@scheduler-systems/gal-run 0.0.263 → 0.0.266

package/dist/index.cjs

@@ -3970,7 +3970,7 @@ var cliVersion, defaultApiUrl, BUILD_CONSTANTS, constants_default;
 var init_constants = __esm({
   "src/constants.ts"() {
     "use strict";
-    cliVersion = true ? "0.0.263" : "0.0.0-dev";
+    cliVersion = true ? "0.0.266" : "0.0.0-dev";
     defaultApiUrl = true ? "https://api.gal.run" : "http://localhost:3000";
     BUILD_CONSTANTS = Object.freeze([cliVersion, defaultApiUrl]);
     constants_default = BUILD_CONSTANTS;
@@ -4812,7 +4812,7 @@ function detectEnvironment() {
     return "dev";
   }
   try {
-    const version = true ? "0.0.263" : void 0;
+    const version = true ? "0.0.266" : void 0;
     if (version && version.includes("-local")) {
       return "dev";
     }
@@ -5181,7 +5181,7 @@ function getId() {
 }
 function getCliVersion() {
   try {
-    return true ? "0.0.263" : "0.0.0-dev";
+    return true ? "0.0.266" : "0.0.0-dev";
   } catch {
     return "0.0.0-dev";
   }
@@ -7731,7 +7731,7 @@ var init_feature_flags2 = __esm({
     init_src();
     COMMAND_CATEGORIES = {
       // Core convenience package (always visible)
-      core: ["auth", "sync", "mcp", "feedback", "update", "hooks", "status", "discover", "approve", "propose", "workspace", "fetch", "join", "scan", "memory"],
+      core: ["auth", "sync", "mcp", "feedback", "update", "hooks", "status", "discover", "approve", "approved-config", "propose", "workspace", "fetch", "join", "scan", "memory"],
       // Internal development commands (requires admin org membership or GAL_INTERNAL=true)
       internal: [
         "admin",
@@ -20802,56 +20802,6 @@ var init_agent = __esm({
   }
 });
 
-// src/utils/capability-checker.ts
-async function checkOrgCapability(authRepo, orgName, requiredCapability, commandName) {
-  try {
-    const context = await authRepo.getUserContext();
-    const org = context.orgs.find((o) => o.name === orgName);
-    if (!org) {
-      console.error(source_default.red(`You don't have access to organization "${orgName}"`));
-      console.log(source_default.dim("\nAvailable organizations:"));
-      if (context.orgs.length === 0) {
-        console.log(source_default.dim("  (none)"));
-        console.log(source_default.dim("\nMake sure you have joined the organization on GitHub."));
-      } else {
-        context.orgs.forEach((o) => {
-          console.log(source_default.dim(`  - ${o.name} (${o.githubRole})`));
-        });
-      }
-      return false;
-    }
-    if (!org.capabilities[requiredCapability]) {
-      const capabilityMessages = {
-        canManageApprovedConfig: `manage approved configs for ${orgName}`,
-        canRunDiscovery: `run discovery scans for ${orgName}`,
-        canManageTeam: `manage team members for ${orgName}`,
-        canSyncConfig: `sync configs from ${orgName}`
-      };
-      console.error(source_default.red(`You don't have permission to ${capabilityMessages[requiredCapability]}`));
-      console.log(source_default.dim(`
-Your role in ${orgName}: ${source_default.white(org.githubRole)}`));
-      console.log(source_default.dim("Required role: admin"));
-      console.log(source_default.dim("\nContact your organization admin to grant you admin access on GitHub."));
-      return false;
-    }
-    return true;
-  } catch (error2) {
-    if ((error2 instanceof Error ? error2.message : "").includes("401") || (error2 instanceof Error ? error2.message : "").includes("Unauthorized")) {
-      console.error(source_default.red("Authentication failed. Please log in again:"));
-      console.log(source_default.dim("  gal auth login"));
-    } else {
-      console.error(source_default.red(`Failed to check permissions: ${error2 instanceof Error ? error2.message : String(error2)}`));
-    }
-    return false;
-  }
-}
-var init_capability_checker = __esm({
-  "src/utils/capability-checker.ts"() {
-    "use strict";
-    init_source();
-  }
-});
-
 // src/services/CoreServiceProvider.ts
 var CoreServiceProvider;
 var init_CoreServiceProvider = __esm({
@@ -21075,6 +21025,378 @@ var init_CoreServiceProvider = __esm({
   }
 });
 
+// src/commands/approved-config.ts
+function makeProvider(config) {
+  return new CoreServiceProvider({
+    apiUrl: config.apiUrl || process.env.GAL_API_URL || "",
+    authToken: config.authToken
+  });
+}
+function resolveOrg(options, config) {
+  const org = options.org || config.defaultOrg;
+  if (!org) {
+    console.error(source_default.red("No organization specified."));
+    console.error(source_default.dim("Use --org <name> or run `gal workspace use <name>` to set a default."));
+    process.exit(1);
+  }
+  return org;
+}
+function printApprovedConfig(config, org) {
+  console.log();
+  console.log(source_default.bold(`Approved config for "${org}" (${config.platform})`));
+  console.log(source_default.dim(`  Version:     ${config.version || "unknown"}`));
+  console.log(source_default.dim(`  Approved at: ${config.approvedAt || "unknown"}`));
+  console.log(source_default.dim(`  Approved by: ${config.approvedBy || "unknown"}`));
+  console.log(source_default.dim(`  Hash:        ${config.hash || "unknown"}`));
+  if (config.policyName) {
+    console.log(source_default.dim(`  Policy:      ${config.policyName}`));
+  }
+  console.log();
+  const commandCount = config.commandCount ?? config.commands?.length ?? 0;
+  const subagentCount = config.subagentCount ?? config.subagents?.length ?? 0;
