@workbench-ai/workbench 0.0.68 → 0.0.70

package/dist/index.js

@@ -4,107 +4,125 @@ import { createRequire } from "node:module";
 import os from "node:os";
 import path from "node:path";
 import { gzipSync } from "node:zlib";
-import { addWorkbenchCase, addWorkbenchRemote, addWorkbenchAgent, checkWorkbenchSkill, compareWorkbench, createWorkbenchAdapterAuthBundle, createWorkbenchInspectionSnapshot, diffWorkbenchVersions, evalWorkbenchSkill, filesForWorkbenchRef, improveWorkbenchSkill, initWorkbenchSkill, listWorkbenchCases, listWorkbenchRemotes, listWorkbenchAgents, listWorkbenchVersions, localWorkbenchAdapterAuthStore, parseWorkbenchAdapterAuthTarget, publishWorkbenchVersion, removeWorkbenchCase, removeWorkbenchAgent, setDefaultWorkbenchAgent, showWorkbenchCase, showWorkbenchRef, switchWorkbenchVersion, syncWorkbenchRemote, workbenchStatus, WorkbenchUserError, } from "@workbench-ai/workbench-core";
+import { addWorkbenchCase, addWorkbenchRemote, addWorkbenchAgent, compareWorkbench, createWorkbenchAdapterAuthBundle, createWorkbenchReadOnlyInspectionSnapshot, diffWorkbenchVersions, evalWorkbenchSkill, improveWorkbenchSkill, initWorkbenchSkill, listWorkbenchCases, listWorkbenchAgents, listWorkbenchVersions, localWorkbenchAdapterAuthStore, parseWorkbenchAdapterAuthTarget, publishWorkbenchVersion, removeWorkbenchCase, removeWorkbenchAgent, showWorkbenchRef, switchWorkbenchVersion, syncWorkbenchRemote, workbenchJobEvidenceForSnapshot, workbenchStatusSnapshot, WorkbenchCodedError, WorkbenchUserError, } from "@workbench-ai/workbench-core";
+import { normalizeWorkbenchSkillName } from "@workbench-ai/workbench-contract";
+import { emitError, emitResult } from "./output.js";
+import { installSnapshotToTargets, installTargetsToJson, normalizeInstallSnapshotPath, resolveInstallTargets, supportedInstallTargets, } from "./install-targets.js";
 import { startWorkbenchOpenServer } from "./open-server.js";
 const require = createRequire(import.meta.url);
 const HELP = [
     "Usage:",
+    "  workbench [--json]",
     "  workbench <command> [options]",
     "",
-    "Skill lifecycle:",
-    "  workbench init [DIR] [--json]",
-    "  workbench status [--dir DIR] [--json]",
-    "  workbench check [--dir DIR] [--json]",
-    "  workbench versions [--dir DIR] [--json]",
-    "  workbench switch VERSION [--dir DIR] [--json]",
-    "  workbench diff [A..B] [--dir DIR] [--json]",
-    "  workbench sync [REMOTE] [--dir DIR] [--json]",
+    "Bare workbench prints project status and the next useful command.",
     "",
-    "Evaluate and improve:",
-    "  workbench eval [VERSION] [--skill SKILL|all] [--agent AGENT|all] [--samples N] [--rerun] [--json]",
-    "  workbench improve [VERSION] [--skill primary] [--agent AGENT] [--budget N] [--samples N] [--json]",
+    "Taught commands:",
+    "  workbench new [DIR] [--json]",
+    "  workbench eval [VERSION] [--skills all|LIST] [--agents all|LIST] [-n N|--samples N] [--rerun] [--cloud] [--json]",
+    "  workbench improve [VERSION] [--skills LIST] [--agents LIST] [--budget N] [-n N|--samples N] [--cloud] [--json]",
     "  workbench compare [--skills all|LIST] [--agents all|LIST] [--versions all|A..B|LIST] [--json]",
-    "  workbench retry RUN_ID [--json]",
+    "  workbench publish [VERSION] [--as OWNER/SKILL] [--private|--team|--public] [--dry-run] [--json]",
+    "  workbench install HANDLE_OR_URL [--to codex|claude|local]... [--yes] [--list] [--dry-run] [--json]",
     "",
-    "Evidence:",
-    "  workbench show REF[:PATH] [--json]",
-    "  workbench files REF [--json]",
-    "  workbench list runs|jobs|traces|artifacts|sessions|remotes [--json]",
-    "  workbench trace RUN_ID|JOB_ID|TRACE_ID [--json]",
+    "More:",
+    "  workbench help --all",
+].join("\n");
+const HELP_ALL = [
+    "Usage:",
+    "  workbench                          # = workbench status",
+    "  workbench new [DIR] [--json]",
+    "  workbench eval [VERSION] [--skills all|LIST] [--agents all|LIST] [-n N|--samples N] [--rerun] [--cloud] [--json]",
+    "  workbench compare [--skills all|LIST] [--agents all|LIST] [--versions all|A..B|LIST] [--json]",
+    "  workbench improve [VERSION] [--skills LIST] [--agents LIST] [--budget N] [-n N|--samples N] [--cloud] [--json]",
+    "  workbench publish [VERSION] [--as OWNER/SKILL] [--private|--team|--public] [--dry-run] [--json]",
+    "  workbench install HANDLE_OR_URL [--to codex|claude|local]... [--yes] [--list] [--dry-run] [--json]",
     "",
-    "Configuration and sync:",
-    "  workbench agent list|add|show|default|remove ...",
-    "  workbench skills list",
-    "  workbench case list|add|show|remove ...",
-    "  workbench remote add origin URL",
-    "  workbench remote list",
-    "  workbench auth status [ADAPTER[/SLOT]] [--profile PROFILE] [--json]",
-    "  workbench auth connect ADAPTER[/SLOT] [--method METHOD] [--profile PROFILE] [--profile-root DIR] [--local-only] [--json]",
-    "  workbench auth disconnect ADAPTER[/SLOT] [--profile PROFILE] [--local-only] [--json]",
-    "  workbench login [--base-url URL] [--no-open] [--json]",
-    "  workbench logout [--json]",
-    "  workbench publish [VERSION] [--visibility private|public] [--json]",
+    "Inspect:",
+    "  workbench status [--dir DIR] [--json]",
+    "  workbench log [--runs|--versions] [--json]",
+    "  workbench show REF[:PATH] [--json]",
+    "  workbench diff [A..B] [--json]",
+    "  workbench switch VERSION [--json]",
     "  workbench open [--host HOST] [--port PORT] [--no-open] [--json]",
     "",
-    "Examples:",
-    "  workbench init ./earnings-prep",
-    "  workbench eval --agent default --samples 1",
-    "  workbench versions",
-    "  workbench switch v001",
-    "  workbench retry run_000002 --json",
-    "  workbench show trace_job_000002:stderr.log",
-    "  workbench auth connect codex --method api-key",
-    "  workbench publish --visibility public",
+    "Configure:",
+    "  workbench case add [RUN_ID] | list | rm ID [--json]",
+    "  workbench agent add NAME --adapter X [--model M] [--with k=v]... | list | rm NAME [--json]",
+    "",
+    "Share and auth:",
+    "  workbench login [PROVIDER] [--method METHOD] [--profile P] [--base-url URL] [--start-only|--wait] [--timeout N] [--no-open] [--local-only] [--json]",
+    "  workbench logout [PROVIDER] [--json]",
+    "  workbench sync [REMOTE] [--dry-run] [--json]",
     "",
-    "Environment:",
-    "  CODEX_HOME and CLAUDE_HOME override read-only session discovery roots.",
-    "  WORKBENCH_API_URL selects a Workbench Cloud API base URL for login, auth, and HTTP remotes.",
+    "Remote URLs:",
+    "  https://HOST/skills/OWNER/SKILL  Workbench Cloud skill remote",
+    "  file:///absolute/path            local file remote for plumbing sync",
 ].join("\n");
 const COMMAND_HELP = {
-    auth: [
+    new: [
         "Usage:",
-        "  workbench auth status [ADAPTER[/SLOT]] [--profile PROFILE] [--json]",
-        "  workbench auth connect ADAPTER[/SLOT] [--method api-key|oauth|bedrock] [--profile PROFILE] [--profile-root DIR] [--local-only] [--json]",
-        "  workbench auth disconnect ADAPTER[/SLOT] [--profile PROFILE] [--local-only] [--json]",
+        "  workbench new [DIR] [--json]",
         "",
-        "Stores adapter credentials locally and uploads them to Workbench Cloud when logged in unless --local-only is passed. Codex supports oauth and api-key. Claude supports oauth, api-key, and bedrock.",
+        "Creates a Workbench skill project.",
     ].join("\n"),
     eval: [
         "Usage:",
-        "  workbench eval [VERSION] [--skill SKILL|all] [--agent AGENT|all] [--samples N] [--rerun] [--json]",
+        "  workbench eval [VERSION] [--skills all|LIST] [--agents all|LIST] [-n N|--samples N] [--rerun] [--cloud] [--json]",
         "",
-        "Runs local eval jobs for the selected version, skill, and agent.",
+        "Runs eval jobs for the selected version, measured skills, and agents. Omitted selectors use manifest defaults.",
     ].join("\n"),
     improve: [
         "Usage:",
-        "  workbench improve [VERSION] [--agent AGENT] [--budget N] [--samples N] [--json]",
+        "  workbench improve [VERSION] [--skills LIST] [--agents LIST] [--budget N] [-n N|--samples N] [--cloud] [--json]",
+        "",
+        "Creates one improved child version from evidence. The selected skills and agents must resolve to exactly one entry each.",
+    ].join("\n"),
+    compare: [
+        "Usage:",
+        "  workbench compare [--skills all|LIST] [--agents all|LIST] [--versions all|A..B|LIST] [--json]",
+        "",
+        "Compares recorded eval evidence across selected skills, agents, and versions.",
+    ].join("\n"),
+    install: [
+        "Usage:",
+        "  workbench install HANDLE_OR_URL [--to codex|claude|local]... [--yes] [--list] [--dry-run] [--json]",
+        "",
+        "Installs published Workbench Cloud source into local agent targets.",
         "",
-        "Creates an improved child version from evidence and switches to it when it beats the incumbent.",
+        "Example:",
+        "  workbench install acme/earnings-prep --to codex --yes",
     ].join("\n"),
-    retry: [
+    status: [
         "Usage:",
-        "  workbench retry RUN_ID [--json]",
+        "  workbench status [--dir DIR] [--json]",
         "",
-        "Retries failed jobs from a prior run by replaying only their case/sample pairs locally.",
+        "Reports project, worktree, run, per-remote sync/publication, and auth state. --json emits the workbench.status.v1 dashboard.",
+    ].join("\n"),
+    logout: [
+        "Usage:",
+        "  workbench logout [PROVIDER] [--json]",
+        "",
+        "With no provider, logs out of Workbench Cloud. With a provider such as codex or claude, removes local adapter auth.",
     ].join("\n"),
     show: [
         "Usage:",
         "  workbench show REF [--json]",
         "  workbench show REF:PATH [--json]",
         "",
-        "Shows a Workbench object or a file inside a version, trace, or artifact.",
+        "Shows a Workbench object, lists files for file-backed objects, or prints one file.",
     ].join("\n"),
-    list: [
+    log: [
         "Usage:",
-        "  workbench list runs|jobs|traces|artifacts|sessions|remotes [--json]",
+        "  workbench log [--runs|--versions] [--json]",
         "",
-        "Lists Workbench evidence, remotes, or read-only native Codex/Claude session files.",
+        "Shows one reverse-chronological timeline of versions and runs.",
     ].join("\n"),
-    versions: [
+    diff: [
         "Usage:",
-        "  workbench versions [--json]",
+        "  workbench diff [A..B] [--json]",
         "",
-        "Lists Workbench skill versions.",
+        "Shows changed files between two Workbench source versions.",
     ].join("\n"),
     switch: [
         "Usage:",
@@ -112,116 +130,129 @@ const COMMAND_HELP = {
         "",
         "Switches the working skill source to a recorded Workbench version.",
     ].join("\n"),
+    open: [
+        "Usage:",
+        "  workbench open [--host HOST] [--port PORT] [--no-open] [--json]",
+        "",
+        "Serves or emits the read-only Workbench inspection snapshot.",
+    ].join("\n"),
+    case: [
+        "Usage:",
+        "  workbench case list [--json]",
+        "  workbench case add [RUN_ID] [--json]",
+        "  workbench case rm ID [--json]",
+        "",
+        "Lists cases, creates a draft case, or removes a case.",
+    ].join("\n"),
+    agent: [
+        "Usage:",
+        "  workbench agent list [--json]",
+        "  workbench agent add NAME --adapter X [--model M] [--with k=v]... [--json]",
+        "  workbench agent rm NAME [--json]",
+        "",
+        "Lists, adds, or removes eval agent configurations.",
+    ].join("\n"),
     sync: [
         "Usage:",
-        "  workbench sync [REMOTE] [--json]",
+        "  workbench sync [REMOTE] [--dry-run] [--dir DIR] [--json]",
         "",
-        "Synchronizes local evidence and version objects with a Workbench remote.",
+        "Plumbing command: synchronizes local evidence and version objects with a Workbench remote.",
     ].join("\n"),
     publish: [
         "Usage:",
-        "  workbench publish [VERSION] [--visibility private|public] [--json]",
+        "  workbench publish [VERSION] [--as OWNER/SKILL] [--private|--team|--public] [--dry-run] [--dir DIR] [--json]",
         "",
-        "Publishes installable skill source from the selected version to a Workbench source remote.",
+        "Publishes installable skill source to Workbench Cloud. --as sets the linked OWNER/SKILL handle.",
     ].join("\n"),
     login: [
         "Usage:",
-        "  workbench login [--base-url URL] [--no-open] [--json]",
-        "  workbench logout [--json]",
+        "  workbench login [PROVIDER] [--method METHOD] [--profile P] [--base-url URL] [--start-only|--wait] [--timeout N] [--no-open] [--local-only] [--json]",
+        "  workbench logout [PROVIDER] [--json]",
         "",
-        "Connects the CLI to Workbench Cloud with the device login flow.",
+        "Connects the CLI to Workbench Cloud or captures local adapter auth for a provider.",
     ].join("\n"),
 };
-const BOOLEAN_FLAGS = new Set([
-    "help",
-    "json",
-    "local-only",
-    "no-open",
-    "rerun",
-]);
-const FLAG_DEFINITIONS = {
-    adapter: "string",
-    "base-url": "string",
-    budget: "positive-integer",
+const COMMON_FLAGS = {
+    json: "boolean",
+};
+const PROJECT_FLAGS = {
+    ...COMMON_FLAGS,
     dir: "string",
-    from: "string",
+};
+const HELP_FLAG = {
     help: "boolean",
-    host: "string",
-    json: "boolean",
-    "local-only": "boolean",
-    method: "string",
-    model: "string",
-    "no-open": "boolean",
-    port: "positive-integer",
-    profile: "string",
-    "profile-root": "string",
-    rerun: "boolean",
-    samples: "positive-integer",
-    agent: "string",
-    agents: "string",
-    skill: "string",
-    skills: "string",
+};
+const VERSION_FLAG = {
     version: "boolean",
-    versions: "string",
-    visibility: "string",
-    with: "repeat-string",
 };
 const COMMAND_FLAGS = {
-    check: ["dir", "json"],
-    compare: ["agents", "dir", "json", "skills", "versions"],
-    diff: ["dir", "json"],
-    eval: ["agent", "dir", "json", "rerun", "samples", "skill"],
-    files: ["dir", "json"],
-    improve: ["agent", "budget", "dir", "json", "samples", "skill"],
-    init: ["dir", "json"],
-    list: ["dir", "json"],
-    login: ["base-url", "json", "no-open"],
-    logout: ["json"],
-    open: ["dir", "host", "json", "no-open", "port"],
-    publish: ["dir", "json", "visibility"],
-    retry: ["dir", "json"],
-    show: ["dir", "json"],
-    status: ["dir", "json"],
-    switch: ["dir", "json"],
-    sync: ["dir", "json"],
-    trace: ["dir", "json"],
-    versions: ["dir", "json"],
-};
-const SUBCOMMAND_FLAGS = {
-    auth: {
-        defaultSubcommand: "status",
-        flags: {
-            status: ["json", "profile"],
-            connect: ["json", "local-only", "method", "profile", "profile-root"],
-            disconnect: ["json", "local-only", "profile"],
-        },
+    compare: { ...PROJECT_FLAGS, ...HELP_FLAG, agents: "string", skills: "string", versions: "string" },
+    diff: { ...PROJECT_FLAGS, ...HELP_FLAG },
+    eval: {
+        ...PROJECT_FLAGS,
+        ...HELP_FLAG,
+        agents: "string",
+        cloud: "boolean",
+        rerun: "boolean",
+        samples: "positive-integer",
+        skills: "string",
     },
-    case: {
-        flags: {
-            list: ["dir", "json"],
-            add: ["dir", "from", "json"],
-            show: ["dir", "json"],
-            remove: ["dir", "json"],
-        },
+    help: { ...COMMON_FLAGS, ...HELP_FLAG, all: "boolean" },
+    improve: {
+        ...PROJECT_FLAGS,
+        ...HELP_FLAG,
+        agents: "string",
+        budget: "positive-integer",
+        cloud: "boolean",
+        samples: "positive-integer",
+        skills: "string",
     },
-    remote: {
-        flags: {
-            add: ["dir", "json"],
-            list: ["dir", "json"],
-        },
+    install: { ...COMMON_FLAGS, ...HELP_FLAG, "dry-run": "boolean", list: "boolean", to: "repeat-string", yes: "boolean" },
+    log: { ...PROJECT_FLAGS, ...HELP_FLAG, runs: "boolean", versions: "boolean" },
+    login: {
+        ...COMMON_FLAGS,
+        ...HELP_FLAG,
+        "base-url": "string",
+        "local-only": "boolean",
+        method: "string",
