@trydreamstate/cli 1.1.1 → 1.2.1

package/dist/index.js

@@ -4,6 +4,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CliUsageError = exports.CLI_EXIT = void 0;
 exports.parseCliArgs = parseCliArgs;
 exports.toolTurnToken = toolTurnToken;
+exports.omitsToolTurnForInlineTableRead = omitsToolTurnForInlineTableRead;
+exports.capabilityIdempotencyKey = capabilityIdempotencyKey;
 exports.refusalEnvelope = refusalEnvelope;
 exports.openWebUrl = openWebUrl;
 exports.exitCodeForError = exitCodeForError;
@@ -17,6 +19,7 @@ const node_os_1 = require("node:os");
 const node_util_1 = require("node:util");
 const config_1 = require("./config");
 const turnCache_1 = require("./turnCache");
+const runWait_1 = require("./runWait");
 const client_1 = require("./client");
 const skillInstaller_1 = require("./skillInstaller");
 exports.CLI_EXIT = { SUCCESS: 0, UNCLASSIFIED: 1, USAGE: 2, AUTH: 3, NOT_FOUND: 4, SERVER: 5, RATE_LIMITED: 6, APPROVAL: 7, TIMEOUT: 8, REFUSED: 9, TRANSPORT: 10 };
@@ -26,26 +29,28 @@ const USAGE = `Dreamstate CLI
 Usage:
   dreamstate --help
   dreamstate --version
-  dreamstate login
-  dreamstate login --token <ds_user_...|ds_live_...>
+  dreamstate login [--no-skills]
+  dreamstate login [--profile <name>] --token <ds_user_...|ds_live_...> [--no-skills]
   dreamstate logout
+  dreamstate status [--json-output|--json]
+  dreamstate profiles <list|use|current|remove|env> [name] [--json-output|--json]
   dreamstate whoami [--json-output|--json]
   dreamstate workspaces list [--json-output|--json]
   dreamstate workspaces use <id|slug>
-  dreamstate auth login [--api-key-file <path>]
+  dreamstate auth login [--api-key-file <path>] [--no-skills]
   dreamstate auth whoami [--json-output|--json]
   dreamstate packs list [--json-output|--json]
   dreamstate packs get <pack_id> [--json-output|--json]
   dreamstate packs route --goal <text> [--json-output|--json]
   dreamstate skills list [--query <query>] [--limit <n>] [--json-output|--json]
-  dreamstate skills get <skill_id> [--json-output|--json]
+  dreamstate skills get <skill_id> [--file <path>] [--json-output|--json]
   dreamstate skills search <query> [--limit <n>] [--json-output|--json]
   dreamstate skills install [--skill <skill_id|*>] [--agents <codex claude-code cursor>] [--project] [--copy] [--json-output|--json]
   dreamstate skills doctor [--agents <codex claude-code cursor>] [--project] [--json-output|--json]
   dreamstate commands search <term> [--json-output|--json]
   dreamstate tools search --goal <goal> [--terms <csv>] [--limit <n>] [--toolset <pack_id>] [--json-output|--json]
   dreamstate tools get <capability_id> [--json-output|--json]
-  dreamstate tools run <capability_id> [--params <object>|--json <body>] [--turn-token <token>] (--live | --dry-run | --mode <smoke_test|dry_run|live>) [--agent-session-id <uuid>] [--approved] [--approved-effect-unknown] [--max-credits <n>] [--idempotency-key <key>] [--open] [--json-output|--json]
+  dreamstate tools run <capability_id> [--params <object>|--json <body>] [--turn-token <token>] (--live | --dry-run | --mode <smoke_test|dry_run|live>) [--agent-session-id <uuid>] [--approved] [--approved-effect-unknown] [--max-credits <n>] [--idempotency-key <key>] [--wait-timeout <seconds>] [--no-wait] [--open] [--json-output|--json]
   dreamstate sequences <verb> [args] [flags]
   dreamstate workflows <verb> [args] [flags]
   dreamstate tables import --table-id <uuid> --file <path> [--format <csv|json|jsonl|xlsx>] [--preview] [--upsert-key <header>] [--background] [--json-output|--json]
@@ -53,10 +58,11 @@ Usage:
   dreamstate runs get <run_id> [--json-output|--json]
   dreamstate runs resume <run_id> --state-version <n> [--reason <text>] [--idempotency-key <key>] [--open] [--json-output|--json]
   dreamstate runs events <run_id> [--json-output|--json]
-  dreamstate runs cancel <run_id> --json <body> [--idempotency-key <key>] [--json-output|--json]
+  dreamstate runs cancel <run_id> [--state-version <n>] [--reason <text>] [--json <body>] [--idempotency-key <key>] [--json-output|--json]
 
 All catalog discovery reads live API records. Set DREAMSTATE_API_URL and DREAMSTATE_API_KEY.
-login opens browser approval; login --token stores a ds_user_ session or ds_live_ key (for SSH or remote machines) after verifying it with whoami.
+Run responses wait for terminal run status by default, timeout default is 120 seconds, --no-wait returns immediate response. Timeout prints latest run envelope and exits ${runWait_1.RUN_WAIT_TIMEOUT_EXIT_CODE}.
+login opens browser approval and installs Dreamstate skills for detected agents; --no-skills skips installation. login --token stores a ds_user_ session or ds_live_ key (for SSH or remote machines) after verifying it with whoami.
 Global flag --workspace <id|slug> (any command) or DREAMSTATE_WORKSPACE picks the workspace for one call; workspaces use stores a default. Flag beats env beats stored. A ds_live_ key is bound to one workspace and cannot switch.
 logout deletes the stored credentials file. --agents takes space-separated, comma-separated or repeated values.
