@workbench-ai/workbench 0.0.69 → 0.0.71

package/dist/index.js

@@ -4,119 +4,106 @@ import { createRequire } from "node:module";
 import os from "node:os";
 import path from "node:path";
 import { gzipSync } from "node:zlib";
-import { addWorkbenchCase, addWorkbenchRemote, addWorkbenchAgent, checkWorkbenchSkill, compareWorkbench, createWorkbenchAdapterAuthBundle, createWorkbenchReadOnlyInspectionSnapshot, diffWorkbenchVersions, evalWorkbenchSkill, filesForWorkbenchRef, improveWorkbenchSkill, initWorkbenchSkill, listWorkbenchCases, listWorkbenchRemotes, listWorkbenchAgents, listWorkbenchVersions, localWorkbenchAdapterAuthStore, parseWorkbenchAdapterAuthTarget, publishWorkbenchVersion, removeWorkbenchCase, removeWorkbenchAgent, removeWorkbenchRemote, setDefaultWorkbenchAgent, showWorkbenchCase, showWorkbenchRef, switchWorkbenchVersion, syncWorkbenchRemote, workbenchJobEvidenceForSnapshot, workbenchStatusSnapshot, WorkbenchCodedError, WorkbenchUserError, } from "@workbench-ai/workbench-core";
+import { addWorkbenchCase, addWorkbenchRemote, addWorkbenchAgent, compareWorkbench, createWorkbenchInspectionSnapshot, createWorkbenchAdapterAuthBundle, createWorkbenchReadOnlyInspectionSnapshot, diffWorkbenchVersions, evalWorkbenchSkill, improveWorkbenchSkill, initWorkbenchSkill, listWorkbenchAgents, listWorkbenchVersions, localWorkbenchAdapterAuthStore, parseWorkbenchAdapterAuthTarget, publishWorkbenchVersion, removeWorkbenchAgent, showWorkbenchRef, switchWorkbenchVersion, syncWorkbenchRemote, workbenchJobEvidenceForSnapshot, workbenchSkillImproveCanUseQueuedAdapter, workbenchStatusSnapshot, WorkbenchCodedError, WorkbenchUserError, } from "@workbench-ai/workbench-core";
+import { normalizeWorkbenchSkillName } from "@workbench-ai/workbench-contract";
 import { emitError, emitResult } from "./output.js";
-import { installSnapshotToTargets, installTargetsToJson, normalizeInstallSnapshotPath, resolveInstallTargets, supportedInstallTargets, } from "./install-targets.js";
+import { installSnapshotToTargets, normalizeInstallSnapshotPath, resolveInstallTargets, supportedInstallTargets, } from "./install-targets.js";
 import { startWorkbenchOpenServer } from "./open-server.js";
 const require = createRequire(import.meta.url);
 const HELP = [
     "Usage:",
+    "  workbench [--json]",
     "  workbench <command> [options]",
     "",
-    "Primary loop:",
-    "  workbench init [DIR] [--json]",
-    "  workbench check [--dir DIR] [--json]",
-    "  workbench eval [VERSION] [--skills all|LIST] [--agents all|LIST] [--samples N] [--rerun] [--json]",
+    "Bare workbench prints project status and the next useful command.",
+    "",
+    "Taught commands:",
+    "  workbench new [DIR] [--json]",
+    "  workbench eval [VERSION] [--skills all|LIST] [--agents all|LIST] [-n N|--samples N] [--rerun] [--cloud] [--json]",
+    "  workbench improve [VERSION] [--skills LIST] [--agents LIST] [--budget N] [-n N|--samples N] [--cloud] [--json]",
     "  workbench compare [--skills all|LIST] [--agents all|LIST] [--versions all|A..B|LIST] [--json]",
-    "  workbench improve [VERSION] [--skill SKILL] [--agent AGENT] [--budget N] [--samples N] [--json]",
+    "  workbench publish [VERSION] [--as OWNER/SKILL] [--private|--team|--public] [--dry-run] [--json]",
+    "  workbench install HANDLE_OR_URL [--to codex|claude|local]... [--yes] [--dry-run] [--json]",
+    "",
+    "More:",
+    "  workbench help --all",
+].join("\n");
+const HELP_ALL = [
+    "Usage:",
+    "  workbench                          # = workbench status",
+    "  workbench new [DIR] [--json]",
+    "  workbench eval [VERSION] [--skills all|LIST] [--agents all|LIST] [-n N|--samples N] [--rerun] [--cloud] [--json]",
+    "  workbench compare [--skills all|LIST] [--agents all|LIST] [--versions all|A..B|LIST] [--json]",
+    "  workbench improve [VERSION] [--skills LIST] [--agents LIST] [--budget N] [-n N|--samples N] [--cloud] [--json]",
+    "  workbench publish [VERSION] [--as OWNER/SKILL] [--private|--team|--public] [--dry-run] [--json]",
+    "  workbench install HANDLE_OR_URL [--to codex|claude|local]... [--yes] [--dry-run] [--json]",
     "",
     "Inspect:",
     "  workbench status [--dir DIR] [--json]",
-    "  workbench versions [--dir DIR] [--json]",
-    "  workbench switch VERSION [--dir DIR] [--json]",
-    "  workbench diff [A..B] [--dir DIR] [--json]",
+    "  workbench log [--runs|--versions] [--json]",
     "  workbench show REF[:PATH] [--json]",
-    "  workbench files REF [--json]",
-    "  workbench list runs|jobs|traces|artifacts|sessions [--json]",
-    "  workbench trace RUN_ID|JOB_ID|TRACE_ID [--json]",
+    "  workbench diff [A..B] [--json]",
+    "  workbench switch VERSION [--json]",
     "  workbench open [--host HOST] [--port PORT] [--no-open] [--json]",
     "",
     "Configure:",
-    "  workbench agent list|add|show|default|remove ...",
-    "  workbench skills list",
-    "  workbench case list|add|show|remove ...",
+    "  workbench case add RUN_ID [--json]",
+    "  workbench agent add NAME --adapter X [--model M] [--with k=v]... | list | rm NAME [--json]",
     "",
     "Share and auth:",
-    "  workbench remote add --name NAME --url URL [--replace] [--dry-run] [--dir DIR] [--json]",
-    "  workbench remote list [--dir DIR] [--json]",
-    "  workbench remote remove NAME [--dir DIR] [--json]",
-    "  workbench sync [REMOTE] [--dry-run] [--dir DIR] [--json]",
-    "  workbench publish [VERSION] [--remote REMOTE] [--visibility private|internal|public] [--dry-run] [--dir DIR] [--json]",
-    "  workbench install --source SOURCE [--agent codex|claude]... [--local] [--yes] [--list] [--dry-run] [--json]",
-    "  workbench auth status [ADAPTER[/SLOT]] [--profile PROFILE] [--json]",
-    "  workbench auth connect ADAPTER[/SLOT] [--method METHOD] [--profile PROFILE] [--profile-root DIR] [--local-only] [--json]",
-    "  workbench auth disconnect ADAPTER[/SLOT] [--profile PROFILE] [--local-only] [--json]",
-    "  workbench login [--base-url URL] [--start-only|--wait] [--timeout N] [--no-open] [--json]",
-    "  workbench logout [--json]",
+    "  workbench login [PROVIDER] [--method METHOD] [--profile P] [--base-url URL] [--start-only|--wait] [--timeout N] [--no-open] [--local-only] [--json]",
+    "  workbench logout [PROVIDER] [--json]",
+    "  workbench sync [REMOTE] [--dry-run] [--json]",
     "",
     "Remote URLs:",
     "  https://HOST/skills/OWNER/SKILL  Workbench Cloud skill remote",
-    "  file:///absolute/path            local file remote",
-    "",
-    "Examples:",
-    "  workbench init ./earnings-prep",
-    "  workbench check --dir ./earnings-prep",
-    "  workbench eval --agents default --samples 1",
-    "  workbench compare",
-    "  workbench status --json",
-    "  workbench remote add --name origin --url https://v2.workbench.ai/skills/acme/earnings-prep",
-    "  workbench publish --remote origin --visibility public --json",
-    "  workbench install --source https://v2.workbench.ai/skills/acme/earnings-prep --agent codex --yes",
-    "",
-    "Environment:",
-    "  CODEX_HOME and CLAUDE_HOME override read-only session discovery roots.",
-    "  WORKBENCH_API_URL selects a Workbench Cloud API base URL for login, auth, and HTTP remotes.",
-    "  WORKBENCH_API_TOKEN supplies a Workbench Cloud token without a login (WORKBENCH_SMOKE_BEARER_TOKEN is a fallback).",
-    "  WORKBENCH_CONFIG overrides the CLI config path (default ~/.workbench/config.json).",
-    "  WORKBENCH_DEVICE_AUTH overrides the pending device login record path.",
-    "  WORKBENCH_ADAPTER_AUTH_STORE overrides the local adapter auth store directory.",
+    "  file:///absolute/path            local file remote for plumbing sync",
 ].join("\n");
 const COMMAND_HELP = {
-    auth: [
+    new: [
         "Usage:",
-        "  workbench auth status [ADAPTER[/SLOT]] [--profile PROFILE] [--json]",
-        "  workbench auth connect ADAPTER[/SLOT] [--method api-key|oauth|bedrock] [--profile PROFILE] [--profile-root DIR] [--local-only] [--json]",
-        "  workbench auth disconnect ADAPTER[/SLOT] [--profile PROFILE] [--local-only] [--json]",
+        "  workbench new [DIR] [--json]",
         "",
-        "Stores adapter credentials locally and uploads them to Workbench Cloud when logged in unless --local-only is passed. Codex supports oauth and api-key. Claude supports oauth, api-key, and bedrock.",
+        "Creates a Workbench skill project.",
         "",
-        "Examples:",
-        "  workbench auth status --json",
-        "  workbench auth connect codex --method api-key",
-        "  workbench auth disconnect codex --json",
+        "Example:",
+        "  workbench new earnings-prep",
     ].join("\n"),
     eval: [
         "Usage:",
-        "  workbench eval [VERSION] [--skills all|LIST] [--agents all|LIST] [--samples N] [--rerun] [--json]",
+        "  workbench eval [VERSION] [--skills all|LIST] [--agents all|LIST] [-n N|--samples N] [--rerun] [--cloud] [--json]",
         "",
         "Runs eval jobs for the selected version, measured skills, and agents. Omitted selectors use manifest defaults.",
+        "",
+        "Example:",
+        "  workbench eval -n 5",
     ].join("\n"),
     improve: [
         "Usage:",
-        "  workbench improve [VERSION] [--skill SKILL] [--agent AGENT] [--budget N] [--samples N] [--json]",
+        "  workbench improve [VERSION] [--skills LIST] [--agents LIST] [--budget N] [-n N|--samples N] [--cloud] [--json]",
+        "",
+        "Creates one improved child version from evidence. The selected skills and agents must resolve to exactly one entry each.",
         "",
-        "Creates one improved child version from evidence. Pass singular --skill and --agent when defaults expand to multiple entries.",
+        "Example:",
+        "  workbench improve --budget 1 -n 1",
     ].join("\n"),
-    install: [
+    compare: [
         "Usage:",
-        "  workbench install --source SOURCE [--agent codex|claude]... [--local] [--yes] [--list] [--dry-run] [--json]",
+        "  workbench compare [--skills all|LIST] [--agents all|LIST] [--versions all|A..B|LIST] [--json]",
         "",
-        "Installs published Workbench Cloud source into explicit local agent targets.",
+        "Compares recorded eval evidence across selected skills, agents, and versions.",
         "",
         "Example:",
-        "  workbench install --source https://v2.workbench.ai/skills/acme/earnings-prep --agent codex --yes",
+        "  workbench compare --agents all",
     ].join("\n"),
-    remote: [
+    install: [
         "Usage:",
-        "  workbench remote add --name NAME --url URL [--replace] [--dry-run] [--dir DIR] [--json]",
-        "  workbench remote list [--dir DIR] [--json]",
-        "  workbench remote remove NAME [--dir DIR] [--json]",
+        "  workbench install HANDLE_OR_URL [--to codex|claude|local]... [--yes] [--dry-run] [--json]",
         "",
-        "Remotes exchange Workbench object packs. Only Workbench Cloud remotes can publish installable source.",
+        "Installs published Workbench Cloud source into local agent targets.",
         "",
-        "Examples:",
-        "  workbench remote add --name origin --url https://v2.workbench.ai/skills/acme/earnings-prep",
-        "  workbench remote add --name scratch --url file:///tmp/earnings-prep-remote --replace",
+        "Example:",
+        "  workbench install acme/earnings-prep --to codex --yes",
     ].join("\n"),
     status: [
         "Usage:",
@@ -129,180 +116,187 @@ const COMMAND_HELP = {
     ].join("\n"),
     logout: [
         "Usage:",
-        "  workbench logout [--json]",
+        "  workbench logout [PROVIDER] [--json]",
         "",
-        "Revokes and removes the local Workbench Cloud token. Reports whether the token was revoked and whether local adapter auth records remain.",
+        "With no provider, logs out of Workbench Cloud. With a provider such as codex or claude, removes local adapter auth.",
         "",
         "Example:",
-        "  workbench logout --json",
+        "  workbench logout claude",
     ].join("\n"),
     show: [
         "Usage:",
         "  workbench show REF [--json]",
         "  workbench show REF:PATH [--json]",
         "",
-        "Shows a Workbench object or a file inside a version, trace, or artifact.",
+        "Shows a Workbench object, lists files for file-backed objects, or prints one file.",
+        "",
+        "Example:",
+        "  workbench show run_abc12345:result.json",
     ].join("\n"),
-    list: [
+    log: [
         "Usage:",
-        "  workbench list runs|jobs|traces|artifacts|sessions [--json]",
+        "  workbench log [--runs|--versions] [--json]",
+        "",
+        "Shows one reverse-chronological timeline of versions and runs.",
         "",
-        "Lists Workbench evidence or read-only native Codex/Claude session files.",
+        "Example:",
+        "  workbench log --runs",
     ].join("\n"),
-    versions: [
+    diff: [
         "Usage:",
-        "  workbench versions [--json]",
+        "  workbench diff [A..B] [--json]",
+        "",
+        "Shows changed files between two Workbench source versions.",
         "",
-        "Lists Workbench skill versions.",
+        "Example:",
+        "  workbench diff 26059f9a..eac5699c",
     ].join("\n"),
     switch: [
         "Usage:",
         "  workbench switch VERSION [--json]",
         "",
         "Switches the working skill source to a recorded Workbench version.",
+        "",
+        "Example:",
+        "  workbench switch 26059f9a",
+    ].join("\n"),
+    open: [
+        "Usage:",
+        "  workbench open [--host HOST] [--port PORT] [--no-open] [--json]",
+        "",
+        "Serves or emits the read-only Workbench inspection snapshot.",
+        "",
+        "Example:",
+        "  workbench open --no-open",
+    ].join("\n"),
+    case: [
+        "Usage:",
+        "  workbench case add RUN_ID [--json]",
+        "",
+        "Captures a regression case from a recorded run.",
+        "",
+        "Example:",
+        "  workbench case add run_abc12345",
+    ].join("\n"),
+    agent: [
+        "Usage:",
+        "  workbench agent list [--json]",
+        "  workbench agent add NAME --adapter X [--model M] [--with k=v]... [--json]",
+        "  workbench agent rm NAME [--json]",
+        "",
+        "Lists, adds, or removes eval agent configurations.",
+        "",
+        "Example:",
+        "  workbench agent add claude --adapter claude --model sonnet",
     ].join("\n"),
     sync: [
         "Usage:",
         "  workbench sync [REMOTE] [--dry-run] [--dir DIR] [--json]",
         "",
-        "Synchronizes local evidence and version objects with a Workbench remote. --dry-run reports what would be exchanged.",
+        "Plumbing command: synchronizes local evidence and version objects with a Workbench remote.",
         "",
-        "Examples:",
-        "  workbench sync origin --json",
-        "  workbench sync origin --dry-run --json",
+        "Example:",
+        "  workbench sync cloud --dry-run",
     ].join("\n"),
     publish: [
         "Usage:",
-        "  workbench publish [VERSION] [--remote REMOTE] [--visibility private|internal|public] [--dry-run] [--dir DIR] [--json]",
+        "  workbench publish [VERSION] [--as OWNER/SKILL] [--private|--team|--public] [--dry-run] [--dir DIR] [--json]",
         "",
-        "Publishes installable skill source from the selected version to a Workbench Cloud remote.",
+        "Publishes installable skill source to Workbench Cloud. --as sets the linked OWNER/SKILL handle.",
         "",
-        "Examples:",
-        "  workbench publish --remote origin --visibility private --json",
