@slock-ai/daemon 0.54.2 → 0.55.0

package/dist/cli/index.js

@@ -46,6 +46,237 @@ function readCliVersion(baseUrl = import.meta.url) {
   );
 }
 
+// src/proxy.ts
+import { ProxyAgent } from "undici";
+var fetchDispatcherCache = /* @__PURE__ */ new Map();
+function getDefaultPort(protocol) {
+  switch (protocol) {
+    case "https:":
+      return "443";
+    case "http:":
+      return "80";
+    default:
+      return "";
+  }
+}
+function hostMatchesNoProxyEntry(hostname3, ruleHost) {
+  if (!ruleHost) return false;
+  const normalizedRule = ruleHost.replace(/^\*\./, ".").replace(/^\./, "").toLowerCase();
+  const normalizedHost = hostname3.toLowerCase();
+  return normalizedHost === normalizedRule || normalizedHost.endsWith(`.${normalizedRule}`);
+}
+function getProxyUrlForTarget(targetUrl, env) {
+  const protocol = new URL(targetUrl).protocol;
+  switch (protocol) {
+    case "https:":
+      return env.HTTPS_PROXY || env.https_proxy || env.ALL_PROXY || env.all_proxy;
+    case "http:":
+      return env.HTTP_PROXY || env.http_proxy || env.ALL_PROXY || env.all_proxy;
+    default:
+      return env.ALL_PROXY || env.all_proxy;
+  }
+}
+function shouldBypassProxy(targetUrl, env) {
+  const rawNoProxy = env.NO_PROXY || env.no_proxy;
+  if (!rawNoProxy) return false;
+  const url2 = new URL(targetUrl);
+  const hostname3 = url2.hostname.toLowerCase();
+  const port = url2.port || getDefaultPort(url2.protocol);
+  return rawNoProxy.split(",").map((entry) => entry.trim()).filter(Boolean).some((entry) => {
+    if (entry === "*") return true;
+    const [ruleHost, rulePort] = entry.split(":", 2);
+    if (rulePort && rulePort !== port) return false;
+    return hostMatchesNoProxyEntry(hostname3, ruleHost);
+  });
+}
+function buildFetchDispatcher(targetUrl, env = process.env) {
+  const proxyUrl = getProxyUrlForTarget(targetUrl, env);
+  if (!proxyUrl) return void 0;
+  if (shouldBypassProxy(targetUrl, env)) return void 0;
+  const cached2 = fetchDispatcherCache.get(proxyUrl);
+  if (cached2) return cached2;
+  const dispatcher = new ProxyAgent(proxyUrl);
+  fetchDispatcherCache.set(proxyUrl, dispatcher);
+  return dispatcher;
+}
+
+// src/client.ts
+var ApiClient = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  usesAgentApiSurface() {
+    return this.ctx.clientMode === "managed-runner" || this.ctx.clientMode === "self-hosted-runner";
+  }
+  rewriteAgentCredentialPath(pathname) {
+    if (!this.usesAgentApiSurface()) return pathname;
+    const attachmentDownload = /^\/api\/attachments\/([^/?]+)(.*)$/.exec(pathname);
+    if (attachmentDownload) {
+      return `/internal/agent-api/attachments/${attachmentDownload[1]}${attachmentDownload[2] ?? ""}`;
+    }
+    const agentPrefix = `/internal/agent/${encodeURIComponent(this.ctx.agentId)}`;
+    if (!pathname.startsWith(agentPrefix)) return pathname;
+    const suffix = pathname.slice(agentPrefix.length);
+    if (suffix === "/server") return "/internal/agent-api/server";
+    if (suffix === "/send") return "/internal/agent-api/send";
+    if (suffix.startsWith("/history")) return `/internal/agent-api/history${suffix.slice("/history".length)}`;
+    if (suffix.startsWith("/search")) return `/internal/agent-api/search${suffix.slice("/search".length)}`;
+    if (suffix.startsWith("/channel-members")) return `/internal/agent-api/channel-members${suffix.slice("/channel-members".length)}`;
+    if (suffix === "/knowledge" || suffix.startsWith("/knowledge?")) {
+      return `/internal/agent-api/knowledge${suffix.slice("/knowledge".length)}`;
+    }
+    if (suffix === "/profile" || suffix.startsWith("/profile/")) return `/internal/agent-api${suffix}`;
+    if (suffix === "/integrations" || suffix.startsWith("/integrations/")) return `/internal/agent-api${suffix}`;
+    if (suffix === "/upload") return "/internal/agent-api/upload";
+    if (suffix === "/resolve-channel") return "/internal/agent-api/resolve-channel";
+    if (suffix === "/threads/unfollow") return "/internal/agent-api/threads/unfollow";
+    if (suffix === "/prepare-action") return "/internal/agent-api/prepare-action";
+    if (suffix === "/tasks" || suffix.startsWith("/tasks?") || suffix.startsWith("/tasks/")) {
+      return `/internal/agent-api${suffix}`;
+    }
+    if (suffix === "/reminders" || suffix.startsWith("/reminders?") || suffix.startsWith("/reminders/")) {
+      return `/internal/agent-api${suffix}`;
+    }
+    if (suffix === "/receive" || suffix.startsWith("/receive?")) {
+      return "/internal/agent-api/events?since=latest";
+    }
+    const reaction = /^\/messages\/([^/]+)\/reactions$/.exec(suffix);
+    if (reaction) {
+      return `/internal/agent-api/messages/${reaction[1]}/reactions`;
+    }
+    const channelMembership = /^\/channels\/([^/]+)\/(join|leave)$/.exec(suffix);
+    if (channelMembership) {
+      return `/internal/agent-api/channels/${channelMembership[1]}/${channelMembership[2]}`;
+    }
+    return pathname;
+  }
+  normalizeAgentCredentialResponse(pathname, data) {
+    if (!this.usesAgentApiSurface()) return data;
+    if (!pathname.includes("/internal/agent-api/events")) return data;
+    const value = data;
+    if (!Array.isArray(value.events)) return data;
+    return { ...data, messages: value.events };
+  }
+  buildAuthHeaders() {
+    const headers = {
+      "Authorization": `Bearer ${this.ctx.token}`,
+      "X-Agent-Id": this.ctx.agentId,
+      "X-Slock-Client": "cli"
+    };
+    if (this.ctx.serverId) headers["X-Server-Id"] = this.ctx.serverId;
+    return headers;
+  }
+  async parseJsonResponse(res) {
+    let data = null;
+    let error48 = null;
+    let errorCode = null;
+    const contentType = res.headers.get("content-type") ?? "";
+    if (contentType.includes("application/json")) {
+      let parseFailed = false;
+      const parsed = await res.json().catch(() => {
+        parseFailed = true;
+        return null;
+      });
+      if (parseFailed) {
+        return {
+          ok: false,
+          status: res.status,
+          data: null,
+          error: `Invalid JSON response from server/proxy (HTTP ${res.status})`,
+          errorCode: "INVALID_JSON_RESPONSE"
+        };
+      }
+      if (res.ok) {
+        data = parsed;
+      } else {
+        const body = parsed;
+        if (res.status === 403 && body?.requiredScope) {
+          errorCode = "SCOPE_DENIED";
+          error48 = `Permission denied. The human has revoked the \`${body.requiredScope}\` capability for this agent under the agent profile's Permissions tab, so this command can't run. If you need it, ask the human to re-enable the corresponding toggle.`;
+        } else {
+          error48 = body?.error ?? `HTTP ${res.status}`;
+          errorCode = body?.errorCode ?? null;
+        }
+      }
+    } else if (!res.ok) {
+      error48 = `HTTP ${res.status}`;
+    }
+    return { ok: res.ok, status: res.status, data, error: error48, errorCode };
+  }
+  async request(method, pathname, body) {
+    pathname = this.rewriteAgentCredentialPath(pathname);
+    const url2 = new URL(pathname, this.ctx.serverUrl).toString();
+    const headers = this.buildAuthHeaders();
+    headers["Content-Type"] = "application/json";
+    if (this.ctx.activeCapabilities && this.ctx.activeCapabilities.length > 0) {
+      headers["X-Slock-Agent-Active-Capabilities"] = this.ctx.activeCapabilities.join(",");
+    }
+    const dispatcher = buildFetchDispatcher(url2);
+    const init = {
+      method,
+      headers,
+      body: body === void 0 ? void 0 : JSON.stringify(body)
+    };
+    if (dispatcher) init.dispatcher = dispatcher;
+    const res = await fetch(url2, init);
+    const parsed = await this.parseJsonResponse(res);
+    if (parsed.ok && parsed.data !== null) {
+      parsed.data = this.normalizeAgentCredentialResponse(pathname, parsed.data);
+    }
+    return parsed;
+  }
+  // Multipart upload. Caller builds the FormData (file part + any text fields).
+  // Content-Type intentionally omitted so fetch sets the correct multipart
+  // boundary itself.
+  async requestMultipart(method, pathname, form) {
+    pathname = this.rewriteAgentCredentialPath(pathname);
+    const url2 = new URL(pathname, this.ctx.serverUrl).toString();
+    const dispatcher = buildFetchDispatcher(url2);
+    const headers = this.buildAuthHeaders();
+    if (this.ctx.activeCapabilities && this.ctx.activeCapabilities.length > 0) {
+      headers["X-Slock-Agent-Active-Capabilities"] = this.ctx.activeCapabilities.join(",");
+    }
+    const init = {
+      method,
+      headers,
+      body: form
+    };
+    if (dispatcher) init.dispatcher = dispatcher;
+    const res = await fetch(url2, init);
+    return this.parseJsonResponse(res);
+  }
+  // Returns the raw Response so the caller can stream / save the body.
+  // For non-JSON downloads (binary attachments). Caller is responsible for
+  // consuming the body. On non-2xx, attempts to surface a JSON error.
+  async requestRaw(method, pathname) {
+    pathname = this.rewriteAgentCredentialPath(pathname);
+    const url2 = new URL(pathname, this.ctx.serverUrl).toString();
+    const dispatcher = buildFetchDispatcher(url2);
+    const headers = this.buildAuthHeaders();
+    if (this.ctx.activeCapabilities && this.ctx.activeCapabilities.length > 0) {
+      headers["X-Slock-Agent-Active-Capabilities"] = this.ctx.activeCapabilities.join(",");
+    }
+    const init = {
+      method,
+      headers,
+      redirect: "follow"
+    };
+    if (dispatcher) init.dispatcher = dispatcher;
+    const res = await fetch(url2, init);
+    let error48 = null;
+    if (!res.ok) {
+      const contentType = res.headers.get("content-type") ?? "";
+      if (contentType.includes("application/json")) {
+        const parsed = await res.json().catch(() => null);
+        error48 = parsed?.error ?? `HTTP ${res.status}`;
+      } else {
+        error48 = `HTTP ${res.status}`;
+      }
+    }
+    return { ok: res.ok, status: res.status, response: res, error: error48 };
+  }
+};
+
 // src/auth/env.ts
 import fs from "fs";
 import os from "os";
@@ -216,44 +447,156 @@ function loadAgentContext(env = process.env) {
   );
 }
 