+  const skillCount = config.skillCount ?? config.skills?.length ?? 0;
+  const ruleCount = config.ruleCount ?? config.rules?.length ?? 0;
+  console.log(source_default.bold("  Contents:"));
+  console.log(`    Commands:  ${commandCount}`);
+  console.log(`    Agents:    ${subagentCount}`);
+  console.log(`    Skills:    ${skillCount}`);
+  console.log(`    Rules:     ${ruleCount}`);
+  console.log(`    Instructions: ${config.instructions ? "yes" : "no"}`);
+  console.log(`    Settings:     ${config.settings ? "yes" : "no"}`);
+  if (commandCount > 0 && config.commands) {
+    console.log();
+    console.log(source_default.bold("  Commands:"));
+    config.commands.forEach((c) => console.log(`    /${c.name}`));
+  }
+  if (subagentCount > 0 && config.subagents) {
+    console.log();
+    console.log(source_default.bold("  Agents:"));
+    config.subagents.forEach((s) => console.log(`    ${s.name}`));
+  }
+  if (skillCount > 0 && config.skills) {
+    console.log();
+    console.log(source_default.bold("  Skills:"));
+    config.skills.forEach((s) => console.log(`    ${s.name}`));
+  }
+  if (ruleCount > 0 && config.rules) {
+    console.log();
+    console.log(source_default.bold("  Rules:"));
+    config.rules.forEach((r) => console.log(`    ${r.name}`));
+  }
+  console.log();
+}
+function createApprovedConfigCommand() {
+  const command = new Command("approved-config");
+  command.description("View and manage the org-approved AI agent configuration");
+  command.command("show").description("Show the current approved configuration for an organization").option("-o, --org <name>", "Organization name (default: from config)").option("-p, --platform <platform>", "Platform (default: claude)", "claude").option("--json", "Output as JSON").action(async (options) => {
+    const config = ConfigManager.load();
+    if (!config.authToken) {
+      console.error(source_default.red("Not authenticated. Run: gal auth login"));
+      process.exit(1);
+    }
+    const org = resolveOrg(options, config);
+    const provider = makeProvider(config);
+    const configRepo = provider.getConfigRepository();
+    const spinner = options.json ? null : ora(`Fetching approved config for "${org}"...`).start();
+    try {
+      const approved = await configRepo.getApprovedConfig(org, options.platform);
+      spinner?.stop();
+      if (!approved) {
+        if (options.json) {
+          console.log(JSON.stringify({ organization: org, platform: options.platform, approved: null }));
+        } else {
+          console.log(source_default.yellow(`No approved config found for "${org}" (${options.platform}).`));
+          console.log(source_default.dim("Run `gal approve` to set one."));
+        }
+        return;
+      }
+      if (options.json) {
+        console.log(JSON.stringify({ organization: org, approved }));
+      } else {
+        printApprovedConfig(approved, org);
+      }
+    } catch (error2) {
+      spinner?.stop();
+      const msg = error2 instanceof Error ? error2.message : String(error2);
+      if (options.json) {
+        console.log(JSON.stringify({ error: msg }));
+      } else {
+        console.error(source_default.red(`Error: ${msg}`));
+      }
+      process.exit(1);
+    }
+  });
+  command.command("diff").description("Show diff between local configs and the approved config").option("-o, --org <name>", "Organization name (default: from config)").option("-p, --platform <platform>", "Platform (default: claude)", "claude").option("-d, --dir <path>", "Local directory to compare against (default: cwd)").option("--json", "Output as JSON").action(async (options) => {
+    const config = ConfigManager.load();
+    if (!config.authToken) {
+      console.error(source_default.red("Not authenticated. Run: gal auth login"));
+      process.exit(1);
+    }
+    const org = resolveOrg(options, config);
+    const provider = makeProvider(config);
+    const configRepo = provider.getConfigRepository();
+    const spinner = options.json ? null : ora(`Fetching approved config for "${org}"...`).start();
+    try {
+      let findMdFiles2 = function(dir) {
+        if (!existsSync41(dir)) return [];
+        const entries = readdirSync16(dir, { withFileTypes: true });
+        const files = [];
+        for (const entry of entries) {
+          const fullPath = join45(dir, entry.name);
+          if (entry.isDirectory()) files.push(...findMdFiles2(fullPath));
+          else if (entry.name.endsWith(".md")) files.push(fullPath);
+        }
+        return files;
+      };
+      var findMdFiles = findMdFiles2;
+      const approved = await configRepo.getApprovedConfig(org, options.platform);
+      spinner?.stop();
+      if (!approved) {
+        if (options.json) {
+          console.log(JSON.stringify({ organization: org, platform: options.platform, approved: null, diff: null }));
+        } else {
+          console.log(source_default.yellow(`No approved config found for "${org}" (${options.platform}).`));
+          console.log(source_default.dim("Run `gal approve` to set one."));
+        }
+        return;
+      }
+      const { existsSync: existsSync41, readdirSync: readdirSync16, readFileSync: readFileSync37 } = await import("fs");
+      const { join: join45, relative: relative10, basename: basename9 } = await import("path");
+      const baseDir = options.dir || process.cwd();
+      const commandsDir = join45(baseDir, ".claude", "commands");