-        "  workbench publish <version-id> --remote origin --dry-run --json",
+        "Example:",
+        "  workbench publish --as acme/earnings-prep --dry-run",
     ].join("\n"),
     login: [
         "Usage:",
-        "  workbench login [--base-url URL] [--start-only|--wait] [--timeout N] [--no-open] [--json]",
-        "  workbench logout [--json]",
+        "  workbench login [PROVIDER] [--method METHOD] [--profile P] [--base-url URL] [--start-only|--wait] [--timeout N] [--no-open] [--local-only] [--json]",
+        "  workbench logout [PROVIDER] [--json]",
         "",
-        "Connects the CLI to Workbench Cloud with the device login flow.",
+        "Connects the CLI to Workbench Cloud or captures local adapter auth for a provider.",
         "",
-        "Examples:",
-        "  workbench login --start-only --json",
-        "  workbench login --wait --timeout 120 --json",
+        "Example:",
+        "  workbench login --start-only --no-open",
     ].join("\n"),
 };
-const BOOLEAN_FLAGS = new Set([
-    "help",
-    "dry-run",
-    "json",
-    "local",
-    "local-only",
-    "list",
-    "no-open",
-    "start-only",
-    "replace",
-    "rerun",
-    "wait",
-    "yes",
-]);
-const FLAG_DEFINITIONS = {
-    adapter: "string",
-    "base-url": "string",
-    budget: "positive-integer",
+const COMMON_FLAGS = {
+    json: "boolean",
+};
+const PROJECT_FLAGS = {
+    ...COMMON_FLAGS,
     dir: "string",
-    from: "string",
-    "dry-run": "boolean",
+};
+const HELP_FLAG = {
     help: "boolean",
-    host: "string",
-    json: "boolean",
-    local: "boolean",
-    "local-only": "boolean",
-    list: "boolean",
-    method: "string",
-    model: "string",
-    name: "string",
-    "no-open": "boolean",
-    port: "positive-integer",
-    profile: "string",
-    "profile-root": "string",
-    remote: "string",
-    replace: "boolean",
-    rerun: "boolean",
-    samples: "positive-integer",
-    source: "string",
-    "start-only": "boolean",
-    agent: "string",
-    agents: "string",
-    skill: "string",
-    skills: "string",
+};
+const VERSION_FLAG = {
     version: "boolean",
-    versions: "string",
-    visibility: "string",
-    timeout: "positive-integer",
-    url: "string",
-    wait: "boolean",
-    with: "repeat-string",
-    yes: "boolean",
 };
 const COMMAND_FLAGS = {
-    check: ["dir", "json"],
-    compare: ["agents", "dir", "json", "skills", "versions"],
-    diff: ["dir", "json"],
-    eval: ["agents", "dir", "json", "rerun", "samples", "skills"],
-    files: ["dir", "json"],
-    improve: ["agent", "budget", "dir", "json", "samples", "skill"],
-    init: ["dir", "json"],
-    install: ["agent", "dry-run", "json", "list", "local", "source", "yes"],
-    list: ["dir", "json"],
-    login: ["base-url", "json", "no-open", "start-only", "timeout", "wait"],
-    logout: ["json"],
-    open: ["dir", "host", "json", "no-open", "port"],
-    publish: ["dir", "dry-run", "json", "remote", "visibility"],
-    show: ["dir", "json"],
-    status: ["dir", "json"],
-    switch: ["dir", "json"],
-    sync: ["dir", "dry-run", "json"],
-    trace: ["dir", "json"],
-    versions: ["dir", "json"],
-};
-const SUBCOMMAND_FLAGS = {
-    auth: {
-        defaultSubcommand: "status",
-        flags: {
-            status: ["json", "profile"],
-            connect: ["json", "local-only", "method", "profile", "profile-root"],
-            disconnect: ["json", "local-only", "profile"],
-        },
+    compare: { ...PROJECT_FLAGS, ...HELP_FLAG, agents: "string", skills: "string", versions: "string" },
+    diff: { ...PROJECT_FLAGS, ...HELP_FLAG },
+    eval: {
+        ...PROJECT_FLAGS,
+        ...HELP_FLAG,
+        agents: "string",
+        cloud: "boolean",
+        rerun: "boolean",
+        samples: "positive-integer",
+        skills: "string",
     },
-    case: {
-        flags: {
-            list: ["dir", "json"],
-            add: ["dir", "from", "json"],
-            show: ["dir", "json"],
-            remove: ["dir", "json"],
-        },
+    help: { ...COMMON_FLAGS, ...HELP_FLAG, all: "boolean" },
+    improve: {
+        ...PROJECT_FLAGS,
+        ...HELP_FLAG,
+        agents: "string",
+        budget: "positive-integer",
+        cloud: "boolean",
+        samples: "positive-integer",
+        skills: "string",
     },
-    remote: {
-        flags: {
-            add: ["dir", "dry-run", "json", "name", "replace", "url"],
-            list: ["dir", "json"],
-            remove: ["dir", "json"],
-        },
+    install: { ...COMMON_FLAGS, ...HELP_FLAG, "dry-run": "boolean", to: "repeat-string", yes: "boolean" },
+    log: { ...PROJECT_FLAGS, ...HELP_FLAG, runs: "boolean", versions: "boolean" },
+    login: {
+        ...COMMON_FLAGS,
+        ...HELP_FLAG,
+        "base-url": "string",
+        "local-only": "boolean",
+        method: "string",
+        "no-open": "boolean",
+        profile: "string",
+        "profile-root": "string",
+        "start-only": "boolean",
+        timeout: "positive-integer",
+        wait: "boolean",
+    },
+    logout: { ...COMMON_FLAGS, ...HELP_FLAG },
+    new: { ...PROJECT_FLAGS, ...HELP_FLAG },
+    open: { ...PROJECT_FLAGS, ...HELP_FLAG, host: "string", "no-open": "boolean", port: "positive-integer" },
+    publish: {
+        ...PROJECT_FLAGS,
+        ...HELP_FLAG,
+        as: "string",
+        "dry-run": "boolean",
+        private: "boolean",
+        public: "boolean",
+        team: "boolean",
     },
-    skills: {
+    show: { ...PROJECT_FLAGS, ...HELP_FLAG },
+    status: { ...PROJECT_FLAGS, ...HELP_FLAG },
+    switch: { ...PROJECT_FLAGS, ...HELP_FLAG },
+    sync: { ...PROJECT_FLAGS, ...HELP_FLAG, "dry-run": "boolean" },
+    version: { ...COMMON_FLAGS, ...VERSION_FLAG },
+};
+const SUBCOMMAND_FLAGS = {
+    case: {
         flags: {
-            list: ["dir", "json"],
+            add: { ...PROJECT_FLAGS, ...HELP_FLAG },
         },
     },
     agent: {
         flags: {
-            list: ["dir", "json"],
-            add: ["adapter", "dir", "json", "model", "with"],
-            show: ["dir", "json"],
-            default: ["dir", "json"],
-            remove: ["dir", "json"],
+            list: { ...PROJECT_FLAGS, ...HELP_FLAG },
+            add: { ...PROJECT_FLAGS, ...HELP_FLAG, adapter: "string", model: "string", with: "repeat-string" },
+            rm: { ...PROJECT_FLAGS, ...HELP_FLAG },
         },
     },
 };
@@ -313,20 +307,23 @@ export async function runCli(argv, io = {
     const parsed = parseArgs(argv);
     const command = parsed.positionals[0];
     try {
-        if (command === "--version" || command === "-v" || command === "version" || parsed.flags.version === true) {
+        validateCommandFlags(parsed, command);
+        if (command === "version" || parsed.flags.version === true) {
             io.stdout.write(`workbench ${getCliVersion()}\n`);
             return 0;
         }
-        if (!command || command === "help" || command === "--help" || command === "-h") {
+        if (command === "help") {
             const helpCommand = command === "help" ? optionalPositional(parsed, 1) : undefined;
-            io.stdout.write(`${helpCommand ? commandHelp(helpCommand) : HELP}\n`);
+            io.stdout.write(`${parsed.flags.all === true ? HELP_ALL : helpCommand ? commandHelp(helpCommand) : HELP}\n`);
             return 0;
         }
         if (parsed.flags.help === true) {
-            io.stdout.write(`${commandHelp(command)}\n`);
+            io.stdout.write(`${command ? commandHelp(command) : HELP}\n`);
             return 0;
         }
-        validateCommandFlags(parsed, command);
+        if (!command) {
+            return await handleStatus(parsed, io);
+        }
         if (command === "login") {
             return await handleLogin(parsed, io);
         }
@@ -337,27 +334,17 @@ export async function runCli(argv, io = {
             return await handleInstall(parsed, io);
         }
         const core = await coreOptions(parsed);
-        if (command === "init") {
+        if (command === "new") {
             const status = await initWorkbenchSkill({ dir: parsed.positionals[1] ?? dirFlag(parsed) });
-            return output(status, parsed, io, () => `Initialized Workbench skill at ${status.root}.`);
+            return output(status, parsed, io, () => `Created Workbench skill at ${status.root}.\nnext: edit SKILL.md, then run workbench eval`);
         }
         if (command === "status") {
-            const status = await workbenchStatusSnapshot(core);
-            const auth = await workbenchCliAuthStatus();
-            return emitResult("workbench.status.v1", {
-                project: status.project,
-                worktree: status.worktree,
-                runs: status.runs,
-                remotes: status.remotes,
-                auth: auth,
-                next: status.next,
-            }, parsed, io, () => formatStatusSnapshot({ ...status, auth }));
-        }
-        if (command === "check") {
-            const result = await checkWorkbenchSkill(core);
-            return output(result, parsed, io, () => formatCheck(result));
+            return await handleStatus(parsed, io);
         }
         if (command === "eval") {
+            if (parsed.flags.cloud === true) {
+                return await handleCloudEval(parsed, io);
+            }
             const runs = await evalWorkbenchSkill({
                 ...core,
                 version: optionalPositional(parsed, 1),
@@ -371,21 +358,36 @@ export async function runCli(argv, io = {
             if (failedRuns.length > 0) {
                 return emitEvalFailure(runs, failedRuns, artifactIds, parsed, io);
             }
-            return output(runs.map((run) => runSummary(run, artifactIds.get(run.id) ?? [])), parsed, io, () => runs.map(formatRun).join("\n"));
+            const deltas = await evalDeltas(core, runs);
+            const next = await evalSuccessNextCommand(core, runs);
+            return emitResult("workbench.cli.eval.v1", {
+                result: runs.map((run) => runSummary(run, artifactIds.get(run.id) ?? [])),
+                deltas: deltas,
+                next: next,
+            }, parsed, io, () => [
+                runs.map(formatRun).join("\n"),
+                ...deltas.map(formatEvalDelta),
+                ...(next ? [`next: ${next}`] : []),
+            ].filter(Boolean).join("\n"));
         }
         if (command === "improve") {
+            if (parsed.flags.cloud === true) {
+                return await handleCloudImprove(parsed, io);
+            }
+            const improverAgent = await resolveLocalImproverAgent(parsed, core);
             const result = await improveWorkbenchSkill({
                 ...core,
                 version: optionalPositional(parsed, 1),
-                skill: stringFlag(parsed, "skill"),
-                agent: stringFlag(parsed, "agent"),
+                skill: stringFlag(parsed, "skills"),
+                agent: stringFlag(parsed, "agents"),
+                ...(improverAgent ? { improverAgent } : {}),
                 budget: intFlag(parsed, "budget"),
                 samples: intFlag(parsed, "samples"),
             });
             return output({
                 ...result,
                 version: versionSummary(result.version),
-            }, parsed, io, () => formatImproveResult(result));
+            }, parsed, io, () => `${formatImproveResult(result)}\nnext: workbench eval`);
         }
         if (command === "compare") {
             const comparison = await compareWorkbench({
@@ -394,92 +396,30 @@ export async function runCli(argv, io = {
                 skills: stringFlag(parsed, "skills"),
                 agents: stringFlag(parsed, "agents"),
             });
-            return output(comparison, parsed, io, () => formatComparison(comparison));
-        }
-        if (command === "versions") {
-            const versions = await listWorkbenchVersions(core);
-            return output(versions.map(versionSummary), parsed, io, () => versions.map(formatVersion).join("\n") || "No versions.");
+            return output(manifestOnly(comparison), parsed, io, () => formatComparison(comparison));
         }
         if (command === "switch") {
             const versionRef = requiredPositional(parsed, 1, "workbench switch requires VERSION.");
             const version = await switchWorkbenchVersion(versionRef, core);
-            return output(versionSummary(version), parsed, io, () => `Switched to ${version.id}.`);
+            return output(versionSummary(version), parsed, io, () => `Switched to ${displayRef(version.id)}.`);
         }
         if (command === "diff") {
-            const range = requiredPositional(parsed, 1, "workbench diff requires A..B.");
+            const range = optionalPositional(parsed, 1) ?? await defaultDiffRange(core);
             const diffs = await diffWorkbenchVersions(range, core);
             return output(diffs, parsed, io, () => diffs.map((entry) => `${entry.status}\t${entry.path}`).join("\n") || "No diff.");
         }
         if (command === "show") {
-            const ref = requiredPositional(parsed, 1, "workbench show requires REF.");
-            const session = await showLocalAgentSession(ref);
-            if (session) {
-                return output(session, parsed, io, () => formatSessionDetail(session));
-            }
-            const value = await showWorkbenchRef(ref, core);
-            return output(value, parsed, io, () => formatShow(value));
-        }
-        if (command === "files") {
-            const ref = requiredPositional(parsed, 1, "workbench files requires REF.");
-            const files = await filesForWorkbenchRef(ref, core);
-            return output(files.map(fileSummary), parsed, io, () => files.map((file) => file.path).join("\n") || "No files.");
-        }
-        if (command === "list") {
-            return await handleList(parsed, io);
-        }
-        if (command === "trace") {
-            const ref = optionalPositional(parsed, 1);
-            if (!ref) {
-                throw new WorkbenchCodedError("usage", "workbench trace requires RUN_ID, JOB_ID, or TRACE_ID.", {
-                    remediation: "Run workbench list runs --json or workbench list traces --json.",
-                    exitCode: 2,
-                });
-            }
-            const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(core);
-            const run = snapshot.runs.find((entry) => entry.id === ref);
-            const job = snapshot.jobs.find((entry) => entry.id === ref);
-            const traces = run
-                ? snapshot.traces.filter((trace) => run.traceIds.includes(trace.id))
-                : job
-                    ? snapshot.traces.filter((trace) => job.traceIds.includes(trace.id))
-                    : snapshot.traces.filter((trace) => trace.id === ref);
-            if (traces.length === 0) {
-                const jobs = run
-                    ? snapshot.jobs.filter((entry) => entry.runId === run.id)
-                    : job ? [job] : [];
-                const details = jobs.flatMap((entry) => {
-                    const detail = workbenchJobEvidenceForSnapshot(snapshot, {
-                        runId: entry.runId,
-                        jobId: entry.id,
-                    });
-                    return detail ? [detail] : [];
-                }).filter((detail) => detail.executions.some((execution) => execution.sessions.length > 0 ||
-                    execution.trace.spans.length > 0 ||
-                    execution.trace.events.length > 0 ||
-                    execution.trace.summaries.length > 0));
-                if (details.length > 0) {
