@toloka-platform/sdk 0.2.0-preview.2 → 0.2.0-preview.3

package/src/cli/program.ts

@@ -1,309 +1,92 @@
-import { Command, CommanderError, InvalidArgumentError } from "commander";
-import { assert } from "es-toolkit";
-import { writeFile } from "node:fs/promises";
-import { resolve } from "node:path";
-import { createInterface } from "node:readline/promises";
-import { createClient } from "../client";
-import type { PotatoClient } from "../client";
-import { readTolokaState } from "../state";
-import type { TolokaState } from "../state";
-import {
-  CHECK_RESULT_FILE_ENV,
-  checkProject,
-  watchProjectChecks,
-  runFreshCheck,
-  type CheckProjectOptions,
-  type CheckProjectResult,
-} from "./check";
-import { authStatus, login, logout } from "./auth";
-import type { AuthPrompt } from "./auth";
+import { Command, CommanderError } from "commander";
+import { createClient, type PotatoClient } from "../client";
 import { commandNameFromArgv, createCliAnalytics } from "./analytics";
 import type { CliAnalytics, CliAnalyticsCommandOutcome } from "./analytics";
 import type { AutoUpdateHooks } from "./auto-update";
 import { maybeAutoUpdate } from "./auto-update";
-import { PRODUCTION_BASE_URL, resolveInternalBaseUrl, resolveTolokaConfig } from "./config";
-import type { TolokaEnvironment } from "./config";
-import {
-  findCommandCredentials,
-  readStoredCredentials,
-  requireStoredCredentials,
-} from "./credentials";
-import type { StoredCredentials } from "./credentials";
-import { getCliSetting, readCliSettings, setCliSetting } from "./settings";
-import {
-  generateDatasetFieldDeclarations,
-  listProjectDatasets,
-  loadDataset,
-  setProjectSecret,
-  uploadDataset,
-} from "./data";
-import { SDK_VERSION, initProject, readAgentSkillStalenessWarning } from "./init";
-import {
-  applyProject,
-  importProject,
-  planProject,
-  projectStatus,
-  validateProject,
-} from "./project";
+import { CHECK_RESULT_FILE_ENV, type checkProject } from "./check";
+import { registerAuthCommands } from "./commands/auth";
+import { registerConfigCommands } from "./commands/config";
+import { registerDatasetCommands } from "./commands/dataset";
+import { registerDeliveryOrderCommands } from "./commands/delivery-order";
+import { registerModelCommands } from "./commands/models";
+import { registerPipelineCommands } from "./commands/pipeline";
+import { registerProjectCommands } from "./commands/project";
+import { registerReportCommand } from "./commands/report";
+import { registerSecretCommands } from "./commands/secret";
+import { registerSkillCommands } from "./commands/skill";
+import { registerSourceCommands } from "./commands/source";
+import { registerStatusCommand } from "./commands/status";
+import { registerTrainingCommands } from "./commands/training";
+import { registerVersionCommand } from "./commands/version";
+import { resolveTolokaConfig, type TolokaEnvironment } from "./config";
+import { findCommandCredentials } from "./credentials";
 import {
-  archiveModel,
-  createModel,
-  downloadModelVersion,
-  getBaseModel,
-  getModel,
-  listBaseModels,
-  listModels,
-  listModelVersions,
-  parseBaseModelId,
-} from "./models";
-import {
-  MISSING_PROJECT_ID_MESSAGE,
-  addProject,
-  createProject,
-  currentProject,
-  listRemoteProjects,
-  removeProject,
-  resolveProjectContext,
-  switchProject,
-  untrackProjectResource,
-} from "./project-context";
-import { estimatePipelineCost } from "./cost";
-import { submitIssueReport } from "./report";
-import type { IssueReportAuthor } from "./report";
+  CREDENTIAL_PRECEDENCE,
+  resolveInternalUser,
+  resolveSourceRoot,
+  type CliIo,
+  type CreatedProgram,
+  type GlobalOptions,
+  type ProgramContext,
+} from "./context";
+import { normalizeEnvironment } from "./environment";
 import { formatCliError } from "./format-error";
-import {
-  cancelPipelineRun,
-  listLivePipelines,
-  listPipelineRuns,
-  pickPipeline,
-  pipelineRunResults,
-  pipelineRunStatus,
-  startPipelineRun,
-} from "./runs";
-import {
-  cancelTrainingRun,
-  createTraining,
-  createTrainingRun,
-  estimateTrainingCost,
-  getTraining,
-  getTrainingRun,
-  readTrainingRunLogs,
-  listTrainingRuns,
-  resumeTrainingRun,
-  listTrainings,
-  updateTraining,
-} from "./trainings";
-import type { TrainingDraftOptions } from "./trainings";
-
-import type { RunOutcome } from "./runs";
-import { skillInstallCommand, skillListCommand, skillSearchCommand } from "./skill";
-import { cliVersionInfo } from "./version";
-import { findSourceRoot } from "./source";
-
-export type CliIo = {
-  readonly stdout: (text: string) => void;
-  readonly stderr: (text: string) => void;
-  readonly readStdin: () => Promise<string>;
-  readonly prompt?: AuthPrompt;
-  readonly select?: (choices: readonly { name: string; value: string }[]) => Promise<string>;
-};
-
-export type ProgramContext = {
-  readonly environment: TolokaEnvironment;
-  readonly io: CliIo;
-  readonly injectedClient?: PotatoClient;
-  readonly runChecks?: typeof checkProject;
-  readonly analytics?: CliAnalytics;
-};
-
-type GlobalOptions = {
-  readonly sourceRoot?: string;
-  readonly apiKey?: string;
-  readonly baseUrl?: string;
-  readonly projectId?: string;
+import { readAgentSkillStalenessWarning } from "./init";
+import { SDK_VERSION } from "./sdk-version";
+import { terminalIo } from "./terminal-io";
+
+export type { CliIo, CreatedProgram, ProgramContext } from "./context";
+export { terminalIo } from "./terminal-io";
+
+const argvFlag = (argv: readonly string[], flag: string): string | undefined => {
+  const index = argv.indexOf(flag);
+  if (index < 0) return undefined;
+  const value = argv[index + 1];
+  return value === undefined || value.startsWith("-") ? undefined : value;
 };
 