-// src/commands/auth/whoami.ts
-function registerWhoamiCommand(parent) {
-  parent.command("whoami").description("Print the agent context resolved from env (token value redacted)").action(() => {
-    let ctx;
-    try {
-      ctx = loadAgentContext();
-    } catch (err) {
-      if (err instanceof AgentBootstrapError) fail(err.code, err.message);
-      throw err;
-    }
-    emit({
-      ok: true,
-      data: {
-        agentId: ctx.agentId,
-        serverUrl: ctx.serverUrl,
-        serverId: ctx.serverId,
-        clientMode: ctx.clientMode,
-        secretSource: ctx.secretSource,
-        ...ctx.profileSlug ? { profileSlug: ctx.profileSlug } : {},
-        ...ctx.profileCredentialPath ? { profileCredentialPath: ctx.profileCredentialPath } : {}
-      }
-    });
-  });
+// src/core/io.ts
+function defaultCliIo() {
+  return {
+    stdout: process.stdout,
+    stderr: process.stderr
+  };
 }
 
-// src/commands/agent/list.ts
-import { fetch as undiciFetch } from "undici";
-
-// src/agentLogin/deviceAuthClient.ts
-import { fetch as fetch2 } from "undici";
-var DeviceCodeLoginError = class extends Error {
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-    this.name = "DeviceCodeLoginError";
+// src/core/errors.ts
+var CliError = class extends Error {
+  code;
+  exitCode;
+  suggestedNextAction;
+  constructor(options) {
+    super(options.message);
+    this.name = "CliError";
+    this.code = options.code;
+    this.exitCode = options.exitCode ?? 1;
+    this.cause = options.cause;
+    this.suggestedNextAction = options.suggestedNextAction;
   }
 };
-var ACTIONABLE_ERROR_MESSAGES = {
+var InternalBugError = class extends CliError {
+  constructor(cause) {
+    const message = cause instanceof Error ? cause.message : String(cause);
+    super({
+      code: "INTERNAL_BUG",
+      message: `Unexpected error: ${message}`,
+      cause
+    });
+    this.name = "InternalBugError";
+  }
+};
+function toCliError(err) {
+  if (err instanceof CliError) return err;
+  return new InternalBugError(err);
+}
+
+// src/core/context.ts
+function createCommandContext(options = {}) {
+  const io = options.io ?? defaultCliIo();
+  const env = options.env ?? process.env;
+  const loadContext = options.loadAgentContext ?? loadAgentContext;
+  const createApiClient = options.createApiClient ?? ((agentContext) => new ApiClient(agentContext));
+  return {
+    io,
+    env,
+    loadAgentContext() {
+      try {
+        return loadContext(env);
+      } catch (err) {
+        if (err instanceof AgentBootstrapError) {
+          throw new CliError({
+            code: err.code,
+            message: err.message,
+            cause: err
+          });
+        }
+        throw err;
+      }
+    },
+    createApiClient
+  };
+}
+
+// src/core/renderer.ts
+function renderError(io, err) {
+  const body = {
+    ok: false,
+    code: err.code,
+    message: err.message
+  };
+  if (err.suggestedNextAction) {
+    body.suggested_next_action = err.suggestedNextAction;
+  }
+  io.stderr.write(`${JSON.stringify(body)}
+`);
+}
+function writeText(io, text) {
+  io.stdout.write(text);
+}
+function writeJson(io, payload) {
+  io.stdout.write(`${JSON.stringify(payload)}
+`);
+}
+
+// src/core/command.ts
+function defineCommand(spec, handler) {
+  return { spec, handler };
+}
+function registerCliCommand(parent, command, runtimeOptions = {}) {
+  const child = parent.command(command.spec.name).description(command.spec.description);
+  for (const arg of command.spec.arguments ?? []) {
+    child.argument(arg);
+  }
+  for (const option of command.spec.options ?? []) {
+    child.option(option.flags, option.description);
+  }
+  child.action(async (...args) => {
+    const ctx = createCommandContext(runtimeOptions);
+    try {
+      await command.handler(ctx, ...args);
+    } catch (err) {
+      const cliError = toCliError(err);
+      renderError(ctx.io, cliError);
+      throw new CliExit(cliError.exitCode);
+    }
+  });
+}
+
+// src/commands/auth/whoami.ts
+var whoamiCommand = defineCommand(
+  {
+    name: "whoami",
+    description: "Print the agent context resolved from env (token value redacted)",
+    rationale: "denied"
+  },
+  (ctx) => {
+    const agentContext = ctx.loadAgentContext();
+    writeJson(ctx.io, {
+      ok: true,
+      data: {
+        agentId: agentContext.agentId,
+        serverUrl: agentContext.serverUrl,
+        serverId: agentContext.serverId,
+        clientMode: agentContext.clientMode,
+        secretSource: agentContext.secretSource,
+        ...agentContext.profileSlug ? { profileSlug: agentContext.profileSlug } : {},
+        ...agentContext.profileCredentialPath ? { profileCredentialPath: agentContext.profileCredentialPath } : {}
+      }
+    });
+  }
+);
+function registerWhoamiCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, whoamiCommand, runtimeOptions);
+}
+
+// src/commands/agent/list.ts
+import { fetch as undiciFetch } from "undici";
+
+// src/agentLogin/deviceAuthClient.ts
+import { fetch as fetch2 } from "undici";
+var DeviceCodeLoginError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "DeviceCodeLoginError";
+  }
+};
+var ACTIONABLE_ERROR_MESSAGES = {
   device_login_disabled: "Device login is not enabled on this Slock server. Ask an admin to set SLOCK_DEVICE_LOGIN_ENABLED=true.",
   device_code_required: "Internal CLI bug: device_code was missing from the poll request.",
   user_code_required: "Internal CLI bug: user_code was missing from the approve request.",
@@ -575,6 +918,30 @@ function describeMintError(code, serverUrl) {
   return void 0;
 }
 