+      const agentsDir = join45(baseDir, ".claude", "agents");
+      const localCommandNames = findMdFiles2(commandsDir).map(
+        (f) => relative10(commandsDir, f).replace(/\.md$/, "").replace(/\//g, ":")
+      );
+      const localAgentNames = findMdFiles2(agentsDir).map(
+        (f) => relative10(agentsDir, f).replace(/\.md$/, "").replace(/\//g, ":")
+      );
+      const approvedCommandNames = (approved.commands ?? []).map((c) => c.name);
+      const approvedAgentNames = (approved.subagents ?? []).map((s) => s.name);
+      const addedCommands = localCommandNames.filter((n) => !approvedCommandNames.includes(n));
+      const removedCommands = approvedCommandNames.filter((n) => !localCommandNames.includes(n));
+      const addedAgents = localAgentNames.filter((n) => !approvedAgentNames.includes(n));
+      const removedAgents = approvedAgentNames.filter((n) => !localAgentNames.includes(n));
+      if (options.json) {
+        console.log(JSON.stringify({
+          organization: org,
+          platform: options.platform,
+          diff: {
+            commands: { added: addedCommands, removed: removedCommands },
+            agents: { added: addedAgents, removed: removedAgents }
+          }
+        }));
+        return;
+      }
+      const hasChanges = addedCommands.length || removedCommands.length || addedAgents.length || removedAgents.length;
+      if (!hasChanges) {
+        console.log(source_default.green(`\u2713 Local configs match approved config for "${org}" (${options.platform}).`));
+        return;
+      }
+      console.log();
+      console.log(source_default.bold(`Diff: local vs. approved config for "${org}" (${options.platform})`));
+      console.log();
+      if (addedCommands.length) {
+        console.log(source_default.bold("  Commands only in local (would be added on `gal approve`):"));
+        addedCommands.forEach((n) => console.log(source_default.green(`    + /${n}`)));
+      }
+      if (removedCommands.length) {
+        console.log(source_default.bold("  Commands only in approved (would be removed locally):"));
+        removedCommands.forEach((n) => console.log(source_default.red(`    - /${n}`)));
+      }
+      if (addedAgents.length) {
+        console.log(source_default.bold("  Agents only in local:"));
+        addedAgents.forEach((n) => console.log(source_default.green(`    + ${n}`)));
+      }
+      if (removedAgents.length) {
+        console.log(source_default.bold("  Agents only in approved:"));
+        removedAgents.forEach((n) => console.log(source_default.red(`    - ${n}`)));
+      }
+      console.log();
+    } catch (error2) {
+      spinner?.stop();
+      const msg = error2 instanceof Error ? error2.message : String(error2);
+      if (options.json) {
+        console.log(JSON.stringify({ error: msg }));
+      } else {
+        console.error(source_default.red(`Error: ${msg}`));
+      }
+      process.exit(1);
+    }
+  });
+  command.command("remove <type> <name>").description("Remove a specific item (command, agent, skill, rule) from the approved config").option("-o, --org <name>", "Organization name (default: from config)").option("-p, --platform <platform>", "Platform (default: claude)", "claude").option("--dry-run", "Preview removal without making changes").option("--json", "Output as JSON").action(async (type, name, options) => {
+    const validTypes = ["command", "agent", "skill", "rule"];
+    if (!validTypes.includes(type)) {
+      const msg = `Invalid type "${type}". Valid types: ${validTypes.join(", ")}`;
+      if (options.json) console.log(JSON.stringify({ error: msg }));
+      else console.error(source_default.red(msg));
+      process.exit(1);
+    }
+    const config = ConfigManager.load();
+    if (!config.authToken) {
+      console.error(source_default.red("Not authenticated. Run: gal auth login"));
+      process.exit(1);
+    }
+    const org = resolveOrg(options, config);
+    const provider = makeProvider(config);
+    const configRepo = provider.getConfigRepository();
+    if (options.dryRun) {
+      if (options.json) {
+        console.log(JSON.stringify({ dryRun: true, type, name, org, platform: options.platform }));
+      } else {
+        console.log(source_default.yellow(`Dry run: would remove ${type} "${name}" from "${org}" (${options.platform}).`));
+      }
+      return;
+    }
+    const spinner = options.json ? null : ora(`Removing ${type} "${name}"...`).start();
+    try {
+      const items = {};
+      if (type === "command") items.commands = [name];
+      else if (type === "agent") items.subagents = [name];
+      else if (type === "skill") items.skills = [name];
+      else if (type === "rule") items.rules = [name];
+      const result = await configRepo.removeFromApprovedConfig(org, options.platform, items);
+      spinner?.succeed(`Removed ${type} "${name}"`);
+      if (options.json) {
+        console.log(JSON.stringify({ success: true, ...result }));
+      } else {
+        console.log(source_default.dim(`  Remaining: ${result.remaining.commands} commands, ${result.remaining.subagents} agents, ${result.remaining.skills} skills, ${result.remaining.rules} rules`));
+        console.log(source_default.dim(`  New hash: ${result.hash}`));
+      }
+    } catch (error2) {
+      spinner?.stop();
+      const msg = error2 instanceof Error ? error2.message : String(error2);
