@shadowob/cloud 1.1.6-dev.331 → 1.1.7

package/dist/{chunk-QET4LT4J.js → chunk-35LJYCQF.js}

@@ -608,6 +608,7 @@ var RUNNER_STATE_VOLUME_NAME = "shadow-runner-state";
 var RUNNER_LOG_VOLUME_NAME = "shadow-runner-logs";
 var RUNNER_CONFIG_VOLUME_NAME = "shadow-runner-config";
 var RUNNER_TMP_VOLUME_NAME = "shadow-runner-tmp";
+var RUNNER_AGENTS_VOLUME_NAME = "shadow-runner-agents";
 var NATIVE_RUNNER_HEALTH_PORT = 3100;
 var OPENCLAW_GATEWAY_PORT = 3101;
 var OPENCLAW_HEALTH_PORT = 3102;
@@ -698,6 +699,7 @@ var HOME_DIR = RUNNER_HOME_DIR;
 var WORKSPACE_DIR = "/workspace";
 var OPENCLAW_SKILLS_DIR = `${HOME_DIR}/.openclaw/skills`;
 var CC_CONNECT_CONFIG_PATH = `${HOME_DIR}/.cc-connect/config.toml`;
+var SHADOWOB_CLI_CONFIG_PATH = `${HOME_DIR}/.shadowob/shadowob.config.json`;
 var SHADOW_SLASH_COMMANDS_PATH = `${SHADOWOB_CONFIG_MOUNT_PATH}/slash-commands.json`;
 function hasRuntimeExtensions(extension) {
   return Boolean(
@@ -785,13 +787,20 @@ function buildIdentityWorkspaceFiles(agent) {
 }
 function shadowobSkillMarkdown() {
   const here = dirname(fileURLToPath(import.meta.url));
-  const candidates = [
-    resolve(process.cwd(), "skills/shadowob-cli/SKILL.md"),
-    resolve(process.cwd(), "../skills/shadowob-cli/SKILL.md"),
-    resolve(here, "../../../../skills/shadowob-cli/SKILL.md"),
-    resolve(here, "../../../../../skills/shadowob-cli/SKILL.md")
-  ];
-  const path = candidates.find((candidate) => existsSync(candidate));
+  let currentDir = here;
+  let path;
+  while (true) {
+    const candidate = resolve(currentDir, "skills/shadowob-cli/SKILL.md");
+    if (existsSync(candidate)) {
+      path = candidate;
+      break;
+    }
+    const parentDir = dirname(currentDir);
+    if (parentDir === currentDir) {
+      break;
+    }
+    currentDir = parentDir;
+  }
   if (!path) {
     throw new Error("Cannot find skills/shadowob-cli/SKILL.md for runner package generation");
   }
@@ -819,6 +828,22 @@ function addShadowobSkill(files, runtimeKind, runtimeId) {
     files[`${HOME_DIR}/.hermes/skills/shadowob/SKILL.md`] = skill;
   }
 }
+function addShadowobCliAuth(files, runtimeExtensions) {
+  const bindings = shadowBindings(runtimeExtensions);
+  const profiles = {};
+  for (const [index, binding] of bindings.entries()) {
+    const profileName = binding.buddyId?.trim() || (index === 0 ? "default" : `shadow-${index + 1}`);
+    profiles[profileName] = {
+      serverUrl: envPlaceholder(binding.serverUrlEnvKey),
+      token: envPlaceholder(binding.tokenEnvKey)
+    };
+  }
+  const currentProfile = Object.keys(profiles)[0] ?? "default";
+  files[SHADOWOB_CLI_CONFIG_PATH] = json({
+    profiles,
+    currentProfile
+  });
+}
 
 // src/runtimes/slash-commands/openclaw.ts
 var OPENCLAW_SLASH_COMMANDS_SOURCE = "https://docs.openclaw.ai/tools/slash-commands";
@@ -915,6 +940,7 @@ var openclawAdapter = {
       [SHADOW_SLASH_COMMANDS_PATH]: json(openClawSlashCommands)
     };
     addShadowobSkill(runtimeFiles, "openclaw", context.agent.runtime);
+    addShadowobCliAuth(runtimeFiles, context.runtimeExtensions);
     const configData = {
       "config.json": JSON.stringify(openclawConfig, null, 2),
       "runtime-files.json": json(runtimeFiles),
@@ -978,6 +1004,7 @@ function buildCcConnectRuntimeFiles(options) {
     ...options.nativeFiles ?? {}
   };
   addShadowobSkill(files, "cc-connect", agent.runtime);
+  addShadowobCliAuth(files, options.runtimeExtensions);
   return files;
 }
 function buildCcConnectPackage(context, options) {
@@ -992,6 +1019,7 @@ function buildCcConnectPackage(context, options) {
   const files = buildCcConnectRuntimeFiles({
     agent: context.agent,
     ccConnectConfig,
+    runtimeExtensions: context.runtimeExtensions,
     nativeFiles: options.nativeFiles?.(context),
     shadowSlashCommands: options.shadowSlashCommands
   });
@@ -1683,6 +1711,7 @@ var hermesAdapter = {
       [SHADOW_SLASH_COMMANDS_PATH]: json(hermesSlashCommands)
     };
     addShadowobSkill(files, "hermes", "hermes");
+    addShadowobCliAuth(files, context.runtimeExtensions);
     const pluginRoot = `${HOME_DIR}/.hermes/plugins/shadowob`;
     files[`${pluginRoot}/plugin.yaml`] = readHermesPluginFile(
       context.cwd,
@@ -5746,6 +5775,7 @@ export {
   RUNNER_LOG_VOLUME_NAME,
   RUNNER_CONFIG_VOLUME_NAME,
   RUNNER_TMP_VOLUME_NAME,
+  RUNNER_AGENTS_VOLUME_NAME,
   runtimeStatePvcName,
   parseJsonc,
   normalizeDeploymentRuntimeContext,

