used on the next invocation."));
+    console.log(chalk45.green(`Runtype CLI ${latestVersion} is ready.`));
+    console.log(chalk45.gray("It will be used on the next invocation."));
   } catch (error51) {
     console.error(
-      chalk44.red(`CLI update failed: ${error51 instanceof Error ? error51.message : error51}`)
+      chalk45.red(`CLI update failed: ${error51 instanceof Error ? error51.message : error51}`)
     );
     process.exitCode = 1;
   }
 });
 
 // src/commands/mcp.ts
-import { Command as Command36, InvalidArgumentError } from "commander";
-import chalk45 from "chalk";
+import { Command as Command37, InvalidArgumentError } from "commander";
+import chalk46 from "chalk";
 
 // src/lib/mcp-client.ts
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -74024,7 +74398,7 @@ async function resolveMcpArguments(options, dependencies = {}) {
 }
 
 // src/commands/mcp.ts
-var defaultDependencies = {
+var defaultDependencies2 = {
   ensureAuth,
   connect: connectMcpClient,
   resolveArguments: resolveMcpArguments,
@@ -74073,16 +74447,16 @@ async function withMcpClient(options, dependencies, operation, authOptions) {
 }
 function printTools(tools, target) {
   if (tools.length === 0) {
-    console.log(chalk45.gray("No MCP tools found"));
+    console.log(chalk46.gray("No MCP tools found"));
     return;
   }
   const label = target === "code" ? "Code Mode MCP Tools" : "MCP Tools";
-  console.log(chalk45.cyan(`${label}:`));
+  console.log(chalk46.cyan(`${label}:`));
   for (const tool of tools) {
     const description = tool.description?.split("\n", 1)[0];
-    console.log(`  ${chalk45.green(tool.name)}${description ? chalk45.gray(` \u2014 ${description}`) : ""}`);
+    console.log(`  ${chalk46.green(tool.name)}${description ? chalk46.gray(` \u2014 ${description}`) : ""}`);
   }
-  console.log(chalk45.dim(`
+  console.log(chalk46.dim(`
   Total: ${tools.length} tools`));
 }
 function printTool(tool) {
@@ -74112,8 +74486,8 @@ function printCallResult(result, json2) {
   printJson(result);
 }
 function createMcpCommand(overrides = {}) {
-  const dependencies = { ...defaultDependencies, ...overrides };
-  const command = new Command36("mcp").description(
+  const dependencies = { ...defaultDependencies2, ...overrides };
+  const command = new Command37("mcp").description(
     "Discover and call tools on the Runtype MCP servers"
   );
   addCommonOptions(
@@ -74126,7 +74500,7 @@ function createMcpCommand(overrides = {}) {
         else printTools(tools, options.server);
       });
     } catch (error51) {
-      console.error(chalk45.red(`Failed to list MCP tools: ${errorMessage(error51)}`));
+      console.error(chalk46.red(`Failed to list MCP tools: ${errorMessage(error51)}`));
       dependencies.setExitCode(1);
     }
   });
@@ -74144,7 +74518,7 @@ function createMcpCommand(overrides = {}) {
         else printTool(tool);
       });
     } catch (error51) {
-      console.error(chalk45.red(`Failed to inspect MCP tool: ${errorMessage(error51)}`));
+      console.error(chalk46.red(`Failed to inspect MCP tool: ${errorMessage(error51)}`));
       dependencies.setExitCode(1);
     }
   });
@@ -74182,7 +74556,7 @@ function createMcpCommand(overrides = {}) {
         usesMcpStdin(options) ? { interactive: false, exitOnFailure: false } : void 0
       );
     } catch (error51) {
-      console.error(chalk45.red(`MCP tool call failed: ${errorMessage(error51)}`));
+      console.error(chalk46.red(`MCP tool call failed: ${errorMessage(error51)}`));
       dependencies.setExitCode(1);
     }
   });
@@ -74193,8 +74567,8 @@ var mcpCommand = createMcpCommand();
 // src/commands/devices.ts
 import { spawn as spawn4 } from "child_process";
 import { readFile as readFile2 } from "fs/promises";
-import { Command as Command37 } from "commander";
-import chalk46 from "chalk";
+import { Command as Command38 } from "commander";
+import chalk47 from "chalk";
 
 // src/lib/device-provider.ts
 var DEVICE_SIDECAR_PROTOCOL_VERSION = 1;
@@ -74582,7 +74956,7 @@ var MacOSDeviceProvider = class {
 };
 
 // src/commands/devices.ts
-var defaultDependencies2 = {
+var defaultDependencies3 = {
   ensureAuth,
