@skrr-ai/cli 0.1.36 → 0.1.37

package/README.md

@@ -839,8 +839,10 @@ cat space.json | sky spaces create --from-json -
 sky spaces create --from-json template.json --title "Override title"
 ```
 
-Flags: `--title`, `--description`, `--status`, `--color`, `--lead-agent`,
-`--target-date`, `--group-chat`, `--from-json <file|->`, `--json`.
+Flags: `--title`, `--description`, `--status`, `--color`, `--icon`,
+`--icon-color`, `--lead-agent`, `--team`, `--target-date`, `--goal`,
+`--label`, `--group-chat`, `--parent`, `--no-inherit-access`,
+`--from-json <file|->`, `--json`.
 
 ### `sky spaces update <id>`
 
@@ -852,8 +854,19 @@ sky spaces update <space-id> --status active --color "#4f46e5"
 sky spaces update <space-id> --from-json patch.json
 ```
 
-Flags: `--title`, `--description`, `--status`, `--color`, `--lead-agent`,
-`--target-date`, `--from-json <file|->`, `--json`.
+Flags: `--title`, `--description`, `--status`, `--color`, `--icon`,
+`--icon-color`, `--lead-agent`, `--target-date`, `--goal`,
+`--no-inherit-access`, `--estimate-scale`, `--estimate-migration`,
+`--default-estimate`, `--no-use-default-estimate`, `--default-expect`,
+`--delivery-mode`, `--integration-branch`, `--auto-merge-tier`,
+`--worktree-isolation`, `--no-auto-start-on-backlog-exit`,
+`--triage-external-intake`, `--default-task-template`,
+`--from-json <file|->`, `--json`.
+
+Nullable fields accept `none` (or `null`) to clear: `--icon none` restores
+the default folder, `--icon-color none` the neutral icon color,
+`--lead-agent none` removes the Leader, `--target-date none` clears the
+date, and `--default-task-template none` removes the default template.
 
 ### `sky spaces delete <id>`
 

package/dist/commands/agents/actions/create.d.ts

@@ -18,6 +18,11 @@ export default class AgentsActionsCreate extends BaseCommand {
         embeds: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         order: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         enabled: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        scope: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        space: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'space-title': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        label: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        outcome: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/agents/actions/create.js

@@ -39,6 +39,20 @@ class AgentsActionsCreate extends base_command_1.BaseCommand {
         embeds: core_1.Flags.string({ description: 'Embedded built-in actions JSON array' }),
         order: core_1.Flags.integer({ description: 'Display order (defaults to end of list)' }),
         enabled: core_1.Flags.boolean({ description: 'Create enabled or disabled', allowNo: true }),
+        scope: core_1.Flags.string({
+            description: 'Where the action is offered. Implied by --space / --label; pass "general" to offer it everywhere.',
+            options: [...agent_actions_1.AGENT_ACTION_SCOPE_CHOICES],
+        }),
+        space: core_1.Flags.string({ description: 'Offer only in this space (implies --scope space)' }),
+        'space-title': core_1.Flags.string({ description: 'Denormalized space title for the scope chip' }),
+        label: core_1.Flags.string({
+            description: 'Offer in every space carrying this label (repeatable, any-of; implies --scope label)',
+            multiple: true,
+        }),
+        outcome: core_1.Flags.string({
+            description: "What a run leaves behind: 'ephemeral' hides the run's task once it answers, 'durable' keeps it on the board. Default ephemeral.",
+            options: [...agent_actions_1.AGENT_ACTION_OUTCOME_CHOICES],
+        }),
     };
     async run() {
         this.requireAuth();
@@ -54,6 +68,10 @@ class AgentsActionsCreate extends base_command_1.BaseCommand {
                 config: (0, agent_actions_1.parseJsonObjectFlag)(flags.config, '--config'),
                 order: flags.order,
                 enabled: flags.enabled,
+                // Flags win over --from-json, and a JSON body may still carry these
+                // directly. Both paths land on the same two fields below.
+                scope: (0, agent_actions_1.resolveAgentActionScopeFlags)(flags),
+                outcome: flags.outcome,
             });
         }
         catch (err) {
@@ -69,12 +87,18 @@ class AgentsActionsCreate extends base_command_1.BaseCommand {
             const kind = body.kind === 'builtin' ? 'builtin' : 'prompt';
             const order = typeof body.order === 'number' ? body.order : (0, agent_actions_1.nextActionOrder)(actions);
             const enabled = typeof body.enabled === 'boolean' ? body.enabled : true;
+            const scope = body.scope;
+            const outcome = body.outcome === 'durable' || body.outcome === 'ephemeral'
+                ? body.outcome
+                : undefined;
             if (kind === 'builtin') {
                 const builtinType = body.builtinType;
                 if (!agent_actions_1.BUILTIN_ACTION_TYPES.includes(builtinType)) {
                     this.error(`--builtin-type is required for built-in actions.`, { exit: 1 });
                 }
                 created = (0, agent_actions_1.makeBuiltinAction)({
+                    scope,
+                    outcome,
                     title,
                     description: typeof body.description === 'string' ? body.description : undefined,
                     builtinType: builtinType,
@@ -104,6 +128,8 @@ class AgentsActionsCreate extends base_command_1.BaseCommand {
                     this.error(err.message, { exit: 1 });
                 }
                 created = (0, agent_actions_1.makePromptAction)({
+                    scope,
+                    outcome,
                     title,
                     description: typeof body.description === 'string' ? body.description : undefined,
                     prompt,