 `;
@@ -106,6 +112,22 @@ function nonNegativeInteger(raw, flag) {
         throw new CliUsageError(`${flag} must be a non-negative integer`);
     return value;
 }
+// runs.get returns { data: { run: { state_version } } }. Cancel posts
+// expected_state_version, and a missing read must not invent 0.
+function stateVersionFromRunRead(payload) {
+    const record = payload && typeof payload === 'object' && !Array.isArray(payload) ? payload : null;
+    const data = record && record.data && typeof record.data === 'object' && !Array.isArray(record.data)
+        ? record.data
+        : null;
+    const run = data && data.run && typeof data.run === 'object' && !Array.isArray(data.run)
+        ? data.run
+        : null;
+    const version = run?.state_version;
+    if (typeof version !== 'number' || !Number.isSafeInteger(version) || version < 0) {
+        throw new client_1.CliError('runs cancel could not read state_version from the run. Pass --state-version <n>.', 'invalid_response', 0);
+    }
+    return version;
+}
 function parsePacks(argv) {
     const { values, positionals } = (0, node_util_1.parseArgs)({ args: argv, options: { goal: { type: 'string' }, 'json-output': { type: 'boolean' }, help: { type: 'boolean', short: 'h' } }, allowPositionals: true, strict: true });
     if (values.help)
@@ -138,7 +160,7 @@ function spaceSeparatedAgents(argv) {
     return out;
 }
 function parseSkills(argv) {
-    const { values, positionals } = (0, node_util_1.parseArgs)({ args: spaceSeparatedAgents(argv), options: { query: { type: 'string' }, limit: { type: 'string' }, skill: { type: 'string' }, agents: { type: 'string', multiple: true }, project: { type: 'boolean' }, copy: { type: 'boolean' }, 'json-output': { type: 'boolean' }, help: { type: 'boolean', short: 'h' } }, allowPositionals: true, strict: true });
+    const { values, positionals } = (0, node_util_1.parseArgs)({ args: spaceSeparatedAgents(argv), options: { query: { type: 'string' }, limit: { type: 'string' }, skill: { type: 'string' }, file: { type: 'string' }, agents: { type: 'string', multiple: true }, project: { type: 'boolean' }, copy: { type: 'boolean' }, 'json-output': { type: 'boolean' }, help: { type: 'boolean', short: 'h' } }, allowPositionals: true, strict: true });
     if (values.help)
         return { command: 'help' };
     const agents = () => {
@@ -159,7 +181,7 @@ function parseSkills(argv) {
         return { command: 'skills_list', query, ...outputOption(values) };
     }
     if (positionals[0] === 'get')
-        return { command: 'skills_get', skillId: requireOne(positionals, 'dreamstate skills get <skill_id>'), ...outputOption(values) };
+        return { command: 'skills_get', skillId: requireOne(positionals, 'dreamstate skills get <skill_id>'), ...(values.file?.trim() ? { file: values.file.trim() } : {}), ...outputOption(values) };
     if (positionals[0] === 'search' && positionals.length > 1) {
         const query = { query: positionals.slice(1).join(' ') };
         if (values.limit !== undefined)
@@ -215,7 +237,7 @@ function parseTools(argv) {
             'idempotency-key': { type: 'string' }, 'json-output': { type: 'boolean' }, open: { type: 'boolean' },
             'dry-run': { type: 'boolean' }, live: { type: 'boolean' }, mode: { type: 'string' },
             'agent-session-id': { type: 'string' }, approved: { type: 'boolean' }, 'approved-effect-unknown': { type: 'boolean' },
-            'max-credits': { type: 'string' }, 'turn-token': { type: 'string' }, help: { type: 'boolean', short: 'h' },
+            'max-credits': { type: 'string' }, 'turn-token': { type: 'string' }, 'wait-timeout': { type: 'string' }, 'no-wait': { type: 'boolean' }, help: { type: 'boolean', short: 'h' },
         }, allowPositionals: true, strict: true });
     if (values.help)
         return { command: 'help' };
@@ -242,9 +264,14 @@ function parseTools(argv) {
             throw new CliUsageError('Use either --params for tool parameters or --json for the complete request, not both.');
         if (!values.json && !values.params)
             throw new CliUsageError('tools run requires --params <object> or --json <body>; fetch live schema first with tools get');
-        const body = values.json ? parseJsonObject(values.json) : {};
+        const json = values.json ? parseJsonObject(values.json) : undefined;
+        const body = json && ('params' in json || 'mode' in json || 'agent_session_id' in json || 'approved_effect_unknown' in json || 'max_credits' in json)
+            ? json
+            : {};
         if (values.params)
             body.params = parseJsonObject(values.params, '--params');
+        else if (json && body !== json)
+            body.params = json;
         // The server never defaults a mode, so a mutating run with none is refused
         // mode_required; --live and --mode exist so a caller can actually ask for one.
