clickup-agent-cli 0.2.1 → 0.4.0

package/dist/clickup.js

@@ -31,23 +31,24 @@ function parseApiError(responseBody, status) {
 }
 function mapToExitCode(error) {
   if (!(error instanceof ClickUpError)) {
-    return 1;
+    return EXIT_CODES.GENERAL_ERROR;
   }
   switch (error.status) {
+    case 0:
+      return EXIT_CODES.NETWORK_ERROR;
     case 401:
-      return 3;
+      return EXIT_CODES.AUTH_FAILURE;
     case 403:
-      return 5;
+      return EXIT_CODES.PERMISSION_DENIED;
     case 404:
-      return 4;
+      return EXIT_CODES.NOT_FOUND;
     case 429:
-      return 6;
+      return EXIT_CODES.RATE_LIMITED;
     default:
-      if (error.status >= 500) return 1;
-      return 1;
+      return EXIT_CODES.GENERAL_ERROR;
   }
 }
-var ClickUpError, ECODE_MESSAGES, STATUS_MESSAGES, EXIT_CODES;
+var ClickUpError, ECODE_MESSAGES, STATUS_MESSAGES, EXIT_CODES, DryRunComplete;
 var init_errors = __esm({
   "src/errors.ts"() {
     "use strict";
@@ -85,6 +86,12 @@ var init_errors = __esm({
       RATE_LIMITED: 6,
       NETWORK_ERROR: 7
     };
+    DryRunComplete = class extends Error {
+      constructor() {
+        super("Dry run complete");
+        this.name = "DryRunComplete";
+      }
+    };
   }
 });
 
@@ -140,6 +147,41 @@ var init_client = __esm({
       async delete(path, body) {
         return this.request("DELETE", path, body);
       }
+      async downloadUrl(url) {
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), this.timeout);
+        const headers = {};
+        try {
+          const { hostname } = new URL(url);
+          if (hostname === "clickup.com" || hostname.endsWith(".clickup.com")) {
+            headers["Authorization"] = this.token;
+          }
+        } catch {
+          clearTimeout(timeoutId);
+          throw new ClickUpError(`Invalid download URL: ${url}`, 0, void 0, void 0);
+        }
+        try {
+          const response = await fetch(url, {
+            headers,
+            signal: controller.signal
+          });
+          clearTimeout(timeoutId);
+          if (!response.ok) {
+            const body = await this.safeJson(response);
+            throw parseApiError(body, response.status);
+          }
+          return response.arrayBuffer();
+        } catch (error) {
+          clearTimeout(timeoutId);
+          if (error instanceof ClickUpError) throw error;
+          throw new ClickUpError(
+            `Network error: ${error instanceof Error ? error.message : "Unknown error"}`,
+            0,
+            void 0,
+            void 0
+          );
+        }
+      }
       async upload(path, filePath, filename) {
         const fileBuffer = readFileSync(filePath);
         const resolvedFilename = filename ?? basename(filePath);
@@ -148,7 +190,7 @@ var init_client = __esm({
         const url = `${this.baseUrl}${path}`;
         if (this.dryRun) {
           this.logDryRun("POST", url, "[multipart form data]");
-          return {};
+          throw new DryRunComplete();
         }
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), this.timeout);
@@ -193,7 +235,7 @@ var init_client = __esm({
         }
         if (this.dryRun) {
           this.logDryRun(method, url, body);
-          return {};
+          throw new DryRunComplete();
         }
         let lastError;
         for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
@@ -240,17 +282,6 @@ Headers: ${JSON.stringify(redactedHeaders)}
               process.stderr.write(`[${method}] ${path} ${response.status} ${response.statusText} (${elapsed}ms)
 `);
             }
-            const remaining = response.headers.get("X-RateLimit-Remaining");
-            const reset = response.headers.get("X-RateLimit-Reset");
-            if (remaining === "0" && reset) {
-              const resetTime = parseInt(reset, 10) * 1e3;
-              const waitMs = Math.max(0, resetTime - Date.now());
-              if (waitMs > 0) {
-                process.stderr.write(`Rate limited. Waiting ${Math.ceil(waitMs / 1e3)}s...
-`);
-                await this.sleep(waitMs);
-              }
-            }
             if (!response.ok) {
               const responseBody = await this.safeJson(response);
               const error = parseApiError(responseBody, response.status);
@@ -262,6 +293,18 @@ Headers: ${JSON.stringify(redactedHeaders)}
                 throw error;
               }
               if (RETRYABLE_STATUSES.has(response.status) && attempt < this.maxRetries) {
+                if (response.status === 429) {
+                  const reset = response.headers.get("X-RateLimit-Reset");
+                  if (reset) {
+                    const resetTime = parseInt(reset, 10) * 1e3;
+                    const waitMs = Math.min(Math.max(0, resetTime - Date.now()), 6e4);
+                    if (waitMs > 0) {
+                      process.stderr.write(`Rate limited. Waiting ${Math.ceil(waitMs / 1e3)}s...
+`);
+                      await this.sleep(waitMs);
+                    }
+                  }
+                }
                 lastError = error;
                 continue;
               }
@@ -321,61 +364,152 @@ Headers: ${JSON.stringify(redactedHeaders)}
         }
       }
       sleep(ms) {
-        return new Promise((resolve) => setTimeout(resolve, ms));
+        return new Promise((resolve2) => setTimeout(resolve2, ms));
       }
     };
   }
 });
 
 // src/config.ts
+import { readFileSync as readFileSync2, chmodSync, existsSync } from "fs";
 import Conf from "conf";
 function isValidConfigKey(key) {
-  return CONFIG_KEYS.includes(key);
-}
-function resolveString(key, flagValue) {
-  if (flagValue !== void 0) return flagValue;
-  const envVal = process.env[ENV_MAP[key]];
-  if (envVal !== void 0) return envVal;
-  const stored = config.get(key);
-  if (typeof stored === "string") return stored;
-  return void 0;
+  return ALL_CONFIG_KEYS.includes(key);
+}
+function hardenConfigFile() {
+  try {
+    if (existsSync(config.path)) chmodSync(config.path, 384);
+  } catch {
+  }
+}
+function setProfileOverride(nameOrKey) {
+  _profileOverride = nameOrKey ? findProfileKey(nameOrKey) : void 0;
+}
+function getActiveProfileKey() {
+  if (_profileOverride) return _profileOverride;
+  const active = config.get("active_profile");
+  return active ?? "default";
+}
+function getProfiles() {
+  const stored = config.get("profiles");
+  return stored ?? {};
+}
+function getProfile(key) {
+  return getProfiles()[key];
+}
+function setProfile(key, profile) {
+  const profiles = getProfiles();
+  profiles[key] = profile;
+  config.set("profiles", profiles);
+  hardenConfigFile();
+}
+function deleteProfile(key) {
+  const profiles = getProfiles();
+  delete profiles[key];
+  config.set("profiles", profiles);
+}
+function slugifyWorkspaceName(name) {
+  return name.toLowerCase().replace(/'/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function findProfileKey(nameOrKey) {
+  const profiles = getProfiles();
+  if (profiles[nameOrKey] !== void 0) return nameOrKey;
+  const lower = nameOrKey.toLowerCase();
+  for (const [key, profile] of Object.entries(profiles)) {
+    if (profile.workspace_name?.toLowerCase() === lower) return key;
+    if (profile.nickname?.toLowerCase() === lower) return key;
+  }
+  for (const [key, profile] of Object.entries(profiles)) {
+    if (profile.workspace_name?.toLowerCase().includes(lower)) return key;
+    if (profile.nickname?.toLowerCase().includes(lower)) return key;
+  }
+  return nameOrKey;
+}
+function migrateConfig() {
+  const legacyToken = config.get("token");
+  const legacyWorkspaceId = config.get("workspace_id");
+  if (!legacyToken && !legacyWorkspaceId) return;
+  const profiles = getProfiles();
+  if (!profiles["default"]) {
+    const defaultProfile = {};
+    if (legacyToken) defaultProfile.token = legacyToken;
+    if (legacyWorkspaceId) defaultProfile.workspace_id = legacyWorkspaceId;
+    setProfile("default", defaultProfile);
+    config.delete("token");
+    config.delete("workspace_id");
+  }
 }
-function resolveToken(flagValue) {
-  return resolveString("token", flagValue);
+function resolveToken(flagValue, tokenFilePath) {
+  if (flagValue) return flagValue;
+  if (tokenFilePath) {
+    let content;
+    try {
+      content = readFileSync2(tokenFilePath, "utf8").trim();
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      throw new Error(`Cannot read token file "${tokenFilePath}": ${reason}`);
+    }
+    if (!content) {
+      throw new Error(`Token file "${tokenFilePath}" is empty`);
+    }
+    return content;
+  }
+  const envVal = process.env["CLICKUP_API_TOKEN"];
+  if (envVal) return envVal;
+  const profileKey = getActiveProfileKey();
+  const profiles = getProfiles();
+  const activeProfile = profiles[profileKey];
+  if (activeProfile?.token) return activeProfile.token;
+  const legacyToken = config.get("token");
+  if (legacyToken) return legacyToken;
+  return void 0;
 }
 function resolveWorkspaceId(flagValue) {
-  return resolveString("workspace_id", flagValue);
+  if (flagValue) return flagValue;
+  const envVal = process.env["CLICKUP_WORKSPACE_ID"];
+  if (envVal) return envVal;
+  const profileKey = getActiveProfileKey();
+  const profiles = getProfiles();
+  const activeProfile = profiles[profileKey];
+  if (activeProfile?.workspace_id) return activeProfile.workspace_id;
+  const withWorkspace = Object.values(profiles).filter((p) => p.workspace_id);
+  if (withWorkspace.length === 1) return withWorkspace[0].workspace_id;
+  const legacyId = config.get("workspace_id");
+  if (legacyId) return legacyId;
+  return void 0;
 }
 function resolveOutputFormat(flagValue) {
-  const val = resolveString("output_format", flagValue);
-  if (val) return val;
+  if (flagValue) return flagValue;
+  const envVal = process.env["CLICKUP_OUTPUT_FORMAT"];
+  if (envVal) return envVal;
+  const stored = config.get("output_format");
+  if (stored) return stored;
   return process.stdout.isTTY ? "table" : "json";
 }
-var CONFIG_KEYS, VALID_CONFIG_KEYS, config, ENV_MAP;
+var ALL_CONFIG_KEYS, VALID_CONFIG_KEYS, config, _profileOverride;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
-    CONFIG_KEYS = ["token", "workspace_id", "output_format", "color", "page_size", "timezone"];
-    VALID_CONFIG_KEYS = CONFIG_KEYS;
+    ALL_CONFIG_KEYS = ["token", "workspace_id", "output_format", "color", "page_size", "timezone", "active_profile"];
+    VALID_CONFIG_KEYS = ALL_CONFIG_KEYS;
     config = new Conf({
       projectName: "clickup-cli",
       schema: {
         token: { type: "string" },
         workspace_id: { type: "string" },
-        output_format: { type: "string", enum: ["table", "json", "csv", "tsv", "quiet", "id"] },
+        output_format: { type: "string", enum: ["table", "json", "csv", "tsv", "quiet", "id", "md"] },
         color: { type: "boolean", default: true },
         page_size: { type: "number", default: 100 },
-        timezone: { type: "string" }
+        timezone: { type: "string" },
+        active_profile: { type: "string" },
+        profiles: { type: "object" }
       }
     });
-    ENV_MAP = {
-      token: "CLICKUP_API_TOKEN",
-      workspace_id: "CLICKUP_WORKSPACE_ID",
-      output_format: "CLICKUP_OUTPUT_FORMAT",
-      color: "CLICKUP_COLOR",
-      page_size: "CLICKUP_PAGE_SIZE",
-      timezone: "CLICKUP_TIMEZONE"
-    };
+    hardenConfigFile();
+    try {
+      migrateConfig();
+    } catch {
+    }
   }
 });
 