+// ../shared/src/slockRefs.ts
+var SLOCK_REF_CHANNEL_NAME_PATTERN = String.raw`[\p{L}\p{N}_-]+`;
+var SLOCK_REF_USER_NAME_PATTERN = SLOCK_REF_CHANNEL_NAME_PATTERN;
+var SLOCK_REF_DM_PEER_PATTERN = String.raw`[\w-]+`;
+var SLOCK_REF_THREAD_SHORT_ID_PATTERN = String.raw`[\da-f]{6,8}`;
+var SLOCK_REF_MESSAGE_ID_PATTERN = String.raw`[A-Za-z0-9][A-Za-z0-9-]{1,63}`;
+var SLOCK_REF_TASK_NUMBER_PATTERN = String.raw`[1-9]\d*`;
+var USER_RE = new RegExp(String.raw`^@(${SLOCK_REF_USER_NAME_PATTERN})$`, "u");
+var CHANNEL_RE = new RegExp(String.raw`^#(${SLOCK_REF_CHANNEL_NAME_PATTERN})$`, "u");
+var CHANNEL_THREAD_RE = new RegExp(
+  String.raw`^#(${SLOCK_REF_CHANNEL_NAME_PATTERN}):(${SLOCK_REF_THREAD_SHORT_ID_PATTERN})$`,
+  "iu"
+);
+var DM_RE = new RegExp(String.raw`^dm:@(${SLOCK_REF_DM_PEER_PATTERN})$`, "iu");
+var DM_THREAD_RE = new RegExp(
+  String.raw`^dm:@(${SLOCK_REF_DM_PEER_PATTERN}):(${SLOCK_REF_THREAD_SHORT_ID_PATTERN})$`,
+  "iu"
+);
+var TASK_RE = new RegExp(String.raw`^task\s+#(${SLOCK_REF_TASK_NUMBER_PATTERN})$`, "iu");
+var CHANNEL_MESSAGE_RE = new RegExp(
+  String.raw`^#(${SLOCK_REF_CHANNEL_NAME_PATTERN})(?::(${SLOCK_REF_THREAD_SHORT_ID_PATTERN}))?\s+msg=(${SLOCK_REF_MESSAGE_ID_PATTERN})$`,
+  "iu"
+);
+
 // ../shared/src/tracing/index.ts
 var DEFAULT_TRACE_FLAGS = "00";
 var TRACE_ID_HEX_LENGTH = 32;
@@ -14481,384 +14848,156 @@ var channelAddMemberOperationSchema = external_exports.object({
   channel: idOrHandleSchema,
   /** Same resolution rule as `channelCreateOperationSchema.initialHumans`. */
   humans: external_exports.array(idOrHandleSchema).max(64).optional(),
-  /** Same resolution rule as `channelCreateOperationSchema.initialAgents`. */
-  agents: external_exports.array(idOrHandleSchema).max(64).optional(),
-  draftHint: draftHintSchema
-});
-var actionCardActionSchema = external_exports.discriminatedUnion("type", [
-  channelCreateOperationSchema,
-  agentCreateOperationSchema,
-  channelAddMemberOperationSchema
-]);
-function validateActionCardAction(action) {
-  if (action.type === "agent:create") {
-    if (action.suggestedComputer && action.requiredComputer) {
-      return "agent:create must include only one of suggestedComputer or requiredComputer";
-    }
-  }
-  if (action.type === "channel:add_member") {
-    const total = (action.humans?.length ?? 0) + (action.agents?.length ?? 0);
-    if (total === 0) {
-      return "channel:add_member must include at least one human or agent";
-    }
-  }
-  return null;
-}
-
-// ../shared/src/translationLanguages.ts
-var SUPPORTED_TRANSLATION_LANGUAGE_CODES = [
-  "en",
-  "zh-cn",
-  "zh-tw",
-  "ja",
-  "ko",
-  "es",
-  "fr",
-  "de",
-  "pt-br"
-];
-var SUPPORTED_TRANSLATION_LANGUAGE_SET = new Set(
-  SUPPORTED_TRANSLATION_LANGUAGE_CODES
-);
-
-// ../shared/src/testing/failpoints.ts
-var NoopFailpointRegistry = class {
-  get enabled() {
-    return false;
-  }
-  isEnabled() {
-    return false;
-  }
-  configure() {
-  }
-  clear() {
-  }
-  getTrace() {
-    return [];
-  }
-  hit(_key, _context, fallback) {
-    return fallback ? fallback() : void 0;
-  }
-};
-var noopFailpointRegistry = new NoopFailpointRegistry();
-
-// ../shared/src/serverPermissions.ts
-var EMPTY_SERVER_CAPABILITIES = Object.freeze({
-  manageServer: false,
-  manageChannels: false,
-  manageAgents: false,
-  manageMachines: false,
-  manageMembers: false,
-  changeMemberRoles: false,
-  manageBilling: false,
-  joinPublicChannels: false
-});
-var SERVER_CAPABILITY_MATRIX = {
-  owner: Object.freeze({
-    manageServer: true,
-    manageChannels: true,
-    manageAgents: true,
-    manageMachines: true,
-    manageMembers: true,
-    changeMemberRoles: true,
-    manageBilling: true,
-    joinPublicChannels: true
-  }),
-  admin: Object.freeze({
-    manageServer: true,
-    manageChannels: true,
-    manageAgents: true,
-    manageMachines: true,
-    manageMembers: true,
-    changeMemberRoles: true,
-    manageBilling: false,
-    joinPublicChannels: true
-  }),
-  member: Object.freeze({
-    manageServer: false,
-    manageChannels: false,
-    manageAgents: false,
-    manageMachines: false,
-    manageMembers: false,
-    changeMemberRoles: false,
-    manageBilling: false,
-    joinPublicChannels: true
-  })
-};
-
-// ../shared/src/index.ts
-var RUNTIMES = [
-  { id: "claude", displayName: "Claude Code", binary: "claude", supported: true },
-  { id: "codex", displayName: "Codex CLI", binary: "codex", supported: true },
-  { id: "antigravity", displayName: "Antigravity CLI", binary: "agy", supported: true },
-  { id: "kimi", displayName: "Kimi CLI", binary: "kimi", supported: true },
-  { id: "copilot", displayName: "Copilot CLI", binary: "copilot", supported: true },
-  { id: "cursor", displayName: "Cursor CLI", binary: "cursor-agent", supported: true },
-  { id: "gemini", displayName: "Gemini CLI", binary: "gemini", supported: true },
-  { id: "opencode", displayName: "OpenCode", binary: "opencode", supported: true }
-];
-function getRuntimeDisplayName(id) {
-  return RUNTIMES.find((r) => r.id === id)?.displayName ?? id;
-}
-var PLAN_CONFIG = {
-  free: {
-    displayName: "Hobby",
-    limits: { maxMachines: 2, maxAgents: 5, maxChannels: 5, messageHistoryDays: 30, includedAgents: 5 },
-    comingSoon: false,
-    price: 0,
-    extraAgentPrice: 0
-  },
-  founder: {
-    displayName: "Founder",
-    limits: { maxMachines: -1, maxAgents: -1, maxChannels: -1, messageHistoryDays: -1, includedAgents: -1 },
-    comingSoon: false,
-    price: 0,
-    extraAgentPrice: 0
-  }
-};
-var DISPLAY_PLAN_CONFIG = {
-  free: PLAN_CONFIG.free,
-  pro: {
-    displayName: "Team",
-    limits: { maxMachines: 8, maxAgents: 40, maxChannels: 20, messageHistoryDays: -1, includedAgents: 40 },
-    comingSoon: true,
-    price: 20,
-    extraAgentPrice: 0
-  },
-  max: {
-    displayName: "Business",
-    limits: { maxMachines: 40, maxAgents: 200, maxChannels: -1, messageHistoryDays: -1, includedAgents: 200 },
-    comingSoon: true,
-    price: 200,
-    extraAgentPrice: 0
-  }
-};
-
-// src/proxy.ts
-import { ProxyAgent } from "undici";
-var fetchDispatcherCache = /* @__PURE__ */ new Map();
-function getDefaultPort(protocol) {
-  switch (protocol) {
-    case "https:":
-      return "443";
-    case "http:":
-      return "80";
-    default:
-      return "";
-  }
-}
-function hostMatchesNoProxyEntry(hostname3, ruleHost) {
-  if (!ruleHost) return false;
-  const normalizedRule = ruleHost.replace(/^\*\./, ".").replace(/^\./, "").toLowerCase();
-  const normalizedHost = hostname3.toLowerCase();
-  return normalizedHost === normalizedRule || normalizedHost.endsWith(`.${normalizedRule}`);
-}
-function getProxyUrlForTarget(targetUrl, env) {
-  const protocol = new URL(targetUrl).protocol;
-  switch (protocol) {
-    case "https:":
-      return env.HTTPS_PROXY || env.https_proxy || env.ALL_PROXY || env.all_proxy;
-    case "http:":
-      return env.HTTP_PROXY || env.http_proxy || env.ALL_PROXY || env.all_proxy;
-    default:
-      return env.ALL_PROXY || env.all_proxy;
-  }
-}
-function shouldBypassProxy(targetUrl, env) {
-  const rawNoProxy = env.NO_PROXY || env.no_proxy;
-  if (!rawNoProxy) return false;
-  const url2 = new URL(targetUrl);
-  const hostname3 = url2.hostname.toLowerCase();
-  const port = url2.port || getDefaultPort(url2.protocol);
-  return rawNoProxy.split(",").map((entry) => entry.trim()).filter(Boolean).some((entry) => {
-    if (entry === "*") return true;
-    const [ruleHost, rulePort] = entry.split(":", 2);
-    if (rulePort && rulePort !== port) return false;
-    return hostMatchesNoProxyEntry(hostname3, ruleHost);
-  });
-}
-function buildFetchDispatcher(targetUrl, env = process.env) {
-  const proxyUrl = getProxyUrlForTarget(targetUrl, env);
-  if (!proxyUrl) return void 0;
-  if (shouldBypassProxy(targetUrl, env)) return void 0;
-  const cached2 = fetchDispatcherCache.get(proxyUrl);
-  if (cached2) return cached2;
-  const dispatcher = new ProxyAgent(proxyUrl);
-  fetchDispatcherCache.set(proxyUrl, dispatcher);
-  return dispatcher;
-}
-
-// src/client.ts
-var ApiClient = class {
-  constructor(ctx) {
-    this.ctx = ctx;
-  }
-  usesAgentApiSurface() {
-    return this.ctx.clientMode === "managed-runner" || this.ctx.clientMode === "self-hosted-runner";
-  }
-  rewriteAgentCredentialPath(pathname) {
-    if (!this.usesAgentApiSurface()) return pathname;
-    const attachmentDownload = /^\/api\/attachments\/([^/?]+)(.*)$/.exec(pathname);
-    if (attachmentDownload) {
-      return `/internal/agent-api/attachments/${attachmentDownload[1]}${attachmentDownload[2] ?? ""}`;
-    }
-    const agentPrefix = `/internal/agent/${encodeURIComponent(this.ctx.agentId)}`;
-    if (!pathname.startsWith(agentPrefix)) return pathname;
-    const suffix = pathname.slice(agentPrefix.length);
-    if (suffix === "/server") return "/internal/agent-api/server";
-    if (suffix === "/send") return "/internal/agent-api/send";
-    if (suffix.startsWith("/history")) return `/internal/agent-api/history${suffix.slice("/history".length)}`;
-    if (suffix.startsWith("/search")) return `/internal/agent-api/search${suffix.slice("/search".length)}`;
-    if (suffix.startsWith("/channel-members")) return `/internal/agent-api/channel-members${suffix.slice("/channel-members".length)}`;
-    if (suffix === "/profile" || suffix.startsWith("/profile/")) return `/internal/agent-api${suffix}`;
-    if (suffix === "/integrations" || suffix.startsWith("/integrations/")) return `/internal/agent-api${suffix}`;
-    if (suffix === "/upload") return "/internal/agent-api/upload";
-    if (suffix === "/resolve-channel") return "/internal/agent-api/resolve-channel";
-    if (suffix === "/threads/unfollow") return "/internal/agent-api/threads/unfollow";
-    if (suffix === "/prepare-action") return "/internal/agent-api/prepare-action";
-    if (suffix === "/tasks" || suffix.startsWith("/tasks?") || suffix.startsWith("/tasks/")) {
-      return `/internal/agent-api${suffix}`;
-    }
-    if (suffix === "/reminders" || suffix.startsWith("/reminders?") || suffix.startsWith("/reminders/")) {
-      return `/internal/agent-api${suffix}`;
-    }
-    if (suffix === "/receive" || suffix.startsWith("/receive?")) {
-      return "/internal/agent-api/events?since=latest";
-    }
-    const reaction = /^\/messages\/([^/]+)\/reactions$/.exec(suffix);
-    if (reaction) {
-      return `/internal/agent-api/messages/${reaction[1]}/reactions`;
-    }
-    const channelMembership = /^\/channels\/([^/]+)\/(join|leave)$/.exec(suffix);
-    if (channelMembership) {
-      return `/internal/agent-api/channels/${channelMembership[1]}/${channelMembership[2]}`;
-    }
-    return pathname;
-  }
-  normalizeAgentCredentialResponse(pathname, data) {
-    if (!this.usesAgentApiSurface()) return data;
-    if (!pathname.includes("/internal/agent-api/events")) return data;
-    const value = data;
-    if (!Array.isArray(value.events)) return data;
-    return { ...data, messages: value.events };
-  }
-  buildAuthHeaders() {
-    const headers = {
-      "Authorization": `Bearer ${this.ctx.token}`,
-      "X-Agent-Id": this.ctx.agentId,
-      "X-Slock-Client": "cli"
-    };
-    if (this.ctx.serverId) headers["X-Server-Id"] = this.ctx.serverId;
-    return headers;
-  }
-  async parseJsonResponse(res) {
-    let data = null;
-    let error48 = null;
-    let errorCode = null;
-    const contentType = res.headers.get("content-type") ?? "";
-    if (contentType.includes("application/json")) {
-      let parseFailed = false;
-      const parsed = await res.json().catch(() => {
-        parseFailed = true;
-        return null;
-      });
-      if (parseFailed) {
-        return {
-          ok: false,
-          status: res.status,
-          data: null,
-          error: `Invalid JSON response from server/proxy (HTTP ${res.status})`,
-          errorCode: "INVALID_JSON_RESPONSE"
-        };
-      }
-      if (res.ok) {
-        data = parsed;
-      } else {
-        const body = parsed;
-        if (res.status === 403 && body?.requiredScope) {
-          errorCode = "SCOPE_DENIED";
-          error48 = `Permission denied. The human has revoked the \`${body.requiredScope}\` capability for this agent under the agent profile's Permissions tab, so this command can't run. If you need it, ask the human to re-enable the corresponding toggle.`;
-        } else {
-          error48 = body?.error ?? `HTTP ${res.status}`;
-          errorCode = body?.errorCode ?? null;
-        }
-      }
-    } else if (!res.ok) {
-      error48 = `HTTP ${res.status}`;
-    }
-    return { ok: res.ok, status: res.status, data, error: error48, errorCode };
-  }
-  async request(method, pathname, body) {
-    pathname = this.rewriteAgentCredentialPath(pathname);
-    const url2 = new URL(pathname, this.ctx.serverUrl).toString();
-    const headers = this.buildAuthHeaders();
-    headers["Content-Type"] = "application/json";
-    if (this.ctx.activeCapabilities && this.ctx.activeCapabilities.length > 0) {
-      headers["X-Slock-Agent-Active-Capabilities"] = this.ctx.activeCapabilities.join(",");
-    }
-    const dispatcher = buildFetchDispatcher(url2);
-    const init = {
-      method,
-      headers,
-      body: body === void 0 ? void 0 : JSON.stringify(body)
-    };
-    if (dispatcher) init.dispatcher = dispatcher;
-    const res = await fetch(url2, init);
-    const parsed = await this.parseJsonResponse(res);
-    if (parsed.ok && parsed.data !== null) {
-      parsed.data = this.normalizeAgentCredentialResponse(pathname, parsed.data);
+  /** Same resolution rule as `channelCreateOperationSchema.initialAgents`. */
+  agents: external_exports.array(idOrHandleSchema).max(64).optional(),
+  draftHint: draftHintSchema
+});
+var actionCardActionSchema = external_exports.discriminatedUnion("type", [
+  channelCreateOperationSchema,
+  agentCreateOperationSchema,
+  channelAddMemberOperationSchema
+]);
+function validateActionCardAction(action) {
+  if (action.type === "agent:create") {
+    if (action.suggestedComputer && action.requiredComputer) {
+      return "agent:create must include only one of suggestedComputer or requiredComputer";
     }
-    return parsed;
   }
-  // Multipart upload. Caller builds the FormData (file part + any text fields).
-  // Content-Type intentionally omitted so fetch sets the correct multipart
-  // boundary itself.
-  async requestMultipart(method, pathname, form) {
-    pathname = this.rewriteAgentCredentialPath(pathname);
-    const url2 = new URL(pathname, this.ctx.serverUrl).toString();
-    const dispatcher = buildFetchDispatcher(url2);
-    const headers = this.buildAuthHeaders();
-    if (this.ctx.activeCapabilities && this.ctx.activeCapabilities.length > 0) {
-      headers["X-Slock-Agent-Active-Capabilities"] = this.ctx.activeCapabilities.join(",");
+  if (action.type === "channel:add_member") {
+    const total = (action.humans?.length ?? 0) + (action.agents?.length ?? 0);
+    if (total === 0) {
+      return "channel:add_member must include at least one human or agent";
     }
-    const init = {
-      method,
-      headers,
-      body: form
-    };
-    if (dispatcher) init.dispatcher = dispatcher;
-    const res = await fetch(url2, init);
-    return this.parseJsonResponse(res);
   }
-  // Returns the raw Response so the caller can stream / save the body.
-  // For non-JSON downloads (binary attachments). Caller is responsible for
-  // consuming the body. On non-2xx, attempts to surface a JSON error.
-  async requestRaw(method, pathname) {
-    pathname = this.rewriteAgentCredentialPath(pathname);
-    const url2 = new URL(pathname, this.ctx.serverUrl).toString();
-    const dispatcher = buildFetchDispatcher(url2);
-    const headers = this.buildAuthHeaders();
-    if (this.ctx.activeCapabilities && this.ctx.activeCapabilities.length > 0) {
-      headers["X-Slock-Agent-Active-Capabilities"] = this.ctx.activeCapabilities.join(",");
-    }
-    const init = {
-      method,
-      headers,
-      redirect: "follow"
-    };
-    if (dispatcher) init.dispatcher = dispatcher;
-    const res = await fetch(url2, init);
-    let error48 = null;
-    if (!res.ok) {
-      const contentType = res.headers.get("content-type") ?? "";
-      if (contentType.includes("application/json")) {
-        const parsed = await res.json().catch(() => null);
-        error48 = parsed?.error ?? `HTTP ${res.status}`;
-      } else {
-        error48 = `HTTP ${res.status}`;
-      }
-    }
-    return { ok: res.ok, status: res.status, response: res, error: error48 };
+  return null;
+}
+
+// ../shared/src/translationLanguages.ts
+var SUPPORTED_TRANSLATION_LANGUAGE_CODES = [
+  "en",
+  "zh-cn",
+  "zh-tw",
+  "ja",
+  "ko",
+  "es",
+  "fr",
+  "de",
+  "pt-br"
+];
+var SUPPORTED_TRANSLATION_LANGUAGE_SET = new Set(
+  SUPPORTED_TRANSLATION_LANGUAGE_CODES
+);
+
+// ../shared/src/testing/failpoints.ts
+var NoopFailpointRegistry = class {
+  get enabled() {
+    return false;
+  }
+  isEnabled() {
+    return false;
+  }
+  configure() {
+  }
+  clear() {
+  }
+  getTrace() {
+    return [];
+  }
+  hit(_key, _context, fallback) {
+    return fallback ? fallback() : void 0;
+  }
+};
+var noopFailpointRegistry = new NoopFailpointRegistry();
+
+// ../shared/src/serverPermissions.ts
+var EMPTY_SERVER_CAPABILITIES = Object.freeze({
+  manageServer: false,
+  manageChannels: false,
+  manageAgents: false,
+  manageMachines: false,
+  manageMembers: false,
+  changeMemberRoles: false,
+  manageBilling: false,
+  joinPublicChannels: false
+});
+var SERVER_CAPABILITY_MATRIX = {
+  owner: Object.freeze({
+    manageServer: true,
+    manageChannels: true,
+    manageAgents: true,
+    manageMachines: true,
+    manageMembers: true,
+    changeMemberRoles: true,
+    manageBilling: true,
+    joinPublicChannels: true
+  }),
+  admin: Object.freeze({
+    manageServer: true,
+    manageChannels: true,
+    manageAgents: true,
+    manageMachines: true,
+    manageMembers: true,
+    changeMemberRoles: true,
+    manageBilling: false,
+    joinPublicChannels: true
+  }),
+  member: Object.freeze({
+    manageServer: false,
+    manageChannels: false,
+    manageAgents: false,
+    manageMachines: false,
+    manageMembers: false,
+    changeMemberRoles: false,
+    manageBilling: false,
+    joinPublicChannels: true
+  })
+};
+
+// ../shared/src/index.ts
+var RUNTIMES = [
+  { id: "claude", displayName: "Claude Code", binary: "claude", supported: true },
+  { id: "codex", displayName: "Codex CLI", binary: "codex", supported: true },
+  { id: "antigravity", displayName: "Antigravity CLI", binary: "agy", supported: true },
+  { id: "kimi", displayName: "Kimi CLI", binary: "kimi", supported: true },
+  { id: "copilot", displayName: "Copilot CLI", binary: "copilot", supported: true },
+  { id: "cursor", displayName: "Cursor CLI", binary: "cursor-agent", supported: true },
+  { id: "gemini", displayName: "Gemini CLI", binary: "gemini", supported: true },
+  { id: "opencode", displayName: "OpenCode", binary: "opencode", supported: true }
+];
+function getRuntimeDisplayName(id) {
+  return RUNTIMES.find((r) => r.id === id)?.displayName ?? id;
+}
+var PLAN_CONFIG = {
+  free: {
+    displayName: "Hobby",
+    limits: { maxMachines: 2, maxAgents: 5, maxChannels: 5, messageHistoryDays: 30, includedAgents: 5 },
+    comingSoon: false,
+    price: 0,
+    extraAgentPrice: 0
+  },
+  founder: {
+    displayName: "Founder",
+    limits: { maxMachines: -1, maxAgents: -1, maxChannels: -1, messageHistoryDays: -1, includedAgents: -1 },
+    comingSoon: false,
+    price: 0,
+    extraAgentPrice: 0
+  }
+};
+var DISPLAY_PLAN_CONFIG = {
+  free: PLAN_CONFIG.free,
+  pro: {
+    displayName: "Team",
+    limits: { maxMachines: 8, maxAgents: 40, maxChannels: 20, messageHistoryDays: -1, includedAgents: 40 },
+    comingSoon: true,
+    price: 20,
+    extraAgentPrice: 0
+  },
+  max: {
+    displayName: "Business",
+    limits: { maxMachines: 40, maxAgents: 200, maxChannels: -1, messageHistoryDays: -1, includedAgents: 200 },
+    comingSoon: true,
+    price: 200,
+    extraAgentPrice: 0
   }
 };
 