-const CREDENTIAL_PRECEDENCE = [
-  "Credentials resolve in this order, highest first:",
-  "  1. --api-key / --base-url",
-  "  2. POTATO_API_KEY / POTATO_BASE_URL",
-  "  3. the file written by toloka login",
-  `The platform defaults to ${PRODUCTION_BASE_URL}.`,
-].join("\n");
-
-const authoredByOption = (raw: string): IssueReportAuthor => {
-  if (raw !== "human" && raw !== "agent")
-    throw new InvalidArgumentError('Expected "human" or "agent".');
-  return raw;
-};
-
-const positiveInteger = (raw: string): number => {
-  const value = Number(raw);
-  if (!Number.isInteger(value) || value <= 0)
-    throw new InvalidArgumentError("Expected a positive integer.");
-  return value;
-};
-
-const nonNegativeInteger = (raw: string): number => {
-  const value = Number(raw);
-  if (!Number.isInteger(value) || value < 0)
-    throw new InvalidArgumentError("Expected a non-negative integer.");
-  return value;
-};
-
-const trainingMethod = (raw: string): "sft" | "gisting" => {
-  if (raw !== "sft" && raw !== "gisting") {
-    throw new InvalidArgumentError('Expected training method "sft" or "gisting".');
-  }
-  return raw;
-};
-
-const trainingRegime = (raw: string): "low" | "medium" | "high" => {
-  if (raw !== "low" && raw !== "medium" && raw !== "high") {
-    throw new InvalidArgumentError('Expected regime "low", "medium", or "high".');
+const resolveInternalCommandAccess = async (
+  argv: readonly string[],
+  environment: TolokaEnvironment,
+  injectedClient: PotatoClient | undefined,
+): Promise<boolean | undefined> => {
+  const commandName = commandNameFromArgv(argv);
+  if (
+    commandName !== "help" &&
+    commandName !== "project create" &&
+    !commandName.startsWith("delivery-order")
+  ) {
+    return undefined;
   }
-  return raw;
-};
-
-type RawTrainingDraftOptions = {
-  method?: TrainingDraftOptions["method"];
-  baseModel?: TrainingDraftOptions["baseModelId"];
-  modelVersion?: string;
-  dataset?: string;
-  validationDataset?: string;
-  trainFilter?: string;
-  validationFilter?: string;
-  regime?: TrainingDraftOptions["regime"];
-  epochs?: number;
-  evalSteps?: number;
-  promptFile?: string;
-};
-
-const trainingDraftOptions = (options: RawTrainingDraftOptions): TrainingDraftOptions => ({
-  method: options.method,
-  baseModelId: options.baseModel,
-  modelVersionId: options.modelVersion,
-  datasetId: options.dataset,
-  validationDatasetId: options.validationDataset,
-  trainingFilter: options.trainFilter,
-  validationFilter: options.validationFilter,
-  regime: options.regime,
-  epochs: options.epochs,
-  evalSteps: options.evalSteps,
-  promptFilePath: options.promptFile,
-});
-
-const exitCodeForOutcome = (outcome: RunOutcome): number => {
-  if (outcome === "failed") return 1;
-  if (outcome === "timedOut") return 2;
-  return 0;
-};
-
-type Resolved = {
-  readonly sourceRoot: string;
-  readonly client: PotatoClient;
-  readonly baseUrl: string;
-  readonly state: TolokaState | undefined;
-  readonly stored: StoredCredentials | undefined;
-  readonly projectId?: string;
-};
-
-const resolveSourceRoot = async (globals: GlobalOptions, io: CliIo): Promise<string> => {
-  if (globals.sourceRoot !== undefined) return resolve(globals.sourceRoot);
-
-  const workingDirectory = process.cwd();
-  const discovered = await findSourceRoot(workingDirectory);
-  if (discovered === undefined || discovered === workingDirectory) return workingDirectory;
-
-  io.stderr(`Using project root ${discovered} (found from ${workingDirectory}).`);
-  return discovered;
-};
-
-const resolveInitRoot = (globals: GlobalOptions): string =>
-  globals.sourceRoot === undefined ? process.cwd() : resolve(globals.sourceRoot);
-
-const readCommandCredentials = async (globals: GlobalOptions, context: ProgramContext) => {
-  const { found, warning } = await findCommandCredentials(
-    context.environment,
-    globals.apiKey ?? context.environment.POTATO_API_KEY,
-  );
-  if (warning !== undefined) context.io.stderr(warning);
-  return found?.credentials;
-};
-
-const identifyClientUser = async (client: PotatoClient, analytics: CliAnalytics | undefined) => {
-  if (analytics?.shouldIdentify !== true) return;
+  if (injectedClient !== undefined) return resolveInternalUser(injectedClient);
   try {
-    analytics.identifyCurrentUser(await client.me());
-  } catch {}
-};
-
-const resolveContext = async (
-  globals: GlobalOptions,
-  context: ProgramContext,
-): Promise<Resolved> => {
-  const sourceRoot = await resolveSourceRoot(globals, context.io);
-  const state = await readTolokaState(sourceRoot);
-  const stored = await readCommandCredentials(globals, context);
-  const config = resolveTolokaConfig(globals, state, context.environment, stored);
-  const client =
-    context.injectedClient ?? createClient({ apiKey: config.apiKey, baseUrl: config.baseUrl });
-  await identifyClientUser(client, context.analytics);
-
-  return {
-    sourceRoot,
-    client,
-    baseUrl: config.baseUrl,
-    state,
-    stored,
-    ...(config.projectId === undefined ? {} : { projectId: config.projectId }),
-  };
-};
-
-const resolveSelectedProject = (
-  globals: GlobalOptions,
-  context: ProgramContext,
-  stored: StoredCredentials | undefined,
-  state: TolokaState | undefined,
-) =>
-  resolveProjectContext({
-    flags: globals,
-    environment: context.environment,
-    stored,
-    ...(state === undefined ? {} : { state }),
-  });
-
-export type CreatedProgram = {
-  readonly program: Command;
-  readonly exitCode: { value: number };
+    const apiKey = argvFlag(argv, "--api-key");
+    const baseUrl = argvFlag(argv, "--base-url");
+    const { found } = await findCommandCredentials(
+      environment,
+      apiKey ?? environment.TOLOKA_API_KEY,
+    );
+    const config = resolveTolokaConfig(
+      {
+        ...(apiKey === undefined ? {} : { apiKey }),
+        ...(baseUrl === undefined ? {} : { baseUrl }),
+      },
+      undefined,
+      environment,
+      found?.credentials,
+    );
+    return await resolveInternalUser(
+      createClient({ apiKey: config.apiKey, baseUrl: config.baseUrl }),
+    );
+  } catch {
+    return undefined;
+  }
 };
 
 export function createProgram(context: ProgramContext): CreatedProgram {
   const program = new Command("toloka");
   const exitCode = { value: 0 };
-  const runChecks = context.runChecks ?? checkProject;
-  const runChecksInterruptibly = async (
-    options: CheckProjectOptions,
-    runner: (options: CheckProjectOptions) => Promise<CheckProjectResult> = runChecks,
-  ): Promise<{ result: CheckProjectResult; interruptedExitCode?: number }> => {
-    const abortController = new AbortController();
-    let interruptedExitCode: number | undefined;
-    const interrupt = (exitCode: number) => {
-      interruptedExitCode = exitCode;
-      abortController.abort();
-    };
-    const interruptSigint = () => interrupt(130);
-    const interruptSigterm = () => interrupt(143);
-    process.on("SIGINT", interruptSigint);
-    process.on("SIGTERM", interruptSigterm);
-    try {
-      const result = await runner({ ...options, signal: abortController.signal });
-      return { result, ...(interruptedExitCode === undefined ? {} : { interruptedExitCode }) };
-    } finally {
-      process.off("SIGINT", interruptSigint);
-      process.off("SIGTERM", interruptSigterm);
-    }
-  };
   let warnedAboutStaleSkills = false;
 
   program
@@ -326,6 +109,7 @@ export function createProgram(context: ProgramContext): CreatedProgram {
     .exitOverride();
 
   const globals = (): GlobalOptions => program.opts<GlobalOptions>();
+  const host = { context, exitCode, globals };
 
   program.hook("postAction", async (_thisCommand, actionCommand) => {
     if (warnedAboutStaleSkills) return;
@@ -349,1051 +133,52 @@ export function createProgram(context: ProgramContext): CreatedProgram {
     context.io.stderr(warning);
   });
 
