coolhand-cli 0.10.0 → 0.11.1

package/README.md

@@ -83,6 +83,8 @@ coolhand close-optimization opt-123 "Added the suggested index; verified query l
 | `coolhand list-workloads` | List workloads with optional search and pagination |
 | `coolhand get-workload` | Fetch a single workload by ID |
 | `coolhand update-workload` | Update a workload's name and/or description |
+| `coolhand search-templates` | List and search LLM request templates |
+| `coolhand get-template` | Fetch a single template by ID, with its prompt patterns |
 | `coolhand search-optimizations` | List and filter optimization records |
 | `coolhand get-optimization` | Fetch a single optimization by ID |
 | `coolhand update-optimization` | Update an optimization's fields |
@@ -91,9 +93,12 @@ coolhand close-optimization opt-123 "Added the suggested index; verified query l
 | `coolhand get-feedback` | Fetch a single feedback record by ID |
 | `coolhand fetch-log` | Fetch the input/output content of a single LLM request log |
 | `coolhand search-logs` | Search LLM request logs with flexible filters |
+| `coolhand search-referenced-files` | List a client's referenced files, aggregated and ranked by reference count |
+| `coolhand list-referenced-file-sessions` | List the raw sessions that referenced one exact file path |
 | `coolhand analyze-claude-sessions` | Submit Claude sessions for pattern and cost analysis |
 | `coolhand map-claude-projects` | Upload a file-tree map (names + metadata only) of every folder named "claude" |
 | `coolhand upload-client-file` | Upload a local file to Coolhand as a client file |
+| `coolhand sync-skills` | Upload locally-built Claude skills (SKILL.md files) to Coolhand as client files |
 | `coolhand wildcard` | Record an agent blocker and exit cleanly |
 
 See [docs/commands.md](./docs/commands.md) for full flag reference and usage notes.
@@ -101,6 +106,7 @@ See [docs/commands.md](./docs/commands.md) for full flag reference and usage not
 ## Security
 
 - The callback listener binds to `127.0.0.1` only — never reachable from the LAN.
+- The MITM proxy started by `coolhand claude`/`coolhand monitor` also binds to `127.0.0.1` only — never reachable from the LAN.
 - Tokens are delivered through a one-shot localhost redirect; subsequent calls to the listener get `410 Gone`.
 - CSRF protection: every login generates a random `state` value verified with `crypto.timingSafeEqual` before any token is accepted.
 - `~/.coolhand/config.json` is written atomically with mode `0o600`; the parent directory is `0o700`.
@@ -165,6 +171,7 @@ Located at `$HOME/.coolhand/config.json` (override with `COOLHAND_CONFIG_DIR` fo
 - [Auth Flow](./docs/auth-flow.md) — browser-callback sequence, state machine, timeout and error paths
 - [Configuration File](./docs/config-file.md) — full config schema, multi-client model, `COOLHAND_CONFIG_DIR` override
 - [Session Capture](./docs/session-capture.md) — session scanning, envelope format, deduplication, scope and limitations
+- [Skill Capture](./docs/skill-capture.md) — skill discovery, dedup, and incremental upload logic for `sync-skills`
 
 ## About Coolhand Labs
 

package/dist/api/last-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"last-sync.d.ts","sourceRoot":"","sources":["../../src/api/last-sync.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,aAAa,CAAC,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAmE1F"}
+{"version":3,"file":"last-sync.d.ts","sourceRoot":"","sources":["../../src/api/last-sync.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,aAAa,CAAC,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAqE1F"}

package/dist/api/last-sync.js

@@ -55,6 +55,8 @@ export async function fetchLastSync(opts = {}) {
         res = await fetch(url, {
             method: 'GET',
             headers: { Accept: 'application/json', 'X-API-Key': apiKey },
+            // Never follow redirects: fetch would forward X-API-Key to the redirect target.
+            redirect: 'error',
         });
     }
     catch {