         // `approved` is no longer sent: the run body schema is strict and has no such
@@ -263,7 +290,8 @@ function parseTools(argv) {
         // run without one. What was missing was any way to ASK for live.
         if (body.mode !== undefined)
             requireToolsRunMode(body);
-        return { command: 'tools_run', capabilityId, body, ...(values['turn-token'] ? { turnToken: values['turn-token'] } : {}), ...(values['idempotency-key'] ? { idempotencyKey: values['idempotency-key'] } : {}), ...(values.open ? { open: true } : {}), ...output };
+        const waitTimeout = values['wait-timeout'] === undefined ? 120 : nonNegativeNumber(values['wait-timeout'], '--wait-timeout');
+        return { command: 'tools_run', capabilityId, body, waitTimeout, ...(values['no-wait'] ? { noWait: true } : {}), ...(values['turn-token'] ? { turnToken: values['turn-token'] } : {}), ...(values['idempotency-key'] ? { idempotencyKey: values['idempotency-key'] } : {}), ...(values.open ? { open: true } : {}), ...output };
     }
     throw new CliUsageError('Usage: dreamstate tools <search|get|run>');
 }
@@ -318,9 +346,20 @@ function parseRuns(argv) {
         return { command: 'runs_resume', runId, stateVersion: nonNegativeInteger(values['state-version'], '--state-version'), ...(values.reason ? { reason: values.reason } : {}), ...(values['idempotency-key'] ? { idempotencyKey: values['idempotency-key'] } : {}), ...(values.open ? { open: true } : {}), ...output };
     }
     if (positionals[0] === 'cancel') {
-        if (!values.json)
-            throw new CliUsageError('runs cancel requires --json <body>');
-        return { command: 'runs_cancel', runId, body: parseJsonObject(values.json), ...(values['idempotency-key'] ? { idempotencyKey: values['idempotency-key'] } : {}), ...output };
+        const idempotency = values['idempotency-key'] ? { idempotencyKey: values['idempotency-key'] } : {};
+        if (values.json && (values['state-version'] !== undefined || values.reason)) {
+            throw new CliUsageError('Use either --json <body> or --state-version and --reason with runs cancel, not both.');
+        }
+        if (values.json)
+            return { command: 'runs_cancel', runId, body: parseJsonObject(values.json), ...idempotency, ...output };
+        return {
+            command: 'runs_cancel',
+            runId,
+            ...(values['state-version'] !== undefined ? { stateVersion: nonNegativeInteger(values['state-version'], '--state-version') } : {}),
+            ...(values.reason ? { reason: values.reason } : {}),
+            ...idempotency,
+            ...output,
+        };
     }
     throw new CliUsageError('Usage: dreamstate runs <get|events|cancel> <run_id>');
 }
@@ -337,14 +376,14 @@ function parseCliArgs(argv) {
         return { command: 'version' };
     const [group, ...rest] = argv;
     if (group === 'login') {
-        const { values, positionals } = (0, node_util_1.parseArgs)({ args: rest, options: { token: { type: 'string' }, 'api-key-file': { type: 'string' }, 'json-output': { type: 'boolean' }, help: { type: 'boolean', short: 'h' } }, allowPositionals: true, strict: true });
+        const { values, positionals } = (0, node_util_1.parseArgs)({ args: rest, options: { token: { type: 'string' }, profile: { type: 'string' }, 'api-key-file': { type: 'string' }, 'no-skills': { type: 'boolean' }, 'json-output': { type: 'boolean' }, help: { type: 'boolean', short: 'h' } }, allowPositionals: true, strict: true });
         if (values.help)
             return { command: 'help' };
         if (positionals.length)
             throw new CliUsageError('Usage: dreamstate login [--token <ds_user_...|ds_live_...>]');
         if (values.token !== undefined && values['api-key-file'])
             throw new CliUsageError('Use either --token or --api-key-file, not both.');
-        return { command: 'login', ...(values.token !== undefined ? { token: values.token } : {}), ...(values['api-key-file'] ? { apiKeyFile: values['api-key-file'] } : {}), ...outputOption(values) };
+        return { command: 'login', ...(values.token !== undefined ? { token: values.token } : {}), ...(values['api-key-file'] ? { apiKeyFile: values['api-key-file'] } : {}), ...(values.profile ? { profile: (0, config_1.validateProfileName)(values.profile) } : {}), ...(values['no-skills'] ? { noSkills: true } : {}), ...outputOption(values) };
     }
     if (group === 'logout') {
         const { values, positionals } = (0, node_util_1.parseArgs)({ args: rest, options: { 'json-output': { type: 'boolean' }, help: { type: 'boolean', short: 'h' } }, allowPositionals: true, strict: true });
@@ -354,6 +393,27 @@ function parseCliArgs(argv) {
             throw new CliUsageError('Usage: dreamstate logout');
         return { command: 'logout', ...outputOption(values) };
     }
+    if (group === 'status') {
+        const { values, positionals } = (0, node_util_1.parseArgs)({ args: rest, options: { 'json-output': { type: 'boolean' } }, allowPositionals: true, strict: true });
+        if (!positionals.length)
+            return { command: 'status', ...outputOption(values) };
+        throw new CliUsageError('Usage: dreamstate status [--json-output]');
+    }
+    if (group === 'profiles') {
+        const { values, positionals } = (0, node_util_1.parseArgs)({ args: rest, options: { 'json-output': { type: 'boolean' } }, allowPositionals: true, strict: true });
+        const output = outputOption(values);
+        if (positionals.length === 1 && positionals[0] === 'list')
+            return { command: 'profiles_list', ...output };
+        if (positionals.length === 1 && positionals[0] === 'current')
+            return { command: 'profiles_current', ...output };
+        if (positionals.length === 2 && positionals[0] === 'use')
+            return { command: 'profiles_use', name: (0, config_1.validateProfileName)(positionals[1]), ...output };