package/dist/commands/agents/actions/update.d.ts

@@ -17,6 +17,11 @@ export default class AgentsActionsUpdate extends BaseCommand {
         'replace-config': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         order: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         enabled: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        scope: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        space: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'space-title': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        label: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        outcome: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/agents/actions/update.js

@@ -35,6 +35,20 @@ class AgentsActionsUpdate extends base_command_1.BaseCommand {
         }),
         order: core_1.Flags.integer({ description: 'Display order' }),
         enabled: core_1.Flags.boolean({ description: 'Enable or disable the action', allowNo: true }),
+        scope: core_1.Flags.string({
+            description: 'Where the action is offered. Implied by --space / --label; pass "general" to offer it everywhere.',
+            options: [...agent_actions_1.AGENT_ACTION_SCOPE_CHOICES],
+        }),
+        space: core_1.Flags.string({ description: 'Offer only in this space (implies --scope space)' }),
+        'space-title': core_1.Flags.string({ description: 'Denormalized space title for the scope chip' }),
+        label: core_1.Flags.string({
+            description: 'Offer in every space carrying this label (repeatable, any-of; implies --scope label)',
+            multiple: true,
+        }),
+        outcome: core_1.Flags.string({
+            description: "What a run leaves behind: 'ephemeral' hides the run's task once it answers, 'durable' keeps it on the board.",
+            options: [...agent_actions_1.AGENT_ACTION_OUTCOME_CHOICES],
+        }),
     };
     async run() {
         this.requireAuth();
@@ -49,6 +63,8 @@ class AgentsActionsUpdate extends base_command_1.BaseCommand {
                 config: (0, agent_actions_1.parseJsonObjectFlag)(flags.config, '--config'),
                 order: flags.order,
                 enabled: flags.enabled,
+                scope: (0, agent_actions_1.resolveAgentActionScopeFlags)(flags),
+                outcome: flags.outcome,
             });
         }
         catch (err) {
@@ -76,6 +92,14 @@ class AgentsActionsUpdate extends base_command_1.BaseCommand {
                 next.order = patch.order;
             if (typeof patch.enabled === 'boolean')
                 next.enabled = patch.enabled;
+            // A scope is replaced wholesale, never merged: `{kind:'space'}` and
+            // `{kind:'label'}` carry disjoint fields, so a shallow merge would leave
+            // a `labelIds` behind on a space scope and produce a shape the write gate
+            // rejects. Absent means "leave the existing scope alone".
+            if (patch.scope !== undefined)
+                next.scope = patch.scope;
+            if (patch.outcome !== undefined)
+                next.outcome = patch.outcome;
             if (current.kind === 'builtin') {
                 const builtin = next;
                 if (patch.builtinType !== undefined) {