package/dist/{chunk-TV3CBM7R.js → chunk-6YAYCWGK.js}

@@ -14,7 +14,7 @@ function createConsoleCommand(container) {
         });
       }, 1500);
     }
-    const { createServeCommand } = await import("./serve.command-DNE6GPMK.js");
+    const { createServeCommand } = await import("./serve.command-RD6I6MFD.js");
     const serve = createServeCommand(container);
     await serve.parseAsync(
       ["--port", port, "--namespace", ...options.namespace, "--host", "127.0.0.1"],

package/dist/{chunk-R52J3PH2.js → chunk-C6OI4ZNO.js}

@@ -1,6 +1,6 @@
 import {
   collectRuntimeEnvRequirements
-} from "./chunk-SUZ2ATT6.js";
+} from "./chunk-ZHVYNIHA.js";
 
 // src/interfaces/cli/init.command.ts
 import { cp, stat, writeFile } from "fs/promises";

package/dist/{chunk-KKK5H7YX.js → chunk-EWB7L7IW.js}

@@ -7,7 +7,7 @@ import {
   normalizeDeploymentRuntimeContext,
   parseJsonc,
   runtimeStatePvcName
-} from "./chunk-SUZ2ATT6.js";
+} from "./chunk-ZHVYNIHA.js";
 import {
   getPluginRegistry,
   loadAllPlugins

package/dist/{chunk-QV4XWO3P.js → chunk-KODMGZUC.js}

@@ -16,7 +16,7 @@ function createConsoleCommand(container) {
         });
       }, 1500);
     }
-    const { createServeCommand } = await import("./serve.command-5FMIPQRY.js");
+    const { createServeCommand } = await import("./serve.command-XLBJUOV6.js");
     const serve = createServeCommand(container);
     await serve.parseAsync(
       ["--port", port, "--namespace", ...options.namespace, "--host", "127.0.0.1"],

package/dist/{chunk-V2LU736V.js → chunk-LXJBQBGL.js}

@@ -7,7 +7,7 @@ import {
   normalizeDeploymentRuntimeContext,
   parseJsonc,
   runtimeStatePvcName
-} from "./chunk-QET4LT4J.js";
+} from "./chunk-35LJYCQF.js";
 import {
   getPluginRegistry,
   loadAllPlugins

package/dist/{chunk-KEPTCLUO.js → chunk-SAP2DBHO.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   collectRuntimeEnvRequirements
-} from "./chunk-QET4LT4J.js";
+} from "./chunk-35LJYCQF.js";
 
 // src/interfaces/cli/init.command.ts
 import { cp, stat, writeFile } from "fs/promises";

package/dist/{chunk-SUZ2ATT6.js → chunk-ZHVYNIHA.js}

@@ -611,6 +611,7 @@ var RUNNER_STATE_VOLUME_NAME = "shadow-runner-state";
 var RUNNER_LOG_VOLUME_NAME = "shadow-runner-logs";
 var RUNNER_CONFIG_VOLUME_NAME = "shadow-runner-config";
 var RUNNER_TMP_VOLUME_NAME = "shadow-runner-tmp";
+var RUNNER_AGENTS_VOLUME_NAME = "shadow-runner-agents";
 var NATIVE_RUNNER_HEALTH_PORT = 3100;
 var OPENCLAW_GATEWAY_PORT = 3101;
 var OPENCLAW_HEALTH_PORT = 3102;
@@ -701,6 +702,7 @@ var HOME_DIR = RUNNER_HOME_DIR;
 var WORKSPACE_DIR = "/workspace";
 var OPENCLAW_SKILLS_DIR = `${HOME_DIR}/.openclaw/skills`;
 var CC_CONNECT_CONFIG_PATH = `${HOME_DIR}/.cc-connect/config.toml`;
+var SHADOWOB_CLI_CONFIG_PATH = `${HOME_DIR}/.shadowob/shadowob.config.json`;
 var SHADOW_SLASH_COMMANDS_PATH = `${SHADOWOB_CONFIG_MOUNT_PATH}/slash-commands.json`;
 function hasRuntimeExtensions(extension) {
   return Boolean(
@@ -788,13 +790,20 @@ function buildIdentityWorkspaceFiles(agent) {
 }
 function shadowobSkillMarkdown() {
   const here = dirname(fileURLToPath(import.meta.url));
-  const candidates = [
-    resolve(process.cwd(), "skills/shadowob-cli/SKILL.md"),
-    resolve(process.cwd(), "../skills/shadowob-cli/SKILL.md"),
-    resolve(here, "../../../../skills/shadowob-cli/SKILL.md"),
-    resolve(here, "../../../../../skills/shadowob-cli/SKILL.md")
-  ];
-  const path = candidates.find((candidate) => existsSync(candidate));
+  let currentDir = here;
+  let path;
+  while (true) {
+    const candidate = resolve(currentDir, "skills/shadowob-cli/SKILL.md");
+    if (existsSync(candidate)) {
+      path = candidate;
+      break;
+    }
+    const parentDir = dirname(currentDir);
+    if (parentDir === currentDir) {
+      break;
+    }
+    currentDir = parentDir;
+  }
   if (!path) {
     throw new Error("Cannot find skills/shadowob-cli/SKILL.md for runner package generation");
   }
@@ -822,6 +831,22 @@ function addShadowobSkill(files, runtimeKind, runtimeId) {
     files[`${HOME_DIR}/.hermes/skills/shadowob/SKILL.md`] = skill;
   }
 }
+function addShadowobCliAuth(files, runtimeExtensions) {
+  const bindings = shadowBindings(runtimeExtensions);
+  const profiles = {};
+  for (const [index, binding] of bindings.entries()) {
+    const profileName = binding.buddyId?.trim() || (index === 0 ? "default" : `shadow-${index + 1}`);
+    profiles[profileName] = {
+      serverUrl: envPlaceholder(binding.serverUrlEnvKey),
+      token: envPlaceholder(binding.tokenEnvKey)
+    };
+  }
+  const currentProfile = Object.keys(profiles)[0] ?? "default";
+  files[SHADOWOB_CLI_CONFIG_PATH] = json({
+    profiles,
+    currentProfile
+  });
+}
 
