@skillcdn/console 0.3.0 → 0.3.2

package/src/cli/cli.ts

@@ -7,8 +7,18 @@ import {
   type FetchLike,
   type ProjectClient,
 } from "../client.js";
-import { CLIENT_RANGE_HEADER, judgeClient, parseVersion, VERSION_HEADER } from "../compat.js";
-import { addDays, dayOf as dayOfDate, isDay } from "../dates.js";
+import {
+  CLIENT_RANGE_HEADER,
+  CONSOLE_AT_LEAST,
+  consoleRange,
+  formatRange,
+  judgeClient,
+  judgeConsole,
+  parseVersion,
+  VERSION_HEADER,
+  formatVersion as versionText,
+} from "../compat.js";
+import { addDays, dayOf as dayOfDate, firstDayOfWeek, isDay, weekOf } from "../dates.js";
 import { DEFAULT_PAGE_LIMIT, LIST_LIMIT, MAX_OPTIONS, MIN_OPTIONS } from "../limits.js";
 import { fillRules, RULES_PATH, RULES_TITLE } from "../rules.js";
 import {
@@ -16,6 +26,7 @@ import {
   type RestClaim,
   type RestDecision,
   type RestMember,
+  type RestPackConnectStarted,
   type RestPerson,
   type RestSkillBrowse,
   type RestSkillFile,
@@ -28,7 +39,9 @@ import {
   type ColorName,
   GOAL_STATES,
   type GoalState,
+  PEOPLE_VISIBILITIES,
   PERSON_ROLES,
+  type PeopleVisibility,
   type PersonRole,
   PROJECT_ROLES,
   PROJECT_VISIBILITIES,
@@ -40,6 +53,7 @@ import {
   TASK_STATES,
   type TaskPriority,
   type TaskState,
+  WEEK_STARTS,
 } from "../vocabulary.js";
 import { loadWebRoot, type WebRoot, WebRootError } from "../web.js";
 import {
@@ -53,7 +67,7 @@ import {
   withLogin,
   withoutLogin,
 } from "./credentials.js";
-import type { DirectorySettings, DirectoryStore } from "./directory.js";
+import { type DirectorySettings, type DirectoryStore, THE_SENTENCE } from "./directory.js";
 import {
   formatAnswer,
   formatCategoryLine,
@@ -80,6 +94,9 @@ import {
   formatVersion,
   formatVersionLine,
   formatWork,
+  formatWorkspace,
+  moment,
+  setMomentZone,
 } from "./format.js";
 import { COMMAND_HELP, helpFor, ownSkillPath, usage } from "./help.js";
 import { describeInstall, type Install, updateCommandFor } from "./install.js";
@@ -161,6 +178,10 @@ export interface CliIo {
   readonly install?: Install | undefined;
   /** What the command last said of the versions; left out, it says it every time. */
   readonly notices?: NoticeStore | undefined;
+  /** The oldest console this command works with (ADR-0038); left out, the package's own floor. */
+  readonly consoleAtLeast?: string | undefined;
+  /** The language and region of this machine (`ko-KR`), for what follows a language where the person chose none; left out, English. */
+  readonly locale?: string | undefined;
   /** Where the console's own skills are on this machine, shipped with the package; nothing when they are not there. */
   readonly skillsDir?: string | undefined;
   /** How `serve` listens on the loopback (ADR-0014); left out, the command cannot serve. */
@@ -310,6 +331,14 @@ async function open(io: CliIo, values: Values): Promise<Session> {
     throw failed(wordsOf(resolved));
   }
   const { url, token } = resolved;
+  // Moments are printed in the workspace's time zone as the login kept it (ADR-0035); the
+  // environment's pair keeps nothing, and they stay as the API gives them.
+  setMomentZone(
+    resolved.via === "login"
+      ? credentials?.logins.find((kept) => kept.url === url && kept.account === resolved.account)
+          ?.timeZone
+      : undefined,
+  );
   const client = clientOf(io, url, token);
   const projectKey = async () =>
     text(values, "project") ?? io.env.CONSOLE_PROJECT ?? directory?.project;
@@ -484,18 +513,25 @@ async function personIdOf(
   return (await personOf(session, value)).id;
 }
 