@@ -15053,29 +15192,39 @@ function formatChannelMembers(data) {
 }
 
 // src/commands/channel/members.ts
-function registerChannelMembersCommand(parent) {
-  parent.command("members").description("List agents and humans who are members of a channel, DM, or thread").argument("<target>", "Channel / DM / thread target, e.g. #proj-runtime, dm:@alice, #proj-runtime:abcd1234").action(async (target) => {
-    let ctx;
-    try {
-      ctx = loadAgentContext();
-    } catch (err) {
-      if (err instanceof AgentBootstrapError) fail(err.code, err.message);
-      throw err;
-    }
-    const client = new ApiClient(ctx);
+var channelMembersCommand = defineCommand(
+  {
+    name: "members",
+    description: "List agents and humans who are members of a channel, DM, or thread",
+    rationale: "denied",
+    arguments: ["<target>"]
+  },
+  async (ctx, target) => {
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
     const channel = String(target || "").trim();
-    if (!channel) fail("MEMBERS_FAILED", "target is required");
+    if (!channel) {
+      throw new CliError({
+        code: "INVALID_ARG",
+        message: "target is required"
+      });
+    }
     const encoded = encodeURIComponent(channel);
     const res = await client.request(
       "GET",
-      `/internal/agent/${encodeURIComponent(ctx.agentId)}/channel-members?channel=${encoded}`
+      `/internal/agent/${encodeURIComponent(agentContext.agentId)}/channel-members?channel=${encoded}`
     );
     if (!res.ok) {
-      const code = res.status >= 500 ? "SERVER_5XX" : "MEMBERS_FAILED";
-      fail(code, res.error ?? `HTTP ${res.status}`);
+      throw new CliError({
+        code: res.status >= 500 ? "SERVER_5XX" : "MEMBERS_FAILED",
+        message: res.error ?? `HTTP ${res.status}`
+      });
     }
-    process.stdout.write(formatChannelMembers(res.data));
-  });
+    writeText(ctx.io, formatChannelMembers(res.data));
+  }
+);
+function registerChannelMembersCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, channelMembersCommand, runtimeOptions);
 }
 