+        "no-open": "boolean",
+        profile: "string",
+        "profile-root": "string",
+        "start-only": "boolean",
+        timeout: "positive-integer",
+        wait: "boolean",
+    },
+    logout: { ...COMMON_FLAGS, ...HELP_FLAG },
+    new: { ...PROJECT_FLAGS, ...HELP_FLAG },
+    open: { ...PROJECT_FLAGS, ...HELP_FLAG, host: "string", "no-open": "boolean", port: "positive-integer" },
+    publish: {
+        ...PROJECT_FLAGS,
+        ...HELP_FLAG,
+        as: "string",
+        "dry-run": "boolean",
+        private: "boolean",
+        public: "boolean",
+        team: "boolean",
     },
-    skills: {
+    show: { ...PROJECT_FLAGS, ...HELP_FLAG },
+    status: { ...PROJECT_FLAGS, ...HELP_FLAG },
+    switch: { ...PROJECT_FLAGS, ...HELP_FLAG },
+    sync: { ...PROJECT_FLAGS, ...HELP_FLAG, "dry-run": "boolean" },
+    version: { ...COMMON_FLAGS, ...VERSION_FLAG },
+};
+const SUBCOMMAND_FLAGS = {
+    case: {
         flags: {
-            list: ["dir", "json"],
+            list: { ...PROJECT_FLAGS, ...HELP_FLAG },
+            add: { ...PROJECT_FLAGS, ...HELP_FLAG },
+            rm: { ...PROJECT_FLAGS, ...HELP_FLAG },
         },
     },
     agent: {
         flags: {
-            list: ["dir", "json"],
-            add: ["adapter", "dir", "json", "model", "with"],
-            show: ["dir", "json"],
-            default: ["dir", "json"],
-            remove: ["dir", "json"],
+            list: { ...PROJECT_FLAGS, ...HELP_FLAG },
+            add: { ...PROJECT_FLAGS, ...HELP_FLAG, adapter: "string", model: "string", with: "repeat-string" },
+            rm: { ...PROJECT_FLAGS, ...HELP_FLAG },
         },
     },
 };
@@ -232,61 +263,85 @@ export async function runCli(argv, io = {
     const parsed = parseArgs(argv);
     const command = parsed.positionals[0];
     try {
-        if (command === "--version" || command === "-v" || command === "version" || parsed.flags.version === true) {
+        validateCommandFlags(parsed, command);
+        if (command === "version" || parsed.flags.version === true) {
             io.stdout.write(`workbench ${getCliVersion()}\n`);
             return 0;
         }
-        if (!command || command === "help" || command === "--help" || command === "-h") {
+        if (command === "help") {
             const helpCommand = command === "help" ? optionalPositional(parsed, 1) : undefined;
-            io.stdout.write(`${helpCommand ? commandHelp(helpCommand) : HELP}\n`);
+            io.stdout.write(`${parsed.flags.all === true ? HELP_ALL : helpCommand ? commandHelp(helpCommand) : HELP}\n`);
             return 0;
         }
         if (parsed.flags.help === true) {
-            io.stdout.write(`${commandHelp(command)}\n`);
+            io.stdout.write(`${command ? commandHelp(command) : HELP}\n`);
             return 0;
         }
-        validateCommandFlags(parsed, command);
-        const core = await coreOptions(parsed);
+        if (!command) {
+            return await handleStatus(parsed, io);
+        }
         if (command === "login") {
             return await handleLogin(parsed, io);
         }
         if (command === "logout") {
             return await handleLogout(parsed, io);
         }
-        if (command === "init") {
+        if (command === "install") {
+            return await handleInstall(parsed, io);
+        }
+        const core = await coreOptions(parsed);
+        if (command === "new") {
             const status = await initWorkbenchSkill({ dir: parsed.positionals[1] ?? dirFlag(parsed) });
-            return output(status, parsed, io, () => `Initialized Workbench skill at ${status.root}.`);
+            return output(status, parsed, io, () => `Created Workbench skill at ${status.root}.\nnext: edit SKILL.md, then run workbench eval`);
         }
         if (command === "status") {
-            const status = await workbenchStatus(core);
-            return output(status, parsed, io, () => formatStatus(status));
-        }
-        if (command === "check") {
-            const result = await checkWorkbenchSkill(core);
-            return output(result, parsed, io, () => formatCheck(result));
+            return await handleStatus(parsed, io);
         }
         if (command === "eval") {
+            if (parsed.flags.cloud === true) {
+                return await handleCloudEval(parsed, io);
+            }
             const runs = await evalWorkbenchSkill({
                 ...core,
                 version: optionalPositional(parsed, 1),
-                skill: stringFlag(parsed, "skill"),
-                agent: stringFlag(parsed, "agent"),
+                skill: stringFlag(parsed, "skills"),
+                agent: stringFlag(parsed, "agents"),
                 samples: intFlag(parsed, "samples"),
                 rerun: parsed.flags.rerun === true,
             });
-            const code = output(runs, parsed, io, () => runs.map(formatRun).join("\n"));
-            return runs.some((run) => run.status === "failed" || run.status === "canceled") ? 1 : code;
+            const artifactIds = await artifactIdsByRunId(core, runs);
+            const failedRuns = runs.filter((run) => run.status === "failed" || run.status === "canceled");
+            if (failedRuns.length > 0) {
+                return emitEvalFailure(runs, failedRuns, artifactIds, parsed, io);
+            }
+            const deltas = await evalDeltas(core, runs);
+            const nextCommands = evalSuccessNextCommands(runs);
+            return emitResult("workbench.cli.eval.v1", {
+                result: runs.map((run) => runSummary(run, artifactIds.get(run.id) ?? [])),
+                deltas: deltas,
+                nextCommands: nextCommands,
+            }, parsed, io, () => [
+                runs.map(formatRun).join("\n"),
+                ...deltas.map(formatEvalDelta),
+                ...(nextCommands[0] ? [`next: ${nextCommands[0]}`] : []),
+            ].filter(Boolean).join("\n"));
         }
         if (command === "improve") {
+            if (parsed.flags.cloud === true) {
+                return await handleCloudImprove(parsed, io);
+            }
             const result = await improveWorkbenchSkill({
                 ...core,
                 version: optionalPositional(parsed, 1),
-                skill: stringFlag(parsed, "skill"),
-                agent: stringFlag(parsed, "agent"),
+                skill: stringFlag(parsed, "skills"),
+                agent: stringFlag(parsed, "agents"),
                 budget: intFlag(parsed, "budget"),
                 samples: intFlag(parsed, "samples"),
             });
-            return output(result, parsed, io, () => formatImproveResult(result));
+            return output({
+                ...result,
+                version: versionSummary(result.version),
+            }, parsed, io, () => `${formatImproveResult(result)}\nnext: workbench eval`);
         }
         if (command === "compare") {
             const comparison = await compareWorkbench({
@@ -297,158 +352,209 @@ export async function runCli(argv, io = {
             });
             return output(comparison, parsed, io, () => formatComparison(comparison));
         }
-        if (command === "retry") {
-            const runId = requiredPositional(parsed, 1, "workbench retry requires RUN_ID.");
-            const snapshot = await createWorkbenchInspectionSnapshot(core);
-            const run = snapshot.runs.find((entry) => entry.id === runId);
-            if (!run) {
-                throw new WorkbenchUserError(`Run not found: ${runId}`);
-            }
-            const retrySelection = retrySamplesForFailedJobs(snapshot.jobs, run);
-            const retry = await evalWorkbenchSkill({
-                ...core,
-                version: run.versionId,
-                skill: run.skillName,
-                agent: run.agentName,
-                kind: "retry",
-                parentRunId: run.id,
-                samples: retrySelection.samples,
-                selectedSamples: retrySelection.selectedSamples,
-            });
-            const code = output(retry, parsed, io, () => retry.map(formatRun).join("\n"));
-            return retry.some((entry) => entry.status === "failed" || entry.status === "canceled") ? 1 : code;
-        }
-        if (command === "versions") {
-            const versions = await listWorkbenchVersions(core);
-            return output(versions, parsed, io, () => versions.map(formatVersion).join("\n") || "No versions.");
-        }
         if (command === "switch") {
             const versionRef = requiredPositional(parsed, 1, "workbench switch requires VERSION.");
             const version = await switchWorkbenchVersion(versionRef, core);
-            return output(version, parsed, io, () => `Switched to ${version.id}.`);
+            return output(versionSummary(version), parsed, io, () => `Switched to ${version.id}.`);
         }
         if (command === "diff") {
-            const range = requiredPositional(parsed, 1, "workbench diff requires A..B.");
+            const range = optionalPositional(parsed, 1) ?? await defaultDiffRange(core);
             const diffs = await diffWorkbenchVersions(range, core);
             return output(diffs, parsed, io, () => diffs.map((entry) => `${entry.status}\t${entry.path}`).join("\n") || "No diff.");
         }
         if (command === "show") {
-            const ref = requiredPositional(parsed, 1, "workbench show requires REF.");
-            const session = await showLocalAgentSession(ref);
-            if (session) {
-                return output(session, parsed, io, () => formatSessionDetail(session));
-            }
-            const value = await showWorkbenchRef(ref, core);
-            return output(value, parsed, io, () => formatShow(value));
-        }
-        if (command === "files") {
-            const ref = requiredPositional(parsed, 1, "workbench files requires REF.");
-            const files = await filesForWorkbenchRef(ref, core);
-            return output(files, parsed, io, () => files.map((file) => file.path).join("\n") || "No files.");
-        }
-        if (command === "list") {
-            return await handleList(parsed, io);
-        }
-        if (command === "trace") {
-            const ref = requiredPositional(parsed, 1, "workbench trace requires RUN_ID or TRACE_ID.");
-            const snapshot = await createWorkbenchInspectionSnapshot(core);
-            const run = snapshot.runs.find((entry) => entry.id === ref);
-            const job = snapshot.jobs.find((entry) => entry.id === ref);
-            const traces = run
-                ? snapshot.traces.filter((trace) => run.traceIds.includes(trace.id))
-                : job
-                    ? snapshot.traces.filter((trace) => job.traceIds.includes(trace.id))
-                    : snapshot.traces.filter((trace) => trace.id === ref);
-            if (traces.length === 0) {
-                throw new WorkbenchUserError(`Trace not found: ${ref}`);
-            }
-            return output(traces, parsed, io, () => traces.map(formatTrace).join("\n"));
+            return await handleShow(parsed, io);
+        }
+        if (command === "log") {
+            return await handleLog(parsed, io);
         }
         if (command === "agent") {
             return await handleAgent(parsed, io);
         }
-        if (command === "skills") {
-            return await handleSkills(parsed, io);
-        }
         if (command === "case") {
             return await handleCase(parsed, io);
         }
-        if (command === "remote") {
-            return await handleRemote(parsed, io);
-        }
         if (command === "sync") {
             const result = await syncWorkbenchRemote({
                 ...core,
                 remote: optionalPositional(parsed, 1),
+                dryRun: parsed.flags["dry-run"] === true,
             });
-            return output(result, parsed, io, () => `Synced ${result.remote.name}: pushed ${result.pushed}, pulled ${result.pulled}.`);
+            return emitResult("workbench.cli.sync.v1", {
+                remote: result.remote,
+                pushed: result.pushed,
+                pulled: result.pulled,
+                upToDate: result.upToDate,
+                publication: result.publication,
+                ...(result.dryRun ? { dryRun: true } : {}),
+            }, parsed, io, () => `${result.dryRun ? "Would sync" : "Synced"} ${result.remote.name}: pushed ${result.pushed}, pulled ${result.pulled}${result.upToDate ? " (up to date)" : ""}.`);
         }
         if (command === "publish") {
+            const preview = parsed.flags["dry-run"] === true && !stringFlag(parsed, "as")
+                ? await previewPublishWithDerivedRemote(parsed)
+                : undefined;
+            if (preview) {
+                return emitResult("workbench.cli.publish.v1", {
+                    remote: preview.remote,
+                    version: versionSummary(preview.version),
+                    visibility: preview.visibility,
+                    installHandle: preview.installHandle,
+                    installUrl: preview.installUrl,
+                    pinnedInstallUrl: preview.pinnedInstallUrl,
+                    dryRun: true,
+                }, parsed, io, () => [
+                    `Would publish ${preview.version.id} to remote ${preview.remote.name}.`,
+                    `Visibility: ${preview.visibility}`,
+                    `Install: ${preview.installUrl}`,
+                    `Pinned: ${preview.pinnedInstallUrl}`,
+                    `next: workbench install ${preview.installHandle}`,
+                ].join("\n"));
+            }
+            const remote = await ensurePublishRemote(parsed);
             const result = await publishWorkbenchVersion({
                 ...core,
                 version: optionalPositional(parsed, 1),
-                visibility: parsePublishVisibility(stringFlag(parsed, "visibility")),
+                remote,
+                dryRun: parsed.flags["dry-run"] === true,
+                visibility: parsePublishVisibilityFlags(parsed),
             });
-            return output(result, parsed, io, () => `Published ${result.version.id} to ${result.installUrl}.`);
-        }
-        if (command === "auth") {
-            return await handleAuth(parsed, io);
+            return emitResult("workbench.cli.publish.v1", {
+                remote: result.remote,
+                version: versionSummary(result.version),
+                visibility: result.visibility,
+                installHandle: result.installHandle,
+                installUrl: result.installUrl,
+                pinnedInstallUrl: result.pinnedInstallUrl,
+                ...(result.dryRun ? { dryRun: true } : {}),
+            }, parsed, io, () => [
+                `${result.dryRun ? "Would publish" : "Published"} ${result.version.id} to remote ${result.remote.name}.`,
+                `Visibility: ${result.visibility}`,
+                `Install: ${result.installUrl}`,
+                `Pinned: ${result.pinnedInstallUrl}`,
+                `next: workbench install ${result.installHandle}`,
+            ].join("\n"));
         }
         if (command === "open") {
-            const snapshot = await createWorkbenchInspectionSnapshot(core);
-            if (parsed.flags.json !== true) {
-                const server = await startWorkbenchOpenServer({
-                    dir: dirFlag(parsed),
-                    authToken: core.authToken,
-                    host: stringFlag(parsed, "host"),
-                    port: intFlag(parsed, "port"),
-                });
-                io.stdout.write(`Workbench: ${server.url}\n`);
-                if (parsed.flags["no-open"] !== true) {
-                    await openBrowser(server.url).catch(() => undefined);
-                }
-                await new Promise(() => { });
+            if (parsed.flags.json === true) {
+                const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(core);
+                return output(snapshot, parsed, io, () => "Read-only Workbench inspection data is available with --json.");
             }
-            return output(snapshot, parsed, io, () => "Read-only Workbench inspection data is available with --json.");
+            // The browser server serves committed object state through a read-only
+            // snapshot path, so long-running commands do not block page loads.