-/** The person a login names, among the workspace's; the logins are as people sign in. */
+/**
+ * The person a login names, among the workspace's, found by their exact login as people sign in
+ * (ADR-0035): whom the console shows the person, and, for an owner of a project, anyone of the
+ * workspace, so that someone the People page does not show can still be listed.
+ */
 async function personOf(session: Session, login: string): Promise<RestPerson> {
-  const { items } = await session.client.people();
-  const found = items.find((person) => person.login.toLowerCase() === login.toLowerCase());
+  const found = await session.client.findPerson(login);
   if (found === undefined) {
     throw misuse(
-      `Nobody of the workspace is called ${login}. console people lists everyone, by login.`,
+      `Nobody of the workspace is called ${login}, or they are not yours to see. console people lists whom you see, by login.`,
     );
   }
   return found;
 }
 
+/** Who sees whom, as the command takes it: with a hyphen or an underscore. */
+const peopleVisibilityOf = (value: string): PeopleVisibility =>
+  wordOf(value.replaceAll("-", "_"), PEOPLE_VISIBILITIES, "who sees whom");
+
 /** One word of a vocabulary, or the refusal to understand. */
 function wordOf<T extends string>(value: string, words: readonly T[], what: string): T {
   const found = words.find((word) => word === value);
@@ -652,7 +688,14 @@ async function keep(
   }
   const next = withLogin(
     credentials,
-    { url, account: person.login, token, agent, since: new Date(io.now()).toISOString() },
+    {
+      url,
+      account: person.login,
+      token,
+      agent,
+      since: new Date(io.now()).toISOString(),
+      timeZone: me.workspace.timeZone ?? undefined,
+    },
     { default: asDefault },
   );
   const kept = await io.store.save(next);
@@ -826,6 +869,24 @@ function agentOf(env: CliIo["env"]): string | undefined {
   return undefined;
 }
 
+/**
+ * Keeps the workspace's time zone on the login the command used (ADR-0035), so that moments are
+ * printed in it from now on without asking; the environment's pair keeps nothing.
+ */
+async function rememberZone(io: CliIo, session: Session, zone: string | undefined): Promise<void> {
+  setMomentZone(zone);
+  if (session.via !== "login" || session.credentials === undefined) {
+    return;
+  }
+  const kept = session.credentials.logins.find(
+    (login) => login.url === session.url && login.account === session.account,
+  );
+  if (kept === undefined || kept.timeZone === zone) {
+    return;
+  }
+  await io.store.save(withLogin(session.credentials, { ...kept, timeZone: zone }));
+}
+
 const whoami: Command = async (args, io) => {
   const { values } = parse(args, {}, false);
   const session = await open(io, values);
@@ -834,6 +895,7 @@ const whoami: Command = async (args, io) => {
   if (person === null) {
     throw failed("The console does not know this token. Sign in again: console login");
   }
+  await rememberZone(io, session, me.workspace.timeZone ?? undefined);
   const key = await session.projectKey();
   const command = parseVersion(io.version);
   const server = parseVersion(me.console?.version);
@@ -841,11 +903,15 @@ const whoami: Command = async (args, io) => {
     command === undefined || server === undefined
       ? undefined
       : judgeClient(command, server).verdict;
+  // The oldest console this command works with (ADR-0038), as it stands within the command's line.
+  const atLeast = io.consoleAtLeast ?? CONSOLE_AT_LEAST;
+  const floor =
+    command === undefined ? atLeast : versionText(consoleRange(command, atLeast).atLeast);
   // A console from before the rule says nothing of itself; the command says so instead.
   const consoleWords =
     me.console === undefined
       ? "the console does not say its version, so it is older than 0.1.18"
-      : `the console is ${me.console.version} and takes ${me.console.clientRange}`;
+      : `the console is ${me.console.version} and takes ${me.console.clientRange}; this command works with a console from ${floor} on`;
   answer(
     io,
     session,
@@ -914,16 +980,29 @@ const use: Command = async (args, io) => {
   const bound = pinUrl
     ? ` at ${session.url}${pinAccount && session.account !== undefined ? ` as ${session.account}` : ""}`
     : "";
-  answer(
-    io,
-    session,
-    project,
-    () =>
+  answer(io, session, project, () =>
+    [
       `Working in ${project.name} (${project.key})${bound} from this directory on: kept in ${kept}, which is meant to be committed in a private repository and left out of a public one. What its people ask of agents: console rules.`,
+      // Nothing sends an agent to the console until the checkout says so; the sentence is the
+      // skill's (references/the-sentence.md), printed here as `skillcdn use` prints its own.
+      "Then put this sentence into the checkout's agreement (AGENTS.md, or CLAUDE.md where that is the file agents read), as it is, so that every agent working here is sent to the console:",
+      "",
+      THE_SENTENCE,
+    ].join("\n"),
   );
   return EXIT.ok;
 };
 