-  program
-    .command("version")
-    .option("--json", "print version and build provenance as JSON", false)
-    .description("print the current CLI version")
-    .action((options: { json: boolean }) =>
-      context.io.stdout(options.json ? JSON.stringify(cliVersionInfo()) : SDK_VERSION),
-    );
-
-  const config = program.command("config").description("read and write machine CLI settings");
-  config
-    .command("get")
-    .argument("[name]", "setting name; omit to print every setting")
-    .description("print a CLI setting, or every setting")
-    .action(async (name?: string) => {
-      const settings = await readCliSettings(context.environment);
-      context.io.stdout(getCliSetting(settings, name).output);
-    });
-  config
-    .command("set")
-    .argument("<name>", "setting name")
-    .argument("<value>", "setting value")
-    .description("write a CLI setting for this machine")
-    .action(async (name: string, value: string) => {
-      const result = await setCliSetting(context.environment, name, value);
-      context.io.stdout(result.output);
-    });
-  config.action(async () => {
-    const settings = await readCliSettings(context.environment);
-    context.io.stdout(getCliSetting(settings, undefined).output);
-  });
-
-  program
-    .command("login")
-    .description("store an API key for this machine after verifying it")
-    .action(async () => {
-      const result = await login({
-        ...(globals().apiKey === undefined ? {} : { apiKey: globals().apiKey }),
-        ...(globals().baseUrl === undefined ? {} : { baseUrl: globals().baseUrl }),
-        ...(context.io.prompt === undefined ? {} : { prompt: context.io.prompt }),
-        write: context.io.stdout,
-        environment: context.environment,
-      });
-      context.io.stdout(result.output);
-      try {
-        const stored = await readStoredCredentials(context.environment);
-        if (stored === undefined) return;
-        const client = context.injectedClient ?? createClient(stored);
-        await identifyClientUser(client, context.analytics);
-      } catch {}
-    });
-
-  program
-    .command("logout")
-    .description("remove stored credentials from this machine")
-    .action(async () => {
-      const result = await logout(context.environment);
-      context.io.stdout(result.output);
-    });
-
-  program
-    .command("auth-status")
-    .alias("whoami")
-    .description("show which platform and key the CLI would use")
-    .option("--show-token", "print the API key instead of masking it", false)
-    .action(async (options: { showToken: boolean }) => {
-      const flags = globals();
-      const credentialLookup = await findCommandCredentials(
-        context.environment,
-        flags.apiKey ?? context.environment.POTATO_API_KEY,
-      );
-      const stored = credentialLookup.found?.credentials;
-      const sourceRoot = await resolveSourceRoot(flags, context.io);
-      const state = await readTolokaState(sourceRoot);
-      const project = resolveSelectedProject(flags, context, stored, state);
-      const injectedClient = context.injectedClient;
-
-      const result = await authStatus({
-        environment: context.environment,
-        showToken: options.showToken,
-        credentialLookup,
-        ...(flags.apiKey === undefined ? {} : { flagApiKey: flags.apiKey }),
-        ...(flags.baseUrl === undefined ? {} : { flagBaseUrl: flags.baseUrl }),
-        ...(injectedClient === undefined ? {} : { probe: () => injectedClient }),
-        ...(project === undefined ? {} : { project }),
-      });
-
-      context.io.stdout(result.output);
-      if (!result.authenticated) {
-        exitCode.value = 1;
-        return;
-      }
-      try {
-        const config = resolveTolokaConfig(flags, state, context.environment, stored);
-        const client =
-          context.injectedClient ??
-          createClient({ apiKey: config.apiKey, baseUrl: config.baseUrl });
-        await identifyClientUser(client, context.analytics);
-      } catch {}
-    });
-
-  const project = program
-    .command("project")
-    .description("select and manage the current platform project");
-  project
-    .command("list")
-    .option("--limit <n>", "maximum projects to list", positiveInteger)
-    .description("list remote projects this key can see")
-    .action(async (options: { limit?: number }) => {
-      const flags = globals();
-      const { client, stored, state } = await resolveContext(flags, context);
-      const selected = resolveSelectedProject(flags, context, stored, state);
-      await listRemoteProjects({
-        client,
-        io: context.io,
-        ...(selected === undefined ? {} : { context: selected }),
-        ...(options.limit === undefined ? {} : { limit: options.limit }),
-      });
-    });
-  project
-    .command("add")
-    .argument("[alias]", "local name for this project")
-    .argument("[projectId]", "platform project id")
-    .description("register a live project and select it")
-    .action(async (alias?: string, projectId?: string) => {
-      const flags = globals();
-      const found = await requireStoredCredentials(context.environment);
-      const client = context.injectedClient ?? createClient(found.credentials);
-      await addProject({
-        environment: context.environment,
-        flags,
-        client,
-        io: context.io,
-        afterPreflight: async () => identifyClientUser(client, context.analytics),
-        ...(alias === undefined ? {} : { alias }),
-        ...(projectId === undefined ? {} : { projectId }),
-      });
-    });
-
-  project
-    .command("switch")
-    .argument("<alias>", "local project alias")
-    .description("select a registered project")
-    .action(async (alias: string) => {
-      await switchProject({
-        environment: context.environment,
-        flags: globals(),
-        alias,
-        io: context.io,
-      });
-    });
-  project
-    .command("current")
-    .description("show the project this command would use")
-    .action(async () => {
-      const flags = globals();
-      const stored = await readCommandCredentials(flags, context);
-      const sourceRoot = await resolveSourceRoot(flags, context.io);
-      const state = await readTolokaState(sourceRoot);
-      const result = currentProject({
-        flags,
-        environment: context.environment,
-        stored,
-        ...(state === undefined ? {} : { state }),
-        io: context.io,
-      });
-      if (result.project === undefined) exitCode.value = 1;
-    });
-  project
-    .command("url")
-    .description("print the current project URL")
-    .action(async () => {
-      const { baseUrl, client, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      const live = await client.projects.get({ projectId });
-      const url = new URL(
-        `/teams/${encodeURIComponent(live.teamId)}/projects/${encodeURIComponent(live.id)}`,
-        baseUrl,
-      );
-      context.io.stdout(url.href);
-    });
-
-  project
-    .command("remove")
-    .argument("<alias>", "local project alias")
-    .description("forget a local project alias")
-    .action(async (alias: string) => {
-      await removeProject({
-        environment: context.environment,
-        flags: globals(),
-        alias,
-        io: context.io,
-      });
-    });
-  project
-    .command("untrack")
-    .argument("<type>", "pipeline or dataset")
-    .argument("<name>", "tracked resource name")
-    .option("--confirm", "confirm untracking in a non-interactive environment", false)
-    .description("remove a pipeline or dataset from local tracking without deleting it")
-    .action(async (type: string, name: string, options: { confirm: boolean }) => {
-      assert(
-        type === "pipeline" || type === "dataset",