package/dist/api/last-sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"last-sync.js","sourceRoot":"","sources":["../../src/api/last-sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA8B,EAAE;IAClE,IAAI,MAA0B,CAAC;IAC/B,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,GAAG,MAAM,EAAE,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACjE,OAAO,GAAG,MAAM,EAAE,QAAQ,IAAI,gBAAgB,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,0BAA0B,EAAE,aAAa,CAAC,CAAC;QACpE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,EAAE,aAAa,CAAC,CAAC;QAC/D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACrD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtC,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,6EAA6E;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,wCAAwC;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAI,MAAmC,CAAC,UAAU,CAAC;IAClE,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC"}
+{"version":3,"file":"last-sync.js","sourceRoot":"","sources":["../../src/api/last-sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA8B,EAAE;IAClE,IAAI,MAA0B,CAAC;IAC/B,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,GAAG,MAAM,EAAE,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACjE,OAAO,GAAG,MAAM,EAAE,QAAQ,IAAI,gBAAgB,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,0BAA0B,EAAE,aAAa,CAAC,CAAC;QACpE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,EAAE,aAAa,CAAC,CAAC;QAC/D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACrD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtC,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,EAAE;YAC5D,gFAAgF;YAChF,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,6EAA6E;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,wCAAwC;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAI,MAAmC,CAAC,UAAU,CAAC;IAClE,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC"}

package/dist/api/llm-reference-client.d.ts

@@ -0,0 +1,25 @@
+import { Coolhand } from 'coolhand-node';
+import { CliError } from '../errors.js';
+/**
+ * Resolves the CLI's stored client and returns a `Coolhand` instance authenticated with its
+ * *private* key. `searchReferencedFiles`/`listReferencedFileSessions` require the private key —
+ * the public key used for LLM capture is write-only on this API and 401s here.
+ */
+export declare function getLlmReferenceClient(opts?: {
+    clientId?: string;
+}): Promise<Coolhand>;
+/**
+ * Maps an error thrown by `Coolhand#searchReferencedFiles`/`listReferencedFileSessions` to a
+ * `CliError` — a 401 means the stored private key was rejected (mirrors `log-client.ts`'s hint), a
+ * 504 means the query exceeded the backend's statement timeout and is retryable, not a bug. Any
+ * other status (e.g. 422 for an unrecognized filter or non-scalar param) surfaces the server's own
+ * message rather than swallowing it.
+ *
+ * Both endpoints can 504 — `searchReferencedFiles` on its GROUP BY aggregate, and
+ * `listReferencedFileSessions` on the pagination `COUNT(*)` for a very hot `file_path` — but they
+ * have different flags to retry with, so `timeoutHint` is caller-supplied (same shape as
+ * `mapFeedbackHttpError`'s `notFoundMessage`). Suggesting a flag the invoking command doesn't
+ * define would be a silent no-op: the arg parser accepts unknown flags without complaint.
+ */
+export declare function mapLlmReferenceHttpError(err: unknown, timeoutHint: string): CliError;
+//# sourceMappingURL=llm-reference-client.d.ts.map

package/dist/api/llm-reference-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-reference-client.d.ts","sourceRoot":"","sources":["../../src/api/llm-reference-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAa,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoB/F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,GAAG,QAAQ,CAkBpF"}