+        if (positionals.length === 2 && positionals[0] === 'remove')
+            return { command: 'profiles_remove', name: (0, config_1.validateProfileName)(positionals[1]), ...output };
+        if (positionals.length === 2 && positionals[0] === 'env')
+            return { command: 'profiles_env', name: (0, config_1.validateProfileName)(positionals[1]), ...output };
+        throw new CliUsageError('Usage: dreamstate profiles <list|use <name>|current|remove <name>|env <name>>');
+    }
     if (group === 'whoami') {
         const { values, positionals } = (0, node_util_1.parseArgs)({ args: rest, options: { 'json-output': { type: 'boolean' } }, allowPositionals: true, strict: true });
         if (positionals.length === 0)
@@ -371,9 +431,9 @@ function parseCliArgs(argv) {
         throw new CliUsageError('Usage: dreamstate workspaces <list|use <id|slug>>');
     }
     if (group === 'auth') {
-        const { values, positionals } = (0, node_util_1.parseArgs)({ args: rest, options: { 'api-key-file': { type: 'string' }, 'json-output': { type: 'boolean' } }, allowPositionals: true, strict: true });
+        const { values, positionals } = (0, node_util_1.parseArgs)({ args: rest, options: { 'api-key-file': { type: 'string' }, 'no-skills': { type: 'boolean' }, 'json-output': { type: 'boolean' } }, allowPositionals: true, strict: true });
         if (positionals.length === 1 && positionals[0] === 'login')
-            return { command: 'login', ...(values['api-key-file'] ? { apiKeyFile: values['api-key-file'] } : {}), ...outputOption(values) };
+            return { command: 'login', ...(values['api-key-file'] ? { apiKeyFile: values['api-key-file'] } : {}), ...(values['no-skills'] ? { noSkills: true } : {}), ...outputOption(values) };
         if (positionals.length === 1 && positionals[0] === 'whoami')
             return { command: 'whoami', ...outputOption(values) };
         throw new CliUsageError('Usage: dreamstate auth <login|whoami>');
@@ -433,6 +493,57 @@ function toolTurnToken(value) {
         return data.tool_turn_token;
     throw new client_1.CliError('tools get did not return a tool_turn_token.', 'invalid_tool_turn_token', 0);
 }
+/**
+ * null suppresses Idempotency-Key. undefined lets runCapability mint one.
+ * A fresh random key never replays, but the server treats any Idempotency-Key
+ * as a replay request and refuses the inline read (isInlineReadEligible).
+ * Omit the key only when the fetched contract says mutates === false and
+ * idempotency_required is not true. Missing flags keep the auto key: a
+ * caller-supplied turn token skips tools get, and live writes still need one.
+ */
+/**
+ * Free sync reads. The server runs these on the inline read path when
+ * the body has no tool_turn_token and the request has no Idempotency-Key
+ * (isInlineReadEligible). A tools get before the run is a second HTTP the
+ * read does not need. Measured 2026-10-04: tables.workbooks.get full live CLI
+ * 0.726s against whoami 0.455s, about 0.27s of tools get per harness read-back.
+ * knowledge.brain.context.get is the same class (catalog: credit_class free,
+ * async_policy.mode sync, mutates not set). Live 2026-10-05 a standalone
+ * tools get of that id was 0.400s including node startup, next to whoami
+ * 0.422s, so the same-process skip is one HTTP, not a second process.
+ * The set name is historical. Writes are not in this set: they stay fetch-first.
+ */
+const INLINE_READ_CAPABILITIES = new Set([
+    'tables.workbooks.get',
+    'tables.workbooks.overview',
+    'tables.workbooks.list',
+    'tables.columns.list',
+    'tables.columns.stats',
+    'tables.rows.query',
+    'tables.rows.get',
+    'tables.rows.count',
+    'knowledge.brain.context.get',
+    // Both are stored, free, synchronous inbox reads. Keeping either behind a
+    // tools_get turns one list or thread open into two HTTP requests, while the
+    // canonical inline-read gate already validates their read-only contract.
+    'unibox.inbox.unified_list',
+    'unibox.inbox.conversation_get',
+]);
+function omitsToolTurnForInlineTableRead(capabilityId) {
+    return INLINE_READ_CAPABILITIES.has(capabilityId);
+}
+function capabilityIdempotencyKey(fetched) {
+    const root = fetched && typeof fetched === 'object' ? fetched : {};
+    const data = root.data && typeof root.data === 'object' && !Array.isArray(root.data)
+        ? root.data
+        : {};
+    const capability = data.capability && typeof data.capability === 'object' && !Array.isArray(data.capability)
+        ? data.capability
+        : {};
+    if (capability.mutates === false && capability.idempotency_required !== true)
+        return null;
+    return undefined;
+}
 function code(error) {
     return error && typeof error === 'object' && typeof error.code === 'string'
         ? error.code
@@ -612,14 +723,94 @@ function whoamiData(value) {
     const data = value && typeof value === 'object' ? value.data : undefined;
     return data && typeof data === 'object' ? data : {};
 }
+function statusData(whoami, health) {
+    const meta = whoami && typeof whoami === 'object' ? whoami.meta : null;
+    const serverVersion = meta && typeof meta === 'object' ? meta.server_version : null;
+    const minimumCliVersion = meta && typeof meta === 'object' ? meta.minimum_cli_version : null;
+    const healthData = health && typeof health === 'object' ? health.data : null;
+    const healthVersion = healthData && typeof healthData === 'object' ? healthData.version : null;
+    const version = typeof serverVersion === 'string' ? serverVersion : typeof healthVersion === 'string' ? healthVersion : null;
+    const minimum = typeof minimumCliVersion === 'string' ? minimumCliVersion : null;
+    const parts = (value) => value.replace(/^v/, '').split('-')[0].split('.').map((part) => Number(part));
+    const [minimumMajor = 0, minimumMinor = 0, minimumPatch = 0] = minimum ? parts(minimum) : [];