package/dist/commands/agents/api-actions/add.d.ts

@@ -0,0 +1,41 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Attach (or re-attach) an OpenAPI document to an agent as a tool surface.
+ *
+ * The derivation is the SAME code the web builder runs —
+ * `validateAndParseOpenAPISpec` then `openapiToFunction`, both from
+ * `@skrr-ai/data-provider`. That matters more than it looks: the server stores
+ * `functions` verbatim and never re-reads the spec, so a CLI that derived them
+ * its own way would produce actions subtly unlike the ones the web produces from
+ * the same document, and the difference would only show up at call time.
+ *
+ * The spec is validated LOCALLY before anything is sent, because the endpoint's
+ * failure for a malformed document is `400 No functions provided` — true, and
+ * useless for finding the line that is wrong.
+ */
+export default class AgentsApiActionsAdd extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        agentId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        spec: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'action-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        auth: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'api-key': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'authorization-type': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'custom-auth-header': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'oauth-client-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'oauth-client-secret': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'oauth-authorization-url': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'oauth-client-url': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'oauth-scope': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'oauth-token-exchange-method': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'dry-run': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    private readSpec;
+    private buildAuth;
+    run(): Promise<void>;
+}

package/dist/commands/agents/api-actions/add.js

@@ -0,0 +1,202 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const promises_1 = require("node:fs/promises");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+/**
+ * Attach (or re-attach) an OpenAPI document to an agent as a tool surface.
+ *
+ * The derivation is the SAME code the web builder runs —
+ * `validateAndParseOpenAPISpec` then `openapiToFunction`, both from
+ * `@skrr-ai/data-provider`. That matters more than it looks: the server stores
+ * `functions` verbatim and never re-reads the spec, so a CLI that derived them
+ * its own way would produce actions subtly unlike the ones the web produces from
+ * the same document, and the difference would only show up at call time.
+ *
+ * The spec is validated LOCALLY before anything is sent, because the endpoint's
+ * failure for a malformed document is `400 No functions provided` — true, and
+ * useless for finding the line that is wrong.
+ */
+class AgentsApiActionsAdd extends base_command_1.BaseCommand {
+    static description = 'Attach an OpenAPI spec to an agent as a callable Action';
+    static examples = [
+        '<%= config.bin %> agents api-actions add <agent-id> --spec ./weather.yaml',
+        'cat weather.json | <%= config.bin %> agents api-actions add <agent-id> --spec -',
+        '<%= config.bin %> agents api-actions add <agent-id> --spec ./api.yaml --auth service_http --api-key $KEY',
+        '<%= config.bin %> agents api-actions add <agent-id> --spec ./api.yaml --action-id <existing> # replace in place',
+    ];
+    static args = {
+        agentId: core_1.Args.string({ description: 'Agent ID', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        spec: core_1.Flags.string({
+            description: 'OpenAPI document — path to a JSON/YAML file, or "-" for stdin',
+            required: true,
+        }),
+        'action-id': core_1.Flags.string({
+            description: 'Replace this existing action instead of creating a new one',
+        }),
+        auth: core_1.Flags.string({
+            description: 'How the API authenticates',
+            options: [data_provider_1.AuthTypeEnum.None, data_provider_1.AuthTypeEnum.ServiceHttp, data_provider_1.AuthTypeEnum.OAuth],
+            default: data_provider_1.AuthTypeEnum.None,
+        }),
+        'api-key': core_1.Flags.string({ description: '--auth service_http: the key or token' }),
+        'authorization-type': core_1.Flags.string({
+            description: '--auth service_http: how the key is presented',
+            options: [
+                data_provider_1.AuthorizationTypeEnum.Bearer,
+                data_provider_1.AuthorizationTypeEnum.Basic,
+                data_provider_1.AuthorizationTypeEnum.Custom,
+            ],
+        }),
+        'custom-auth-header': core_1.Flags.string({
+            description: '--authorization-type custom: the header name',
+        }),
+        'oauth-client-id': core_1.Flags.string({ description: '--auth oauth: client id' }),
+        'oauth-client-secret': core_1.Flags.string({ description: '--auth oauth: client secret' }),
+        'oauth-authorization-url': core_1.Flags.string({ description: '--auth oauth: authorization URL' }),
+        'oauth-client-url': core_1.Flags.string({ description: '--auth oauth: token URL' }),
+        'oauth-scope': core_1.Flags.string({ description: '--auth oauth: space-separated scopes' }),
+        'oauth-token-exchange-method': core_1.Flags.string({
+            description: '--auth oauth: how the token is exchanged',
+            options: [data_provider_1.TokenExchangeMethodEnum.DefaultPost, data_provider_1.TokenExchangeMethodEnum.BasicAuthHeader],
+        }),
+        'dry-run': core_1.Flags.boolean({