package/dist/api/llm-reference-client.js

@@ -0,0 +1,49 @@
+import { Coolhand, HttpError } from 'coolhand-node';
+import { CliError } from '../errors.js';
+import { loadConfig, resolveClient } from '../config.js';
+/**
+ * Resolves the CLI's stored client and returns a `Coolhand` instance authenticated with its
+ * *private* key. `searchReferencedFiles`/`listReferencedFileSessions` require the private key —
+ * the public key used for LLM capture is write-only on this API and 401s here.
+ */
+export async function getLlmReferenceClient(opts = {}) {
+    const cfg = await loadConfig();
+    const client = await resolveClient(cfg, opts.clientId);
+    if (!client.private_key) {
+        throw new CliError('NO_PRIVATE_KEY', "No private key configured. Run 'coolhand login --scope private' first.");
+    }
+    try {
+        // Coolhand validates baseUrl in its constructor (https required; http only for localhost).
+        return new Coolhand({ apiKey: client.private_key, baseUrl: client.base_url, silent: true });
+    }
+    catch (err) {
+        throw new CliError('INVALID_BASE_URL', `Invalid base_url for client: ${client.base_url} (${err.message})`);
+    }
+}
+/**
+ * Maps an error thrown by `Coolhand#searchReferencedFiles`/`listReferencedFileSessions` to a
+ * `CliError` — a 401 means the stored private key was rejected (mirrors `log-client.ts`'s hint), a
+ * 504 means the query exceeded the backend's statement timeout and is retryable, not a bug. Any
+ * other status (e.g. 422 for an unrecognized filter or non-scalar param) surfaces the server's own
+ * message rather than swallowing it.
+ *
+ * Both endpoints can 504 — `searchReferencedFiles` on its GROUP BY aggregate, and
+ * `listReferencedFileSessions` on the pagination `COUNT(*)` for a very hot `file_path` — but they
+ * have different flags to retry with, so `timeoutHint` is caller-supplied (same shape as
+ * `mapFeedbackHttpError`'s `notFoundMessage`). Suggesting a flag the invoking command doesn't
+ * define would be a silent no-op: the arg parser accepts unknown flags without complaint.
+ */
+export function mapLlmReferenceHttpError(err, timeoutHint) {
+    if (err instanceof HttpError) {
+        if (err.status === 401) {
+            return new CliError('LLM_REFERENCE_ERROR', "The stored private key was rejected. Run 'coolhand login --scope private' to re-authenticate.");
+        }
+        if (err.status === 504) {
+            return new CliError('LLM_REFERENCE_ERROR', `Referenced file request timed out (504): the query exceeded the backend's statement ` +
+                `timeout. This is retryable — ${timeoutHint}.`);
+        }
+        return new CliError('LLM_REFERENCE_ERROR', `Referenced file request failed (${err.status}): ${err.message}`);
+    }
+    return new CliError('LLM_REFERENCE_ERROR', `Referenced file request failed: ${err.message}`);
+}
+//# sourceMappingURL=llm-reference-client.js.map

package/dist/api/llm-reference-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-reference-client.js","sourceRoot":"","sources":["../../src/api/llm-reference-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAA8B,EAAE;IAC1E,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEvD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,wEAAwE,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,2FAA2F;QAC3F,OAAO,IAAI,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,gCAAgC,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,GAAG,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAY,EAAE,WAAmB;IACxE,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,QAAQ,CACjB,qBAAqB,EACrB,+FAA+F,CAChG,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,QAAQ,CACjB,qBAAqB,EACrB,sFAAsF;gBACpF,gCAAgC,WAAW,GAAG,CACjD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,mCAAmC,GAAG,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,mCAAoC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;AAC1G,CAAC"}

package/dist/api/template-client.d.ts

@@ -0,0 +1,19 @@
+import { Coolhand } from 'coolhand-node';
+import { CliError } from '../errors.js';
+/**
+ * Resolves the CLI's stored client and returns a `Coolhand` instance authenticated with its
+ * *private* key. `searchTemplates`/`getTemplate` require the private key — the public key used by
+ * `monitor`/`logRequest` is write-only on this API and will 401 here.
+ */
+export declare function getTemplateClient(opts?: {
+    clientId?: string;
+}): Promise<Coolhand>;
+/**
+ * Maps an error thrown by `Coolhand#searchTemplates`/`getTemplate` to a `CliError`.
+ *
+ * A `504` is not a crash: both endpoints aggregate `log_count` over `llm_request_logs` under a
+ * 10-second statement timeout, so a slow aggregate is expected and retryable. `timeoutHint` is the
+ * caller's advice for making the same call cheaper, which differs between list and show.
+ */
+export declare function mapTemplateHttpError(err: unknown, notFoundMessage: string, timeoutHint: string): CliError;
+//# sourceMappingURL=template-client.d.ts.map

package/dist/api/template-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-client.d.ts","sourceRoot":"","sources":["../../src/api/template-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAa,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoB3F;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,GAClB,QAAQ,CAsBV"}