+    const [cliMajor = 0, cliMinor = 0, cliPatch = 0] = parts(client_1.CLI_VERSION);
+    const compatible = !minimum || minimumMajor < cliMajor || (minimumMajor === cliMajor && (minimumMinor < cliMinor || (minimumMinor === cliMinor && minimumPatch <= cliPatch)));
+    return {
+        cli_version: client_1.CLI_VERSION,
+        api_version: version,
+        minimum_cli_version: minimum,
+        minimum_cli_version_published: minimum !== null,
+        compatible,
+        upgrade_hint: compatible ? null : 'Run: npm install -g @trydreamstate/cli@latest',
+        health,
+        whoami: whoamiData(whoami),
+    };
+}
 function activeWorkspace(data) {
-    const activeId = data.workspace_id ?? data.active_workspace_id ?? undefined;
+    const activeId = data.workspace_id;
     return activeId ? data.workspaces?.find((workspace) => workspace.id === activeId) : undefined;
 }
 function wait(milliseconds) {
     return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
-async function loginWithDeviceAuthorization(runtime, stdout, stderr) {
+async function installHostedSkills(client, agents, runtime, options = {}) {
+    const listed = await client.listAllSkills();
+    const entries = listed && typeof listed === 'object' && listed.data?.skills;
+    const ids = Array.isArray(entries) ? entries.map((skill) => skill && typeof skill === 'object' ? skill.id : undefined).filter((id) => typeof id === 'string') : [];
+    if (!ids.length)
+        throw new client_1.CliError('Dreamstate API returned no installable skills.', 'invalid_response', 200);
+    if (ids.some((id) => !/^[a-z0-9][a-z0-9_-]*$/i.test(id)))
+        throw new CliUsageError('Dreamstate API returned an invalid skill id.');
+    const skills = [];
+    for (const id of ids) {
+        const skill = hostedSkill(await client.getSkill(id));
+        if (!/^[a-z0-9][a-z0-9_-]*$/i.test(skill.id))
+            throw new CliUsageError('Dreamstate API returned an invalid skill id.');
+        if (skill.id !== id)
+            throw new client_1.CliError('Dreamstate API returned a mismatched skill id.', 'invalid_response', 200);
+        skills.push(skill);
+    }
+    const packs = await client.listPacks();
+    const whoami = await client.getWhoami();
+    const workspaceId = typeof whoami?.data?.workspace_id === 'string' ? whoami.data.workspace_id : 'unknown';
+    const indexVersion = (0, node_crypto_1.createHash)('sha256')
+        .update(JSON.stringify(skills.map((skill) => [skill.id, skill.description, skill.body, skill.frontmatter ?? {}])))
+        .digest('hex').slice(0, 16);
+    const installed = await (0, skillInstaller_1.installSkills)([...skills, (0, skillInstaller_1.routerSkill)(packs)], {
+        agents,
+        homeDirectory: runtime.homeDirectory,
+        project: Boolean(options.project),
+        copy: Boolean(options.copy) || process.platform === 'win32',
+        workspaceId,
+        indexVersion,
+    });
+    return { files: installed.files, skillIds: [...ids, 'router'] };
+}
+async function installLoginSkills(client, runtime, skip, stderr) {
+    if (skip)
+        return { skipped: 'disabled' };
+    const agents = await (0, skillInstaller_1.detectInstalledSkillAgents)(runtime.homeDirectory);
+    if (!agents.length) {
+        stderr.write('Run dreamstate skills install to install Dreamstate skills.\n');
+        return { skipped: 'no_agents_detected' };
+    }
+    try {
+        const installed = await installHostedSkills(client, agents, runtime);
+        stderr.write(`Installed Dreamstate skills into: ${agents.join(', ')}.\n`);
+        return { installed: agents, files: installed.files.length };
+    }
+    catch {
+        stderr.write('Run dreamstate skills install to install Dreamstate skills.\n');
+        return { skipped: 'installation_failed' };
+    }
+}
+function loginResult(value, skills) {
+    if (!value || typeof value !== 'object')
+        return value;
+    const envelope = value;
+    return { ...envelope, data: { ...(envelope.data && typeof envelope.data === 'object' ? envelope.data : {}), skills } };
+}
+async function loginWithDeviceAuthorization(runtime, stdout, stderr, profile, noSkills = false, jsonOutput = false) {
     const environment = runtime.env ?? process.env;
     const baseUrl = (0, config_1.resolveApiBaseUrl)(environment);
     const state = runtime.deviceState ?? deviceState();
@@ -632,14 +823,19 @@ async function loginWithDeviceAuthorization(runtime, stdout, stderr) {
     for (;;) {
         const claim = await (0, client_1.claimDeviceAuthorization)(baseUrl, authorization.device_code);
         if (claim.status === 'ready') {
-            await (0, config_1.storeApiKey)(claim.token, runtimeCredentialsPath(runtime), claim.workspace.id);
+            if (profile)
+                await (0, config_1.storeCredentialProfile)(profile, claim.token, runtimeCredentialsPath(runtime), claim.workspace.id);
+            else
+                await (0, config_1.storeApiKey)(claim.token, runtimeCredentialsPath(runtime), claim.workspace.id);
             const client = new client_1.DreamstateClient({
                 baseUrl,
                 apiKey: claim.token,
                 requestTimeoutMs: runtime.requestTimeoutMs,
                 onVersionWarning: (message) => (runtime.stderr ?? process.stderr).write(`${message}\n`),
             });
-            print(await client.getWhoami(), stdout, false);
+            const whoami = await client.getWhoami();
+            const skills = await installLoginSkills(client, runtime, noSkills, stderr);
+            print(loginResult(whoami, skills), stdout, jsonOutput);
             return;
         }
         await (runtime.sleep ?? wait)(authorization.interval_seconds * 1_000);
@@ -665,8 +861,9 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
     try {
         const extracted = extractWorkspaceFlag(argv);
         const command = parseCliArgs(extracted.argv);