+/**
+ * The last day of this week (ADR-0039): the week begins as the workspace says, or, left to the
+ * language, as the person's language has it, else this machine's.
+ */
+async function endOfWeek(io: CliIo, session: Session, today: string): Promise<string> {
+  const me = await session.client.me();
+  const language = me.language ?? io.locale ?? "en";
+  return weekOf(today, firstDayOfWeek(language, me.workspace.weekStart ?? "auto")).at(-1) ?? today;
+}
+
 const tasks: Command = async (args, io) => {
   const { values } = parse(
     args,
@@ -935,6 +1014,7 @@ const tasks: Command = async (args, io) => {
       category: { type: "string" },
       goal: { type: "string" },
       due: { type: "string" },
+      search: { type: "string" },
       archived: { type: "boolean" },
       ...PAGE_OPTIONS,
     },
@@ -943,7 +1023,7 @@ const tasks: Command = async (args, io) => {
   const state = stateOf(text(values, "state"));
   if (on(values, "mine") && on(values, "unassigned")) {
     throw misuse(
-      "Say one: --mine for the tasks assigned to you, or --unassigned for those assigned to nobody",
+      "Say one: --mine for the tasks you work on, or --unassigned for those nobody works on",
     );
   }
   const page = pageOf(values);
@@ -958,19 +1038,22 @@ const tasks: Command = async (args, io) => {
       : due === "overdue"
         ? addDays(today, -1)
         : due === "week"
-          ? addDays(today, 6)
+          ? await endOfWeek(io, session, today)
           : (dayOf(io, due) ?? undefined);
-  const assignee = on(values, "mine")
-    ? ((await personIdOf(session, "me")) ?? undefined)
-    : undefined;
+  const worker = on(values, "mine") ? ((await personIdOf(session, "me")) ?? undefined) : undefined;
+  const search = text(values, "search")?.trim();
+  if (search === "") {
+    throw misuse("Say what to search for: console tasks --search <words>");
+  }
   const found = await project.tasks({
     ...(state === undefined ? {} : { state }),
     ...(on(values, "open") || due === "overdue" ? { open: true } : {}),
-    ...(assignee === undefined ? {} : { assignee }),
+    ...(worker === undefined ? {} : { worker }),
     ...(on(values, "unassigned") ? { unassigned: true } : {}),
     ...(text(values, "category") === undefined ? {} : { category: text(values, "category") }),
     ...(text(values, "goal") === undefined ? {} : { goal: text(values, "goal") }),
     ...(dueBy === undefined ? {} : { dueBy }),
+    ...(search === undefined ? {} : { q: search }),
     ...(on(values, "archived") ? { archived: true } : {}),
     ...page,
   });
@@ -1284,10 +1367,42 @@ const TASK_FIELDS: OptionSpec = {
   goal: { type: "string" },
   starts: { type: "string" },
   due: { type: "string" },
-  assignee: { type: "string" },
+  worker: { type: "string", multiple: true },
   parent: { type: "string" },
 };
 
