@uru-intelligence/cli 0.3.54 → 0.3.56

package/README.md

@@ -54,6 +54,14 @@ bun src/index.ts gems write 'library/Golden Gems/My Gem.gem' main.html --file ./
 bun src/index.ts library ls library
 bun src/index.ts library search revenue
 bun src/index.ts library mkdir 'library/Golden Gems'
+bun src/index.ts library read 'library/Contexts/Client Brief.md'
+bun src/index.ts library write 'library/Contexts/Client Brief.md' --file ./brief.md --create
+bun src/index.ts library write 'library/Prompts/Sales Email.md' --content "Draft the follow-up." --create
+bun src/index.ts library patch 'library/Prompts/Sales Email.md' --stdin
+bun src/index.ts library cp 'library/Notes/Brief.md' 'library/Archive/Brief.md'
+bun src/index.ts library mv 'library/Notes/Draft.md' 'library/Notes/Final.md'
+bun src/index.ts library rm 'library/Notes/Old.md'
+bun src/index.ts library restore 'library/Notes/Old.md'
 bun src/index.ts datasets query revenue_rows --limit 50 --response-format concise --json
 bun src/index.ts datasets get --params-json '{"dataset_id":"revenue_rows"}'
 bun src/index.ts datasets rows-upsert --params-json '{"dataset_id":"revenue_rows","rows":[{"name":"Acme"}]}'

package/dist/uru.mjs

@@ -6,7 +6,7 @@ import { spawn as spawn3 } from "node:child_process";
 
 // src/types.ts
 var DEFAULT_API_URL = "https://api.uruintelligence.com";
-var CLI_VERSION = "0.3.54";
+var CLI_VERSION = "0.3.55";
 var ExitCode = {
   Ok: 0,
   Failure: 1,
@@ -241,8 +241,12 @@ function buildOperationGroups(op) {
   const libraryOperations = [
     op("library.ls", "library", "List visible Library folders and resources.", "library_query", "ls", "read"),
     op("library.stat", "library", "Read metadata for a visible Library path.", "library_query", "stat", "read"),
+    op("library.read", "library", "Read a visible text-backed Library resource by path.", "library_query", "read", "read"),
     op("library.search", "library", "Search visible Library resources server-side.", "library_query", "search", "read"),
     op("library.mkdir", "library", "Create a Library folder.", "library_fs", "mkdir", "write"),
+    op("library.write", "library", "Create or replace a text-backed Library resource by path.", "library_fs", "write", "write"),
+    op("library.patch", "library", "Replace text content for a text-backed Library resource by path.", "library_fs", "patch", "write"),
+    op("library.cp", "library", "Copy a supported Library item when the backing resource supports copy semantics.", "library_fs", "cp", "write"),
     op("library.mv", "library", "Move or rename a Library item.", "library_fs", "mv", "write"),
     op("library.move_workspace", "library", "Move a Library item to another workspace.", "library_fs", "move_workspace", "destructive"),
     op("library.rm", "library", "Trash a Library item.", "library_fs", "rm", "destructive"),
@@ -250,10 +254,7 @@ function buildOperationGroups(op) {
     op("library.empty_trash", "library", "Permanently empty Library trash.", "library_fs", "empty_trash", "destructive"),
     op("library.upload_preflight", "library", "Preflight a Library upload.", "library_upload", "preflight", "read"),
     op("library.upload_create_session", "library", "Create a direct Library upload session.", "library_upload", "create_session", "write"),
-    op("library.upload_complete_session", "library", "Complete a direct Library upload session.", "library_upload", "complete_session", "write"),
-    op("context.manage", "library", "Manage typed Context Library metadata such as workspace-default, teams, category, and favorite state.", "context_manage", undefined, "write"),
-    op("prompt.render", "library", "Render a typed Prompt Library resource with supplied variables.", "prompt_render", undefined, "read"),
-    op("persona.query", "library", "Query typed Persona Library resources and linked prompt/context resources.", "persona_query", undefined, "read")
+    op("library.upload_complete_session", "library", "Complete a direct Library upload session.", "library_upload", "complete_session", "write")
   ];
   const sharingOperations = [
     op("sharing.share", "sharing", "Share a Library resource with a user, team, or workspace.", "library_collab", "share", "write"),
@@ -416,7 +417,7 @@ function buildOperationGroups(op) {
     op("file.download_for_user", "files", "Prepare a file download for the user.", "DOWNLOAD_FILE_FOR_USER", undefined, "read")
   ];
   const businessSqlOperations = [
-    op("business_sql.transcript", "business_sql", "Query transcript SQL.", "TRANSCRIPT_SQL", undefined, "read"),
+    op("business_sql.transcript", "business_sql", "Query transcript SQL.", "transcript_sql", undefined, "read"),
     op("business_sql.maguire", "business_sql", "Query Maguire SQL.", "MAGUIRE_SQL", undefined, "read"),
     op("business_sql.tyler", "business_sql", "Query Tyler SQL.", "TYLER_SQL", undefined, "read"),
     op("business_sql.cfo", "business_sql", "Query CFO SQL.", "CFO_SQL", undefined, "read"),
@@ -473,7 +474,6 @@ var internalOnlyPlatformToolIds = new Set([
   "MAGUIRE_WRITE_SQL",
   "PEREGRINE_SQL",
   "RESTORE_DATASET_ROWS",
-  "TRANSCRIPT_SQL",
   "TYLER_SQL",
   "UPSERT_DATASET_ROWS"
 ]);
@@ -906,171 +906,6 @@ function normalizeTool(value) {
   return [tool];
 }
 
-// src/cli-helpers.ts
-function parseApiArgs(args) {
-  let method = "GET";
-  let path;
-  let body;
-  const fields = {};
-  for (let index = 0;index < args.length; index += 1) {
-    const arg = args[index];
-    if (arg === undefined) {
-      continue;
-    }
-    if (arg === "-X" || arg === "--method") {
-      method = requireCommandValue(args[index + 1], `${arg} requires a method`).toUpperCase();
-      index += 1;
-      continue;
-    }
-    if (arg.startsWith("-X") && arg.length > 2) {
-      method = arg.slice(2).toUpperCase();
-      continue;
-    }
-    if (arg === "--body-json" || arg === "--data-json") {
-      body = parseParamsJson(requireCommandValue(args[index + 1], `${arg} requires a JSON object`), arg);
-      index += 1;
-      continue;
-    }
-    if (arg === "-F" || arg === "--field") {
-      addApiField(fields, requireCommandValue(args[index + 1], `${arg} requires key=value`));