package/dist/api/template-client.js

@@ -0,0 +1,47 @@
+import { Coolhand, HttpError } from 'coolhand-node';
+import { CliError } from '../errors.js';
+import { loadConfig, resolveClient } from '../config.js';
+/**
+ * Resolves the CLI's stored client and returns a `Coolhand` instance authenticated with its
+ * *private* key. `searchTemplates`/`getTemplate` require the private key — the public key used by
+ * `monitor`/`logRequest` is write-only on this API and will 401 here.
+ */
+export async function getTemplateClient(opts = {}) {
+    const cfg = await loadConfig();
+    const client = await resolveClient(cfg, opts.clientId);
+    if (!client.private_key) {
+        throw new CliError('NO_PRIVATE_KEY', "No private key configured. Run 'coolhand login --scope private' first.");
+    }
+    try {
+        // Coolhand validates baseUrl in its constructor (https required; http only for localhost).
+        return new Coolhand({ apiKey: client.private_key, baseUrl: client.base_url, silent: true });
+    }
+    catch (err) {
+        throw new CliError('INVALID_BASE_URL', `Invalid base_url for client: ${client.base_url} (${err.message})`);
+    }
+}
+/**
+ * Maps an error thrown by `Coolhand#searchTemplates`/`getTemplate` to a `CliError`.
+ *
+ * A `504` is not a crash: both endpoints aggregate `log_count` over `llm_request_logs` under a
+ * 10-second statement timeout, so a slow aggregate is expected and retryable. `timeoutHint` is the
+ * caller's advice for making the same call cheaper, which differs between list and show.
+ */
+export function mapTemplateHttpError(err, notFoundMessage, timeoutHint) {
+    if (err instanceof HttpError) {
+        if (err.status === 401) {
+            return new CliError('TEMPLATE_ERROR', "The stored private key was rejected. Run 'coolhand login --scope private' to re-authenticate.");
+        }
+        if (err.status === 404) {
+            return new CliError('TEMPLATE_ERROR', notFoundMessage);
+        }
+        if (err.status === 504) {
+            return new CliError('TEMPLATE_ERROR', `The server timed out counting logs (log_count) for this request. ${timeoutHint}`);
+        }
+        // coolhand-node already formats this as `Template request failed (<status>): <body>`;
+        // re-prefixing it here would print the status twice.
+        return new CliError('TEMPLATE_ERROR', err.message);
+    }
+    return new CliError('TEMPLATE_ERROR', `Template request failed: ${err.message}`);
+}
+//# sourceMappingURL=template-client.js.map

package/dist/api/template-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-client.js","sourceRoot":"","sources":["../../src/api/template-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA8B,EAAE;IACtE,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEvD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,wEAAwE,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,2FAA2F;QAC3F,OAAO,IAAI,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,gCAAgC,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,GAAG,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAY,EACZ,eAAuB,EACvB,WAAmB;IAEnB,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,QAAQ,CACjB,gBAAgB,EAChB,+FAA+F,CAChG,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,QAAQ,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,QAAQ,CACjB,gBAAgB,EAChB,oEAAoE,WAAW,EAAE,CAClF,CAAC;QACJ,CAAC;QACD,sFAAsF;QACtF,qDAAqD;QACrD,OAAO,IAAI,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,gBAAgB,EAAE,4BAA6B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;AAC9F,CAAC"}

package/dist/auth/open-browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"open-browser.d.ts","sourceRoot":"","sources":["../../src/auth/open-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAGtC,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BxF"}
+{"version":3,"file":"open-browser.d.ts","sourceRoot":"","sources":["../../src/auth/open-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAItC,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BxF"}

package/dist/auth/open-browser.js

@@ -1,5 +1,6 @@
 import { spawn } from 'child_process';
 import { logger } from '../logger.js';
+import { resolveWrapSpawn } from '../win-spawn.js';
 export async function openBrowser(url, deps = {}) {
     const platform = deps.platform ?? process.platform;
     const spawnFn = deps.spawnFn ?? spawn;
@@ -17,8 +18,9 @@ export async function openBrowser(url, deps = {}) {
         command = 'xdg-open';
         args = [url];
     }
+    const { cmd, spawnArgs, windowsVerbatimArguments } = resolveWrapSpawn(command, args, platform);
     try {
-        const child = spawnFn(command, args, { detached: true, stdio: 'ignore' });
+        const child = spawnFn(cmd, spawnArgs, { detached: true, stdio: 'ignore', windowsVerbatimArguments });
         child.on('error', (err) => {
             logger.warn(`Failed to open browser (${command}): ${err.message}. Open the URL manually.`);
         });