-        "Resource type must be pipeline or dataset.",
-      );
-      const sourceRoot = await resolveSourceRoot(globals(), context.io);
-      await untrackProjectResource({
-        sourceRoot,
-        type,
-        name,
-        confirm: options.confirm,
-        io: context.io,
-      });
-    });
-  project
-    .command("create")
-    .argument("[alias]", "local name for the new project")
-    .option("--name <name>", "platform project name")
-    .option("--team-id <id>", "team that owns the project")
-    .description("create a live project and select it")
-    .action(async (alias: string | undefined, options: { name?: string; teamId?: string }) => {
-      const flags = globals();
-      const found = await requireStoredCredentials(context.environment);
-      const client = context.injectedClient ?? createClient(found.credentials);
-      const sourceRoot = await resolveSourceRoot(flags, context.io);
-      await createProject({
-        environment: context.environment,
-        flags,
-        client,
-        io: context.io,
-        sourceRoot,
-        afterPreflight: async () => identifyClientUser(client, context.analytics),
-        ...(alias === undefined ? {} : { alias }),
-        ...(options.name === undefined ? {} : { name: options.name }),
-        ...(options.teamId === undefined ? {} : { teamId: options.teamId }),
-      });
-    });
-
-  program
-    .command("init")
-    .description("initialize this project directory and install the agent bootstrap")
-    .action(async () => {
-      const flags = globals();
-      const sourceRoot = resolveInitRoot(flags);
-      const state = await readTolokaState(sourceRoot);
-      const selected = resolveProjectContext({
-        flags,
-        environment: context.environment,
-        ...(state === undefined ? {} : { state }),
-      });
-      const result = await initProject(
-        sourceRoot,
-        selected === undefined ? {} : { projectId: selected.id },
-      );
-      context.io.stdout(result.output);
-      if (result.warning !== undefined) context.io.stderr(result.warning);
-    });
-
-  program
-    .command("import")
-    .argument(
-      "[projectId]",
-      "existing project to write into source; defaults to the selected project",
-    )
-    .option("-f, --force", "replace an existing pipelines/ directory", false)
-    .description("generate TypeScript source from a live project")
-    .action(async (projectId?: string, options?: { force?: boolean }) => {
-      const {
-        sourceRoot,
-        client,
-        projectId: selectedProjectId,
-      } = await resolveContext(globals(), context);
-      const id = projectId ?? selectedProjectId;
-      assert(id, MISSING_PROJECT_ID_MESSAGE);
-      const result = await importProject(client, {
-        sourceRoot,
-        projectId: id,
-        ...(options?.force === true ? { force: true } : {}),
-      });
-      context.io.stdout(result.output);
-    });
-
-  program
-    .command("plan")
-    .description("show what apply would change")
-    .action(async () => {
-      const { sourceRoot, client, projectId } = await resolveContext(globals(), context);
-      const result = await planProject(client, {
-        sourceRoot,
-        ...(projectId === undefined ? {} : { projectId }),
-      });
-      context.io.stdout(result.output);
-    });
-
-  program
-    .command("validate")
-    .description("run platform spec validation and report matching checks")
-    .action(async () => {
-      const { sourceRoot, client, projectId } = await resolveContext(globals(), context);
-      const result = await validateProject(client, {
-        sourceRoot,
-        ...(projectId === undefined ? {} : { projectId }),
-      });
-      context.io.stdout(result.output);
-      if (!result.valid) exitCode.value = 1;
-    });
-
-  program
-    .command("check")
-    .argument("[pipeline]", "pipeline source directory or name")
-    .option("--node <node>", "check one code or human-work node by name or id")
-    .option("--json", "print the structured check report", false)
-    .option("--watch", "rerun checks when project files change", false)
-    .description("run the complete local source, type, and test gate")
-    .action(
-      async (
-        pipeline: string | undefined,
-        options: { node?: string; json: boolean; watch: boolean },
-      ) => {
-        const sourceRoot = await resolveSourceRoot(globals(), context.io);
-        const checkOptions = {
-          environment: context.environment,
-          sourceRoot,
-          ...(pipeline === undefined ? {} : { pipeline }),
-          ...(options.node === undefined ? {} : { node: options.node }),
-          ...(options.json ? { json: true } : {}),
-        };
-        const writeCheckOutput = async (output: string): Promise<void> => {
-          const resultPath = context.environment[CHECK_RESULT_FILE_ENV];
-          if (resultPath === undefined) context.io.stdout(output);
-          else await writeFile(resultPath, output, "utf8");
-        };
-        const checkRunner =
-          context.runChecks === undefined &&
-          context.environment[CHECK_RESULT_FILE_ENV] === undefined
-            ? runFreshCheck
-            : runChecks;
-        if (options.watch) {
-          const abortController = new AbortController();
-          const stop = () => abortController.abort();
-          process.on("SIGINT", stop);
-          process.on("SIGTERM", stop);
-          try {
-            await watchProjectChecks(
-              checkOptions,
-              async (result) => {
-                await writeCheckOutput(result.output);
-                exitCode.value = result.exitCode;
-              },
-              undefined,
-              abortController.signal,
-            );
-          } finally {
-            process.off("SIGINT", stop);
-            process.off("SIGTERM", stop);
-          }
-          return;
-        }
-        const { result, interruptedExitCode } = await runChecksInterruptibly(
-          checkOptions,
-          checkRunner,
-        );
-        await writeCheckOutput(result.output);
-        exitCode.value = interruptedExitCode ?? result.exitCode;
-      },
-    );
-
-  program
-    .command("apply")
-    .description("check source, then make the platform match it")
-    .action(async () => {
-      const sourceRoot = await resolveSourceRoot(globals(), context.io);
-      const { result: checked, interruptedExitCode } = await runChecksInterruptibly({
-        sourceRoot,
-        environment: context.environment,
-      });
-      context.io.stdout(checked.output);
-      if (interruptedExitCode !== undefined) {
-        exitCode.value = interruptedExitCode;
-        return;
-      }
-      if (checked.exitCode !== 0) {
-        exitCode.value = checked.exitCode;
-        return;
-      }
-      assert(checked.source, "Passing checks must return project source");
-      const { client, projectId } = await resolveContext(globals(), context);
-      const result = await applyProject(client, {
-        sourceRoot,
-        source: checked.source,
-        ...(projectId === undefined ? {} : { projectId }),
-      });
-      context.io.stdout(result.output);
-    });
-
-  const secret = program.command("secret").description("manage project secrets");
-  secret
-    .command("set")
-    .argument("<name>", "secret name referenced by a code node")
-    .option(
-      "--from-env <variable>",
-      "read the value from this environment variable instead of stdin",
-    )
-    .description("set a secret value without writing it to disk")
-    .action(async (name: string, options: { fromEnv?: string }) => {
-      const { client, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-
-      const value =
-        options.fromEnv === undefined