-      index += 1;
-      continue;
-    }
-    if (arg.startsWith("-F") && arg.length > 2) {
-      addApiField(fields, arg.slice(2));
-      continue;
-    }
-    if (path === undefined) {
-      path = normalizeApiPath(arg);
-      continue;
-    }
-    throw new CliError(`Unexpected api argument: ${arg}`);
-  }
-  if (Object.keys(fields).length > 0) {
-    body = { ...body ?? {}, ...fields };
-    if (method === "GET") {
-      method = "POST";
-    }
-  }
-  return {
-    path: requireCommandValue(path, "Usage: uru api <path> [-X POST] [-F k=v] [--body-json {...}]"),
-    method,
-    ...body === undefined ? {} : { body }
-  };
-}
-function normalizeApiPath(value) {
-  const trimmed = value.trim();
-  if (trimmed.startsWith("/")) {
-    return trimmed;
-  }
-  return `/api/${trimmed.replace(/^api\//, "")}`;
-}
-function addApiField(target, raw) {
-  const equals = raw.indexOf("=");
-  if (equals <= 0) {
-    throw new CliError("-F/--field requires key=value");
-  }
-  target[raw.slice(0, equals)] = raw.slice(equals + 1);
-}
-function paramsJson(args) {
-  for (let index = 0;index < args.length; index += 1) {
-    const arg = args[index];
-    if (arg === "--params-json" || arg === "--args-json") {
-      const value = args[index + 1];
-      if (value === undefined) {
-        throw new CliError(`${arg} requires a JSON object`);
-      }
-      return parseParamsJson(value, arg);
-    }
-    if (arg?.startsWith("--params-json=")) {
-      return parseParamsJson(arg.slice("--params-json=".length), "--params-json");
-    }
-    if (arg?.startsWith("--args-json=")) {
-      return parseParamsJson(arg.slice("--args-json=".length), "--args-json");
-    }
-  }
-  return {};
-}
-function parseParamsJson(value, label) {
-  try {
-    return parseJsonObject(value, label);
-  } catch (error) {
-    throw new CliError(error instanceof Error ? error.message : `Invalid ${label}`, {
-      cause: error
-    });
-  }
-}
-function parseLocalFlags(args) {
-  const values = {};
-  const booleans = new Set;
-  const positionals = [];
-  for (let index = 0;index < args.length; index += 1) {
-    const arg = args[index];
-    if (arg === undefined) {
-      continue;
-    }
-    if (!arg.startsWith("--")) {
-      positionals.push(arg);
-      continue;
-    }
-    const equals = arg.indexOf("=");
-    if (equals > -1) {
-      values[arg.slice(0, equals)] = arg.slice(equals + 1);
-      continue;
-    }
-    const next = args[index + 1];
-    if (next !== undefined && !next.startsWith("--")) {
-      values[arg] = next;
-      index += 1;
-    } else {
-      booleans.add(arg);
-    }
-  }
-  return { values, booleans, positionals };
-}
-function integerFlag(flags, name, fallback) {
-  const raw = flags.values[name];
-  if (raw === undefined) {
-    return fallback;
-  }
-  const value = Number.parseInt(raw, 10);
-  if (!Number.isFinite(value) || value < 0) {
-    throw new CliError(`${name} must be a non-negative integer`);
-  }
-  return value;
-}
-function copyStringFlag(flags, target, flagName, paramName) {
-  const value = flags.values[flagName];
-  if (value !== undefined) {
-    target[paramName] = value;
-  }
-}
-function isJsonRequested(argv) {
-  for (let index = 0;index < argv.length; index += 1) {
-    const arg = argv[index];
-    if (arg === "--json") {
-      return true;
-    }
-    if (arg === "--output-format=json" || arg === "--output-format=stream-json" || arg === "--output=json" || arg === "--output=stream-json") {
-      return true;
-    }
-    if (arg === "--output-format" || arg === "--output") {
-      const value = argv[index + 1];
-      if (value === "json" || value === "stream-json") {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-function nonEmptyString(value) {
-  if (value === undefined) {
-    return;
-  }
-  const trimmed = value.trim();
-  return trimmed === "" ? undefined : trimmed;
-}
-
 // src/output.ts
 function writeJson(io, value) {
   io.stdout.write(`${JSON.stringify(value, null, 2)}
@@ -1184,6 +1019,12 @@ LIBRARY / DATASETS / TOOLS
   uru library ls [path]                             List Library items
   uru library search <query>                        Search Library items
   uru library mkdir <path>                          Create a Library folder
+  uru library read <path>                           Print a text-backed Library resource
+  uru library write <path> --file ./note.md --create Create/replace text-backed Library content
+  uru library patch <path> --content "..."          Replace text-backed Library content
+  uru library cp|mv <path> <target-path>            Copy or move visible Library items
+  uru library rm <path> [--permanent --yes]         Trash or permanently delete Library items
+  uru library restore <path>                        Restore a trashed Library item
   # Prompts, personas, contexts: use typed Library paths such as library/Prompts/Foo.prompt.md
   uru datasets query <dataset-slug> [--limit 50]    Query dataset rows; add --response-format concise for compact output
   uru automations ls|get|create|enable|disable      Manage automations without raw JSON parameters
@@ -1400,8 +1241,20 @@ the check a release gate; security also accepts --deep.
   library: `Usage: uru library ls [path]
        uru library search <query>
        uru library mkdir <path>
+       uru library read <path>
+       uru library write <path> (--file <local-path>|--content <text>|--stdin) [--create]
+       uru library patch <path> (--file <local-path>|--content <text>|--stdin)
+       uru library cp <path> <target-path>
+       uru library mv <path> <target-path>
+       uru library rm <path> [--permanent] [--yes]
+       uru library restore <path>
+       uru library empty-trash --yes
 
-Operate on Library items through platform tools.
+Operate on Library items through platform tools. Use write --create to create
+text-backed Context, Prompt, Persona, note, and plain .md/.txt resources at
+visible Library paths. For binary files, use library_upload through
+\`uru operations run\` or \`uru tools run\`; for Gem child source files, use
+\`uru gems read|write\`.