+            description: 'Parse the spec and report the functions it yields, send nothing',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async readSpec(source) {
+        if (source === '-') {
+            const chunks = [];
+            for await (const chunk of process.stdin)
+                chunks.push(Buffer.from(chunk));
+            return Buffer.concat(chunks).toString('utf8');
+        }
+        return (0, promises_1.readFile)(source, 'utf8');
+    }
+    buildAuth(flags) {
+        const type = flags.auth;
+        if (type === data_provider_1.AuthTypeEnum.ServiceHttp) {
+            if (!flags['api-key']) {
+                this.error('--auth service_http needs --api-key.', { exit: 1 });
+            }
+            if (flags['authorization-type'] === data_provider_1.AuthorizationTypeEnum.Custom &&
+                !flags['custom-auth-header']) {
+                this.error('--authorization-type custom needs --custom-auth-header.', { exit: 1 });
+            }
+            return {
+                api_key: String(flags['api-key']),
+                auth: {
+                    type,
+                    authorization_type: flags['authorization-type'] ?? data_provider_1.AuthorizationTypeEnum.Bearer,
+                    ...(flags['custom-auth-header'] === undefined
+                        ? {}
+                        : { custom_auth_header: String(flags['custom-auth-header']) }),
+                },
+            };
+        }
+        if (type === data_provider_1.AuthTypeEnum.OAuth) {
+            const missing = [
+                ['--oauth-client-id', flags['oauth-client-id']],
+                ['--oauth-client-secret', flags['oauth-client-secret']],
+                ['--oauth-authorization-url', flags['oauth-authorization-url']],
+                ['--oauth-client-url', flags['oauth-client-url']],
+            ]
+                .filter(([, value]) => !value)
+                .map(([name]) => name);
+            if (missing.length > 0) {
+                this.error(`--auth oauth needs ${missing.join(', ')}.`, { exit: 1 });
+            }
+            return {
+                oauth_client_id: String(flags['oauth-client-id']),
+                oauth_client_secret: String(flags['oauth-client-secret']),
+                auth: {
+                    type,
+                    authorization_url: String(flags['oauth-authorization-url']),
+                    client_url: String(flags['oauth-client-url']),
+                    ...(flags['oauth-scope'] === undefined ? {} : { scope: String(flags['oauth-scope']) }),
+                    token_exchange_method: flags['oauth-token-exchange-method'] ??
+                        data_provider_1.TokenExchangeMethodEnum.DefaultPost,
+                },
+            };
+        }
+        return { auth: { type: data_provider_1.AuthTypeEnum.None } };
+    }
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(AgentsApiActionsAdd);
+        let rawSpec;
+        try {
+            rawSpec = await this.readSpec(flags.spec);
+        }
+        catch (err) {
+            this.error(`Could not read --spec ${flags.spec}: ${err.message}`, { exit: 1 });
+        }
+        const validation = (0, data_provider_1.validateAndParseOpenAPISpec)(rawSpec);
+        if (!validation.status || !validation.spec) {
+            this.error(`The OpenAPI document is not usable: ${validation.message}`, { exit: 1 });
+        }
+        const { functionSignatures, requestBuilders } = (0, data_provider_1.openapiToFunction)(validation.spec);
+        const functions = functionSignatures.map((signature) => signature.toObjectTool());
+        if (functions.length === 0) {
+            this.error('The spec parsed but yielded no callable operations. Every path needs an ' +
+                'operationId and a method the parser understands.', { exit: 1 });
+        }
+        const first = Object.values(requestBuilders)[0];
+        if (!first?.domain) {
+            this.error('The spec has no server URL to call — `servers[0].url` is required.', { exit: 1 });
+        }
+        let domain;
+        try {
+            domain = new URL(first.domain).hostname;
+        }
+        catch {
+            this.error(`The spec's server URL is not a URL: ${first.domain}`, { exit: 1 });
+        }
+        if (flags['dry-run']) {
+            const preview = {
+                domain: domain,
+                functions: Object.entries(requestBuilders).map(([name, props]) => ({
+                    name,
+                    method: props.method,
+                    path: props.path,
+                })),
+            };
+            this.log(flags.json
+                ? JSON.stringify(preview, null, 2)
+                : `${preview.functions.length} operation(s) on ${domain}:\n` +
+                    preview.functions
+                        .map((f) => `  ${f.name}  ${f.method.toUpperCase()} ${f.path}`)
+                        .join('\n'));
+            return;
+        }
+        const metadata = {
+            raw_spec: rawSpec,
+            domain: domain,
+            ...this.buildAuth(flags),
+        };
+        let result;
+        try {
+            result = await data_provider_1.dataService.updateAgentAction({
+                agent_id: args.agentId,
+                ...(flags['action-id'] === undefined ? {} : { action_id: flags['action-id'] }),
+                metadata,
+                functions,
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(this.agentJson(args.agentId, result));
+            return;
+        }
+        this.log(`${flags['action-id'] ? 'Updated' : 'Added'} an OpenAPI action on agent ${args.agentId} — ` +
+            `${functions.length} operation(s) on ${domain}`);
+        this.printAgentUrl(args.agentId);
+    }
+}
+exports.default = AgentsApiActionsAdd;