@@ -387,22 +521,29 @@ __export(auth_exports, {
   oauthLogin: () => oauthLogin
 });
 import { createServer } from "http";
-import { randomBytes, createHash } from "crypto";
+import { randomBytes, createHash, timingSafeEqual } from "crypto";
 function generateCodeVerifier() {
   return randomBytes(48).toString("base64url");
 }
 function generateCodeChallenge(verifier) {
   return createHash("sha256").update(verifier).digest("base64url");
 }
-function buildAuthorizeUrl(clientId, codeChallenge) {
+function buildAuthorizeUrl(clientId, codeChallenge, state) {
   const params = new URLSearchParams({
     client_id: clientId,
     redirect_uri: REDIRECT_URI,
     code_challenge: codeChallenge,
-    code_challenge_method: "S256"
+    code_challenge_method: "S256",
+    state
   });
   return `${CLICKUP_AUTHORIZE_URL}?${params.toString()}`;
 }
+function statesMatch(expected, received) {
+  const a = Buffer.from(expected);
+  const b = Buffer.from(received);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
 async function exchangeCodeForToken(code, clientId, clientSecret, codeVerifier) {
   const response = await fetch(CLICKUP_TOKEN_URL, {
     method: "POST",
@@ -425,8 +566,8 @@ async function exchangeCodeForToken(code, clientId, clientSecret, codeVerifier)
   }
   return token;
 }
-function waitForCallback(server) {
-  return new Promise((resolve, reject) => {
+function waitForCallback(server, expectedState) {
+  return new Promise((resolve2, reject) => {
     const timeout = setTimeout(() => {
       server.close();
       reject(new Error("OAuth callback timed out after 120 seconds"));
@@ -440,6 +581,7 @@ function waitForCallback(server) {
       }
       const code = url.searchParams.get("code");
       const error = url.searchParams.get("error");
+      const state = url.searchParams.get("state");
       if (error) {
         res.writeHead(200, { "Content-Type": "text/html" });
         res.end("<html><body><h1>Authentication failed</h1><p>You can close this tab.</p></body></html>");
@@ -448,6 +590,11 @@ function waitForCallback(server) {
         reject(new Error(`OAuth error: ${error}`));
         return;
       }
+      if (!state || !statesMatch(expectedState, state)) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end("<html><body><h1>Invalid request</h1><p>State mismatch. Please retry the login.</p></body></html>");
+        return;
+      }
       if (!code) {
         res.writeHead(400, { "Content-Type": "text/html" });
         res.end("<html><body><h1>Missing code</h1><p>No authorization code received.</p></body></html>");
@@ -457,24 +604,28 @@ function waitForCallback(server) {
       res.end("<html><body><h1>Authenticated</h1><p>You can close this tab and return to the terminal.</p></body></html>");
       clearTimeout(timeout);
       server.close();
-      resolve(code);
+      resolve2(code);
     });
   });
 }
 async function openBrowser(url) {
   const { platform } = process;
+  const { execFile } = await import("child_process");
   let command;
+  let args;
   if (platform === "darwin") {
     command = "open";
+    args = [url];
   } else if (platform === "win32") {
-    command = "start";
+    command = "cmd";
+    args = ["/c", "start", "", url];
   } else {
     command = "xdg-open";
+    args = [url];
   }
-  const { exec } = await import("child_process");
-  return new Promise((resolve) => {
-    exec(`${command} "${url}"`, () => {
-      resolve();
+  return new Promise((resolve2) => {
+    execFile(command, args, () => {
+      resolve2();
     });
   });
 }
@@ -493,22 +644,24 @@ async function oauthLogin() {
   }
   const codeVerifier = generateCodeVerifier();
   const codeChallenge = generateCodeChallenge(codeVerifier);
+  const state = randomBytes(24).toString("base64url");
   const server = createServer();
-  await new Promise((resolve, reject) => {
-    server.listen(CALLBACK_PORT, () => resolve());
+  await new Promise((resolve2, reject) => {
+    server.listen(CALLBACK_PORT, "127.0.0.1", () => resolve2());
     server.on("error", reject);
   });
-  const authorizeUrl = buildAuthorizeUrl(clientId, codeChallenge);
+  const authorizeUrl = buildAuthorizeUrl(clientId, codeChallenge, state);
   process.stderr.write(`Opening browser for authentication...
 `);
   process.stderr.write(`If the browser does not open, visit:
 ${authorizeUrl}
 `);
   await openBrowser(authorizeUrl);
-  const code = await waitForCallback(server);
+  const code = await waitForCallback(server, state);
   process.stderr.write("Exchanging code for token...\n");
   const token = await exchangeCodeForToken(code, clientId, clientSecret, codeVerifier);
-  config.set("token", token);
+  const profileKey = getActiveProfileKey();
+  setProfile(profileKey, { ...getProfile(profileKey), token });
   return token;
 }
 var CLICKUP_AUTHORIZE_URL, CLICKUP_TOKEN_URL, CALLBACK_PORT, CALLBACK_PATH, REDIRECT_URI;
@@ -528,13 +681,14 @@ var init_auth = __esm({
 init_client();
 init_errors();
 init_config();
-import { Command } from "commander";
+import { Command, Option } from "commander";
 
 // src/commands/auth-cmd.ts
 init_config();
+import { readFileSync as readFileSync3 } from "fs";
 function registerAuthCommands(program, getClient) {
   const auth = program.command("auth").description("Manage authentication");
-  auth.command("login").description("Authenticate with ClickUp").option("--token <token>", "Personal API token").option("--oauth", "Use OAuth2 PKCE browser flow (requires CLICKUP_CLIENT_ID and CLICKUP_CLIENT_SECRET)").action(async (opts) => {
+  auth.command("login").description("Authenticate with ClickUp").option("--token <token>", "Personal API token").option("--token-file <path>", "Read token from this file path").option("--oauth", "Use OAuth2 PKCE browser flow (requires CLICKUP_CLIENT_ID and CLICKUP_CLIENT_SECRET)").action(async (opts) => {
     if (opts.oauth) {
       const { oauthLogin: oauthLogin2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
       const token2 = await oauthLogin2();
@@ -550,9 +704,19 @@ function registerAuthCommands(program, getClient) {
       return;
     }
     let token = opts.token;
+    if (!token && opts.tokenFile) {
+      try {
+        token = readFileSync3(opts.tokenFile, "utf8").trim();
+      } catch {
+        process.stderr.write(`Error: Could not read token file: ${opts.tokenFile}
+`);
+        process.exit(2);
+        return;
+      }
+    }
     if (!token) {
       if (!process.stdin.isTTY) {
-        process.stderr.write("Error: No token provided. Use --token <token> or --oauth in non-interactive mode.\n");
+        process.stderr.write("Error: No token provided. Use --token <token>, --token-file <path>, or --oauth in non-interactive mode.\n");
         process.exit(2);
         return;
       }
@@ -571,15 +735,29 @@ function registerAuthCommands(program, getClient) {
     const client = new ClientClass({ token });
     try {
       const userData = await client.get("/user");
-      config.set("token", token);
+      const profileKey = getActiveProfileKey();
+      const profiles = getProfiles();
+      const existing = profiles[profileKey] ?? {};
+      setProfile(profileKey, { ...existing, token });
       process.stdout.write(`Authenticated as ${userData.user.username} (${userData.user.email})
 `);
+      const profile = getProfiles()[profileKey];
+      if (!profile?.workspace_id) {
+        process.stdout.write("Run: clickup workspace setup -- to configure your workspace.\n");
+      }
     } catch {
       process.stderr.write("Error: Invalid token. Authentication failed.\n");
       process.exit(3);
     }
   });
   auth.command("logout").description("Remove stored credentials").action(() => {
+    const profileKey = getActiveProfileKey();
+    const profiles = getProfiles();
+    const existing = profiles[profileKey];
+    if (existing) {
+      const { token: _removed, ...profileWithoutToken } = existing;
+      setProfile(profileKey, profileWithoutToken);
+    }
     config.delete("token");
     process.stdout.write("Logged out. Token removed.\n");
   });
@@ -592,9 +770,17 @@ function registerAuthCommands(program, getClient) {
     const prefix = token.slice(0, 8);
     process.stdout.write(`Token: ${prefix}...
 `);
-    const workspaceId = config.get("workspace_id");
-    if (workspaceId) {
-      process.stdout.write(`Workspace: ${workspaceId}
+    const profileKey = getActiveProfileKey();
+    process.stdout.write(`Profile: ${profileKey}
+`);
+    const profiles = getProfiles();
+    const activeProfile = profiles[profileKey];
+    if (activeProfile?.workspace_id) {
+      process.stdout.write(`Workspace: ${activeProfile.workspace_name ?? activeProfile.workspace_id}
+`);
+    } else {
+      const legacyId = config.get("workspace_id");
+      if (legacyId) process.stdout.write(`Workspace: ${legacyId}
 `);
     }
     try {
@@ -620,7 +806,7 @@ function registerAuthCommands(program, getClient) {
 
 // src/commands/config-cmd.ts
 init_config();
-function registerConfigCommands(program) {
+function registerConfigCommands(program, getClient) {
   const configCmd = program.command("config").description("Manage CLI configuration");
   configCmd.command("set").description("Set a configuration value").argument("<key>", "Config key").argument("<value>", "Config value").action((key, value) => {
     if (!isValidConfigKey(key)) {
@@ -639,10 +825,20 @@ function registerConfigCommands(program) {
         return;
       }
       config.set(key, num);
+    } else if (key === "output_format") {
+      const valid = ["table", "json", "csv", "tsv", "quiet", "id", "md"];
+      if (!valid.includes(value)) {
+        process.stderr.write(`Error: output_format must be one of: ${valid.join(", ")}
+`);
+        process.exit(2);
+        return;
+      }
+      config.set(key, value);
     } else {
       config.set(key, value);
     }
-    process.stdout.write(`Set ${key} = ${value}
+    const shown = key === "token" ? `${value.slice(0, 8)}...` : value;
+    process.stdout.write(`Set ${key} = ${shown}
 `);
   });
   configCmd.command("get").description("Get a configuration value").argument("<key>", "Config key").action((key) => {
@@ -666,7 +862,8 @@ function registerConfigCommands(program) {
     for (const key of keys) {
       const value = store[key];
       if (value !== void 0) {
-        process.stdout.write(`${key} = ${value}
+        const shown = key === "token" ? `${String(value).slice(0, 8)}...` : value;
+        process.stdout.write(`${key} = ${shown}
 `);
       }
     }
@@ -694,6 +891,141 @@ function registerConfigCommands(program) {
   configCmd.command("path").description("Print the config file path").action(() => {
     process.stdout.write(config.path + "\n");
   });
+  configCmd.command("validate").description("Verify the stored token works and show current identity").action(async () => {
+    const client = getClient();
+    let user;
+    try {
+      const userData = await client.get("/user");
+      user = userData.user;
+    } catch (err) {
+      process.stderr.write(`Error: Token validation failed. Run: clickup auth login
+`);
+      process.exit(3);
+      return;
+    }
+    let workspaceName = "(none)";
+    let workspaceId = "(none)";
+    try {
+      const teamsData = await client.get("/team");
+      const activeKey = getActiveProfileKey();
+      const profiles = getProfiles();
+      const activeProfile = profiles[activeKey];
+      if (activeProfile?.workspace_id) {
+        const match = teamsData.teams.find((t) => t.id === activeProfile.workspace_id);
+        workspaceName = match?.name ?? activeProfile.workspace_name ?? activeProfile.workspace_id;
+        workspaceId = activeProfile.workspace_id;
+      } else if (teamsData.teams.length > 0) {
+        workspaceName = teamsData.teams.map((t) => t.name).join(", ");
+        workspaceId = teamsData.teams.map((t) => t.id).join(", ");
+      }
+    } catch {
+    }
+    process.stdout.write(`User:             ${user.username} (${user.email})
+`);
+    process.stdout.write(`Active profile:   ${getActiveProfileKey()}
+`);
+    process.stdout.write(`Workspace:        ${workspaceName}
+`);
+    process.stdout.write(`Workspace ID:     ${workspaceId}
+`);
+    process.stdout.write(`Token status:     Valid
+`);
+  });
+  const profileCmd = configCmd.command("profile").description("Manage named profiles");
+  profileCmd.command("list").description("List all profiles").action(() => {
+    const profiles = getProfiles();
+    const activeKey = getActiveProfileKey();
+    const keys = Object.keys(profiles);
+    if (keys.length === 0) {
+      process.stdout.write("No profiles configured. Run: clickup auth login\n");
+      return;
+    }
+    const col = (s, w) => s.padEnd(w).slice(0, w);
+    process.stdout.write(
+      `${col("Key", 20)} ${col("Workspace Name", 30)} ${col("Nickname", 15)} ${col("Workspace ID", 16)} Active
+`
+    );
+    process.stdout.write(`${"-".repeat(20)} ${"-".repeat(30)} ${"-".repeat(15)} ${"-".repeat(16)} ------
+`);
+    for (const key of keys) {
+      const p = profiles[key];
+      const active = key === activeKey ? "*" : "";
+      process.stdout.write(
+        `${col(key, 20)} ${col(p.workspace_name ?? "", 30)} ${col(p.nickname ?? "", 15)} ${col(p.workspace_id ?? "", 16)} ${active}
+`
+      );
+    }
+  });
+  profileCmd.command("create").description("Create an empty profile").argument("<key>", "Profile key").action((key) => {
+    const profiles = getProfiles();
+    if (profiles[key]) {
+      process.stderr.write(`Error: Profile "${key}" already exists.
+`);
+      process.exit(2);
+      return;
+    }
+    setProfile(key, {});
+    process.stdout.write(`Profile "${key}" created.
+`);
+  });
+  profileCmd.command("delete").description("Delete a profile").argument("<key>", "Profile key").option("--confirm", "Skip confirmation prompt").action(async (key, opts) => {
+    const profiles = getProfiles();
+    if (!profiles[key]) {
+      process.stderr.write(`Error: Profile "${key}" not found.
+`);
+      process.exit(2);
+      return;
+    }
+    const isActive = key === getActiveProfileKey();
+    if (!opts.confirm) {
+      if (!process.stdin.isTTY) {
+        process.stderr.write("Error: Add --confirm to delete a profile in non-interactive mode.\n");
+        process.exit(2);
+        return;
+      }
+      const { confirm } = await import("@inquirer/prompts");
+      const answer = await confirm({
+        message: isActive ? `"${key}" is the active profile. Delete it?` : `Delete profile "${key}"?`,
+        default: false
+      });
+      if (!answer) {
+        process.stdout.write("Cancelled.\n");
+        return;
+      }
+    }
+    deleteProfile(key);
+    if (isActive) {
+      config.delete("active_profile");
+    }
+    process.stdout.write(`Profile "${key}" deleted.
+`);
+  });
+  profileCmd.command("use").description("Switch the active profile").argument("<key>", "Profile key, workspace name, or nickname").action((nameOrKey) => {
+    const profiles = getProfiles();
+    const resolvedKey = findProfileKey(nameOrKey);
+    if (!profiles[resolvedKey]) {
+      process.stderr.write(`Error: Profile "${nameOrKey}" not found.
+`);
+      process.exit(2);
+      return;
+    }
+    config.set("active_profile", resolvedKey);
+    process.stdout.write(`Active profile: ${resolvedKey}
+`);
+  });
+  profileCmd.command("nickname").description("Set a short nickname for a profile").argument("<key>", "Profile key").argument("<nickname>", "Short nickname").action((key, nickname) => {
+    const profiles = getProfiles();
+    const profile = profiles[key];
+    if (!profile) {
+      process.stderr.write(`Error: Profile "${key}" not found.
+`);
+      process.exit(2);
+      return;
+    }
+    setProfile(key, { ...profile, nickname });
+    process.stdout.write(`Nickname "${nickname}" set for profile "${key}".
+`);
+  });
 }
 