package/dist/auth/open-browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"open-browser.js","sourceRoot":"","sources":["../../src/auth/open-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAOtC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAwB,EAAE;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IAEtC,IAAI,OAAe,CAAC;IACpB,IAAI,IAAc,CAAC;IACnB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,MAAM,CAAC;QACjB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,GAAG,KAAK,CAAC;QAChB,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,UAAU,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,MAAM,CAAC,IAAI,CAAC,2BAA2B,OAAO,MAAM,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,6BAA6B,OAAO,MAAO,GAAa,CAAC,OAAO,0BAA0B,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC"}
+{"version":3,"file":"open-browser.js","sourceRoot":"","sources":["../../src/auth/open-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAOnD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAwB,EAAE;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IAEtC,IAAI,OAAe,CAAC;IACpB,IAAI,IAAc,CAAC;IACnB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,MAAM,CAAC;QACjB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,GAAG,KAAK,CAAC;QAChB,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,UAAU,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,wBAAwB,EAAE,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE/F,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACrG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,MAAM,CAAC,IAAI,CAAC,2BAA2B,OAAO,MAAM,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,6BAA6B,OAAO,MAAO,GAAa,CAAC,OAAO,0BAA0B,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAmDA,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;CACpD;AAmVD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAgE7F;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAiDpD;AAwnBD,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA8IzD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AA6DA,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;CACpD;AAmZD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAgE7F;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAiDpD;AA6xBD,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAwJzD"}