 `,
   datasets: `Usage: uru datasets query <dataset-slug> [--limit 50] [--offset 0] [--response-format detailed|concise]
 
@@ -1563,7 +1416,14 @@ async function executeOperationStream(ctx, operationId, params, onEvent) {
   if (operation.backendOp !== undefined) {
     toolParams["op"] = operation.backendOp;
   }
-  return client(ctx).streamTool(operation.backendToolName, toolParams, onEvent);
+  const response = await client(ctx).streamTool(operation.backendToolName, toolParams, (event) => {
+    assertToolResultSuccess(event);
+    onEvent(event);
+  });
+  if (response.payload !== undefined) {
+    assertToolResultSuccess(response.payload);
+  }
+  return response;
 }
 async function executeOperation(ctx, operationId, params) {
   const operation = getPlatformOperation(operationId);
@@ -1574,7 +1434,9 @@ async function executeOperation(ctx, operationId, params) {
   if (operation.backendOp !== undefined) {
     toolParams["op"] = operation.backendOp;
   }
-  return client(ctx).runTool(operation.backendToolName, toolParams);
+  const result = await client(ctx).runTool(operation.backendToolName, toolParams);
+  assertToolResultSuccess(result);
+  return result;
 }
 function emit(ctx, value, text) {
   if (ctx.outputFormat === "stream-json") {
@@ -1586,19 +1448,51 @@ function emit(ctx, value, text) {
   }
 }
 function unwrapToolResult(value) {
-  if (isJsonObject2(value) && isJsonObject2(value["result"])) {
-    return value["result"];
+  assertToolResultSuccess(value);
+  if (isJsonObject2(value) && Object.hasOwn(value, "result") && (isToolResultEnvelope(value) || isJsonObject2(value["result"]))) {
+    const result = value["result"];
+    if (result !== undefined) {
+      return result;
+    }
   }
   return value;
 }
+function assertToolResultSuccess(value) {
+  if (!isJsonObject2(value) || !isToolResultEnvelope(value)) {
+    return;
+  }
+  const httpStatus = toolResultHttpStatus(value);
+  const failed = value["success"] === false || Object.hasOwn(value, "error") || Object.hasOwn(value, "errorMessage") || Object.hasOwn(value, "error_message") || Object.hasOwn(value, "errorCode") || Object.hasOwn(value, "error_code") || Object.hasOwn(value, "code") || httpStatus !== undefined && httpStatus >= 400;
+  if (!failed) {
+    return;
+  }
+  const errorCode = stringField(value, ["errorCode", "error_code", "code"]);
+  const toolId = stringField(value, ["toolId", "tool_id"]);
+  const message = stringField(value, ["errorMessage", "error_message", "error", "message"]) ?? `${toolId === undefined ? "Tool operation" : `Tool ${toolId}`} failed`;
+  const details = [
+    errorCode === undefined ? undefined : `[${errorCode}]`,
+    httpStatus === undefined ? undefined : `(HTTP ${httpStatus})`
+  ].filter((detail) => detail !== undefined);
+  const tip = stringField(value, ["tip"]);
+  throw new CliError(`${message}${details.length === 0 ? "" : ` ${details.join(" ")}`}${tip === undefined ? "" : ` ${tip}`}`, {
+    code: httpStatus === 409 ? ExitCode.Conflict : httpStatus === 401 || httpStatus === 403 ? ExitCode.AuthRequired : ExitCode.Failure,
+    ...errorCode === undefined ? {} : { errorCode }
+  });
+}
+function isToolResultEnvelope(value) {
+  return typeof value["success"] === "boolean" && (typeof value["toolId"] === "string" || typeof value["tool_id"] === "string" || typeof value["executionTimeMs"] === "number" || typeof value["execution_time_ms"] === "number");
+}
+function toolResultHttpStatus(value) {
+  const status = value["httpStatus"] ?? value["http_status"];
+  return typeof status === "number" && Number.isFinite(status) ? status : undefined;
+}
 function delegatedPayload(value) {
   if (isJsonObject2(value) && isJsonObject2(value["payload"])) {
     return value["payload"];
   }
   return value;
 }
-function gemPathFromArgs(args, linkedProject) {
-  const flags = parseLocalFlags(args);
+function gemPathFromArgs(flags, linkedProject) {
   return flags.values["--path"] ?? flags.values["--gem"] ?? flags.positionals.find((value) => value.startsWith("library/")) ?? linkedProject.libraryPath ?? linkedProject.gemId ?? (() => {
     throw new CliError("Gem path required. Pass library/<name>.gem or run `uru link --path library/<name>.gem`.");
   })();
@@ -1822,16 +1716,9 @@ function createMacosKeychainCredentialStore(runCommand) {
     },
     async writeToken(apiUrl, token) {
       try {
-        await runCommand("security", [
-          "add-generic-password",
-          "-a",
-          accountForApiUrl(apiUrl),
-          "-s",
-          KEYCHAIN_SERVICE,
-          "-w",
-          token,
-          "-U"
-        ]);
+        await runCommand("security", ["-i"], {
+          input: macosKeychainWriteCommand(apiUrl, token)
+        });
       } catch (error) {
         throw credentialStoreError("macOS Keychain", error);
       }
@@ -1853,6 +1740,11 @@ function createMacosKeychainCredentialStore(runCommand) {
     }
   };
 }
+function macosKeychainWriteCommand(apiUrl, token) {
+  const tokenHex = Buffer.from(token, "utf8").toString("hex");
+  return `add-generic-password -a "${accountForApiUrl(apiUrl)}" -s "${KEYCHAIN_SERVICE}" -X ${tokenHex} -U
+`;
+}
 function createLinuxSecretToolCredentialStore(runCommand) {
   return {
     async readToken(apiUrl) {
@@ -2351,7 +2243,8 @@ var SKIPPED_SOURCE_PATH_SEGMENTS = new Set([
   "build",
   "coverage",
   "tmp",
-  "temp"
+  "temp",
+  "__MACOSX"
 ]);
 var SKIPPED_SOURCE_FILE_NAMES = new Set([
   ".DS_Store",
@@ -2364,7 +2257,8 @@ var SKIPPED_SOURCE_FILE_NAMES = new Set([
 ]);
 function shouldSkipProjectPath(path) {
   const segments = path.split("/");
-  return segments.some((segment) => SKIPPED_SOURCE_PATH_SEGMENTS.has(segment)) || SKIPPED_SOURCE_FILE_NAMES.has(segments.at(-1) ?? "");
+  const name = segments.at(-1) ?? "";
+  return segments.some((segment) => SKIPPED_SOURCE_PATH_SEGMENTS.has(segment)) || SKIPPED_SOURCE_FILE_NAMES.has(name) || name.startsWith("._");
 }
 function stableStringRecord(record) {
   return Object.fromEntries(Object.entries(record).filter(([, value]) => typeof value === "string" && value.trim() !== "").sort(([left], [right]) => compareStrings(left, right)));
@@ -2419,11 +2313,12 @@ async function maybeNotifyCliUpdate(ctx, options = {}) {
   if (!shouldCheckForUpdate(ctx, options.env ?? process.env)) {
     return;
   }
+  const currentConfig = await readConfigBestEffort(ctx);
   const now = options.now?.() ?? Date.now();
-  if (!isUpdateCheckDue(ctx.config, now)) {
+  if (!isUpdateCheckDue(currentConfig, now)) {
     return;
   }