+            const server = await startWorkbenchOpenServer({
+                dir: dirFlag(parsed),
+                authToken: core.authToken,
+                host: stringFlag(parsed, "host"),
+                port: intFlag(parsed, "port"),
+            });
+            io.stdout.write(`Workbench: ${server.url}\n`);
+            if (parsed.flags["no-open"] !== true) {
+                await openBrowser(server.url).catch(() => undefined);
+            }
+            return await new Promise(() => { });
         }
         throw new WorkbenchUserError(`Unknown command: ${command}\n\n${HELP}`);
     }
     catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        if (parsed.flags.json === true) {
-            io.stdout.write(`${JSON.stringify({ ok: false, error: message }, null, 2)}\n`);
-            return error instanceof WorkbenchUserError ? 2 : 1;
-        }
-        io.stderr.write(`${message}\n`);
-        return error instanceof WorkbenchUserError ? 2 : 1;
-    }
-}
-async function handleList(parsed, io) {
-    const kind = requiredPositional(parsed, 1, "workbench list requires runs|jobs|traces|artifacts|sessions|remotes.");
-    if (kind === "sessions") {
-        const sessions = await listLocalAgentSessions();
-        return output(sessions, parsed, io, () => sessions.map(formatSession).join("\n") || "No local sessions.");
-    }
-    const snapshot = await createWorkbenchInspectionSnapshot(await coreOptions(parsed));
-    if (kind === "runs") {
-        return output(snapshot.runs, parsed, io, () => snapshot.runs.map(formatRun).join("\n") || "No runs.");
-    }
-    if (kind === "jobs") {
-        return output(snapshot.jobs, parsed, io, () => snapshot.jobs.map(formatJob).join("\n") || "No jobs.");
-    }
-    if (kind === "traces") {
-        return output(snapshot.traces, parsed, io, () => snapshot.traces.map(formatTrace).join("\n") || "No traces.");
-    }
-    if (kind === "artifacts") {
-        return output(snapshot.artifacts, parsed, io, () => snapshot.artifacts.map(formatArtifact).join("\n") || "No artifacts.");
+        return emitError(error, parsed, io);
+    }
+}
+async function handleStatus(parsed, io) {
+    const status = await workbenchStatusSnapshot(await coreOptions(parsed));
+    const auth = await workbenchCliAuthStatus();
+    return emitResult("workbench.status.v1", {
+        project: status.project,
+        worktree: status.worktree,
+        runs: status.runs,
+        remotes: status.remotes,
+        auth: auth,
+        next: status.next,
+    }, parsed, io, () => formatStatusSnapshot({ ...status, auth }));
+}
+async function handleLog(parsed, io) {
+    if (parsed.flags.runs === true && parsed.flags.versions === true) {
+        throw new WorkbenchCodedError("usage", "workbench log accepts only one of --runs or --versions.", {
+            remediation: "Run workbench log --runs or workbench log --versions.",
+            exitCode: 2,
+        });
     }
-    if (kind === "remotes") {
-        return output(snapshot.remotes, parsed, io, () => snapshot.remotes.map((remote) => `${remote.name}\t${remote.url}`).join("\n") || "No remotes.");
+    if (parsed.positionals.length > 1) {
+        if (parsed.flags.runs === true) {
+            throw new WorkbenchUserError("--runs does not accept a value.");
+        }
+        if (parsed.flags.versions === true) {
+            throw new WorkbenchUserError("--versions does not accept a value.");
+        }
+        rejectExtraInput(parsed, {
+            maxPositionals: 1,
+            message: "workbench log does not accept refs or paths.",
+            remediation: "Run workbench log, workbench log --runs, or workbench log --versions.",
+        });
     }
-    throw new WorkbenchUserError(`Unsupported list target: ${kind}`);
+    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(await coreOptions(parsed));
+    const includeRuns = parsed.flags.versions !== true;
+    const includeVersions = parsed.flags.runs !== true;
+    const entries = [
+        ...(includeVersions ? snapshot.versions.map((version) => ({
+            kind: "version",
+            id: version.id,
+            createdAt: version.createdAt,
+            message: version.message,
+            fileCount: version.files.length,
+        })) : []),
+        ...(includeRuns ? snapshot.runs.map((run) => ({
+            kind: "run",
+            id: run.id,
+            createdAt: run.createdAt,
+            status: run.status,
+            versionId: run.versionId,
+            skillName: run.skillName,
+            agentName: run.agentName,
+            ...(run.score !== undefined ? { score: run.score } : {}),
+        })) : []),
+    ].sort((left, right) => right.createdAt.localeCompare(left.createdAt));
+    return emitResult("workbench.cli.log.v1", {
+        entries: entries,
+    }, parsed, io, () => entries.map(formatLogEntry).join("\n") || "No history.");
+}
+async function handleShow(parsed, io) {
+    const ref = requiredPositional(parsed, 1, "workbench show requires REF.");
+    const session = await showLocalAgentSession(ref);
+    if (session) {
+        return output(session, parsed, io, () => formatSessionDetail(session));
+    }
+    const core = await coreOptions(parsed);
+    const [objectRef, requestedPath] = splitShowRef(ref);
+    if (requestedPath) {
+        const runOrJobFile = await fileForRunOrJobRef(core, objectRef, requestedPath);
+        if (runOrJobFile) {
+            return output(runOrJobFile, parsed, io, () => formatShow(runOrJobFile));
+        }
+        const value = await showWorkbenchRef(ref, core);
+        return output(value, parsed, io, () => formatShow(value));
+    }
+    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(core);
+    const version = snapshot.versions.find((entry) => entry.id === objectRef);
+    if (version) {
+        return output(fileListing("version", version.id, version.files), parsed, io, () => formatFileListing("version", version.id, version.files));
+    }
+    const trace = snapshot.traces.find((entry) => entry.id === objectRef);
+    if (trace) {
+        return output(fileListing("trace", trace.id, trace.files), parsed, io, () => formatFileListing("trace", trace.id, trace.files));
+    }
+    const artifact = snapshot.artifacts.find((entry) => entry.id === objectRef);
+    if (artifact) {
+        return output(fileListing("artifact", artifact.id, artifact.files), parsed, io, () => formatFileListing("artifact", artifact.id, artifact.files));
+    }
+    const details = evidenceDetailsForRunOrJob(snapshot, objectRef);
+    if (details.length > 0) {
+        return output(details, parsed, io, () => details.map(formatTraceDetail).join("\n"));
+    }
+    const value = await showWorkbenchRef(ref, core);
+    return output(value, parsed, io, () => formatShow(value));
 }
 async function handleAgent(parsed, io) {
-    const subcommand = requiredPositional(parsed, 1, "workbench agent requires list|add|show|default|remove.");
+    const subcommand = requiredPositional(parsed, 1, "workbench agent requires list|add|rm.");
     if (subcommand === "list") {
         const agents = await listWorkbenchAgents(await coreOptions(parsed));
         return output(agents, parsed, io, () => agents.map(formatAgent).join("\n") || "No agents.");
@@ -468,95 +574,43 @@ async function handleAgent(parsed, io) {
         });
         return output(agent, parsed, io, () => `Added agent ${formatAgent(agent)}.`);
     }
-    if (subcommand === "show") {
-        const name = requiredPositional(parsed, 2, "workbench agent show requires NAME.");
-        const agent = (await listWorkbenchAgents(await coreOptions(parsed))).find((entry) => entry.name === name);
-        if (!agent) {
-            throw new WorkbenchUserError(`Agent not found: ${name}`);
-        }
-        return output(agent, parsed, io, () => formatAgent(agent));
-    }
-    if (subcommand === "default") {
-        const agent = await setDefaultWorkbenchAgent(requiredPositional(parsed, 2, "workbench agent default requires NAME."), await coreOptions(parsed));
-        return output(agent, parsed, io, () => `Default agent: ${agent.name}`);
-    }
-    if (subcommand === "remove") {
-        const result = await removeWorkbenchAgent(requiredPositional(parsed, 2, "workbench agent remove requires NAME."), await coreOptions(parsed));
+    if (subcommand === "rm") {
+        const result = await removeWorkbenchAgent(requiredPositional(parsed, 2, "workbench agent rm requires NAME."), await coreOptions(parsed));
         return output(result, parsed, io, () => `Removed agent ${result.removed}.`);
     }
     throw new WorkbenchUserError(`Unsupported agent command: ${subcommand}`);
 }
-async function handleSkills(parsed, io) {
-    const subcommand = requiredPositional(parsed, 1, "workbench skills requires list.");
-    if (subcommand !== "list") {
-        throw new WorkbenchUserError(`Unsupported skills command: ${subcommand}`);
-    }
-    const snapshot = await createWorkbenchInspectionSnapshot(await coreOptions(parsed));
-    return output(snapshot.skillSources, parsed, io, () => snapshot.skillSources.map((source) => {
-        const where = source.kind === "remote" ? `${source.from}${source.ref ? `#${source.ref}` : ""}` : source.path;
-        return `${source.name}\t${source.kind}\t${where}\tincludes=${source.includes?.length ?? 0}`;
-    }).join("\n") || "No skills.");
-}
 async function handleCase(parsed, io) {
-    const subcommand = requiredPositional(parsed, 1, "workbench case requires list|add|show|remove.");
+    const subcommand = requiredPositional(parsed, 1, "workbench case requires list|add|rm.");
     if (subcommand === "list") {
         const cases = await listWorkbenchCases(await coreOptions(parsed));
         return output(cases, parsed, io, () => cases.map((entry) => `${entry.id}\t${entry.path}`).join("\n") || "No cases.");
     }
     if (subcommand === "add") {
-        const record = await addWorkbenchCase({ ...(await coreOptions(parsed)), fromTraceId: stringFlag(parsed, "from") });
+        const core = await coreOptions(parsed);
+        const sourceRef = optionalPositional(parsed, 2);
+        const record = await addWorkbenchCase({ ...core, fromTraceId: sourceRef ? await traceIdForCaseSource(core, sourceRef) : undefined });
         return output(record, parsed, io, () => `Added case ${record.id}.`);
     }
-    if (subcommand === "show") {
-        const record = await showWorkbenchCase(requiredPositional(parsed, 2, "workbench case show requires CASE_ID."), await coreOptions(parsed));
-        return output(record, parsed, io, () => record.content);
-    }
-    if (subcommand === "remove") {
-        const result = await removeWorkbenchCase(requiredPositional(parsed, 2, "workbench case remove requires CASE_ID."), await coreOptions(parsed));
+    if (subcommand === "rm") {
+        const result = await removeWorkbenchCase(requiredPositional(parsed, 2, "workbench case rm requires CASE_ID."), await coreOptions(parsed));
         return output(result, parsed, io, () => `Removed case ${result.removed}.`);
     }
     throw new WorkbenchUserError(`Unsupported case command: ${subcommand}`);
 }
-async function handleRemote(parsed, io) {
-    const subcommand = requiredPositional(parsed, 1, "workbench remote requires add|list.");
-    if (subcommand === "add") {
-        const remote = await addWorkbenchRemote(requiredPositional(parsed, 2, "workbench remote add requires NAME."), requiredPositional(parsed, 3, "workbench remote add requires URL."), await coreOptions(parsed));
-        return output(remote, parsed, io, () => `Added remote ${remote.name}\t${remote.url}`);
-    }
-    if (subcommand === "list") {
-        const remotes = await listWorkbenchRemotes(await coreOptions(parsed));
-        return output(remotes, parsed, io, () => remotes.map((remote) => `${remote.name}\t${remote.url}`).join("\n") || "No remotes.");
-    }
-    throw new WorkbenchUserError(`Unsupported remote command: ${subcommand}`);
-}
-async function handleAuth(parsed, io) {
-    const subcommand = optionalPositional(parsed, 1) ?? "status";
-    if (subcommand === "status") {
-        const targetRaw = optionalPositional(parsed, 2);
-        const profile = authProfileFlag(parsed);
-        const store = localWorkbenchAdapterAuthStore(adapterAuthStoreRoot());
-        if (targetRaw) {
-            const status = await store.status(parseAuthTarget(targetRaw, profile));
-            return output({ ok: true, command: "status", status }, parsed, io, () => formatAuthStatusRecord(status));
-        }
-        const statuses = await store.listStatus();
-        const required = await requiredAgentAuthStatuses(parsed, statuses);
-        return output({ ok: true, command: "status", adapterStatuses: statuses, required }, parsed, io, () => formatAuthStatusList(statuses, required));
-    }
-    if (subcommand === "connect") {
-        const targetRaw = requiredPositional(parsed, 2, "workbench auth connect requires ADAPTER[/SLOT].");
-        const target = parseAuthTarget(targetRaw, authProfileFlag(parsed));
-        const method = authMethod(parsed, target.adapterId);
-        const bundle = await collectAdapterAuthBundle({
-            target,
-            method,
-            profileRoot: path.resolve(stringFlag(parsed, "profile-root") ?? os.homedir()),
-        });
-        const saved = await localWorkbenchAdapterAuthStore(adapterAuthStoreRoot()).put(bundle);
-        const remote = await uploadAdapterConnection(saved, parsed);
-        return output({
-            ok: true,
-            command: "connect",
+async function handleAdapterLogin(provider, parsed, io) {
+    const target = parseAuthTarget(provider, authProfileFlag(parsed));
+    const method = authMethod(parsed, target.adapterId);
+    const bundle = await collectAdapterAuthBundle({
+        target,
+        method,
+        profileRoot: path.resolve(stringFlag(parsed, "profile-root") ?? os.homedir()),
+    });
+    const saved = await localWorkbenchAdapterAuthStore(adapterAuthStoreRoot()).put(bundle);
+    const remote = await uploadAdapterConnection(saved, parsed);
+    return emitResult("workbench.cli.login.v1", {
+        provider: saved.adapterId,
+        localAdapter: {
             adapter: saved.adapterId,
             ...(saved.slot ? { slot: saved.slot } : {}),
             profile: saved.profile,
@@ -564,25 +618,24 @@ async function handleAuth(parsed, io) {
             status: saved.status,
             version: saved.version,
             updatedAt: saved.updatedAt,
-            remote,
-        }, parsed, io, () => `Connected ${formatAuthTarget(saved)} ${saved.method} auth v${saved.version}; remote: ${remote.status}${remote.reason ? ` (${remote.reason})` : ""}.`);
-    }
-    if (subcommand === "disconnect") {
-        const targetRaw = requiredPositional(parsed, 2, "workbench auth disconnect requires ADAPTER[/SLOT].");
-        const target = parseAuthTarget(targetRaw, authProfileFlag(parsed));
-        await localWorkbenchAdapterAuthStore(adapterAuthStoreRoot()).disconnect(target);
-        const remote = await deleteAdapterConnectionRemote(target, parsed);
-        return output({
-            ok: true,
-            command: "disconnect",
+        },
+        workbenchCloud: remote,
+    }, parsed, io, () => `Connected ${formatAuthTarget(saved)} ${saved.method} auth v${saved.version}; Workbench Cloud: ${remote.sync}${remote.reason ? ` (${remote.reason})` : ""}.`);
+}
+async function handleAdapterLogout(provider, parsed, io) {
+    const target = parseAuthTarget(provider, authProfileFlag(parsed));
+    await localWorkbenchAdapterAuthStore(adapterAuthStoreRoot()).disconnect(target);
+    const remote = await deleteAdapterConnectionRemote(target, parsed);
+    return emitResult("workbench.cli.logout.v1", {
+        provider: target.adapterId,
+        localAdapter: {
             adapter: target.adapterId,
             ...(target.slot ? { slot: target.slot } : {}),
             profile: target.profile,
             status: "disconnected",
-            remote,
-        }, parsed, io, () => `Disconnected ${formatAuthTarget(target)}; remote: ${remote.status}${remote.reason ? ` (${remote.reason})` : ""}.`);
-    }
-    throw new WorkbenchUserError(`Unsupported auth command: ${subcommand}`);
+        },
+        workbenchCloud: remote,
+    }, parsed, io, () => `Disconnected ${formatAuthTarget(target)}; Workbench Cloud: ${remote.sync}${remote.reason ? ` (${remote.reason})` : ""}.`);
 }
 function getCliVersion() {
     const manifest = require("../package.json");
@@ -592,19 +645,17 @@ function commandHelp(command) {
     return COMMAND_HELP[command] ?? HELP;
 }
 function validateCommandFlags(parsed, command) {
-    if (!command) {
-        return;
-    }
-    const allowed = allowedFlagsForCommand(parsed, command);
+    const effectiveCommand = command ?? (parsed.flags.version === true ? "version" : "status");
+    const allowed = allowedFlagsForCommand(parsed, effectiveCommand);
     if (!allowed) {
         return;
     }
-    const allowedSet = new Set(allowed);
+    const allowedSet = new Set(Object.keys(allowed));