-                    return output(details, parsed, io, () => details.map(formatTraceDetail).join("\n"));
-                }
-                throw new WorkbenchCodedError("ref_not_found", `Trace not found: ${ref}`, {
-                    remediation: "Run workbench list runs --json, workbench list jobs --json, or workbench list traces --json.",
-                    subject: { ref },
-                    exitCode: 1,
-                });
-            }
-            return output(traces, parsed, io, () => traces.map(formatTrace).join("\n"));
+            return await handleShow(parsed, io);
+        }
+        if (command === "log") {
+            return await handleLog(parsed, io);
         }
         if (command === "agent") {
             return await handleAgent(parsed, io);
         }
-        if (command === "skills") {
-            return await handleSkills(parsed, io);
-        }
         if (command === "case") {
             return await handleCase(parsed, io);
         }
-        if (command === "remote") {
-            return await handleRemote(parsed, io);
-        }
         if (command === "sync") {
             const result = await syncWorkbenchRemote({
                 ...core,
@@ -496,34 +436,54 @@ export async function runCli(argv, io = {
             }, parsed, io, () => `${result.dryRun ? "Would sync" : "Synced"} ${result.remote.name}: pushed ${result.pushed}, pulled ${result.pulled}${result.upToDate ? " (up to date)" : ""}.`);
         }
         if (command === "publish") {
+            const preview = parsed.flags["dry-run"] === true
+                ? await previewPublishWithDerivedRemote(parsed)
+                : undefined;
+            if (preview) {
+                return emitResult("workbench.cli.publish.v1", {
+                    remote: preview.remote,
+                    version: versionSummary(preview.version),
+                    visibility: preview.visibility,
+                    installHandle: preview.installHandle,
+                    installUrl: preview.installUrl,
+                    pinnedInstallUrl: preview.pinnedInstallUrl,
+                    dryRun: true,
+                }, parsed, io, () => [
+                    `Would publish ${displayRef(preview.version.id)} to remote ${preview.remote.name}.`,
+                    `Visibility: ${preview.visibility}`,
+                    `Install: ${preview.installUrl}`,
+                    `Pinned: ${preview.pinnedInstallUrl}`,
+                    `next: workbench install ${preview.installHandle}`,
+                ].join("\n"));
+            }
+            const remote = await ensurePublishRemote(parsed);
             const result = await publishWorkbenchVersion({
                 ...core,
                 version: optionalPositional(parsed, 1),
-                remote: stringFlag(parsed, "remote"),
+                remote,
                 dryRun: parsed.flags["dry-run"] === true,
-                visibility: parsePublishVisibility(stringFlag(parsed, "visibility")),
+                visibility: parsePublishVisibilityFlags(parsed),
             });
             return emitResult("workbench.cli.publish.v1", {
                 remote: result.remote,
                 version: versionSummary(result.version),
                 visibility: result.visibility,
+                installHandle: result.installHandle,
                 installUrl: result.installUrl,
                 pinnedInstallUrl: result.pinnedInstallUrl,
                 ...(result.dryRun ? { dryRun: true } : {}),
             }, parsed, io, () => [
-                `${result.dryRun ? "Would publish" : "Published"} ${result.version.id} to remote ${result.remote.name}.`,
+                `${result.dryRun ? "Would publish" : "Published"} ${displayRef(result.version.id)} to remote ${result.remote.name}.`,
                 `Visibility: ${result.visibility}`,
                 `Install: ${result.installUrl}`,
                 `Pinned: ${result.pinnedInstallUrl}`,
+                `next: workbench install ${result.installHandle}`,
             ].join("\n"));
         }
-        if (command === "auth") {
-            return await handleAuth(parsed, io);
-        }
         if (command === "open") {
             if (parsed.flags.json === true) {
                 const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(core);
-                return output(snapshot, parsed, io, () => "Read-only Workbench inspection data is available with --json.");
+                return output(manifestOnly(snapshot), parsed, io, () => "Read-only Workbench inspection data is available with --json.");
             }
             // The browser server serves committed object state through a read-only
             // snapshot path, so long-running commands do not block page loads.
@@ -545,29 +505,107 @@ export async function runCli(argv, io = {
         return emitError(error, parsed, io);
     }
 }
-async function handleList(parsed, io) {
-    const kind = requiredPositional(parsed, 1, "workbench list requires runs|jobs|traces|artifacts|sessions.");
-    if (kind === "sessions") {
-        const sessions = await listLocalAgentSessions();
-        return output(sessions, parsed, io, () => sessions.map(formatSession).join("\n") || "No local sessions.");
+async function handleStatus(parsed, io) {
+    const status = await workbenchStatusSnapshot(await coreOptions(parsed));
+    const auth = await workbenchCliAuthStatus();
+    const cliStatus = statusWithCausalNext(status, auth);
+    return emitResult("workbench.status.v1", {
+        project: cliStatus.project,
+        worktree: cliStatus.worktree,
+        runs: cliStatus.runs,
+        remotes: cliStatus.remotes,
+        auth: auth,
+        next: cliStatus.next,
+    }, parsed, io, () => formatStatusSnapshot({ ...cliStatus, auth }));
+}
+async function handleLog(parsed, io) {
+    if (parsed.flags.runs === true && parsed.flags.versions === true) {
+        throw new WorkbenchCodedError("usage", "workbench log accepts only one of --runs or --versions.", {
+            remediation: "Run workbench log --runs or workbench log --versions.",
+            exitCode: 2,
+        });
     }
-    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(await coreOptions(parsed));
-    if (kind === "runs") {
-        return output(snapshot.runs, parsed, io, () => snapshot.runs.map(formatRun).join("\n") || "No runs.");
+    if (parsed.positionals.length > 1) {
+        if (parsed.flags.runs === true) {
+            throw new WorkbenchUserError("--runs does not accept a value.");
+        }
+        if (parsed.flags.versions === true) {
+            throw new WorkbenchUserError("--versions does not accept a value.");
+        }
+        rejectExtraInput(parsed, {
+            maxPositionals: 1,
+            message: "workbench log does not accept refs or paths.",
+            remediation: "Run workbench log, workbench log --runs, or workbench log --versions.",
+        });
+    }
+    const snapshot = await createWorkbenchInspectionSnapshot(await coreOptions(parsed));
+    const includeRuns = parsed.flags.versions !== true;
+    const includeVersions = parsed.flags.runs !== true;
+    const entries = [
+        ...(includeVersions ? snapshot.versions.map((version) => ({
+            kind: "version",
+            id: version.id,
+            createdAt: version.createdAt,
+            message: version.message,
+            fileCount: version.files.length,
+        })) : []),
+        ...(includeRuns ? snapshot.runs.map((run) => ({
+            kind: "run",
+            id: run.id,
+            createdAt: run.createdAt,
+            status: run.status,
+            versionId: run.versionId,
+            skillName: run.skillName,
+            agentName: run.agentName,
+            ...(run.score !== undefined ? { score: run.score } : {}),
+        })) : []),
+    ].sort((left, right) => right.createdAt.localeCompare(left.createdAt));
+    return emitResult("workbench.cli.log.v1", {
+        entries: entries,
+    }, parsed, io, () => entries.map(formatLogEntry).join("\n") || "No history.");
+}
+async function handleShow(parsed, io) {
+    const ref = requiredPositional(parsed, 1, "workbench show requires REF.");
+    const session = await showLocalAgentSession(ref);
+    if (session) {
+        return output(session, parsed, io, () => formatSessionDetail(session));
+    }
+    const core = await coreOptions(parsed);
+    const [objectRef, requestedPath] = splitShowRef(ref);
+    if (requestedPath) {
+        const runOrJobFile = await fileForRunOrJobRef(core, objectRef, requestedPath);
+        if (runOrJobFile) {
+            return output(runOrJobFile, parsed, io, () => formatShow(runOrJobFile));
+        }
+        const value = await showWorkbenchRef(ref, core);
+        return output(value, parsed, io, () => formatShow(value));
     }
-    if (kind === "jobs") {
-        return output(snapshot.jobs, parsed, io, () => snapshot.jobs.map(formatJob).join("\n") || "No jobs.");
+    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(core);
+    const version = snapshotVersionByRef(snapshot, objectRef);
+    if (version) {
+        return output(fileListing("version", version.id, version.files), parsed, io, () => formatFileListing("version", version.id, version.files));
     }
-    if (kind === "traces") {
-        return output(snapshot.traces.map(traceSummary), parsed, io, () => snapshot.traces.map(formatTrace).join("\n") || "No traces.");
+    const trace = snapshotObjectByRef(snapshot.traces, objectRef, "trace");
+    if (trace) {
+        return output(fileListing("trace", trace.id, trace.files), parsed, io, () => formatFileListing("trace", trace.id, trace.files));
     }
-    if (kind === "artifacts") {
-        return output(snapshot.artifacts.map(artifactSummary), parsed, io, () => snapshot.artifacts.map(formatArtifact).join("\n") || "No artifacts.");
+    const artifact = snapshotObjectByRef(snapshot.artifacts, objectRef, "artifact");
+    if (artifact) {
+        return output(fileListing("artifact", artifact.id, artifact.files), parsed, io, () => formatFileListing("artifact", artifact.id, artifact.files));
     }
-    throw new WorkbenchUserError(`Unsupported list target: ${kind}`);
+    const details = evidenceDetailsForRunOrJob(snapshot, objectRef);
+    const evidenceFiles = evidenceFilesForRunOrJob(snapshot, objectRef);
+    if (details.length > 0 || evidenceFiles.length > 0) {
+        return output({
+            details: details,
+            files: evidenceFiles.map(fileSummary),
+        }, parsed, io, () => formatRunOrJobEvidence(details, evidenceFiles));
+    }
+    const value = await showWorkbenchRef(ref, core);
+    return output(value, parsed, io, () => formatShow(value));
 }
 async function handleAgent(parsed, io) {
-    const subcommand = requiredPositional(parsed, 1, "workbench agent requires list|add|show|default|remove.");
+    const subcommand = requiredPositional(parsed, 1, "workbench agent requires list|add|rm.");
     if (subcommand === "list") {
         const agents = await listWorkbenchAgents(await coreOptions(parsed));
         return output(agents, parsed, io, () => agents.map(formatAgent).join("\n") || "No agents.");
@@ -587,173 +625,65 @@ async function handleAgent(parsed, io) {
         });
         return output(agent, parsed, io, () => `Added agent ${formatAgent(agent)}.`);
     }
-    if (subcommand === "show") {
-        const name = requiredPositional(parsed, 2, "workbench agent show requires NAME.");
-        const agent = (await listWorkbenchAgents(await coreOptions(parsed))).find((entry) => entry.name === name);
-        if (!agent) {
-            throw new WorkbenchCodedError("ref_not_found", `Agent not found: ${name}`, {
-                remediation: "Run workbench agent list.",
-                subject: { agent: name },
-                exitCode: 1,
-            });
-        }
-        return output(agent, parsed, io, () => formatAgent(agent));
-    }
-    if (subcommand === "default") {
-        const result = await setDefaultWorkbenchAgent(requiredPositional(parsed, 2, "workbench agent default requires NAME."), await coreOptions(parsed));
-        return output(result, parsed, io, () => `Default agent: ${result.defaultAgent}`);
-    }
-    if (subcommand === "remove") {
-        const result = await removeWorkbenchAgent(requiredPositional(parsed, 2, "workbench agent remove requires NAME."), await coreOptions(parsed));
+    if (subcommand === "rm") {
+        const result = await removeWorkbenchAgent(requiredPositional(parsed, 2, "workbench agent rm requires NAME."), await coreOptions(parsed));
         return output(result, parsed, io, () => `Removed agent ${result.removed}.`);
     }
     throw new WorkbenchUserError(`Unsupported agent command: ${subcommand}`);
 }
-async function handleSkills(parsed, io) {
-    const subcommand = requiredPositional(parsed, 1, "workbench skills requires list.");
-    if (subcommand !== "list") {
-        throw new WorkbenchUserError(`Unsupported skills command: ${subcommand}`);
-    }
-    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(await coreOptions(parsed));
-    return output(snapshot.skillSources, parsed, io, () => snapshot.skillSources.map((source) => {
-        const where = source.kind === "remote"
-            ? `${source.from}${source.ref ? `#${source.ref}` : ""}`
-            : source.kind === "none"
-                ? "baseline:none"
-                : source.path;
-        return `${source.name}\t${source.kind}\t${where}\tincludes=${source.includes?.length ?? 0}`;
-    }).join("\n") || "No skills.");
-}
 async function handleCase(parsed, io) {
-    const subcommand = requiredPositional(parsed, 1, "workbench case requires list|add|show|remove.");
-    if (subcommand === "list") {
-        const cases = await listWorkbenchCases(await coreOptions(parsed));
-        return output(cases, parsed, io, () => cases.map((entry) => `${entry.id}\t${entry.path}`).join("\n") || "No cases.");
-    }
+    const subcommand = requiredPositional(parsed, 1, "workbench case requires add.");
     if (subcommand === "add") {
-        const record = await addWorkbenchCase({ ...(await coreOptions(parsed)), fromTraceId: stringFlag(parsed, "from") });
-        return output(record, parsed, io, () => `Added case ${record.id}.`);
-    }
-    if (subcommand === "show") {
-        const record = await showWorkbenchCase(requiredPositional(parsed, 2, "workbench case show requires CASE_ID."), await coreOptions(parsed));
-        return output(record, parsed, io, () => record.content);
-    }
-    if (subcommand === "remove") {
-        const result = await removeWorkbenchCase(requiredPositional(parsed, 2, "workbench case remove requires CASE_ID."), await coreOptions(parsed));
-        return output(result, parsed, io, () => `Removed case ${result.removed}.`);
-    }
-    throw new WorkbenchUserError(`Unsupported case command: ${subcommand}`);
-}
-async function handleRemote(parsed, io) {
-    const subcommand = requiredPositional(parsed, 1, "workbench remote requires add|list|remove.");
-    if (subcommand === "add") {
-        const name = requiredFlag(parsed, {
-            flag: "name",
-            usage: "workbench remote add requires --name NAME.",
-            remediation: "Run workbench remote add --name origin --url https://HOST/skills/OWNER/SKILL.",
-        });
-        const url = requiredFlag(parsed, {
-            flag: "url",
-            usage: "workbench remote add requires --url URL.",
-            remediation: `Run workbench remote add --name ${name} --url https://HOST/skills/OWNER/SKILL.`,
-        });
+        const core = await coreOptions(parsed);
+        const sourceRef = requiredPositional(parsed, 2, "workbench case add requires RUN_ID.");