-  const checkedConfig = withUpdateCheckTimestamp(ctx.config, now);
+  const checkedConfig = withUpdateCheckTimestamp(currentConfig, now);
   await writeConfigBestEffort(ctx, checkedConfig);
   const latestVersion = await fetchLatestVersion({
     fetchImpl: ctx.fetch ?? fetch,
@@ -2445,6 +2340,13 @@ async function maybeNotifyCliUpdate(ctx, options = {}) {
   ctx.io.stderr.write(`A newer Uru CLI is available: ${CLI_VERSION} → ${latestVersion}. ` + `Run npm install -g ${PACKAGE_NAME}@latest
 `);
 }
+async function readConfigBestEffort(ctx) {
+  try {
+    return await ctx.store.read();
+  } catch {
+    return ctx.config;
+  }
+}
 function shouldCheckForUpdate(ctx, env) {
   return ctx.outputFormat === "text" && ctx.terminal.stderrIsTty && !ctx.terminal.ci && env["NO_UPDATE_NOTIFIER"] === undefined && env["URU_NO_UPDATE_NOTIFIER"] === undefined;
 }
@@ -2524,6 +2426,194 @@ function isRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
+// src/cli-helpers.ts
+var BOOLEAN_LOCAL_FLAGS = new Set([
+  "--blocking",
+  "--create",
+  "--deep",
+  "--dry-run",
+  "--follow",
+  "--force",
+  "--force-build",
+  "--hard-delete",
+  "--no-create",
+  "--no-publish",
+  "--no-wait",
+  "--permanent",
+  "--prod",
+  "--skip-promote",
+  "--stdin",
+  "--value-stdin",
+  "--yes"
+]);
+function parseApiArgs(args) {
+  let method = "GET";
+  let path;
+  let body;
+  const fields = {};
+  for (let index = 0;index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === undefined) {
+      continue;
+    }
+    if (arg === "-X" || arg === "--method") {
+      method = requireCommandValue(args[index + 1], `${arg} requires a method`).toUpperCase();
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith("-X") && arg.length > 2) {
+      method = arg.slice(2).toUpperCase();
+      continue;
+    }
+    if (arg === "--body-json" || arg === "--data-json") {
+      body = parseParamsJson(requireCommandValue(args[index + 1], `${arg} requires a JSON object`), arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "-F" || arg === "--field") {
+      addApiField(fields, requireCommandValue(args[index + 1], `${arg} requires key=value`));
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith("-F") && arg.length > 2) {
+      addApiField(fields, arg.slice(2));
+      continue;
+    }
+    if (path === undefined) {
+      path = normalizeApiPath(arg);
+      continue;
+    }
+    throw new CliError(`Unexpected api argument: ${arg}`);
+  }
+  if (Object.keys(fields).length > 0) {
+    body = { ...body ?? {}, ...fields };
+    if (method === "GET") {
+      method = "POST";
+    }
+  }
+  return {
+    path: requireCommandValue(path, "Usage: uru api <path> [-X POST] [-F k=v] [--body-json {...}]"),
+    method,
+    ...body === undefined ? {} : { body }
+  };
+}
+function normalizeApiPath(value) {
+  const trimmed = value.trim();
+  if (trimmed.startsWith("/")) {
+    return trimmed;
+  }
+  return `/api/${trimmed.replace(/^api\//, "")}`;
+}
+function addApiField(target, raw) {
+  const equals = raw.indexOf("=");
+  if (equals <= 0) {
+    throw new CliError("-F/--field requires key=value");
+  }
+  target[raw.slice(0, equals)] = raw.slice(equals + 1);
+}
+function paramsJson(args) {
+  for (let index = 0;index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--params-json" || arg === "--args-json") {
+      const value = args[index + 1];
+      if (value === undefined) {
+        throw new CliError(`${arg} requires a JSON object`);
+      }
+      return parseParamsJson(value, arg);
+    }
+    if (arg?.startsWith("--params-json=")) {
+      return parseParamsJson(arg.slice("--params-json=".length), "--params-json");
+    }
+    if (arg?.startsWith("--args-json=")) {
+      return parseParamsJson(arg.slice("--args-json=".length), "--args-json");
+    }
+  }
+  return {};
+}
+function parseParamsJson(value, label) {
+  try {
+    return parseJsonObject(value, label);
+  } catch (error) {
+    throw new CliError(error instanceof Error ? error.message : `Invalid ${label}`, {
+      cause: error
+    });
+  }
+}
+function parseLocalFlags(args) {
+  const values = {};
+  const booleans = new Set;
+  const positionals = [];
+  for (let index = 0;index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === undefined) {
+      continue;
+    }
+    if (!arg.startsWith("--")) {
+      positionals.push(arg);
+      continue;
+    }
+    const equals = arg.indexOf("=");
+    if (equals > -1) {
+      values[arg.slice(0, equals)] = arg.slice(equals + 1);
+      continue;
+    }
+    if (BOOLEAN_LOCAL_FLAGS.has(arg)) {
+      booleans.add(arg);
+      continue;
+    }
+    const next = args[index + 1];
+    if (next !== undefined && !next.startsWith("--")) {
+      values[arg] = next;
+      index += 1;
+    } else {
+      booleans.add(arg);
+    }
+  }
+  return { values, booleans, positionals };
+}
+function integerFlag(flags, name, fallback) {
+  const raw = flags.values[name];
+  if (raw === undefined) {
+    return fallback;
+  }
+  const value = Number.parseInt(raw, 10);
+  if (!Number.isFinite(value) || value < 0) {
+    throw new CliError(`${name} must be a non-negative integer`);
+  }
+  return value;
+}
+function copyStringFlag(flags, target, flagName, paramName) {
+  const value = flags.values[flagName];
+  if (value !== undefined) {
+    target[paramName] = value;
+  }
+}
+function isJsonRequested(argv) {
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === "--json") {
+      return true;
+    }
+    if (arg === "--output-format=json" || arg === "--output-format=stream-json" || arg === "--output=json" || arg === "--output=stream-json") {
+      return true;
+    }
+    if (arg === "--output-format" || arg === "--output") {
+      const value = argv[index + 1];
+      if (value === "json" || value === "stream-json") {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function nonEmptyString(value) {
+  if (value === undefined) {
+    return;
+  }
+  const trimmed = value.trim();
+  return trimmed === "" ? undefined : trimmed;
+}
+
 // src/auth-commands.ts
 import { readFile as readFile3 } from "node:fs/promises";
 import { createServer } from "node:http";
@@ -3184,8 +3274,8 @@ async function switchWorkspace(ctx, workspaceId) {
 }
 
 // src/local-commands.ts
-import { mkdir as mkdir3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname3 } from "node:path";
+import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname as dirname3, resolve as resolve2 } from "node:path";
 var GENERIC_FAMILY_COMMANDS = {
   workspace: "workspace",
   sharing: "sharing",