+      if (options.json) {
+        console.log(JSON.stringify({ error: msg }));
+      } else {
+        console.error(source_default.red(`Error: ${msg}`));
+      }
+      process.exit(1);
+    }
+  });
+  command.command("clear").description("Clear the entire approved configuration for a platform").option("-o, --org <name>", "Organization name (default: from config)").option("-p, --platform <platform>", "Platform (default: claude)", "claude").option("--dry-run", "Preview clearing without making changes").option("--json", "Output as JSON").action(async (options) => {
+    const config = ConfigManager.load();
+    if (!config.authToken) {
+      console.error(source_default.red("Not authenticated. Run: gal auth login"));
+      process.exit(1);
+    }
+    const org = resolveOrg(options, config);
+    if (options.dryRun) {
+      if (options.json) {
+        console.log(JSON.stringify({ dryRun: true, org, platform: options.platform }));
+      } else {
+        console.log(source_default.yellow(`Dry run: would clear approved config for "${org}" (${options.platform}).`));
+      }
+      return;
+    }
+    const provider = makeProvider(config);
+    const configRepo = provider.getConfigRepository();
+    const spinner = options.json ? null : ora(`Clearing approved config for "${org}" (${options.platform})...`).start();
+    try {
+      await configRepo.deleteApprovedConfig(org, options.platform);
+      spinner?.succeed(`Cleared approved config for "${org}" (${options.platform})`);
+      if (options.json) {
+        console.log(JSON.stringify({ success: true, org, platform: options.platform }));
+      }
+    } catch (error2) {
+      spinner?.stop();
+      const msg = error2 instanceof Error ? error2.message : String(error2);
+      if (options.json) {
+        console.log(JSON.stringify({ error: msg }));
+      } else {
+        console.error(source_default.red(`Error: ${msg}`));
+      }
+      process.exit(1);
+    }
+  });
+  command.command("export").description("Export the approved configuration to stdout or a file").option("-o, --org <name>", "Organization name (default: from config)").option("-p, --platform <platform>", "Platform (default: claude)", "claude").option("--format <format>", "Output format: json (default)", "json").action(async (options) => {
+    const config = ConfigManager.load();
+    if (!config.authToken) {
+      console.error(source_default.red("Not authenticated. Run: gal auth login"));
+      process.exit(1);
+    }
+    const org = resolveOrg(options, config);
+    const provider = makeProvider(config);
+    const configRepo = provider.getConfigRepository();
+    const spinner = ora(`Fetching approved config for "${org}"...`).start();
+    try {
+      const approved = await configRepo.getApprovedConfig(org, options.platform);
+      spinner?.stop();
+      if (!approved) {
+        console.log(JSON.stringify({ organization: org, platform: options.platform, approved: null }));
+        return;
+      }
+      console.log(JSON.stringify({ organization: org, approved }, null, 2));
+    } catch (error2) {
+      spinner?.stop();
+      const msg = error2 instanceof Error ? error2.message : String(error2);
+      console.error(source_default.red(`Error: ${msg}`));
+      process.exit(1);
+    }
+  });
+  return command;
+}
+var init_approved_config = __esm({
+  "src/commands/approved-config.ts"() {
+    "use strict";
+    init_esm();
+    init_source();
+    init_ora();
+    init_config_manager();
+    init_CoreServiceProvider();
+  }
+});
+
+// src/utils/capability-checker.ts
+async function checkOrgCapability(authRepo, orgName, requiredCapability, commandName) {
+  try {
+    const context = await authRepo.getUserContext();
+    const org = context.orgs.find((o) => o.name === orgName);
+    if (!org) {
+      console.error(source_default.red(`You don't have access to organization "${orgName}"`));
+      console.log(source_default.dim("\nAvailable organizations:"));
+      if (context.orgs.length === 0) {
+        console.log(source_default.dim("  (none)"));
+        console.log(source_default.dim("\nMake sure you have joined the organization on GitHub."));
+      } else {
+        context.orgs.forEach((o) => {
+          console.log(source_default.dim(`  - ${o.name} (${o.githubRole})`));
+        });
+      }
+      return false;
+    }
+    if (!org.capabilities[requiredCapability]) {
+      const capabilityMessages = {
+        canManageApprovedConfig: `manage approved configs for ${orgName}`,
+        canRunDiscovery: `run discovery scans for ${orgName}`,
+        canManageTeam: `manage team members for ${orgName}`,
+        canSyncConfig: `sync configs from ${orgName}`
+      };
+      console.error(source_default.red(`You don't have permission to ${capabilityMessages[requiredCapability]}`));
+      console.log(source_default.dim(`
+Your role in ${orgName}: ${source_default.white(org.githubRole)}`));
+      console.log(source_default.dim("Required role: admin"));
+      console.log(source_default.dim("\nContact your organization admin to grant you admin access on GitHub."));
+      return false;
+    }
+    return true;
+  } catch (error2) {
+    if ((error2 instanceof Error ? error2.message : "").includes("401") || (error2 instanceof Error ? error2.message : "").includes("Unauthorized")) {
+      console.error(source_default.red("Authentication failed. Please log in again:"));