 // src/runtimes/slash-commands/openclaw.ts
 var OPENCLAW_SLASH_COMMANDS_SOURCE = "https://docs.openclaw.ai/tools/slash-commands";
@@ -918,6 +943,7 @@ var openclawAdapter = {
       [SHADOW_SLASH_COMMANDS_PATH]: json(openClawSlashCommands)
     };
     addShadowobSkill(runtimeFiles, "openclaw", context.agent.runtime);
+    addShadowobCliAuth(runtimeFiles, context.runtimeExtensions);
     const configData = {
       "config.json": JSON.stringify(openclawConfig, null, 2),
       "runtime-files.json": json(runtimeFiles),
@@ -981,6 +1007,7 @@ function buildCcConnectRuntimeFiles(options) {
     ...options.nativeFiles ?? {}
   };
   addShadowobSkill(files, "cc-connect", agent.runtime);
+  addShadowobCliAuth(files, options.runtimeExtensions);
   return files;
 }
 function buildCcConnectPackage(context, options) {
@@ -995,6 +1022,7 @@ function buildCcConnectPackage(context, options) {
   const files = buildCcConnectRuntimeFiles({
     agent: context.agent,
     ccConnectConfig,
+    runtimeExtensions: context.runtimeExtensions,
     nativeFiles: options.nativeFiles?.(context),
     shadowSlashCommands: options.shadowSlashCommands
   });
@@ -1686,6 +1714,7 @@ var hermesAdapter = {
       [SHADOW_SLASH_COMMANDS_PATH]: json(hermesSlashCommands)
     };
     addShadowobSkill(files, "hermes", "hermes");
+    addShadowobCliAuth(files, context.runtimeExtensions);
     const pluginRoot = `${HOME_DIR}/.hermes/plugins/shadowob`;
     files[`${pluginRoot}/plugin.yaml`] = readHermesPluginFile(
       context.cwd,
@@ -5755,6 +5784,7 @@ export {
   RUNNER_LOG_VOLUME_NAME,
   RUNNER_CONFIG_VOLUME_NAME,
   RUNNER_TMP_VOLUME_NAME,
+  RUNNER_AGENTS_VOLUME_NAME,
   runtimeStatePvcName,
   getRuntime,
   getAllRuntimes,