   createClient: (apiKey) => createCliClient(apiKey),
   createProvider: () => new MacOSDeviceProvider(),
@@ -74614,8 +74988,8 @@ function isRecordedRevocationError(error51) {
   return detail.toLowerCase().includes("revocation was recorded");
 }
 function printCommandError(label, error51) {
-  console.error(chalk46.red(label));
-  console.error(chalk46.red(errorMessage2(error51)));
+  console.error(chalk47.red(label));
+  console.error(chalk47.red(errorMessage2(error51)));
 }
 function printDevice(device) {
   printDetail("Runtype Device", [
@@ -74665,8 +75039,8 @@ async function runTail2(logPath, lines) {
   });
 }
 function createDevicesCommand(overrides = {}) {
-  const dependencies = { ...defaultDependencies2, ...overrides };
-  const command = new Command37("devices").description(
+  const dependencies = { ...defaultDependencies3, ...overrides };
+  const command = new Command38("devices").description(
     "Manage local computers connected to Runtype agents"
   );
   command.command("setup").description("Install, pair, and start Runtype Device on this Mac").option("--name <name>", "Device name shown in Runtype").option("--helper-path <path>", "Install a locally built native helper (internal alpha)").option("--json", "Output as JSON").action(async (options) => {
@@ -74710,26 +75084,26 @@ function createDevicesCommand(overrides = {}) {
         printJson(result);
         return;
       }
-      console.log(chalk46.green(`Paired and started ${paired.name}`));
-      console.log(`  Device ID: ${chalk46.green(paired.deviceId)}`);
+      console.log(chalk47.green(`Paired and started ${paired.name}`));
+      console.log(`  Device ID: ${chalk47.green(paired.deviceId)}`);
       console.log(
-        `  Relay: ${device?.status?.online ? chalk46.green("online") : chalk46.yellow("connecting")}`
+        `  Relay: ${device?.status?.online ? chalk47.green("online") : chalk47.yellow("connecting")}`
       );
       if (device?.mcpUrl) console.log(`  MCP URL: ${device.mcpUrl}`);
       if (local.messagesDatabaseReadable !== true) {
         console.log(
-          chalk46.yellow(
+          chalk47.yellow(
             `
 Grant Full Disk Access to ${String(local.executablePath)} to enable iMessage reads.`
           )
         );
       }
-      console.log(chalk46.gray("iMessage sending remains disabled by local policy."));
+      console.log(chalk47.gray("iMessage sending remains disabled by local policy."));
     } catch (error51) {
       printCommandError("Failed to set up Runtype Device", error51);
       if (pairedDeviceId) {
         console.error(
-          chalk46.yellow(
+          chalk47.yellow(
             `Pairing completed as ${pairedDeviceId}, but startup did not finish. Run \`runtype devices install\` after correcting the error.`
           )
         );
@@ -74745,7 +75119,7 @@ Grant Full Disk Access to ${String(local.executablePath)} to enable iMessage rea
       if (options.json) {
         printJson({ installation, service });
       } else {
-        console.log(chalk46.green("Runtype Device is installed and running"));
+        console.log(chalk47.green("Runtype Device is installed and running"));
         console.log(`  Helper: ${installation.binaryPath}`);
         if (typeof service.logPath === "string") console.log(`  Logs: ${service.logPath}`);
       }
@@ -74764,13 +75138,13 @@ Grant Full Disk Access to ${String(local.executablePath)} to enable iMessage rea
         return;
       }
       if (devices.length === 0) {
-        console.log(chalk46.gray("No paired devices"));
+        console.log(chalk47.gray("No paired devices"));
         return;
       }
-      console.log(chalk46.cyan("Runtype Devices:"));
+      console.log(chalk47.cyan("Runtype Devices:"));
       for (const device of devices) {
         const state = device.revokedAt ? "revoked" : device.status?.online ? "online" : "offline";
-        console.log(`  ${chalk46.green(device.id)}  ${device.name}  ${state}`);
+        console.log(`  ${chalk47.green(device.id)}  ${device.name}  ${state}`);
       }
     } catch (error51) {
       printCommandError("Failed to list Runtype devices", error51);