+      console.log(source_default.dim("  gal auth login"));
+    } else {
+      console.error(source_default.red(`Failed to check permissions: ${error2 instanceof Error ? error2.message : String(error2)}`));
+    }
+    return false;
+  }
+}
+var init_capability_checker = __esm({
+  "src/utils/capability-checker.ts"() {
+    "use strict";
+    init_source();
+  }
+});
+
 // ../../node_modules/.pnpm/yaml@2.8.2/node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS({
   "../../node_modules/.pnpm/yaml@2.8.2/node_modules/yaml/dist/nodes/identity.js"(exports2) {
@@ -29348,7 +29670,7 @@ function incrementVersion(version) {
   return version;
 }
 function createApproveCommand() {
-  const approve = new Command("approve").description("Upload local configs to org approved config").option("-o, --org <name>", "Organization name (default: from config)").option("-p, --platform <platform>", "Platform to approve for", "claude").option("-d, --dir <path>", "Directory to read configs from", process.cwd()).option("--dry-run", "Preview what would be uploaded without making changes").option("--commands-only", "Only approve commands (no agents, instructions, settings)").option("--agents-only", "Only approve agents (no commands, instructions, settings)").option("--clear", "Clear entire approved config for the platform").option("--remove <names...>", "Remove specific commands/agents by name (comma-separated)").option("--local", "Save to .gal/config.yaml locally (no auth required, no API upload)").action(async (options) => {
+  const approve = new Command("approve").description("Upload local configs to org approved config").option("-o, --org <name>", "Organization name (default: from config)").option("-p, --platform <platform>", "Platform to approve for", "claude").option("-d, --dir <path>", "Directory to read configs from", process.cwd()).option("--dry-run", "Preview what would be uploaded without making changes").option("--commands-only", "Only approve commands (no agents, instructions, settings)").option("--agents-only", "Only approve agents (no commands, instructions, settings)").option("--clear", "Clear entire approved config for the platform").option("--remove <names...>", "Remove specific commands/agents by name (comma-separated)").option("--local", "Save to .gal/config.yaml locally (no auth required, no API upload)").option("--from-discovered", "Approve configs sourced from the discovered repositories pool").option("--type <type>", "Filter discovered configs by type: command, agent, skill, rule").option("--repo <repo>", "Filter discovered configs to a specific repository").option("--diff", "Show a unified diff before approving").action(async (options) => {
     if (options.commandsOnly && options.agentsOnly) {
       console.error(source_default.red("\nError: --commands-only and --agents-only are mutually exclusive."));
       console.log(source_default.dim("Use one or the other, or neither to approve all configs.\n"));
@@ -29362,6 +29684,67 @@ function createApproveCommand() {
       console.error(source_default.red("\nError: --remove cannot be combined with --commands-only or --agents-only."));
       process.exit(1);
     }
+    if (options.fromDiscovered) {
+      const config2 = ConfigManager.load();
+      if (!config2.authToken) {
+        console.error(source_default.red("Not authenticated. Run: gal auth login"));
+        process.exit(1);
+      }
+      const orgName2 = options.org || config2.defaultOrg;
+      if (!orgName2) {
+        console.error(source_default.red("No organization specified. Use --org or run `gal workspace use <name>`."));
+        process.exit(1);
+      }
+      const provider2 = new CoreServiceProvider({
+        apiUrl: config2.apiUrl || process.env.GAL_API_URL || "",
+        authToken: config2.authToken
+      });
+      const scanRepo = provider2.getScanResultRepository();
+      const spinner2 = ora(`Fetching discovered configs for "${orgName2}"...`).start();
+      try {
+        const cache = await scanRepo.getDiscoveredConfigsCache(orgName2);
+        spinner2.stop();
+        let configs = cache?.configs || [];
+        if (options.repo) {
+          configs = configs.filter((c) => c.repo === options.repo || c.repoName === options.repo);
+        }
+        if (options.type) {
+          configs = configs.filter((c) => c.type === options.type || c.configType === options.type);
+        }
+        if (configs.length === 0) {
+          console.log(source_default.yellow("No discovered configs found matching your filters."));
+          console.log(source_default.dim("Run `gal discover --scan` to trigger a discovery scan."));
+          process.exit(0);
+        }
+        console.log(source_default.bold(`
+Discovered configs to approve (${orgName2}):
+`));
+        for (const c of configs.slice(0, 20)) {
+          const repoLabel = c.repo || c.repoName || "(unknown repo)";
+          const typeLabel = c.type || c.configType || c.platform || "?";
+          const nameLabel = c.name || c.path || "(unnamed)";
+          console.log(`  ${source_default.cyan(repoLabel)} / ${source_default.dim(typeLabel)} : ${nameLabel}`);
+        }
+        if (configs.length > 20) {
+          console.log(source_default.dim(`  ... and ${configs.length - 20} more`));
+        }
+        console.log();
+        if (options.dryRun) {
+          console.log(source_default.yellow(`Dry run: would approve ${configs.length} discovered configs.