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   createConsoleCommand
-} from "./chunk-QV4XWO3P.js";
+} from "./chunk-KODMGZUC.js";
 import {
   createInitCommand
-} from "./chunk-KEPTCLUO.js";
+} from "./chunk-SAP2DBHO.js";
 import {
   formatProvisionState,
   loadProvisionState,
@@ -17,8 +17,9 @@ import {
   resolveCloudPackageAssetDir,
   toProviderSecretEnvKey,
   withLegacyEnvAliases
-} from "./chunk-V2LU736V.js";
+} from "./chunk-LXJBQBGL.js";
 import {
+  RUNNER_AGENTS_VOLUME_NAME,
   RUNNER_CONFIG_MOUNT_PATH,
   RUNNER_CONFIG_VOLUME_NAME,
   RUNNER_LOG_VOLUME_NAME,
@@ -42,7 +43,7 @@ import {
   resolveConfig,
   runtimeContextEnv,
   runtimeStatePvcName
-} from "./chunk-QET4LT4J.js";
+} from "./chunk-35LJYCQF.js";
 import {
   deepMerge,
   getPluginRegistry
@@ -1380,7 +1381,7 @@ function createOnboardCommand(container2) {
     } else {
       const answer = await ask(`  No ${configPath} found. Create one from template? [Y/n] `);
       if (!answer || answer.toLowerCase() !== "n") {
-        const { createInitCommand: createInitCommand2 } = await import("./init.command-O4HG4HKR.js");
+        const { createInitCommand: createInitCommand2 } = await import("./init.command-YVG4X6II.js");
         const init = createInitCommand2(container2);
         await init.parseAsync(["--quick"], { from: "user" });
       } else {
@@ -1397,7 +1398,7 @@ function createOnboardCommand(container2) {
     }
     container2.logger.success("Onboarding complete! Starting console...");
     console.log();
-    const { createConsoleCommand: createConsoleCommand2 } = await import("./dashboard.command-J7XOZNXU.js");
+    const { createConsoleCommand: createConsoleCommand2 } = await import("./dashboard.command-ZMQFKLNQ.js");
     const console_ = createConsoleCommand2(container2);
     await console_.parseAsync([], { from: "user" });
   });
@@ -4129,7 +4130,8 @@ function baseVolumeMounts(runtime) {
     { name: RUNNER_STATE_VOLUME_NAME, mountPath: runtime.container.statePath },
     { name: RUNNER_CONFIG_VOLUME_NAME, mountPath: RUNNER_CONFIG_MOUNT_PATH, readOnly: true },
     { name: RUNNER_LOG_VOLUME_NAME, mountPath: runtime.container.logPath },
-    { name: RUNNER_TMP_VOLUME_NAME, mountPath: "/tmp" }
+    { name: RUNNER_TMP_VOLUME_NAME, mountPath: "/tmp" },
+    { name: RUNNER_AGENTS_VOLUME_NAME, mountPath: "/workspace/.agents" }
   ];
 }
 function baseVolumes(configMapName) {
@@ -4137,7 +4139,8 @@ function baseVolumes(configMapName) {
     { name: RUNNER_STATE_VOLUME_NAME, emptyDir: {} },
     { name: RUNNER_CONFIG_VOLUME_NAME, configMap: { name: configMapName } },
     { name: RUNNER_LOG_VOLUME_NAME, emptyDir: {} },
-    { name: RUNNER_TMP_VOLUME_NAME, emptyDir: {} }
+    { name: RUNNER_TMP_VOLUME_NAME, emptyDir: {} },
+    { name: RUNNER_AGENTS_VOLUME_NAME, emptyDir: {} }
   ];
 }
 function buildAgentPodSpec(options) {

package/dist/{dashboard.command-RV2NHDKW.js → dashboard.command-2AM45SIT.js}

@@ -1,6 +1,6 @@
 import {
   createConsoleCommand
-} from "./chunk-TV3CBM7R.js";
+} from "./chunk-6YAYCWGK.js";
 import "./chunk-R5U7XKVJ.js";
 export {
   createConsoleCommand

package/dist/{dashboard.command-J7XOZNXU.js → dashboard.command-ZMQFKLNQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   createConsoleCommand
-} from "./chunk-QV4XWO3P.js";
+} from "./chunk-KODMGZUC.js";
 import "./chunk-AD3JTIU3.js";
 export {
   createConsoleCommand

package/dist/index.js

@@ -1,9 +1,9 @@
 import {
   createConsoleCommand
-} from "./chunk-TV3CBM7R.js";
+} from "./chunk-6YAYCWGK.js";
 import {
   createInitCommand
-} from "./chunk-R52J3PH2.js";
+} from "./chunk-C6OI4ZNO.js";
 import {
   formatProvisionState,
   loadProvisionState,
@@ -26,8 +26,9 @@ import {
   toProviderSecretEnvKey,
   validateCloudSaasConfigSnapshot,
   withLegacyEnvAliases
-} from "./chunk-KKK5H7YX.js";
+} from "./chunk-EWB7L7IW.js";
 import {
+  RUNNER_AGENTS_VOLUME_NAME,
   RUNNER_CONFIG_MOUNT_PATH,
   RUNNER_CONFIG_VOLUME_NAME,
   RUNNER_LOG_VOLUME_NAME,
@@ -55,7 +56,7 @@ import {
   runtimeContextEnv,
   runtimeStatePvcName,
   validateCloudConfig
-} from "./chunk-SUZ2ATT6.js";
+} from "./chunk-ZHVYNIHA.js";
 import {
   deepMerge,
   getPluginRegistry
@@ -10964,7 +10965,7 @@ function createOnboardCommand(container) {
     } else {
       const answer = await ask(`  No ${configPath} found. Create one from template? [Y/n] `);
       if (!answer || answer.toLowerCase() !== "n") {
-        const { createInitCommand: createInitCommand2 } = await import("./init.command-6E24K4H3.js");
+        const { createInitCommand: createInitCommand2 } = await import("./init.command-JKE3SXAS.js");
         const init = createInitCommand2(container);
         await init.parseAsync(["--quick"], { from: "user" });
       } else {
@@ -10981,7 +10982,7 @@ function createOnboardCommand(container) {
     }
     container.logger.success("Onboarding complete! Starting console...");
     console.log();
-    const { createConsoleCommand: createConsoleCommand2 } = await import("./dashboard.command-RV2NHDKW.js");
+    const { createConsoleCommand: createConsoleCommand2 } = await import("./dashboard.command-2AM45SIT.js");
     const console_ = createConsoleCommand2(container);
     await console_.parseAsync([], { from: "user" });
   });
@@ -13063,7 +13064,8 @@ function baseVolumeMounts(runtime) {
     { name: RUNNER_STATE_VOLUME_NAME, mountPath: runtime.container.statePath },
     { name: RUNNER_CONFIG_VOLUME_NAME, mountPath: RUNNER_CONFIG_MOUNT_PATH, readOnly: true },
     { name: RUNNER_LOG_VOLUME_NAME, mountPath: runtime.container.logPath },
-    { name: RUNNER_TMP_VOLUME_NAME, mountPath: "/tmp" }
+    { name: RUNNER_TMP_VOLUME_NAME, mountPath: "/tmp" },
+    { name: RUNNER_AGENTS_VOLUME_NAME, mountPath: "/workspace/.agents" }
   ];
 }
 function baseVolumes(configMapName) {
@@ -13071,7 +13073,8 @@ function baseVolumes(configMapName) {
     { name: RUNNER_STATE_VOLUME_NAME, emptyDir: {} },
     { name: RUNNER_CONFIG_VOLUME_NAME, configMap: { name: configMapName } },
     { name: RUNNER_LOG_VOLUME_NAME, emptyDir: {} },
-    { name: RUNNER_TMP_VOLUME_NAME, emptyDir: {} }
+    { name: RUNNER_TMP_VOLUME_NAME, emptyDir: {} },
+    { name: RUNNER_AGENTS_VOLUME_NAME, emptyDir: {} }
   ];
 }
 function buildAgentPodSpec(options) {