@@ -74821,7 +75195,7 @@ Grant Full Disk Access to ${String(local.executablePath)} to enable iMessage rea
         printJson(result);
       } else {
         console.log(
-          healthy ? chalk46.green("Runtype Device is healthy") : chalk46.yellow("Runtype Device needs attention")
+          healthy ? chalk47.green("Runtype Device is healthy") : chalk47.yellow("Runtype Device needs attention")
         );
         console.log(`  Platform supported: ${probe.supported ? "yes" : "no"}`);
         console.log(`  Helper installed: ${probe.installed ? "yes" : "no"}`);
@@ -74833,7 +75207,7 @@ Grant Full Disk Access to ${String(local.executablePath)} to enable iMessage rea
           );
           if (local.messagesDatabaseReadable !== true) {
             console.log(
-              chalk46.yellow(`  Grant Full Disk Access to ${String(local.executablePath)}`)
+              chalk47.yellow(`  Grant Full Disk Access to ${String(local.executablePath)}`)
             );
           }
         }
@@ -74846,7 +75220,7 @@ Grant Full Disk Access to ${String(local.executablePath)} to enable iMessage rea
   });
   command.command("policy <mode>").description("Set local iMessage send policy (allow-send or deny-send)").option("--json", "Output as JSON").action(async (mode, options) => {
     if (mode !== "allow-send" && mode !== "deny-send") {
-      console.error(chalk46.red("Policy must be allow-send or deny-send"));
+      console.error(chalk47.red("Policy must be allow-send or deny-send"));
       dependencies.setExitCode(1);
       return;
     }
@@ -74867,15 +75241,15 @@ Grant Full Disk Access to ${String(local.executablePath)} to enable iMessage rea
       if (options.json) printJson(result);
       else {
         console.log(
-          chalk46.green(
+          chalk47.green(
             `Local iMessage sending is ${mode === "allow-send" ? "enabled" : "disabled"}`
           )
         );
         if (service)
-          console.log(chalk46.gray("Restarted the device service to publish capabilities."));
+          console.log(chalk47.gray("Restarted the device service to publish capabilities."));
         else {
           console.log(
-            chalk46.yellow(
+            chalk47.yellow(
               "The device service is not installed; run `runtype devices install` to publish this policy."
             )
           );
@@ -74906,7 +75280,7 @@ Grant Full Disk Access to ${String(local.executablePath)} to enable iMessage rea
   });
   command.command("revoke <id>").description("Revoke a paired device in Runtype").option("--yes", "Confirm irreversible device revocation").option("--json", "Output as JSON").action(async (id, options) => {
     if (!options.yes) {
-      console.error(chalk46.red("Pass --yes to confirm irreversible device revocation"));
+      console.error(chalk47.red("Pass --yes to confirm irreversible device revocation"));
       dependencies.setExitCode(1);
       return;
     }
@@ -74918,8 +75292,8 @@ Grant Full Disk Access to ${String(local.executablePath)} to enable iMessage rea
       );
       if (options.json) printJson(device);
       else {
-        console.log(chalk46.green(`Revoked ${device.name} (${device.id})`));
-        console.log(chalk46.gray("If this is the local Mac, run `runtype devices reset --yes`."));
+        console.log(chalk47.green(`Revoked ${device.name} (${device.id})`));
+        console.log(chalk47.gray("If this is the local Mac, run `runtype devices reset --yes`."));
       }
     } catch (error51) {
       if (isRecordedRevocationError(error51)) {
@@ -74932,12 +75306,12 @@ Grant Full Disk Access to ${String(local.executablePath)} to enable iMessage rea
         if (options.json) printJson(result);
         else {
           console.error(
-            chalk46.yellow(
+            chalk47.yellow(
               `Revocation was recorded for ${id}, but relay disconnection was not confirmed.`
             )
           );
           console.error(
-            chalk46.yellow("Retry this command, and reset the local Mac if applicable.")
+            chalk47.yellow("Retry this command, and reset the local Mac if applicable.")