@@ -3414,7 +3504,109 @@ async function dispatchLibrary(ctx, sub, args) {
     });
     return;
   }
-  throw new CliError("Usage: uru library ls|search|mkdir");
+  if (sub === "read" || sub === "cat") {
+    await emitTool(ctx, "library.read", {
+      path: requireCommandValue(args[0], "Usage: uru library read <path>")
+    }, { textExtractor: extractLibraryTextContent });
+    return;
+  }
+  if (sub === "write") {
+    const flags = parseLocalFlags(args);
+    const path = requireCommandValue(flags.positionals[0], "Usage: uru library write <path> (--file <local-path>|--content <text>|--stdin) [--create]");
+    await emitTool(ctx, "library.write", {
+      path,
+      content: await libraryTextFromFlags(ctx, flags, "write"),
+      create: flags.booleans.has("--create")
+    });
+    return;
+  }
+  if (sub === "patch") {
+    const flags = parseLocalFlags(args);
+    const path = requireCommandValue(flags.positionals[0], "Usage: uru library patch <path> (--file <local-path>|--content <text>|--stdin)");
+    await emitTool(ctx, "library.patch", {
+      path,
+      content: await libraryTextFromFlags(ctx, flags, "patch")
+    });
+    return;
+  }
+  if (sub === "cp" || sub === "copy") {
+    const [path, targetPath] = args;
+    await emitTool(ctx, "library.cp", {
+      path: requireCommandValue(path, "Usage: uru library cp <path> <target-path>"),
+      target_path: requireCommandValue(targetPath, "Usage: uru library cp <path> <target-path>")
+    });
+    return;
+  }
+  if (sub === "mv" || sub === "move" || sub === "rename") {
+    const [path, targetPath] = args;
+    await emitTool(ctx, "library.mv", {
+      path: requireCommandValue(path, "Usage: uru library mv <path> <target-path>"),
+      target_path: requireCommandValue(targetPath, "Usage: uru library mv <path> <target-path>")
+    });
+    return;
+  }
+  if (sub === "rm" || sub === "remove" || sub === "delete") {
+    const flags = parseLocalFlags(args);
+    if ((flags.booleans.has("--permanent") || flags.booleans.has("--hard-delete")) && !ctx.yes && !flags.booleans.has("--yes")) {
+      throw new CliError("Permanent Library deletion cannot be undone. Re-run with --yes to confirm.");
+    }
+    const path = requireCommandValue(flags.positionals[0], "Usage: uru library rm <path> [--permanent] [--yes]");
+    await emitTool(ctx, "library.rm", {
+      path,
+      permanent: flags.booleans.has("--permanent") || flags.booleans.has("--hard-delete")
+    });
+    return;
+  }
+  if (sub === "restore") {
+    await emitTool(ctx, "library.restore", {
+      path: requireCommandValue(args[0], "Usage: uru library restore <path>"),
+      include_trashed: true
+    });
+    return;
+  }
+  if (sub === "empty-trash") {
+    const flags = parseLocalFlags(args);
+    if (!ctx.yes && !flags.booleans.has("--yes")) {
+      throw new CliError("Emptying Library trash permanently deletes all trashed items. Re-run with --yes to confirm.");
+    }
+    await emitTool(ctx, "library.empty_trash", {});
+    return;
+  }
+  throw new CliError("Usage: uru library ls|search|mkdir|read|write|patch|cp|mv|rm|restore|empty-trash");
+}
+async function libraryTextFromFlags(ctx, flags, verb) {
+  const content = flags.values["--content"];
+  const file = flags.values["--file"];
+  const fromStdin = flags.booleans.has("--stdin");
+  const sources = [content !== undefined, file !== undefined, fromStdin].filter(Boolean).length;
+  if (sources !== 1) {
+    throw new CliError(`Library ${verb} requires exactly one of --file <path>, --content <text>, or --stdin.`);
+  }
+  if (content !== undefined) {
+    return content;
+  }
+  if (file !== undefined) {
+    return await readFile4(resolve2(ctx.cwd, file), "utf8");
+  }
+  return await readStdinText(ctx.stdin ?? process.stdin);
+}
+async function readStdinText(stdin) {
+  const chunks = [];
+  for await (const chunk of stdin) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+function extractLibraryTextContent(value) {
+  if (!isJsonObject2(value)) {
+    return;
+  }
+  const content = value["content"];
+  if (typeof content === "string") {
+    return content;
+  }
+  const text = value["text"];
+  return typeof text === "string" ? text : undefined;
 }
 async function dispatchDatasets(ctx, sub, args) {
   if (sub !== "query") {
@@ -3623,11 +3815,12 @@ function levenshtein(left, right) {
 }
 
 // src/gem-lifecycle-commands.ts
-import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
+import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
 import { setTimeout as sleep } from "node:timers/promises";
-import { join as join3, resolve as resolve2 } from "node:path";
+import { join as join3, resolve as resolve3 } from "node:path";
 async function dispatchGems(ctx, sub, args, linkedProject) {
-  const gemPath = () => gemPathFromArgs(args, linkedProject);
+  const flags = parseLocalFlags(args);
+  const gemPath = () => gemPathFromArgs(flags, linkedProject);
   if (sub === "inspect") {
     await emitGemTool(ctx, "gem.inspect", { path: gemPath() });
     return;
@@ -3678,7 +3871,7 @@ async function gemInit(ctx, args) {
     params["content"] = flags.values["--content"];
   }
   if (flags.values["--file"] !== undefined) {
-    params["content"] = await readFile4(flags.values["--file"], "utf8");
+    params["content"] = await readFile5(flags.values["--file"], "utf8");
   }
   await emitGemTool(ctx, "gem.init", params);
 }
@@ -3703,6 +3896,12 @@ async function gemDeploy(ctx, args, linkedProject) {
   }
   if (flags.booleans.has("--dry-run")) {
     const buildArgs = [...flags.positionals, "--dry-run"];
+    for (const flag of ["--path", "--gem"]) {
+      const value = flags.values[flag];
+      if (value !== undefined) {
+        buildArgs.push(flag, value);
+      }
+    }
     if (flags.booleans.has("--force-build")) {
       buildArgs.push("--force");
     }
@@ -3713,7 +3912,7 @@ async function gemDeploy(ctx, args, linkedProject) {
     await gemBuild(ctx, buildArgs, linkedProject);
     return;
   }
-  const gemPath = gemPathFromArgs(flags.positionals, linkedProject);
+  const gemPath = gemPathFromArgs(flags, linkedProject);
   const publish = !flags.booleans.has("--no-publish") && !flags.booleans.has("--skip-promote");
   const params = {
     path: gemPath,
@@ -3742,7 +3941,7 @@ async function gemDeploy(ctx, args, linkedProject) {
 async function gemBuild(ctx, args, linkedProject) {
   const flags = parseLocalFlags(args);
   assertAllowedLocalFlags(flags, ["--dry-run", "--force", "--gem", "--outdir", "--path", "--source-version-id"], "uru build");