+/**
+ * The people `--worker` names, each a login or `me`, given again or with commas between for
+ * several, in place of those there were; `none` alone for nobody; nothing when the flag was
+ * not given.
+ */
+async function workerIdsOf(
+  session: Session,
+  given: readonly string[],
+): Promise<string[] | undefined> {
+  if (given.length === 0) {
+    return undefined;
+  }
+  const names = given
+    .flatMap((value) => value.split(","))
+    .map((name) => name.trim())
+    .filter((name) => name.length > 0);
+  if (names.includes("none")) {
+    if (names.length > 1) {
+      throw misuse("Say --worker none alone, for nobody; or the logins of the workers.");
+    }
+    return [];
+  }
+  const ids: string[] = [];
+  for (const name of names) {
+    const id = await personIdOf(session, name);
+    if (typeof id === "string" && !ids.includes(id)) {
+      ids.push(id);
+    }
+  }
+  return ids;
+}
+
 /** What the flags say of a task's fields, as the API takes them; `none` clears a field. */
 async function taskFieldsOf(
   io: CliIo,
@@ -1301,7 +1416,7 @@ async function taskFieldsOf(
   const goalId = orNone(text(values, "goal"));
   const startsOn = dayOf(io, text(values, "starts"), true);
   const dueOn = dayOf(io, text(values, "due"), true);
-  const assigneeId = await personIdOf(session, text(values, "assignee"));
+  const workerIds = await workerIdsOf(session, texts(values, "worker"));
   const parent = text(values, "parent");
   const parentId =
     parent === undefined ? undefined : parent === "none" ? null : (await project.task(parent)).id;
@@ -1312,7 +1427,7 @@ async function taskFieldsOf(
     ...(goalId === undefined ? {} : { goalId }),
     ...(startsOn === undefined ? {} : { startsOn }),
     ...(dueOn === undefined ? {} : { dueOn }),
-    ...(assigneeId === undefined ? {} : { assigneeId }),
+    ...(workerIds === undefined ? {} : { workerIds }),
     ...(parentId === undefined ? {} : { parentId }),
   };
 }
@@ -1333,7 +1448,12 @@ const newTask: Command = async (args, io) => {
     ...(body === undefined ? {} : { body }),
     ...fields,
   });
-  answer(io, session, made, () => `Task #${made.number} written: ${made.title}\nid: ${made.id}`);
+  answer(
+    io,
+    session,
+    made,
+    () => `Task #${made.number} written: ${made.title}\ntask id: ${made.id}`,
+  );
   return EXIT.ok;
 };
 
@@ -1359,7 +1479,7 @@ const editTask: Command = async (args, io) => {
   };
   if (Object.keys(patch).length === 0) {
     throw misuse(
-      "Say what to change: --title, --body, --state, --priority, --category, --goal, --starts, --due, --assignee or --parent; none clears a field.",
+      "Say what to change: --title, --body, --state, --priority, --category, --goal, --starts, --due, --worker or --parent; none clears a field.",
     );
   }
   const found = await project.task(ref);
@@ -1556,6 +1676,9 @@ const take: Command = async (args, io) => {
   answer(io, session, { run, task: taken, comments: comments.items, rules }, () =>
     [
       `Run ${run.id} began on #${found.number} ${found.title}, as "${run.agent}" for ${run.person.login}. The task is in progress and theirs.${tookOver}${elsewhere}`,
+      // The ids on a line of their own, each named: a run's and a task's begin alike, and a
+      // task has a number for people as well.
+      `run id: ${run.id}  task id: ${found.id}  (task #${found.number})`,
       "",
       formatTask(taken, undefined, undefined, comments.items),
       "",
@@ -1701,7 +1824,7 @@ const ask: Command = async (args, io) => {
   io.stdout(
     session.json
       ? `${JSON.stringify(raised, null, 2)}\n`
-      : `Decision ${raised.id} raised on run ${runId}; the run waits for a person.\n${formatOptions(raised)}\n`,
+      : `Decision ${raised.id} raised on run ${runId}; the run waits for a person.\ndecision id: ${raised.id}\n${formatOptions(raised)}\n`,
   );
   return settle(io, session, project, raised, seconds, true);
 };
@@ -1897,23 +2020,36 @@ const restore: Command = async (args, io) => {
 const goals: Command = async (args, io) => {
   const { values } = parse(
     args,
-    { category: { type: "string" }, state: { type: "string" } },
+    {
+      category: { type: "string" },
+      state: { type: "string" },
+      search: { type: "string" },
+      ...PAGE_OPTIONS,
+    },
     false,
   );
   const state = goalStateOf(text(values, "state"));
   const category = text(values, "category");
+  const search = text(values, "search")?.trim();
+  if (search === "") {
+    throw misuse("Say what to search for: console goals --search <words>");
+  }
+  const page = pageOf(values);
   const session = await open(io, values);
   const project = await session.project();
   const found = await project.goals({
     ...(state === undefined ? {} : { state }),
     ...(category === undefined ? {} : { category }),
+    ...(search === undefined ? {} : { q: search }),
+    ...page,
   });
   answer(io, session, found, () =>
     found.items.length === 0
-      ? state === undefined && category === undefined
+      ? state === undefined && category === undefined && search === undefined
         ? "No goals. An owner sets one: console goal new <title> --due <day>"
         : "No goal matches."
-      : found.items.map(formatGoalLine).join("\n"),
+      : found.items.map(formatGoalLine).join("\n") +
+        formatMore(found.more, page.limit, page.offset),
   );
   return EXIT.ok;
 };
@@ -1950,7 +2086,7 @@ const newGoal: Command = async (args, io) => {
     ...(startsOn === undefined ? {} : { startsOn }),
     ...(dueOn === undefined ? {} : { dueOn }),
   });
-  answer(io, session, made, () => `Goal set: ${made.title}\nid: ${made.id}`);
+  answer(io, session, made, () => `Goal set: ${made.title}\ngoal id: ${made.id}`);
   return EXIT.ok;
 };
 