package/dist/commands/agents/api-actions/index.d.ts

@@ -0,0 +1,28 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * OpenAPI-spec-backed Actions — an agent calling a third-party HTTP API.
+ *
+ * WHY THE COMMAND IS NOT CALLED `actions`
+ * ───────────────────────────────────────
+ * Three different things in this product are called an "action", and two of
+ * them already own that word in the CLI:
+ *
+ *   skrr agents actions   — embedded `agentActions`: prompt/builtin buttons
+ *                           that live ON the agent document
+ *   skrr actions          — marketplace LISTINGS of those embedded actions
+ *   skrr agents api-actions (this) — `/api/agents/actions`: a tool surface
+ *                           generated from an OpenAPI document
+ *
+ * The third had no CLI at all, which the naming collision helped hide. Renaming
+ * the other two would break muscle memory for a surface that works, so this one
+ * takes an unambiguous name and all three now say which concept they are.
+ */
+export default class AgentsApiActionsList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        agent: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/agents/api-actions/index.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+const format_1 = require("../../../lib/format");
+/**
+ * OpenAPI-spec-backed Actions — an agent calling a third-party HTTP API.
+ *
+ * WHY THE COMMAND IS NOT CALLED `actions`
+ * ───────────────────────────────────────
+ * Three different things in this product are called an "action", and two of
+ * them already own that word in the CLI:
+ *
+ *   skrr agents actions   — embedded `agentActions`: prompt/builtin buttons
+ *                           that live ON the agent document
+ *   skrr actions          — marketplace LISTINGS of those embedded actions
+ *   skrr agents api-actions (this) — `/api/agents/actions`: a tool surface
+ *                           generated from an OpenAPI document
+ *
+ * The third had no CLI at all, which the naming collision helped hide. Renaming
+ * the other two would break muscle memory for a surface that works, so this one
+ * takes an unambiguous name and all three now say which concept they are.
+ */
+class AgentsApiActionsList extends base_command_1.BaseCommand {
+    static description = 'List OpenAPI-backed Actions on agents you can edit (NOT `agents actions`, which is embedded buttons)';
+    static examples = [
+        '<%= config.bin %> agents api-actions',
+        '<%= config.bin %> agents api-actions --agent <agent-id>',
+        '<%= config.bin %> agents api-actions --json',
+    ];
+    static flags = {
+        agent: core_1.Flags.string({ description: 'Only actions on this agent' }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(AgentsApiActionsList);
+        let actions;
+        try {
+            actions = await data_provider_1.dataService.getActions();
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        // Filtered here rather than server-side: the endpoint returns every action
+        // on every agent the caller may EDIT, and has no agent filter. Doing it in
+        // the CLI keeps the flag honest instead of inventing a query the API does
+        // not answer.
+        const rows = flags.agent
+            ? actions.filter((action) => action.agent_id === flags.agent)
+            : actions;
+        if (flags.json) {
+            this.log(JSON.stringify(rows, null, 2));
+            return;
+        }
+        if (rows.length === 0) {
+            this.log(flags.agent
+                ? `No OpenAPI actions on agent ${flags.agent}.`
+                : 'No OpenAPI actions on any agent you can edit.');
+            this.log('Add one with: skrr agents api-actions add <agent-id> --spec <openapi.yaml>');
+            return;
+        }
+        (0, format_1.renderTable)(rows.map((action) => ({
+            actionId: action.action_id,
+            agentId: action.agent_id ?? '-',
+            domain: action.metadata?.domain ?? '-',
+            auth: action.metadata?.auth?.type ?? 'none',
+        })), [
+            { key: 'actionId', header: 'ACTION ID', verbatim: true },
+            { key: 'agentId', header: 'AGENT ID', verbatim: true },
+            { key: 'domain', header: 'DOMAIN', maxWidth: 40 },
+            { key: 'auth', header: 'AUTH' },
+        ], (line) => this.log(line));
+    }
+}
+exports.default = AgentsApiActionsList;