         rejectExtraInput(parsed, {
-            maxPositionals: 2,
-            message: "workbench remote add accepts --name NAME and --url URL, not positional NAME or URL.",
-            remediation: "Run workbench remote add --name origin --url https://HOST/skills/OWNER/SKILL.",
-        });
-        const result = await addWorkbenchRemote(name, url, {
-            ...(await coreOptions(parsed)),
-            replace: parsed.flags.replace === true,
-            dryRun: parsed.flags["dry-run"] === true,
+            maxPositionals: 3,
+            message: "workbench case add accepts one RUN_ID argument.",
+            remediation: "Run workbench case add RUN_ID.",
         });
-        return emitResult("workbench.cli.remote-add.v1", {
-            remote: result.remote,
-            operation: result.operation,
-            ...(result.dryRun ? { dryRun: true } : {}),
-        }, parsed, io, () => `${result.dryRun ? "Would update" : "Remote"} ${result.remote.name}: ${result.operation}\t${result.remote.kind}\t${result.remote.url}`);
-    }
-    if (subcommand === "list") {
-        const remotes = await listWorkbenchRemotes(await coreOptions(parsed));
-        return emitResult("workbench.cli.remote-list.v1", {
-            remotes: remotes,
-        }, parsed, io, () => remotes.map((remote) => `${remote.name}\t${remote.kind}\t${remote.url}`).join("\n") || "No remotes.");
-    }
-    if (subcommand === "remove") {
-        const result = await removeWorkbenchRemote(requiredPositional(parsed, 2, "workbench remote remove requires NAME."), await coreOptions(parsed));
-        return emitResult("workbench.cli.remote-remove.v1", {
-            remote: result.remote,
-            removed: result.removed,
-        }, parsed, io, () => result.removed ? `Removed remote ${result.remote}.` : `Remote ${result.remote} was not configured.`);
-    }
-    throw new WorkbenchUserError(`Unsupported remote command: ${subcommand}`);
-}
-async function handleAuth(parsed, io) {
-    const subcommand = optionalPositional(parsed, 1) ?? "status";
-    if (subcommand === "status") {
-        const targetRaw = optionalPositional(parsed, 2);
-        const profile = authProfileFlag(parsed);
-        const store = localWorkbenchAdapterAuthStore(adapterAuthStoreRoot());
-        const cliAuth = await workbenchCliAuthStatus();
-        if (targetRaw) {
-            const status = await store.status(parseAuthTarget(targetRaw, profile));
-            return emitResult("workbench.cli.auth-status.v1", {
-                workbenchCloud: cliAuth.workbenchCloud,
-                adapters: [authStatusRecordToJson(status)],
-            }, parsed, io, () => [
-                formatWorkbenchCloudAuthStatus(cliAuth.workbenchCloud),
-                "Adapter auth:",
-                formatAuthStatusRecord(status),
-            ].join("\n"));
-        }
-        const statuses = await store.listStatus();
-        const required = await requiredAgentAuthStatuses(parsed, statuses);
-        return emitResult("workbench.cli.auth-status.v1", {
-            workbenchCloud: cliAuth.workbenchCloud,
-            adapters: cliAuth.adapters,
-            required: required,
-        }, parsed, io, () => formatAuthStatusList(cliAuth.workbenchCloud, statuses, required));
-    }
-    if (subcommand === "connect") {
-        const targetRaw = requiredPositional(parsed, 2, "workbench auth connect requires ADAPTER[/SLOT].");
-        const target = parseAuthTarget(targetRaw, authProfileFlag(parsed));
-        const method = authMethod(parsed, target.adapterId);
-        const bundle = await collectAdapterAuthBundle({
-            target,
-            method,
-            profileRoot: path.resolve(stringFlag(parsed, "profile-root") ?? os.homedir()),
-        });
-        const saved = await localWorkbenchAdapterAuthStore(adapterAuthStoreRoot()).put(bundle);
-        const remote = await uploadAdapterConnection(saved, parsed);
-        return emitResult("workbench.cli.auth-connect.v1", {
-            localAdapter: {
-                adapter: saved.adapterId,
-                ...(saved.slot ? { slot: saved.slot } : {}),
-                profile: saved.profile,
-                method: saved.method,
-                status: saved.status,
-                version: saved.version,
-                updatedAt: saved.updatedAt,
-            },
-            workbenchCloud: remote,
-        }, parsed, io, () => `Connected ${formatAuthTarget(saved)} ${saved.method} auth v${saved.version}; Workbench Cloud: ${remote.sync}${remote.reason ? ` (${remote.reason})` : ""}.`);
-    }
-    if (subcommand === "disconnect") {
-        const targetRaw = requiredPositional(parsed, 2, "workbench auth disconnect requires ADAPTER[/SLOT].");
-        const target = parseAuthTarget(targetRaw, authProfileFlag(parsed));
-        await localWorkbenchAdapterAuthStore(adapterAuthStoreRoot()).disconnect(target);
-        const remote = await deleteAdapterConnectionRemote(target, parsed);
-        return emitResult("workbench.cli.auth-disconnect.v1", {
-            localAdapter: {
-                adapter: target.adapterId,
-                ...(target.slot ? { slot: target.slot } : {}),
-                profile: target.profile,
-                status: "disconnected",
-            },
-            workbenchCloud: remote,
-        }, parsed, io, () => `Disconnected ${formatAuthTarget(target)}; Workbench Cloud: ${remote.sync}${remote.reason ? ` (${remote.reason})` : ""}.`);
-    }
-    throw new WorkbenchUserError(`Unsupported auth command: ${subcommand}`);
+        const record = await addWorkbenchCase({ ...core, fromTraceId: await traceIdForCaseSource(core, sourceRef) });
+        return output(record, parsed, io, () => `Added draft case ${record.id}. Edit .workbench/cases/${record.path}/case.yaml before using it as score evidence.`);
+    }
+    throw new WorkbenchUserError(`Unknown command: workbench case ${subcommand}`);
+}
+async function handleAdapterLogin(provider, parsed, io) {
+    const target = parseAuthTarget(provider, authProfileFlag(parsed));
+    const method = authMethod(parsed, target.adapterId);
+    const bundle = await collectAdapterAuthBundle({
+        target,
+        method,
+        profileRoot: path.resolve(stringFlag(parsed, "profile-root") ?? os.homedir()),
+    });
+    const saved = await localWorkbenchAdapterAuthStore(adapterAuthStoreRoot()).put(bundle);
+    const remote = await uploadAdapterConnection(saved, parsed);
+    return emitResult("workbench.cli.login.v1", {
+        provider: saved.adapterId,
+        localAdapter: {
+            adapter: saved.adapterId,
+            ...(saved.slot ? { slot: saved.slot } : {}),
+            profile: saved.profile,
+            method: saved.method,
+            status: saved.status,
+            version: saved.version,
+            updatedAt: saved.updatedAt,
+        },
+        workbenchCloud: remote,
+    }, parsed, io, () => `Connected ${formatAuthTarget(saved)} ${saved.method} auth v${saved.version}; Workbench Cloud: ${remote.sync}${remote.reason ? ` (${remote.reason})` : ""}.`);
+}
+async function handleAdapterLogout(provider, parsed, io) {
+    const target = parseAuthTarget(provider, authProfileFlag(parsed));
+    await localWorkbenchAdapterAuthStore(adapterAuthStoreRoot()).disconnect(target);
+    const remote = await deleteAdapterConnectionRemote(target, parsed);
+    return emitResult("workbench.cli.logout.v1", {
+        provider: target.adapterId,
+        localAdapter: {
+            adapter: target.adapterId,
+            ...(target.slot ? { slot: target.slot } : {}),
+            profile: target.profile,
+            status: "disconnected",
+        },
+        workbenchCloud: remote,
+    }, parsed, io, () => `Disconnected ${formatAuthTarget(target)}; Workbench Cloud: ${remote.sync}${remote.reason ? ` (${remote.reason})` : ""}.`);
 }
 function getCliVersion() {
     const manifest = require("../package.json");
@@ -763,19 +693,17 @@ function commandHelp(command) {
     return COMMAND_HELP[command] ?? HELP;
 }
 function validateCommandFlags(parsed, command) {
-    if (!command) {
-        return;
-    }
-    const allowed = allowedFlagsForCommand(parsed, command);
+    const effectiveCommand = command ?? (parsed.flags.version === true ? "version" : "status");
+    const allowed = allowedFlagsForCommand(parsed, effectiveCommand);
     if (!allowed) {
         return;
     }
-    const allowedSet = new Set(allowed);
+    const allowedSet = new Set(Object.keys(allowed));
     for (const [name, value] of Object.entries(parsed.flags)) {
-        if (!allowedSet.has(name) && name !== "help" && name !== "version") {
-            throw new WorkbenchUserError(`Unsupported flag --${name} for workbench ${command}.`);
+        if (!allowedSet.has(name)) {
+            throw new WorkbenchUserError(`Unsupported flag --${name} for workbench ${effectiveCommand}.`);
         }
-        validateFlagValue(name, value, command === "install" && (name === "agent" || name === "skill"));
+        validateFlagValue(name, value, allowed[name]);
     }
 }
 function allowedFlagsForCommand(parsed, command) {
@@ -784,25 +712,12 @@ function allowedFlagsForCommand(parsed, command) {
         return COMMAND_FLAGS[command];
     }
     const subcommand = parsed.positionals[1] ?? subcommands.defaultSubcommand;
-    return subcommand ? subcommands.flags[subcommand] ?? ["json"] : ["json"];
+    return subcommand ? subcommands.flags[subcommand] ?? { ...COMMON_FLAGS, ...HELP_FLAG } : { ...COMMON_FLAGS, ...HELP_FLAG };
 }
-function validateFlagValue(name, value, repeatString = false) {
-    const kind = FLAG_DEFINITIONS[name];
+function validateFlagValue(name, value, kind) {
     if (!kind) {
         return;
     }
-    if (repeatString) {
-        if (Array.isArray(value)) {
-            if (value.some((entry) => !entry.trim())) {
-                throw new WorkbenchUserError(`--${name} requires a non-empty value.`);
-            }
-            return;
-        }
-        if (typeof value === "string" && value.trim()) {
-            return;
-        }
-        throw new WorkbenchUserError(`--${name} requires a non-empty value.`);
-    }
     if (kind === "boolean") {
         if (value !== true) {
             throw new WorkbenchUserError(`--${name} does not accept a value.`);
@@ -826,15 +741,28 @@ function validateFlagValue(name, value, repeatString = false) {
     }
 }
 const CONFIG_SCHEMA = "workbench.cli.config.v1";
+const DEFAULT_WORKBENCH_CLOUD_BASE_URL = "https://v2.workbench.ai";
 const API_REQUEST_MAX_ATTEMPTS = 3;
 const API_REQUEST_GZIP_THRESHOLD_BYTES = 1024 * 1024;
+const CLOUD_RUN_TIMEOUT_MS = 30 * 60 * 1000;
+const CLOUD_RUN_POLL_INTERVAL_MS = 3000;
 async function handleLogin(parsed, io) {
-    if (parsed.positionals.length > 1) {
-        throw new WorkbenchUserError("workbench login accepts no positional arguments.");
+    const provider = optionalPositional(parsed, 1);
+    if (provider) {
+        if (parsed.positionals.length > 2) {
+            throw new WorkbenchUserError("workbench login PROVIDER accepts only one provider argument.");
+        }
+        if (parsed.flags["start-only"] === true || parsed.flags.wait === true || parsed.flags.timeout !== undefined || parsed.flags["no-open"] === true) {
+            throw new WorkbenchCodedError("usage", "Workbench Cloud login flags do not apply to provider login.", {
+                remediation: `Run workbench login ${provider} --method ${authMethod(parsed, provider)}.`,
+                exitCode: 2,
+            });
+        }
+        return await handleAdapterLogin(provider, parsed, io);
     }
     if (parsed.flags["start-only"] === true && parsed.flags.wait === true) {
         throw new WorkbenchCodedError("usage", "workbench login accepts only one of --start-only or --wait.", {
-            remediation: "Run workbench login --start-only or workbench login --wait --timeout 120.",
+            remediation: "Run workbench login --start-only or workbench login --wait.",
             exitCode: 2,
         });
     }
@@ -843,22 +771,17 @@ async function handleLogin(parsed, io) {
     const timeoutSeconds = intFlag(parsed, "timeout");
     if (startOnly && timeoutSeconds !== undefined) {
         throw new WorkbenchCodedError("usage", "workbench login --timeout only applies with --wait.", {
-            remediation: "Run workbench login --start-only, then workbench login --wait --timeout 120.",
-            exitCode: 2,
-        });
-    }
-    if (waitOnly && timeoutSeconds === undefined) {
-        throw new WorkbenchCodedError("usage", "workbench login --wait requires --timeout N.", {
-            remediation: "Run workbench login --wait --timeout 120.",
+            remediation: "Run workbench login --start-only, then workbench login --wait.",
             exitCode: 2,
         });
     }
     const config = await loadConfig();
-    const baseUrl = selectWorkbenchBaseUrl({
-        explicitBaseUrl: stringFlag(parsed, "base-url"),
+    const explicitBaseUrl = stringFlag(parsed, "base-url");
+    const pending = waitOnly ? await readPendingDeviceAuthorization(explicitBaseUrl) : null;
+    const baseUrl = pending?.baseUrl ?? selectWorkbenchBaseUrl({
+        explicitBaseUrl,
         configBaseUrl: config.baseUrl,
     });
-    const pending = waitOnly ? await readPendingDeviceAuthorization(baseUrl) : null;
     const record = pending ?? await startDeviceAuthorization(baseUrl);
     const freshAuthorization = pending === null;
     if (startOnly) {
@@ -873,8 +796,8 @@ async function handleLogin(parsed, io) {
             verificationUriComplete: record.verification_uri_complete,
             userCode: record.user_code,
             expiresAt: record.expiresAt,
-            resume: "workbench login --wait --timeout 120",
-        }, parsed, io, () => `Open ${record.verification_uri_complete}\nCode: ${record.user_code}\nResume: workbench login --wait --timeout 120`);
+            resume: "workbench login --wait",
+        }, parsed, io, () => `Open ${record.verification_uri_complete}\nCode: ${record.user_code}\nResume: workbench login --wait`);
     }
     await writePendingDeviceAuthorization(record);
     if (freshAuthorization && !parsed.flags.json) {
@@ -911,15 +834,16 @@ async function handleLogin(parsed, io) {
     }, parsed, io, () => `Workbench Cloud: authenticated${username ? ` as ${username}` : ""}\nWorkbench API: ${baseUrl}`);
 }
 async function handleLogout(parsed, io) {
-    if (parsed.positionals.length > 1) {
-        throw new WorkbenchUserError("workbench logout accepts no positional arguments.");
+    const provider = optionalPositional(parsed, 1);
+    if (provider) {
+        if (parsed.positionals.length > 2) {
+            throw new WorkbenchUserError("workbench logout PROVIDER accepts only one provider argument.");
+        }
+        return await handleAdapterLogout(provider, parsed, io);
     }
     const config = await loadConfig();
     const baseUrl = optionalWorkbenchBaseUrl({ configBaseUrl: config.baseUrl });
     const tokenPresent = Boolean(config.accessToken);
-    if (tokenPresent && !baseUrl) {
-        throw new WorkbenchUserError("Missing Workbench API URL. Set WORKBENCH_API_URL or run `workbench login --base-url URL`.");
-    }
     let revoke = "skipped";
     if (config.accessToken && baseUrl) {
         try {
@@ -950,51 +874,33 @@ async function handleLogout(parsed, io) {
         `Logged out of Workbench${baseUrl ? ` (${baseUrl})` : ""}.`,
         `Token: ${tokenPresent ? "present" : "absent"}; revoke ${revoke}; config ${configRemoved ? "removed" : "unchanged"}.`,
         adapterAuthRetained
-            ? "Local adapter auth records were retained; run workbench auth disconnect ADAPTER to remove them."