package/dist/{init.command-6E24K4H3.js → init.command-JKE3SXAS.js}

@@ -1,7 +1,7 @@
 import {
   createInitCommand
-} from "./chunk-R52J3PH2.js";
-import "./chunk-SUZ2ATT6.js";
+} from "./chunk-C6OI4ZNO.js";
+import "./chunk-ZHVYNIHA.js";
 import "./chunk-JUPAE5IA.js";
 import "./chunk-R5U7XKVJ.js";
 export {

package/dist/{init.command-O4HG4HKR.js → init.command-YVG4X6II.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   createInitCommand
-} from "./chunk-KEPTCLUO.js";
-import "./chunk-QET4LT4J.js";
+} from "./chunk-SAP2DBHO.js";
+import "./chunk-35LJYCQF.js";
 import "./chunk-6P2K6QZR.js";
 import "./chunk-AD3JTIU3.js";
 export {

package/dist/{serve.command-DNE6GPMK.js → serve.command-RD6I6MFD.js}

@@ -1,7 +1,7 @@
 import {
   createServeCommand
-} from "./chunk-KKK5H7YX.js";
-import "./chunk-SUZ2ATT6.js";
+} from "./chunk-EWB7L7IW.js";
+import "./chunk-ZHVYNIHA.js";
 import "./chunk-JUPAE5IA.js";
 import "./chunk-R5U7XKVJ.js";
 export {

package/dist/{serve.command-5FMIPQRY.js → serve.command-XLBJUOV6.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   createServeCommand
-} from "./chunk-V2LU736V.js";
-import "./chunk-QET4LT4J.js";
+} from "./chunk-LXJBQBGL.js";
+import "./chunk-35LJYCQF.js";
 import "./chunk-6P2K6QZR.js";
 import "./chunk-AD3JTIU3.js";
 export {