@@ -2186,6 +2322,81 @@ const people: Command = async (args, io) => {
   return EXIT.ok;
 };
 
+// The workspace's settings (ADR-0035): read by everyone, changed by an administrator, themselves
+// on the Settings page or through their agent here (ADR-0021).
+const WORKSPACE_FLAGS =
+  "--people-visibility <everyone|shared-projects>, --week-start <auto|monday|sunday>, --time-zone <zone|none>";
+const WORKSPACE_USAGE = `Say what to do: console workspace  |  console workspace edit [${WORKSPACE_FLAGS.replaceAll(", ", "] [")}]  |  console workspace pack-token --connect|--stdin|--remove`;
+
+const workspace: Command = async (args, io) => {
+  const [verb, ...rest] = args;
+  if (verb === undefined || verb.startsWith("--")) {
+    const { values } = parse(args, {}, false);
+    const session = await open(io, values);
+    const me = await session.client.me();
+    await rememberZone(io, session, me.workspace.timeZone ?? undefined);
+    answer(io, session, me.workspace, () => formatWorkspace(me.workspace));
+    return EXIT.ok;
+  }
+  if (verb === "edit") {
+    const { values } = parse(
+      rest,
+      {
+        "people-visibility": { type: "string" },
+        "week-start": { type: "string" },
+        "time-zone": { type: "string" },
+      },
+      false,
+    );
+    const visibility = text(values, "people-visibility");
+    const weekStart = text(values, "week-start");
+    const zone = text(values, "time-zone");
+    if (visibility === undefined && weekStart === undefined && zone === undefined) {
+      throw misuse(`Say what to change: ${WORKSPACE_FLAGS}`);
+    }
+    const session = await open(io, values);
+    const changed = await session.client.updateWorkspace({
+      ...(visibility === undefined ? {} : { peopleVisibility: peopleVisibilityOf(visibility) }),
+      ...(weekStart === undefined
+        ? {}
+        : { weekStart: wordOf(weekStart, WEEK_STARTS, "a day the week begins on") }),
+      ...(zone === undefined ? {} : { timeZone: zone === "none" ? null : zone }),
+    });
+    await rememberZone(io, session, changed.timeZone ?? undefined);
+    answer(io, session, changed, () => formatWorkspace(changed));
+    return EXIT.ok;
+  }
+  if (verb === "pack-token") {
+    const { values, positionals } = parse(rest, PACK_TOKEN_FLAGS);
+    if (positionals.length > 0) {
+      throw misuse(
+        "The workspace's token names no project: console workspace pack-token --connect, --stdin or --remove",
+      );
+    }
+    const way = wayOf(values);
+    const session = await open(io, values);
+    const { client } = session;
+    return packToken(
+      io,
+      session,
+      way,
+      {
+        set: (token) => client.setWorkspacePackToken({ token }),
+        remove: () => client.removeWorkspacePackToken(),
+        connect: () => client.connectWorkspacePackToken(),
+        async standing() {
+          const state = await client.workspacePackTokenConnection();
+          return state.status === "connected"
+            ? { status: "connected", held: state.workspace }
+            : state;
+        },
+      },
+      formatWorkspace,
+    );
+  }
+  throw misuse(WORKSPACE_USAGE);
+};
+
 const PERSON_USAGE =
   "Say what to do: console person role <login> <admin|member>  |  person add <login> [--host gh|google]  |  person remove <login>  |  person deactivate <login>  |  person reactivate <login>";
 
@@ -2309,35 +2520,118 @@ const editProject: Command = async (args, io) => {
   return EXIT.ok;
 };
 