           );
         }
         dependencies.setExitCode(1);
@@ -74970,7 +75344,7 @@ Grant Full Disk Access to ${String(local.executablePath)} to enable iMessage rea
       if (entries.at(-1) === "") entries.pop();
       const selected = entries.slice(-lines).join("\n");
       if (selected) console.log(selected);
-      else console.log(chalk46.gray("No local device logs yet"));
+      else console.log(chalk47.gray("No local device logs yet"));
     } catch (error51) {
       printCommandError("Failed to read Runtype Device logs", error51);
       dependencies.setExitCode(1);
@@ -74982,7 +75356,7 @@ Grant Full Disk Access to ${String(local.executablePath)} to enable iMessage rea
       const service = await provider.invoke("uninstall");
       const removedBinary = options.removeBinary ? await provider.removeInstalledBinary() : false;
       if (options.json) printJson({ service, removedBinary });
-      else console.log(chalk46.green("Stopped and uninstalled the local Runtype Device service"));
+      else console.log(chalk47.green("Stopped and uninstalled the local Runtype Device service"));
     } catch (error51) {
       printCommandError("Failed to uninstall Runtype Device", error51);
       dependencies.setExitCode(1);
@@ -74990,7 +75364,7 @@ Grant Full Disk Access to ${String(local.executablePath)} to enable iMessage rea
   });
   command.command("reset").description("Clear local pairing state and rotate the native signing identity").option("--yes", "Confirm destructive local reset").option("--json", "Output as JSON").action(async (options) => {
     if (!options.yes) {
-      console.error(chalk46.red("Pass --yes to confirm destructive local reset"));
+      console.error(chalk47.red("Pass --yes to confirm destructive local reset"));
       dependencies.setExitCode(1);
       return;
     }
@@ -74998,9 +75372,9 @@ Grant Full Disk Access to ${String(local.executablePath)} to enable iMessage rea
       const result = await dependencies.createProvider().invoke("reset", { rotateIdentity: true });
       if (options.json) printJson(result);
       else {
-        console.log(chalk46.green("Cleared local device state and rotated the signing identity"));
+        console.log(chalk47.green("Cleared local device state and rotated the signing identity"));
         console.log(
-          chalk46.gray("Revoke the old device in Runtype if it has not already been revoked.")
+          chalk47.gray("Revoke the old device in Runtype if it has not already been revoked.")
         );
       }
     } catch (error51) {
@@ -75031,7 +75405,7 @@ function registerGlobalOptionForwarding(program2) {
 // src/index.ts
 loadEnv();
 setCliTitle();
-var program = new Command38();
+var program = new Command39();
 program.name("runtype").description("CLI for Runtype AI Platform").version(getCliVersion()).option("-v, --verbose", "Enable verbose output").option("--api-url <url>", "Override API URL").option("--json", "Output as JSON");
 program.addCommand(initCommand);
 program.addCommand(loginCommand);
@@ -75068,6 +75442,7 @@ program.addCommand(deployCommand);
 program.addCommand(skillsCommand);
 program.addCommand(updateCommand);
 program.addCommand(installMcpCommand);
+program.addCommand(onboardCommand);
 program.addCommand(mcpCommand);
 program.addCommand(devicesCommand);
 program.addCommand(appsCommand, { hidden: process.env.RUNTYPE_APPS_CLI !== "1" });
@@ -75102,17 +75477,17 @@ async function run() {
 run().catch((error51) => {
   const commanderError = error51;
   if (commanderError.code === "commander.missingArgument") {
-    console.error(chalk47.red(`Error: ${commanderError.message}`));
+    console.error(chalk48.red(`Error: ${commanderError.message}`));
     process.exit(1);
   } else if (commanderError.code === "commander.unknownOption") {
-    console.error(chalk47.red(`Error: ${commanderError.message}`));
+    console.error(chalk48.red(`Error: ${commanderError.message}`));
     process.exit(1);
   } else if (commanderError.code === "commander.unknownCommand") {
     process.exit(1);
   } else if (commanderError.code === "commander.help" || commanderError.code === "commander.helpDisplayed" || commanderError.code === "commander.version") {
     process.exit(0);
   } else {
-    console.error(chalk47.red("An unexpected error occurred:"));
+    console.error(chalk48.red("An unexpected error occurred:"));
     console.error(error51);
     process.exit(1);
   }
@@ -75121,12 +75496,12 @@ async function handleNoCommand() {
   const store = new CredentialStore();
   const hasCredentials = await store.hasCredentials();
   if (!hasCredentials) {
-    console.log(chalk47.cyan("\nWelcome to Runtype CLI!\n"));
+    console.log(chalk48.cyan("\nWelcome to Runtype CLI!\n"));
     console.log("It looks like this is your first time. Run the setup wizard:");
-    console.log(`  ${chalk47.green("runtype init")}
+    console.log(`  ${chalk48.green("runtype init")}
 `);
     console.log("Or see all available commands:");
-    console.log(`  ${chalk47.green("runtype --help")}
+    console.log(`  ${chalk48.green("runtype --help")}
 `);
   } else {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runtypelabs/cli",
-  "version": "2.29.0",
+  "version": "2.30.0",
   "description": "Command-line interface for Runtype AI platform",
   "type": "module",
   "main": "dist/index.js",
@@ -41,7 +41,7 @@
     "tsx": "^4.7.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.0",
-    "@runtypelabs/shared": "3.4.2"
+    "@runtypelabs/shared": "3.4.3"
   },
   "engines": {
     "node": ">=22.12.0"