+            ? "Local adapter auth records were retained; run workbench logout PROVIDER to remove them."
             : "No local adapter auth records remain.",
     ].join("\n"));
 }
 async function handleInstall(parsed, io) {
-    const source = requiredFlag(parsed, {
-        flag: "source",
-        usage: "workbench install requires --source SOURCE.",
-        remediation: "Run workbench install --source https://HOST/skills/OWNER/SKILL --agent codex.",
-    });
+    const sourceInput = requiredPositional(parsed, 1, "workbench install requires HANDLE_OR_URL.");
     rejectExtraInput(parsed, {
-        maxPositionals: 1,
-        message: "workbench install accepts --source SOURCE, not positional SOURCE.",
-        remediation: "Run workbench install --source https://HOST/skills/OWNER/SKILL --agent codex.",
+        maxPositionals: 2,
+        message: "workbench install accepts one HANDLE_OR_URL argument.",
+        remediation: "Run workbench install OWNER/SKILL --to codex.",
     });
-    if (parsed.flags.list !== true && stringsFlag(parsed, "agent").length === 0 && parsed.flags.local !== true) {
-        throw new WorkbenchCodedError("install_target_required", "workbench install requires an explicit target.", {
-            remediation: "Run workbench install --source SOURCE --agent codex, workbench install --source SOURCE --agent claude, or workbench install --source SOURCE --local.",
-            exitCode: 2,
-        });
-    }
+    const source = await resolveWorkbenchInstallSourceInput(sourceInput);
     const workbenchSource = parseWorkbenchInstallSource(source);
     if (!workbenchSource) {
         throw new WorkbenchCodedError("usage", "workbench install requires a Workbench Cloud source URL.", {
-            remediation: "Run workbench install --source https://HOST/skills/OWNER/SKILL --agent codex.",
+            remediation: "Run workbench install OWNER/SKILL --to codex.",
             exitCode: 2,
         });
     }
     const snapshot = await fetchWorkbenchInstallSourceSnapshot(workbenchSource, source);
     const sourceSummary = workbenchInstallSourceSummary(workbenchSource, snapshot);
-    if (parsed.flags.list === true) {
-        return emitResult("workbench.cli.install.v1", {
-            source: sourceSummary,
-            skills: [snapshot.name],
-            fileCount: snapshot.files.length,
-            targets: installTargetsToJson(supportedInstallTargets()),
-        }, parsed, io, () => [
-            `${snapshot.name}\t${snapshot.versionId}\tfiles=${snapshot.files.length}`,
-            "Targets:",
-            ...supportedInstallTargets().map((target) => `  ${target.agent}\t${target.destination}`),
-        ].join("\n"));
-    }
+    const config = await loadConfig();
+    const toTargets = stringsFlag(parsed, "to");
+    const selectedTargets = toTargets.length > 0 ? normalizeInstallTargetNames(toTargets) : await defaultInstallTargetNames(config);
     const targets = resolveInstallTargets({
-        agents: stringsFlag(parsed, "agent"),
-        local: parsed.flags.local === true,
+        agents: selectedTargets.filter((target) => target !== "local"),
+        local: selectedTargets.some((target) => target === "local"),
         skillName: snapshot.name,
     });
     const result = await installSnapshotToTargets({
@@ -1003,6 +909,9 @@ async function handleInstall(parsed, io) {
         overwrite: parsed.flags.yes === true,
         dryRun: parsed.flags["dry-run"] === true,
     });
+    if (toTargets.length > 0 && parsed.flags["dry-run"] !== true) {
+        await writeConfig({ ...config, installTargets: selectedTargets });
+    }
     return emitResult("workbench.cli.install.v1", {
         source: sourceSummary,
         result: result.result,
@@ -1016,6 +925,327 @@ async function handleInstall(parsed, io) {
         ...result.targets.map((target) => `  ${target.agent}\t${target.previous}\t${target.destination}`),
     ].join("\n"));
 }
+async function handleCloudEval(parsed, io) {
+    const started = await startCloudExecution("eval", parsed);
+    const artifactIds = await artifactIdsByRunId(started.core, started.runs);
+    const failedRuns = started.runs.filter((run) => run.status === "failed" || run.status === "canceled");
+    if (failedRuns.length > 0) {
+        return emitEvalFailure(started.runs, failedRuns, artifactIds, parsed, io);
+    }
+    const deltas = await evalDeltas(started.core, started.runs);
+    const next = await evalSuccessNextCommand(started.core, started.runs);
+    return emitResult("workbench.cli.eval.v1", {
+        result: started.runs.map((run) => runSummary(run, artifactIds.get(run.id) ?? [])),
+        deltas: deltas,
+        next: next,
+        cloud: cloudExecutionSummary(started),
+    }, parsed, io, () => [
+        `Completed hosted eval on ${started.remote.url}.`,
+        started.runs.map(formatRun).join("\n"),
+        ...deltas.map(formatEvalDelta),
+        ...(next ? [`next: ${next}`] : []),
+    ].filter(Boolean).join("\n"));
+}
+async function handleCloudImprove(parsed, io) {
+    const started = await startCloudExecution("improve", parsed);
+    const artifactIds = await artifactIdsByRunId(started.core, started.runs);
+    const failedRuns = started.runs.filter((run) => run.status === "failed" || run.status === "canceled");
+    if (failedRuns.length > 0) {
+        const first = failedRuns[0];
+        throw new WorkbenchCodedError("improve_failed", "Hosted improve failed; evidence was saved.", {
+            remediation: `Run workbench show ${first.id}.`,
+            subject: {
+                runIds: failedRuns.map((run) => run.id),
+                statuses: Object.fromEntries(failedRuns.map((run) => [run.id, run.status])),
+            },
+            exitCode: 1,
+        });
+    }
+    const switchedVersionId = await switchHostedImproveVersionIfPromoted(started);
+    const next = cloudImproveNextCommand(started.runs);
+    return emitResult("workbench.cli.improve.v1", {
+        result: started.runs.map((run) => runSummary(run, artifactIds.get(run.id) ?? [])),
+        next: next,
+        cloud: cloudExecutionSummary(started),
+        ...(switchedVersionId ? { switchedVersionId } : {}),
+    }, parsed, io, () => [
+        `Completed hosted improve on ${started.remote.url}.`,
+        started.runs.map(formatRun).join("\n"),
+        ...(switchedVersionId ? [`Switched local source to ${displayRef(switchedVersionId)}.`] : []),
+        ...(next ? [`next: ${next}`] : []),
+    ].filter(Boolean).join("\n"));
+}
+async function defaultInstallTargetNames(config) {
+    if (config.installTargets && config.installTargets.length > 0) {
+        return config.installTargets;
+    }
+    const detected = [];
+    for (const target of supportedInstallTargets()) {
+        if (target.agent === "local") {
+            continue;
+        }
+        const home = path.dirname(path.dirname(target.destination));
+        if (await pathExists(home)) {
+            detected.push(target.agent);
+        }
+    }
+    return detected.length > 0 ? detected : ["local"];
+}
+function normalizeInstallTargetNames(values) {
+    const normalized = [];
+    for (const value of values) {
+        const target = value.trim().toLowerCase();
+        if (target !== "codex" && target !== "claude" && target !== "local") {
+            throw new WorkbenchCodedError("usage", `Unsupported install target: ${value}`, {
+                remediation: "Use --to codex, --to claude, or --to local.",
+                exitCode: 2,
+            });
+        }
+        normalized.push(target);
+    }
+    return [...new Set(normalized)];
+}
+async function pathExists(filePath) {
+    try {
+        await fs.access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function startCloudExecution(command, parsed) {
+    const root = dirFlag(parsed) ?? process.cwd();
+    const remote = await ensureCloudRemoteForExecution(root, parsed);
+    const source = parseWorkbenchInstallSource(remote.url);
+    if (!source) {
+        throw new WorkbenchCodedError("remote_invalid_url", `Workbench remote is not a Cloud skill URL: ${remote.url}`, {
+            remediation: "Run workbench publish to recreate the Workbench Cloud link.",
+            subject: { remote: remote.name, url: remote.url },
+            exitCode: 2,
+        });
+    }
+    const token = await workbenchCloudToken({ baseUrl: source.baseUrl });
+    if (!token) {
+        throw new WorkbenchCodedError("auth_required", `workbench ${command} --cloud requires Workbench Cloud auth.`, {
+            remediation: `Run workbench login --base-url ${source.baseUrl}.`,
+            exitCode: 1,
+        });
+    }
+    const core = { dir: root, authToken: token };
+    const syncBefore = await syncWorkbenchRemote({ ...core, remote: remote.name });
+    const startSnapshot = await createWorkbenchReadOnlyInspectionSnapshot(core);
+    const skillId = await resolveCloudSkillId(source);
+    const response = await apiRequest(`/api/workbench/skills/${encodeURIComponent(skillId)}${command === "improve" ? "/improve" : "/runs"}`, { method: "POST", body: cloudExecutionRequestBody(command, parsed) }, source.baseUrl);
+    const runs = response.runs ?? [];
+    if (runs.length === 0) {
+        throw new WorkbenchCodedError("cloud_run_missing", `Workbench Cloud did not return a run for ${command}.`, {
+            retryable: true,
+            remediation: "Run workbench log --runs.",
+            subject: { remote: remote.name, skillId },
+            exitCode: 1,
+        });
+    }
+    const initialSyncAfter = await syncWorkbenchRemote({ ...core, remote: remote.name });
+    const completed = await waitForCloudRuns({
+        core,
+        remote,
+        runs,
+        initialSync: initialSyncAfter,
+    });
+    return {
+        core,
+        remote,
+        skillId,
+        runs: completed.runs,
+        startVersionId: startSnapshot.status.currentVersionId ?? startSnapshot.refs.current,
+        source,
+        sync: {
+            before: { pushed: syncBefore.pushed, pulled: syncBefore.pulled, upToDate: syncBefore.upToDate },
+            after: { pushed: completed.sync.pushed, pulled: completed.sync.pulled, upToDate: completed.sync.upToDate },
+        },
+    };
+}
+async function waitForCloudRuns(input) {
+    const runIds = input.runs
+        .map((run) => run.id)
+        .filter((id) => typeof id === "string" && id.length > 0);
+    if (runIds.length === 0 || runIds.length !== input.runs.length) {
+        throw new WorkbenchCodedError("cloud_run_missing", "Workbench Cloud did not return a run id.", {
+            retryable: true,
+            remediation: "Run workbench log --runs.",
+            exitCode: 1,
+        });
+    }
+    let sync = input.initialSync;
+    const timeoutMs = positiveIntEnv("WORKBENCH_CLOUD_RUN_TIMEOUT_MS") ?? CLOUD_RUN_TIMEOUT_MS;
+    const pollIntervalMs = positiveIntEnv("WORKBENCH_CLOUD_RUN_POLL_INTERVAL_MS") ?? CLOUD_RUN_POLL_INTERVAL_MS;
+    const deadline = Date.now() + timeoutMs;
+    while (true) {
+        const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(input.core);
+        const runs = runIds
+            .map((id) => snapshot.runs.find((entry) => entry.id === id))
+            .filter((run) => Boolean(run));
+        if (runs.length === runIds.length && runs.every(isTerminalRun)) {
+            return { runs, sync };
+        }
+        if (Date.now() >= deadline) {
+            throw new WorkbenchCodedError("cloud_run_pending", "Hosted Workbench run is still running.", {
+                retryable: true,
+                remediation: runIds[0] ? `Run workbench show ${runIds[0]}.` : "Run workbench log --runs.",
+                subject: {
+                    runIds,
+                    statuses: Object.fromEntries(runs.map((run) => [run.id, run.status])),
+                },
+                exitCode: 1,
+            });
+        }
+        await sleep(pollIntervalMs);
+        sync = await syncWorkbenchRemote({ ...input.core, remote: input.remote.name });
+    }
+}
+function isTerminalRun(run) {
+    return run.status === "succeeded" || run.status === "failed" || run.status === "canceled";
+}
+async function switchHostedImproveVersionIfPromoted(started) {
+    const outputVersionId = started.runs.find((run) => run.status === "succeeded" && run.outputVersionId)?.outputVersionId;
+    if (!outputVersionId) {
+        return undefined;
+    }
+    const refs = await fetchCloudObjectRefs(started);
+    if (refs.current !== outputVersionId) {
+        return undefined;
+    }
+    await listWorkbenchVersions(started.core);
+    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(started.core);
+    const currentVersionId = snapshot.status.currentVersionId ?? snapshot.refs.current;
+    if (started.startVersionId && currentVersionId && currentVersionId !== started.startVersionId) {
+        throw new WorkbenchCodedError("worktree_changed", "Local source changed while hosted improve was running; refusing to overwrite it.", {
+            remediation: `Review workbench diff, then run workbench switch ${outputVersionId} when ready.`,
+            subject: {
+                startedFrom: started.startVersionId,
+                current: currentVersionId,
+                hostedVersion: outputVersionId,
+            },
+            exitCode: 1,
+        });
+    }
+    const version = await switchWorkbenchVersion(outputVersionId, started.core);
+    return version.id;
+}
+async function fetchCloudObjectRefs(started) {
+    const response = await apiRequest(`/api/workbench/skills/${encodeURIComponent(started.skillId)}/objects`, {}, started.source.baseUrl);
+    return response.objectPack?.refs ?? {};
+}
+async function ensureCloudRemoteForExecution(root, parsed) {
+    const linked = await linkedCloudRemote(root);
+    if (linked) {
+        return linked;
+    }
+    const link = await cloudRemoteLinkTarget(root);
+    const remote = await derivePublishCloudRemote(parsed, "workbench --cloud", link.name);
+    const source = parseWorkbenchInstallSource(remote.url);
+    if (!source) {
+        throw new WorkbenchCodedError("remote_invalid_url", `Workbench remote is not a Cloud skill URL: ${remote.url}`, {
+            remediation: "Run workbench publish to recreate the Workbench Cloud link.",
+            subject: { remote: remote.name, url: remote.url },
+            exitCode: 2,
+        });
+    }
+    const token = await workbenchCloudToken({ baseUrl: source.baseUrl });
+    if (!token) {
+        throw new WorkbenchCodedError("auth_required", "workbench --cloud requires Workbench Cloud auth.", {
+            remediation: `Run workbench login --base-url ${source.baseUrl}.`,
+            exitCode: 1,
+        });
+    }
+    const result = await addWorkbenchRemote(remote.name, remote.url, {
+        dir: root,
+        authToken: token,
+        replace: link.replace,
+    });
+    return result.remote;
+}
+async function linkedCloudRemote(root) {
+    return preferredCloudRemote(await inspectionRemotes(root)) ?? null;
+}
+async function inspectionRemotes(root) {
+    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot({ dir: root }).catch((error) => {
+        if (error instanceof WorkbenchCodedError || error instanceof WorkbenchUserError) {
+            return null;
+        }