     for (const [name, value] of Object.entries(parsed.flags)) {
-        if (!allowedSet.has(name) && name !== "help" && name !== "version") {
-            throw new WorkbenchUserError(`Unsupported flag --${name} for workbench ${command}.`);
+        if (!allowedSet.has(name)) {
+            throw new WorkbenchUserError(`Unsupported flag --${name} for workbench ${effectiveCommand}.`);
         }
-        validateFlagValue(name, value);
+        validateFlagValue(name, value, allowed[name]);
     }
 }
 function allowedFlagsForCommand(parsed, command) {
@@ -613,10 +664,9 @@ function allowedFlagsForCommand(parsed, command) {
         return COMMAND_FLAGS[command];
     }
     const subcommand = parsed.positionals[1] ?? subcommands.defaultSubcommand;
-    return subcommand ? subcommands.flags[subcommand] ?? ["json"] : ["json"];
+    return subcommand ? subcommands.flags[subcommand] ?? { ...COMMON_FLAGS, ...HELP_FLAG } : { ...COMMON_FLAGS, ...HELP_FLAG };
 }
-function validateFlagValue(name, value) {
-    const kind = FLAG_DEFINITIONS[name];
+function validateFlagValue(name, value, kind) {
     if (!kind) {
         return;
     }
@@ -643,55 +693,685 @@ function validateFlagValue(name, value) {
     }
 }
 const CONFIG_SCHEMA = "workbench.cli.config.v1";
+const DEFAULT_WORKBENCH_CLOUD_BASE_URL = "https://v2.workbench.ai";
 const API_REQUEST_MAX_ATTEMPTS = 3;
 const API_REQUEST_GZIP_THRESHOLD_BYTES = 1024 * 1024;
+const CLOUD_RUN_TIMEOUT_MS = 30 * 60 * 1000;
+const CLOUD_RUN_POLL_INTERVAL_MS = 3000;
 async function handleLogin(parsed, io) {
-    if (parsed.positionals.length > 1) {
-        throw new WorkbenchUserError("workbench login accepts no positional arguments.");
+    const provider = optionalPositional(parsed, 1);
+    if (provider) {
+        if (parsed.positionals.length > 2) {
+            throw new WorkbenchUserError("workbench login PROVIDER accepts only one provider argument.");
+        }
+        if (parsed.flags["start-only"] === true || parsed.flags.wait === true || parsed.flags.timeout !== undefined || parsed.flags["no-open"] === true) {
+            throw new WorkbenchCodedError("usage", "Workbench Cloud login flags do not apply to provider login.", {
+                remediation: `Run workbench login ${provider} --method ${authMethod(parsed, provider)}.`,
+                exitCode: 2,
+            });
+        }
+        return await handleAdapterLogin(provider, parsed, io);
+    }
+    if (parsed.flags["start-only"] === true && parsed.flags.wait === true) {
+        throw new WorkbenchCodedError("usage", "workbench login accepts only one of --start-only or --wait.", {
+            remediation: "Run workbench login --start-only or workbench login --wait --timeout 120.",
+            exitCode: 2,
+        });
+    }
+    const startOnly = parsed.flags["start-only"] === true;
+    const waitOnly = parsed.flags.wait === true;
+    const timeoutSeconds = intFlag(parsed, "timeout");
+    if (startOnly && timeoutSeconds !== undefined) {
+        throw new WorkbenchCodedError("usage", "workbench login --timeout only applies with --wait.", {
+            remediation: "Run workbench login --start-only, then workbench login --wait --timeout 120.",
+            exitCode: 2,
+        });
+    }
+    if (waitOnly && timeoutSeconds === undefined) {
+        throw new WorkbenchCodedError("usage", "workbench login --wait requires --timeout N.", {
+            remediation: "Run workbench login --wait --timeout 120.",
+            exitCode: 2,
+        });
     }
     const config = await loadConfig();
     const baseUrl = selectWorkbenchBaseUrl({
         explicitBaseUrl: stringFlag(parsed, "base-url"),
         configBaseUrl: config.baseUrl,
     });
-    const authorization = await requestDeviceAuthorization(baseUrl);
-    if (parsed.flags.json === true) {
-        io.stdout.write(`${JSON.stringify({ ok: true, status: "authorization_pending", ...authorization }, null, 2)}\n`);
-    }
-    else {
-        io.stdout.write(`Open ${authorization.verification_uri_complete}\nCode: ${authorization.user_code}\n`);
-    }
-    if (parsed.flags["no-open"] !== true) {
-        await openBrowser(authorization.verification_uri_complete).catch(() => undefined);
-    }
-    const token = await pollDeviceToken(baseUrl, authorization);
-    await writeConfig({ schema: CONFIG_SCHEMA, baseUrl, accessToken: token.access_token });
-    if (parsed.flags.json === true) {
-        io.stdout.write(`${JSON.stringify({ ok: true, baseUrl, expiresIn: token.expires_in ?? null }, null, 2)}\n`);
+    const pending = waitOnly ? await readPendingDeviceAuthorization(baseUrl) : null;
+    const record = pending ?? await startDeviceAuthorization(baseUrl);
+    const freshAuthorization = pending === null;
+    if (startOnly) {
+        await writePendingDeviceAuthorization(record);
+        if (parsed.flags["no-open"] !== true) {
+            await openBrowser(record.verification_uri_complete).catch(() => undefined);
+        }
+        return emitResult("workbench.cli.login.v1", {
+            status: "authorization_pending",
+            baseUrl,
+            verificationUri: record.verification_uri,
+            verificationUriComplete: record.verification_uri_complete,
+            userCode: record.user_code,
+            expiresAt: record.expiresAt,
+            resume: "workbench login --wait --timeout 120",
+        }, parsed, io, () => `Open ${record.verification_uri_complete}\nCode: ${record.user_code}\nResume: workbench login --wait --timeout 120`);
+    }
+    await writePendingDeviceAuthorization(record);
+    if (freshAuthorization && !parsed.flags.json) {
+        io.stdout.write(`Open ${record.verification_uri_complete}\nCode: ${record.user_code}\n`);
+    }
+    if (!waitOnly && parsed.flags["no-open"] !== true) {
+        await openBrowser(record.verification_uri_complete).catch(() => undefined);
+    }
+    let token;
+    try {
+        token = await pollDeviceToken(baseUrl, record, timeoutSeconds);
     }
-    else {
-        io.stdout.write(`Workbench API: ${baseUrl}\n`);
+    catch (error) {
+        const denied = error instanceof WorkbenchCodedError && error.code === "login_denied";
+        const expired = Date.parse(record.expiresAt) <= Date.now();
+        if (denied || expired) {
+            await clearPendingDeviceAuthorization();
+        }
+        throw error;
     }
-    return 0;
+    const username = await fetchWorkbenchUsername(baseUrl, token.access_token).catch(() => undefined);
+    await writeConfig({
+        schema: CONFIG_SCHEMA,
+        baseUrl,
+        accessToken: token.access_token,
+        ...(username ? { username } : {}),
+    });
+    await clearPendingDeviceAuthorization();
+    return emitResult("workbench.cli.login.v1", {
+        status: "authenticated",
+        baseUrl,
+        ...(username ? { username } : {}),
+        ...(token.expires_in !== undefined ? { expiresIn: token.expires_in } : {}),
+    }, parsed, io, () => `Workbench Cloud: authenticated${username ? ` as ${username}` : ""}\nWorkbench API: ${baseUrl}`);
 }
 async function handleLogout(parsed, io) {
-    if (parsed.positionals.length > 1) {
-        throw new WorkbenchUserError("workbench logout accepts no positional arguments.");
+    const provider = optionalPositional(parsed, 1);
+    if (provider) {
+        if (parsed.positionals.length > 2) {
+            throw new WorkbenchUserError("workbench logout PROVIDER accepts only one provider argument.");
+        }
+        return await handleAdapterLogout(provider, parsed, io);
     }
     const config = await loadConfig();
     const baseUrl = optionalWorkbenchBaseUrl({ configBaseUrl: config.baseUrl });
-    if (config.accessToken && !baseUrl) {
+    const tokenPresent = Boolean(config.accessToken);
+    if (tokenPresent && !baseUrl) {
         throw new WorkbenchUserError("Missing Workbench API URL. Set WORKBENCH_API_URL or run `workbench login --base-url URL`.");
     }
+    let revoke = "skipped";
     if (config.accessToken && baseUrl) {
-        await fetch(`${baseUrl}/api/oauth/revoke`, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({ token: config.accessToken }),
-        }).catch(() => undefined);
+        try {
+            const response = await fetch(`${baseUrl}/api/oauth/revoke`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ token: config.accessToken }),
+            });
+            revoke = response.ok ? "revoked" : "failed";
+        }
+        catch {
+            revoke = "failed";
+        }
+    }
+    const configRemoved = tokenPresent;
+    if (tokenPresent) {
+        await writeConfig({ schema: CONFIG_SCHEMA, ...(baseUrl ? { baseUrl } : {}) });
+    }
+    const adapterStatuses = await localWorkbenchAdapterAuthStore(adapterAuthStoreRoot()).listStatus().catch(() => []);
+    const adapterAuthRetained = adapterStatuses.length > 0;
+    return emitResult("workbench.cli.logout.v1", {
+        ...(baseUrl ? { baseUrl } : {}),
+        tokenPresent,
+        revoke,
+        configRemoved,
+        adapterAuthRetained,
+    }, parsed, io, () => [
+        `Logged out of Workbench${baseUrl ? ` (${baseUrl})` : ""}.`,
+        `Token: ${tokenPresent ? "present" : "absent"}; revoke ${revoke}; config ${configRemoved ? "removed" : "unchanged"}.`,
+        adapterAuthRetained
+            ? "Local adapter auth records were retained; run workbench logout PROVIDER to remove them."
+            : "No local adapter auth records remain.",
+    ].join("\n"));
+}
+async function handleInstall(parsed, io) {
+    const sourceInput = requiredPositional(parsed, 1, "workbench install requires HANDLE_OR_URL.");
+    rejectExtraInput(parsed, {
+        maxPositionals: 2,
+        message: "workbench install accepts one HANDLE_OR_URL argument.",
+        remediation: "Run workbench install OWNER/SKILL --to codex.",
+    });
+    const source = await resolveWorkbenchInstallSourceInput(sourceInput);
+    const workbenchSource = parseWorkbenchInstallSource(source);
+    if (!workbenchSource) {
+        throw new WorkbenchCodedError("usage", "workbench install requires a Workbench Cloud source URL.", {
+            remediation: "Run workbench install OWNER/SKILL --to codex.",
+            exitCode: 2,
+        });
+    }
+    const snapshot = await fetchWorkbenchInstallSourceSnapshot(workbenchSource, source);
+    const sourceSummary = workbenchInstallSourceSummary(workbenchSource, snapshot);
+    const config = await loadConfig();
+    if (parsed.flags.list === true) {
+        return emitResult("workbench.cli.install.v1", {
+            source: sourceSummary,
+            skills: [snapshot.name],
+            fileCount: snapshot.files.length,
+            targets: installTargetsToJson(supportedInstallTargets()),
+        }, parsed, io, () => [
+            `${snapshot.name}\t${snapshot.versionId}\tfiles=${snapshot.files.length}`,
+            "Targets:",
+            ...supportedInstallTargets().map((target) => `  ${target.agent}\t${target.destination}`),
+        ].join("\n"));
+    }
+    const toTargets = stringsFlag(parsed, "to");
+    const selectedTargets = toTargets.length > 0 ? normalizeInstallTargetNames(toTargets) : await defaultInstallTargetNames(config);
+    const targets = resolveInstallTargets({
+        agents: selectedTargets.filter((target) => target !== "local"),
+        local: selectedTargets.some((target) => target === "local"),
+        skillName: snapshot.name,
+    });
+    const result = await installSnapshotToTargets({
+        snapshot,
+        targets,
+        overwrite: parsed.flags.yes === true,
+        dryRun: parsed.flags["dry-run"] === true,
+    });
+    if (toTargets.length > 0 && parsed.flags["dry-run"] !== true) {
+        await writeConfig({ ...config, installTargets: selectedTargets });
+    }
+    return emitResult("workbench.cli.install.v1", {
+        source: sourceSummary,
+        result: result.result,
+        targets: result.targets,
+        filesCopied: result.filesCopied,
+        ...(parsed.flags["dry-run"] === true ? { dryRun: true } : {}),
+    }, parsed, io, () => [
+        parsed.flags["dry-run"] === true
+            ? `Would install ${snapshot.name}: filesCopied=${result.filesCopied}`
+            : `Installed ${snapshot.name}: ${result.result}`,
+        ...result.targets.map((target) => `  ${target.agent}\t${target.previous}\t${target.destination}`),
+    ].join("\n"));
+}
+async function handleCloudEval(parsed, io) {
+    const started = await startCloudExecution("eval", parsed);
+    const artifactIds = await artifactIdsByRunId(started.core, started.runs);
+    const failedRuns = started.runs.filter((run) => run.status === "failed" || run.status === "canceled");
+    if (failedRuns.length > 0) {
+        return emitEvalFailure(started.runs, failedRuns, artifactIds, parsed, io);
+    }
+    const deltas = await evalDeltas(started.core, started.runs);
+    const nextCommands = cloudEvalNextCommands(started.runs);
+    return emitResult("workbench.cli.eval.v1", {
+        result: started.runs.map((run) => runSummary(run, artifactIds.get(run.id) ?? [])),
+        deltas: deltas,
+        nextCommands: nextCommands,
+        cloud: cloudExecutionSummary(started),
+    }, parsed, io, () => [
+        `Completed hosted eval on ${started.remote.url}.`,
+        started.runs.map(formatRun).join("\n"),
+        ...deltas.map(formatEvalDelta),
+        ...(nextCommands[0] ? [`next: ${nextCommands[0]}`] : []),
+    ].filter(Boolean).join("\n"));
+}
+async function handleCloudImprove(parsed, io) {
+    const started = await startCloudExecution("improve", parsed);
+    const artifactIds = await artifactIdsByRunId(started.core, started.runs);
+    const failedRuns = started.runs.filter((run) => run.status === "failed" || run.status === "canceled");
+    if (failedRuns.length > 0) {
+        const first = failedRuns[0];
+        throw new WorkbenchCodedError("improve_failed", "Hosted improve failed; evidence was saved.", {
+            remediation: `Run workbench show ${first.id}.`,
+            subject: {
+                runIds: failedRuns.map((run) => run.id),
+                statuses: Object.fromEntries(failedRuns.map((run) => [run.id, run.status])),
+            },
+            exitCode: 1,
+        });
     }
-    await writeConfig({ schema: CONFIG_SCHEMA, ...(baseUrl ? { baseUrl } : {}) });
-    return output({ ok: true, ...(baseUrl ? { baseUrl } : {}) }, parsed, io, () => "Logged out of Workbench.");
+    const switchedVersionId = await switchHostedImproveVersionIfPromoted(started);
+    const nextCommands = cloudImproveNextCommands(started.runs);
+    return emitResult("workbench.cli.improve.v1", {
+        result: started.runs.map((run) => runSummary(run, artifactIds.get(run.id) ?? [])),
+        nextCommands: nextCommands,
+        cloud: cloudExecutionSummary(started),
+        ...(switchedVersionId ? { switchedVersionId } : {}),
+    }, parsed, io, () => [
+        `Completed hosted improve on ${started.remote.url}.`,
+        started.runs.map(formatRun).join("\n"),
+        ...(switchedVersionId ? [`Switched local source to ${switchedVersionId}.`] : []),
+        ...(nextCommands[0] ? [`next: ${nextCommands[0]}`] : []),
+    ].filter(Boolean).join("\n"));
+}
+async function defaultInstallTargetNames(config) {
+    if (config.installTargets && config.installTargets.length > 0) {
+        return config.installTargets;
+    }
+    const detected = [];
+    for (const target of supportedInstallTargets()) {
+        if (target.agent === "local") {
+            continue;
+        }
+        const home = path.dirname(path.dirname(target.destination));
+        if (await pathExists(home)) {
+            detected.push(target.agent);
+        }
+    }
+    return detected.length > 0 ? detected : ["local"];
+}
+function normalizeInstallTargetNames(values) {
+    const normalized = [];
+    for (const value of values) {
+        const target = value.trim().toLowerCase();
+        if (target !== "codex" && target !== "claude" && target !== "local") {
+            throw new WorkbenchCodedError("usage", `Unsupported install target: ${value}`, {
+                remediation: "Use --to codex, --to claude, or --to local.",
+                exitCode: 2,
+            });
+        }
+        normalized.push(target);
+    }
+    return [...new Set(normalized)];
+}
+async function pathExists(filePath) {
+    try {
+        await fs.access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function startCloudExecution(command, parsed) {
+    const root = dirFlag(parsed) ?? process.cwd();
+    const remote = await ensureCloudRemoteForExecution(root, parsed);
+    const source = parseWorkbenchInstallSource(remote.url);
+    if (!source) {
+        throw new WorkbenchCodedError("remote_invalid_url", `Workbench remote is not a Cloud skill URL: ${remote.url}`, {
+            remediation: "Run workbench publish to recreate the Workbench Cloud link.",
+            subject: { remote: remote.name, url: remote.url },
+            exitCode: 2,
+        });
+    }
+    const token = await workbenchCloudToken({ baseUrl: source.baseUrl });