-        if (command.command === 'help') {
-            print({ ok: true, data: { usage: USAGE }, meta: {} }, stdout, false);
+        if (command.command === 'help' || command.command === 'pack_help') {
+            const packHelp = command.command === 'pack_help' ? command : undefined;
+            print({ ok: true, data: { usage: packHelp?.usage ?? USAGE }, meta: {} }, stdout, Boolean(packHelp?.jsonOutput));
             process.exitCode = exports.CLI_EXIT.SUCCESS;
             return;
         }
@@ -694,6 +891,38 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
             process.exitCode = exports.CLI_EXIT.SUCCESS;
             return;
         }
+        if (command.command === 'profiles_list' || command.command === 'profiles_current' || command.command === 'profiles_use' || command.command === 'profiles_remove' || command.command === 'profiles_env') {
+            const path = runtimeCredentialsPath(runtime);
+            const environment = runtime.env ?? process.env;
+            if (command.command === 'profiles_list') {
+                const current = await (0, config_1.currentCredentialProfile)(path, environment);
+                const profiles = await (0, config_1.listCredentialProfiles)(path);
+                print({ ok: true, data: { current_profile: current, profiles: profiles.map(({ name, workspace }) => ({ name, workspace, active: name === current })) }, meta: {} }, stdout, Boolean(command.jsonOutput));
+            }
+            else if (command.command === 'profiles_current') {
+                print({ ok: true, data: { profile: await (0, config_1.currentCredentialProfile)(path, environment) }, meta: {} }, stdout, Boolean(command.jsonOutput));
+            }
+            else if (command.command === 'profiles_use') {
+                await (0, config_1.useCredentialProfile)(command.name, path);
+                print({ ok: true, data: { profile: command.name }, meta: {} }, stdout, Boolean(command.jsonOutput));
+            }
+            else if (command.command === 'profiles_remove') {
+                const removed = await (0, config_1.removeCredentialProfile)(command.name, path);
+                print({ ok: true, data: { profile: command.name, removed }, meta: {} }, stdout, Boolean(command.jsonOutput));
+            }
+            else {
+                const profiles = await (0, config_1.listCredentialProfiles)(path);
+                if (!profiles.some((profile) => profile.name === command.name))
+                    throw new CliUsageError(`Profile not found: ${command.name}.`);
+                const result = { ok: true, data: { profile: command.name, exports: [`DREAMSTATE_PROFILE=${command.name}`] }, meta: {} };
+                if (command.jsonOutput)
+                    print(result, stdout, true);
+                else
+                    stdout.write(`export DREAMSTATE_PROFILE=${command.name}\n`);
+            }
+            process.exitCode = exports.CLI_EXIT.SUCCESS;
+            return;
+        }
         if (command.command === 'login' && command.token !== undefined) {
             const token = command.token.trim();
             if (!(0, config_1.isDreamstateToken)(token))
@@ -710,8 +939,23 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
                 onVersionWarning: (message) => stderr.write(`${message}\n`),
             });
             const whoami = await client.getWhoami();
-            await (0, config_1.storeApiKey)(token, runtimeCredentialsPath(runtime));
-            print(whoami, stdout, Boolean(command.jsonOutput));
+            if (command.profile)
+                await (0, config_1.storeCredentialProfile)(command.profile, token, runtimeCredentialsPath(runtime));
+            else
+                await (0, config_1.storeApiKey)(token, runtimeCredentialsPath(runtime));
+            const skills = await installLoginSkills(client, runtime, Boolean(command.noSkills), stderr);
+            print(loginResult(whoami, skills), stdout, Boolean(command.jsonOutput));
+            process.exitCode = exports.CLI_EXIT.SUCCESS;
+            return;
+        }
+        if (command.command === 'status') {
+            const environment = runtime.env ?? process.env;
+            const credentialFilePath = runtimeCredentialsPath(runtime);
+            const apiKey = await (0, config_1.resolveApiKey)(environment, credentialFilePath);
+            const workspace = await (0, config_1.resolveWorkspace)(extracted.workspace, environment, credentialFilePath);
+            const client = new client_1.DreamstateClient({ baseUrl: (0, config_1.resolveApiBaseUrl)(environment), apiKey, ...(workspace ? { workspace } : {}), requestTimeoutMs: runtime.requestTimeoutMs });
+            const [whoami, health] = await Promise.all([client.getStatusWhoami(), client.getHealth()]);
+            print({ ok: true, data: statusData(whoami, health), meta: {} }, stdout, Boolean(command.jsonOutput));
             process.exitCode = exports.CLI_EXIT.SUCCESS;
             return;
         }
@@ -720,14 +964,16 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
                 const key = await readLoginKey(command, runtime);
                 if (!(0, config_1.isDreamstateToken)(key))
                     throw new CliUsageError('Dreamstate API keys must start with ds_user_ or ds_live_.');
-                const path = await (0, config_1.storeApiKey)(key, runtimeCredentialsPath(runtime));
-                print({ ok: true, data: { credentials_path: path }, meta: {} }, stdout, Boolean(command.jsonOutput));
-                stderr.write('Run dreamstate skills install to install Dreamstate skills.\n');
+                const path = command.profile
+                    ? await (0, config_1.storeCredentialProfile)(command.profile, key, runtimeCredentialsPath(runtime))
+                    : await (0, config_1.storeApiKey)(key, runtimeCredentialsPath(runtime));