-/** The pack token (ADR-0028): read from standard input and never from an argument, so that no shell keeps it. */
-const projectPackToken: Command = async (args, io) => {
-  const { values, positionals } = parse(args, {
-    stdin: { type: "boolean" },
-    remove: { type: "boolean" },
-  });
-  const key = theOne(
-    positionals,
-    "Say which project: console project pack-token <key> --stdin, or console project pack-token <key> --remove",
-  );
-  if (on(values, "stdin") === on(values, "remove")) {
+/** How a pack's connection ended short of a token (ADR-0036), in words for the person. */
+const PACK_CONNECT_ENDED = {
+  expired: "The code expired before anyone approved it. Run the command again for a new one.",
+  declined: "The request was declined at SkillCDN, or the code was spent.",
+  refused:
+    "SkillCDN refused the request: the repository is not one the person may open, the pack is public and needs no token, or they hold as many tokens as one may.",
+} as const;
+
+/** How a SkillCDN token is to change, one of the three the flags name. */
+const wayOf = (values: Values): "connect" | "stdin" | "remove" => {
+  const ways = (["connect", "stdin", "remove"] as const).filter((way) => on(values, way));
+  const [way] = ways;
+  if (way === undefined || ways.length !== 1) {
     throw misuse(
-      "Say one of --stdin, which reads the token from standard input, and --remove, which takes it away.",
+      "Say one of --connect, which asks SkillCDN for a code a person approves; --stdin, which reads a token made by hand from standard input; and --remove, which takes the token away.",
     );
   }
-  const session = await open(io, values);
-  const project = session.client.project(key);
-  if (on(values, "remove")) {
-    const changed = await project.removePackToken();
-    answer(io, session, changed, () => formatProject(changed));
+  return way;
+};
+
+/** Whose SkillCDN token the command works: a project's, or the workspace's for the organization's pack. */
+interface TokenHolder<T> {
+  set(token: string): Promise<T>;
+  remove(): Promise<T>;
+  connect(): Promise<RestPackConnectStarted>;
+  standing(): Promise<
+    | { readonly status: "none" }
+    | { readonly status: "pending" }
+    | { readonly status: "ended"; readonly reason: keyof typeof PACK_CONNECT_ENDED }
+    | { readonly status: "connected"; readonly held: T }
+  >;
+}
+
+/**
+ * The SkillCDN token (ADR-0028): connected with a code a person approves at SkillCDN (ADR-0036),
+ * or read from standard input and never from an argument, so that no shell keeps it; or taken
+ * away. The same for a project's and for the workspace's.
+ */
+async function packToken<T>(
+  io: CliIo,
+  session: Session,
+  way: "connect" | "stdin" | "remove",
+  holder: TokenHolder<T>,
+  format: (held: T) => string,
+): Promise<number> {
+  if (way === "remove") {
+    const changed = await holder.remove();
+    answer(io, session, changed, () => format(changed));
     return EXIT.ok;
   }
+  if (way === "connect") {
+    const started = await holder.connect();
+    io.stdout(
+      `To connect the pack, a person who may open its repository opens ${started.url} signed in at SkillCDN, checks that the page shows the code ${started.code}, and approves; the console receives the SkillCDN token and keeps it sealed, shown to nobody.\nWaiting for that, until ${moment(started.expiresAt)}.\n`,
+    );
+    for (;;) {
+      await io.sleep(started.intervalSeconds * 1000);
+      const state = await holder.standing();
+      if (state.status === "pending") {
+        continue;
+      }
+      if (state.status === "connected") {
+        answer(io, session, state.held, () => `Connected.\n${format(state.held)}`);
+        return EXIT.ok;
+      }
+      if (state.status === "ended") {
+        throw failed(PACK_CONNECT_ENDED[state.reason]);
+      }
+      throw failed(
+        "The console no longer waits for the connection; run the command again for a new code.",
+      );
+    }
+  }
   const token = (await io.readStdin()).trim();
   if (token.length === 0) {
     throw failed("No token was given on standard input.");
   }
-  const changed = await project.setPackToken({ token });
-  answer(io, session, changed, () => formatProject(changed));
+  const changed = await holder.set(token);
+  answer(io, session, changed, () => format(changed));
   return EXIT.ok;
+}
+
+const PACK_TOKEN_FLAGS = {
+  connect: { type: "boolean" },
+  stdin: { type: "boolean" },
+  remove: { type: "boolean" },
+} as const;
+
+const projectPackToken: Command = async (args, io) => {
+  const { values, positionals } = parse(args, PACK_TOKEN_FLAGS);
+  const key = theOne(
+    positionals,
+    "Say which project: console project pack-token <key> --connect, --stdin or --remove",
+  );
+  const way = wayOf(values);
+  const session = await open(io, values);
+  const project = session.client.project(key);
+  return packToken(
+    io,
+    session,
+    way,
+    {
+      set: (token) => project.setPackToken({ token }),
+      remove: () => project.removePackToken(),
+      connect: () => project.connectPackToken(),
+      async standing() {
+        const state = await project.packTokenConnection();
+        return state.status === "connected" ? { status: "connected", held: state.project } : state;
+      },
+    },
+    formatProject,
+  );
 };
 