+    if (!token) {
+        throw new WorkbenchCodedError("auth_required", `workbench ${command} --cloud requires Workbench Cloud auth.`, {
+            remediation: `Run workbench login --base-url ${source.baseUrl}.`,
+            exitCode: 1,
+        });
+    }
+    const core = { dir: root, authToken: token };
+    const syncBefore = await syncWorkbenchRemote({ ...core, remote: remote.name });
+    const startSnapshot = await createWorkbenchReadOnlyInspectionSnapshot(core);
+    const skillId = await resolveCloudSkillId(source);
+    const response = await apiRequest(`/api/workbench/skills/${encodeURIComponent(skillId)}${command === "improve" ? "/improve" : "/runs"}`, { method: "POST", body: cloudExecutionRequestBody(command, parsed) }, source.baseUrl);
+    const runs = response.runs ?? [];
+    if (runs.length === 0) {
+        throw new WorkbenchCodedError("cloud_run_missing", `Workbench Cloud did not return a run for ${command}.`, {
+            retryable: true,
+            remediation: "Run workbench log --runs.",
+            subject: { remote: remote.name, skillId },
+            exitCode: 1,
+        });
+    }
+    const initialSyncAfter = await syncWorkbenchRemote({ ...core, remote: remote.name });
+    const completed = await waitForCloudRuns({
+        core,
+        remote,
+        runs,
+        initialSync: initialSyncAfter,
+    });
+    return {
+        core,
+        remote,
+        skillId,
+        runs: completed.runs,
+        startVersionId: startSnapshot.status.currentVersionId ?? startSnapshot.refs.current,
+        source,
+        sync: {
+            before: { pushed: syncBefore.pushed, pulled: syncBefore.pulled, upToDate: syncBefore.upToDate },
+            after: { pushed: completed.sync.pushed, pulled: completed.sync.pulled, upToDate: completed.sync.upToDate },
+        },
+    };
+}
+async function waitForCloudRuns(input) {
+    const runIds = input.runs
+        .map((run) => run.id)
+        .filter((id) => typeof id === "string" && id.length > 0);
+    if (runIds.length === 0 || runIds.length !== input.runs.length) {
+        throw new WorkbenchCodedError("cloud_run_missing", "Workbench Cloud did not return a run id.", {
+            retryable: true,
+            remediation: "Run workbench log --runs.",
+            exitCode: 1,
+        });
+    }
+    let sync = input.initialSync;
+    const timeoutMs = positiveIntEnv("WORKBENCH_CLOUD_RUN_TIMEOUT_MS") ?? CLOUD_RUN_TIMEOUT_MS;
+    const pollIntervalMs = positiveIntEnv("WORKBENCH_CLOUD_RUN_POLL_INTERVAL_MS") ?? CLOUD_RUN_POLL_INTERVAL_MS;
+    const deadline = Date.now() + timeoutMs;
+    while (true) {
+        const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(input.core);
+        const runs = runIds
+            .map((id) => snapshot.runs.find((entry) => entry.id === id))
+            .filter((run) => Boolean(run));
+        if (runs.length === runIds.length && runs.every(isTerminalRun)) {
+            return { runs, sync };
+        }
+        if (Date.now() >= deadline) {
+            throw new WorkbenchCodedError("cloud_run_pending", "Hosted Workbench run is still running.", {
+                retryable: true,
+                remediation: runIds[0] ? `Run workbench show ${runIds[0]}.` : "Run workbench log --runs.",
+                subject: {
+                    runIds,
+                    statuses: Object.fromEntries(runs.map((run) => [run.id, run.status])),
+                },
+                exitCode: 1,
+            });
+        }
+        await sleep(pollIntervalMs);
+        sync = await syncWorkbenchRemote({ ...input.core, remote: input.remote.name });
+    }
+}
+function isTerminalRun(run) {
+    return run.status === "succeeded" || run.status === "failed" || run.status === "canceled";
+}
+async function switchHostedImproveVersionIfPromoted(started) {
+    const outputVersionId = started.runs.find((run) => run.status === "succeeded" && run.outputVersionId)?.outputVersionId;
+    if (!outputVersionId) {
+        return undefined;
+    }
+    const refs = await fetchCloudObjectRefs(started);
+    if (refs.current !== outputVersionId) {
+        return undefined;
+    }
+    await listWorkbenchVersions(started.core);
+    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(started.core);
+    const currentVersionId = snapshot.status.currentVersionId ?? snapshot.refs.current;
+    if (started.startVersionId && currentVersionId && currentVersionId !== started.startVersionId) {
+        throw new WorkbenchCodedError("worktree_changed", "Local source changed while hosted improve was running; refusing to overwrite it.", {
+            remediation: `Review workbench diff, then run workbench switch ${outputVersionId} when ready.`,
+            subject: {
+                startedFrom: started.startVersionId,
+                current: currentVersionId,
+                hostedVersion: outputVersionId,
+            },
+            exitCode: 1,
+        });
+    }
+    const version = await switchWorkbenchVersion(outputVersionId, started.core);
+    return version.id;
+}
+async function fetchCloudObjectRefs(started) {
+    const response = await apiRequest(`/api/workbench/skills/${encodeURIComponent(started.skillId)}/objects`, {}, started.source.baseUrl);
+    return response.objectPack?.refs ?? {};
+}
+async function ensureCloudRemoteForExecution(root, parsed) {
+    const linked = await linkedCloudRemote(root);
+    if (linked) {
+        return linked;
+    }
+    const link = await cloudRemoteLinkTarget(root);
+    const remote = await derivePublishCloudRemote(parsed, "workbench --cloud", link.name);
+    const source = parseWorkbenchInstallSource(remote.url);
+    if (!source) {
+        throw new WorkbenchCodedError("remote_invalid_url", `Workbench remote is not a Cloud skill URL: ${remote.url}`, {
+            remediation: "Run workbench publish to recreate the Workbench Cloud link.",
+            subject: { remote: remote.name, url: remote.url },
+            exitCode: 2,
+        });
+    }
+    const token = await workbenchCloudToken({ baseUrl: source.baseUrl });
+    if (!token) {
+        throw new WorkbenchCodedError("auth_required", "workbench --cloud requires Workbench Cloud auth.", {
+            remediation: `Run workbench login --base-url ${source.baseUrl}.`,
+            exitCode: 1,
+        });
+    }
+    const result = await addWorkbenchRemote(remote.name, remote.url, {
+        dir: root,
+        authToken: token,
+        replace: link.replace,
+    });
+    return result.remote;
+}
+async function linkedCloudRemote(root) {
+    return preferredCloudRemote(await inspectionRemotes(root)) ?? null;
+}
+async function inspectionRemotes(root) {
+    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot({ dir: root }).catch((error) => {
+        if (error instanceof WorkbenchCodedError || error instanceof WorkbenchUserError) {
+            return null;
+        }
+        throw error;
+    });
+    return snapshot?.remotes ?? [];
+}
+async function cloudRemoteLinkTarget(root) {
+    return cloudRemoteLinkTargetFromRemotes(await inspectionRemotes(root));
+}
+function cloudRemoteLinkTargetFromRemotes(remotes) {
+    const existing = preferredCloudRemote(remotes);
+    if (existing) {
+        return { name: existing.name, replace: true, existing };
+    }
+    return { name: availableCloudRemoteName(remotes), replace: false };
+}
+function preferredCloudRemote(remotes) {
+    const cloudRemotes = remotes.filter((remote) => remote.kind === "workbench-cloud");
+    return cloudRemotes.find((remote) => remote.name === "cloud") ?? cloudRemotes[0];
+}
+function availableCloudRemoteName(remotes) {
+    const names = new Set(remotes.map((remote) => remote.name));
+    if (!names.has("cloud")) {
+        return "cloud";
+    }
+    for (let index = 1;; index += 1) {
+        const name = `cloud-${index}`;
+        if (!names.has(name)) {
+            return name;
+        }
+    }
+}
+async function resolveCloudSkillId(source) {
+    const listed = await apiRequest("/api/workbench/skills", {}, source.baseUrl);
+    const skill = listed.skills?.find((entry) => entry.ownerSlug === source.owner && entry.name === source.skill);
+    if (!skill?.id) {
+        throw new WorkbenchCodedError("remote_not_found", `Workbench Cloud skill not found: ${source.owner}/${source.skill}`, {
+            remediation: "Run workbench publish.",
+            subject: { owner: source.owner, skill: source.skill },
+            exitCode: 1,
+        });
+    }
+    return skill.id;
+}
+function cloudExecutionRequestBody(command, parsed) {
+    return {
+        version: optionalPositional(parsed, 1),
+        skill: stringFlag(parsed, "skills"),
+        agent: stringFlag(parsed, "agents"),
+        samples: intFlag(parsed, "samples"),
+        ...(command === "improve" ? { budget: intFlag(parsed, "budget") } : {}),
+    };
+}
+function cloudEvalNextCommands(runs) {
+    return cloudExecutionNextCommands(runs, "workbench publish");
+}
+function cloudImproveNextCommands(runs) {
+    return cloudExecutionNextCommands(runs, "workbench eval");
+}
+function cloudExecutionNextCommands(runs, successCommand) {
+    const first = runs[0];
+    if (!first) {
+        return ["workbench log --runs"];
+    }
+    if (first.status === "running" || first.status === "failed" || first.status === "canceled") {
+        return [`workbench show ${first.id}`];
+    }
+    return [successCommand];
+}
+function cloudExecutionSummary(started) {
+    return {
+        remote: started.remote.name,
+        url: started.remote.url,
+        skillId: started.skillId,
+        sync: started.sync,
+    };
+}
+function workbenchInstallSourceSummary(source, snapshot) {
+    const installUrl = `${source.baseUrl}/skills/${encodeURIComponent(source.owner)}/${encodeURIComponent(source.skill)}`;
+    return {
+        kind: "workbench-cloud",
+        owner: snapshot.owner,
+        skill: snapshot.name,
+        versionId: snapshot.versionId,
+        installUrl,
+        pinnedInstallUrl: `${installUrl}/releases/${encodeURIComponent(snapshot.versionId)}`,
+    };
+}
+function parseWorkbenchInstallSource(source) {
+    let url;
+    try {
+        url = new URL(source);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        return undefined;
+    }
+    const segments = url.pathname
+        .split("/")
+        .filter(Boolean)
+        .map((segment) => decodeURIComponent(segment));
+    if (segments[0] !== "skills") {
+        return undefined;
+    }
+    if (!segments[1] || !segments[2]) {
+        throw new WorkbenchUserError(`Invalid Workbench skill URL: ${source}`);
+    }
+    if (segments.length === 3) {
+        return {
+            baseUrl: url.origin,
+            owner: segments[1],
+            skill: segments[2],
+        };
+    }
+    if (segments.length === 5 && segments[3] === "releases" && segments[4]) {
+        return {
+            baseUrl: url.origin,
+            owner: segments[1],
+            skill: segments[2],
+            version: segments[4],
+        };
+    }
+    throw new WorkbenchUserError(`Invalid Workbench skill URL: ${source}`);
+}
+async function fetchWorkbenchInstallSourceSnapshot(source, displaySource) {
+    const token = await workbenchCloudToken({ baseUrl: source.baseUrl });
+    const apiPath = source.version
+        ? `/api/workbench/source/skills/${encodeURIComponent(source.owner)}/${encodeURIComponent(source.skill)}/releases/${encodeURIComponent(source.version)}/source`
+        : `/api/workbench/source/skills/${encodeURIComponent(source.owner)}/${encodeURIComponent(source.skill)}/source`;
+    const response = await fetch(`${source.baseUrl}${apiPath}`, {
+        headers: {
+            ...(token ? { authorization: `Bearer ${token}` } : {}),
+        },
+    });
+    const text = await response.text();
+    const cloudError = parseWorkbenchCloudErrorBody(text);
+    if (cloudError) {
+        throw new WorkbenchCodedError(cloudError.code, cloudError.message, {
+            retryable: cloudError.retryable,
+            ...(cloudError.remediation ? { remediation: cloudError.remediation } : {}),
+            ...(cloudError.subject ? { subject: cloudError.subject } : {}),
+            exitCode: response.status === 400 ? 2 : 1,
+        });
+    }
+    if (response.status === 401) {
+        throw new WorkbenchCodedError("auth_required", token
+            ? `Workbench Cloud rejected the provided token while installing ${displaySource}.`
+            : `Authentication is required to install ${displaySource}.`, {
+            remediation: `Run workbench login --base-url ${source.baseUrl}.`,
+            exitCode: 1,
+        });
+    }
+    if (!response.ok) {
+        throw new WorkbenchCodedError("install_failed", `Unable to download Workbench source ${displaySource}: ${response.status} ${readResponseError(text) ?? response.statusText}`, {
+            subject: { source: displaySource, status: response.status },
+            exitCode: 1,
+        });
+    }
+    let parsed;
+    try {
+        parsed = text ? JSON.parse(text) : null;
+    }
+    catch {
+        throw new WorkbenchCodedError("install_failed", `Workbench source ${displaySource} did not return JSON.`, {
+            subject: { source: displaySource },
+            exitCode: 1,
+        });
+    }
+    const snapshot = parseWorkbenchInstallSourceSnapshot(parsed, displaySource);
+    if (source.version && snapshot.versionId !== source.version) {
+        throw new WorkbenchCodedError("install_failed", `Workbench source ${displaySource} resolved ${snapshot.versionId} instead of requested release ${source.version}.`, {
+            subject: { source: displaySource, resolvedVersionId: snapshot.versionId, requestedVersionId: source.version },
+            exitCode: 1,
+        });
+    }
+    return snapshot;
+}
+function parseWorkbenchInstallSourceSnapshot(value, displaySource) {
+    const record = asRecord(value);
+    if (record?.schema !== "workbench.source.snapshot.v1") {
+        throw new WorkbenchCodedError("install_failed", `Workbench source ${displaySource} did not return a source snapshot.`, {
+            subject: { source: displaySource },
+            exitCode: 1,
+        });
+    }
+    const owner = typeof record.owner === "string" ? record.owner : "";
+    const name = typeof record.name === "string" ? record.name : "";
+    const versionId = typeof record.versionId === "string" ? record.versionId : "";
+    const files = Array.isArray(record.files) ? record.files.map((entry) => parseWorkbenchInstallSourceFile(entry, displaySource)) : [];
+    if (!owner || !name || !versionId || files.length === 0) {
+        throw new WorkbenchCodedError("install_failed", `Workbench source ${displaySource} returned an incomplete source snapshot.`, {
+            subject: { source: displaySource },
+            exitCode: 1,
+        });
+    }
+    return {
+        schema: "workbench.source.snapshot.v1",
+        owner,
+        name,
+        versionId,
+        files,
+    };
+}
+function parseWorkbenchInstallSourceFile(value, displaySource) {
+    const record = asRecord(value);
+    if (!record) {
+        throw new WorkbenchCodedError("install_failed", `Workbench source ${displaySource} returned an invalid file entry.`, {
+            subject: { source: displaySource },
+            exitCode: 1,
+        });
+    }
+    const filePath = typeof record?.path === "string" ? record.path : "";
+    const content = typeof record?.content === "string" ? record.content : undefined;
+    if (!filePath || content === undefined) {
+        throw new WorkbenchCodedError("install_failed", `Workbench source ${displaySource} returned an invalid file entry.`, {
+            subject: { source: displaySource },
+            exitCode: 1,
+        });
+    }
+    return {
+        path: normalizeInstallSnapshotPath(filePath),
+        ...(record.kind === "text" || record.kind === "binary" ? { kind: record.kind } : {}),
+        encoding: record.encoding === "base64" ? "base64" : "utf8",
+        executable: record.executable === true,
+        content,
+    };
 }
 async function loadConfig() {
     const parsed = await readConfigJson(configPath()) ?? {};
@@ -699,11 +1379,24 @@ async function loadConfig() {
         schema: CONFIG_SCHEMA,
         ...(typeof parsed.baseUrl === "string" ? { baseUrl: normalizeBaseUrl(parsed.baseUrl) } : {}),
         ...(typeof parsed.accessToken === "string" ? { accessToken: parsed.accessToken } : {}),
+        ...(typeof parsed.username === "string" ? { username: parsed.username } : {}),
+        ...(Array.isArray(parsed.installTargets) ? { installTargets: normalizeInstallTargetNames(parsed.installTargets.flatMap((entry) => typeof entry === "string" ? [entry] : [])) } : {}),
     };
 }
-async function workbenchRemoteAuthToken() {
+// Single resolver for the Workbench Cloud token used by every authenticated
+// path: config accessToken first, then WORKBENCH_API_TOKEN, then
+// WORKBENCH_SMOKE_BEARER_TOKEN. When a target base URL is known, the config
+// token is only used if the config base URL matches it.