 // src/commands/workspace.ts
@@ -772,18 +1104,23 @@ function applySort(rows, sort) {
     return desc ? -result : result;
   });
 }
+var CONTROL_CHARS_RE = new RegExp("[\\u0000-\\u0008\\u000b-\\u001f\\u007f-\\u009f]", "g");
+function sanitize(str) {
+  return str.replace(/\r?\n/g, " ").replace(CONTROL_CHARS_RE, "");
+}
 function getValue(row, key) {
   if (row && typeof row === "object") {
     const record = row;
     const val = record[key];
     if (val === null || val === void 0) return "";
-    if (typeof val === "object") return JSON.stringify(val);
-    return String(val);
+    if (typeof val === "object") return sanitize(JSON.stringify(val));
+    return sanitize(String(val));
   }
   return "";
 }
 function truncate(str, width) {
   if (str.length <= width) return str;
+  if (width <= 3) return str.slice(0, Math.max(0, width));
   return str.slice(0, width - 3) + "...";
 }
 function printTable(rows, columns, opts) {
@@ -813,7 +1150,10 @@ function printDelimited(rows, columns, delimiter, opts) {
   }
   for (const row of rows) {
     const values = columns.map((col) => {
-      const val = getValue(row, col.key);
+      let val = getValue(row, col.key);
+      if (delimiter === "," && /^[=+\-@\t\r]/.test(val)) {
+        val = `'${val}`;
+      }
       if (delimiter === "," && (val.includes(",") || val.includes('"') || val.includes("\n"))) {
         return `"${val.replace(/"/g, '""')}"`;
       }
@@ -869,6 +1209,7 @@ function getFields(resource, action) {
 }
 
 // src/commands/workspace.ts
+registerSchema("workspace", "setup", "Configure workspace -- fetches workspaces and saves profile", []);
 registerSchema("workspace", "list", "List all workspaces accessible to the authenticated user", []);
 registerSchema("workspace", "get", "Get workspace details", [
   { flag: "--workspace-id", type: "string", required: true, description: "Workspace ID" }
@@ -912,6 +1253,49 @@ function requireWorkspaceId(program) {
 }
 function registerWorkspaceCommands(program, getClient) {
   const workspace = program.command("workspace").description("Manage workspaces");
+  workspace.command("setup").description("Configure workspace for the active profile").action(async () => {
+    const client = getClient();
+    const data = await client.get("/team");
+    const teams = data.teams;
+    if (teams.length === 0) {
+      process.stderr.write("Error: No workspaces found for this token.\n");
+      process.exit(1);
+      return;
+    }
+    let selected;
+    if (teams.length === 1) {
+      selected = teams[0];
+    } else {
+      if (!process.stdin.isTTY) {
+        process.stderr.write("Error: Multiple workspaces found. Use --workspace-id or run in interactive mode.\n");
+        process.exit(2);
+        return;
+      }
+      const { select } = await import("@inquirer/prompts");
+      const selectedId = await select({
+        message: "Select workspace:",
+        choices: teams.map((t) => ({ name: t.name, value: t.id }))
+      });
+      selected = teams.find((t) => t.id === selectedId);
+    }
+    const profileKey = getActiveProfileKey();
+    const profiles = getProfiles();
+    const existing = profiles[profileKey] ?? {};
+    const slugKey = slugifyWorkspaceName(selected.name);
+    setProfile(profileKey, {
+      ...existing,
+      workspace_id: selected.id,
+      workspace_name: selected.name
+    });
+    process.stdout.write(
+      `Workspace "${selected.name}" saved as profile "${profileKey}".
+`
+    );
+    if (slugKey !== profileKey) {
+      process.stdout.write(`Use --profile "${selected.name}" or --profile ${profileKey}
+`);
+    }
+  });
   workspace.command("list").description("List all workspaces").action(async () => {
     const client = getClient();
     const data = await client.get("/team");
@@ -1160,6 +1544,124 @@ function registerFolderCommands(program, getClient) {
   });
 }
 
+// src/dates.ts
+var RELATIVE_OFFSET_RE = /^([+-]\d+)([dwmh])$/;
+var UNIX_MS_RE = /^\d{13,}$/;
+var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+var ISO_DATETIME_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}/;
+var DAY_NAMES = ["sunday", "monday", "tuesday", "wednesday", "thursday", "friday", "saturday"];
+function parseDate(input) {
+  const raw = input.trim();
+  const lower = raw.toLowerCase();
+  if (UNIX_MS_RE.test(raw)) {
+    return parseInt(raw, 10);
+  }
+  const now = /* @__PURE__ */ new Date();
+  switch (lower) {
+    case "today": {
+      return startOfDay(now).getTime();
+    }
+    case "tomorrow": {
+      const d = startOfDay(now);
+      d.setDate(d.getDate() + 1);
+      return d.getTime();
+    }
+    case "yesterday": {
+      const d = startOfDay(now);
+      d.setDate(d.getDate() - 1);
+      return d.getTime();
+    }
+  }
+  const offsetMatch = RELATIVE_OFFSET_RE.exec(lower);
+  if (offsetMatch) {
+    const amount = parseInt(offsetMatch[1], 10);
+    const unit = offsetMatch[2];
+    const ms = unitToMs(unit, amount);
+    return now.getTime() + ms;
+  }
+  if (lower.startsWith("next ")) {
+    const dayName = lower.slice(5);
+    const dayIndex = DAY_NAMES.indexOf(dayName);
+    if (dayIndex !== -1) {
+      const today = now.getDay();
+      let daysAhead = dayIndex - today;
+      if (daysAhead <= 0) daysAhead += 7;
+      const target = startOfDay(now);
+      target.setDate(target.getDate() + daysAhead);
+      return target.getTime();
+    }
+  }
+  if (ISO_DATE_RE.test(raw)) {
+    const d = /* @__PURE__ */ new Date(raw + "T00:00:00");
+    if (!isNaN(d.getTime())) return d.getTime();
+  }
+  if (ISO_DATETIME_RE.test(raw)) {
+    const d = new Date(raw);
+    if (!isNaN(d.getTime())) return d.getTime();
+  }
+  throw new Error(`Unable to parse date: "${input}"`);
+}
+function startOfDay(date) {
+  const d = new Date(date);
+  d.setHours(0, 0, 0, 0);
+  return d;
+}
+function unitToMs(unit, amount) {
+  switch (unit) {
+    case "m":
+      return amount * 60 * 1e3;
+    case "h":
+      return amount * 60 * 60 * 1e3;
+    case "d":
+      return amount * 24 * 60 * 60 * 1e3;
+    case "w":
+      return amount * 7 * 24 * 60 * 60 * 1e3;
+    default:
+      return 0;
+  }
+}
+
+// src/parse.ts
+function fail(message) {
+  process.stderr.write(`Error: ${message}
+`);
+  process.exit(2);
+}
+function parseIntStrict(value, flag) {
+  const num = parseInt(value, 10);
+  if (isNaN(num)) fail(`${flag} must be a number, got "${value}"`);
+  return num;
+}
+function parseFloatStrict(value, flag) {
+  const num = parseFloat(value);
+  if (isNaN(num)) fail(`${flag} must be a number, got "${value}"`);
+  return num;
+}
+function parseDateStrict(value, flag) {
+  try {
+    return parseDate(value);
+  } catch {
+    fail(`${flag} must be a date (ISO 8601, relative like +3d, or Unix ms), got "${value}"`);
+  }
+}
+function parseBoolStrict(value, flag) {
+  if (value === "true") return true;
+  if (value === "false") return false;
+  fail(`${flag} must be "true" or "false", got "${value}"`);
+}
+function intArg(flag) {
+  return (value) => parseIntStrict(value, flag);
+}
+function enumIntArg(flag, allowed) {
+  return (value) => {
+    const num = parseInt(value, 10);
+    if (isNaN(num) || !allowed.includes(num)) {
+      fail(`${flag} must be one of: ${allowed.join(", ")}`);
+    }
+    return num;
+  };
+}
+
 // src/commands/list.ts
 registerSchema("list", "list", "List lists in a folder", [
   { flag: "--folder-id", type: "string", required: true, description: "Folder ID" },
@@ -1232,11 +1734,11 @@ function registerListCommands(program, getClient) {
     const data = await client.get(`/list/${listId}`);
     formatOutput(data, LIST_COLUMNS, getOutputOptions(program));
   });
-  list.command("create").description("Create a new list in a folder").requiredOption("--folder-id <id>", "Folder ID").requiredOption("--name <name>", "List name").option("--content <desc>", "List description").option("--due-date <ts>", "Due date (Unix ms)").option("--priority <n>", "Priority (1-4)", parseInt).option("--status <s>", "Default status").action(async (opts) => {
+  list.command("create").description("Create a new list in a folder").requiredOption("--folder-id <id>", "Folder ID").requiredOption("--name <name>", "List name").option("--content <desc>", "List description").option("--due-date <ts>", "Due date (Unix ms)").option("--priority <n>", "Priority (1-4)", enumIntArg("--priority", [1, 2, 3, 4])).option("--status <s>", "Default status").action(async (opts) => {
     const client = getClient();
     const body = { name: opts.name };
     if (opts.content !== void 0) body["content"] = opts.content;
-    if (opts.dueDate !== void 0) body["due_date"] = parseInt(opts.dueDate, 10);
+    if (opts.dueDate !== void 0) body["due_date"] = parseDateStrict(opts.dueDate, "--due-date");
     if (opts.priority !== void 0) body["priority"] = opts.priority;
     if (opts.status !== void 0) body["status"] = opts.status;
     const data = await client.post(`/folder/${opts.folderId}/list`, body);
@@ -1254,7 +1756,7 @@ function registerListCommands(program, getClient) {
     const body = {};
     if (opts.name !== void 0) body["name"] = opts.name;
     if (opts.content !== void 0) body["content"] = opts.content;
-    if (opts.dueDate !== void 0) body["due_date"] = parseInt(opts.dueDate, 10);
+    if (opts.dueDate !== void 0) body["due_date"] = parseDateStrict(opts.dueDate, "--due-date");
     if (opts.unsetStatus) body["unset_status"] = true;
     const data = await client.put(`/list/${listId}`, body);
     formatOutput(data, LIST_COLUMNS, getOutputOptions(program));
@@ -1294,6 +1796,116 @@ function registerListCommands(program, getClient) {
 