-          ? (await context.io.readStdin()).replace(/\r?\n$/u, "")
-          : context.environment[options.fromEnv];
-      assert(
-        value !== undefined,
-        `Missing secret value. Set ${options.fromEnv ?? "the named environment variable"} or pipe it to stdin.`,
-      );
-
-      try {
-        const result = await setProjectSecret(client, { projectId, name, value });
-        context.io.stdout(result.output);
-      } catch {
-        context.io.stderr(`Failed to set secret ${name}.`);
-        exitCode.value = 1;
-      }
-    });
-
-  const baseModel = program
-    .command("base-model")
-    .description("inspect the global base model catalog");
-  baseModel
-    .command("list")
-    .option("--json", "print JSON", false)
-    .description("list base models")
-    .action(async (options: { json: boolean }) => {
-      const { client } = await resolveContext(globals(), context);
-      await listBaseModels(client, { json: options.json }, context.io);
-    });
-  baseModel
-    .command("get")
-    .argument("<id>", "base model ID")
-    .option("--json", "print JSON", false)
-    .description("show one base model")
-    .action(async (id: string, options: { json: boolean }) => {
-      const { client } = await resolveContext(globals(), context);
-      await getBaseModel(client, { id: parseBaseModelId(id), json: options.json }, context.io);
-    });
-
-  const model = program
-    .command("model")
-    .description("manage project Models and immutable versions");
-  model
-    .command("list")
-    .option("--json", "print JSON", false)
-    .description("list Models owned by the selected project")
-    .action(async (options: { json: boolean }) => {
-      const { client, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      await listModels(client, { projectId, json: options.json }, context.io);
-    });
-  model
-    .command("get")
-    .argument("<name-or-id>", "project Model name or ID")
-    .option("--json", "print JSON", false)
-    .description("show one project Model")
-    .action(async (nameOrId: string, options: { json: boolean }) => {
-      const { client, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      await getModel(client, { projectId, nameOrId, json: options.json }, context.io);
-    });
-  model
-    .command("versions")
-    .argument("<name-or-id>", "project Model name or ID")
-    .option("--json", "print JSON", false)
-    .description("list immutable versions of a model")
-    .action(async (nameOrId: string, options: { json: boolean }) => {
-      const { client, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      await listModelVersions(client, { projectId, nameOrId, json: options.json }, context.io);
-    });
-  model
-    .command("create")
-    .argument("<name>", "new Model name")
-    .requiredOption("--base <id>", "base model ID")
-    .option("--description <text>", "Model description")
-    .option("--json", "print JSON", false)
-    .description("create project Model metadata without a Model Version")
-    .action(
-      async (name: string, options: { base: string; description?: string; json: boolean }) => {
-        const { client, projectId } = await resolveContext(globals(), context);
-        assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-        await createModel(
-          client,
-          {
-            projectId,
-            name,
-            description: options.description,
-            baseModelId: parseBaseModelId(options.base),
-            json: options.json,
-          },
-          context.io,
-        );
-      },
-    );
-  model
-    .command("archive")
-    .option("--json", "print JSON", false)
-    .argument("<name-or-id>", "project Model name or ID")
-    .description("archive a project Model")
-    .action(async (nameOrId: string, options: { json: boolean }) => {
-      const { client, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      await archiveModel(client, { projectId, nameOrId, json: options.json }, context.io);
-    });
-
-  const modelVersion = model.command("version").description("manage one immutable Model Version");
-  modelVersion
-    .command("download")
-    .argument("<model-version>", "Model Version ID or Model@name")
-    .requiredOption("--out <directory>", "output directory")
-    .description("download and verify Model Version content")
-    .action(async (modelVersionId: string, options: { out: string }) => {
-      const { client, projectId } = await resolveContext(globals(), context);
-      await downloadModelVersion(
-        client,
-        { projectId, modelVersionId, out: options.out },
-        context.io,
-      );
-    });
-
-  const training = program.command("training").description("manage project Training drafts");
-  training
-    .command("list")
-    .option("--json", "print JSON", false)
-    .description("list active Trainings owned by the selected project")
-    .action(async (options: { json: boolean }) => {
-      const { client, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      await listTrainings(client, { projectId, json: options.json }, context.io);
-    });
-  training
-    .command("get")
-    .argument("<name-or-id>", "Training name or ID")
-    .option("--json", "print JSON", false)
-    .description("show one Training draft")
-    .action(async (nameOrId: string, options: { json: boolean }) => {
-      const { client, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      await getTraining(client, { projectId, nameOrId, json: options.json }, context.io);
-    });
-  training
-    .command("create")
-    .argument("<name>", "new Training name")
-    .option("--method <method>", "Training method", trainingMethod, "sft")
-    .option("--base-model <id>", "catalog Base Model source", parseBaseModelId)
-    .option("--model-version <id>", "exact Model Version source")
-    .requiredOption("--dataset <id>", "required training Dataset ID")
-    .option("--validation-dataset <id>", "optional validation Dataset ID")
-    .option("--train-filter <field=value>", "training Dataset field equality filter")
-    .option("--validation-filter <field=value>", "validation Dataset field equality filter")
-    .option("--regime <regime>", "Python training regime", trainingRegime)
-    .option("--epochs <count>", "training epochs", nonNegativeInteger)
-    .option("--eval-steps <count>", "SFT eval steps", positiveInteger)
-    .option("--prompt-file <path>", "gisting prompt text file")
-    .option("--json", "print JSON", false)
-    .description("create a normalized Training draft")
-    .action(async (name: string, options: RawTrainingDraftOptions & { json: boolean }) => {
-      const { client, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      await createTraining(
-        client,
-        {
-          ...trainingDraftOptions(options),
-          projectId,
-          name,
-          json: options.json,
-        },
-        context.io,
-      );
-    });
-  training
-    .command("update")
-    .argument("<name-or-id>", "Training name or ID")
-    .option("--base-model <id>", "catalog Base Model source", parseBaseModelId)
-    .option("--model-version <id>", "exact Model Version source")
-    .option("--dataset <id>", "required training Dataset ID")
-    .option("--validation-dataset <id>", "replacement validation Dataset ID")
-    .option("--train-filter <field=value>", "replacement training Dataset field equality filter")
-    .option("--validation-filter <field=value>", "replacement validation Dataset field equality filter")
-    .option("--regime <regime>", "Python training regime", trainingRegime)
-    .option("--epochs <count>", "training epochs", nonNegativeInteger)
-    .option("--eval-steps <count>", "SFT eval steps", positiveInteger)
-    .option("--prompt-file <path>", "replacement gisting prompt text file")