-  const gemPath = gemPathFromArgs(flags.positionals, linkedProject);
+  const gemPath = gemPathFromArgs(flags, linkedProject);
   const params = {
     path: gemPath
   };
@@ -3791,9 +3990,9 @@ async function gemChecks(ctx, args, linkedProject) {
   }
   assertAllowedLocalFlags(flags, ["--deployment-id", "--gem", "--path"], "uru gems checks");
   const explicitDeploymentId = flags.values["--deployment-id"];
-  const gemPathArgs = explicitDeploymentId === undefined ? flags.positionals.slice(1) : flags.positionals;
+  const gemPathFlags = explicitDeploymentId === undefined ? shiftPositionals(flags, 1) : flags;
   const params = {
-    path: gemPathFromArgs(gemPathArgs, linkedProject)
+    path: gemPathFromArgs(gemPathFlags, linkedProject)
   };
   if (explicitDeploymentId !== undefined) {
     params["deployment_id"] = explicitDeploymentId;
@@ -3806,7 +4005,7 @@ async function gemRunCheck(ctx, flags, linkedProject) {
   assertAllowedLocalFlags(flags, ["--blocking", "--deep", "--deployment-id", "--gem", "--path"], "uru gems checks run");
   const kind = requireCommandValue(flags.positionals[1], "Usage: uru gems checks run browser|security [library/name.gem] [--deployment-id <id>] [--blocking]");
   const params = {
-    path: gemPathFromArgs(flags.positionals.slice(2), linkedProject)
+    path: gemPathFromArgs(shiftPositionals(flags, 2), linkedProject)
   };
   copyStringFlag(flags, params, "--deployment-id", "deployment_id");
   if (flags.booleans.has("--blocking")) {
@@ -3842,7 +4041,7 @@ async function gemLogs(ctx, args, linkedProject) {
     "--request-id"
   ], "uru logs");
   const params = {
-    path: gemPathFromArgs(flags.positionals, linkedProject),
+    path: gemPathFromArgs(flags, linkedProject),
     limit: integerFlag(flags, "--limit", 100)
   };
   copyStringFlag(flags, params, "--level", "level");
@@ -3990,8 +4189,9 @@ function boundedIntegerFlag(flags, name, fallback, maximum) {
   return Math.min(value, maximum);
 }
 async function gemOpen(ctx, args, linkedProject) {
+  const flags = parseLocalFlags(args);
   const result = await executeOperation(ctx, "gem.links_list", {
-    path: gemPathFromArgs(args, linkedProject)
+    path: gemPathFromArgs(flags, linkedProject)
   });
   const url = firstUrl(unwrapToolResult(result));
   if (url === undefined) {
@@ -4022,7 +4222,7 @@ async function gemWrite(ctx, args) {
   const flags = parseLocalFlags(args);
   const gemPath = requireCommandValue(flags.positionals[0], "Usage: uru gems write <gem-path> <file> --content <text>|--file <local-file>");
   const filePath = requireCommandValue(flags.positionals[1], "Usage: uru gems write <gem-path> <file> --content <text>|--file <local-file>");
-  const content = flags.values["--content"] ?? (flags.values["--file"] === undefined ? undefined : await readFile4(flags.values["--file"], "utf8"));
+  const content = flags.values["--content"] ?? (flags.values["--file"] === undefined ? undefined : await readFile5(flags.values["--file"], "utf8"));
   if (content === undefined) {
     throw new CliError("Gem write requires --content or --file.");
   }
@@ -4049,7 +4249,7 @@ async function dispatchGemVersions(ctx, args, linkedProject) {
     assertAllowedLocalFlags(flags, ["--gem", "--link-id", "--no-wait", "--path", "--pct", "--skip-promote"], "uru gems versions deploy");
     const version = requireCommandValue(flags.positionals[0], "Usage: uru gems versions deploy <version-id> [library/name.gem] [--pct 100] [--skip-promote]");
     const [versionId, trafficPercent] = version.split("@", 2);
-    const gemPath = gemPathFromArgs(flags.positionals.slice(1), linkedProject);
+    const gemPath = gemPathFromArgs(shiftPositionals(flags, 1), linkedProject);
     const pct = flags.values["--pct"] ?? trafficPercent;
     const trafficPercentValue = pct === undefined || pct === "" ? 100 : parseTrafficPercent(pct);
     const publish = !flags.booleans.has("--skip-promote");
@@ -4086,7 +4286,7 @@ async function gemVersionUpload(ctx, args, linkedProject) {
     "--tag",
     "--tags"
   ], "uru gems versions upload");
-  const gemPath = gemPathFromArgs(flags.positionals, linkedProject);
+  const gemPath = gemPathFromArgs(flags, linkedProject);
   const params = {
     path: gemPath
   };
@@ -4122,7 +4322,7 @@ async function deployVersionToPublishedLink(ctx, flags, linkedProject, options)
   if (deploymentId === undefined && versionId === undefined) {
     throw new CliError(options.usage);
   }
-  const gemPath = gemPathFromArgs(versionId === undefined ? flags.positionals : flags.positionals.slice(1), linkedProject);
+  const gemPath = gemPathFromArgs(versionId === undefined ? flags : shiftPositionals(flags, 1), linkedProject);
   const trafficPercent = parseTrafficPercent(flags.values["--pct"] ?? "100");
   if (trafficPercent !== 100) {
     throw new CliError(`${options.operation} does not support partial traffic shifts yet. Deploy the version with --skip-promote for validation, or ${options.operation} with --pct 100.`);
@@ -4179,7 +4379,7 @@ function localFlagNames(flags) {
 async function writeBuildManifest(ctx, outdir, buildResult) {
   const manifest = gemBuildManifestFromBuildResult(buildResult);
   const providerDecision = gemProviderDecisionFromBuildResult(buildResult, manifest);
-  const absoluteOutdir = resolve2(ctx.cwd, outdir);
+  const absoluteOutdir = resolve3(ctx.cwd, outdir);
   await mkdir4(absoluteOutdir, { recursive: true });
   await writeFile4(join3(absoluteOutdir, "gem-build-manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `, { mode: 384 });
@@ -4378,10 +4578,10 @@ function trimLeadingSlashes(value) {
 
 // src/gem-source-commands.ts
 import { mkdir as mkdir5, rm as rm3, writeFile as writeFile5 } from "node:fs/promises";
-import { dirname as dirname4, join as join4, resolve as resolve3 } from "node:path";
+import { dirname as dirname4, join as join4, resolve as resolve4 } from "node:path";
 async function gemSourcePull(ctx, args, linkedProject) {
   const flags = parseLocalFlags(args);
-  const gemPath = gemPathFromArgs(flags.positionals, linkedProject);
+  const gemPath = gemPathFromArgs(flags, linkedProject);
   const force = flags.booleans.has("--force");
   const previousLock = await readSourceLock(ctx.cwd);
   const localFilesBeforePull = await collectLocalSourceFiles(ctx.cwd);
@@ -4401,15 +4601,19 @@ async function gemSourcePull(ctx, args, linkedProject) {
   }
   let sourceVersionId = findSourceVersionId(tree);
   const files = {};
+  const pulledFiles = [];
   for (const filePath of filePaths) {