+`));
+          process.exit(0);
+        }
+        console.log(source_default.dim("To approve these configs, integrate them into your local .claude/ directory"));
+        console.log(source_default.dim("and then run `gal approve` (without --from-discovered)."));
+        console.log();
+        console.log(source_default.dim("Direct auto-approval of discovered configs is coming in a future release."));
+        process.exit(0);
+      } catch (error2) {
+        spinner2.stop();
+        console.error(source_default.red(`Error: ${error2 instanceof Error ? error2.message : String(error2)}`));
+        process.exit(1);
+      }
+    }
     const earlyConfig = ConfigManager.load();
     const isOrgMode = !!(options.org || options.clear || options.remove);
     const isLocalMode = options.local || !earlyConfig.authToken && !isOrgMode;
@@ -39179,6 +39562,54 @@ Discovery Results for "${org}"`));
       }
     }
   });
+  command.command("show").description("Show content of a specific discovered config").argument("<repo>", 'Repository name (e.g. "my-org/my-repo")').argument("<path>", 'Config file path within the repository (e.g. "CLAUDE.md")').option("--org <orgName>", "Organization name (alternative to positional arg)").option("--format <format>", "Output format: text (default) or json", "text").action(async (repo, path8, options) => {
+    const config = ConfigManager.load();
+    const org = options.org || config.defaultOrg;
+    if (!org) {
+      console.error(source_default.red("No organization specified."));
+      console.error(source_default.dim("Usage: gal discover show <repo> <path> --org <orgName>"));
+      return;
+    }
+    const provider = new CoreServiceProvider({
+      apiUrl: config.apiUrl || process.env.GAL_API_URL || "",
+      authToken: config.authToken
+    });
+    const scanRepo = provider.getScanResultRepository();
+    try {
+      const cache = await scanRepo.getDiscoveredConfigsCache(org);
+      const configs = cache?.configs || [];
+      const match = configs.find((c) => {
+        const repoMatch = c.repo === repo || c.repoName === repo || c.repo?.endsWith(`/${repo}`) || c.repoName?.endsWith(`/${repo}`);
+        const pathMatch = c.path === path8 || c.filePath === path8 || c.path && c.path.endsWith(path8) || c.filePath && c.filePath.endsWith(path8);
+        return repoMatch && pathMatch;
+      });
+      if (!match) {
+        console.log(source_default.yellow(`Config not found: ${repo}/${path8}`));
+        console.log(source_default.dim(`Run \`gal discover ${org}\` to see available configs.`));
+        return;
+      }
+      if (options.format === "json") {
+        console.log(JSON.stringify({ organization: org, repo, path: path8, config: match }, null, 2));
+      } else {
+        console.log(source_default.bold(`
+Config: ${repo}/${path8}
+`));
+        if (match.platform) console.log(source_default.dim(`Platform: ${match.platform}`));
+        if (match.type || match.configType) console.log(source_default.dim(`Type: ${match.type || match.configType}`));
+        if (match.discoveredAt) console.log(source_default.dim(`Discovered: ${new Date(match.discoveredAt).toLocaleString()}`));
+        console.log();
+        const content = match.content || match.rawContent;
+        if (content) {
+          console.log(content);
+        } else {
+          console.log(source_default.dim("(No content available \u2014 run `gal discover --scan` to refresh.)"));
+        }
+      }
+    } catch (error2) {
+      const msg = error2 instanceof Error ? error2.message : String(error2);
+      console.error(source_default.red(`Error: ${msg}`));
+    }
+  });
   return command;
 }
 var VALID_PLATFORMS, POLL_INTERVAL, SCAN_TIMEOUT;
@@ -44068,6 +44499,104 @@ function createPolicyCommand() {
       process.exit(1);
     }
   });
+  command.command("show <id>").description("Show details of a specific policy (admin only)").option("--json", "Output as JSON").action(async (id, options) => {
+    const config = ConfigManager.load();
+    const authToken = config.authToken || config.apiKey;
+    if (!authToken) {
+      console.error(source_default.red("Not authenticated. Run: gal auth login"));
+      process.exit(1);
+    }
+    const orgName = config.defaultOrg;
+    if (!orgName) {
+      console.error(source_default.red("No default organization set. Run: gal auth login"));
+      process.exit(1);
+    }
+    const apiUrl = config.apiUrl || defaultApiUrl11;
+    const spinner = options.json ? null : ora(`Fetching policy "${id}"...`).start();
+    try {
+      const res = await fetchWithAuth2(
+        `${apiUrl}/organizations/${encodeURIComponent(orgName)}/agent-security-policies/${encodeURIComponent(id)}`,
+        authToken
+      );
+      if (!res.ok) {
+        const body = await res.json().catch(() => ({}));
+        throw new Error(body.error || `HTTP ${res.status}`);
+      }
+      const data = await res.json();
+      spinner?.stop();
+      if (options.json) {
+        console.log(JSON.stringify(data, null, 2));
+      } else {
+        const p = data.policy || data;
+        console.log();
+        console.log(`  ${source_default.bold(p.name)} ${source_default.dim(`(${p.type || "policy"})`)}`);
+        console.log(`  ID:          ${source_default.bold(p.id)}`);
+        console.log(`  Description: ${p.description || ""}`);
+        console.log(`  Enabled:     ${p.enabled ? source_default.green("yes") : source_default.yellow("no")}`);
+        console.log(`  Version:     ${p.version || "N/A"}`);
+        console.log(`  Created by:  ${p.createdBy || "unknown"}`);
+        if (p.allowedTools?.length > 0) {
+          console.log(`  Allowed tools: ${p.allowedTools.join(", ")}`);
+        }
+        if (p.blockedTools?.length > 0) {