 // src/commands/task.ts
 init_config();
+
+// src/commands/task-bulk.ts
+registerSchema("task", "bulk-update", "Apply the same update to multiple tasks", [
+  { flag: "--task-id", type: "string[]", required: true, description: "Task ID (repeatable)" },
+  { flag: "--name", type: "string", required: false, description: "New task name" },
+  { flag: "--description", type: "string", required: false, description: "New description" },
+  { flag: "--status", type: "string", required: false, description: "New status" },
+  { flag: "--priority", type: "string", required: false, description: "New priority (1-4 or urgent/high/normal/low)" }
+]);
+registerSchema("task", "bulk-delete", "Delete multiple tasks", [
+  { flag: "--task-id", type: "string[]", required: true, description: "Task ID (repeatable)" },
+  { flag: "--confirm", type: "boolean", required: false, description: "Skip confirmation prompt" }
+]);
+async function runConcurrent(tasks, limit) {
+  const results = new Array(tasks.length);
+  let idx = 0;
+  async function worker() {
+    while (idx < tasks.length) {
+      const current = idx++;
+      try {
+        results[current] = await tasks[current]();
+      } catch (e) {
+        results[current] = e instanceof Error ? e : new Error(String(e));
+      }
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(limit, tasks.length) }, worker));
+  return results;
+}
+function registerTaskBulkCommands(task, program, getClient) {
+  task.command("bulk-time-in-status").description("Get time-in-status for multiple tasks").requiredOption("--task-id <id>", "Task ID (repeatable)", collect, []).action(async (opts) => {
+    const client = getClient();
+    const taskIds = opts.taskId;
+    const results = [];
+    for (const id of taskIds) {
+      const data = await client.get(`/task/${id}/time_in_status`);
+      const entries = data.status_history ?? [];
+      if (data.current_status) entries.push(data.current_status);
+      results.push({ task_id: id, statuses: entries });
+    }
+    formatOutput(results, [
+      { key: "task_id", header: "Task ID", width: 14 },
+      { key: "statuses", header: "Statuses", width: 50 }
+    ], getOutputOptions(program));
+  });
+  task.command("bulk-update").description("Apply the same update to multiple tasks").requiredOption("--task-id <id>", "Task ID (repeatable)", collect, []).option("--name <name>", "New task name").option("--description <desc>", "New description").option("--status <s>", "New status").option("--priority <n>", "New priority (1-4 or urgent/high/normal/low)").option("--due-date <date>", "New due date (Unix ms)").option("--start-date <date>", "New start date (Unix ms)").option("--time-estimate <ms>", "New time estimate in milliseconds", intArg("--time-estimate")).option("--assignee-add <id>", "Add assignee (repeatable)", collect, []).option("--assignee-remove <id>", "Remove assignee (repeatable)", collect, []).action(async (opts) => {
+    const client = getClient();
+    const taskIds = opts.taskId;
+    const body = {};
+    if (opts.name !== void 0) body["name"] = opts.name;
+    if (opts.description !== void 0) body["description"] = opts.description;
+    if (opts.status !== void 0) body["status"] = opts.status;
+    if (opts.priority !== void 0) body["priority"] = parsePriority(opts.priority);
+    if (opts.dueDate !== void 0) body["due_date"] = parseDateStrict(opts.dueDate, "--due-date");
+    if (opts.startDate !== void 0) body["start_date"] = parseDateStrict(opts.startDate, "--start-date");
+    if (opts.timeEstimate !== void 0) body["time_estimate"] = opts.timeEstimate;
+    const addIds = opts.assigneeAdd;
+    const remIds = opts.assigneeRemove;
+    if (addIds.length || remIds.length) {
+      body["assignees"] = {
+        add: addIds.map((a) => parseIntStrict(a, "--assignee-add")),
+        rem: remIds.map((a) => parseIntStrict(a, "--assignee-remove"))
+      };
+    }
+    const tasks = taskIds.map((id) => async () => {
+      const data = await client.put(`/task/${id}`, body);
+      return { task_id: id, name: data["name"], result: "ok" };
+    });
+    const results = await runConcurrent(tasks, 3);
+    const rows = results.map(
+      (r, i) => r instanceof Error ? { task_id: taskIds[i], name: "", result: r.message } : r
+    );
+    formatOutput(rows, [
+      { key: "task_id", header: "Task ID", width: 14 },
+      { key: "name", header: "Name", width: 30 },
+      { key: "result", header: "Result", width: 20 }
+    ], getOutputOptions(program));
+  });
+  task.command("bulk-delete").description("Delete multiple tasks").requiredOption("--task-id <id>", "Task ID (repeatable)", collect, []).option("--confirm", "Skip confirmation prompt").action(async (opts) => {
+    const client = getClient();
+    const taskIds = opts.taskId;
+    if (!opts.confirm) {
+      if (!process.stdin.isTTY) {
+        process.stderr.write("Error: Use --confirm to bulk delete in non-interactive mode.\n");
+        process.exit(2);
+        return;
+      }
+      const { confirm } = await import("@inquirer/prompts");
+      const yes = await confirm({ message: `Delete ${taskIds.length} task(s)?` });
+      if (!yes) {
+        process.stdout.write("Cancelled.\n");
+        return;
+      }
+    }
+    const tasks = taskIds.map((id) => async () => {
+      await client.delete(`/task/${id}`);
+      return { task_id: id, result: "deleted" };
+    });
+    const results = await runConcurrent(tasks, 3);
+    const rows = results.map(
+      (r, i) => r instanceof Error ? { task_id: taskIds[i], result: r.message } : r
+    );
+    formatOutput(rows, [
+      { key: "task_id", header: "Task ID", width: 14 },
+      { key: "result", header: "Result", width: 20 }
+    ], getOutputOptions(program));
+  });
+}
+
+// src/commands/task.ts
 registerSchema("task", "list", "List tasks in a list", [
   { flag: "--list-id", type: "string", required: true, description: "List ID" },
   { flag: "--archived", type: "boolean", required: false, description: "Include archived tasks" },
@@ -1377,6 +1989,26 @@ function requireWorkspaceId3(program) {
 function collect(value, previous) {
   return previous.concat([value]);
 }
+var PRIORITY_MAP = {
+  urgent: 1,
+  high: 2,
+  normal: 3,
+  low: 4
+};
+function parsePriority(value) {
+  const lower = value.toLowerCase();
+  if (PRIORITY_MAP[lower] !== void 0) return PRIORITY_MAP[lower];
+  const num = parseInt(value, 10);
+  if (!isNaN(num) && num >= 1 && num <= 4) return num;
+  fail("--priority must be 1-4 or urgent/high/normal/low");
+}
+function parseCustomFieldFilters(filters) {
+  try {
+    return JSON.stringify(filters.map((f) => JSON.parse(f)));
+  } catch {
+    fail("--custom-field filters must be valid JSON");
+  }
+}
 function buildTaskListParams(opts) {
   const params = {};
   if (opts.archived) params["archived"] = "true";
@@ -1398,20 +2030,18 @@ function buildTaskListParams(opts) {
   const tags = opts.tag;
   if (tags?.length) params["tags[]"] = tags;
   const customFields = opts.customField;
-  if (customFields?.length) {
-    for (const cf of customFields) params["custom_fields"] = JSON.stringify(customFields.map((f) => JSON.parse(f)));
-  }
+  if (customFields?.length) params["custom_fields"] = parseCustomFieldFilters(customFields);
   return params;
 }
 function registerTaskCommands(program, getClient) {
   const task = program.command("task").description("Manage tasks");
-  task.command("list").description("List tasks in a list").requiredOption("--list-id <id>", "List ID").option("--archived", "Include archived tasks").option("--include-closed", "Include tasks in closed status").option("--subtasks", "Include subtasks in results").option("--page <n>", "Page number (0-indexed)", parseInt).option("--status <s>", "Filter by status (repeatable)", collect, []).option("--assignee <id>", "Filter by assignee ID (repeatable)", collect, []).option("--tag <name>", "Filter by tag name (repeatable)", collect, []).option("--due-date-gt <ts>", "Tasks due after timestamp").option("--due-date-lt <ts>", "Tasks due before timestamp").option("--date-created-gt <ts>", "Tasks created after timestamp").option("--date-created-lt <ts>", "Tasks created before timestamp").option("--date-updated-gt <ts>", "Tasks updated after timestamp").option("--date-updated-lt <ts>", "Tasks updated before timestamp").option("--custom-field <json>", "Custom field filter as JSON (repeatable)", collect, []).option("--order-by <field>", "Sort by field (id|created|updated|due_date)").option("--reverse", "Reverse sort order").action(async (opts) => {
+  task.command("list").description("List tasks in a list").requiredOption("--list-id <id>", "List ID").option("--archived", "Include archived tasks").option("--include-closed", "Include tasks in closed status").option("--subtasks", "Include subtasks in results").option("--page <n>", "Page number (0-indexed)", intArg("--page")).option("--status <s>", "Filter by status (repeatable)", collect, []).option("--assignee <id>", "Filter by assignee ID (repeatable)", collect, []).option("--tag <name>", "Filter by tag name (repeatable)", collect, []).option("--due-date-gt <ts>", "Tasks due after timestamp").option("--due-date-lt <ts>", "Tasks due before timestamp").option("--date-created-gt <ts>", "Tasks created after timestamp").option("--date-created-lt <ts>", "Tasks created before timestamp").option("--date-updated-gt <ts>", "Tasks updated after timestamp").option("--date-updated-lt <ts>", "Tasks updated before timestamp").option("--custom-field <json>", "Custom field filter as JSON (repeatable)", collect, []).option("--order-by <field>", "Sort by field (id|created|updated|due_date)").option("--reverse", "Reverse sort order").action(async (opts) => {
     const client = getClient();
     const params = buildTaskListParams(opts);
     const data = await client.get(`/list/${opts.listId}/task`, params);
     formatOutput(data.tasks, TASK_COLUMNS, getOutputOptions(program));
   });
-  task.command("search").description("Search tasks across a workspace").option("--query <text>", "Full-text search query").option("--include-closed", "Include tasks in closed status").option("--subtasks", "Include subtasks").option("--page <n>", "Page number (0-indexed)", parseInt).option("--status <s>", "Filter by status (repeatable)", collect, []).option("--assignee <id>", "Filter by assignee ID (repeatable)", collect, []).option("--tag <name>", "Filter by tag name (repeatable)", collect, []).option("--priority <n>", "Filter by priority (repeatable)", collect, []).option("--list-id <id>", "Scope to list IDs (repeatable)", collect, []).option("--folder-id <id>", "Scope to folder IDs (repeatable)", collect, []).option("--space-id <id>", "Scope to space IDs (repeatable)", collect, []).option("--project-id <id>", "Scope to project IDs (repeatable)", collect, []).option("--due-date-gt <ts>", "Tasks due after timestamp").option("--due-date-lt <ts>", "Tasks due before timestamp").option("--date-created-gt <ts>", "Tasks created after timestamp").option("--date-created-lt <ts>", "Tasks created before timestamp").option("--custom-field <json>", "Custom field filter as JSON (repeatable)", collect, []).option("--order-by <field>", "Sort by field (id|created|updated|due_date)").option("--reverse", "Reverse sort order").action(async (opts) => {
+  task.command("search").description("Search tasks across a workspace").option("--query <text>", "Full-text search query").option("--include-closed", "Include tasks in closed status").option("--subtasks", "Include subtasks").option("--page <n>", "Page number (0-indexed)", intArg("--page")).option("--status <s>", "Filter by status (repeatable)", collect, []).option("--assignee <id>", "Filter by assignee ID (repeatable)", collect, []).option("--tag <name>", "Filter by tag name (repeatable)", collect, []).option("--priority <n>", "Filter by priority (repeatable)", collect, []).option("--list-id <id>", "Scope to list IDs (repeatable)", collect, []).option("--folder-id <id>", "Scope to folder IDs (repeatable)", collect, []).option("--space-id <id>", "Scope to space IDs (repeatable)", collect, []).option("--project-id <id>", "Scope to project IDs (repeatable)", collect, []).option("--due-date-gt <ts>", "Tasks due after timestamp").option("--due-date-lt <ts>", "Tasks due before timestamp").option("--date-created-gt <ts>", "Tasks created after timestamp").option("--date-created-lt <ts>", "Tasks created before timestamp").option("--custom-field <json>", "Custom field filter as JSON (repeatable)", collect, []).option("--order-by <field>", "Sort by field (id|created|updated|due_date)").option("--reverse", "Reverse sort order").action(async (opts) => {
     const workspaceId = requireWorkspaceId3(program);
     if (!workspaceId) return;
     const client = getClient();
@@ -1443,7 +2073,7 @@ function registerTaskCommands(program, getClient) {
     const projectIds = opts.projectId;
     if (projectIds.length) params["project_ids[]"] = projectIds;
     const customFields = opts.customField;
-    if (customFields.length) params["custom_fields"] = JSON.stringify(customFields.map((f) => JSON.parse(f)));
+    if (customFields.length) params["custom_fields"] = parseCustomFieldFilters(customFields);
     const data = await client.get(`/team/${workspaceId}/task`, params);
     formatOutput(data.tasks, TASK_COLUMNS, getOutputOptions(program));
   });
@@ -1455,17 +2085,17 @@ function registerTaskCommands(program, getClient) {
     const data = await client.get(`/task/${taskId}`, params);
     formatOutput(data, TASK_COLUMNS, getOutputOptions(program));
   });
-  task.command("create").description("Create a new task").requiredOption("--list-id <id>", "List ID").requiredOption("--name <name>", "Task name").option("--description <desc>", "Plain text description").option("--markdown-description <md>", "Markdown description (overrides --description)").option("--status <s>", "Initial status").option("--priority <n>", "Priority (1=urgent, 2=high, 3=normal, 4=low)", parseInt).option("--due-date <date>", "Due date (Unix ms)").option("--start-date <date>", "Start date (Unix ms)").option("--assignee <id>", "Assignee user ID (repeatable)", collect, []).option("--tag <name>", "Tag name (repeatable)", collect, []).option("--time-estimate <ms>", "Time estimate in milliseconds", parseInt).option("--notify-all", "Notify all assignees and watchers").option("--parent <task-id>", "Parent task ID (creates subtask)").option("--links-to <task-id>", "Link to another task").option("--custom-field <id=value>", "Set custom field (repeatable)", collect, []).option("--check-required-custom-fields", "Reject if required custom fields are missing").action(async (opts) => {
+  task.command("create").description("Create a new task").requiredOption("--list-id <id>", "List ID").requiredOption("--name <name>", "Task name").option("--description <desc>", "Plain text description").option("--markdown-description <md>", "Markdown description (overrides --description)").option("--status <s>", "Initial status").option("--priority <n>", "Priority (1-4 or urgent/high/normal/low)").option("--due-date <date>", "Due date (Unix ms)").option("--start-date <date>", "Start date (Unix ms)").option("--assignee <id>", "Assignee user ID (repeatable)", collect, []).option("--tag <name>", "Tag name (repeatable)", collect, []).option("--time-estimate <ms>", "Time estimate in milliseconds", intArg("--time-estimate")).option("--notify-all", "Notify all assignees and watchers").option("--parent <task-id>", "Parent task ID (creates subtask)").option("--links-to <task-id>", "Link to another task").option("--custom-field <id=value>", "Set custom field (repeatable)", collect, []).option("--check-required-custom-fields", "Reject if required custom fields are missing").action(async (opts) => {
     const client = getClient();
     const body = { name: opts.name };
     if (opts.markdownDescription !== void 0) body["markdown_description"] = opts.markdownDescription;
     else if (opts.description !== void 0) body["description"] = opts.description;
     if (opts.status !== void 0) body["status"] = opts.status;
-    if (opts.priority !== void 0) body["priority"] = opts.priority;
-    if (opts.dueDate !== void 0) body["due_date"] = parseInt(opts.dueDate, 10);
-    if (opts.startDate !== void 0) body["start_date"] = parseInt(opts.startDate, 10);
+    if (opts.priority !== void 0) body["priority"] = parsePriority(opts.priority);
+    if (opts.dueDate !== void 0) body["due_date"] = parseDateStrict(opts.dueDate, "--due-date");
+    if (opts.startDate !== void 0) body["start_date"] = parseDateStrict(opts.startDate, "--start-date");
     const assignees = opts.assignee;
-    if (assignees.length) body["assignees"] = assignees.map((a) => parseInt(a, 10));
+    if (assignees.length) body["assignees"] = assignees.map((a) => parseIntStrict(a, "--assignee"));
     const tags = opts.tag;
     if (tags.length) body["tags"] = tags;
     if (opts.timeEstimate !== void 0) body["time_estimate"] = opts.timeEstimate;
@@ -1476,7 +2106,7 @@ function registerTaskCommands(program, getClient) {
     if (customFields.length) {
       body["custom_fields"] = customFields.map((cf) => {
         const eqIdx = cf.indexOf("=");
-        if (eqIdx === -1) throw new Error(`Invalid custom field format: ${cf}. Expected: <id>=<value>`);
+        if (eqIdx === -1) fail(`Invalid custom field format: ${cf}. Expected: <id>=<value>`);
         const id = cf.slice(0, eqIdx);
         let value = cf.slice(eqIdx + 1);
         try {
@@ -1490,22 +2120,22 @@ function registerTaskCommands(program, getClient) {
     const data = await client.post(`/list/${opts.listId}/task`, body);
     formatOutput(data, TASK_COLUMNS, getOutputOptions(program));
   });
-  task.command("update").description("Update a task").argument("<task-id>", "Task ID").option("--name <name>", "New task name").option("--description <desc>", "New description").option("--status <s>", "New status").option("--priority <n>", "New priority (1-4)", parseInt).option("--due-date <date>", "New due date (Unix ms)").option("--start-date <date>", "New start date (Unix ms)").option("--time-estimate <ms>", "New time estimate in milliseconds", parseInt).option("--assignee-add <id>", "Add assignee (repeatable)", collect, []).option("--assignee-remove <id>", "Remove assignee (repeatable)", collect, []).option("--archived <bool>", "Archive or unarchive").action(async (taskId, opts) => {
+  task.command("update").description("Update a task").argument("<task-id>", "Task ID").option("--name <name>", "New task name").option("--description <desc>", "New description").option("--status <s>", "New status").option("--priority <n>", "New priority (1-4 or urgent/high/normal/low)").option("--due-date <date>", "New due date (Unix ms)").option("--start-date <date>", "New start date (Unix ms)").option("--time-estimate <ms>", "New time estimate in milliseconds", intArg("--time-estimate")).option("--assignee-add <id>", "Add assignee (repeatable)", collect, []).option("--assignee-remove <id>", "Remove assignee (repeatable)", collect, []).option("--archived <bool>", "Archive or unarchive").action(async (taskId, opts) => {
     const client = getClient();
     const body = {};
     if (opts.name !== void 0) body["name"] = opts.name;
     if (opts.description !== void 0) body["description"] = opts.description;
     if (opts.status !== void 0) body["status"] = opts.status;
-    if (opts.priority !== void 0) body["priority"] = opts.priority;
-    if (opts.dueDate !== void 0) body["due_date"] = parseInt(opts.dueDate, 10);
-    if (opts.startDate !== void 0) body["start_date"] = parseInt(opts.startDate, 10);
+    if (opts.priority !== void 0) body["priority"] = parsePriority(opts.priority);
+    if (opts.dueDate !== void 0) body["due_date"] = parseDateStrict(opts.dueDate, "--due-date");
+    if (opts.startDate !== void 0) body["start_date"] = parseDateStrict(opts.startDate, "--start-date");
     if (opts.timeEstimate !== void 0) body["time_estimate"] = opts.timeEstimate;
     const addIds = opts.assigneeAdd;
     const remIds = opts.assigneeRemove;
     if (addIds.length || remIds.length) {
       body["assignees"] = {
-        add: addIds.map((a) => parseInt(a, 10)),
-        rem: remIds.map((a) => parseInt(a, 10))
+        add: addIds.map((a) => parseIntStrict(a, "--assignee-add")),
+        rem: remIds.map((a) => parseIntStrict(a, "--assignee-remove"))
       };
     }
     if (opts.archived !== void 0) body["archived"] = opts.archived === "true";
@@ -1538,21 +2168,7 @@ function registerTaskCommands(program, getClient) {
     if (data.current_status) entries.push(data.current_status);
     formatOutput(entries, TIME_IN_STATUS_COLUMNS, getOutputOptions(program));
   });
-  task.command("bulk-time-in-status").description("Get time-in-status for multiple tasks").requiredOption("--task-id <id>", "Task ID (repeatable)", collect, []).action(async (opts) => {
-    const client = getClient();
-    const taskIds = opts.taskId;
-    const results = [];
-    for (const id of taskIds) {
-      const data = await client.get(`/task/${id}/time_in_status`);
-      const entries = data.status_history ?? [];
-      if (data.current_status) entries.push(data.current_status);
-      results.push({ task_id: id, statuses: entries });
-    }
-    formatOutput(results, [
-      { key: "task_id", header: "Task ID", width: 14 },
-      { key: "statuses", header: "Statuses", width: 50 }
-    ], getOutputOptions(program));
-  });
+  registerTaskBulkCommands(task, program, getClient);
 }
 