     const readResult = unwrapToolResult(await executeOperation(ctx, "gem.fs_read", {
       path: gemFilePath(gemPath, filePath)
     }));
     sourceVersionId = sourceVersionId ?? findSourceVersionId(readResult);
     const content = extractRemoteFileContent(readResult, filePath);
-    await writePulledSourceFile(ctx.cwd, filePath, content);
+    pulledFiles.push({ path: filePath, content });
     files[filePath] = sha256Hex(content);
   }
+  for (const file of pulledFiles) {
+    await writePulledSourceFile(ctx.cwd, file.path, file.content);
+  }
   const pruned = await pruneRemoteDeletedSourceFiles(ctx.cwd, previousLock, localFilesBeforePull, new Set(filePaths));
   const lock = {
     ...sourceVersionId === undefined ? {} : { sourceVersionId },
@@ -4428,11 +4632,11 @@ async function gemSourcePull(ctx, args, linkedProject) {
 }
 async function gemSourceStatus(ctx, args, linkedProject) {
   const flags = parseLocalFlags(args);
-  const gemPath = gemPathFromArgs(flags.positionals, linkedProject);
+  const gemPath = gemPathFromArgs(flags, linkedProject);
   const lock = await readSourceLock(ctx.cwd);
   const localFiles = await collectLocalSourceFiles(ctx.cwd);
   const localStatus = compareSourceLock(lock, localFiles);
-  const remote = await tryRemoteSourceOperation(ctx, "gem.fs_status", {
+  const remote = await remoteSourceOperation(ctx, "gem.fs_status", {
     path: gemPath,
     ...lock.sourceVersionId === undefined ? {} : { base: lock.sourceVersionId }
   });
@@ -4447,12 +4651,12 @@ async function gemSourceStatus(ctx, args, linkedProject) {
 }
 async function gemSourceDiff(ctx, args, linkedProject) {
   const flags = parseLocalFlags(args);
-  const gemPath = gemPathFromArgs(flags.positionals, linkedProject);
+  const gemPath = gemPathFromArgs(flags, linkedProject);
   const lock = await readSourceLock(ctx.cwd);
   const localFiles = await collectLocalSourceFiles(ctx.cwd);
   const localStatus = compareSourceLock(lock, localFiles);
   const mode = flags.values["--mode"] ?? "name_status";
-  const remote = await tryRemoteSourceOperation(ctx, "gem.fs_diff", {
+  const remote = await remoteSourceOperation(ctx, "gem.fs_diff", {
     path: gemPath,
     mode,
     ...lock.sourceVersionId === undefined ? {} : { base: lock.sourceVersionId }
@@ -4468,7 +4672,7 @@ async function gemSourceDiff(ctx, args, linkedProject) {
 }
 async function gemSourcePush(ctx, args, linkedProject) {
   const flags = parseLocalFlags(args);
-  const gemPath = gemPathFromArgs(flags.positionals, linkedProject);
+  const gemPath = gemPathFromArgs(flags, linkedProject);
   const lock = await readSourceLock(ctx.cwd);
   const force = flags.booleans.has("--force");
   const localFiles = await collectLocalSourceFiles(ctx.cwd);
@@ -4495,6 +4699,9 @@ async function gemSourcePush(ctx, args, linkedProject) {
     }));
     sourceCas = nextSourceMutationCas(sourceCas, syncResult);
   } catch (error) {
+    if (error instanceof CliError && error.exitCode === ExitCode.Conflict) {
+      throw error;
+    }
     if (isConflictLikeError(error)) {
       throw new CliError(error instanceof Error ? error.message : "Gem source conflict", { code: ExitCode.Conflict, cause: error });
     }
@@ -4541,7 +4748,7 @@ async function pruneRemoteDeletedSourceFiles(cwd, previousLock, localFilesBefore
       preserved.push(projectPath2);
       continue;
     }
-    await rm3(join4(resolve3(cwd), ...safePath.split("/")), { force: true });
+    await rm3(join4(resolve4(cwd), ...safePath.split("/")), { force: true });
     deleted.push(projectPath2);
   }
   return { deleted, preserved };
@@ -4660,18 +4867,11 @@ function dirtyPullErrorMessage(status) {
 Run \`uru status\` to inspect them, save or push your changes, or re-run \`uru pull --force\` to replace local files with server source.
 ${preview}${moreLine}`;
 }
-async function tryRemoteSourceOperation(ctx, operationId, params) {
-  try {
-    return {
-      available: true,
-      result: unwrapToolResult(await executeOperation(ctx, operationId, params))
-    };
-  } catch (error) {
-    return {
-      available: false,
-      error: error instanceof Error ? error.message : "Remote operation failed"
-    };
-  }
+async function remoteSourceOperation(ctx, operationId, params) {
+  return {
+    available: true,
+    result: unwrapToolResult(await executeOperation(ctx, operationId, params))
+  };
 }
 function formatRemoteSummary(remote) {
   if (!remote.available) {
@@ -4762,7 +4962,7 @@ async function writePulledSourceFile(cwd, projectPath2, content) {
   if (safePath === null) {
     throw new CliError(`Refusing to write unsafe Gem source path: ${projectPath2}`);
   }
-  const localPath = join4(resolve3(cwd), ...safePath.split("/"));
+  const localPath = join4(resolve4(cwd), ...safePath.split("/"));
   await mkdir5(dirname4(localPath), { recursive: true });
   await writeFile5(localPath, content);
 }
@@ -4817,8 +5017,9 @@ function isConflictLikeError(error) {
 
 // src/token-env-secret-commands.ts
 import { spawn as spawn2 } from "node:child_process";
-import { chmod, mkdir as mkdir6, readFile as readFile5, writeFile as writeFile6 } from "node:fs/promises";
-import { dirname as dirname5, resolve as resolve4 } from "node:path";
+import { StringDecoder } from "node:string_decoder";
+import { chmod, mkdir as mkdir6, readFile as readFile6, writeFile as writeFile6 } from "node:fs/promises";
+import { dirname as dirname5, resolve as resolve5 } from "node:path";
 async function dispatchTokens(ctx, sub, args, linkedProject) {
   if (sub === "create") {
     const flags = parseLocalFlags(args);
@@ -4932,7 +5133,7 @@ async function dispatchEnv(ctx, sub, args, linkedProject) {
     })));
     const secrets = extractSecretRows(result);
     const content = formatEnvTemplate(secrets);
-    const absolutePath = resolve4(ctx.cwd, outputPath);
+    const absolutePath = resolve5(ctx.cwd, outputPath);
     await mkdir6(dirname5(absolutePath), { recursive: true });
     await writeFile6(absolutePath, content, { mode: 384 });
     await chmod(absolutePath, 384);
@@ -4949,8 +5150,8 @@ async function dispatchEnv(ctx, sub, args, linkedProject) {
   }
   if (sub === "run") {
     const parsed = parseEnvRunArgs(args);
-    const envFilePath = resolve4(ctx.cwd, parsed.envFile);
-    const envVars = parseEnvFile(await readFile5(envFilePath, "utf8"));
+    const envFilePath = resolve5(ctx.cwd, parsed.envFile);
+    const envVars = parseEnvFile(await readFile6(envFilePath, "utf8"));
     await runEnvCommand(ctx, parsed.command, envVars);