+          console.log(`  Blocked tools: ${p.blockedTools.join(", ")}`);
+        }
+        console.log();
+      }
+    } catch (error2) {
+      spinner?.stop();
+      const msg = error2 instanceof Error ? error2.message : String(error2);
+      if (options.json) {
+        console.log(JSON.stringify({ error: msg }));
+      } else {
+        console.error(source_default.red("Error fetching policy:"), msg);
+      }
+      process.exit(1);
+    }
+  });
+  command.command("activate <id>").description("Activate (enable) an agent security policy (admin only)").option("--json", "Output as JSON").action(async (id, options) => {
+    const config = ConfigManager.load();
+    const authToken = config.authToken || config.apiKey;
+    if (!authToken) {
+      console.error(source_default.red("Not authenticated. Run: gal auth login"));
+      process.exit(1);
+    }
+    const orgName = config.defaultOrg;
+    if (!orgName) {
+      console.error(source_default.red("No default organization set. Run: gal auth login"));
+      process.exit(1);
+    }
+    const apiUrl = config.apiUrl || defaultApiUrl11;
+    const spinner = options.json ? null : ora(`Activating policy "${id}"...`).start();
+    try {
+      const res = await fetchWithAuth2(
+        `${apiUrl}/organizations/${encodeURIComponent(orgName)}/agent-security-policies/${encodeURIComponent(id)}`,
+        authToken,
+        "PUT",
+        { enabled: true }
+      );
+      if (!res.ok) {
+        const data2 = await res.json().catch(() => ({}));
+        throw new Error(data2.error || `HTTP ${res.status}`);
+      }
+      const data = await res.json();
+      spinner?.succeed(`Policy "${id}" activated`);
+      if (options.json) {
+        console.log(JSON.stringify(data, null, 2));
+      } else {
+        console.log(`  Policy ${source_default.bold(id)} is now ${source_default.green("enabled")}.`);
+      }
+    } catch (error2) {
+      spinner?.stop();
+      const msg = error2 instanceof Error ? error2.message : String(error2);
+      if (options.json) {
+        console.log(JSON.stringify({ error: msg }));
+      } else {
+        console.error(source_default.red("Error activating policy:"), msg);
+      }
+      process.exit(1);
+    }
+  });
   command.command("distribute <id>").description("Trigger distribution of an active policy").option("--json", "Output as JSON").action(async (id, options) => {
     const config = ConfigManager.load();
     const authToken = config.authToken || config.apiKey;
@@ -52743,14 +53272,63 @@ function printNoWorkspacesMessage() {
   console.log("  gal approve     # Approve a local config");
   console.log("  gal sync        # Sync approved config to all agents");
 }
+function switchWorkspaceAction(name, options) {
+  const trimmedName = name.trim();
+  const config = ConfigManager.load();
+  const memberships = config.orgMemberships ?? [];
+  if (!trimmedName) {
+    if (options.json) {
+      console.log(JSON.stringify({ error: "Workspace name cannot be empty." }));
+    } else {
+      console.error(source_default.red("Workspace name cannot be empty."));
+    }
+    process.exit(1);
+  }
+  if (memberships.length > 0 && !memberships.includes(trimmedName)) {
+    if (options.json) {
+      console.log(JSON.stringify({
+        error: `Workspace "${trimmedName}" not found.`,
+        available: memberships
+      }));
+    } else {
+      console.error(
+        source_default.red(
+          `Workspace "${trimmedName}" not found. Run \`gal workspace list\` to see available workspaces.`
+        )
+      );
+    }
+    process.exit(1);
+  }
+  ConfigManager.save({
+    ...config,
+    defaultOrg: trimmedName
+  });
+  if (options.json) {
+    console.log(JSON.stringify({ active: trimmedName }));
+  } else {
+    console.log(source_default.green(`\u2713 Switched to ${trimmedName}`));
+    console.log("  Run `gal sync --pull` to sync the approved config for this workspace.");
+  }
+}
 function createWorkspaceCommand() {
   const command = new Command("workspace");
   command.description("Manage workspaces (GitHub organizations and personal accounts)");
-  command.command("list").description("List all connected workspaces").action(() => {
+  command.command("list").description("List all connected workspaces").option("--json", "Output as JSON").action((options) => {
     const config = ConfigManager.load();
     const memberships = config.orgMemberships ?? [];
     if (memberships.length === 0) {
-      printNoWorkspacesMessage();
+      if (options.json) {
+        console.log(JSON.stringify({ workspaces: [], active: null }));
+      } else {
+        printNoWorkspacesMessage();
+      }
+      return;
+    }
+    if (options.json) {
+      console.log(JSON.stringify({
+        workspaces: memberships,
+        active: config.defaultOrg ?? null
+      }));
       return;
     }
     for (const workspace of memberships) {
@@ -52760,36 +53338,100 @@ function createWorkspaceCommand() {
       console.log(`${prefix} ${workspace}${suffix}`);
     }
   });
-  command.command("current").description("Show the currently active workspace").action(() => {
+  command.command("current").description("Show the currently active workspace").option("--json", "Output as JSON").action((options) => {
     const config = ConfigManager.load();
     if (!config.defaultOrg) {
-      console.log("No active workspace set. Run `gal workspace switch <name>` to set one.");
+      if (options.json) {
+        console.log(JSON.stringify({ active: null }));
+      } else {
+        console.log("No active workspace set. Run `gal workspace use <name>` to set one.");
+      }
       return;
     }
-    console.log(`Active workspace: ${config.defaultOrg}`);
+    if (options.json) {