package/dist/commands/agents/api-actions/remove.d.ts

@@ -0,0 +1,14 @@
+import { BaseCommand } from '../../../base-command';
+/** Detach an OpenAPI Action from an agent. Wraps `DELETE /api/agents/actions/:agent_id/:action_id`. */
+export default class AgentsApiActionsRemove extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        agentId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        actionId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/agents/api-actions/remove.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+/** Detach an OpenAPI Action from an agent. Wraps `DELETE /api/agents/actions/:agent_id/:action_id`. */
+class AgentsApiActionsRemove extends base_command_1.BaseCommand {
+    static description = 'Remove an OpenAPI-backed Action from an agent';
+    static examples = ['<%= config.bin %> agents api-actions remove <agent-id> <action-id>'];
+    static args = {
+        agentId: core_1.Args.string({ description: 'Agent ID', required: true, ignoreStdin: true }),
+        actionId: core_1.Args.string({ description: 'Action ID', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(AgentsApiActionsRemove);
+        try {
+            await data_provider_1.dataService.deleteAgentAction({
+                agent_id: args.agentId,
+                action_id: args.actionId,
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify({ removed: args.actionId, agentId: args.agentId }, null, 2));
+            return;
+        }
+        this.log(`Removed action ${args.actionId} from agent ${args.agentId}`);
+    }
+}
+exports.default = AgentsApiActionsRemove;

package/dist/commands/agents/avatar/default/apply.d.ts

@@ -0,0 +1,25 @@
+import { BaseCommand } from '../../../../base-command';
+/**
+ * Apply the policy to agents that ALREADY EXIST — the one retroactive path in
+ * the avatar system, and deliberately user-initiated.
+ *
+ * It is not a sweep over everything: an agent whose owner explicitly chose the
+ * platform logo stores `{type:'default'}` and is NOT eligible, while an agent
+ * that never had a face stores nothing and is. "Never chose" and "chose the
+ * logo" are different facts and the server keeps them apart.
+ *
+ * The count is shown BEFORE anything is written. `--dry-run` asks the server how
+ * many are eligible without touching them; without `--yes` that is what this
+ * command does first, then asks. A command that silently re-skinned an unknown
+ * number of agents would be the wrong shape for an irreversible bulk write.
+ */
+export default class AgentsAvatarDefaultApply extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        'dry-run': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        yes: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/agents/avatar/default/apply.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../../base-command");
+/**
+ * Apply the policy to agents that ALREADY EXIST — the one retroactive path in
+ * the avatar system, and deliberately user-initiated.
+ *
+ * It is not a sweep over everything: an agent whose owner explicitly chose the
+ * platform logo stores `{type:'default'}` and is NOT eligible, while an agent
+ * that never had a face stores nothing and is. "Never chose" and "chose the
+ * logo" are different facts and the server keeps them apart.
+ *
+ * The count is shown BEFORE anything is written. `--dry-run` asks the server how
+ * many are eligible without touching them; without `--yes` that is what this
+ * command does first, then asks. A command that silently re-skinned an unknown
+ * number of agents would be the wrong shape for an irreversible bulk write.
+ */
+class AgentsAvatarDefaultApply extends base_command_1.BaseCommand {
+    static description = 'Apply your default-avatar policy to existing agents that never had a face chosen';
+    static examples = [
+        '<%= config.bin %> agents avatar default apply --dry-run',
+        '<%= config.bin %> agents avatar default apply --yes',
+    ];
+    static flags = {
+        'dry-run': core_1.Flags.boolean({ description: 'Report how many agents are eligible, write nothing' }),
+        yes: core_1.Flags.boolean({ description: 'Skip the eligible-count preview and write' }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(AgentsAvatarDefaultApply);
+        const dryRun = flags['dry-run'] === true || flags.yes !== true;
+        let result;
+        try {
+            result = await data_provider_1.dataService.applyAgentAvatarDefault(dryRun);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        if (!dryRun) {
+            this.log(`Applied the default-avatar policy to ${result.updated} agent(s).`);
+            return;
+        }
+        this.log(`${result.eligible} agent(s) would get a new avatar. Nothing was written.`);
+        if (!flags['dry-run']) {
+            this.log('Re-run with --yes to apply.');
+        }
+    }
+}
+exports.default = AgentsAvatarDefaultApply;