+        throw error;
+    });
+    return snapshot?.remotes ?? [];
+}
+async function cloudRemoteLinkTarget(root) {
+    return cloudRemoteLinkTargetFromRemotes(await inspectionRemotes(root));
+}
+function cloudRemoteLinkTargetFromRemotes(remotes) {
+    const existing = preferredCloudRemote(remotes);
+    if (existing) {
+        return { name: existing.name, replace: true, existing };
+    }
+    return { name: availableCloudRemoteName(remotes), replace: false };
+}
+function preferredCloudRemote(remotes) {
+    const cloudRemotes = remotes.filter((remote) => remote.kind === "workbench-cloud");
+    return cloudRemotes.find((remote) => remote.name === "cloud") ?? cloudRemotes[0];
+}
+function availableCloudRemoteName(remotes) {
+    const names = new Set(remotes.map((remote) => remote.name));
+    if (!names.has("cloud")) {
+        return "cloud";
+    }
+    for (let index = 1;; index += 1) {
+        const name = `cloud-${index}`;
+        if (!names.has(name)) {
+            return name;
+        }
+    }
+}
+async function resolveCloudSkillId(source) {
+    const listed = await apiRequest("/api/workbench/skills", {}, source.baseUrl);
+    const skill = listed.skills?.find((entry) => entry.ownerSlug === source.owner && entry.name === source.skill);
+    if (!skill?.id) {
+        throw new WorkbenchCodedError("remote_not_found", `Workbench Cloud skill not found: ${source.owner}/${source.skill}`, {
+            remediation: "Run workbench publish.",
+            subject: { owner: source.owner, skill: source.skill },
+            exitCode: 1,
+        });
+    }
+    return skill.id;
+}
+function cloudExecutionRequestBody(command, parsed) {
+    return {
+        version: optionalPositional(parsed, 1),
+        skill: stringFlag(parsed, "skills"),
+        agent: stringFlag(parsed, "agents"),
+        samples: intFlag(parsed, "samples"),
+        ...(command === "improve" ? { budget: intFlag(parsed, "budget") } : {}),
+    };
+}
+function cloudImproveNextCommand(runs) {
+    return cloudExecutionNextCommand(runs, "workbench eval");
+}
+function cloudExecutionNextCommand(runs, successCommand) {
+    const first = runs[0];
+    if (!first) {
+        return "workbench log --runs";
+    }
+    if (first.status === "running" || first.status === "failed" || first.status === "canceled") {
+        return `workbench show ${displayRef(first.id)}`;
+    }
+    return successCommand;
+}
+function cloudExecutionSummary(started) {
+    return {
+        remote: started.remote.name,
+        url: started.remote.url,
+        skillId: started.skillId,
+        sync: started.sync,
+    };
+}
 function workbenchInstallSourceSummary(source, snapshot) {
     const installUrl = `${source.baseUrl}/skills/${encodeURIComponent(source.owner)}/${encodeURIComponent(source.skill)}`;
     return {
@@ -1089,12 +1319,13 @@ async function fetchWorkbenchInstallSourceSnapshot(source, displaySource) {
         throw new WorkbenchCodedError("auth_required", token
             ? `Workbench Cloud rejected the provided token while installing ${displaySource}.`
             : `Authentication is required to install ${displaySource}.`, {
-            remediation: `Run workbench login --base-url ${source.baseUrl}.`,
+            remediation: "Run workbench login.",
             exitCode: 1,
         });
     }
     if (!response.ok) {
-        throw new WorkbenchCodedError("install_failed", `Unable to download Workbench source ${displaySource}: ${response.status} ${readResponseError(text) ?? response.statusText}`, {
+        const excerpt = readResponseError(text);
+        throw new WorkbenchCodedError("install_failed", `Unable to download Workbench source ${displaySource}: ${response.status}${excerpt ? ` ${excerpt}` : response.statusText ? ` ${response.statusText}` : ""}`, {
             subject: { source: displaySource, status: response.status },
             exitCode: 1,
         });
@@ -1175,6 +1406,7 @@ async function loadConfig() {
         ...(typeof parsed.baseUrl === "string" ? { baseUrl: normalizeBaseUrl(parsed.baseUrl) } : {}),
         ...(typeof parsed.accessToken === "string" ? { accessToken: parsed.accessToken } : {}),
         ...(typeof parsed.username === "string" ? { username: parsed.username } : {}),
+        ...(Array.isArray(parsed.installTargets) ? { installTargets: normalizeInstallTargetNames(parsed.installTargets.flatMap((entry) => typeof entry === "string" ? [entry] : [])) } : {}),
     };
 }
 // Single resolver for the Workbench Cloud token used by every authenticated
@@ -1214,18 +1446,15 @@ function deviceAuthPath() {
     return process.env.WORKBENCH_DEVICE_AUTH?.trim() || path.join(path.dirname(configPath()), "device-auth.json");
 }
 function selectWorkbenchBaseUrl(input = {}) {
-    const baseUrl = optionalWorkbenchBaseUrl(input);
-    if (!baseUrl) {
-        throw new WorkbenchUserError("Missing Workbench API URL. Pass --base-url URL, set WORKBENCH_API_URL, or run `workbench login --base-url URL`.");
-    }
-    return baseUrl;
+    return optionalWorkbenchBaseUrl(input);
 }
 function optionalWorkbenchBaseUrl(input = {}) {
     const value = input.explicitBaseUrl ??
         input.originBaseUrl ??
         process.env.WORKBENCH_API_URL ??
-        input.configBaseUrl;
-    return value ? normalizeBaseUrl(value) : undefined;
+        input.configBaseUrl ??
+        DEFAULT_WORKBENCH_CLOUD_BASE_URL;
+    return normalizeBaseUrl(value);
 }
 function normalizeBaseUrl(value) {
     return value.trim().replace(/\/+$/u, "");
@@ -1243,7 +1472,8 @@ async function requestDeviceAuthorization(baseUrl) {
         });
     }
     if (!response.ok) {
-        throw new WorkbenchCodedError("login_denied", `Device login failed: ${readResponseError(text) ?? response.statusText}`, {
+        const excerpt = readResponseError(text);
+        throw new WorkbenchCodedError("login_denied", `Device login failed: ${response.status}${excerpt ? ` ${excerpt}` : response.statusText ? ` ${response.statusText}` : ""}`, {
             exitCode: 1,
         });
     }
@@ -1294,7 +1524,7 @@ async function pollDeviceToken(baseUrl, authorization, timeoutSeconds) {
     }
     throw new WorkbenchCodedError("login_pending", "Device login is still waiting for browser authorization.", {
         retryable: true,
-        remediation: "Authorize the device in the browser, then run workbench login --wait --timeout 120.",
+        remediation: "Authorize the device in the browser, then run workbench login --wait.",
         subject: {
             retryAfterSeconds: Math.max(1, Math.ceil(intervalMs / 1000)),
             verificationUri: authorization.verification_uri,
@@ -1318,7 +1548,8 @@ async function fetchWorkbenchUsername(baseUrl, accessToken) {
 }
 async function readPendingDeviceAuthorization(baseUrl) {
     const record = await readDeviceAuthorizationJson(deviceAuthPath());
-    if (!record || record.baseUrl !== baseUrl || Date.parse(record.expiresAt) <= Date.now()) {
+    const expectedBaseUrl = baseUrl ? normalizeBaseUrl(baseUrl) : undefined;
+    if (!record || (expectedBaseUrl && record.baseUrl !== expectedBaseUrl) || Date.parse(record.expiresAt) <= Date.now()) {
         return null;
     }
     return record;
@@ -1408,7 +1639,8 @@ async function apiRequest(apiPath, options = {}, baseUrlOverride) {
                 }
                 throw requestError;
             }
-            const requestError = new WorkbenchApiRequestError(response.status, readResponseError(text) ?? `Request failed with status ${response.status}${response.statusText ? ` ${response.statusText}` : ""}.`, text);
+            const excerpt = readResponseError(text);
+            const requestError = new WorkbenchApiRequestError(response.status, `Request failed with status ${response.status}${response.statusText ? ` ${response.statusText}` : ""}${excerpt ? `: ${excerpt}` : ""}.`, text);
             lastError = requestError;
             if (canRetry && attempt < API_REQUEST_MAX_ATTEMPTS && isTransientApiRequestError(requestError)) {
                 await sleep(250 * attempt);
@@ -1428,8 +1660,11 @@ function encodeJsonRequestBody(body) {
     if (Buffer.byteLength(text) < API_REQUEST_GZIP_THRESHOLD_BYTES) {
         return { body: text, headers: { "content-type": "application/json" } };
     }
+    const compressed = gzipSync(text);
+    const compressedBody = new ArrayBuffer(compressed.byteLength);
+    new Uint8Array(compressedBody).set(compressed);
     return {
-        body: gzipSync(text),
+        body: compressedBody,
         headers: {
             "content-encoding": "gzip",
             "content-type": "application/json",
@@ -1498,11 +1733,21 @@ function readResponseError(text) {
         const parsed = JSON.parse(text);
         const record = asRecord(parsed);
         const error = record?.error ?? record?.message;
-        return typeof error === "string" && error.trim() ? error : null;
+        return typeof error === "string" && error.trim() ? oneLineExcerpt(error) : null;
     }
     catch {
-        return text.trim() || null;
+        if (/<(?:!doctype|html|head|body)\b/iu.test(text)) {
+            return null;
+        }
+        return oneLineExcerpt(text);
+    }
+}
+function oneLineExcerpt(text) {
+    const line = text.replace(/\s+/gu, " ").trim();
+    if (!line) {
+        return null;
     }
+    return line.length > 180 ? `${line.slice(0, 177)}...` : line;
 }
 function parseWorkbenchCloudErrorBody(text) {
     try {
@@ -1535,6 +1780,14 @@ function errorMessage(error) {
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function positiveIntEnv(name) {
+    const raw = process.env[name]?.trim();
+    if (!raw) {
+        return undefined;
+    }
+    const value = Number(raw);
+    return Number.isSafeInteger(value) && value > 0 ? value : undefined;
+}
 async function openBrowser(url) {
     const command = process.platform === "darwin"
         ? "open"
@@ -1870,6 +2123,17 @@ function parseArgs(argv) {
             addFlag(flags, "version", true);
             continue;
         }
+        if (arg === "-n") {
+            const value = argv[index + 1];
+            if (value && !value.startsWith("-")) {
+                index += 1;
+                addFlag(flags, "samples", value);
+            }
+            else {
+                addFlag(flags, "samples", true);
+            }
+            continue;
+        }
         if (!arg.startsWith("--") || arg === "--") {
             positionals.push(arg);
             continue;
@@ -1877,7 +2141,9 @@ function parseArgs(argv) {
         const eq = arg.indexOf("=");
         const name = eq === -1 ? arg.slice(2) : arg.slice(2, eq);
         const value = eq === -1 ? argv[index + 1] : arg.slice(eq + 1);
-        if (eq === -1 && BOOLEAN_FLAGS.has(name)) {
+        const flagSpec = flagSpecForParsedPrefix(positionals, flags);
+        const kind = flagSpec?.[name];
+        if (eq === -1 && kind === "boolean") {
             addFlag(flags, name, true);
         }
         else if (eq === -1 && value && !value.startsWith("-")) {
@@ -1890,8 +2156,12 @@ function parseArgs(argv) {
     }
     return { positionals, flags };
 }
+function flagSpecForParsedPrefix(positionals, flags) {
+    const command = positionals[0] ?? (flags.version === true ? "version" : "status");
+    return allowedFlagsForCommand({ positionals: [...positionals], flags: {} }, command);
+}
 function addFlag(flags, name, value) {
-    if (name === "with") {
+    if (name === "with" || name === "to") {
         const existing = flags[name];
         flags[name] = Array.isArray(existing)
             ? [...existing, String(value)]
@@ -1900,15 +2170,6 @@ function addFlag(flags, name, value) {
                 : [String(existing), String(value)];
         return;
     }
-    if (name === "agent" || name === "skill") {
-        const existing = flags[name];
-        flags[name] = Array.isArray(existing)
-            ? [...existing, String(value)]
-            : existing === undefined
-                ? String(value)
-                : [String(existing), String(value)];
-        return;
-    }
     flags[name] = value;
 }
 function dirFlag(parsed) {
@@ -1972,14 +2233,154 @@ function rejectExtraInput(parsed, input) {
         exitCode: 2,
     });
 }
-function parsePublishVisibility(value) {
-    if (value === undefined) {
-        return undefined;
+async function defaultDiffRange(core) {
+    await listWorkbenchVersions(core);
+    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(core);
+    const currentId = snapshot.status.currentVersionId ?? snapshot.refs.current;
+    const current = snapshot.versions.find((version) => version.id === currentId);
+    if (!current) {
+        throw new WorkbenchCodedError("version_not_found", "Current Workbench version was not found.", {
+            remediation: "Run workbench log --versions.",
+            exitCode: 1,
+        });
     }
-    if (value === "private" || value === "internal" || value === "public") {
-        return value;
+    const parent = current.parentIds[0];
+    return parent ? `${parent}..${current.id}` : `${current.id}..${current.id}`;
+}
+function parsePublishVisibilityFlags(parsed) {
+    const selected = [
+        parsed.flags.private === true ? "private" : undefined,
+        parsed.flags.team === true ? "internal" : undefined,
+        parsed.flags.public === true ? "public" : undefined,
+    ].filter((value) => Boolean(value));
+    if (selected.length > 1) {
+        throw new WorkbenchCodedError("usage", "workbench publish accepts only one visibility flag.", {
+            remediation: "Run workbench publish --private, workbench publish --team, or workbench publish --public.",
+            exitCode: 2,
+        });
+    }
+    return selected[0];
+}
+async function previewPublishWithDerivedRemote(parsed) {
+    const root = path.resolve(dirFlag(parsed) ?? process.cwd());
+    const reconciledSnapshot = await createWorkbenchReadOnlyInspectionSnapshot({ dir: root });
+    const link = cloudRemoteLinkTargetFromRemotes(reconciledSnapshot.remotes);
+    const remote = stringFlag(parsed, "as") || !link.existing
+        ? await derivePublishCloudRemote(parsed, "workbench publish", link.name)
+        : link.existing;
+    const requestedVersion = optionalPositional(parsed, 1);
+    const version = requestedVersion && requestedVersion !== "current"
+        ? snapshotVersionByRef(reconciledSnapshot, requestedVersion)
+        : snapshotVersionByRef(reconciledSnapshot, reconciledSnapshot.status.currentVersionId ?? reconciledSnapshot.refs.current ?? "");
+    if (!version) {
+        throw new WorkbenchCodedError("version_not_found", `Version not found: ${requestedVersion ?? "current"}`, {
+            remediation: "Run workbench log --versions.",
+            subject: { version: requestedVersion ?? "current" },
+            exitCode: 1,
+        });
     }
-    throw new WorkbenchUserError("workbench publish --visibility must be private, internal, or public.");
+    return {
+        remote,
+        version,
+        visibility: parsePublishVisibilityFlags(parsed) ?? "private",
+        installHandle: installHandleFromCloudRemote(remote),
+        installUrl: remote.url,
+        pinnedInstallUrl: `${remote.url}/releases/${encodeURIComponent(version.id)}`,
+    };
+}
+async function ensurePublishRemote(parsed) {