package/dist/cli.js

@@ -16,19 +16,24 @@ import { run as runMonitor } from './commands/monitor.js';
 import { run as runAnalyzeClaudeSessions } from './commands/analyze-claude-sessions.js';
 import { run as runMapClaudeProjects } from './commands/map-claude-projects.js';
 import { run as runUploadClientFile } from './commands/upload-client-file.js';
+import { run as runSyncSkills } from './commands/sync-skills.js';
 import { run as runListWorkloads } from './commands/list-workloads.js';
 import { run as runGetWorkload } from './commands/get-workload.js';
 import { run as runUpdateWorkload } from './commands/update-workload.js';
 import { run as runFetchLog } from './commands/fetch-log.js';
 import { run as runSearchLogs } from './commands/search-logs.js';
+import { run as runSearchTemplates } from './commands/search-templates.js';
+import { run as runGetTemplate } from './commands/get-template.js';
 import { run as runFlushPending, spawnBackgroundFlush } from './commands/flush-pending.js';
 import { run as runSearchFeedback } from './commands/search-feedback.js';
 import { run as runGetFeedback } from './commands/get-feedback.js';
+import { run as runSearchReferencedFiles } from './commands/search-referenced-files.js';
+import { run as runListReferencedFileSessions } from './commands/list-referenced-file-sessions.js';
 import { countPending, flushFailed } from './pending-store.js';
 import { confirm } from './prompt.js';
-const BOOLEAN_FLAGS = new Set(['all', 'help', 'h', 'json', 'version', 'v', 'dry-run', 'include-archived', 'include-system', 'include-templates', 'full', 'matched', 'unmatched', 'include-thinking', 'unmatched-only', 'include-prompts']);
+const BOOLEAN_FLAGS = new Set(['all', 'help', 'h', 'json', 'version', 'v', 'dry-run', 'include-archived', 'include-system', 'include-templates', 'full', 'matched', 'unmatched', 'include-thinking', 'unmatched-only', 'include-prompts', 'include-deprecated', 'force']);
 /** Flags whose repeated occurrences accumulate into an array instead of overwriting. */
-const REPEATABLE_FLAGS = new Set(['project', 'exclude-project']);
+const REPEATABLE_FLAGS = new Set(['project', 'exclude-project', 'skill', 'exclude-skill', 'source']);
 const COMMANDS = [
     {
         name: 'login',
@@ -198,6 +203,7 @@ const COMMANDS = [
         options: [
             { flag: '--root PATH', description: 'Search PATH instead of the home directory' },
             { flag: '--output PATH', description: 'Also write the generated markdown report to PATH, for local inspection' },
+            { flag: '--force', description: 'Skip the confirmation prompt when --output already exists' },
             { flag: '--dry-run', description: 'Build the map and report its size without uploading' },
             { flag: '--client-id ID', description: 'Use a specific stored client' },
             { flag: '--json', description: 'Emit JSON output instead of human-readable text' },
@@ -216,6 +222,21 @@ const COMMANDS = [
             { flag: '--json', description: 'Emit JSON output instead of human-readable text' },
         ],
     },
+    {
+        name: 'sync-skills',
+        oneLiner: 'Upload locally-built Claude skills (SKILL.md files) to Coolhand as client files',
+        usage: 'coolhand sync-skills [options]',
+        options: [
+            { flag: '--root PATH', description: 'Search only PATH (recursively) instead of the 3 default roots' },
+            { flag: '--source NAME', description: 'Restrict the default scan to: authored, installed, claude-code (repeatable, comma-separable)' },
+            { flag: '--skill NAME', description: 'Only upload skills whose name matches (repeatable, comma-separable)' },
+            { flag: '--exclude-skill NAME', description: 'Skip skills whose name matches (repeatable, comma-separable)' },
+            { flag: '--force', description: 'Re-upload every matched skill, ignoring the unchanged-content skip (different meaning than map-claude-projects\' --force)' },
+            { flag: '--dry-run', description: 'Scan and report what would be uploaded, without sending or updating local state' },
+            { flag: '--client-id ID', description: 'Use a specific stored client' },
+            { flag: '--json', description: 'Emit JSON output instead of human-readable text' },
+        ],
+    },
     {
         name: 'claude',
         oneLiner: 'Run the Claude CLI through the Coolhand proxy (captures LLM calls)',
@@ -306,6 +327,54 @@ const COMMANDS = [
             { flag: '--json', description: 'Emit JSON output instead of human-readable text' },
         ],
     },
+    {
+        name: 'search-templates',
+        oneLiner: 'List and search LLM request templates (requires a private key)',
+        usage: 'coolhand search-templates [options]',
+        options: [
+            { flag: '--search TEXT', description: 'Case-insensitive substring to match in the template name' },
+            { flag: '--workload-id ID', description: 'Filter to a single workload, by workload hashid' },
+            { flag: '--status VALUE', description: 'Filter by status: draft, published, or failure' },
+            { flag: '--include-deprecated', description: 'Include deprecated templates (hidden by default)' },