-    .option("--json", "print JSON", false)
-    .description("replace the complete Training draft")
-    .action(async (nameOrId: string, options: RawTrainingDraftOptions & { json: boolean }) => {
-      const { client, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      await updateTraining(
-        client,
-        {
-          ...trainingDraftOptions(options),
-          projectId,
-          nameOrId,
-          json: options.json,
-        },
-        context.io,
-      );
-    });
-  training
-    .command("cost")
-    .argument("<name-or-id>", "Training name or ID")
-    .option("--idempotency-key <key>", "reuse one Cost Estimate input preparation")
-    .option("--json", "print JSON", false)
-    .description("validate Training inputs and calculate the maximum charge")
-    .action(async (nameOrId: string, options: { idempotencyKey?: string; json: boolean }) => {
-      const { client, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      await estimateTrainingCost(
-        client,
-        { projectId, nameOrId, idempotencyKey: options.idempotencyKey, json: options.json },
-        context.io,
-      );
-    });
-  training
-    .command("run")
-    .argument("<name-or-id>", "Training name or ID")
-    .requiredOption("--estimate-file <path>", "ready Training Cost Estimate JSON")
-    .requiredOption("--version-name <name>", "unique Model Version name for this run")
-    .option("--idempotency-key <key>", "reuse one Training Run creation")
-    .option("--json", "print JSON", false)
-    .description("create one queued Training Run from a ready Cost Estimate")
-    .action(
-      async (
-        nameOrId: string,
-        options: {
-          estimateFile: string;
-          versionName: string;
-          idempotencyKey?: string;
-          json: boolean;
-        },
-      ) => {
-        const { client, projectId } = await resolveContext(globals(), context);
-        assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-        await createTrainingRun(client, { projectId, nameOrId, ...options }, context.io);
-      },
-    );
-  training
-    .command("runs")
-    .argument("<name-or-id>", "Training name or ID")
-    .option("--json", "print JSON", false)
-    .description("list Training Run history")
-    .action(async (nameOrId: string, options: { json: boolean }) => {
-      const { client, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      await listTrainingRuns(client, { projectId, nameOrId, json: options.json }, context.io);
-    });
-  training
-    .command("status")
-    .argument("<training-run-id>", "Training Run ID")
-    .option("--json", "print JSON", false)
-    .description("show one Training Run")
-    .action(async (trainingRunId: string, options: { json: boolean }) => {
-      const { client } = await resolveContext(globals(), context);
-      await getTrainingRun(client, { trainingRunId, json: options.json }, context.io);
-    });
-  training
-    .command("resume")
-    .argument("<training-run-id>", "Training Run ID")
-    .option("--json", "print JSON", false)
-    .description("resume a Training Run blocked on funds or payment")
-    .action(async (trainingRunId: string, options: { json: boolean }) => {
-      const { client } = await resolveContext(globals(), context);
-      await resumeTrainingRun(client, { trainingRunId, json: options.json }, context.io);
-    });
-  training
-    .command("cancel")
-    .argument("<training-run-id>", "Training Run ID")
-    .option("--json", "print JSON", false)
-    .description("cancel a Training Run before provider work completes")
-    .action(async (trainingRunId: string, options: { json: boolean }) => {
-      const { client } = await resolveContext(globals(), context);
-      await cancelTrainingRun(client, { trainingRunId, json: options.json }, context.io);
-    });
-  training
-    .command("logs")
-    .argument("<training-run-id>", "Training Run ID")
-    .option("--follow", "wait for new log entries until complete", false)
-    .description("read sanitized Training Run logs")
-    .action(async (trainingRunId: string, options: { follow: boolean }) => {
-      const { client } = await resolveContext(globals(), context);
-      await readTrainingRunLogs(client, { trainingRunId, follow: options.follow }, context.io);
-    });
-
-  const dataset = program
-    .command("dataset")
-    .description("inspect and move dataset catalog and rows");
-  dataset
-    .command("list")
-    .description("list live datasets in the selected project")
-    .action(async () => {
-      const { client, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      const result = await listProjectDatasets(client, { projectId });
-      context.io.stdout(result.output);
-    });
-  dataset
-    .command("fields")
-    .argument("<name>", "dataset name or id")
-    .description("print field declarations inferred from uploaded rows")
-    .action(async (name: string) => {
-      const { sourceRoot, client, projectId } = await resolveContext(globals(), context);
-      const result = await generateDatasetFieldDeclarations(client, {
-        sourceRoot,
-        datasetName: name,
-        ...(projectId === undefined ? {} : { projectId }),
-      });
-      context.io.stdout(result.output);
-    });
-  dataset
-    .command("load")
-    .argument("<name>", "dataset name or id")
-    .requiredOption("--out <file>", "JSONL file to write")
-    .option("--limit <n>", "how many rows to keep after download", positiveInteger)
-    .option("--timeout <ms>", "how long to wait for the export", positiveInteger)
-    .description("download live dataset rows into a JSONL file")
-    .action(async (name: string, options: { out: string; limit?: number; timeout?: number }) => {
-      const { sourceRoot, client, projectId } = await resolveContext(globals(), context);
-      const result = await loadDataset(client, {
-        sourceRoot,
-        datasetName: name,
-        outPath: resolve(options.out),
-        ...(projectId === undefined ? {} : { projectId }),
-        ...(options.limit === undefined ? {} : { limit: options.limit }),
-        ...(options.timeout === undefined ? {} : { timeoutMs: options.timeout }),
-      });
-      context.io.stdout(result.output);
-    });
-  dataset
-    .command("upload")
-    .argument("<name>", "dataset name or id")
-    .argument("<file>", "JSON array, JSONL, or CSV file")
-    .description("append rows to a dataset")
-    .action(async (name: string, file: string) => {
-      const { sourceRoot, client, projectId } = await resolveContext(globals(), context);
-      const result = await uploadDataset(client, {
-        sourceRoot,
-        datasetName: name,
-        filePath: resolve(file),
-        ...(projectId === undefined ? {} : { projectId }),
-      });
-      context.io.stdout(result.output);
-      if (result.warning !== undefined) context.io.stderr(result.warning);
-    });
-
-  const pipelineNameHelp =
-    "pipeline name or id; required unless a TTY picker can choose among several";
-  const pipeline = program
-    .command("pipeline")
-    .description("operate on a live pipeline in the selected project");
-  pipeline
-    .command("list")
-    .option("--limit <n>", "maximum pipelines to list", positiveInteger)
-    .description("list live pipelines in the selected project")
-    .action(async (options: { limit?: number }) => {
-      const { client, projectId, state } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      const result = await listLivePipelines({
-        client,
-        projectId,
-        state,
-        ...(options.limit === undefined ? {} : { limit: options.limit }),
-      });
-      context.io.stdout(result.output);
-    });
-  pipeline
-    .command("run")
-    .argument("[name]", pipelineNameHelp)
-    .option("--wait", "wait for the run to reach a terminal state", false)