 const projectIcon: Command = async (args, io) => {
@@ -2564,6 +2858,7 @@ const COMMANDS: Readonly<Record<string, Command>> = {
   rules,
   people,
   person,
+  workspace,
   project,
   members,
   member,
@@ -2674,11 +2969,39 @@ async function noticeVersions(io: CliIo, seen: ConsoleSeen): Promise<void> {
   });
 }
 
+/**
+ * The refusal of a console older than this command works with (ADR-0038), in a console's own
+ * form: a `426` the command reads as it reads the console's, before it acts on anything the
+ * console answered.
+ */
+function consoleRefusal(io: CliIo, seen: ConsoleSeen): Response | undefined {
+  const command = parseVersion(io.version);
+  const server = parseVersion(seen.version);
+  if (command === undefined || server === undefined) {
+    return undefined;
+  }
+  const { verdict, range } = judgeConsole(server, command, io.consoleAtLeast ?? CONSOLE_AT_LEAST);
+  if (verdict !== "outdated") {
+    return undefined;
+  }
+  return Response.json(
+    {
+      error: {
+        code: "console.outdated",
+        message: `This console, ${seen.version}, is older than this command (${io.version}) works with (${formatRange(range)}).`,
+      },
+    },
+    { status: 426 },
+  );
+}
+
 /** What a refusal of the console is followed by, when there is something to do about it. */
 function hintFor(error: ApiError, io: CliIo, seen: ConsoleSeen): string {
   switch (error.code) {
     case "client.outdated":
       return `Update the command: ${updateWords(io, seen.version)}\n`;
+    case "console.outdated":
+      return `Install the console's version: ${updateWords(io, seen.version)}; or ask the console's operator to update the console.\n`;
     case "client.too_new":
       return `Install the console's version: ${updateWords(io, seen.version)}; or ask the console's operator to update the console.\n`;
     case "auth.required":
@@ -2715,6 +3038,8 @@ function hintFor(error: ApiError, io: CliIo, seen: ConsoleSeen): string {
       return "The person is listed already. console member role <login> <owner|member> changes what they are.\n";
     case "member.not_found":
       return "The person is not listed in the project. console members lists those who are.\n";
+    case "member.open_project":
+      return "The project is open to the workspace, so everyone of it is a member already. console member add <login> --role owner lists an owner; console member role <login> member takes one back to member.\n";
     case "category.key_taken":
       return "A category has that key already. console categories lists them.\n";
     case "category.not_found":
@@ -2752,7 +3077,13 @@ export async function runCli(argv: readonly string[], io: CliIo): Promise<number
       const response = await io.fetch(input, init);
       seen.version = response.headers.get(VERSION_HEADER) ?? seen.version;
       seen.range = response.headers.get(CLIENT_RANGE_HEADER) ?? seen.range;
-      return response;
+      // A console older than this command works with is refused here (ADR-0038); `serve`
+      // carries the pages' own requests, which are not the command's to judge.
+      // A refusal of the console's own is passed on as it is.
+      return (
+        (name === "serve" || response.status === 426 ? undefined : consoleRefusal(io, seen)) ??
+        response
+      );
     },
   };
   try {
@@ -2784,7 +3115,9 @@ export async function runCli(argv: readonly string[], io: CliIo): Promise<number
     }
     if (error instanceof ApiError) {
       io.stderr(`${error.code}: ${error.message}\n${hintFor(error, io, seen)}`);
-      return error.code === "client.outdated" || error.code === "client.too_new"
+      return error.code === "client.outdated" ||
+        error.code === "client.too_new" ||
+        error.code === "console.outdated"
         ? EXIT.incompatible
         : EXIT.failed;
     }