 // src/commands/checklist.ts
@@ -1600,7 +2216,7 @@ function registerChecklistCommands(program, getClient) {
     const data = await client.post(`/task/${opts.taskId}/checklist`, { name: opts.name });
     formatOutput(data.checklist, CHECKLIST_COLUMNS, getOutputOptions(program));
   });
-  checklist.command("update").description("Update a checklist").argument("<checklist-id>", "Checklist ID").option("--name <name>", "New checklist name").option("--position <n>", "Position (0-indexed)", parseInt).action(async (checklistId, opts) => {
+  checklist.command("update").description("Update a checklist").argument("<checklist-id>", "Checklist ID").option("--name <name>", "New checklist name").option("--position <n>", "Position (0-indexed)", intArg("--position")).action(async (checklistId, opts) => {
     const client = getClient();
     const body = {};
     if (opts.name !== void 0) body["name"] = opts.name;
@@ -1630,7 +2246,7 @@ function registerChecklistCommands(program, getClient) {
   checklist.command("add-item").description("Add an item to a checklist").argument("<checklist-id>", "Checklist ID").requiredOption("--name <name>", "Item name").option("--assignee <id>", "Assignee user ID").option("--resolved <bool>", "Mark as resolved").option("--parent <item-id>", "Parent item ID").action(async (checklistId, opts) => {
     const client = getClient();
     const body = { name: opts.name };
-    if (opts.assignee !== void 0) body["assignee"] = parseInt(opts.assignee, 10);
+    if (opts.assignee !== void 0) body["assignee"] = parseIntStrict(opts.assignee, "--assignee");
     if (opts.resolved !== void 0) body["resolved"] = opts.resolved === "true";
     if (opts.parent !== void 0) body["parent"] = opts.parent;
     const data = await client.post(`/checklist/${checklistId}/checklist_item`, body);
@@ -1641,7 +2257,7 @@ function registerChecklistCommands(program, getClient) {
     const body = {};
     if (opts.name !== void 0) body["name"] = opts.name;
     if (opts.resolved !== void 0) body["resolved"] = opts.resolved === "true";
-    if (opts.assignee !== void 0) body["assignee"] = parseInt(opts.assignee, 10);
+    if (opts.assignee !== void 0) body["assignee"] = parseIntStrict(opts.assignee, "--assignee");
     if (opts.parent !== void 0) body["parent"] = opts.parent;
     const data = await client.put(`/checklist/${checklistId}/checklist_item/${opts.itemId}`, body);
     formatOutput(data.checklist, CHECKLIST_COLUMNS, getOutputOptions(program));
@@ -1668,6 +2284,7 @@ function registerChecklistCommands(program, getClient) {
 }
 