 // src/commands/channel/leave.ts
@@ -15091,46 +15240,65 @@ function formatLeaveChannelResult(target) {
 function formatAlreadyNotJoined(target) {
   return `Already not joined in ${target}.`;
 }
-function registerChannelLeaveCommand(parent) {
-  parent.command("leave").description("Leave a regular channel you have joined").requiredOption("--target <target>", "Regular channel to leave, e.g. '#engineering'").action(async (opts) => {
-    const channelName = parseRegularChannelTarget(opts.target);
+var channelLeaveCommand = defineCommand(
+  {
+    name: "leave",
+    description: "Leave a regular channel you have joined",
+    rationale: "required",
+    options: [
+      {
+        flags: "--target <target>",
+        description: "Regular channel to leave, e.g. '#engineering'"
+      }
+    ]
+  },
+  async (ctx, opts) => {
+    const target = opts.target ?? "";
+    const channelName = parseRegularChannelTarget(target);
     if (!channelName) {
-      fail("INVALID_TARGET", "Target must be a regular channel in the form '#channel-name'. DMs and thread targets are not supported.");
-    }
-    let ctx;
-    try {
-      ctx = loadAgentContext();
-    } catch (err) {
-      if (err instanceof AgentBootstrapError) fail(err.code, err.message);
-      throw err;
+      throw new CliError({
+        code: "INVALID_TARGET",
+        message: "Target must be a regular channel in the form '#channel-name'. DMs and thread targets are not supported."
+      });
     }
-    const client = new ApiClient(ctx);
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
     const infoRes = await client.request(
       "GET",
-      `/internal/agent/${encodeURIComponent(ctx.agentId)}/server`
+      `/internal/agent/${encodeURIComponent(agentContext.agentId)}/server`
     );
     if (!infoRes.ok) {
-      const code = infoRes.status >= 500 ? "SERVER_5XX" : "INFO_FAILED";
-      fail(code, infoRes.error ?? `HTTP ${infoRes.status}`);
+      throw new CliError({
+        code: infoRes.status >= 500 ? "SERVER_5XX" : "INFO_FAILED",
+        message: infoRes.error ?? `HTTP ${infoRes.status}`
+      });
     }
     const channel = (infoRes.data?.channels ?? []).find((candidate) => candidate.name === channelName);
     if (!channel) {
-      fail("NOT_FOUND", `Channel not found: ${opts.target}`);
+      throw new CliError({
+        code: "NOT_FOUND",
+        message: `Channel not found: ${target}`
+      });
     }
     if (!channel.joined) {
-      process.stdout.write(formatAlreadyNotJoined(opts.target) + "\n");
+      writeText(ctx.io, formatAlreadyNotJoined(target) + "\n");
       return;
     }
     const leaveRes = await client.request(
       "POST",
-      `/internal/agent/${encodeURIComponent(ctx.agentId)}/channels/${encodeURIComponent(channel.id)}/leave`
+      `/internal/agent/${encodeURIComponent(agentContext.agentId)}/channels/${encodeURIComponent(channel.id)}/leave`
     );
     if (!leaveRes.ok) {
-      const code = leaveRes.status >= 500 ? "SERVER_5XX" : "LEAVE_FAILED";
-      fail(code, leaveRes.error ?? `HTTP ${leaveRes.status}`);
+      throw new CliError({
+        code: leaveRes.status >= 500 ? "SERVER_5XX" : "LEAVE_FAILED",
+        message: leaveRes.error ?? `HTTP ${leaveRes.status}`
+      });
     }
-    process.stdout.write(formatLeaveChannelResult(opts.target) + "\n");
-  });
+    writeText(ctx.io, formatLeaveChannelResult(target) + "\n");
+  }
+);
+function registerChannelLeaveCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, channelLeaveCommand, runtimeOptions);
 }
 
 // src/commands/channel/join.ts
@@ -15140,76 +15308,179 @@ function formatJoinChannelResult(target) {
 function formatAlreadyJoined(target) {
   return `Already joined ${target}.`;
 }
-function registerChannelJoinCommand(parent) {
-  parent.command("join").description("Join a visible public channel").requiredOption("--target <target>", "Regular channel to join, e.g. '#engineering'").action(async (opts) => {
-    const channelName = parseRegularChannelTarget(opts.target);
+var channelJoinCommand = defineCommand(
+  {
+    name: "join",
+    description: "Join a visible public channel",
+    rationale: "required",
+    options: [
+      {
+        flags: "--target <target>",
+        description: "Regular channel to join, e.g. '#engineering'"
+      }
+    ]
+  },
+  async (ctx, opts) => {
+    const target = opts.target ?? "";
+    const channelName = parseRegularChannelTarget(target);
     if (!channelName) {
-      fail("INVALID_TARGET", "Target must be a regular channel in the form '#channel-name'. DMs and thread targets are not supported.");
-    }
-    let ctx;
-    try {
-      ctx = loadAgentContext();
-    } catch (err) {
-      if (err instanceof AgentBootstrapError) fail(err.code, err.message);
-      throw err;
+      throw new CliError({
+        code: "INVALID_TARGET",
+        message: "Target must be a regular channel in the form '#channel-name'. DMs and thread targets are not supported."
+      });
     }
-    const client = new ApiClient(ctx);
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
     const infoRes = await client.request(
       "GET",
-      `/internal/agent/${encodeURIComponent(ctx.agentId)}/server`
+      `/internal/agent/${encodeURIComponent(agentContext.agentId)}/server`
     );
     if (!infoRes.ok) {
-      const code = infoRes.status >= 500 ? "SERVER_5XX" : "INFO_FAILED";
-      fail(code, infoRes.error ?? `HTTP ${infoRes.status}`);
+      throw new CliError({
+        code: infoRes.status >= 500 ? "SERVER_5XX" : "INFO_FAILED",
+        message: infoRes.error ?? `HTTP ${infoRes.status}`
+      });
     }
     const channel = (infoRes.data?.channels ?? []).find((candidate) => candidate.name === channelName);
     if (!channel) {
-      fail("NOT_FOUND", `Channel not found: ${opts.target}`);
+      throw new CliError({
+        code: "NOT_FOUND",
+        message: `Channel not found: ${target}`
+      });
     }
     if (channel.joined) {
-      process.stdout.write(formatAlreadyJoined(opts.target) + "\n");
+      writeText(ctx.io, formatAlreadyJoined(target) + "\n");
       return;
     }
     const joinRes = await client.request(
       "POST",
-      `/internal/agent/${encodeURIComponent(ctx.agentId)}/channels/${encodeURIComponent(channel.id)}/join`
+      `/internal/agent/${encodeURIComponent(agentContext.agentId)}/channels/${encodeURIComponent(channel.id)}/join`
     );
     if (!joinRes.ok) {
-      const code = joinRes.status >= 500 ? "SERVER_5XX" : "JOIN_FAILED";
-      fail(code, joinRes.error ?? `HTTP ${joinRes.status}`);
-    }
-    process.stdout.write(formatJoinChannelResult(opts.target) + "\n");
-  });
-}
-
-// src/commands/server/info.ts
-function registerServerInfoCommand(parent) {
-  parent.command("info").description("List channels, agents, and humans on the current server").action(async () => {
-    let ctx;
-    try {
-      ctx = loadAgentContext();
-    } catch (err) {
-      if (err instanceof AgentBootstrapError) fail(err.code, err.message);
-      throw err;
+      throw new CliError({
+        code: joinRes.status >= 500 ? "SERVER_5XX" : "JOIN_FAILED",
+        message: joinRes.error ?? `HTTP ${joinRes.status}`
+      });
     }
-    const client = new ApiClient(ctx);
+    writeText(ctx.io, formatJoinChannelResult(target) + "\n");
+  }
+);
+function registerChannelJoinCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, channelJoinCommand, runtimeOptions);
+}
+
+// src/commands/server/info.ts
+var serverInfoCommand = defineCommand(
+  {
+    name: "info",
+    description: "List channels, agents, and humans on the current server",
+    rationale: "denied"
+  },
+  async (ctx) => {
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
     const res = await client.request(
       "GET",
-      `/internal/agent/${encodeURIComponent(ctx.agentId)}/server`
+      `/internal/agent/${encodeURIComponent(agentContext.agentId)}/server`
     );
     if (!res.ok) {
       const code = res.status >= 500 ? "SERVER_5XX" : "INFO_FAILED";
-      fail(code, res.error ?? `HTTP ${res.status}`);
+      throw new CliError({
+        code,
+        message: res.error ?? `HTTP ${res.status}`
+      });
     }
     const data = res.data;
     if (data?.runtimeContext) {
       data.runtimeContext = {
         ...data.runtimeContext,
-        workspacePath: data.runtimeContext.workspacePath ?? process.env.SLOCK_CURRENT_WORKSPACE_PATH ?? null
+        workspacePath: data.runtimeContext.workspacePath ?? ctx.env.SLOCK_CURRENT_WORKSPACE_PATH ?? null
       };
     }
-    process.stdout.write(formatServerInfo(data));
-  });
+    writeText(ctx.io, formatServerInfo(data));
+  }
+);
+function registerServerInfoCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, serverInfoCommand, runtimeOptions);
+}
+
+// src/commands/knowledge/get.ts
+function buildKnowledgeGetPath(agentId, topic, opts) {
+  const params = new URLSearchParams();
+  params.set("topic", topic);
+  if (opts.reason) params.set("reason", opts.reason);
+  if (opts.turnId) params.set("turn_id", opts.turnId);
+  if (opts.traceId) params.set("trace_id", opts.traceId);
+  return `/internal/agent/${encodeURIComponent(agentId)}/knowledge?${params.toString()}`;
+}
+function formatKnowledgeStdout(content) {
+  return content.endsWith("\n") ? content : `${content}
+`;
+}
+function toKnowledgeErrorCode(errorCode, status) {
+  switch (errorCode) {
+    case "INVALID_JSON_RESPONSE":
+    case "SCOPE_DENIED":
+    case "knowledge_agent_missing":
+    case "knowledge_internal_error":
+    case "knowledge_not_found":
+    case "knowledge_reason_invalid":
+    case "knowledge_source_invalid":
+    case "knowledge_topic_invalid":
+    case "knowledge_trace_id_invalid":
+    case "knowledge_turn_id_invalid":
+    case "unsupported_capability":
+      return errorCode;
+    default:
+      return status >= 500 ? "SERVER_5XX" : "KNOWLEDGE_GET_FAILED";
+  }
+}
+var knowledgeGetCommand = defineCommand(
+  {
+    name: "get",
+    description: "Fetch an agent knowledge topic from the current server",
+    rationale: "optional",
+    arguments: ["<topic>"],
+    options: [
+      {
+        flags: "--reason <text>",
+        description: "Optional rationale for fetching this topic (>=12 chars when provided)"
+      },
+      {
+        flags: "--turn-id <id>",
+        description: "Optional turn id for correlation in the knowledge event"
+      },
+      {
+        flags: "--trace-id <id>",
+        description: "Optional trace id for correlation in the knowledge event"
+      }
+    ]
+  },
+  async (ctx, topic, opts) => {
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
+    const res = await client.request(
+      "GET",
+      buildKnowledgeGetPath(agentContext.agentId, topic, opts)
+    );
+    if (!res.ok) {
+      throw new CliError({
+        code: toKnowledgeErrorCode(res.errorCode, res.status),
+        message: res.error ?? `HTTP ${res.status}`
+      });
+    }
+    const data = res.data;
+    if (!data || data.ok !== true) {
+      throw new CliError({
+        code: "KNOWLEDGE_GET_FAILED",
+        message: "Server returned an unexpected response shape"
+      });
+    }
+    writeText(ctx.io, formatKnowledgeStdout(data.content));
+  }
+);
+function registerKnowledgeGetCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, knowledgeGetCommand, runtimeOptions);
 }
 