+                const client = new client_1.DreamstateClient({ baseUrl: (0, config_1.resolveApiBaseUrl)(runtime.env ?? process.env), apiKey: key, requestTimeoutMs: runtime.requestTimeoutMs, onVersionWarning: (message) => stderr.write(`${message}\n`) });
+                const skills = await installLoginSkills(client, runtime, Boolean(command.noSkills), stderr);
+                print({ ok: true, data: { credentials_path: path, skills }, meta: {} }, stdout, Boolean(command.jsonOutput));
                 process.exitCode = exports.CLI_EXIT.SUCCESS;
                 return;
             }
-            await loginWithDeviceAuthorization(runtime, stdout, stderr);
-            stderr.write('Run dreamstate skills install to install Dreamstate skills.\n');
+            await loginWithDeviceAuthorization(runtime, stdout, stderr, command.profile, Boolean(command.noSkills), Boolean(command.jsonOutput));
             process.exitCode = exports.CLI_EXIT.SUCCESS;
             return;
         }
@@ -819,7 +1065,7 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
                 result = await client.getWhoami();
                 if (!command.jsonOutput) {
                     const data = whoamiData(result);
-                    const activeId = data.workspace_id ?? data.active_workspace_id ?? null;
+                    const activeId = data.workspace_id ?? null;
                     const rows = data.workspaces ?? [];
                     stdout.write(rows.length
                         ? `${rows.map((row) => `${row.id === activeId ? '*' : ' '} ${row.slug ?? '-'}  ${row.name}  ${row.role ?? '-'}  ${row.id}`).join('\n')}\n`
@@ -836,10 +1082,10 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
                 const match = data.workspaces?.find((row) => row.id.toLowerCase() === wanted || row.slug?.toLowerCase() === wanted);
                 if (!match)
                     throw new CliUsageError(`You are not a member of workspace "${command.workspace}". Run dreamstate workspaces list to see the workspaces you can use.`);
-                const stored = await (0, config_1.readStoredCredentials)(credentialFilePath);
+                const stored = await (0, config_1.readStoredCredentials)(await (0, config_1.selectedCredentialsPath)(credentialFilePath, environment));
                 if (!stored)
                     throw new CliUsageError('workspaces use saves the default next to a stored login. Run dreamstate login or dreamstate login --token first.');
-                await (0, config_1.storeApiKey)(stored.token, credentialFilePath, match.id);
+                await (0, config_1.storeApiKey)(stored.token, await (0, config_1.selectedCredentialsPath)(credentialFilePath, environment), match.id);
                 stderr.write(`Default workspace: ${match.name} (${match.slug})\n`);
                 result = { ok: true, data: { workspace: { id: match.id, name: match.name, slug: match.slug }, credentials_path: credentialFilePath }, meta: {} };
                 break;
@@ -857,24 +1103,23 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
                 result = await client.listSkills(command.query);
                 break;
             case 'skills_get':
-                result = await client.getSkill(command.skillId);
+                result = await client.getSkill(command.skillId, command.file ? { file: command.file } : {});
                 break;
             case 'skills_search':
                 result = await client.searchSkillDocuments(command.query);
                 break;
             case 'skills_install': {
-                const listed = command.skillId === '*' ? await client.listAllSkills() : null;
-                const entries = listed && typeof listed === 'object' && listed.data?.skills;
-                const ids = command.skillId === '*'
-                    ? Array.isArray(entries) ? entries.map((skill) => skill && typeof skill === 'object' ? skill.id : undefined).filter((id) => typeof id === 'string') : []
-                    : [command.skillId];
-                if (!ids.length)
-                    throw new client_1.CliError('Dreamstate API returned no installable skills.', 'invalid_response', 200);
+                if (command.skillId === '*') {
+                    const installed = await installHostedSkills(client, command.agents, runtime, { project: command.project, copy: command.copy });
+                    result = { ok: true, data: { installed_files: installed.files, skill_ids: installed.skillIds, agents: command.agents, ...(command.project ? { lock_file: 'skills-lock.json' } : {}) }, meta: {} };
+                    break;
+                }
+                const ids = [command.skillId];
                 // A remote id becomes a directory name; refuse traversal before any request or write.
                 if (ids.some((id) => !/^[a-z0-9][a-z0-9_-]*$/i.test(id)))
                     throw new CliUsageError('Dreamstate API returned an invalid skill id.');
-                // One at a time: each read comes from the workspace's private vault,
-                // which admits two reads at once, and fifteen in parallel failed on prod.
+                // Read each skill one at a time because the workspace's private vault
+                // admits two reads at once, and fifteen parallel reads failed in production.
                 const skills = [];
                 for (const id of ids) {
                     const skill = hostedSkill(await client.getSkill(id));
@@ -908,6 +1153,9 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
             case 'tools_search':
                 result = await client.listTools(command.query);
                 break;
+            // Exact GET mints its own turn server-side. No prior search is required:
+            // search ranking can omit a valid exact capability, which made standalone
+            // CLI contract reads fail despite the capability being runnable.