 // src/commands/custom-field.ts
+init_config();
 registerSchema("field", "list", "List custom fields for a list, folder, space, or workspace", [
   { flag: "--list-id", type: "string", required: false, description: "List ID" },
   { flag: "--folder-id", type: "string", required: false, description: "Folder ID" },
@@ -1681,7 +2298,8 @@ registerSchema("field", "set", "Set a custom field value on a task", [
 ]);
 registerSchema("field", "remove", "Remove a custom field value from a task", [
   { flag: "--task-id", type: "string", required: true, description: "Task ID" },
-  { flag: "--field-id", type: "string", required: true, description: "Field ID" }
+  { flag: "--field-id", type: "string", required: true, description: "Field ID" },
+  { flag: "--confirm", type: "boolean", required: false, description: "Skip confirmation prompt" }
 ]);
 var FIELD_COLUMNS = [
   { key: "id", header: "ID", width: 20 },
@@ -1694,7 +2312,7 @@ function registerFieldCommands(program, getClient) {
   const field = program.command("field").description("Manage custom fields");
   field.command("list").description("List custom fields (provide one ID flag)").option("--list-id <id>", "List ID").option("--folder-id <id>", "Folder ID").option("--space-id <id>", "Space ID").action(async (opts) => {
     const client = getClient();
-    const globalWorkspaceId = program.opts()["workspaceId"];
+    const globalWorkspaceId = resolveWorkspaceId(program.opts()["workspaceId"]);
     let endpoint;
     if (opts.listId) {
       endpoint = `/list/${opts.listId}/field`;
@@ -1722,8 +2340,21 @@ function registerFieldCommands(program, getClient) {
     const data = await client.post(`/task/${opts.taskId}/field/${opts.fieldId}`, { value: parsedValue });
     formatOutput(data, FIELD_COLUMNS, getOutputOptions(program));
   });
-  field.command("remove").description("Remove a custom field value from a task").requiredOption("--task-id <id>", "Task ID").requiredOption("--field-id <fid>", "Field ID").action(async (opts) => {
+  field.command("remove").description("Remove a custom field value from a task").requiredOption("--task-id <id>", "Task ID").requiredOption("--field-id <fid>", "Field ID").option("--confirm", "Skip confirmation prompt").action(async (opts) => {
     const client = getClient();
+    if (!opts.confirm) {
+      if (!process.stdin.isTTY) {
+        process.stderr.write("Error: Use --confirm to remove in non-interactive mode.\n");
+        process.exit(2);
+        return;
+      }
+      const { confirm } = await import("@inquirer/prompts");
+      const yes = await confirm({ message: `Remove field ${opts.fieldId} value from task ${opts.taskId}?` });
+      if (!yes) {
+        process.stdout.write("Cancelled.\n");
+        return;
+      }
+    }
     await client.delete(`/task/${opts.taskId}/field/${opts.fieldId}`);
     process.stdout.write(`Removed field ${opts.fieldId} from task ${opts.taskId}
 `);
@@ -1900,11 +2531,22 @@ function registerRelationCommands(program, getClient) {
 }
 
 // src/commands/attachment.ts
+import { writeFileSync, existsSync as existsSync2 } from "fs";
+import { join, basename as basename2, resolve } from "path";
 registerSchema("attachment", "upload", "Upload a file to a task", [
   { flag: "--task-id", type: "string", required: true, description: "Task ID" },
   { flag: "--file", type: "string", required: true, description: "Local file path" },
   { flag: "--filename", type: "string", required: false, description: "Override display filename" }
 ]);
+registerSchema("attachment", "list", "List attachments on a task", [
+  { flag: "--task-id", type: "string", required: true, description: "Task ID" }
+]);
+registerSchema("attachment", "download", "Download an attachment from a task", [
+  { flag: "--task-id", type: "string", required: true, description: "Task ID" },
+  { flag: "--attachment-id", type: "string", required: true, description: "Attachment ID" },
+  { flag: "--output", type: "string", required: false, description: "Output file path (default: ./attachment-<id>-<title>)" },
+  { flag: "--force", type: "boolean", required: false, description: "Overwrite the output file if it exists" }
+]);
 var ATTACHMENT_COLUMNS = [
   { key: "id", header: "ID", width: 20 },
   { key: "title", header: "Title", width: 30 },
@@ -1919,6 +2561,42 @@ function registerAttachmentCommands(program, getClient) {
     const data = await client.upload(`/task/${opts.taskId}/attachment`, opts.file, opts.filename);
     formatOutput(data, ATTACHMENT_COLUMNS, getOutputOptions(program));
   });
+  attachment.command("list").description("List attachments on a task").requiredOption("--task-id <id>", "Task ID").action(async (opts) => {
+    const client = getClient();
+    const data = await client.get(`/task/${opts.taskId}`);
+    const attachments = data["attachments"] ?? [];
+    formatOutput(attachments, ATTACHMENT_COLUMNS, getOutputOptions(program));
+  });
+  attachment.command("download").description("Download an attachment from a task").requiredOption("--task-id <id>", "Task ID").requiredOption("--attachment-id <id>", "Attachment ID").option("--output <path>", "Output file path").option("--force", "Overwrite the output file if it exists").action(async (opts) => {
+    const { default: ora } = await import("ora");
+    const client = getClient();
+    const data = await client.get(`/task/${opts.taskId}`);
+    const attachments = data["attachments"] ?? [];
+    const attachment2 = attachments.find((a) => a.id === opts.attachmentId);
+    if (!attachment2) {
+      process.stderr.write(`Error: Attachment "${opts.attachmentId}" not found on task "${opts.taskId}".
+`);
+      process.exit(4);
+      return;
+    }
+    const safeTitle = basename2(attachment2.title.replace(/[/\\]/g, "_")) || "file";
+    const outputPath = opts.output ? resolve(opts.output) : join(process.cwd(), `attachment-${attachment2.id}-${safeTitle}`);
+    if (existsSync2(outputPath) && !opts.force) {
+      process.stderr.write(`Error: "${outputPath}" already exists. Use --force to overwrite or --output to pick another path.
+`);
+      process.exit(2);
+      return;
+    }
+    const spinner = ora(`Downloading ${safeTitle}...`).start();
+    try {
+      const buffer = await client.downloadUrl(attachment2.url);
+      writeFileSync(outputPath, Buffer.from(buffer));
+      spinner.succeed(`Downloaded to ${outputPath}`);
+    } catch (err) {
+      spinner.fail("Download failed");
+      throw err;
+    }
+  });
 }
 
 // src/commands/comment.ts
@@ -2005,7 +2683,7 @@ function registerCommentCommands(program, getClient) {
     if (!parent) return;
     const client = getClient();
     const body = { comment_text: opts.text };
-    if (opts.assignee !== void 0) body["assignee"] = parseInt(opts.assignee, 10);
+    if (opts.assignee !== void 0) body["assignee"] = parseIntStrict(opts.assignee, "--assignee");
     if (opts.notifyAll) body["notify_all"] = true;
     const data = await client.post(`/${parent.type}/${parent.id}/comment`, body);
     process.stdout.write(`Created comment ${data["id"] ?? ""}
@@ -2014,7 +2692,7 @@ function registerCommentCommands(program, getClient) {
   comment.command("update").description("Update a comment").argument("<comment-id>", "Comment ID").requiredOption("--text <text>", "New comment text").option("--assignee <id>", "Assignee user ID").option("--resolved <bool>", "Mark as resolved (true/false)").action(async (commentId, opts) => {
     const client = getClient();
     const body = { comment_text: opts.text };
-    if (opts.assignee !== void 0) body["assignee"] = parseInt(opts.assignee, 10);
+    if (opts.assignee !== void 0) body["assignee"] = parseIntStrict(opts.assignee, "--assignee");
     if (opts.resolved !== void 0) body["resolved"] = opts.resolved === "true";
     await client.put(`/comment/${commentId}`, body);
     process.stdout.write(`Updated comment ${commentId}
@@ -2047,7 +2725,7 @@ function registerCommentCommands(program, getClient) {
   comment.command("reply").description("Reply to a comment (threaded)").argument("<comment-id>", "Comment ID").requiredOption("--text <text>", "Reply text").option("--assignee <id>", "Assignee user ID").option("--notify-all", "Notify all watchers").action(async (commentId, opts) => {
     const client = getClient();
     const body = { comment_text: opts.text };
-    if (opts.assignee !== void 0) body["assignee"] = parseInt(opts.assignee, 10);
+    if (opts.assignee !== void 0) body["assignee"] = parseIntStrict(opts.assignee, "--assignee");
     if (opts.notifyAll) body["notify_all"] = true;
     const data = await client.post(`/comment/${commentId}/thread`, body);
     process.stdout.write(`Created reply ${data["id"] ?? ""}
@@ -2057,85 +2735,6 @@ function registerCommentCommands(program, getClient) {
 