+async function workbenchCloudToken(options = {}) {
     const config = await loadConfig();
-    return config.accessToken ?? process.env.WORKBENCH_API_TOKEN?.trim() ?? undefined;
+    const configToken = config.accessToken &&
+        (!options.baseUrl || !config.baseUrl || normalizeBaseUrl(config.baseUrl) === normalizeBaseUrl(options.baseUrl))
+        ? config.accessToken
+        : undefined;
+    return configToken ?? workbenchCloudEnvToken();
+}
+function workbenchCloudEnvToken() {
+    return process.env.WORKBENCH_API_TOKEN?.trim() || process.env.WORKBENCH_SMOKE_BEARER_TOKEN?.trim() || undefined;
 }
 async function readConfigJson(filePath) {
     try {
@@ -723,6 +1416,9 @@ async function writeConfig(config) {
 function configPath() {
     return process.env.WORKBENCH_CONFIG?.trim() || path.join(os.homedir(), ".workbench", "config.json");
 }
+function deviceAuthPath() {
+    return process.env.WORKBENCH_DEVICE_AUTH?.trim() || path.join(path.dirname(configPath()), "device-auth.json");
+}
 function selectWorkbenchBaseUrl(input = {}) {
     const baseUrl = optionalWorkbenchBaseUrl(input);
     if (!baseUrl) {
@@ -742,13 +1438,41 @@ function normalizeBaseUrl(value) {
 }
 async function requestDeviceAuthorization(baseUrl) {
     const response = await fetch(`${baseUrl}/api/oauth/device/code`, { method: "POST" });
+    const text = await response.text();
+    const cloudError = parseWorkbenchCloudErrorBody(text);
+    if (cloudError) {
+        throw new WorkbenchCodedError(cloudError.code, cloudError.message, {
+            retryable: cloudError.retryable,
+            ...(cloudError.remediation ? { remediation: cloudError.remediation } : {}),
+            ...(cloudError.subject ? { subject: cloudError.subject } : {}),
+            exitCode: 1,
+        });
+    }
     if (!response.ok) {
-        throw new WorkbenchUserError(`Device login failed: ${readResponseError(await response.text()) ?? response.statusText}`);
+        throw new WorkbenchCodedError("login_denied", `Device login failed: ${readResponseError(text) ?? response.statusText}`, {
+            exitCode: 1,
+        });
     }
-    return await response.json();
+    return JSON.parse(text);
+}
+async function startDeviceAuthorization(baseUrl) {
+    const authorization = await requestDeviceAuthorization(baseUrl);
+    return {
+        schema: "workbench.cli.device-auth.v1",
+        baseUrl,
+        device_code: authorization.device_code,
+        user_code: authorization.user_code,
+        verification_uri: authorization.verification_uri,
+        verification_uri_complete: authorization.verification_uri_complete,
+        expiresAt: new Date(Date.now() + Math.max(1, authorization.expires_in) * 1000).toISOString(),
+        ...(authorization.interval !== undefined ? { interval: authorization.interval } : {}),
+    };
 }
-async function pollDeviceToken(baseUrl, authorization) {
-    const deadline = Date.now() + Math.max(1, authorization.expires_in) * 1000;
+async function pollDeviceToken(baseUrl, authorization, timeoutSeconds) {
+    const expiresAtMs = Date.parse(authorization.expiresAt);
+    const expiryDeadline = Number.isFinite(expiresAtMs) ? expiresAtMs : Date.now() + 15 * 60 * 1000;
+    const timeoutDeadline = timeoutSeconds ? Date.now() + timeoutSeconds * 1000 : Number.POSITIVE_INFINITY;
+    const deadline = Math.min(expiryDeadline, timeoutDeadline);
     let intervalMs = Math.max(1, authorization.interval ?? 5) * 1000;
     while (Date.now() < deadline) {
         const response = await fetch(`${baseUrl}/api/oauth/token`, {
@@ -768,17 +1492,87 @@ async function pollDeviceToken(baseUrl, authorization) {
             intervalMs += 5000;
         }
         else if (error !== "authorization_pending") {
-            throw new WorkbenchUserError(`Device login failed: ${error}`);
+            throw new WorkbenchCodedError("login_denied", `Device login failed: ${error}`, {
+                exitCode: 1,
+            });
         }
         await sleep(intervalMs);
     }
-    throw new WorkbenchUserError("Device login timed out before authorization completed.");
+    throw new WorkbenchCodedError("login_pending", "Device login is still waiting for browser authorization.", {
+        retryable: true,
+        remediation: "Authorize the device in the browser, then run workbench login --wait --timeout 120.",
+        subject: {
+            retryAfterSeconds: Math.max(1, Math.ceil(intervalMs / 1000)),
+            verificationUri: authorization.verification_uri,
+            verificationUriComplete: authorization.verification_uri_complete,
+            userCode: authorization.user_code,
+            expiresAt: authorization.expiresAt,
+        },
+        exitCode: 1,
+    });
+}
+async function fetchWorkbenchUsername(baseUrl, accessToken) {
+    const response = await fetch(`${baseUrl}/api/workbench/profile`, {
+        headers: { authorization: `Bearer ${accessToken}` },
+    });
+    if (!response.ok) {
+        return undefined;
+    }
+    const record = asRecord(await response.json());
+    const profile = asRecord(record?.profile);
+    return typeof profile?.username === "string" ? profile.username : undefined;
+}
+async function readPendingDeviceAuthorization(baseUrl) {
+    const record = await readDeviceAuthorizationJson(deviceAuthPath());
+    if (!record || record.baseUrl !== baseUrl || Date.parse(record.expiresAt) <= Date.now()) {
+        return null;
+    }
+    return record;
+}
+async function writePendingDeviceAuthorization(record) {
+    await fs.mkdir(path.dirname(deviceAuthPath()), { recursive: true });
+    await fs.writeFile(deviceAuthPath(), `${JSON.stringify(record, null, 2)}\n`);
+}
+async function clearPendingDeviceAuthorization() {
+    await fs.rm(deviceAuthPath(), { force: true });
+}
+async function readDeviceAuthorizationJson(filePath) {
+    try {
+        const record = asRecord(JSON.parse(await fs.readFile(filePath, "utf8")));
+        if (record?.schema !== "workbench.cli.device-auth.v1" ||
+            typeof record.baseUrl !== "string" ||
+            typeof record.device_code !== "string" ||
+            typeof record.user_code !== "string" ||
+            typeof record.verification_uri !== "string" ||
+            typeof record.verification_uri_complete !== "string" ||
+            typeof record.expiresAt !== "string" ||
+            !Number.isFinite(Date.parse(record.expiresAt))) {
+            return null;
+        }
+        return {
+            schema: "workbench.cli.device-auth.v1",
+            baseUrl: record.baseUrl,
+            device_code: record.device_code,
+            user_code: record.user_code,
+            verification_uri: record.verification_uri,
+            verification_uri_complete: record.verification_uri_complete,
+            expiresAt: record.expiresAt,
+            ...(typeof record.interval === "number" ? { interval: record.interval } : {}),
+        };
+    }
+    catch (error) {
+        if (error?.code === "ENOENT") {
+            return null;
+        }
+        throw error;
+    }
 }
 async function apiRequest(apiPath, options = {}, baseUrlOverride) {
     const config = await loadConfig();
     const baseUrl = baseUrlOverride !== undefined
         ? normalizeBaseUrl(baseUrlOverride)
         : selectWorkbenchBaseUrl({ configBaseUrl: config.baseUrl });
+    const token = await workbenchCloudToken({ baseUrl });
     const method = options.method ?? "GET";
     const canRetry = method === "GET";
     const requestBody = encodeJsonRequestBody(options.body);
@@ -790,7 +1584,7 @@ async function apiRequest(apiPath, options = {}, baseUrlOverride) {
                 method,
                 headers: {
                     ...requestBody.headers,
-                    ...(config.accessToken ? { authorization: `Bearer ${config.accessToken}` } : {}),
+                    ...(token ? { authorization: `Bearer ${token}` } : {}),
                 },
                 body: requestBody.body,
             });
@@ -805,6 +1599,21 @@ async function apiRequest(apiPath, options = {}, baseUrlOverride) {
         }
         if (!response.ok) {
             const text = await response.text();
+            const cloudError = parseWorkbenchCloudErrorBody(text);
+            if (cloudError) {
+                const requestError = new WorkbenchCodedError(cloudError.code, cloudError.message, {
+                    retryable: cloudError.retryable,
+                    ...(cloudError.remediation ? { remediation: cloudError.remediation } : {}),
+                    ...(cloudError.subject ? { subject: cloudError.subject } : {}),
+                    exitCode: response.status === 400 ? 2 : 1,
+                });
+                lastError = requestError;
+                if (canRetry && attempt < API_REQUEST_MAX_ATTEMPTS && cloudError.retryable) {
+                    await sleep(250 * attempt);
+                    continue;
+                }
+                throw requestError;
+            }
             const requestError = new WorkbenchApiRequestError(response.status, readResponseError(text) ?? `Request failed with status ${response.status}${response.statusText ? ` ${response.statusText}` : ""}.`, text);
             lastError = requestError;
             if (canRetry && attempt < API_REQUEST_MAX_ATTEMPTS && isTransientApiRequestError(requestError)) {
@@ -825,8 +1634,11 @@ function encodeJsonRequestBody(body) {
     if (Buffer.byteLength(text) < API_REQUEST_GZIP_THRESHOLD_BYTES) {
         return { body: text, headers: { "content-type": "application/json" } };
     }
+    const compressed = gzipSync(text);
+    const compressedBody = new ArrayBuffer(compressed.byteLength);
+    new Uint8Array(compressedBody).set(compressed);
     return {
-        body: gzipSync(text),
+        body: compressedBody,
         headers: {
             "content-encoding": "gzip",
             "content-type": "application/json",
@@ -834,26 +1646,44 @@ function encodeJsonRequestBody(body) {
     };
 }
 async function uploadAdapterConnection(bundle, parsed) {
+    const token = await workbenchCloudToken();
     if (parsed.flags["local-only"] === true) {
-        return { status: "skipped", reason: "local_only" };
+        return {
+            status: token ? "authenticated" : "not_authenticated",
+            sync: "skipped",
+            reason: "local_only",
+        };
     }
-    const config = await loadConfig();
-    if (!config.accessToken) {
-        return { status: "skipped", reason: "not_authenticated" };
+    if (!token) {
+        return {
+            status: "not_authenticated",
+            sync: "skipped",
+            reason: "not_authenticated",
+            remediation: "Run workbench login.",
+        };
     }
     await apiRequest(adapterConnectionApiPath(bundle), { method: "PUT", body: { bundle } });
-    return { status: "connected" };
+    return { status: "authenticated", sync: "uploaded" };
 }
 async function deleteAdapterConnectionRemote(target, parsed) {
+    const token = await workbenchCloudToken();
     if (parsed.flags["local-only"] === true) {
-        return { status: "skipped", reason: "local_only" };
+        return {
+            status: token ? "authenticated" : "not_authenticated",
+            sync: "skipped",
+            reason: "local_only",
+        };
     }
-    const config = await loadConfig();
-    if (!config.accessToken) {
-        return { status: "skipped", reason: "not_authenticated" };
+    if (!token) {
+        return {
+            status: "not_authenticated",
+            sync: "skipped",
+            reason: "not_authenticated",
+            remediation: "Run workbench login.",
+        };
     }
     await apiRequest(adapterConnectionApiPath(target), { method: "DELETE" });
-    return { status: "disconnected" };
+    return { status: "authenticated", sync: "deleted" };
 }
 function adapterConnectionApiPath(target) {
     const params = new URLSearchParams({ profile: target.profile });
@@ -883,6 +1713,25 @@ function readResponseError(text) {
         return text.trim() || null;
     }
 }
+function parseWorkbenchCloudErrorBody(text) {
+    try {
+        const record = asRecord(JSON.parse(text));
+        if (record?.schema !== "workbench.cloud.error.v1" || typeof record.code !== "string" || typeof record.message !== "string") {
+            return null;
+        }
+        const subject = asRecord(record.subject);
+        return {
+            code: record.code,
+            message: record.message,
+            retryable: record.retryable === true,
+            ...(typeof record.remediation === "string" ? { remediation: record.remediation } : {}),
+            ...(subject ? { subject: subject } : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}
 function isTransientFetchError(error) {
     return /(?:fetch failed|socket hang up|ECONNRESET|EPIPE|UND_ERR_SOCKET|terminated)/iu.test(errorMessage(error));
 }
@@ -895,6 +1744,14 @@ function errorMessage(error) {
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function positiveIntEnv(name) {
+    const raw = process.env[name]?.trim();
+    if (!raw) {
+        return undefined;
+    }
+    const value = Number(raw);
+    return Number.isSafeInteger(value) && value > 0 ? value : undefined;
+}
 async function openBrowser(url) {
     const command = process.platform === "darwin"
         ? "open"
@@ -911,26 +1768,6 @@ async function openBrowser(url) {
         });
     });
 }
-function retrySamplesForFailedJobs(jobs, run) {
-    if (run.status === "running") {
-        throw new WorkbenchUserError(`Run ${run.id} is still running; wait for it to finish before retrying.`);
-    }
-    const failed = jobs
-        .filter((job) => job.runId === run.id && job.status !== "succeeded")
-        .map((job) => ({ caseId: job.caseId, sample: job.sample }));
-    if (failed.length === 0) {
-        throw new WorkbenchUserError(`Run ${run.id} has no failed jobs to retry; use workbench eval to intentionally run it again.`);
-    }
-    const byKey = new Map();
-    for (const sample of failed) {
-        byKey.set(`${sample.caseId}:${sample.sample}`, sample);
-    }
-    const selectedSamples = [...byKey.values()].sort((left, right) => left.caseId.localeCompare(right.caseId) || left.sample - right.sample);
-    return {
-        samples: Math.max(1, ...selectedSamples.map((entry) => entry.sample + 1)),
-        selectedSamples,
-    };
-}
 function adapterAuthStoreRoot() {
     return process.env.WORKBENCH_ADAPTER_AUTH_STORE?.trim() || undefined;
 }
@@ -1062,24 +1899,40 @@ async function requiredAgentAuthStatuses(parsed, statuses) {
         .filter((agent) => ["codex", "claude"].includes(agent.adapter.trim().toLowerCase()))
         .map(async (agent) => {
         const target = parseAuthTarget(agent.adapter.trim().toLowerCase(), "default");
+        const local = statusMap.get(`${target.adapterId}/${target.slot ?? "_"}/${target.profile}`) ??