package/dist/skills/shadowob-cli/SKILL.md

@@ -0,0 +1,451 @@
+---
+name: shadowob
+description: "Use when live Shadow context or actions are needed: channel/DM history, pins, members, server/channel/workspace/shop/app/buddy data, or sending/managing Shadow content via the shadowob CLI."
+metadata:
+  {
+    "openclaw":
+      {
+        "emoji": "🏠",
+        "requires": { "bins": ["shadowob"] },
+        "primaryEnv": "SHADOWOB_TOKEN",
+      },
+  }
+---
+allowed-tools: ["exec"]
+
+# Shadow CLI
+
+Use `shadowob` CLI to interact with Shadow servers.
+
+Activate this skill when you need current Shadow context, such as recent channel or DM history,
+pinned messages, member/server/channel state, workspace/shop/app/buddy data, or when you need to
+send or manage Shadow content. Prefer narrow `--json` reads before acting.
+
+## Quickstart
+
+```bash
+# Login (one-time setup)
+shadowob auth login --server-url https://shadowob.com --token <jwt>
+
+# List servers
+shadowob servers list --json
+
+# Send a message
+shadowob channels send <channel-id> --content "Hello" --json
+```
+
+## Authentication
+
+Set token via:
+1. `shadowob auth login` (persistent, stored in `~/.shadowob/shadowob.config.json`)
+2. `--profile <name>` to use a specific profile
+3. `SHADOWOB_TOKEN` env var (used by SDK directly)
+
+### Profile Commands
+
+```bash
+shadowob auth login --server-url <url> --token <token> --profile <name>
+shadowob auth switch <profile>
+shadowob auth list
+shadowob auth whoami
+shadowob auth logout --profile <name>
+```
+
+## Servers
+
+```bash
+# List joined servers
+shadowob servers list --json
+
+# Get server details
+shadowob servers get <server-id> --json
+
+# Create server
+shadowob servers create --name "My Server" --slug myserver --json
+
+# Join/Leave
+shadowob servers join <server-id> [--invite-code <code>]
+shadowob servers leave <server-id>
+
+# Members
+shadowob servers members <server-id> --json
+
+# Discover public servers
+shadowob servers discover --json
+```
+
+## Channels
+
+```bash
+# List channels
+shadowob channels list --server <server> --json
+
+# Get channel
+shadowob channels get <channel-id> --json
+
+# Create/Delete
+shadowob channels create --server <server> --name <name> [--type text] --json
+shadowob channels delete <channel-id>
+
+# Messages
+shadowob channels messages <channel-id> [--limit 50] [--cursor <cursor>] --json
+shadowob channels send <channel-id> --content "text" [--reply-to <id>] [--thread-id <id>] --json
+shadowob channels edit <message-id> --content "new text" --json
+shadowob channels delete-message <message-id>
+
+# Reactions
+shadowob channels react <message-id> --emoji 👍
+shadowob channels unreact <message-id> --emoji 👍
+
+# Pins
+shadowob channels pin <message-id> [--channel-id <id>]
+shadowob channels unpin <message-id> [--channel-id <id>]
+shadowob channels pinned <channel-id> --json
+```
+
+## Threads
+
+```bash
+# List threads
+shadowob threads list <channel-id> --json
+
+# Get thread
+shadowob threads get <thread-id> --json
+
+# Create/Delete
+shadowob threads create <channel-id> --name <name> --parent-message <id> --json
+shadowob threads delete <thread-id>
+
+# Messages
+shadowob threads messages <thread-id> [--limit 50] --json
+shadowob threads send <thread-id> --content "text" --json
+```
+
+## Direct Messages (DMs)
+
+```bash
+# List DM channels
+shadowob dms list --json
+
+# Get DM channel
+shadowob dms get <dm-channel-id> --json
+
+# Create DM channel
+shadowob dms create --user-id <user-id> --json
+
+# Messages
+shadowob dms messages <dm-channel-id> [--limit 50] --json
+shadowob dms send <dm-channel-id> --content "text" --json
+
+# Delete DM channel
+shadowob dms delete <dm-channel-id>
+```
+
+## Buddies
+
+```bash
+# List buddies
+shadowob buddies list --json
+
+# Get buddy
+shadowob buddies get <buddy-id> --json
+
+# Create/Update/Delete
+shadowob buddies create --name <name> --username <username> [--display-name <name>] [--avatar-url <url>] --json
+shadowob buddies update <buddy-id> [--name <name>] [--display-name <name>] --json
+shadowob buddies delete <buddy-id>
+
+# Control
+shadowob buddies start <buddy-id>
+shadowob buddies stop <buddy-id>
+
+# Token
+shadowob buddies token <buddy-id> --json
+
+# Config
+shadowob buddies config <buddy-id> --json
+```
+
+## Workspace
+
+```bash
+# Workspace info
+shadowob workspace get <server-id> --json
+shadowob workspace tree <server-id> --json
+shadowob workspace stats <server-id> --json
+
+# Children
+shadowob workspace children <server-id> [--parent-id <id>] --json
+
+# Files
+shadowob workspace files get <server-id> <file-id> --json
+shadowob workspace files upload <server-id> --file <path> [--name <name>] [--parent-id <id>] --json
+shadowob workspace files update <server-id> <file-id> [--name <name>] [--parent-id <id>] --json
+shadowob workspace files delete <server-id> <file-id>
+shadowob workspace files search <server-id> [--search-text <text>] [--ext <ext>] [--parent-id <id>] --json
+# Note: files download is not yet implemented in CLI; download via contentRef URL instead.
+
+# Folders
+shadowob workspace folders create <server-id> --name <name> [--parent-id <id>] --json
+shadowob workspace folders update <server-id> <folder-id> [--name <name>] [--parent-id <id>] --json
+shadowob workspace folders delete <server-id> <folder-id>
+```
+
+### Workspace Node Metadata
+
+Each workspace node has a `flags` JSONB field with optional metadata:
+
+- **Access control**: `flags.access = { scope: "server" | "channel", serverId, channelId? }`. All nodes have at least `scope: "server"` + `serverId`. Channel-scoped nodes require channel membership for access.