 // src/commands/thread/unfollow.ts
@@ -15237,31 +15508,44 @@ function parseThreadTarget(target) {
 function formatUnfollowThreadResult(target) {
   return `Unfollowed ${target}. You can still inspect the thread when its parent conversation is visible, but you will no longer receive ordinary thread delivery unless you follow it again or are mentioned.`;
 }
-function registerThreadUnfollowCommand(parent) {
-  parent.command("unfollow").description("Stop following a thread you no longer need ordinary delivery for").requiredOption("--target <target>", "Thread target, e.g. '#engineering:abcd1234' or 'dm:@alice:abcd1234'").action(async (opts) => {
-    const thread = parseThreadTarget(opts.target);
+var threadUnfollowCommand = defineCommand(
+  {
+    name: "unfollow",
+    description: "Stop following a thread you no longer need ordinary delivery for",
+    rationale: "required",
+    options: [
+      {
+        flags: "--target <target>",
+        description: "Thread target, e.g. '#engineering:abcd1234' or 'dm:@alice:abcd1234'"
+      }
+    ]
+  },
+  async (ctx, opts) => {
+    const thread = parseThreadTarget(opts.target ?? "");
     if (!thread) {
-      fail("INVALID_TARGET", "Thread must be a thread target like '#channel:abcd1234', 'dm:@peer:abcd1234', or a thread channel UUID.");
-    }
-    let ctx;
-    try {
-      ctx = loadAgentContext();
-    } catch (err) {
-      if (err instanceof AgentBootstrapError) fail(err.code, err.message);
-      throw err;
+      throw new CliError({
+        code: "INVALID_TARGET",
+        message: "Thread must be a thread target like '#channel:abcd1234', 'dm:@peer:abcd1234', or a thread channel UUID."
+      });
     }
-    const client = new ApiClient(ctx);
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
     const res = await client.request(
       "POST",
-      `/internal/agent/${encodeURIComponent(ctx.agentId)}/threads/unfollow`,
+      `/internal/agent/${encodeURIComponent(agentContext.agentId)}/threads/unfollow`,
       { thread }
     );
     if (!res.ok) {
-      const code = res.status >= 500 ? "SERVER_5XX" : "UNFOLLOW_FAILED";
-      fail(code, res.error ?? `HTTP ${res.status}`);
+      throw new CliError({
+        code: res.status >= 500 ? "SERVER_5XX" : "UNFOLLOW_FAILED",
+        message: res.error ?? `HTTP ${res.status}`
+      });
     }
-    process.stdout.write(formatUnfollowThreadResult(thread) + "\n");
-  });
+    writeText(ctx.io, formatUnfollowThreadResult(thread) + "\n");
+  }
+);
+function registerThreadUnfollowCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, threadUnfollowCommand, runtimeOptions);
 }
 
 // src/commands/message/_format.ts
@@ -15727,8 +16011,7 @@ ${formatMessages(data.recentUnread)}`;
 }
 
 // src/commands/message/_inbox.ts
-async function drainInbox(ctx, opts) {
-  const client = new ApiClient(ctx);
+async function drainInbox(ctx, opts, client = new ApiClient(ctx)) {
   const agentPath = `/internal/agent/${encodeURIComponent(ctx.agentId)}`;
   const failCode = opts.block ? "WAIT_FAILED" : "CHECK_FAILED";
   const query = [];
@@ -15737,8 +16020,10 @@ async function drainInbox(ctx, opts) {
   const path4 = query.length > 0 ? `${agentPath}/receive?${query.join("&")}` : `${agentPath}/receive`;
   const res = await client.request("GET", path4);
   if (!res.ok) {
-    const code = res.status >= 500 ? "SERVER_5XX" : failCode;
-    fail(code, res.error ?? `HTTP ${res.status}`);
+    throw new CliError({
+      code: res.status >= 500 ? "SERVER_5XX" : failCode,
+      message: res.error ?? `HTTP ${res.status}`
+    });
   }
   const messages = res.data?.messages ?? [];
   if (ctx.clientMode === "managed-runner" || ctx.clientMode === "self-hosted-runner") {
@@ -15754,18 +16039,25 @@ async function drainInbox(ctx, opts) {
 }
 
 // src/commands/message/check.ts
-function registerCheckCommand(parent) {
-  parent.command("check").description("Drain the agent inbox (non-blocking). Acks delivered seqs before returning.").action(async () => {
-    let ctx;
-    try {
-      ctx = loadAgentContext();
-    } catch (err) {
-      if (err instanceof AgentBootstrapError) fail(err.code, err.message);
-      throw err;
-    }
-    const result = await drainInbox(ctx, { block: false });
-    process.stdout.write(formatMessages(result.messages) + "\n");
-  });
+var messageCheckCommand = defineCommand(
+  {
+    name: "check",
+    description: "Drain the agent inbox (non-blocking). Acks delivered seqs before returning.",
+    rationale: "denied"
+  },
+  async (ctx) => {
+    const agentContext = ctx.loadAgentContext();
+    const result = await drainInbox(
+      agentContext,
+      { block: false },
+      ctx.createApiClient(agentContext)
+    );
+    writeText(ctx.io, `${formatMessages(result.messages)}
+`);
+  }
+);
+function registerCheckCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, messageCheckCommand, runtimeOptions);
 }
 
 // src/commands/message/read.ts
@@ -15773,39 +16065,81 @@ function parsePositiveInt(name, raw) {
   if (raw === void 0) return void 0;
   const n = Number(raw);
   if (!Number.isFinite(n) || !Number.isInteger(n) || n <= 0) {
-    fail("INVALID_ARG", `--${name} must be a positive integer; got ${raw}`);
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: `--${name} must be a positive integer; got ${raw}`
+    });
   }
   return n;
 }
-function registerReadCommand(parent) {
-  parent.command("read").description("Read message history for a channel, DM, or thread").requiredOption("--channel <target>", "Target: '#channel', 'dm:@peer', '#channel:threadId', 'dm:@peer:threadId'").option("--before <seq>", "Return messages strictly before this seq (paginate backwards)").option("--after <seq>", "Return messages strictly after this seq (paginate forwards)").option("--around <idOrSeq>", "Center the window on this messageId or seq").option("--limit <n>", "Max messages to return (server default applies if omitted)").action(async (opts) => {
-    let ctx;
-    try {
-      ctx = loadAgentContext();
-    } catch (err) {
-      if (err instanceof AgentBootstrapError) fail(err.code, err.message);
-      throw err;
-    }
-    const before = parsePositiveInt("before", opts.before);
-    const after = parsePositiveInt("after", opts.after);
-    const limit = parsePositiveInt("limit", opts.limit);
-    const params = new URLSearchParams();
-    params.set("channel", opts.channel);
-    if (before !== void 0) params.set("before", String(before));
-    if (after !== void 0) params.set("after", String(after));
-    if (opts.around !== void 0) params.set("around", opts.around);
-    if (limit !== void 0) params.set("limit", String(limit));
-    const client = new ApiClient(ctx);
+function buildReadPath(agentId, opts) {
+  const params = new URLSearchParams();
+  params.set("channel", opts.channel);
+  if (opts.before !== void 0) params.set("before", String(opts.before));
+  if (opts.after !== void 0) params.set("after", String(opts.after));
+  if (opts.around !== void 0) params.set("around", opts.around);
+  if (opts.limit !== void 0) params.set("limit", String(opts.limit));
+  return `/internal/agent/${encodeURIComponent(agentId)}/history?${params.toString()}`;
+}
+function validateReadOpts(opts) {
+  const channel = opts.channel?.trim();
+  if (!channel) {
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: "--channel is required"
+    });
+  }
+  const before = parsePositiveInt("before", opts.before);
+  const after = parsePositiveInt("after", opts.after);
+  const limit = parsePositiveInt("limit", opts.limit);
+  return {
+    channel,
+    ...before !== void 0 ? { before } : {},
+    ...after !== void 0 ? { after } : {},
+    ...opts.around !== void 0 ? { around: opts.around } : {},
+    ...limit !== void 0 ? { limit } : {}
+  };
+}
+var messageReadCommand = defineCommand(
+  {
+    name: "read",
+    description: "Read message history for a channel, DM, or thread",
+    rationale: "denied",
+    options: [
+      { flags: "--channel <target>", description: "Target: '#channel', 'dm:@peer', '#channel:threadId', 'dm:@peer:threadId'" },
+      { flags: "--before <seq>", description: "Return messages strictly before this seq (paginate backwards)" },
+      { flags: "--after <seq>", description: "Return messages strictly after this seq (paginate forwards)" },
+      { flags: "--around <idOrSeq>", description: "Center the window on this messageId or seq" },
+      { flags: "--limit <n>", description: "Max messages to return (server default applies if omitted)" }
+    ]
+  },
+  async (ctx, opts) => {
+    const readOpts = validateReadOpts(opts);
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
     const res = await client.request(
       "GET",
-      `/internal/agent/${encodeURIComponent(ctx.agentId)}/history?${params.toString()}`
+      buildReadPath(agentContext.agentId, readOpts)
     );
     if (!res.ok) {
-      const code = res.status >= 500 ? "SERVER_5XX" : "READ_FAILED";
-      fail(code, res.error ?? `HTTP ${res.status}`);
+      throw new CliError({
+        code: res.status >= 500 ? "SERVER_5XX" : "READ_FAILED",
+        message: res.error ?? `HTTP ${res.status}`
+      });
     }
-    process.stdout.write(formatHistory(opts.channel, res.data, { around: opts.around, after, before }) + "\n");
-  });
+    writeText(
+      ctx.io,
+      `${formatHistory(readOpts.channel, res.data, {
+        around: readOpts.around,
+        after: readOpts.after,
+        before: readOpts.before
+      })}
+`
+    );
+  }
+);
+function registerReadCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, messageReadCommand, runtimeOptions);
 }
 