 // src/commands/time-tracking.ts
 init_config();
-
-// src/dates.ts
-var RELATIVE_OFFSET_RE = /^([+-]\d+)([dwmh])$/;
-var UNIX_MS_RE = /^\d{13,}$/;
-var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
-var ISO_DATETIME_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}/;
-var DAY_NAMES = ["sunday", "monday", "tuesday", "wednesday", "thursday", "friday", "saturday"];
-function parseDate(input) {
-  const raw = input.trim();
-  const lower = raw.toLowerCase();
-  if (UNIX_MS_RE.test(raw)) {
-    return parseInt(raw, 10);
-  }
-  const now = /* @__PURE__ */ new Date();
-  switch (lower) {
-    case "today": {
-      return startOfDay(now).getTime();
-    }
-    case "tomorrow": {
-      const d = startOfDay(now);
-      d.setDate(d.getDate() + 1);
-      return d.getTime();
-    }
-    case "yesterday": {
-      const d = startOfDay(now);
-      d.setDate(d.getDate() - 1);
-      return d.getTime();
-    }
-  }
-  const offsetMatch = RELATIVE_OFFSET_RE.exec(lower);
-  if (offsetMatch) {
-    const amount = parseInt(offsetMatch[1], 10);
-    const unit = offsetMatch[2];
-    const ms = unitToMs(unit, amount);
-    return now.getTime() + ms;
-  }
-  if (lower.startsWith("next ")) {
-    const dayName = lower.slice(5);
-    const dayIndex = DAY_NAMES.indexOf(dayName);
-    if (dayIndex !== -1) {
-      const today = now.getDay();
-      let daysAhead = dayIndex - today;
-      if (daysAhead <= 0) daysAhead += 7;
-      const target = startOfDay(now);
-      target.setDate(target.getDate() + daysAhead);
-      return target.getTime();
-    }
-  }
-  if (ISO_DATE_RE.test(raw)) {
-    const d = /* @__PURE__ */ new Date(raw + "T00:00:00");
-    if (!isNaN(d.getTime())) return d.getTime();
-  }
-  if (ISO_DATETIME_RE.test(raw)) {
-    const d = new Date(raw);
-    if (!isNaN(d.getTime())) return d.getTime();
-  }
-  throw new Error(`Unable to parse date: "${input}"`);
-}
-function startOfDay(date) {
-  const d = new Date(date);
-  d.setHours(0, 0, 0, 0);
-  return d;
-}
-function unitToMs(unit, amount) {
-  switch (unit) {
-    case "m":
-      return amount * 60 * 1e3;
-    case "h":
-      return amount * 60 * 60 * 1e3;
-    case "d":
-      return amount * 24 * 60 * 60 * 1e3;
-    case "w":
-      return amount * 7 * 24 * 60 * 60 * 1e3;
-    default:
-      return 0;
-  }
-}
-
-// src/commands/time-tracking.ts
 registerSchema("time", "list", "List time entries for a task or workspace", [
   { flag: "--task-id", type: "string", required: false, description: "Task ID (or use --workspace-id for workspace-wide)" },
   { flag: "--workspace-id", type: "string", required: false, description: "Workspace ID" },
@@ -2166,7 +2765,8 @@ registerSchema("time", "update", "Update a time entry", [
 ]);
 registerSchema("time", "delete", "Delete a time entry", [
   { flag: "--workspace-id", type: "string", required: true, description: "Workspace ID" },
-  { flag: "<timer-id>", type: "string", required: true, description: "Time entry ID" }
+  { flag: "<timer-id>", type: "string", required: true, description: "Time entry ID" },
+  { flag: "--confirm", type: "boolean", required: false, description: "Skip confirmation prompt" }
 ]);
 registerSchema("time", "running", "Get current running timer", [
   { flag: "--workspace-id", type: "string", required: true, description: "Workspace ID" },
@@ -2254,12 +2854,12 @@ function registerTimeTrackingCommands(program, getClient) {
   time.command("create").description("Create a time entry on a task").requiredOption("--task-id <id>", "Task ID").requiredOption("--duration <ms>", "Duration in milliseconds").requiredOption("--start <ts>", "Start time (Unix ms or date string)").option("--description <desc>", "Description").option("--assignee <id>", "Assignee user ID").option("--billable <bool>", "Billable (true/false)").option("--tag <name>", "Tag name (repeatable)", collect2, []).action(async (opts) => {
     const client = getClient();
     const body = {
-      duration: parseInt(opts.duration, 10),
+      duration: parseIntStrict(opts.duration, "--duration"),
       start: String(parseDate(opts.start))
     };
     if (opts.description !== void 0) body["description"] = opts.description;
-    if (opts.assignee !== void 0) body["assignee"] = parseInt(opts.assignee, 10);
-    if (opts.billable !== void 0) body["billable"] = opts.billable === "true";
+    if (opts.assignee !== void 0) body["assignee"] = parseIntStrict(opts.assignee, "--assignee");
+    if (opts.billable !== void 0) body["billable"] = parseBoolStrict(opts.billable, "--billable");
     if (opts.tag.length) body["tags"] = opts.tag.map((t) => ({ name: t }));
     const data = await client.post(`/task/${opts.taskId}/time`, body);
     process.stdout.write(`Created time entry ${data.data?.id ?? ""}
@@ -2271,9 +2871,9 @@ function registerTimeTrackingCommands(program, getClient) {
     const client = getClient();
     const body = {};
     if (opts.description !== void 0) body["description"] = opts.description;
-    if (opts.duration !== void 0) body["duration"] = parseInt(opts.duration, 10);
+    if (opts.duration !== void 0) body["duration"] = parseIntStrict(opts.duration, "--duration");
     if (opts.start !== void 0) body["start"] = String(parseDate(opts.start));
-    if (opts.billable !== void 0) body["billable"] = opts.billable === "true";
+    if (opts.billable !== void 0) body["billable"] = parseBoolStrict(opts.billable, "--billable");
     if (opts.tag.length) {
       body["tags"] = opts.tag.map((t) => ({ name: t }));
       if (opts.tagAction) body["tag_action"] = opts.tagAction;
@@ -2282,10 +2882,23 @@ function registerTimeTrackingCommands(program, getClient) {
     process.stdout.write(`Updated time entry ${timerId}
 `);
   });
-  time.command("delete").description("Delete a time entry").argument("<timer-id>", "Time entry ID").action(async (timerId) => {
+  time.command("delete").description("Delete a time entry").argument("<timer-id>", "Time entry ID").option("--confirm", "Skip confirmation prompt").action(async (timerId, opts) => {
     const workspaceId = requireWorkspaceId4(program);
     if (!workspaceId) return;
     const client = getClient();
+    if (!opts.confirm) {
+      if (!process.stdin.isTTY) {
+        process.stderr.write("Error: Use --confirm to delete in non-interactive mode.\n");
+        process.exit(2);
+        return;
+      }
+      const { confirm } = await import("@inquirer/prompts");
+      const yes = await confirm({ message: `Delete time entry ${timerId}?` });
+      if (!yes) {
+        process.stdout.write("Cancelled.\n");
+        return;
+      }
+    }
     await client.delete(`/team/${workspaceId}/time_entries/${timerId}`);
     process.stdout.write(`Deleted time entry ${timerId}
 `);
@@ -2316,7 +2929,7 @@ function registerTimeTrackingCommands(program, getClient) {
     const client = getClient();
     const body = { tid: opts.taskId };
     if (opts.description !== void 0) body["description"] = opts.description;
-    if (opts.billable !== void 0) body["billable"] = opts.billable === "true";
+    if (opts.billable !== void 0) body["billable"] = parseBoolStrict(opts.billable, "--billable");
     if (opts.tag.length) body["tags"] = opts.tag.map((t) => ({ name: t }));
     const data = await client.post(`/team/${workspaceId}/time_entries/start`, body);
     process.stdout.write(`Started timer ${data.data?.id ?? ""}
@@ -2481,7 +3094,7 @@ function registerGoalCommands(program, getClient) {
     if (opts.dueDate !== void 0) body["due_date"] = opts.dueDate;
     if (opts.description !== void 0) body["description"] = opts.description;
     if (opts.multipleOwners) body["multiple_owners"] = true;
-    if (opts.owner.length) body["owners"] = opts.owner.map((id) => parseInt(id, 10));
+    if (opts.owner.length) body["owners"] = opts.owner.map((id) => parseIntStrict(id, "--owner"));
     if (opts.color !== void 0) body["color"] = opts.color;
     const data = await client.post(`/team/${workspaceId}/goal`, body);
     process.stdout.write(`Created goal ${data.goal?.id ?? ""}
@@ -2520,8 +3133,8 @@ function registerGoalCommands(program, getClient) {
   goal.command("add-key-result").description("Add a key result to a goal").argument("<goal-id>", "Goal ID").requiredOption("--name <name>", "Key result name").requiredOption("--type <type>", "Type (number, currency, boolean, percentage, automatic)").option("--steps-start <n>", "Starting value").option("--steps-end <n>", "Target value").option("--unit <unit>", "Unit label").option("--task-ids <id>", "Task ID (repeatable, for automatic type)", collect3, []).option("--list-ids <id>", "List ID (repeatable, for automatic type)", collect3, []).action(async (goalId, opts) => {
     const client = getClient();
     const body = { name: opts.name, type: opts.type };
-    if (opts.stepsStart !== void 0) body["steps_start"] = parseFloat(opts.stepsStart);
-    if (opts.stepsEnd !== void 0) body["steps_end"] = parseFloat(opts.stepsEnd);
+    if (opts.stepsStart !== void 0) body["steps_start"] = parseFloatStrict(opts.stepsStart, "--steps-start");
+    if (opts.stepsEnd !== void 0) body["steps_end"] = parseFloatStrict(opts.stepsEnd, "--steps-end");
     if (opts.unit !== void 0) body["unit"] = opts.unit;
     if (opts.taskIds.length) body["task_ids"] = opts.taskIds;
     if (opts.listIds.length) body["list_ids"] = opts.listIds;
@@ -2533,7 +3146,7 @@ function registerGoalCommands(program, getClient) {
     const client = getClient();
     const body = {};
     if (opts.name !== void 0) body["name"] = opts.name;
-    if (opts.stepsCurrent !== void 0) body["steps_current"] = parseFloat(opts.stepsCurrent);
+    if (opts.stepsCurrent !== void 0) body["steps_current"] = parseFloatStrict(opts.stepsCurrent, "--steps-current");
     if (opts.note !== void 0) body["note"] = opts.note;
     await client.put(`/key_result/${keyResultId}`, body);
     process.stdout.write(`Updated key result ${keyResultId}
@@ -2561,6 +3174,7 @@ function registerGoalCommands(program, getClient) {
 }
 
 // src/commands/view.ts
+init_config();
 registerSchema("view", "list", "List views for a workspace, space, folder, or list", [
   { flag: "--workspace-id", type: "string", required: false, description: "Workspace ID (provide one parent)" },
   { flag: "--space-id", type: "string", required: false, description: "Space ID (provide one parent)" },
@@ -2613,6 +3227,10 @@ function resolveViewParent(opts, program) {
   if (opts.spaceId) parents.push({ segment: "space", id: opts.spaceId });
   if (opts.folderId) parents.push({ segment: "folder", id: opts.folderId });
   if (opts.listId) parents.push({ segment: "list", id: opts.listId });
+  if (parents.length === 0) {
+    const resolvedWsId = resolveWorkspaceId(void 0);
+    if (resolvedWsId) parents.push({ segment: "team", id: resolvedWsId });
+  }
   if (parents.length === 0) {
     process.stderr.write("Error: Provide one of --workspace-id, --space-id, --folder-id, or --list-id.\n");
     process.exit(2);
@@ -2816,6 +3434,11 @@ function registerWebhookCommands(program, getClient) {
 `);
   });
   webhook.command("update").description("Update a webhook").argument("<webhook-id>", "Webhook ID").option("--endpoint <url>", "New endpoint URL").option("--event <event>", "Event to subscribe to (repeatable, replaces existing)", collect4, []).option("--status <status>", "Status (active or inactive)").action(async (webhookId, opts) => {
+    if (opts.status !== void 0 && opts.status !== "active" && opts.status !== "inactive") {
+      process.stderr.write('Error: --status must be "active" or "inactive".\n');
+      process.exit(2);
+      return;
+    }
     const client = getClient();
     const body = {};
     if (opts.endpoint !== void 0) body["endpoint"] = opts.endpoint;
@@ -2917,7 +3540,7 @@ function registerUserCommands(program, getClient) {
     const body = {};
     if (opts.username !== void 0) body["username"] = opts.username;
     if (opts.admin !== void 0) body["admin"] = opts.admin === "true";
-    if (opts.customRoleId !== void 0) body["custom_role_id"] = parseInt(opts.customRoleId, 10);
+    if (opts.customRoleId !== void 0) body["custom_role_id"] = parseIntStrict(opts.customRoleId, "--custom-role-id");
     await client.put(`/team/${workspaceId}/user/${userId}`, body);
     process.stdout.write(`Updated user ${userId}
 `);
@@ -3006,7 +3629,7 @@ function registerGroupCommands(program, getClient) {
     const client = getClient();
     const body = { name: opts.name };
     if (opts.memberId.length) {
-      body["members"] = opts.memberId.map((id) => ({ id: parseInt(id, 10) }));
+      body["members"] = opts.memberId.map((id) => ({ id: parseIntStrict(id, "--member-id") }));
     }
     const data = await client.post(`/team/${workspaceId}/group`, body);
     process.stdout.write(`Created group ${data["id"] ?? ""}
@@ -3017,8 +3640,8 @@ function registerGroupCommands(program, getClient) {
     const body = {};
     if (opts.name !== void 0) body["name"] = opts.name;
     const members = {};
-    if (opts.addMember.length) members["add"] = opts.addMember.map((id) => ({ id: parseInt(id, 10) }));
-    if (opts.removeMember.length) members["rem"] = opts.removeMember.map((id) => ({ id: parseInt(id, 10) }));
+    if (opts.addMember.length) members["add"] = opts.addMember.map((id) => ({ id: parseIntStrict(id, "--add-member") }));
+    if (opts.removeMember.length) members["rem"] = opts.removeMember.map((id) => ({ id: parseIntStrict(id, "--remove-member") }));
     if (Object.keys(members).length) body["members"] = members;
     await client.put(`/group/${groupId}`, body);
     process.stdout.write(`Updated group ${groupId}
@@ -3069,6 +3692,15 @@ function parseBool(val) {
   if (val === void 0) return void 0;
   return val === "true";
 }
+var PERMISSION_LEVELS = ["read", "comment", "edit", "create"];
+function requirePermission(level) {
+  if (!PERMISSION_LEVELS.includes(level)) {
+    process.stderr.write(`Error: --permission must be one of: ${PERMISSION_LEVELS.join(", ")}
+`);
+    process.exit(2);
+  }
+  return level;
+}
 registerSchema("guest", "invite", "Invite a guest to a workspace", [
   { flag: "--workspace-id", type: "string", required: true, description: "Workspace ID" },
   { flag: "--email", type: "string", required: true, description: "Email address to invite" },
@@ -3183,7 +3815,7 @@ function registerGuestCommands(program, getClient) {
   });
   guest.command("add-to-task").description("Add a guest to a task").argument("<guest-id>", "Guest ID").requiredOption("--task-id <id>", "Task ID").requiredOption("--permission <level>", "Permission level (read, comment, edit, create)").action(async (guestId, opts) => {
     const client = getClient();
-    await client.post(`/task/${opts.taskId}/guest/${guestId}`, { permission_level: opts.permission });
+    await client.post(`/task/${opts.taskId}/guest/${guestId}`, { permission_level: requirePermission(opts.permission) });
     process.stdout.write(`Added guest ${guestId} to task ${opts.taskId}
 `);
   });
@@ -3195,7 +3827,7 @@ function registerGuestCommands(program, getClient) {
   });
   guest.command("add-to-list").description("Add a guest to a list").argument("<guest-id>", "Guest ID").requiredOption("--list-id <id>", "List ID").requiredOption("--permission <level>", "Permission level (read, comment, edit, create)").action(async (guestId, opts) => {
     const client = getClient();
-    await client.post(`/list/${opts.listId}/guest/${guestId}`, { permission_level: opts.permission });
+    await client.post(`/list/${opts.listId}/guest/${guestId}`, { permission_level: requirePermission(opts.permission) });
     process.stdout.write(`Added guest ${guestId} to list ${opts.listId}
 `);
   });
@@ -3207,7 +3839,7 @@ function registerGuestCommands(program, getClient) {
   });
   guest.command("add-to-folder").description("Add a guest to a folder").argument("<guest-id>", "Guest ID").requiredOption("--folder-id <id>", "Folder ID").requiredOption("--permission <level>", "Permission level (read, comment, edit, create)").action(async (guestId, opts) => {
     const client = getClient();
-    await client.post(`/folder/${opts.folderId}/guest/${guestId}`, { permission_level: opts.permission });
+    await client.post(`/folder/${opts.folderId}/guest/${guestId}`, { permission_level: requirePermission(opts.permission) });
     process.stdout.write(`Added guest ${guestId} to folder ${opts.folderId}
 `);
   });
@@ -3373,9 +4005,25 @@ registerSchema("template", "list", "List task templates in a workspace", [
   { flag: "--workspace-id", type: "string", required: true, description: "Workspace ID" },
   { flag: "--page", type: "integer", required: false, description: "Page number (starts at 0)" }
 ]);
+registerSchema("template", "apply-task", "Create a task from a task template", [
+  { flag: "--list-id", type: "string", required: true, description: "List to create the task in" },
+  { flag: "--template-id", type: "string", required: true, description: "Template ID to apply" },
+  { flag: "--name", type: "string", required: false, description: "Override the template name" }
+]);
+registerSchema("template", "apply-list", "Create a list from a list template", [
+  { flag: "--template-id", type: "string", required: true, description: "Template ID to apply" },
+  { flag: "--folder-id", type: "string", required: false, description: "Folder to create the list in (use this or --space-id)" },
+  { flag: "--space-id", type: "string", required: false, description: "Space to create the list in (use this or --folder-id)" },
+  { flag: "--name", type: "string", required: false, description: "Override the template name" }
+]);
+registerSchema("template", "apply-folder", "Create a folder from a folder template", [
+  { flag: "--space-id", type: "string", required: true, description: "Space to create the folder in" },
+  { flag: "--template-id", type: "string", required: true, description: "Template ID to apply" },
+  { flag: "--name", type: "string", required: false, description: "Override the template name" }
+]);
 function registerTemplateCommands(program, getClient) {
   const template = program.command("template").description("Manage task templates");
-  template.command("list").description("List task templates").option("--page <n>", "Page number (starts at 0)", parseInt).action(async (opts) => {
+  template.command("list").description("List task templates").option("--page <n>", "Page number (starts at 0)", intArg("--page")).action(async (opts) => {
     const workspaceId = requireWorkspaceId11(program);
     if (!workspaceId) return;
     const client = getClient();
@@ -3384,6 +4032,39 @@ function registerTemplateCommands(program, getClient) {
     const data = await client.get(`/team/${workspaceId}/taskTemplate`, params);
     formatOutput(data.templates, TEMPLATE_COLUMNS, getOutputOptions(program));
   });
+  template.command("apply-task").description("Create a task from a task template").requiredOption("--list-id <id>", "List to create the task in").requiredOption("--template-id <id>", "Template ID to apply").option("--name <name>", "Override the template name").action(async (opts) => {
+    const client = getClient();
+    const body = {};
+    if (opts.name !== void 0) body["name"] = opts.name;
+    const data = await client.post(
+      `/list/${opts.listId}/taskTemplate/${opts.templateId}`,
+      body
+    );
+    formatOutput([data], TEMPLATE_COLUMNS, getOutputOptions(program));
+  });
+  template.command("apply-list").description("Create a list from a list template").requiredOption("--template-id <id>", "Template ID to apply").option("--folder-id <id>", "Folder to create the list in").option("--space-id <id>", "Space to create the list in (folderless)").option("--name <name>", "Override the template name").action(async (opts) => {
+    if (!opts.folderId && !opts.spaceId) {
+      process.stderr.write("Error: Provide either --folder-id or --space-id\n");
+      process.exit(2);
+      return;
+    }
+    const client = getClient();
+    const body = {};
+    if (opts.name !== void 0) body["name"] = opts.name;
+    const path = opts.folderId ? `/folder/${opts.folderId}/listTemplate/${opts.templateId}` : `/space/${opts.spaceId}/listTemplate/${opts.templateId}`;
+    const data = await client.post(path, body);
+    formatOutput([data], TEMPLATE_COLUMNS, getOutputOptions(program));
+  });
+  template.command("apply-folder").description("Create a folder from a folder template").requiredOption("--space-id <id>", "Space to create the folder in").requiredOption("--template-id <id>", "Template ID to apply").option("--name <name>", "Override the template name").action(async (opts) => {
+    const client = getClient();
+    const body = {};
+    if (opts.name !== void 0) body["name"] = opts.name;
+    const data = await client.post(
+      `/space/${opts.spaceId}/folderTemplate/${opts.templateId}`,
+      body
+    );
+    formatOutput([data], TEMPLATE_COLUMNS, getOutputOptions(program));
+  });
 }
 