+      console.log(JSON.stringify({ active: config.defaultOrg }));
+    } else {
+      console.log(`Active workspace: ${config.defaultOrg}`);
+    }
   });
-  command.command("switch").description("Switch the active workspace").argument("<name>", "Workspace name to activate").action((name) => {
-    const trimmedName = name.trim();
+  command.command("use").description("Switch the active workspace").argument("<name>", "Workspace name to activate").option("--json", "Output as JSON").action((name, options) => {
+    switchWorkspaceAction(name, options);
+  });
+  command.command("switch").description("Switch the active workspace (alias: use)").argument("<name>", "Workspace name to activate").option("--json", "Output as JSON").action((name, options) => {
+    switchWorkspaceAction(name, options);
+  });
+  command.command("add").description("Add an organization to the workspace list").argument("<org>", "Organization name to add").option("--json", "Output as JSON").action((org, options) => {
+    const trimmedOrg = org.trim();
+    if (!trimmedOrg) {
+      if (options.json) {
+        console.log(JSON.stringify({ error: "Organization name cannot be empty." }));
+      } else {
+        console.error(source_default.red("Organization name cannot be empty."));
+      }
+      process.exit(1);
+    }
     const config = ConfigManager.load();
     const memberships = config.orgMemberships ?? [];
-    if (!trimmedName) {
-      console.error(source_default.red("Workspace name cannot be empty."));
+    if (memberships.includes(trimmedOrg)) {
+      if (options.json) {
+        console.log(JSON.stringify({ workspace: trimmedOrg, added: false, message: "Already in workspace list." }));
+      } else {
+        console.log(source_default.yellow(`"${trimmedOrg}" is already in your workspace list.`));
+      }
+      return;
+    }
+    ConfigManager.save({
+      ...config,
+      orgMemberships: [...memberships, trimmedOrg]
+    });
+    if (options.json) {
+      console.log(JSON.stringify({ workspace: trimmedOrg, added: true }));
+    } else {
+      console.log(source_default.green(`\u2713 Added "${trimmedOrg}" to workspaces.`));
+      console.log(source_default.dim(`  Run \`gal workspace use ${trimmedOrg}\` to make it active.`));
+    }
+  });
+  command.command("remove").description("Remove an organization from the workspace list").argument("<org>", "Organization name to remove").option("--json", "Output as JSON").action((org, options) => {
+    const trimmedOrg = org.trim();
+    if (!trimmedOrg) {
+      if (options.json) {
+        console.log(JSON.stringify({ error: "Organization name cannot be empty." }));
+      } else {
+        console.error(source_default.red("Organization name cannot be empty."));
+      }
       process.exit(1);
     }
-    if (memberships.length > 0 && !memberships.includes(trimmedName)) {
-      console.error(
-        source_default.red(
-          `Workspace "${trimmedName}" not found. Run \`gal workspace list\` to see available workspaces.`
-        )
-      );
+    const config = ConfigManager.load();
+    const memberships = config.orgMemberships ?? [];
+    if (!memberships.includes(trimmedOrg)) {
+      if (options.json) {
+        console.log(JSON.stringify({ error: `Workspace "${trimmedOrg}" not found.`, available: memberships }));
+      } else {
+        console.error(source_default.red(`Workspace "${trimmedOrg}" not found.`));
+      }
       process.exit(1);
     }
-    ConfigManager.save({
+    const updated = memberships.filter((m) => m !== trimmedOrg);
+    const newConfig = {
       ...config,
-      defaultOrg: trimmedName
-    });
-    console.log(source_default.green(`\u2713 Switched to ${trimmedName}`));
-    console.log("  Run `gal sync --pull` to sync the approved config for this workspace.");
+      orgMemberships: updated
+    };
+    if (config.defaultOrg === trimmedOrg) {
+      delete newConfig.defaultOrg;
+    }
+    ConfigManager.save(newConfig);
+    if (options.json) {
+      console.log(JSON.stringify({
+        workspace: trimmedOrg,
+        removed: true,
+        active: newConfig.defaultOrg ?? null
+      }));
+    } else {
+      console.log(source_default.green(`\u2713 Removed "${trimmedOrg}" from workspaces.`));
+      if (config.defaultOrg === trimmedOrg) {
+        console.log(source_default.yellow("  Active workspace cleared. Run `gal workspace use <name>` to set a new one."));
+      }
+    }
   });
   return command;
 }
@@ -52809,6 +53451,7 @@ var init_command_registry = __esm({
     "use strict";
     init_admin();
     init_agent();
+    init_approved_config();
     init_approve();
     init_audit();
     init_auth2();
@@ -52856,6 +53499,7 @@ var init_command_registry = __esm({
     COMMAND_FACTORIES = [
       { name: "admin", create: createAdminCommand },
       { name: "agent", create: createAgentCommand },
+      { name: "approved-config", create: createApprovedConfigCommand },
       { name: "approve", create: createApproveCommand },
       { name: "audit", create: createAuditCommand },
       { name: "auth", create: createAuthCommand },
@@ -53377,7 +54021,7 @@ var init_index = __esm({
 });
 
 // src/bootstrap.ts
-var cliVersion10 = true ? "0.0.263" : "0.0.0-dev";
+var cliVersion10 = true ? "0.0.266" : "0.0.0-dev";
 var args = process.argv.slice(2);
 var requestedGlobalHelp = args.length === 1 && (args[0] === "--help" || args[0] === "-h");
 var requestedVersion = args.length === 1 && (args[0] === "--version" || args[0] === "-V");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scheduler-systems/gal-run",
-  "version": "0.0.263",
+  "version": "0.0.266",
   "description": "GAL CLI - Command-line tool for managing AI agent configurations across your organization",
   "license": "Elastic-2.0",
   "private": false,