 // src/commands/message/search.ts
@@ -15813,56 +16147,117 @@ var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
 function normalizeMemberHandleRef(raw) {
   const trimmed = raw.trim();
   if (!trimmed) {
-    fail("INVALID_ARG", "--sender must not be empty");
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: "--sender must not be empty"
+    });
   }
   if (UUID_RE2.test(trimmed)) {
-    fail("INVALID_ARG", "--sender expects a member handle like @alice, not a UUID");
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: "--sender expects a member handle like @alice, not a UUID"
+    });
   }
   const handle = trimmed.replace(/^@/, "").trim();
   if (!handle) {
-    fail("INVALID_ARG", "--sender handle must not be empty");
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: "--sender handle must not be empty"
+    });
   }
   return handle;
 }
-function registerSearchCommand(parent) {
-  parent.command("search").description("Search messages across channels the agent can see").requiredOption("--query <q>", "Search query string").option("--channel <target>", "Restrict to a single channel/DM/thread").option("--sender <handle>", "Restrict to messages by sender handle, e.g. @alice").option("--sort <mode>", "Sort results by relevance or recent (default: relevance)").option("--before <iso>", "Only messages before this ISO datetime").option("--after <iso>", "Only messages after this ISO datetime").option("--limit <n>", "Max results (server default applies if omitted)").action(async (opts) => {
-    let ctx;
-    try {
-      ctx = loadAgentContext();
-    } catch (err) {
-      if (err instanceof AgentBootstrapError) fail(err.code, err.message);
-      throw err;
-    }
-    let limit;
-    if (opts.limit !== void 0) {
-      const n = Number(opts.limit);
-      if (!Number.isFinite(n) || !Number.isInteger(n) || n <= 0) {
-        fail("INVALID_ARG", `--limit must be a positive integer; got ${opts.limit}`);
-      }
-      limit = n;
-    }
-    if (opts.sort !== void 0 && opts.sort !== "relevance" && opts.sort !== "recent") {
-      fail("INVALID_ARG", `--sort must be "relevance" or "recent"; got ${opts.sort}`);
-    }
-    const params = new URLSearchParams();
-    params.set("q", opts.query);
-    if (opts.channel) params.set("channel", opts.channel);
-    if (opts.sender) params.set("sender", normalizeMemberHandleRef(opts.sender));
-    if (opts.sort) params.set("sort", opts.sort);
-    if (opts.before) params.set("before", opts.before);
-    if (opts.after) params.set("after", opts.after);
-    if (limit !== void 0) params.set("limit", String(limit));
-    const client = new ApiClient(ctx);
+function parsePositiveInt2(name, raw) {
+  if (raw === void 0) return void 0;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || !Number.isInteger(n) || n <= 0) {
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: `--${name} must be a positive integer; got ${raw}`
+    });
+  }
+  return n;
+}
+function normalizeSearchOpts(opts) {
+  const query = opts.query?.trim();
+  if (!query) {
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: "--query is required"
+    });
+  }
+  if (opts.sort !== void 0 && opts.sort !== "relevance" && opts.sort !== "recent") {
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: `--sort must be "relevance" or "recent"; got ${opts.sort}`
+    });
+  }
+  const limit = parsePositiveInt2("limit", opts.limit);
+  return {
+    query,
+    ...opts.channel ? { channel: opts.channel } : {},
+    ...opts.sender ? { sender: normalizeMemberHandleRef(opts.sender) } : {},
+    ...opts.sort ? { sort: opts.sort } : {},
+    ...opts.before ? { before: opts.before } : {},
+    ...opts.after ? { after: opts.after } : {},
+    ...limit !== void 0 ? { limit } : {}
+  };
+}
+function buildSearchPath(agentId, opts) {
+  const params = new URLSearchParams();
+  params.set("q", opts.query);
+  if (opts.channel) params.set("channel", opts.channel);
+  if (opts.sender) params.set("sender", opts.sender);
+  if (opts.sort) params.set("sort", opts.sort);
+  if (opts.before) params.set("before", opts.before);
+  if (opts.after) params.set("after", opts.after);
+  if (opts.limit !== void 0) params.set("limit", String(opts.limit));
+  return `/internal/agent/${encodeURIComponent(agentId)}/search?${params.toString()}`;
+}
+function toSearchErrorCode(errorCode, status) {
+  switch (errorCode) {
+    case "SCOPE_DENIED":
+    case "INVALID_JSON_RESPONSE":
+      return errorCode;
+    default:
+      return status >= 500 ? "SERVER_5XX" : "SEARCH_FAILED";
+  }
+}
+var messageSearchCommand = defineCommand(
+  {
+    name: "search",
+    description: "Search messages across channels the agent can see",
+    rationale: "denied",
+    options: [
+      { flags: "--query <q>", description: "Search query string" },
+      { flags: "--channel <target>", description: "Restrict to a single channel/DM/thread" },
+      { flags: "--sender <handle>", description: "Restrict to messages by sender handle, e.g. @alice" },
+      { flags: "--sort <mode>", description: "Sort results by relevance or recent (default: relevance)" },
+      { flags: "--before <iso>", description: "Only messages before this ISO datetime" },
+      { flags: "--after <iso>", description: "Only messages after this ISO datetime" },
+      { flags: "--limit <n>", description: "Max results (server default applies if omitted)" }
+    ]
+  },
+  async (ctx, opts) => {
+    const searchOpts = normalizeSearchOpts(opts);
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
     const res = await client.request(
       "GET",
-      `/internal/agent/${encodeURIComponent(ctx.agentId)}/search?${params.toString()}`
+      buildSearchPath(agentContext.agentId, searchOpts)
     );
     if (!res.ok) {
-      const code = res.errorCode ?? (res.status >= 500 ? "SERVER_5XX" : "SEARCH_FAILED");
-      fail(code, res.error ?? `HTTP ${res.status}`);
+      throw new CliError({
+        code: toSearchErrorCode(res.errorCode, res.status),
+        message: res.error ?? `HTTP ${res.status}`
+      });
     }
-    process.stdout.write(formatSearchResults(opts.query, res.data) + "\n");
-  });
+    writeText(ctx.io, `${formatSearchResults(searchOpts.query, res.data)}
+`);
+  }
+);
+function registerSearchCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, messageSearchCommand, runtimeOptions);
 }
 
 // src/commands/message/react.ts
@@ -16075,29 +16470,55 @@ Use this ID with slock message send --attachment-id ${d.id} to include it in a m
 
 // src/commands/attachment/view.ts
 import { writeFileSync } from "fs";
-function registerAttachmentViewCommand(parent) {
-  parent.command("view").description("Download an attachment by id and save it to a local path").requiredOption("--id <attachmentId>", "Attachment UUID").requiredOption("--output <path>", "Local path to write the file to").action(async (opts) => {
-    let ctx;
-    try {
-      ctx = loadAgentContext();
-    } catch (err) {
-      if (err instanceof AgentBootstrapError) fail(err.code, err.message);
-      throw err;
-    }
-    const client = new ApiClient(ctx);
+function validateViewOpts(opts) {
+  const id = opts.id?.trim();
+  const output = opts.output;
+  if (!id) {
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: "--id is required"
+    });
+  }
+  if (!output) {
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: "--output is required"
+    });
+  }
+  return { id, output };
+}
+var attachmentViewCommand = defineCommand(
+  {
+    name: "view",
+    description: "Download an attachment by id and save it to a local path",
+    rationale: "denied",
+    options: [
+      { flags: "--id <attachmentId>", description: "Attachment UUID" },
+      { flags: "--output <path>", description: "Local path to write the file to" }
+    ]
+  },
+  async (ctx, opts) => {
+    const { id, output } = validateViewOpts(opts);
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
     const res = await client.requestRaw(
       "GET",
-      `/api/attachments/${encodeURIComponent(opts.id)}`
+      `/api/attachments/${encodeURIComponent(id)}`
     );
     if (!res.ok) {
-      const code = res.status >= 500 ? "SERVER_5XX" : "VIEW_FAILED";
-      fail(code, res.error ?? `HTTP ${res.status}`);
+      throw new CliError({
+        code: res.status >= 500 ? "SERVER_5XX" : "VIEW_FAILED",
+        message: res.error ?? `HTTP ${res.status}`
+      });
     }
     const buffer = Buffer.from(await res.response.arrayBuffer());
-    writeFileSync(opts.output, buffer);
-    process.stdout.write(`Downloaded to: ${opts.output}
+    writeFileSync(output, buffer);
+    writeText(ctx.io, `Downloaded to: ${output}
 `);
-  });
+  }
+);
+function registerAttachmentViewCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, attachmentViewCommand, runtimeOptions);
 }
 
 // src/commands/task/_format.ts
@@ -16155,32 +16576,61 @@ function formatTaskStatusUpdated(taskNumber, status) {
 
 // src/commands/task/list.ts
 var VALID_STATUSES = /* @__PURE__ */ new Set(["all", "todo", "in_progress", "in_review", "done", "closed"]);
-function registerTaskListCommand(parent) {
-  parent.command("list").description("List tasks in a channel").requiredOption("--channel <target>", "Channel target: '#channel'").option("--status <s>", "Filter: all|todo|in_progress|in_review|done (default: server-side)").action(async (opts) => {
-    let ctx;
-    try {
-      ctx = loadAgentContext();
-    } catch (err) {
-      if (err instanceof AgentBootstrapError) fail(err.code, err.message);
-      throw err;
-    }
-    if (opts.status && !VALID_STATUSES.has(opts.status)) {
-      fail("INVALID_ARG", `--status must be one of ${Array.from(VALID_STATUSES).join("|")}; got ${opts.status}`);
-    }
-    const params = new URLSearchParams();
-    params.set("channel", opts.channel);
-    if (opts.status) params.set("status", opts.status);
-    const client = new ApiClient(ctx);
+function buildTaskListPath(agentId, opts) {
+  const params = new URLSearchParams();
+  params.set("channel", opts.channel);
+  if (opts.status) params.set("status", opts.status);
+  return `/internal/agent/${encodeURIComponent(agentId)}/tasks?${params.toString()}`;
+}
+function validateListOpts(opts) {
+  const channel = opts.channel?.trim();
+  if (!channel) {
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: "--channel is required"
+    });
+  }
+  if (opts.status && !VALID_STATUSES.has(opts.status)) {
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: `--status must be one of ${Array.from(VALID_STATUSES).join("|")}; got ${opts.status}`
+    });
+  }
+  return {
+    channel,
+    ...opts.status ? { status: opts.status } : {}
+  };
+}
+var taskListCommand = defineCommand(
+  {
+    name: "list",
+    description: "List tasks in a channel",
+    rationale: "denied",
+    options: [
+      { flags: "--channel <target>", description: "Channel target: '#channel'" },
+      { flags: "--status <s>", description: "Filter: all|todo|in_progress|in_review|done (default: server-side)" }
+    ]
+  },
+  async (ctx, opts) => {
+    const listOpts = validateListOpts(opts);
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
     const res = await client.request(
       "GET",
-      `/internal/agent/${encodeURIComponent(ctx.agentId)}/tasks?${params.toString()}`
+      buildTaskListPath(agentContext.agentId, listOpts)
     );
     if (!res.ok) {
-      const code = res.status >= 500 ? "SERVER_5XX" : "LIST_FAILED";
-      fail(code, res.error ?? `HTTP ${res.status}`);
+      throw new CliError({
+        code: res.status >= 500 ? "SERVER_5XX" : "LIST_FAILED",
+        message: res.error ?? `HTTP ${res.status}`
+      });
     }
-    process.stdout.write(formatTaskList(opts.channel, res.data, opts.status) + "\n");
-  });
+    writeText(ctx.io, `${formatTaskList(listOpts.channel, res.data, listOpts.status)}
+`);
+  }
+);
+function registerTaskListCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, taskListCommand, runtimeOptions);
 }
 