             case 'tools_get':
                 result = await client.getTool(command.capabilityId);
                 break;
@@ -929,31 +1177,67 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
                 const pending = command.turnToken
                     ? null
                     : await (0, turnCache_1.reusableTurnToken)(turns, baseUrl, turnKey, command.capabilityId, Date.now(), warnTurnCache);
-                const turnToken = command.turnToken ?? pending ?? toolTurnToken(await client.getTool(command.capabilityId));
+                const inlineRead = !command.turnToken && !pending && !command.idempotencyKey && omitsToolTurnForInlineTableRead(command.capabilityId);
+                const fetchedForRun = command.turnToken || pending || inlineRead ? null : await client.getTool(command.capabilityId);
+                let turnToken = command.turnToken ?? pending ?? (inlineRead ? undefined : toolTurnToken(fetchedForRun));
+                let idempotencyKey = command.idempotencyKey ?? (inlineRead ? null : (fetchedForRun ? capabilityIdempotencyKey(fetchedForRun) : undefined));
+                let recoveredInlineRead = false;
+                const run = () => client.runCapability(command.capabilityId, {
+                    ...command.body,
+                    ...(turnToken ? { tool_turn_token: turnToken } : {}),
+                }, idempotencyKey);
                 try {
-                    result = await client.runCapability(command.capabilityId, { ...command.body, tool_turn_token: turnToken }, command.idempotencyKey);
+                    try {
+                        result = await run();
+                    }
+                    catch (error) {
+                        // The inline skip is only valid while the server still treats this
+                        // capability as a free sync read. capability_not_fetched means the
+                        // fetch-first fence is on, so retry once on the old get-then-run path.
+                        if (inlineRead && !recoveredInlineRead && code(error) === 'capability_not_fetched') {
+                            recoveredInlineRead = true;
+                            const fetched = await client.getTool(command.capabilityId);
+                            turnToken = toolTurnToken(fetched);
+                            idempotencyKey = command.idempotencyKey ?? capabilityIdempotencyKey(fetched);
+                            result = await run();
+                        }
+                        else if (command.body.mode !== 'live' || code(error) !== 'quote_required') {
+                            // A quote_required refusal binds a fresh quote to this turn, so the
+                            // identical call admits on the next try. Retry once here instead of
+                            // making the caller rerun the same command by hand.
+                            throw error;
+                        }
+                        else {
+                            result = await run();
+                        }
+                    }
                 }
                 catch (error) {
-                    if (!command.turnToken && code(error) === 'quote_required') {
+                    if (!command.turnToken && turnToken && code(error) === 'quote_required') {
                         await (0, turnCache_1.rememberTurnToken)(turns, baseUrl, turnKey, command.capabilityId, turnToken, Date.now(), warnTurnCache);
                     }
                     throw error;
                 }
                 if (!command.turnToken) {
-                    if (command.body.mode === 'dry_run')
+                    if (command.body.mode === 'dry_run' && turnToken)
                         await (0, turnCache_1.rememberTurnToken)(turns, baseUrl, turnKey, command.capabilityId, turnToken, Date.now(), warnTurnCache);
                     else if (pending)
                         await (0, turnCache_1.forgetTurnToken)(turns, baseUrl, turnKey, command.capabilityId, warnTurnCache);
                 }
+                if (!command.noWait && !(0, runWait_1.columnRunReturnsRunId)(command.capabilityId)) {
+                    const waited = await (0, runWait_1.waitForRun)(client, result, command.waitTimeout, runtime.sleep ?? wait);
+                    result = waited.value;
+                    if (waited.timedOut)
+                        process.exitCode = runWait_1.RUN_WAIT_TIMEOUT_EXIT_CODE;
+                }
                 break;
             }
             case 'tables_import': {
                 await (0, promises_1.access)(command.file);
-                const discovered = await client.listTools({
-                    goal: 'prepare a local file import into a table',
-                    query_terms: ['local', 'file', 'import'],
-                });
-                const importCapabilityId = discoveredCapabilityId(discovered);
+                // Search ranking is not an import contract. This exact capability owns the
+                // prepare handoff for caller-local files, while nearby upload capabilities
+                // can also match these words and made a real import fail after local work.
+                const importCapabilityId = 'tables.table_sources.csv_import_prepare';
                 result = await client.runCapability(importCapabilityId, {
                     // A mutation run needs the turn token its own get minted; without it
                     // an API-key import was refused after the local file work.
@@ -983,15 +1267,20 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
             case 'runs_events':
                 result = await client.getRunEvents(command.runId);
                 break;
-            case 'runs_cancel':
-                result = await client.cancelRun(command.runId, command.body, command.idempotencyKey);
+            case 'runs_cancel': {
+                const body = command.body ?? {
+                    expected_state_version: command.stateVersion ?? stateVersionFromRunRead(await client.getRun(command.runId)),
+                    ...(command.reason ? { reason: command.reason } : {}),
+                };
+                result = await client.cancelRun(command.runId, body, command.idempotencyKey);
                 break;
+            }
             case 'pack': {
                 if (command.pack === 'sequences') {
-                    await require('./commands/sequences').runSequencesCommand(client, command, stdout);
+                    await require('./commands/sequences').runSequencesCommand(client, command, stdout, runtime.sleep ?? wait);
                 }
                 else {
-                    await require('./commands/workflows').runWorkflowsCommand(client, command, stdout);
+                    await require('./commands/workflows').runWorkflowsCommand(client, command, stdout, runtime.sleep ?? wait);
                 }
                 return;
             }
@@ -1003,7 +1292,8 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
             printPackRoute(result, stdout);
         else
             print(result, stdout, Boolean(command.jsonOutput));
-        process.exitCode = exports.CLI_EXIT.SUCCESS;
+        if (process.exitCode !== runWait_1.RUN_WAIT_TIMEOUT_EXIT_CODE)
+            process.exitCode = exports.CLI_EXIT.SUCCESS;
     }
     catch (error) {
         const exitCode = exitCodeForError(error);