+            await localWorkbenchAdapterAuthStore(adapterAuthStoreRoot()).status(target);
         return {
             agent: agent.name,
             adapter: agent.adapter,
-            local: statusMap.get(`${target.adapterId}/${target.slot ?? "_"}/${target.profile}`) ??
-                await localWorkbenchAdapterAuthStore(adapterAuthStoreRoot()).status(target),
+            local: local.status === "connected" ? "connected" : "missing",
         };
     }));
 }
 function formatAuthStatusRecord(status) {
     return `${formatAuthTarget(status)}\t${status.status}${status.method ? `\t${status.method}` : ""}${status.reason ? `\t${status.reason}` : ""}`;
 }
-function formatAuthStatusList(statuses, required) {
+function authStatusRecordToJson(status) {
+    return {
+        adapter: status.adapterId,
+        ...(status.slot ? { slot: status.slot } : {}),
+        profile: status.profile,
+        status: status.status,
+        ...(status.method ? { method: status.method } : {}),
+        ...(status.updatedAt ? { updatedAt: status.updatedAt } : {}),
+    };
+}
+function formatWorkbenchCloudAuthStatus(status) {
+    return `Workbench Cloud: ${status.status}${status.baseUrl ? `\tbaseUrl=${status.baseUrl}` : ""}${status.username ? `\tuser=${status.username}` : ""}`;
+}
+function formatAuthStatusList(workbenchCloud, statuses, required) {
     const lines = [
+        formatWorkbenchCloudAuthStatus(workbenchCloud),
+        "",
         ...(statuses.length > 0
             ? ["Adapter auth:", ...statuses.map(formatAuthStatusRecord)]
             : ["No local adapter auth records."]),
         ...(required.length > 0
-            ? ["", "Required by agents:", ...required.map((entry) => `${entry.agent}\t${entry.adapter}\t${entry.local.status}${entry.local.method ? `\t${entry.local.method}` : ""}`)]
+            ? ["", "Required by agents:", ...required.map((entry) => `${entry.agent}\t${entry.adapter}\t${entry.local}`)]
             : []),
     ];
     return lines.join("\n");
@@ -1108,7 +1961,7 @@ async function showLocalAgentSession(ref) {
     const sessions = await listLocalAgentSessions();
     const session = sessions.find((entry) => entry.id === ref);
     if (!session) {
-        throw new WorkbenchUserError(`Session not found: ${ref}`);
+        throw new WorkbenchCodedError("ref_not_found", `Session not found: ${ref}`, { exitCode: 1 });
     }
     return {
         ...session,
@@ -1234,6 +2087,17 @@ function parseArgs(argv) {
             addFlag(flags, "version", true);
             continue;
         }
+        if (arg === "-n") {
+            const value = argv[index + 1];
+            if (value && !value.startsWith("-")) {
+                index += 1;
+                addFlag(flags, "samples", value);
+            }
+            else {
+                addFlag(flags, "samples", true);
+            }
+            continue;
+        }
         if (!arg.startsWith("--") || arg === "--") {
             positionals.push(arg);
             continue;
@@ -1241,7 +2105,9 @@ function parseArgs(argv) {
         const eq = arg.indexOf("=");
         const name = eq === -1 ? arg.slice(2) : arg.slice(2, eq);
         const value = eq === -1 ? argv[index + 1] : arg.slice(eq + 1);
-        if (eq === -1 && BOOLEAN_FLAGS.has(name)) {
+        const flagSpec = flagSpecForParsedPrefix(positionals, flags);
+        const kind = flagSpec?.[name];
+        if (eq === -1 && kind === "boolean") {
             addFlag(flags, name, true);
         }
         else if (eq === -1 && value && !value.startsWith("-")) {
@@ -1254,8 +2120,12 @@ function parseArgs(argv) {
     }
     return { positionals, flags };
 }
+function flagSpecForParsedPrefix(positionals, flags) {
+    const command = positionals[0] ?? (flags.version === true ? "version" : "status");
+    return allowedFlagsForCommand({ positionals: [...positionals], flags: {} }, command);
+}
 function addFlag(flags, name, value) {
-    if (name === "with") {
+    if (name === "with" || name === "to") {
         const existing = flags[name];
         flags[name] = Array.isArray(existing)
             ? [...existing, String(value)]
@@ -1272,13 +2142,21 @@ function dirFlag(parsed) {
 async function coreOptions(parsed) {
     return {
         dir: dirFlag(parsed),
-        authToken: await workbenchRemoteAuthToken(),
+        authToken: await workbenchCloudToken(),
     };
 }
 function stringFlag(parsed, name) {
     const value = parsed.flags[name];
     return typeof value === "string" ? value : undefined;
 }
+function stringsFlag(parsed, name) {
+    const value = parsed.flags[name];
+    return Array.isArray(value)
+        ? value
+        : typeof value === "string"
+            ? [value]
+            : [];
+}
 function intFlag(parsed, name) {
     const value = stringFlag(parsed, name);
     if (!value) {
@@ -1300,14 +2178,177 @@ function requiredPositional(parsed, index, message) {
     }
     return value;
 }
-function parsePublishVisibility(value) {
-    if (value === undefined) {
+function requiredFlag(parsed, input) {
+    const flagValue = stringFlag(parsed, input.flag);
+    if (!flagValue) {
+        throw new WorkbenchCodedError("usage", input.usage, {
+            remediation: input.remediation,
+            exitCode: 2,
+        });
+    }
+    return flagValue;
+}
+function rejectExtraInput(parsed, input) {
+    if (parsed.positionals.length <= input.maxPositionals) {
+        return;
+    }
+    throw new WorkbenchCodedError("usage", input.message, {
+        remediation: input.remediation,
+        exitCode: 2,
+    });
+}
+async function defaultDiffRange(core) {
+    await listWorkbenchVersions(core);
+    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(core);
+    const currentId = snapshot.status.currentVersionId ?? snapshot.refs.current;
+    const current = snapshot.versions.find((version) => version.id === currentId);
+    if (!current) {
+        throw new WorkbenchCodedError("version_not_found", "Current Workbench version was not found.", {
+            remediation: "Run workbench log --versions.",
+            exitCode: 1,
+        });
+    }
+    const parent = current.parentIds[0];
+    return parent ? `${parent}..${current.id}` : `${current.id}..${current.id}`;
+}
+function parsePublishVisibilityFlags(parsed) {
+    const selected = [
+        parsed.flags.private === true ? "private" : undefined,
+        parsed.flags.team === true ? "internal" : undefined,
+        parsed.flags.public === true ? "public" : undefined,
+    ].filter((value) => Boolean(value));
+    if (selected.length > 1) {
+        throw new WorkbenchCodedError("usage", "workbench publish accepts only one visibility flag.", {
+            remediation: "Run workbench publish --private, workbench publish --team, or workbench publish --public.",
+            exitCode: 2,
+        });
+    }
+    return selected[0];
+}
+async function previewPublishWithDerivedRemote(parsed) {
+    const root = path.resolve(dirFlag(parsed) ?? process.cwd());
+    const core = await coreOptions(parsed);
+    await listWorkbenchVersions(core);
+    const reconciledSnapshot = await createWorkbenchReadOnlyInspectionSnapshot({ dir: root });
+    const link = cloudRemoteLinkTargetFromRemotes(reconciledSnapshot.remotes);
+    if (link.existing) {
         return undefined;
     }
-    if (value === "private" || value === "public") {
-        return value;
+    const remote = await derivePublishCloudRemote(parsed, "workbench publish", link.name);
+    const requestedVersion = optionalPositional(parsed, 1);
+    const versionId = requestedVersion && requestedVersion !== "current"
+        ? requestedVersion
+        : reconciledSnapshot.status.currentVersionId ?? reconciledSnapshot.refs.current;
+    const version = reconciledSnapshot.versions.find((entry) => entry.id === versionId);
+    if (!version) {
+        throw new WorkbenchCodedError("version_not_found", `Version not found: ${requestedVersion ?? "current"}`, {
+            remediation: "Run workbench log --versions.",
+            subject: { version: requestedVersion ?? "current" },
+            exitCode: 1,
+        });
+    }
+    return {
+        remote,
+        version,
+        visibility: parsePublishVisibilityFlags(parsed) ?? "private",
+        installHandle: installHandleFromCloudRemote(remote),
+        installUrl: remote.url,
+        pinnedInstallUrl: `${remote.url}/releases/${encodeURIComponent(version.id)}`,
+    };
+}
+async function ensurePublishRemote(parsed) {
+    const core = await coreOptions(parsed);
+    const root = path.resolve(dirFlag(parsed) ?? process.cwd());
+    const link = await cloudRemoteLinkTarget(root);
+    const override = stringFlag(parsed, "as");
+    if (override) {
+        const remote = await derivePublishCloudRemote(parsed, "workbench publish", link.name);
+        const result = await addWorkbenchRemote(remote.name, remote.url, { ...core, replace: link.replace });
+        return result.remote.name;
+    }
+    if (link.existing) {
+        return link.existing.name;
+    }
+    const remote = await derivePublishCloudRemote(parsed, "workbench publish", link.name);
+    const result = await addWorkbenchRemote(remote.name, remote.url, core);
+    return result.remote.name;
+}
+async function derivePublishCloudRemote(parsed, action = "workbench publish", name = "cloud") {
+    const config = await loadConfig();
+    const baseUrl = optionalWorkbenchBaseUrl({ configBaseUrl: config.baseUrl }) ?? DEFAULT_WORKBENCH_CLOUD_BASE_URL;
+    const override = stringFlag(parsed, "as");
+    const handle = override ? parseOwnerSkillHandle(override) : derivedOwnerSkillHandle(parsed, config, action);
+    const url = `${baseUrl}/skills/${encodeURIComponent(handle.owner)}/${encodeURIComponent(handle.skill)}`;
+    return { name, kind: "workbench-cloud", url };
+}
+function installHandleFromCloudRemote(remote) {
+    const source = parseWorkbenchInstallSource(remote.url);
+    if (!source) {
+        throw new WorkbenchCodedError("remote_invalid_url", `Workbench remote is not a Cloud skill URL: ${remote.url}`, {
+            remediation: "Run workbench publish to recreate the Workbench Cloud link.",
+            subject: { remote: remote.name, url: remote.url },
+            exitCode: 2,
+        });
     }
-    throw new WorkbenchUserError("workbench publish --visibility must be private or public.");
+    return `${source.owner}/${source.skill}`;
+}
+function parseOwnerSkillHandle(input) {
+    const handle = normalizedOwnerSkillHandle(input);
+    if (!handle) {
+        throw new WorkbenchCodedError("usage", "workbench publish --as expects OWNER/SKILL.", {
+            remediation: "Run workbench publish --as OWNER/SKILL.",
+            exitCode: 2,
+        });
+    }
+    return handle;
+}
+function derivedOwnerSkillHandle(parsed, config, action) {
+    const owner = config.username?.trim();
+    if (!owner) {
+        throw new WorkbenchCodedError("auth_required", `${action} needs a logged-in Workbench Cloud username before it can derive OWNER/SKILL.`, {
+            remediation: "Run workbench login.",
+            exitCode: 1,
+        });
+    }
+    const root = path.resolve(dirFlag(parsed) ?? process.cwd());
+    const handle = normalizeOwnerSkillHandle(owner, path.basename(root));
+    if (!handle.owner || !handle.skill) {
+        throw new WorkbenchCodedError("usage", `${action} could not derive a valid OWNER/SKILL handle.`, {
+            remediation: `Run ${action} --as OWNER/SKILL.`,
+            subject: { owner, skill: path.basename(root) },
+            exitCode: 2,
+        });
+    }
+    return handle;
+}
+async function resolveWorkbenchInstallSourceInput(input) {
+    if (/^https?:\/\//u.test(input)) {
+        return input;
+    }
+    const handle = normalizedOwnerSkillHandle(input);
+    if (!handle) {
+        throw new WorkbenchCodedError("usage", "workbench install expects OWNER/SKILL or a Workbench Cloud skill URL.", {
+            remediation: "Run workbench install OWNER/SKILL --to codex.",
+            exitCode: 2,
+        });
+    }
+    const config = await loadConfig();
+    const baseUrl = optionalWorkbenchBaseUrl({ configBaseUrl: config.baseUrl }) ?? DEFAULT_WORKBENCH_CLOUD_BASE_URL;
+    return `${baseUrl}/skills/${encodeURIComponent(handle.owner)}/${encodeURIComponent(handle.skill)}`;
+}
+function normalizedOwnerSkillHandle(value) {
+    const parts = value.trim().split("/");
+    if (parts.length !== 2) {
+        return null;
+    }
+    const handle = normalizeOwnerSkillHandle(parts[0] ?? "", parts[1] ?? "");
+    return handle.owner && handle.skill ? handle : null;
+}
+function normalizeOwnerSkillHandle(owner, skill) {
+    return {
+        owner: normalizeWorkbenchSkillName(owner),
+        skill: normalizeWorkbenchSkillName(skill),
+    };
 }
 function parseWithFlags(parsed) {
     const raw = parsed.flags.with;
@@ -1332,71 +2373,284 @@ function parseScalar(value) {
     }
     return value;
 }
-function output(value, parsed, io, text) {
-    if (parsed.flags.json === true) {
-        io.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+async function artifactIdsByRunId(core, runs) {
+    const runIds = new Set(runs.map((run) => run.id));
+    const byRun = new Map([...runIds].map((runId) => [runId, []]));
+    if (runIds.size === 0) {
+        return byRun;
     }
-    else {
-        io.stdout.write(`${text()}\n`);
+    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(core);
+    for (const job of snapshot.jobs) {
+        if (!runIds.has(job.runId)) {
+            continue;
+        }
+        const current = byRun.get(job.runId) ?? [];
+        byRun.set(job.runId, [...new Set([...current, ...job.artifactIds])]);
     }
-    return 0;
+    return byRun;
+}
+function emitEvalFailure(runs, failedRuns, artifactIds, parsed, io) {
+    const nextCommands = evalFailureNextCommands(failedRuns);
+    if (parsed.flags.json === true) {
+        io.stdout.write(`${JSON.stringify({
+            schema: "workbench.cli.eval.v1",
+            ok: false,
+            code: "eval_runs_failed",
+            message: "Eval failed; evidence was saved.",
+            retryable: false,
+            evidenceSaved: true,
+            runs: runs.map((run) => runFailureSummary(run, artifactIds.get(run.id) ?? [])),
+            failedRuns: failedRuns.map((run) => runFailureSummary(run, artifactIds.get(run.id) ?? [])),
+            nextCommands,
+        }, null, 2)}\n`);
+        return 1;
+    }
+    io.stdout.write([
+        "Eval failed; evidence was saved.",
+        ...failedRuns.map(formatRun),
+        ...(nextCommands[0] ? [`next: ${nextCommands[0]}`] : []),
+    ].join("\n") + "\n");
+    return 1;
+}
+function runSummary(run, artifactIds) {
+    return {
+        id: run.id,
+        kind: run.kind,
+        status: run.status,
+        versionId: run.versionId,
+        skillName: run.skillName,
+        agentName: run.agentName,
+        ...(run.score !== undefined ? { score: run.score } : {}),
+        ...(run.latencyMs !== undefined ? { latencyMs: run.latencyMs } : {}),
+        ...(run.error ? { error: run.error } : {}),
+        ...(run.jobIds ? { jobIds: run.jobIds } : {}),
+        traceIds: run.traceIds,
+        artifactIds: [...artifactIds],
+    };
 }
-function formatStatus(status) {
-    if (!status.initialized) {
-        return `Workbench: not initialized\nRoot: ${status.root}`;
+function runFailureSummary(run, artifactIds) {
+    return {
+        runId: run.id,
+        agent: run.agentName,
+        skill: run.skillName,
+        status: run.status,
+        versionId: run.versionId,
+        ...(run.score !== undefined ? { score: run.score } : {}),
+        ...(run.error ? { error: run.error } : {}),
+        traceIds: run.traceIds,
+        artifactIds: [...artifactIds],
+    };
+}
+function evalFailureNextCommands(failedRuns) {
+    const first = failedRuns[0];
+    if (!first) {
+        return ["workbench log --runs"];
     }
     return [
-        `Root: ${status.root}`,
-        `Current version: ${status.currentVersionId ?? "none"}`,
-        `Unversioned changes: ${status.hasUnversionedChanges ? "yes" : "no"}`,