 // src/commands/task/create.ts
@@ -16267,76 +16717,133 @@ function registerTaskClaimCommand(parent) {
 }
 
 // src/commands/task/unclaim.ts
-function registerTaskUnclaimCommand(parent) {
-  parent.command("unclaim").description("Release a previously-claimed task").requiredOption("--channel <target>", "Channel target: '#channel'").requiredOption("--number <n>", "Task number to unclaim").action(async (opts) => {
-    let ctx;
-    try {
-      ctx = loadAgentContext();
-    } catch (err) {
-      if (err instanceof AgentBootstrapError) fail(err.code, err.message);
-      throw err;
-    }
-    const n = Number(opts.number);
-    if (!Number.isFinite(n) || !Number.isInteger(n) || n <= 0) {
-      fail("INVALID_ARG", `--number must be a positive integer; got ${opts.number}`);
-    }
-    const client = new ApiClient(ctx);
+function parseTaskNumber(raw) {
+  const n = Number(raw);
+  if (!Number.isFinite(n) || !Number.isInteger(n) || n <= 0) {
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: `--number must be a positive integer; got ${raw}`
+    });
+  }
+  return n;
+}
+function validateUnclaimOpts(opts) {
+  const channel = opts.channel?.trim();
+  if (!channel) {
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: "--channel is required"
+    });
+  }
+  return { channel, taskNumber: parseTaskNumber(opts.number) };
+}
+var taskUnclaimCommand = defineCommand(
+  {
+    name: "unclaim",
+    description: "Release a previously-claimed task",
+    rationale: "required",
+    options: [
+      { flags: "--channel <target>", description: "Channel target: '#channel'" },
+      { flags: "--number <n>", description: "Task number to unclaim" }
+    ]
+  },
+  async (ctx, opts) => {
+    const { channel, taskNumber } = validateUnclaimOpts(opts);
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
     const res = await client.request(
       "POST",
-      `/internal/agent/${encodeURIComponent(ctx.agentId)}/tasks/unclaim`,
-      { channel: opts.channel, task_number: n }
+      `/internal/agent/${encodeURIComponent(agentContext.agentId)}/tasks/unclaim`,
+      { channel, task_number: taskNumber }
     );
     if (!res.ok) {
-      const code = res.status >= 500 ? "SERVER_5XX" : "UNCLAIM_FAILED";
-      fail(code, res.error ?? `HTTP ${res.status}`);
+      throw new CliError({
+        code: res.status >= 500 ? "SERVER_5XX" : "UNCLAIM_FAILED",
+        message: res.error ?? `HTTP ${res.status}`
+      });
     }
-    process.stdout.write(formatTaskUnclaimed(n) + "\n");
-  });
+    writeText(ctx.io, `${formatTaskUnclaimed(taskNumber)}
+`);
+  }
+);
+function registerTaskUnclaimCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, taskUnclaimCommand, runtimeOptions);
 }
 
 // src/commands/task/update.ts
 var STATUSES = ["todo", "in_progress", "in_review", "done", "closed"];
-function registerTaskUpdateCommand(parent) {
-  parent.command("update").description("Update task status").requiredOption("--channel <target>", "Channel target: '#channel'").requiredOption("--number <n>", "Task number to update").requiredOption(
-    "--status <status>",
-    `New status. One of: ${STATUSES.join(", ")}`
-  ).action(async (opts) => {
-    let ctx;
-    try {
-      ctx = loadAgentContext();
-    } catch (err) {
-      if (err instanceof AgentBootstrapError) fail(err.code, err.message);
-      throw err;
-    }
-    const n = Number(opts.number);
-    if (!Number.isFinite(n) || !Number.isInteger(n) || n <= 0) {
-      fail("INVALID_ARG", `--number must be a positive integer; got ${opts.number}`);
-    }
-    if (!STATUSES.includes(opts.status)) {
-      fail(
-        "INVALID_ARG",
-        `--status must be one of: ${STATUSES.join(", ")}; got ${opts.status}`
-      );
-    }
-    const client = new ApiClient(ctx);
+function parseTaskNumber2(raw) {
+  const n = Number(raw);
+  if (!Number.isFinite(n) || !Number.isInteger(n) || n <= 0) {
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: `--number must be a positive integer; got ${raw}`
+    });
+  }
+  return n;
+}
+function parseStatus(raw) {
+  if (!raw || !STATUSES.includes(raw)) {
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: `--status must be one of: ${STATUSES.join(", ")}; got ${raw}`
+    });
+  }
+  return raw;
+}
+function validateUpdateOpts(opts) {
+  const channel = opts.channel?.trim();
+  if (!channel) {
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: "--channel is required"
+    });
+  }
+  return {
+    channel,
+    taskNumber: parseTaskNumber2(opts.number),
+    status: parseStatus(opts.status)
+  };
+}
+var taskUpdateCommand = defineCommand(
+  {
+    name: "update",
+    description: "Update task status",
+    rationale: "required",
+    options: [
+      { flags: "--channel <target>", description: "Channel target: '#channel'" },
+      { flags: "--number <n>", description: "Task number to update" },
+      { flags: "--status <status>", description: `New status. One of: ${STATUSES.join(", ")}` }
+    ]
+  },
+  async (ctx, opts) => {
+    const { channel, taskNumber, status } = validateUpdateOpts(opts);
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
     const res = await client.request(
       "POST",
-      `/internal/agent/${encodeURIComponent(ctx.agentId)}/tasks/update-status`,
-      { channel: opts.channel, task_number: n, status: opts.status }
+      `/internal/agent/${encodeURIComponent(agentContext.agentId)}/tasks/update-status`,
+      { channel, task_number: taskNumber, status }
     );
     if (!res.ok) {
-      const code = res.status >= 500 ? "SERVER_5XX" : "UPDATE_FAILED";
-      fail(code, res.error ?? `HTTP ${res.status}`);
+      throw new CliError({
+        code: res.status >= 500 ? "SERVER_5XX" : "UPDATE_FAILED",
+        message: res.error ?? `HTTP ${res.status}`
+      });
     }
     if (isFreshnessHeldResponse(res.data)) {
-      process.stdout.write(formatFreshnessHoldOutput(opts.channel, res.data, {
+      writeText(ctx.io, formatFreshnessHoldOutput(channel, res.data, {
         heldAction: "Your task status update was not applied.",
         draftInstructions: "After reviewing the newer context, rerun the task update command if it is still correct.\n"
       }));
       return;
     }
-    process.stdout.write(formatTaskStatusUpdated(n, opts.status) + "\n");
-  });
+    writeText(ctx.io, `${formatTaskStatusUpdated(taskNumber, status)}
+`);
+  }
+);
+function registerTaskUpdateCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, taskUpdateCommand, runtimeOptions);
 }
 
 // src/commands/profile/_format.ts
@@ -16403,39 +16910,58 @@ function normalizeTarget(target) {
   if (target === void 0) return null;
   const trimmed = target.trim();
   if (!trimmed) {
-    fail("INVALID_ARG", "profile target must not be empty");
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: "profile target must not be empty"
+    });
   }
   if (!trimmed.startsWith("@")) {
-    fail("INVALID_ARG", "profile target must start with @");
+    throw new CliError({
+      code: "INVALID_ARG",
+      message: "profile target must start with @"
+    });
   }
   return trimmed;
 }
-function registerProfileShowCommand(parent) {
-  parent.command("show").description("Show a profile. Omit the target to show your own profile.").argument("[target]", "Handle like @alice; omit to show your own profile").option("--json", "Emit machine-readable JSON").action(async (target, opts) => {
-    let ctx;
-    try {
-      ctx = loadAgentContext();
-    } catch (err) {
-      if (err instanceof AgentBootstrapError) fail(err.code, err.message);
-      throw err;
-    }
+function buildProfileShowPath(agentId, target) {
+  const base = `/internal/agent/${encodeURIComponent(agentId)}/profile`;
+  if (!target) return base;
+  const params = new URLSearchParams();
+  params.set("target", target);
+  return `${base}?${params.toString()}`;
+}
+var profileShowCommand = defineCommand(
+  {
+    name: "show",
+    description: "Show a profile. Omit the target to show your own profile.",
+    rationale: "denied",
+    arguments: ["[target]"],
+    options: [{ flags: "--json", description: "Emit machine-readable JSON" }]
+  },
+  async (ctx, target, opts = {}) => {
+    const agentContext = ctx.loadAgentContext();
+    const client = ctx.createApiClient(agentContext);
     const normalizedTarget = normalizeTarget(target);
-    const params = new URLSearchParams();
-    if (normalizedTarget) params.set("target", normalizedTarget);
-    const client = new ApiClient(ctx);
-    const pathname = params.size > 0 ? `/internal/agent/${encodeURIComponent(ctx.agentId)}/profile?${params.toString()}` : `/internal/agent/${encodeURIComponent(ctx.agentId)}/profile`;
-    const res = await client.request("GET", pathname);
+    const res = await client.request(
+      "GET",
+      buildProfileShowPath(agentContext.agentId, normalizedTarget)
+    );
     if (!res.ok || !res.data) {
-      const code = res.status >= 500 ? "SERVER_5XX" : "PROFILE_SHOW_FAILED";
-      fail(code, res.error ?? `HTTP ${res.status}`);
+      throw new CliError({
+        code: res.status >= 500 ? "SERVER_5XX" : "PROFILE_SHOW_FAILED",
+        message: res.error ?? `HTTP ${res.status}`
+      });
     }
     if (opts.json) {
-      emit({ ok: true, data: res.data });
+      writeJson(ctx.io, { ok: true, data: res.data });
       return;
     }
-    process.stdout.write(`${formatProfile(res.data)}
+    writeText(ctx.io, `${formatProfile(res.data)}
 `);
-  });
+  }
+);
+function registerProfileShowCommand(parent, runtimeOptions) {
+  registerCliCommand(parent, profileShowCommand, runtimeOptions);
 }
 
 // src/commands/profile/update.ts
@@ -17136,6 +17662,8 @@ var threadCmd = program.command("thread").description("Thread attention operatio
 registerThreadUnfollowCommand(threadCmd);
 var serverCmd = program.command("server").description("Server / workspace introspection");
 registerServerInfoCommand(serverCmd);
+var knowledgeCmd = program.command("knowledge").description("Agent knowledge retrieval (canonical Slock product knowledge topics)");
+registerKnowledgeGetCommand(knowledgeCmd);
 var messageCmd = program.command("message").description("Message operations");
 registerSendCommand(messageCmd);
 registerCheckCommand(messageCmd);