-    .option("--timeout <ms>", "how long to wait", positiveInteger)
-    .description("start a run on a deployed pipeline")
-    .action(async (name: string | undefined, options: { wait: boolean; timeout?: number }) => {
-      const { client, state, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      const result = await startPipelineRun(client, {
-        projectId,
-        state,
-        ...(name === undefined ? {} : { pipeline: name }),
-        wait: options.wait,
-        ...(options.timeout === undefined ? {} : { timeoutMs: options.timeout }),
-        ...(context.io.select === undefined ? {} : { select: context.io.select }),
-      });
-      context.io.stdout(result.output);
-      exitCode.value = exitCodeForOutcome(result.outcome);
-    });
-  pipeline
-    .command("status")
-    .argument("[name]", pipelineNameHelp)
-    .description("report the latest run's state and item counts")
-    .action(async (name: string | undefined) => {
-      const { client, state, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      const result = await pipelineRunStatus(client, {
-        projectId,
-        state,
-        ...(name === undefined ? {} : { pipeline: name }),
-        ...(context.io.select === undefined ? {} : { select: context.io.select }),
-      });
-      context.io.stdout(result.output);
-      exitCode.value = exitCodeForOutcome(result.outcome);
-    });
-  pipeline
-    .command("runs")
-    .argument("[name]", pipelineNameHelp)
-    .option("--limit <n>", "how many runs to list", positiveInteger)
-    .description("list recent runs")
-    .action(async (name: string | undefined, options: { limit?: number }) => {
-      const { client, state, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      const result = await listPipelineRuns(client, {
-        projectId,
-        state,
-        ...(name === undefined ? {} : { pipeline: name }),
-        ...(options.limit === undefined ? {} : { limit: options.limit }),
-        ...(context.io.select === undefined ? {} : { select: context.io.select }),
-      });
-      context.io.stdout(result.output);
-    });
-  pipeline
-    .command("cost")
-    .argument("[name]", pipelineNameHelp)
-    .option("--item-limit <n>", "cap how many items to price", positiveInteger)
-    .description("forecast what a run of this pipeline would bill")
-    .action(async (name: string | undefined, options: { itemLimit?: number }) => {
-      const { client, state, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      const result = await estimatePipelineCost(client, {
-        projectId,
-        state,
-        ...(name === undefined ? {} : { pipeline: name }),
-        ...(options.itemLimit === undefined ? {} : { itemLimit: options.itemLimit }),
-        ...(context.io.select === undefined ? {} : { select: context.io.select }),
-      });
-      context.io.stdout(result.output);
-    });
-  pipeline
-    .command("cancel")
-    .argument("<runId>", "run to cancel")
-    .description("request cancellation of a run")
-    .action(async (runId: string) => {
-      const { client } = await resolveContext(globals(), context);
-      const result = await cancelPipelineRun(client, { runId });
-      context.io.stdout(result.output);
-    });
-  pipeline
-    .command("results")
-    .argument("<runId>", "run to read")
-    .option("--limit <n>", "how many items to scan", positiveInteger)
-    .option("--failed", "only report failed items", false)
-    .description("report a run's items")
-    .action(async (runId: string, options: { limit?: number; failed: boolean }) => {
-      const { client } = await resolveContext(globals(), context);
-      const result = await pipelineRunResults(client, {
-        runId,
-        failedOnly: options.failed,
-        ...(options.limit === undefined ? {} : { limit: options.limit }),
-      });
-      context.io.stdout(result.output);
-      exitCode.value = exitCodeForOutcome(result.outcome);
-    });
-
-  program
-    .command("status")
-    .description("report project health: live counts and pending source changes")
-    .action(async () => {
-      const { sourceRoot, client, projectId } = await resolveContext(globals(), context);
-      assert(projectId, MISSING_PROJECT_ID_MESSAGE);
-      const result = await projectStatus(client, { sourceRoot, projectId });
-      context.io.stdout(result.output);
-    });
-  program
-    .command("report")
-    .argument("<markdownPath>", "path to a UTF-8 Markdown report")
-    .option("--authored-by <who>", "human or agent", authoredByOption, "human")
-    .option("--confirm", "confirm submission in a non-interactive environment", false)
-    .description("preview and send an issue report to Toloka through PostHog")
-    .action(
-      async (
-        markdownPath: string,
-        options: { authoredBy: IssueReportAuthor; confirm: boolean },
-      ) => {
-        assert(context.analytics, "Issue reporting requires CLI analytics.");
-        const sourceRoot = resolveInitRoot(globals());
-        const baseUrl =
-          globals().baseUrl ??
-          context.environment.POTATO_BASE_URL ??
-          resolveInternalBaseUrl(context.environment) ??
-          PRODUCTION_BASE_URL;
-        exitCode.value = await submitIssueReport({
-          path: markdownPath,
-          authoredBy: options.authoredBy,
-          platform: new URL(baseUrl).origin,
-          confirm: options.confirm,
-          sourceRoot,
-          cwd: process.cwd(),
-          analytics: context.analytics,
-          io: context.io,
-        });
-      },
-    );
-
-  const skill = program
-    .command("skill")
-    .description("discover bundled agent skills and install them into .agents/skills");
-  skill
-    .command("list")
-    .option("--json", "print Skill Descriptors with their status as JSON", false)
-    .description("list bundled skills as not-installed, current, or stale")
-    .action(async (options: { json: boolean }) => {
-      const sourceRoot = await resolveSourceRoot(globals(), context.io);
-      await skillListCommand({ sourceRoot, json: options.json, io: context.io });
-    });
-  skill
-    .command("search")
-    .argument("<query>", "text matched case-insensitively against id, name, description, and tags")
-    .option("--json", "print matching Skill Descriptors with their status as JSON", false)
-    .description("find bundled skills for a task")
-    .action(async (query: string, options: { json: boolean }) => {
-      const sourceRoot = await resolveSourceRoot(globals(), context.io);
-      await skillSearchCommand({ sourceRoot, query, json: options.json, io: context.io });
-    });
-  skill
-    .command("install")
-    .argument("<skillId>", "skill id from toloka skill list")
-    .option("-f, --force", "replace an existing .agents/skills/<skillId> directory", false)
-    .description("copy one bundled skill into .agents/skills/<skillId>")
-    .action(async (skillId: string, options: { force: boolean }) => {
-      const sourceRoot = await resolveSourceRoot(globals(), context.io);
-      await skillInstallCommand({ sourceRoot, skillId, force: options.force, io: context.io });
-    });
+  registerVersionCommand(program, host);
+  registerConfigCommands(program, host);
+  registerAuthCommands(program, host);
+  registerProjectCommands(program, host);
+  if (context.internalUser === true) registerDeliveryOrderCommands(program, host);
+  registerSourceCommands(program, host);
+  registerSecretCommands(program, host);
+  registerModelCommands(program, host);
+  registerTrainingCommands(program, host);
+  registerDatasetCommands(program, host);
+  registerPipelineCommands(program, host);
+  registerStatusCommand(program, host);
+  registerReportCommand(program, host);
+  registerSkillCommands(program, host);
 