+- **Traceability**: `flags.source = "channel_message_attachment"` with `channelId` and `messageId` for files uploaded via channel messages, enabling reverse lookup to the originating message.
+- **Path is server-computed**: `path` is derived from parent path + name, maintained server-side. Do not set path manually — it is auto-updated on rename/move.
+
+## Shop
+
+```bash
+# Shop info
+shadowob shop get <server-id> --json
+shadowob shop get-by-id <shop-id> --json
+shadowob shop me get --json
+
+# Products
+shadowob shop products list <server-id> [--status active] [--keyword <text>] [--limit <n>] --json
+shadowob shop products list-by-shop <shop-id> [--status active] [--limit <n>] --json
+shadowob shop products get <server-id> <product-id> --json
+shadowob shop products purchase <shop-id> <product-id> --idempotency-key <unique-operation-id> --json
+
+# Offers, deliverables, and shop assets
+shadowob shop offers list <shop-id> --json
+shadowob shop offers create <shop-id> --data '<offer-json>' --json
+shadowob shop offers deliverables create <shop-id> <offer-id> --data '<deliverable-json>' --json
+shadowob shop assets list <shop-id> --json
+shadowob shop assets create <shop-id> --data '<asset-definition-json>' --json
+shadowob shop entitlements list <shop-id> --json
+
+# Cart
+shadowob shop cart list <server-id> --json
+
+# Orders
+shadowob shop orders list <server-id> --json
+shadowob shop orders get <server-id> <order-id> --json
+
+# Wallet
+shadowob shop wallet balance --json
+```
+
+## Commerce
+
+```bash
+# Product and offer buyer context
+shadowob commerce products context <product-id> --json
+shadowob commerce offers preview <offer-id> --json
+shadowob commerce offers purchase <offer-id> --idempotency-key <unique-operation-id> --json
+
+# Chat commerce cards
+shadowob commerce cards list --channel-id <channel-id> [--keyword <text>] --json
+shadowob commerce cards purchase <message-id> <card-id> --idempotency-key <unique-operation-id> --json
+
+# Purchases, delivery, protected files, and community assets
+shadowob commerce entitlements list [--server <server>] --json
+shadowob commerce entitlements get <entitlement-id> --json
+shadowob commerce entitlements verify <entitlement-id> --json
+shadowob commerce paid-files open <file-id> --json
+shadowob commerce assets list --json
+shadowob commerce assets consume <grant-id> --idempotency-key <unique-operation-id> --json
+
+# Seller income and support actions
+shadowob commerce settlements list --json
+shadowob commerce settlements settle --json
+shadowob commerce tips send --recipient-user-id <user-id> --amount <shrimp> [--message <text>] --json
+shadowob commerce gifts send --recipient-user-id <user-id> --assets '<json-array>' --json
+```
+
+## Commerce Validation Notes
+
+- Use the CLI for setup, inspection, and automation, but validate commerce user stories in the
+  browser before calling them complete.
+- Do not add seed code to populate commerce surfaces. Create ordinary local/test records through
+  browser flows or explicit setup calls.
+- When inspecting a commerce flow, preserve ids for the handoff: product, offer, order,
+  entitlement, shop, server, Buddy, and workspace file where applicable.
+- External app entitlement automation must use Shadow OAuth commerce APIs and remain scoped to the
+  app's own `external_app` resource namespace.
+
+## Apps
+
+```bash
+# Server App integrations
+shadowob app list --server <server-id-or-slug> --json
+shadowob app preview --server <server-id-or-slug> --manifest-url <manifest-url> --json
+shadowob app install --server <server-id-or-slug> --manifest-url <manifest-url> --json
+shadowob app uninstall <app-key> --server <server-id-or-slug>
+shadowob app discover --server <server-id-or-slug> --json
+shadowob app inspect <app-key> --server <server-id-or-slug> --json
+shadowob app skills <app-key> --server <server-id-or-slug>
+shadowob app call <app-key> <command> --server <server-id-or-slug> --channel-id <channel-id> --json-input '<raw-command-input-json>' --json
+```
+
+For server App commands, use the `shadowob app` CLI path only. Do not use curl, fetch, raw HTTP
+routes, or the JavaScript SDK to call server App commands. Pass the command input object directly
+to `--json-input`, for example `{"title":"Example","priority":"high"}`; the CLI wraps the HTTP
+request for you and binds Shadow OAuth identity, server membership, App grants, and command policy.
+When a channel message mentions a server App, use the mentioned app key/server id directly and pass
+the current channel id with `--channel-id` when available. If a server App command requires
+approval, do not send a chat form or call the approval endpoint yourself as a Buddy. Wait for a
+person to confirm the Shadow approval popup, then retry the original command.
+
+```bash
+# Legacy workspace apps
+shadowob apps list <server-id> --json
+
+# Get app
+shadowob apps get <app-id> --json
+
+# Create/Update/Delete
+shadowob apps create <server-id> --name <name> --type <url|workspace|static> [--source-url <url>] [--description <desc>] [--settings <json>] --json
+shadowob apps update <app-id> [--name <name>] [--description <desc>] [--source-url <url>] [--settings <json>] --json
+shadowob apps delete <app-id>
+
+# Publish from workspace
+shadowob apps publish <server-id> --folder-id <id> [--name <name>] [--description <desc>] --json
+
+# Download source
+shadowob apps download <app-id> [--output <path>]
+```
+
+## Notifications
+
+```bash
+# List notifications
+shadowob notifications list [--unread-only] [--limit <n>] --json
+
+# Get/Read/Delete
+shadowob notifications get <notification-id> --json
+shadowob notifications mark-read <notification-id>
+shadowob notifications mark-all-read