+    const core = await coreOptions(parsed);
+    const root = path.resolve(dirFlag(parsed) ?? process.cwd());
+    const link = await cloudRemoteLinkTarget(root);
+    const override = stringFlag(parsed, "as");
+    if (override) {
+        const remote = await derivePublishCloudRemote(parsed, "workbench publish", link.name);
+        const result = await addWorkbenchRemote(remote.name, remote.url, { ...core, replace: link.replace });
+        return result.remote.name;
+    }
+    if (link.existing) {
+        return link.existing.name;
+    }
+    const remote = await derivePublishCloudRemote(parsed, "workbench publish", link.name);
+    const result = await addWorkbenchRemote(remote.name, remote.url, core);
+    return result.remote.name;
+}
+async function derivePublishCloudRemote(parsed, action = "workbench publish", name = "cloud") {
+    const config = await loadConfig();
+    const baseUrl = optionalWorkbenchBaseUrl({ configBaseUrl: config.baseUrl }) ?? DEFAULT_WORKBENCH_CLOUD_BASE_URL;
+    const override = stringFlag(parsed, "as");
+    const handle = override ? parseOwnerSkillHandle(override) : derivedOwnerSkillHandle(parsed, config, action);
+    const url = `${baseUrl}/skills/${encodeURIComponent(handle.owner)}/${encodeURIComponent(handle.skill)}`;
+    return { name, kind: "workbench-cloud", url };
+}
+function installHandleFromCloudRemote(remote) {
+    const source = parseWorkbenchInstallSource(remote.url);
+    if (!source) {
+        throw new WorkbenchCodedError("remote_invalid_url", `Workbench remote is not a Cloud skill URL: ${remote.url}`, {
+            remediation: "Run workbench publish to recreate the Workbench Cloud link.",
+            subject: { remote: remote.name, url: remote.url },
+            exitCode: 2,
+        });
+    }
+    return `${source.owner}/${source.skill}`;
+}
+function parseOwnerSkillHandle(input) {
+    const handle = normalizedOwnerSkillHandle(input);
+    if (!handle) {
+        throw new WorkbenchCodedError("usage", "workbench publish --as expects OWNER/SKILL.", {
+            remediation: "Run workbench publish --as OWNER/SKILL.",
+            exitCode: 2,
+        });
+    }
+    return handle;
+}
+function derivedOwnerSkillHandle(parsed, config, action) {
+    const owner = config.username?.trim();
+    if (!owner) {
+        throw new WorkbenchCodedError("auth_required", `${action} needs a logged-in Workbench Cloud username before it can derive OWNER/SKILL.`, {
+            remediation: "Run workbench login.",
+            exitCode: 1,
+        });
+    }
+    const root = path.resolve(dirFlag(parsed) ?? process.cwd());
+    const handle = normalizeOwnerSkillHandle(owner, path.basename(root));
+    if (!handle.owner || !handle.skill) {
+        throw new WorkbenchCodedError("usage", `${action} could not derive a valid OWNER/SKILL handle.`, {
+            remediation: `Run ${action} --as OWNER/SKILL.`,
+            subject: { owner, skill: path.basename(root) },
+            exitCode: 2,
+        });
+    }
+    return handle;
+}
+async function resolveWorkbenchInstallSourceInput(input) {
+    if (/^https?:\/\//u.test(input)) {
+        return input;
+    }
+    const handle = normalizedOwnerSkillHandle(input);
+    if (!handle) {
+        throw new WorkbenchCodedError("usage", "workbench install expects OWNER/SKILL or a Workbench Cloud skill URL.", {
+            remediation: "Run workbench install OWNER/SKILL --to codex.",
+            exitCode: 2,
+        });
+    }
+    const config = await loadConfig();
+    const baseUrl = optionalWorkbenchBaseUrl({ configBaseUrl: config.baseUrl }) ?? DEFAULT_WORKBENCH_CLOUD_BASE_URL;
+    return `${baseUrl}/skills/${encodeURIComponent(handle.owner)}/${encodeURIComponent(handle.skill)}`;
+}
+function normalizedOwnerSkillHandle(value) {
+    const parts = value.trim().split("/");
+    if (parts.length !== 2) {
+        return null;
+    }
+    const handle = normalizeOwnerSkillHandle(parts[0] ?? "", parts[1] ?? "");
+    return handle.owner && handle.skill ? handle : null;
+}
+function normalizeOwnerSkillHandle(owner, skill) {
+    return {
+        owner: normalizeWorkbenchSkillName(owner),
+        skill: normalizeWorkbenchSkillName(skill),
+    };
 }
 function parseWithFlags(parsed) {
     const raw = parsed.flags.with;
@@ -2021,7 +2422,7 @@ async function artifactIdsByRunId(core, runs) {
     return byRun;
 }
 function emitEvalFailure(runs, failedRuns, artifactIds, parsed, io) {
-    const nextCommands = evalFailureNextCommands(failedRuns);
+    const next = evalFailureNextCommand(failedRuns);
     if (parsed.flags.json === true) {
         io.stdout.write(`${JSON.stringify({
             schema: "workbench.cli.eval.v1",
@@ -2032,14 +2433,14 @@ function emitEvalFailure(runs, failedRuns, artifactIds, parsed, io) {
             evidenceSaved: true,
             runs: runs.map((run) => runFailureSummary(run, artifactIds.get(run.id) ?? [])),
             failedRuns: failedRuns.map((run) => runFailureSummary(run, artifactIds.get(run.id) ?? [])),
-            nextCommands,
+            next,
         }, null, 2)}\n`);
         return 1;
     }
     io.stdout.write([
         "Eval failed; evidence was saved.",
         ...failedRuns.map(formatRun),
-        ...(nextCommands.length > 0 ? ["next:", ...nextCommands.map((command) => `  ${command}`)] : []),
+        ...(next ? [`next: ${next}`] : []),
     ].join("\n") + "\n");
     return 1;
 }
@@ -2072,18 +2473,12 @@ function runFailureSummary(run, artifactIds) {
         artifactIds: [...artifactIds],
     };
 }
-function evalFailureNextCommands(failedRuns) {
+function evalFailureNextCommand(failedRuns) {
     const first = failedRuns[0];
     if (!first) {
-        return ["workbench compare --versions all"];
+        return "workbench log --runs";
     }
-    const traceId = first.traceIds[0];
-    return [
-        "workbench compare --versions all",
-        `workbench trace ${first.id}`,
-        ...(traceId ? [`workbench show ${traceId}:stderr.log`] : []),
-        `workbench improve --agent ${first.agentName} --budget 1 --samples 1`,
-    ];
+    return `workbench show ${displayRef(first.id)}`;
 }
 function output(value, parsed, io, text) {
     return emitResult(commandSchema(parsed), { result: value }, parsed, io, text);
@@ -2091,7 +2486,7 @@ function output(value, parsed, io, text) {
 function commandSchema(parsed) {
     const command = parsed.positionals[0] ?? "result";
     const subcommand = parsed.positionals[1];
-    const suffix = ["auth", "remote", "agent", "case", "skills"].includes(command) && subcommand
+    const suffix = ["agent", "case"].includes(command) && subcommand
         ? `${command}-${subcommand}`
         : command;
     return `workbench.cli.${suffix}.v1`;
@@ -2116,11 +2511,377 @@ async function workbenchCliAuthStatus() {
         })),
     };
 }
+function statusWithCausalNext(status, auth) {
+    const cloudAuthMissing = auth.workbenchCloud.status !== "authenticated";
+    const needsCloudAuth = cloudAuthMissing && status.remotes.some((remote) => remote.kind === "workbench-cloud" &&
+        (remote.sync.status !== "up_to_date" || remote.publication.status === "unpublished"));
+    if (!needsCloudAuth) {
+        return status;
+    }
+    return {
+        ...status,
+        next: "workbench login",
+    };
+}
+function displayRef(id) {
+    const version = /^v_([0-9a-f]{8,})$/iu.exec(id);
+    if (version?.[1]) {
+        return version[1].slice(0, 8);
+    }
+    const separator = id.indexOf("_");
+    if (separator > 0 && separator < id.length - 1) {
+        const prefix = id.slice(0, separator);
+        const suffix = id.slice(separator + 1);
+        return `${prefix}_${suffix.slice(0, 8)}`;
+    }
+    return id.length > 8 ? id.slice(0, 8) : id;
+}
+function shortenCommandRefs(command) {
+    return command.replace(/\b(?:v_[0-9a-f]{8,}|(?:run|job|trace|artifact)_[a-z0-9_-]+)/giu, (match) => displayRef(match));
+}
+function snapshotVersionByRef(snapshot, ref) {
+    const requested = ref.trim();
+    const normalized = requested === "current" ? snapshot.refs.current ?? "" : requested;
+    if (!normalized) {
+        return undefined;
+    }
+    const candidates = snapshot.versions.filter((version) => snapshotVersionRefMatches(version, normalized));
+    if (candidates.length > 1) {
+        throw new WorkbenchCodedError("ref_ambiguous", `Version ref is ambiguous: ${ref}. Candidates: ${candidates.map((version) => displayRef(version.id)).join(", ")}.`, {
+            subject: { ref, candidates: candidates.map((version) => version.id) },
+            exitCode: 2,
+        });
+    }
+    return candidates[0];
+}
+function snapshotVersionRefMatches(version, ref) {
+    const withoutVersionPrefix = ref.startsWith("v_") ? ref.slice(2) : ref;
+    return version.id === ref ||
+        version.hash === ref ||
+        version.id.startsWith(ref) ||
+        version.hash.startsWith(ref) ||
+        version.hash.startsWith(withoutVersionPrefix) ||
+        version.id.startsWith(`v_${withoutVersionPrefix}`);
+}
+function snapshotObjectByRef(entries, ref, kind) {
+    const normalized = ref.trim();
+    if (!normalized) {
+        return undefined;
+    }
+    const candidates = entries.filter((entry) => objectRefMatches(entry.id, normalized));
+    if (candidates.length > 1) {
+        throw new WorkbenchCodedError("ref_ambiguous", `${capitalize(kind)} ref is ambiguous: ${ref}. Candidates: ${candidates.map((entry) => displayRef(entry.id)).slice(0, 8).join(", ")}.`, {
+            subject: { ref, candidates: candidates.map((entry) => entry.id).slice(0, 20) },
+            exitCode: 2,
+        });
+    }
+    return candidates[0];
+}
+function objectRefMatches(id, ref) {
+    if (id === ref || id.startsWith(ref)) {
+        return true;
+    }
+    const separator = id.indexOf("_");
+    return separator > 0 && id.slice(separator + 1).startsWith(ref);
+}
+function capitalize(value) {
+    return value.length > 0 ? `${value[0].toUpperCase()}${value.slice(1)}` : value;
+}
+function runOrJobEvidenceSelection(snapshot, ref) {
+    const run = snapshotObjectByRef(snapshot.runs, ref, "run");
+    const job = snapshotObjectByRef(snapshot.jobs, ref, "job");
+    if (run && job) {
+        throw new WorkbenchCodedError("ref_ambiguous", `Run/job ref is ambiguous: ${ref}. Candidates: ${displayRef(run.id)}, ${displayRef(job.id)}.`, {
+            subject: { ref, candidates: [run.id, job.id] },
+            exitCode: 2,
+        });
+    }
+    if (run) {
+        return {
+            run,
+            jobs: snapshot.jobs.filter((entry) => entry.runId === run.id),
+        };
+    }
+    return job ? { jobs: [job] } : { jobs: [] };
+}
+function evidenceFilesForRunOrJob(snapshot, ref) {
+    const selection = runOrJobEvidenceSelection(snapshot, ref);
+    if (!selection.run && selection.jobs.length === 0) {
+        return [];
+    }
+    const traceById = new Map(snapshot.traces.map((trace) => [trace.id, trace]));
+    const artifactById = new Map(snapshot.artifacts.map((artifact) => [artifact.id, artifact]));
+    const files = selection.jobs.flatMap((job) => [
+        ...job.traceIds.flatMap((traceId) => {
+            const trace = traceById.get(traceId);
+            return trace
+                ? trace.files.map((file) => evidenceFileWithPath(file, `cases/${evidencePathSegment(job.caseId)}/jobs/${evidencePathSegment(job.id)}/traces/${evidencePathSegment(trace.id)}/${file.path}`))
+                : [];
+        }),
+        ...job.artifactIds.flatMap((artifactId) => {
+            const artifact = artifactById.get(artifactId);
+            return artifact
+                ? artifact.files.map((file) => evidenceFileWithPath(file, `cases/${evidencePathSegment(job.caseId)}/jobs/${evidencePathSegment(job.id)}/artifacts/${evidencePathSegment(artifact.id)}/${file.path}`))
+                : [];
+        }),
+    ]);
+    const seen = new Set();
+    return files.filter((file) => {
+        if (seen.has(file.path)) {
+            return false;
+        }
+        seen.add(file.path);
+        return true;
+    });
+}
+function evidenceFileWithPath(file, filePath) {
+    return {
+        ...file,
+        path: filePath.replace(/\\/gu, "/").replace(/^\/+/u, ""),
+    };
+}
+function evidencePathSegment(value) {
+    return value.replace(/[^A-Za-z0-9._-]+/gu, "-") || "_";
+}
+function formatRunOrJobEvidence(details, files) {
+    const detailLines = details.map(formatTraceDetail).filter(Boolean);
+    const fileLines = files.length > 0 ? ["Files:", ...files.map((file) => file.path)] : [];
+    return [...detailLines, ...fileLines].join("\n") || "No evidence.";
+}
+function manifestOnly(value) {
+    if (value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value.map(manifestOnly);
+    }
+    if (!value || typeof value !== "object") {
+        return null;
+    }
+    const record = value;
+    if (typeof record.path === "string" && typeof record.content === "string") {
+        return fileSummary(record);
+    }
+    const out = {};
+    for (const [key, child] of Object.entries(record)) {
+        if (child === undefined) {
+            continue;
+        }
+        out[key] = manifestOnly(child);
+    }
+    return out;
+}
+async function resolveLocalImproverAgent(parsed, core) {
+    if (stringFlag(parsed, "agents")) {
+        return undefined;
+    }
+    const agents = await listWorkbenchAgents(core).catch(() => []);
+    const status = await workbenchStatusSnapshot(core).catch(() => undefined);
+    const defaultAgentName = status?.project.defaultAgent ?? agents[0]?.name;
+    const defaultAgent = agents.find((agent) => agent.name === defaultAgentName);
+    if (defaultAgent && workbenchSkillImproveCanUseQueuedAdapter(defaultAgent)) {
+        return undefined;
+    }
+    const connected = await localWorkbenchAdapterAuthStore(adapterAuthStoreRoot()).listStatus().catch(() => []);
+    const candidates = connected
+        .filter((entry) => entry.status === "connected" &&
+        (entry.adapterId === "claude" || entry.adapterId === "codex"))
+        .sort((left, right) => {
+        const adapterRank = (adapter) => adapter === "claude" ? 0 : adapter === "codex" ? 1 : 2;
+        return adapterRank(left.adapterId) - adapterRank(right.adapterId) ||
+            (Date.parse(right.updatedAt ?? "") || 0) - (Date.parse(left.updatedAt ?? "") || 0);
+    });
+    const selected = candidates[0];
+    if (!selected) {
+        throw new WorkbenchCodedError("auth_required", "workbench improve needs a connected improver.", {
+            remediation: "Run workbench login claude (or codex) to connect an improver.",
+            exitCode: 1,
+        });
+    }
+    return {
+        name: selected.adapterId,
+        adapter: selected.adapterId,
+        config: {
+            auth: selected.slot ? { [selected.slot]: selected.profile } : selected.profile,
+        },
+    };
+}
+function formatLogEntry(entry) {
+    if (entry.kind === "version") {
+        return `${entry.createdAt}\tversion\t${displayRef(entry.id)}\tfiles=${entry.fileCount}\t${entry.message}`;
+    }
+    const score = entry.score === undefined ? "n/a" : entry.score.toFixed(3);
+    return `${entry.createdAt}\trun\t${displayRef(entry.id)}\t${entry.status}\tversion=${displayRef(entry.versionId)}\tskill=${entry.skillName}\tagent=${entry.agentName}\tscore=${score}`;