   return { program, exitCode };
 }
 
-const readStandardInput = async (): Promise<string> => {
-  process.stdin.setEncoding("utf8");
-  const chunks: string[] = [];
-  for await (const chunk of process.stdin) chunks.push(String(chunk));
-  return chunks.join("");
-};
-
-const readMaskedLine = async (question: string): Promise<string> => {
-  process.stdout.write(question);
-  const wasRaw = process.stdin.isRaw;
-  process.stdin.setRawMode(true);
-  process.stdin.resume();
-  process.stdin.setEncoding("utf8");
-
-  const { promise, resolve, reject } = Promise.withResolvers<string>();
-  let value = "";
-
-  const restore = () => {
-    process.stdin.off("data", onData);
-    process.stdin.off("end", onEnd);
-    process.stdin.off("error", onError);
-    process.stdin.setRawMode(wasRaw);
-    process.stdin.pause();
-  };
-
-  const finish = () => {
-    restore();
-    process.stdout.write("\n");
-  };
-
-  const onEnd = () => {
-    finish();
-    reject(new Error("Standard input closed before an API key was entered."));
-  };
-
-  const onError = (error: Error) => {
-    finish();
-    reject(error);
-  };
-
-  const onData = (chunk: string) => {
-    for (const character of chunk) {
-      if (character === "\r" || character === "\n") {
-        finish();
-        resolve(value);
-        return;
-      }
-      if (character === "\u0003" || character === "\u0004") {
-        finish();
-        reject(
-          new Error(
-            character === "\u0003"
-              ? "Canceled."
-              : "Standard input closed before an API key was entered.",
-          ),
-        );
-        return;
-      }
-      if (character === "\u007f" || character === "\b") {
-        if (value.length > 0) {
-          value = value.slice(0, -1);
-          process.stdout.write("\b \b");
-        }
-        continue;
-      }
-      value += character;
-      process.stdout.write("*");
-    }
-  };
-
-  process.stdin.on("data", onData);
-  process.stdin.once("end", onEnd);
-  process.stdin.once("error", onError);
-
-  try {
-    return await promise;
-  } finally {
-    restore();
-  }
+type CommandResult = {
+  readonly code: number;
+  readonly outcome: CliAnalyticsCommandOutcome;
+  readonly error?: unknown;
 };
 
-const promptFromTerminal: AuthPrompt = async (question, options = {}) => {
-  if (options.mask === true) return readMaskedLine(question);
-
-  const input = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
-  try {
-    return await input.question(question);
-  } finally {
-    input.close();
+const firstOperand = (program: Command, argv: readonly string[]): string | undefined => {
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (token === undefined) return undefined;
+    if (token === "--") return argv[index + 1];
+    if (!token.startsWith("-")) return token;
+    const option = program.options.find(
+      (candidate) => candidate.short === token || candidate.long === token,
+    );
+    if (option !== undefined && (option.required || option.optional) && !token.includes("="))
+      index += 1;
   }
+  return undefined;
 };
 
-export const terminalIo = (): CliIo => ({
-  stdout: (text) => console.log(text),
-  stderr: (text) => console.error(text),
-  readStdin: readStandardInput,
-  ...(process.stdin.isTTY ? { prompt: promptFromTerminal, select: pickPipeline } : {}),
-});
-
-type CommandResult = {
-  readonly code: number;
-  readonly outcome: CliAnalyticsCommandOutcome;
-  readonly error?: unknown;
+const unknownCommand = (program: Command, argv: readonly string[]): string | undefined => {
+  const name = firstOperand(program, argv);
+  if (name === undefined || name === "help") return undefined;
+  const known = program.commands.some(
+    (command) => command.name() === name || command.aliases().includes(name),
+  );
+  return known ? undefined : name;
 };
 
 const runProgram = async (
@@ -1402,6 +187,13 @@ const runProgram = async (
   argv: readonly string[],
   io: CliIo,
 ): Promise<CommandResult> => {
+  const unknown = unknownCommand(program, argv);
+  if (unknown !== undefined) {
+    io.stderr(
+      `error: unknown command '${unknown}'\ntoloka ${SDK_VERSION} does not have it. Run toloka --help to list its commands; a runbook that uses it may need a newer release.`,
+    );
+    return { code: 1, outcome: "usage_error" };
+  }
   try {
     await program.parseAsync([...argv], { from: "user" });
     const code = exitCode.value;
@@ -1416,15 +208,42 @@ const runProgram = async (
   }
 };
 
+const finalizeAnalytics = async ({
+  analytics,
+  argv,
+  startedAt,
+  result,
+}: {
+  analytics: CliAnalytics | undefined;
+  argv: readonly string[];
+  startedAt: number;
+  result: CommandResult;
+}): Promise<void> => {
+  if (analytics === undefined) return;
+
+  try {
+    analytics.captureCommand({
+      command: commandNameFromArgv(argv),
+      durationMs: Date.now() - startedAt,
+      exitCode: result.code,
+      outcome: result.outcome,
+      ...(result.error === undefined ? {} : { error: result.error }),
+    });
+    await analytics.shutdown();
+  } catch {}
+};
+
 export async function runTolokaCli(
   argv: readonly string[],
-  environment: TolokaEnvironment = process.env,
+  rawEnvironment: TolokaEnvironment = process.env,
   io: CliIo = terminalIo(),
   injectedClient?: PotatoClient,
   analytics?: CliAnalytics,
   runChecks?: typeof checkProject,
   autoUpdate?: AutoUpdateHooks,
 ): Promise<number> {
+  const { environment, warnings } = normalizeEnvironment(rawEnvironment);
+  for (const warning of warnings) io.stderr(warning);
   const autoUpdateResult = await maybeAutoUpdate({
     argv,
     environment,
@@ -1437,28 +256,33 @@ export async function runTolokaCli(
     environment[CHECK_RESULT_FILE_ENV] === undefined
       ? (analytics ?? createCliAnalytics({ environment }))
       : undefined;
-  const { program, exitCode } = createProgram({
+  const baseContext: ProgramContext = {
     environment,
     io,
     ...(activeAnalytics === undefined ? {} : { analytics: activeAnalytics }),
     ...(injectedClient === undefined ? {} : { injectedClient }),
     ...(runChecks === undefined ? {} : { runChecks }),
+  };
+  const internalUser = await resolveInternalCommandAccess(argv, environment, injectedClient);
+  const { program, exitCode } = createProgram({
+    ...baseContext,
+    ...(internalUser === undefined ? {} : { internalUser }),
   });
-
   const startedAt = Date.now();
-  const result = await runProgram(program, exitCode, argv, io);
-  if (activeAnalytics !== undefined) {
-    try {
-      activeAnalytics.captureCommand({
-        command: commandNameFromArgv(argv),
-        durationMs: Date.now() - startedAt,
-        exitCode: result.code,
-        outcome: result.outcome,
-        ...(result.error === undefined ? {} : { error: result.error }),
-      });
-      await activeAnalytics.shutdown();
-    } catch {}
-  }
 
-  return result.code;
+  try {
+    const result = await runProgram(program, exitCode, argv, io);
+    await finalizeAnalytics({ analytics: activeAnalytics, argv, startedAt, result });
+
+    return result.code;
+  } catch (error) {
+    await finalizeAnalytics({
+      analytics: activeAnalytics,
+      argv,
+      startedAt,
+      result: { code: 1, outcome: "failed", error },
+    });
+
+    throw error;
+  }
 }