+shadowob notifications delete <notification-id>
+
+# Preferences
+shadowob notifications preferences get --json
+shadowob notifications preferences update [--email-enabled <bool>] [--push-enabled <bool>] [--mentions-only <bool>] --json
+```
+
+## Friends
+
+```bash
+# List friends
+shadowob friends list --json
+
+# Friend requests
+shadowob friends requests [--incoming] [--outgoing] --json
+shadowob friends add <username> [--message <text>] --json
+shadowob friends accept <request-id> --json
+shadowob friends reject <request-id> --json
+
+# Remove friend
+shadowob friends remove <friendship-id> --json
+```
+
+## Invites
+
+```bash
+# List your invite codes
+shadowob invites list --json
+
+# Create invite code
+shadowob invites create [--max-uses <n>] [--expires-in <hours>] --json
+
+# Deactivate/Delete invite
+shadowob invites deactivate <invite-id>
+shadowob invites delete <invite-id>
+```
+
+## OAuth
+
+```bash
+# List OAuth apps
+shadowob oauth list --json
+
+# Create OAuth app
+shadowob oauth create --name <name> [--description <desc>] [--redirect-uri <uri>] [--homepage <url>] --json
+
+# Update/Delete OAuth app
+shadowob oauth update <app-id> [--name <name>] [--description <desc>] [--redirect-uri <uri>] [--homepage <url>] --json
+shadowob oauth delete <app-id>
+
+# Reset client secret
+shadowob oauth reset-secret <app-id> --json
+
+# List authorized apps (user consents)
+shadowob oauth consents --json
+
+# Revoke consent for an app
+shadowob oauth revoke <app-id>
+
+# External app commerce entitlement checks use OAuth access tokens, not user JWTs
+shadowob oauth commerce check --access-token <oauth-access-token> --resource-id <app-id>:premium --json
+shadowob oauth commerce redeem --access-token <oauth-access-token> --resource-id <app-id>:premium --idempotency-key <provider-operation-id> --json
+```
+
+## Marketplace
+
+```bash
+# Listings
+shadowob marketplace listings list [--agent-id <id>] [--min-price <n>] [--max-price <n>] --json
+shadowob marketplace listings get <listing-id> --json
+shadowob marketplace listings create --agent-id <id> --price <n> [--description <text>] --json
+shadowob marketplace listings update <listing-id> [--price <n>] [--description <text>] [--active <bool>] --json
+shadowob marketplace listings delete <listing-id>
+
+# Contracts
+shadowob marketplace contracts list [--as-renter] [--as-owner] [--active-only] --json
+shadowob marketplace contracts get <contract-id> --json
+shadowob marketplace contracts create --listing-id <id> --hours <n> [--note <text>] --json
+shadowob marketplace contracts cancel <contract-id>
+shadowob marketplace contracts extend <contract-id> --hours <n> --json
+```
+
+## Media
+
+```bash
+# Upload a file
+shadowob media upload --file <path> [--server <server>] [--channel-id <id>] --json
+
+# Download a file
+shadowob media download <file-url> [--output <path>]
+```
+
+## Search
+
+```bash
+# Search messages
+shadowob search messages --query <text> [--server <server>] [--channel-id <id>] [--author-id <id>] [--after <date>] [--before <date>] [--has-attachments] [--limit <n>] --json
+```
+
+## Listen (Real-time Events)
+
+```bash
+# Stream mode: listen until timeout or count
+shadowob listen channel <channel-id> --mode stream [--timeout 60] [--count 10] --json
+
+# Poll mode: fetch recent messages
+shadowob listen channel <channel-id> --mode poll [--last 50] --json
+
+# Filter events
+shadowob listen channel <id> --event-type message:new,reaction:add --json
+
+# DM events
+shadowob listen dm <dm-channel-id> [--timeout 60] --json
+```
+
+## Output Format
+
+- Default: human-readable list format
+- `--json`: JSON output for programmatic use
+
+## Error Handling
+
+Commands exit with code 1 on error. Use `--json` to get structured errors:
+
+```json
+{ "error": "message" }
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shadowob/cloud",
-  "version": "1.1.6-dev.331",
+  "version": "1.1.7",
   "description": "shadowob-cloud — deploy AI agents to Kubernetes",
   "type": "module",
   "bin": {
@@ -58,8 +58,8 @@
     "yaml": "^2.8.4",
     "zod": "^3.25.76",
     "zustand": "^5.0.13",
-    "@shadowob/sdk": "1.1.6-dev.331",
-    "@shadowob/shared": "1.1.6-dev.331"
+    "@shadowob/sdk": "1.1.7",
+    "@shadowob/shared": "1.1.7"
   },
   "devDependencies": {
     "@playwright/test": "^1.52.0",
@@ -90,6 +90,7 @@
   },
   "scripts": {
     "build": "tsup && rsbuild build",
+    "build:cli": "tsup",
     "dev": "tsup --watch",
     "dev:backend": "tsup --watch",
     "dev:frontend": "rsbuild dev",
@@ -98,7 +99,11 @@
     "console:preview": "rsbuild preview",
     "generate:plugin-library": "node --import tsx scripts/generate-plugin-library.ts",
     "generate:schema": "node --import tsx scripts/generate-schema.ts",
+    "copy:cli-skill": "node --import tsx scripts/copy-cli-skill.ts",
+    "prebuild:cli": "pnpm generate:plugin-library",
     "prebuild": "pnpm generate:plugin-library",
+    "postbuild:cli": "pnpm copy:cli-skill",
+    "postbuild": "pnpm copy:cli-skill",
     "predev": "pnpm generate:plugin-library",
     "predev:backend": "pnpm generate:plugin-library",
     "predev:frontend": "pnpm generate:plugin-library",
@@ -108,9 +113,9 @@
     "pretest": "pnpm generate:plugin-library",
     "test": "vitest run",
     "test:watch": "vitest",
-    "pretest:e2e": "pnpm generate:plugin-library",
+    "pretest:e2e": "pnpm build:cli",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
-    "pretest:e2e:cli": "pnpm generate:plugin-library",
+    "pretest:e2e:cli": "pnpm build:cli",
     "test:e2e:cli": "vitest run --config vitest.cli.config.ts",
     "pretest:e2e:console": "pnpm generate:plugin-library",
     "test:e2e:console": "playwright test",