+            { flag: '--include-system', description: "Include the 'Unmatched' and 'Ignored API Calls' system buckets (hidden by default) — inspect 'Unmatched' when logs are misrouting" },
+            { flag: '--page N', description: 'Page number (default: 1)' },
+            { flag: '--per-page N', description: 'Results per page (default: 25, max: 100)' },
+            { flag: '--client-id ID', description: 'Use a specific stored client' },
+            { flag: '--json', description: 'Emit JSON output instead of human-readable text' },
+        ],
+    }, {
+        name: 'get-template',
+        oneLiner: 'Get a single LLM request template by ID, including its prompt patterns (requires a private key)',
+        usage: 'coolhand get-template <template-id> [options]',
+        options: [
+            { flag: '--client-id ID', description: 'Use a specific stored client' },
+            { flag: '--json', description: 'Emit JSON output instead of human-readable text' },
+        ],
+    }, {
+        name: 'search-referenced-files',
+        oneLiner: "List a client's referenced files, aggregated and ranked by reference count",
+        usage: 'coolhand search-referenced-files [options]',
+        options: [
+            { flag: '--file-path-contains TEXT', description: 'Case-insensitive substring to match in the file path' },
+            { flag: '--created-at-gteq DATE', description: 'Lower bound (inclusive) on created_at, ISO-8601' },
+            { flag: '--created-at-lteq DATE', description: 'Upper bound (inclusive) on created_at, ISO-8601' },
+            { flag: '--page N', description: 'Page number (default: 1)' },
+            { flag: '--per-page N', description: 'Results per page (default: 25, max: 100)' },
+            { flag: '--client-id ID', description: 'Use a specific stored client' },
+            { flag: '--json', description: 'Emit JSON output instead of human-readable text' },
+        ],
+    }, {
+        name: 'list-referenced-file-sessions',
+        oneLiner: 'List the raw, un-aggregated sessions that referenced one exact file path',
+        usage: 'coolhand list-referenced-file-sessions --file-path PATH [options]',
+        options: [
+            { flag: '--file-path PATH', description: 'Exact file_path to look up (required)' },
+            { flag: '--page N', description: 'Page number (default: 1)' },
+            { flag: '--per-page N', description: 'Results per page (default: 25, max: 100)' },
+            { flag: '--client-id ID', description: 'Use a specific stored client' },
+            { flag: '--json', description: 'Emit JSON output instead of human-readable text' },
+        ],
+    },
     {
         name: 'help',
         oneLiner: 'Show this message or per-command help',
@@ -703,6 +772,40 @@ function mapClaudeProjectsOptions(parsed) {
     if (typeof parsed.flags.output === 'string') {
         opts.output = parsed.flags.output;
     }
+    if (parsed.flags.force === true) {
+        opts.force = true;
+    }
+    if (parsed.flags['dry-run'] === true) {
+        opts.dryRun = true;
+    }
+    if (typeof parsed.flags['client-id'] === 'string') {
+        opts.clientId = parsed.flags['client-id'];
+    }
+    if (parsed.flags.json === true) {
+        opts.json = true;
+    }
+    return opts;
+}
+function syncSkillsOptions(parsed) {
+    const opts = {};
+    if (typeof parsed.flags.root === 'string') {
+        opts.root = parsed.flags.root;
+    }
+    const sources = stringListFlag(parsed.flags.source);
+    if (sources) {
+        opts.sources = sources;
+    }
+    const skills = stringListFlag(parsed.flags.skill);
+    if (skills) {
+        opts.skills = skills;
+    }
+    const excludeSkills = stringListFlag(parsed.flags['exclude-skill']);
+    if (excludeSkills) {
+        opts.excludeSkills = excludeSkills;
+    }
+    if (parsed.flags.force === true) {
+        opts.force = true;
+    }
     if (parsed.flags['dry-run'] === true) {
         opts.dryRun = true;
     }
@@ -831,6 +934,66 @@ function fetchLogOptions(parsed) {
     }
     return opts;
 }
+const TEMPLATE_STATUSES = new Set(['draft', 'published', 'failure']);
+function searchTemplatesOptions(parsed) {
+    const opts = {};
+    if (typeof parsed.flags['search'] === 'string') {
+        opts.search = parsed.flags['search'];
+    }
+    if (typeof parsed.flags['workload-id'] === 'string') {
+        opts.workloadId = parsed.flags['workload-id'];
+    }
+    if (typeof parsed.flags['status'] === 'string') {
+        const status = parsed.flags['status'];
+        if (!TEMPLATE_STATUSES.has(status)) {
+            throw new CliError('INVALID_ARGS', '--status must be one of: draft, published, failure');
+        }
+        opts.status = status;
+    }
+    if (parsed.flags['include-deprecated'] === true) {
+        opts.includeDeprecated = true;
+    }
+    if (parsed.flags['include-system'] === true) {
+        opts.includeSystem = true;
+    }
+    if (typeof parsed.flags['page'] === 'string') {
+        const raw = parsed.flags['page'];
+        const n = parseInt(raw, 10);
+        if (!/^\d+$/.test(raw) || isNaN(n) || n < 1) {
+            throw new CliError('INVALID_ARGS', '--page must be a positive integer');
+        }
+        opts.page = n;
+    }