 // src/commands/task-type.ts
@@ -3631,7 +4312,7 @@ function registerDocCommands(program, getClient) {
     const data = await client.get(`/v3/workspaces/${workspaceId}/docs/${opts.docId}`);
     formatOutput(data, DOC_COLUMNS, getOutputOptions(program));
   });
-  doc.command("create").description("Create a doc").requiredOption("--name <name>", "Doc name").option("--parent-id <id>", "Parent ID").option("--parent-type <type>", "Parent type (4=space, 5=folder, 6=list, 7=task)", parseInt).option("--visibility <visibility>", "Visibility (private, workspace)").action(async (opts) => {
+  doc.command("create").description("Create a doc").requiredOption("--name <name>", "Doc name").option("--parent-id <id>", "Parent ID").option("--parent-type <type>", "Parent type (4=space, 5=folder, 6=list, 7=task)", enumIntArg("--parent-type", [4, 5, 6, 7])).option("--visibility <visibility>", "Visibility (private, workspace)").action(async (opts) => {
     const workspaceId = requireWorkspaceId14(program);
     if (!workspaceId) return;
     const client = getClient();
@@ -3729,8 +4410,8 @@ function registerDocCommands(program, getClient) {
 }
 
 // src/commands/skill-cmd.ts
-import { readdirSync, readFileSync as readFileSync2, existsSync } from "fs";
-import { join, dirname } from "path";
+import { readdirSync, readFileSync as readFileSync4, existsSync as existsSync3 } from "fs";
+import { join as join2, dirname } from "path";
 import { fileURLToPath } from "url";
 var SKILL_COLUMNS = [
   { key: "name", header: "Name", width: 28 },
@@ -3746,10 +4427,10 @@ registerSchema("skill", "path", "Print the file system path to a skill directory
 ]);
 function findSkillsDir() {
   const thisDir = dirname(fileURLToPath(import.meta.url));
-  const bundledDir = join(thisDir, "..", "skills");
-  if (existsSync(bundledDir)) return bundledDir;
-  const projectDir = join(thisDir, "..", "..", "skills");
-  if (existsSync(projectDir)) return projectDir;
+  const bundledDir = join2(thisDir, "..", "skills");
+  if (existsSync3(bundledDir)) return bundledDir;
+  const projectDir = join2(thisDir, "..", "..", "skills");
+  if (existsSync3(projectDir)) return projectDir;
   return void 0;
 }
 function parseFrontmatter(content) {
@@ -3789,16 +4470,16 @@ function loadSkills(skillsDir) {
     return skills;
   }
   for (const entry of entries) {
-    const skillFile = join(skillsDir, entry, "SKILL.md");
-    if (!existsSync(skillFile)) continue;
+    const skillFile = join2(skillsDir, entry, "SKILL.md");
+    if (!existsSync3(skillFile)) continue;
     try {
-      const content = readFileSync2(skillFile, "utf-8");
+      const content = readFileSync4(skillFile, "utf-8");
       const { frontmatter } = parseFrontmatter(content);
       skills.push({
         name: frontmatter["name"] || entry,
         description: (frontmatter["description"] || "").slice(0, 100),
         type: classifySkill(frontmatter),
-        path: join(skillsDir, entry),
+        path: join2(skillsDir, entry),
         frontmatter
       });
     } catch {
@@ -3813,11 +4494,11 @@ function loadSkills(skillsDir) {
   });
 }
 function findSkill(skillsDir, name) {
-  const skillDir = join(skillsDir, name);
-  const skillFile = join(skillDir, "SKILL.md");
-  if (!existsSync(skillFile)) return void 0;
+  const skillDir = join2(skillsDir, name);
+  const skillFile = join2(skillDir, "SKILL.md");
+  if (!existsSync3(skillFile)) return void 0;
   try {
-    const content = readFileSync2(skillFile, "utf-8");
+    const content = readFileSync4(skillFile, "utf-8");
     return { skillDir, content };
   } catch {
     return void 0;
@@ -3945,15 +4626,20 @@ function registerChatCommands(program, getClient) {
 }
 
 // src/cli.ts
-var VERSION = "0.2.0";
+var VERSION = "0.4.0";
 function createProgram() {
   const program = new Command();
-  program.name("clickup").description("ClickUp CLI - Manage ClickUp workspaces from the terminal").version(VERSION).option("--token <token>", "API token").option("--workspace-id <id>", "Workspace ID").option("--format <format>", "Output format (table|json|csv|tsv|quiet|id|md)").option("--no-color", "Disable colors").option("--no-header", "Omit column headers").option("--fields <fields>", "Show only specified fields (comma-separated)").option("--filter <filter>", "Client-side filter (key=value)").option("--sort <sort>", "Sort by field (field[:asc|:desc])").option("--limit <n>", "Limit results", parseInt).option("--verbose", "Show request details").option("--debug", "Full debug output").option("--dry-run", "Print what would be sent without executing");
+  program.name("clickup").description("ClickUp CLI - Manage ClickUp workspaces from the terminal").version(VERSION).option("--token <token>", "API token").option("--token-file <path>", "Read API token from this file path").option("--profile <name>", "Profile to use (key, workspace name, or nickname)").option("--workspace-id <id>", "Workspace ID").addOption(
+    new Option("--format <format>", "Output format").choices(["table", "json", "csv", "tsv", "quiet", "id", "md"])
+  ).option("--no-color", "Disable colors").option("--no-header", "Omit column headers").option("--fields <fields>", "Show only specified fields (comma-separated)").option("--filter <filter>", "Client-side filter (key=value)").option("--sort <sort>", "Sort by field (field[:asc|:desc])").option("--limit <n>", "Limit results", intArg("--limit")).option("--verbose", "Show request details").option("--debug", "Full debug output").option("--dry-run", "Print what would be sent without executing");
   return program;
 }
 function createClient(program) {
   const globalOpts = program.opts();
-  const token = resolveToken(globalOpts["token"]);
+  const token = resolveToken(
+    globalOpts["token"],
+    globalOpts["tokenFile"]
+  );
   if (!token) {
     process.stderr.write("Error: No API token found. Run: clickup auth login\n");
     process.exit(EXIT_CODES.AUTH_FAILURE);
@@ -3982,9 +4668,15 @@ function getOutputOptions(program) {
   return result;
 }
 function run() {
+  process.stdout.on("error", (err) => {
+    if (err.code === "EPIPE") process.exit(EXIT_CODES.SUCCESS);
+  });
   const program = createProgram();
+  program.hook("preAction", () => {
+    setProfileOverride(program.opts()["profile"]);
+  });
   registerAuthCommands(program, () => createClient(program));
-  registerConfigCommands(program);
+  registerConfigCommands(program, () => createClient(program));
   registerWorkspaceCommands(program, () => createClient(program));
   registerSpaceCommands(program, () => createClient(program));
   registerFolderCommands(program, () => createClient(program));
@@ -4014,6 +4706,9 @@ function run() {
   registerSchemaCommands(program);
   registerSkillCommands(program);
   program.parseAsync(process.argv).catch((error) => {
+    if (error instanceof DryRunComplete) {
+      process.exit(EXIT_CODES.SUCCESS);
+    }
     if (error instanceof ClickUpError) {
       process.stderr.write(`Error: ${error.message}
 `);