-        `Default skill: ${status.defaultSkill ?? "none"}`,
-        `Default agent: ${status.defaultAgent ?? "none"}`,
-        `Versions: ${status.versionCount}`,
-        `Skills: ${status.skillCount}`,
-        `Agents: ${status.agentCount}`,
-        `Runs: ${status.runCount}`,
-        `Remotes: ${status.remoteCount}`,
-        ...(status.pendingSyncCount ? [`Pending sync: ${status.pendingSyncCount}`] : []),
-        ...(status.lastScore !== undefined ? [`Last score: ${status.lastScore}`] : []),
-        ...(status.automationReadiness ? [`Automation readiness: ${status.automationReadiness.label} - ${status.automationReadiness.reason}`] : []),
-    ].join("\n");
+        `workbench show ${first.id}`,
+        `workbench show ${first.id}:stderr.log`,
+        `workbench case add ${first.id}`,
+        `workbench improve --agents ${first.agentName} --budget 1 -n 1`,
+    ];
 }
-function formatCheck(result) {
-    return [
-        "Workbench skill is valid.",
-        `Cases: ${result.cases} (${result.plan.source.smokeCaseCount} smoke)`,
-        `Skills: ${result.skills}`,
-        `Agents: ${result.agents}`,
-        `Skill files: ${result.plan.source.skillFiles}`,
-        `Eval files: ${result.plan.source.evalFiles}`,
-        `Readiness: ${result.plan.readiness.label} - ${result.plan.readiness.reason}`,
-        "",
-        "Skill plan:",
-        ...result.plan.skills.map((skill) => [
-            skill.name,
-            `bundle=${skill.bundleHash.slice(0, 12)}`,
-            `files=${skill.fileCount}`,
-            `includes=${skill.includedSkillCount}`,
-        ].join("\t")),
-        "",
-        "Agent plan:",
-        ...result.plan.agents.map((agent) => [
-            agent.name,
-            agent.adapter,
-            agent.model,
-            agent.providerBacked ? "provider-eval" : "local-eval",
-            `network=${agent.network.egress}`,
-            `cpu=${agent.resources.cpu}`,
-            `memoryGb=${agent.resources.memoryGb}`,
-            `timeout=${agent.resources.timeoutMinutes}m`,
-            `image=${agent.image}`,
-            agent.auth ? `auth=${agent.auth}` : undefined,
-        ].filter(Boolean).join("\t")),
-    ].join("\n");
+function output(value, parsed, io, text) {
+    return emitResult(commandSchema(parsed), { result: value }, parsed, io, text);
+}
+function commandSchema(parsed) {
+    const command = parsed.positionals[0] ?? "result";
+    const subcommand = parsed.positionals[1];
+    const suffix = ["agent", "case"].includes(command) && subcommand
+        ? `${command}-${subcommand}`
+        : command;
+    return `workbench.cli.${suffix}.v1`;
+}
+async function workbenchCliAuthStatus() {
+    const config = await loadConfig();
+    const adapterStatuses = await localWorkbenchAdapterAuthStore(adapterAuthStoreRoot()).listStatus().catch(() => []);
+    const baseUrl = optionalWorkbenchBaseUrl({ configBaseUrl: config.baseUrl });
+    return {
+        workbenchCloud: {
+            status: config.accessToken || workbenchCloudEnvToken() ? "authenticated" : "not_authenticated",
+            ...(baseUrl ? { baseUrl } : {}),
+            ...(config.accessToken && config.username ? { username: config.username } : {}),
+        },
+        adapters: adapterStatuses.map((status) => ({
+            adapter: status.adapterId,
+            ...(status.slot ? { slot: status.slot } : {}),
+            profile: status.profile,
+            status: status.status,
+            ...(status.method ? { method: status.method } : {}),
+            ...(status.updatedAt ? { updatedAt: status.updatedAt } : {}),
+        })),
+    };
+}
+function formatLogEntry(entry) {
+    if (entry.kind === "version") {
+        return `${entry.createdAt}\tversion\t${entry.id}\tfiles=${entry.fileCount}\t${entry.message}`;
+    }
+    const score = entry.score === undefined ? "n/a" : entry.score.toFixed(3);
+    return `${entry.createdAt}\trun\t${entry.id}\t${entry.status}\tversion=${entry.versionId}\tskill=${entry.skillName}\tagent=${entry.agentName}\tscore=${score}`;
+}
+function splitShowRef(ref) {
+    const index = ref.indexOf(":");
+    if (index === -1) {
+        return [ref, null];
+    }
+    return [ref.slice(0, index), ref.slice(index + 1)];
+}
+async function fileForRunOrJobRef(core, objectRef, requestedPath) {
+    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(core);
+    const run = snapshot.runs.find((entry) => entry.id === objectRef);
+    const job = snapshot.jobs.find((entry) => entry.id === objectRef);
+    if (!run && !job) {
+        return null;
+    }
+    const traceIds = run?.traceIds ?? job?.traceIds ?? [];
+    const traces = snapshot.traces.filter((trace) => traceIds.includes(trace.id));
+    for (const trace of traces) {
+        const file = findShowFile(trace.files, requestedPath);
+        if (file) {
+            return file;
+        }
+    }
+    throw new WorkbenchCodedError("ref_not_found", `File not found in ${objectRef}: ${requestedPath}`, {
+        remediation: `Run workbench show ${objectRef}.`,
+        subject: { ref: objectRef, path: requestedPath },
+        exitCode: 1,
+    });
+}
+function evidenceDetailsForRunOrJob(snapshot, ref) {
+    const run = snapshot.runs.find((entry) => entry.id === ref);
+    const job = snapshot.jobs.find((entry) => entry.id === ref);
+    const jobs = run
+        ? snapshot.jobs.filter((entry) => entry.runId === run.id)
+        : job ? [job] : [];
+    return jobs.flatMap((entry) => {
+        const detail = workbenchJobEvidenceForSnapshot(snapshot, {
+            runId: entry.runId,
+            jobId: entry.id,
+        });
+        return detail ? [detail] : [];
+    }).filter((detail) => detail.executions.some((execution) => execution.sessions.length > 0 ||
+        execution.trace.spans.length > 0 ||
+        execution.trace.events.length > 0 ||
+        execution.trace.summaries.length > 0));
+}
+function findShowFile(files, requestedPath) {
+    const normalized = requestedPath.replace(/\\/gu, "/");
+    return files.find((file) => file.path === normalized) ??
+        files.find((file) => file.path.endsWith(`/${normalized}`)) ??
+        files.find((file) => path.basename(file.path) === normalized) ??
+        null;
+}
+function fileListing(kind, id, files) {
+    return {
+        kind,
+        id,
+        fileCount: files.length,
+        files: files.map(fileSummary),
+    };
+}
+function formatFileListing(kind, id, files) {
+    return [`${kind}\t${id}\tfiles=${files.length}`, ...files.map((file) => file.path)].join("\n");
+}
+async function traceIdForCaseSource(core, ref) {
+    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(core);
+    const trace = snapshot.traces.find((entry) => entry.id === ref);
+    if (trace) {
+        return trace.id;
+    }
+    const run = snapshot.runs.find((entry) => entry.id === ref);
+    const job = snapshot.jobs.find((entry) => entry.id === ref);
+    const traceId = run?.traceIds[0] ?? job?.traceIds[0];
+    if (traceId) {
+        return traceId;
+    }
+    throw new WorkbenchCodedError("ref_not_found", `Run, job, or trace not found: ${ref}`, {
+        remediation: "Run workbench log, then workbench case add RUN_ID.",
+        subject: { ref },
+        exitCode: 1,
+    });
+}
+async function evalDeltas(core, runs) {
+    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(core);
+    return runs.map((run) => {
+        const previous = snapshot.runs
+            .filter((candidate) => candidate.id !== run.id &&
+            candidate.skillName === run.skillName &&
+            candidate.agentName === run.agentName &&
+            typeof candidate.score === "number" &&
+            candidate.createdAt < run.createdAt)
+            .sort((left, right) => right.createdAt.localeCompare(left.createdAt))[0];
+        return {
+            runId: run.id,
+            versionId: run.versionId,
+            skillName: run.skillName,
+            agentName: run.agentName,
+            ...(run.score !== undefined ? { score: run.score } : {}),
+            ...(previous?.score !== undefined ? { previousScore: previous.score } : {}),
+            ...(run.score !== undefined && previous?.score !== undefined ? { delta: run.score - previous.score } : {}),
+        };
+    });
+}
+function formatEvalDelta(delta) {
+    const score = delta.score === undefined ? "n/a" : delta.score.toFixed(3);
+    if (delta.previousScore === undefined || delta.delta === undefined) {
+        return `${delta.skillName} ${delta.versionId} ${score} (was n/a)`;
+    }
+    const sign = delta.delta >= 0 ? "+" : "";
+    return `${delta.skillName} ${delta.versionId} ${score} (was ${delta.previousScore.toFixed(3)}, ${sign}${delta.delta.toFixed(3)})`;
+}
+function evalSuccessNextCommands(runs) {
+    return runs.length > 0 ? ["workbench publish"] : ["workbench eval"];
+}
+function formatStatusSnapshot(status) {
+    const lines = [
+        `Root: ${status.project.root}`,
+        `Initialized: ${status.project.initialized ? "yes" : "no"}`,
+        ...(status.project.currentVersionId ? [`Current version: ${status.project.currentVersionId}`] : []),
+        ...(status.project.defaultSkill ? [`Default skill: ${status.project.defaultSkill}`] : []),
+        ...(status.project.defaultAgent ? [`Default agent: ${status.project.defaultAgent}`] : []),
+        `Runs: ${status.runs.total}${status.runs.lastStatus ? ` (last ${status.runs.lastStatus})` : ""}`,
+        `Workbench Cloud: ${status.auth?.workbenchCloud.status ?? "not_authenticated"}${status.auth?.workbenchCloud.baseUrl ? ` ${status.auth.workbenchCloud.baseUrl}` : ""}`,
+        ...(status.remotes.length > 0 ? ["Remotes:", ...status.remotes.flatMap((remote) => {
+                const publication = remote.publication.status === "published"
+                    ? [
+                        "publication=published",
+                        remote.publication.visibility ? `visibility=${remote.publication.visibility}` : undefined,
+                        remote.publication.versionId ? `version=${remote.publication.versionId}` : undefined,
+                        remote.publication.installUrl ? `install=${remote.publication.installUrl}` : undefined,
+                        remote.publication.pinnedInstallUrl ? `pinned=${remote.publication.pinnedInstallUrl}` : undefined,
+                    ].filter(Boolean).join("\t")
+                    : "publication=unpublished";
+                return [
+                    `  ${remote.name}\tkind=${remote.kind}\tsync=${remote.sync.status}\turl=${remote.url}\t${publication}`,
+                    ...(remote.sync.status === "error" && remote.sync.lastError
+                        ? [
+                            `    error[${remote.sync.lastError.code}]: ${remote.sync.lastError.message}`,
+                            ...(remote.sync.lastAttemptAt ? [`    last attempt: ${remote.sync.lastAttemptAt}`] : []),
+                            ...(remote.sync.nextCommand ? [`    next: ${remote.sync.nextCommand}`] : []),
+                        ]
+                        : []),
+                ];
+            })] : ["Remotes: none"]),
+        ...(status.next[0] ? [`next: ${status.next[0]}`] : []),
+    ];
+    return lines.join("\n");
 }
 function formatVersion(version) {
     return `${version.id}\t${version.hash.slice(0, 12)}\t${version.message}`;
 }
+function versionSummary(version) {
+    return {
+        id: version.id,
+        hash: version.hash,
+        message: version.message,
+        parentIds: version.parentIds,
+        createdAt: version.createdAt,
+        fileCount: version.files.length,
+    };
+}
 function formatAgent(agent) {
     return `${agent.name}\t${agent.adapter}${agent.model ? `\t${agent.model}` : ""}`;
 }
@@ -1419,14 +2673,14 @@ function formatJob(job) {
     return `${job.id}\trun=${job.runId}\tcase=${job.caseId}\tsample=${job.sample}\t${job.status}\tscore=${score}\tduration=${duration}`;
 }
 function formatComparison(comparison) {
-    const lines = ["version\tskill\tagent\tscore\treadiness\tcost\tlatency\trun"];
+    const lines = ["version\tskill\tagent\tstatus\tscore\tcost\tlatency\trun"];
     for (const cell of comparison.cells) {
         lines.push([
             cell.versionId,
             cell.skillName,
-            cell.agentName,
+            `${cell.agentName}@${shortObjectId(cell.agentHash)}`,
+            cell.status ?? "not-run",
             cell.score === undefined ? "n/a" : cell.score.toFixed(3),
-            cell.automationReadiness?.label ?? "n/a",
             cell.costUsd === undefined ? "n/a" : `$${cell.costUsd.toFixed(4)}`,
             cell.latencyMs === undefined ? "n/a" : `${cell.latencyMs}ms`,
             cell.runId ?? "n/a",
@@ -1434,6 +2688,9 @@ function formatComparison(comparison) {
     }
     return lines.join("\n");
 }
+function shortObjectId(id) {
+    return id.length > 12 ? id.slice(0, 12) : id;
+}
 function formatTrace(trace) {
     const result = asRecord(trace.result);
     const status = typeof result?.status === "string" ? result.status : undefined;
@@ -1448,9 +2705,62 @@ function formatTrace(trace) {
         `files=${trace.files.length}${files ? ` (${files}${trace.files.length > 5 ? ",..." : ""})` : ""}`,
     ].filter(Boolean).join("\t");
 }
+function traceSummary(trace) {
+    const result = asRecord(trace.result);
+    return {
+        id: trace.id,
+        runId: trace.runId,
+        ...(trace.jobId ? { jobId: trace.jobId } : {}),
+        versionId: trace.versionId,
+        skillName: trace.skillName,
+        agentName: trace.agentName,
+        createdAt: trace.createdAt,
+        ...(typeof result?.status === "string" ? { status: result.status } : {}),
+        ...(typeof result?.score === "number" ? { score: result.score } : {}),
+        ...(typeof result?.error === "string" ? { error: singleLine(result.error) } : {}),
+        fileCount: trace.files.length,
+        files: trace.files.map(fileSummary),
+    };
+}
+function formatTraceDetail(detail) {
+    return detail.executions.map((execution) => {
+        const sessionLabels = execution.sessions.map((session) => session.label).join(",");
+        return [
+            `${execution.id}\trun=${detail.runId}\tjobs=${execution.jobIds.join(",")}\tstatus=${execution.status}`,
+            `events=${execution.trace.events.length}`,
+            `spans=${execution.trace.spans.length}`,
+            `summaries=${execution.trace.summaries.length}`,
+            sessionLabels ? `sessions=${sessionLabels}` : undefined,
+        ].filter(Boolean).join("\t");
+    }).join("\n");
+}
 function formatArtifact(artifact) {
     return `${artifact.id}\trun=${artifact.runId}\tjob=${artifact.jobId}\t${artifact.kind}\tfiles=${artifact.files.length}`;
 }
+function artifactSummary(artifact) {
+    return {
+        id: artifact.id,
+        runId: artifact.runId,
+        jobId: artifact.jobId,
+        kind: artifact.kind,
+        fileCount: artifact.files.length,
+        files: artifact.files.map(fileSummary),
+    };
+}
+function fileSummary(file) {
+    return {
+        path: file.path,
+        ...(file.kind ? { kind: file.kind } : {}),
+        ...(file.encoding ? { encoding: file.encoding } : {}),
+        ...(file.executable !== undefined ? { executable: file.executable } : {}),
+        bytes: surfaceFileByteLength(file),
+    };
+}
+function surfaceFileByteLength(file) {
+    return file.encoding === "base64"
+        ? Buffer.byteLength(file.content, "base64")
+        : Buffer.byteLength(file.content, "utf8");
+}
 function formatSession(session) {
     return `${session.id}\t${session.source}\t${session.updatedAt}\t${session.bytes}b\t${session.path}${session.title ? `\t${session.title}` : ""}`;
 }
@@ -1473,6 +2783,9 @@ function formatShow(value) {
 function isSurfaceFile(value) {
     return Boolean(value && typeof value === "object" && "content" in value && typeof value.content === "string");
 }
+function singleLine(value) {
+    return value.replace(/\s+/gu, " ").trim();
+}
 function asRecord(value) {
     return value && typeof value === "object" && !Array.isArray(value)
         ? value