+    if (typeof parsed.flags['per-page'] === 'string') {
+        const raw = parsed.flags['per-page'];
+        const n = parseInt(raw, 10);
+        if (!/^\d+$/.test(raw) || isNaN(n) || n < 1 || n > 100) {
+            throw new CliError('INVALID_ARGS', '--per-page must be an integer between 1 and 100');
+        }
+        opts.perPage = n;
+    }
+    if (typeof parsed.flags['client-id'] === 'string') {
+        opts.clientId = parsed.flags['client-id'];
+    }
+    if (parsed.flags.json === true) {
+        opts.json = true;
+    }
+    return opts;
+}
+function getTemplateOptions(parsed) {
+    const id = parsed.positional[0];
+    if (!id) {
+        throw new CliError('INVALID_ARGS', 'get-template requires a <template-id> argument');
+    }
+    const opts = { id };
+    if (typeof parsed.flags['client-id'] === 'string') {
+        opts.clientId = parsed.flags['client-id'];
+    }
+    if (parsed.flags.json === true) {
+        opts.json = true;
+    }
+    return opts;
+}
 function searchLogsOptions(parsed) {
     const opts = {};
     if (typeof parsed.flags['template-id'] === 'string') {
@@ -895,6 +1058,71 @@ function searchLogsOptions(parsed) {
     }
     return opts;
 }
+function searchReferencedFilesOptions(parsed) {
+    const opts = {};
+    if (typeof parsed.flags['file-path-contains'] === 'string') {
+        opts.filePathContains = parsed.flags['file-path-contains'];
+    }
+    if (typeof parsed.flags['created-at-gteq'] === 'string') {
+        opts.createdAtGteq = parsed.flags['created-at-gteq'];
+    }
+    if (typeof parsed.flags['created-at-lteq'] === 'string') {
+        opts.createdAtLteq = parsed.flags['created-at-lteq'];
+    }
+    if (typeof parsed.flags['page'] === 'string') {
+        const raw = parsed.flags['page'];
+        const n = parseInt(raw, 10);
+        if (!/^\d+$/.test(raw) || isNaN(n) || n < 1) {
+            throw new CliError('INVALID_ARGS', '--page must be a positive integer');
+        }
+        opts.page = n;
+    }
+    if (typeof parsed.flags['per-page'] === 'string') {
+        const raw = parsed.flags['per-page'];
+        const n = parseInt(raw, 10);
+        if (!/^\d+$/.test(raw) || isNaN(n) || n < 1 || n > 100) {
+            throw new CliError('INVALID_ARGS', '--per-page must be an integer between 1 and 100');
+        }
+        opts.perPage = n;
+    }
+    if (typeof parsed.flags['client-id'] === 'string') {
+        opts.clientId = parsed.flags['client-id'];
+    }
+    if (parsed.flags.json === true) {
+        opts.json = true;
+    }
+    return opts;
+}
+function listReferencedFileSessionsOptions(parsed) {
+    const filePath = parsed.flags['file-path'];
+    if (typeof filePath !== 'string') {
+        throw new CliError('INVALID_ARGS', 'list-referenced-file-sessions requires --file-path <value>');
+    }
+    const opts = { filePath };
+    if (typeof parsed.flags['page'] === 'string') {
+        const raw = parsed.flags['page'];
+        const n = parseInt(raw, 10);
+        if (!/^\d+$/.test(raw) || isNaN(n) || n < 1) {
+            throw new CliError('INVALID_ARGS', '--page must be a positive integer');
+        }
+        opts.page = n;
+    }
+    if (typeof parsed.flags['per-page'] === 'string') {
+        const raw = parsed.flags['per-page'];
+        const n = parseInt(raw, 10);
+        if (!/^\d+$/.test(raw) || isNaN(n) || n < 1 || n > 100) {
+            throw new CliError('INVALID_ARGS', '--per-page must be an integer between 1 and 100');
+        }
+        opts.perPage = n;
+    }
+    if (typeof parsed.flags['client-id'] === 'string') {
+        opts.clientId = parsed.flags['client-id'];
+    }
+    if (parsed.flags.json === true) {
+        opts.json = true;
+    }
+    return opts;
+}
 function listWorkloadsOptions(parsed) {
     const opts = {};
     if (typeof parsed.flags.search === 'string') {
@@ -1180,6 +1408,8 @@ export async function run(argv) {
                 return await runMapClaudeProjects(mapClaudeProjectsOptions(parsed));
             case 'upload-client-file':
                 return await runUploadClientFile(uploadClientFileOptions(parsed));
+            case 'sync-skills':
+                return await runSyncSkills(syncSkillsOptions(parsed));
             case 'list-workloads':
                 return await runListWorkloads(listWorkloadsOptions(parsed));
             case 'get-workload':
@@ -1190,6 +1420,14 @@ export async function run(argv) {
                 return await runFetchLog(fetchLogOptions(parsed));
             case 'search-logs':
                 return await runSearchLogs(searchLogsOptions(parsed));
+            case 'search-templates':
+                return await runSearchTemplates(searchTemplatesOptions(parsed));
+            case 'get-template':
+                return await runGetTemplate(getTemplateOptions(parsed));
+            case 'search-referenced-files':
+                return await runSearchReferencedFiles(searchReferencedFilesOptions(parsed));
+            case 'list-referenced-file-sessions':
+                return await runListReferencedFileSessions(listReferencedFileSessionsOptions(parsed));
             default:
                 logger.info(`Unknown command: ${parsed.command}`);
                 logger.info(buildSummaryHelp());