     return;
   }
@@ -4970,10 +5171,10 @@ async function secretValueFromFlags(ctx, flags) {
   }
   const valueFile = flags.values["--value-file"];
   if (valueFile !== undefined) {
-    return (await readFile5(resolve4(ctx.cwd, valueFile), "utf8")).trimEnd();
+    return (await readFile6(resolve5(ctx.cwd, valueFile), "utf8")).trimEnd();
   }
   if (flags.booleans.has("--value-stdin")) {
-    return await readStdinText(ctx.stdin ?? process.stdin);
+    return await readStdinText2(ctx.stdin ?? process.stdin);
   }
   throw new CliError("Secret put requires --value-file <path> or --value-stdin. Values are never printed by the CLI.");
 }
@@ -5068,48 +5269,69 @@ function unquoteEnvValue(value) {
 }
 async function runEnvCommand(ctx, command, envVars) {
   const executable = requireCommandValue(command[0], "env run command is required");
-  const result = await spawnBuffered(executable, command.slice(1), {
+  const redactions = Object.values(envVars).filter((value) => value.length > 0);
+  const code = await spawnStreaming(executable, command.slice(1), {
     cwd: ctx.cwd,
-    env: { ...process.env, ...envVars }
+    env: { ...process.env, ...envVars },
+    redactions,
+    stdout: ctx.io.stdout,
+    stderr: ctx.io.stderr
   });
-  const redactions = Object.values(envVars).filter((value) => value.length > 0);
-  const stdout = redactValues2(result.stdout, redactions);
-  const stderr = redactValues2(result.stderr, redactions);
-  if (stdout.length > 0) {
-    ctx.io.stdout.write(stdout);
-  }
-  if (stderr.length > 0) {
-    ctx.io.stderr.write(stderr);
-  }
-  if (result.code !== 0) {
-    throw new CliError(`env run failed with exit code ${result.code}`);
+  if (code !== 0) {
+    throw new CliError(`env run failed with exit code ${code}`);
   }
 }
-async function spawnBuffered(command, args, options) {
+async function spawnStreaming(command, args, options) {
   return new Promise((resolvePromise, reject) => {
     const child = spawn2(command, [...args], {
       cwd: options.cwd,
       env: options.env,
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: ["inherit", "pipe", "pipe"]
     });
-    const stdout = [];
-    const stderr = [];
+    const stdout = redactingLineWriter(options.stdout, options.redactions);
+    const stderr = redactingLineWriter(options.stderr, options.redactions);
     child.stdout?.on("data", (chunk) => {
-      stdout.push(Buffer.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk));
+      stdout.write(chunk);
     });
     child.stderr?.on("data", (chunk) => {
-      stderr.push(Buffer.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk));
+      stderr.write(chunk);
     });
     child.on("error", reject);
     child.on("close", (code) => {
-      resolvePromise({
-        code: code ?? 1,
-        stdout: stdout.join(""),
-        stderr: stderr.join("")
-      });
+      stdout.end();
+      stderr.end();
+      resolvePromise(code ?? 1);
     });
   });
 }
+function redactingLineWriter(destination, redactions) {
+  const decoder = new StringDecoder("utf8");
+  let buffered = "";
+  const flushCompleteLines = () => {
+    let newline = buffered.indexOf(`
+`);
+    while (newline !== -1) {
+      destination.write(redactValues2(buffered.slice(0, newline + 1), redactions));
+      buffered = buffered.slice(newline + 1);
+      newline = buffered.indexOf(`
+`);
+    }
+  };
+  return {
+    write: (chunk) => {
+      buffered += decoder.write(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      flushCompleteLines();
+    },
+    end: () => {
+      buffered += decoder.end();
+      flushCompleteLines();
+      if (buffered.length > 0) {
+        destination.write(redactValues2(buffered, redactions));
+        buffered = "";
+      }
+    }
+  };
+}
 function redactValues2(content, values) {
   let redacted = content;
   const ordered = [...new Set(values)].filter((value) => value.length > 0).sort((left, right) => right.length - left.length);
@@ -5118,7 +5340,7 @@ function redactValues2(content, values) {
   }
   return redacted;
 }
-async function readStdinText(stdin) {
+async function readStdinText2(stdin) {
   const chunks = [];
   for await (const chunk of stdin) {
     chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
@@ -5257,7 +5479,7 @@ async function runCli(options) {
     const explicitGemRef = parsed.flags.gem ?? envGemId;
     const apiUrl = parsed.flags.apiUrl ?? envApiUrl ?? config.apiUrl ?? DEFAULT_API_URL;
     const token = flagToken ?? envToken ?? await resolveStoredToken(credentialStore, apiUrl, config);
-    const cwd = parsed.flags.cwd ?? options.env?.["PWD"] ?? process.cwd();
+    const cwd = parsed.flags.cwd ?? process.cwd();
     const linkedProjectFromDisk = await readLinkedProject(cwd);
     const linkedProject = explicitGemRef === undefined ? linkedProjectFromDisk : linkedProjectWithExplicitGemRef(linkedProjectFromDisk, explicitGemRef);
     const workspace = parsed.flags.workspace ?? envWorkspace ?? linkedProject.workspaceId ?? config.workspace;
@@ -5594,14 +5816,14 @@ function writeSystemClipboard(text) {
   const platform = process.platform;
   const command = platform === "darwin" ? "pbcopy" : platform === "win32" ? "clip" : "xclip";
   const args = platform === "linux" ? ["-selection", "clipboard"] : [];
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const child = spawn3(command, args, { stdio: ["pipe", "ignore", "ignore"] });
     child.on("error", (error) => {
       reject(new CliError("Could not copy login URL to clipboard. Re-run without --clipboard to print the URL.", { cause: error }));
     });
     child.on("close", (code) => {
       if (code === 0) {
-        resolve5();
+        resolve6();
         return;
       }
       reject(new CliError(`Could not copy login URL to clipboard (${command} exited ${code ?? "unknown"}). Re-run without --clipboard to print the URL.`));

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@uru-intelligence/cli",
-    "version": "0.3.54",
+    "version": "0.3.56",
     "private": false,
     "description": "Uru full-platform command line interface",
     "type": "module",
@@ -31,13 +31,13 @@
     },
     "devDependencies": {
         "@uru/platform-operations": "workspace:*",
-        "@types/node": "24.13.2",
+        "@types/node": "24.13.3",
         "bun-types": "1.3.13",
-        "typescript": "7.0.1-rc"
+        "typescript": "7.0.2"
     },
     "packageManager": "bun@1.3.13",
     "engines": {
-        "node": "24.13.0"
+        "node": ">=24"
     },
     "files": [
         "dist",