+}
+function splitShowRef(ref) {
+    const index = ref.indexOf(":");
+    if (index === -1) {
+        return [ref, null];
+    }
+    return [ref.slice(0, index), ref.slice(index + 1)];
+}
+async function fileForRunOrJobRef(core, objectRef, requestedPath) {
+    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(core);
+    const selection = runOrJobEvidenceSelection(snapshot, objectRef);
+    if (!selection.run && selection.jobs.length === 0) {
+        return null;
+    }
+    const files = evidenceFilesForRunOrJob(snapshot, objectRef);
+    const file = findShowFile(files, requestedPath, objectRef);
+    if (file) {
+        return file;
+    }
+    throw new WorkbenchCodedError("ref_not_found", `File not found in ${objectRef}: ${requestedPath}`, {
+        remediation: `Run workbench show ${objectRef}.`,
+        subject: { ref: objectRef, path: requestedPath },
+        exitCode: 1,
+    });
+}
+function evidenceDetailsForRunOrJob(snapshot, ref) {
+    const selection = runOrJobEvidenceSelection(snapshot, ref);
+    return selection.jobs.flatMap((entry) => {
+        const detail = workbenchJobEvidenceForSnapshot(snapshot, {
+            runId: entry.runId,
+            jobId: entry.id,
+        });
+        return detail ? [detail] : [];
+    }).filter((detail) => detail.executions.some((execution) => execution.sessions.length > 0 ||
+        execution.trace.spans.length > 0 ||
+        execution.trace.events.length > 0 ||
+        execution.trace.summaries.length > 0));
+}
+function findShowFile(files, requestedPath, objectRef) {
+    const normalized = requestedPath.replace(/\\/gu, "/");
+    const exact = files.filter((file) => file.path === normalized);
+    if (exact.length === 1) {
+        return exact[0];
+    }
+    const exactEquivalent = singleEquivalentShowFile(exact);
+    if (exactEquivalent) {
+        return exactEquivalent;
+    }
+    if (exact.length > 1) {
+        throw ambiguousShowPath(objectRef, requestedPath, exact);
+    }
+    const suffixCandidates = files.filter((file) => file.path.endsWith(`/${normalized}`) || path.basename(file.path) === normalized);
+    if (suffixCandidates.length === 0) {
+        return null;
+    }
+    const candidates = normalized === "stderr.log"
+        ? suffixCandidates.filter((file) => file.content.length > 0)
+        : suffixCandidates;
+    if (candidates.length === 1) {
+        return candidates[0];
+    }
+    const equivalentCandidate = singleEquivalentShowFile(candidates);
+    if (equivalentCandidate) {
+        return equivalentCandidate;
+    }
+    if (candidates.length === 0 && suffixCandidates.length === 1) {
+        return suffixCandidates[0];
+    }
+    const equivalentSuffixCandidate = singleEquivalentShowFile(suffixCandidates);
+    if (equivalentSuffixCandidate) {
+        return equivalentSuffixCandidate;
+    }
+    throw ambiguousShowPath(objectRef, requestedPath, candidates.length > 0 ? candidates : suffixCandidates);
+}
+function singleEquivalentShowFile(files) {
+    if (files.length <= 1) {
+        return null;
+    }
+    const first = files[0];
+    return files.every((file) => file.kind === first.kind && file.encoding === first.encoding && file.content === first.content)
+        ? first
+        : null;
+}
+function ambiguousShowPath(objectRef, requestedPath, candidates) {
+    const candidatePaths = candidates.map((file) => file.path);
+    return new WorkbenchCodedError("ref_ambiguous", `File path is ambiguous in ${objectRef}: ${requestedPath}. Candidates: ${candidatePaths.join(", ")}.`, {
+        remediation: `Run workbench show ${objectRef}.`,
+        subject: { ref: objectRef, path: requestedPath, candidates: candidatePaths },
+        exitCode: 2,
+    });
+}
+function fileListing(kind, id, files) {
+    return {
+        kind,
+        id,
+        fileCount: files.length,
+        files: files.map(fileSummary),
+    };
+}
+function formatFileListing(kind, id, files) {
+    return [`${kind}\t${displayRef(id)}\tfiles=${files.length}`, ...files.map((file) => file.path)].join("\n");
+}
+async function traceIdForCaseSource(core, ref) {
+    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(core);
+    const trace = snapshotObjectByRef(snapshot.traces, ref, "trace");
+    if (trace) {
+        return trace.id;
+    }
+    const selection = runOrJobEvidenceSelection(snapshot, ref);
+    const traceId = selection.run?.traceIds[0] ?? selection.jobs[0]?.traceIds[0];
+    if (traceId) {
+        return traceId;
+    }
+    throw new WorkbenchCodedError("ref_not_found", `Run, job, or trace not found: ${ref}`, {
+        remediation: "Run workbench log, then workbench case add RUN_ID.",
+        subject: { ref },
+        exitCode: 1,
+    });
+}
+async function evalDeltas(core, runs) {
+    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(core);
+    return runs.map((run) => {
+        const previous = snapshot.runs
+            .filter((candidate) => candidate.id !== run.id &&
+            candidate.skillName === run.skillName &&
+            candidate.agentName === run.agentName &&
+            typeof candidate.score === "number" &&
+            candidate.createdAt < run.createdAt)
+            .sort((left, right) => right.createdAt.localeCompare(left.createdAt))[0];
+        return {
+            runId: run.id,
+            versionId: run.versionId,
+            skillName: run.skillName,
+            agentName: run.agentName,
+            ...(run.score !== undefined ? { score: run.score } : {}),
+            ...(previous?.score !== undefined ? { previousScore: previous.score } : {}),
+            ...(run.score !== undefined && previous?.score !== undefined ? { delta: run.score - previous.score } : {}),
+        };
+    });
+}
+function formatEvalDelta(delta) {
+    if (delta.score === undefined) {
+        return "";
+    }
+    const score = delta.score.toFixed(3);
+    if (delta.previousScore === undefined || delta.delta === undefined) {
+        return `${delta.skillName} ${displayRef(delta.versionId)} ${score}`;
+    }
+    const sign = delta.delta >= 0 ? "+" : "";
+    return `${delta.skillName} ${displayRef(delta.versionId)} ${score} (was ${delta.previousScore.toFixed(3)}, ${sign}${delta.delta.toFixed(3)})`;
+}
+async function evalSuccessNextCommand(core, runs) {
+    if (runs.length === 0) {
+        return "workbench eval";
+    }
+    if (!runs.some((run) => typeof run.score === "number")) {
+        return "edit .workbench/cases, then run workbench eval";
+    }
+    const snapshot = await createWorkbenchReadOnlyInspectionSnapshot(core);
+    const currentVersion = snapshotVersionByRef(snapshot, snapshot.status.currentVersionId ?? snapshot.refs.current ?? "");
+    const caseFiles = currentVersion?.files.filter((file) => file.kind === "text" &&
+        /^\.workbench\/cases\/[^/]+\/case\.ya?ml$/u.test(file.path)) ?? [];
+    const hasWorkflowCase = caseFiles.some((file) => file.kind === "text" && !/\n\s*smoke:\s*true(?:\s|$)/u.test(`\n${file.content}`));
+    return hasWorkflowCase ? "workbench publish" : "edit .workbench/cases, then run workbench eval";
+}
 function formatStatusSnapshot(status) {
     const lines = [
         `Root: ${status.project.root}`,
         `Initialized: ${status.project.initialized ? "yes" : "no"}`,
-        ...(status.project.currentVersionId ? [`Current version: ${status.project.currentVersionId}`] : []),
+        ...(status.project.currentVersionId ? [`Current version: ${displayRef(status.project.currentVersionId)}`] : []),
         ...(status.project.defaultSkill ? [`Default skill: ${status.project.defaultSkill}`] : []),
         ...(status.project.defaultAgent ? [`Default agent: ${status.project.defaultAgent}`] : []),
         `Runs: ${status.runs.total}${status.runs.lastStatus ? ` (last ${status.runs.lastStatus})` : ""}`,
@@ -2130,7 +2891,7 @@ function formatStatusSnapshot(status) {
                     ? [
                         "publication=published",
                         remote.publication.visibility ? `visibility=${remote.publication.visibility}` : undefined,
-                        remote.publication.versionId ? `version=${remote.publication.versionId}` : undefined,
+                        remote.publication.versionId ? `version=${displayRef(remote.publication.versionId)}` : undefined,
                         remote.publication.installUrl ? `install=${remote.publication.installUrl}` : undefined,
                         remote.publication.pinnedInstallUrl ? `pinned=${remote.publication.pinnedInstallUrl}` : undefined,
                     ].filter(Boolean).join("\t")
@@ -2141,49 +2902,16 @@ function formatStatusSnapshot(status) {
                         ? [
                             `    error[${remote.sync.lastError.code}]: ${remote.sync.lastError.message}`,
                             ...(remote.sync.lastAttemptAt ? [`    last attempt: ${remote.sync.lastAttemptAt}`] : []),
-                            ...(remote.sync.nextCommand ? [`    next: ${remote.sync.nextCommand}`] : []),
                         ]
                         : []),
                 ];
             })] : ["Remotes: none"]),
-        ...(status.next.length > 0 ? ["Next:", ...status.next.map((command) => `  ${command}`)] : []),
+        ...(status.next ? [`next: ${shortenCommandRefs(status.next)}`] : []),
     ];
     return lines.join("\n");
 }
-function formatCheck(result) {
-    return [
-        "Workbench skill is valid.",
-        `Cases: ${result.cases} (${result.plan.source.smokeCaseCount} smoke)`,
-        `Skills: ${result.skills}`,
-        `Agents: ${result.agents}`,
-        `Skill files: ${result.plan.source.skillFiles}`,
-        `Eval files: ${result.plan.source.evalFiles}`,
-        "",
-        "Skill plan:",
-        ...result.plan.skills.map((skill) => [
-            skill.name,
-            `bundle=${skill.bundleHash.slice(0, 12)}`,
-            `files=${skill.fileCount}`,
-            `includes=${skill.includedSkillCount}`,
-        ].join("\t")),
-        "",
-        "Agent plan:",
-        ...result.plan.agents.map((agent) => [
-            agent.name,
-            agent.adapter,
-            agent.model,
-            agent.providerBacked ? "provider-eval" : "local-eval",
-            `network=${agent.network.egress}`,
-            `cpu=${agent.resources.cpu}`,
-            `memoryGb=${agent.resources.memoryGb}`,
-            `timeout=${agent.resources.timeoutMinutes}m`,
-            `image=${agent.image}`,
-            agent.auth ? `auth=${agent.auth}` : undefined,
-        ].filter(Boolean).join("\t")),
-    ].join("\n");
-}
 function formatVersion(version) {
-    return `${version.id}\t${version.hash.slice(0, 12)}\t${version.message}`;
+    return `${displayRef(version.id)}\t${version.hash.slice(0, 12)}\t${version.message}`;
 }
 function versionSummary(version) {
     return {
@@ -2201,11 +2929,11 @@ function formatAgent(agent) {
 function formatRun(run) {
     const score = run.score === undefined ? "n/a" : run.score.toFixed(3);
     const latency = run.latencyMs === undefined ? "n/a" : `${run.latencyMs}ms`;
-    return `${run.id}\t${run.kind}\t${run.status}\tversion=${run.versionId}\tskill=${run.skillName}\tagent=${run.agentName}\tscore=${score}\tlatency=${latency}`;
+    return `${displayRef(run.id)}\t${run.kind}\t${run.status}\tversion=${displayRef(run.versionId)}\tskill=${run.skillName}\tagent=${run.agentName}\tscore=${score}\tlatency=${latency}`;
 }
 function formatImproveResult(result) {
     return [
-        `Improved ${result.version.parentIds[0] ?? "current"} -> ${result.version.id}. ${formatRun(result.run)}`,
+        `Improved ${result.version.parentIds[0] ? displayRef(result.version.parentIds[0]) : "current"} -> ${displayRef(result.version.id)}. ${formatRun(result.run)}`,
         result.switched
             ? "Switched to improved version."
             : `Did not switch: ${result.promotionReason}`,
@@ -2214,26 +2942,26 @@ function formatImproveResult(result) {
 function formatJob(job) {
     const score = job.score === undefined ? "n/a" : job.score.toFixed(3);
     const duration = job.durationMs === undefined ? "n/a" : `${job.durationMs}ms`;
-    return `${job.id}\trun=${job.runId}\tcase=${job.caseId}\tsample=${job.sample}\t${job.status}\tscore=${score}\tduration=${duration}`;
+    return `${displayRef(job.id)}\trun=${displayRef(job.runId)}\tcase=${job.caseId}\tsample=${job.sample}\t${job.status}\tscore=${score}\tduration=${duration}`;
 }
 function formatComparison(comparison) {
     const lines = ["version\tskill\tagent\tstatus\tscore\tcost\tlatency\trun"];
     for (const cell of comparison.cells) {
         lines.push([
-            cell.versionId,
+            displayRef(cell.versionId),
             cell.skillName,
             `${cell.agentName}@${shortObjectId(cell.agentHash)}`,
             cell.status ?? "not-run",
             cell.score === undefined ? "n/a" : cell.score.toFixed(3),
             cell.costUsd === undefined ? "n/a" : `$${cell.costUsd.toFixed(4)}`,
             cell.latencyMs === undefined ? "n/a" : `${cell.latencyMs}ms`,
-            cell.runId ?? "n/a",
+            cell.runId ? displayRef(cell.runId) : "n/a",
         ].join("\t"));
     }
     return lines.join("\n");
 }
 function shortObjectId(id) {
-    return id.length > 12 ? id.slice(0, 12) : id;
+    return id.length > 8 ? id.slice(0, 8) : id;
 }
 function formatTrace(trace) {
     const result = asRecord(trace.result);
@@ -2242,7 +2970,7 @@ function formatTrace(trace) {
     const error = typeof result?.error === "string" ? result.error.split(/\r?\n/u)[0] : undefined;
     const files = trace.files.slice(0, 5).map((file) => file.path).join(",");
     return [
-        `${trace.id}\trun=${trace.runId}\tjob=${trace.jobId ?? "n/a"}\tversion=${trace.versionId}\tskill=${trace.skillName}\tagent=${trace.agentName}`,
+        `${displayRef(trace.id)}\trun=${displayRef(trace.runId)}\tjob=${trace.jobId ? displayRef(trace.jobId) : "n/a"}\tversion=${displayRef(trace.versionId)}\tskill=${trace.skillName}\tagent=${trace.agentName}`,
         status ? `status=${status}` : undefined,
         score ? `score=${score}` : undefined,
         error ? `error=${error}` : undefined,
@@ -2270,7 +2998,7 @@ function formatTraceDetail(detail) {
     return detail.executions.map((execution) => {
         const sessionLabels = execution.sessions.map((session) => session.label).join(",");
         return [
-            `${execution.id}\trun=${detail.runId}\tjobs=${execution.jobIds.join(",")}\tstatus=${execution.status}`,
+            `${execution.id}\trun=${displayRef(detail.runId)}\tjobs=${execution.jobIds.map(displayRef).join(",")}\tstatus=${execution.status}`,
             `events=${execution.trace.events.length}`,
             `spans=${execution.trace.spans.length}`,
             `summaries=${execution.trace.summaries.length}`,
@@ -2279,7 +3007,7 @@ function formatTraceDetail(detail) {
     }).join("\n");
 }
 function formatArtifact(artifact) {
-    return `${artifact.id}\trun=${artifact.runId}\tjob=${artifact.jobId}\t${artifact.kind}\tfiles=${artifact.files.length}`;
+    return `${displayRef(artifact.id)}\trun=${displayRef(artifact.runId)}\tjob=${displayRef(artifact.jobId)}\t${artifact.kind}\tfiles=${artifact.files.length}`;
 }
 function artifactSummary(artifact) {
     return {