orizu 0.0.8 → 0.1.0

package/src/index.ts

@@ -2,15 +2,17 @@
 import { createHash, randomBytes } from 'crypto'
 import { basename } from 'path'
 import { createServer } from 'http'
-import { readFileSync, writeFileSync } from 'fs'
+import { readFileSync, statSync, writeFileSync } from 'fs'
 import { spawn } from 'child_process'
 import { createInterface } from 'readline/promises'
 import { stdin as input, stdout as output } from 'process'
 import { clearServerCredentials, getServerCredentials, saveServerCredentials } from './credentials.js'
 import { parseDatasetFile } from './file-parser.js'
 import { parseDatasetReference } from './dataset-download.js'
+import { extractErrorMessage } from './error-response.js'
 import { parseGlobalFlags } from './global-flags.js'
 import { authedFetch, getBaseUrl, resolveLoginBaseUrl, setGlobalFlags } from './http.js'
+import { formatTaskCreateError } from './task-create-error.js'
 import { LoginResponse } from './types.js'
 
 interface Team {
@@ -106,7 +108,7 @@ interface TaskStatusPayload {
 }
 
 function printUsage() {
-  console.log(`orizu global options:\n\n  --local                 Use http://localhost:3000\n  --server <url>          Use a specific server origin (for example: https://preview.example.com)\n\norizu commands:\n\n  orizu login\n  orizu logout\n  orizu whoami\n  orizu teams list\n  orizu teams create [--name <name>]\n  orizu teams members list [--team <teamSlug>]\n  orizu teams members add --email <email> [--team <teamSlug>]\n  orizu teams members remove --email <email> [--team <teamSlug>]\n  orizu teams members role --team <teamSlug> --email <email> --role <admin|member>\n  orizu projects list [--team <teamSlug>]\n  orizu projects create --name <name> [--team <teamSlug>]\n  orizu apps list [--project <team/project>]\n  orizu apps create --project <team/project> --name <name> --dataset <datasetId> --file <path> --input-schema <json-path> --output-schema <json-path> [--component <name>]\n  orizu apps update [--app <appId>] [--project <team/project>] --file <path> --input-schema <json-path> --output-schema <json-path> [--component <name>]\n  orizu apps link-dataset --dataset <datasetId> [--app <appId>] [--project <team/project>] [--version <n>]\n  orizu tasks list [--project <team/project>]\n  orizu tasks create --project <team/project> --dataset <datasetId> --app <appId> --title <title> --assignees <userId1,userId2> [--instructions <text>] [--labels-per-item <n>]\n  orizu tasks assign --task <taskId> --assignees <userId1,userId2>\n  orizu tasks status --task <taskId> [--json]\n  orizu datasets upload --file <path> [--project <team/project>] [--name <name>]\n  orizu datasets download [--dataset <datasetId|datasetUrl>] [--project <team/project>] [--format <csv|json|jsonl>] [--out <path>]\n  orizu datasets append [--dataset <datasetId|datasetUrl>] [--project <team/project>] --file <path>\n  orizu datasets delete-rows [--dataset <datasetId|datasetUrl>] [--project <team/project>] [--row-ids <id1,id2>] [--row-indices <n1,n2>]\n  orizu tasks export [--task <taskId>] [--format <csv|json|jsonl>] [--out <path>]`)
+  console.log(`orizu global options:\n\n  --local                 Use http://localhost:3000\n  --server <url>          Use a specific server origin (for example: https://preview.example.com)\n\norizu commands:\n\n  orizu login\n  orizu logout\n  orizu whoami\n  orizu teams list\n  orizu teams create [--name <name>]\n  orizu teams members list [--team <teamSlug>]\n  orizu teams members add --email <email> [--team <teamSlug>]\n  orizu teams members remove --email <email> [--team <teamSlug>]\n  orizu teams members role --team <teamSlug> --email <email> --role <admin|member>\n  orizu projects list [--team <teamSlug>]\n  orizu projects create --name <name> [--team <teamSlug>]\n  orizu apps list [--project <team/project>]\n  orizu apps create --project <team/project> --name <name> --dataset <datasetId> --file <path> --input-schema <json-path> --output-schema <json-path> [--component <name>]\n  orizu apps update [--app <appId>] [--project <team/project>] --file <path> --input-schema <json-path> --output-schema <json-path> [--component <name>]\n  orizu apps link-dataset --dataset <datasetId> [--app <appId>] [--project <team/project>] [--version <n>]\n  orizu apps detail --app <appId> [--project <team/project>] [--json]\n  orizu tasks list [--project <team/project>]\n  orizu tasks create --project <team/project> --dataset <datasetId> --app <appId> --title <title> --assignees <userIdOrEmail1,userIdOrEmail2> [--version <n>] [--instructions <text>] [--labels-per-item <n>] [--json]\n  orizu tasks assign --task <taskId> --assignees <userId1,userId2>\n  orizu tasks status --task <taskId> [--json]\n  orizu tasks pause --task <taskId>\n  orizu tasks unpause --task <taskId>\n  orizu datasets upload --file <path> [--project <team/project>] [--name <name>]\n  orizu datasets download [--dataset <datasetId|datasetUrl>] [--project <team/project>] [--format <csv|json|jsonl>] [--out <path>]\n  orizu datasets append [--dataset <datasetId|datasetUrl>] [--project <team/project>] --file <path>\n  orizu datasets edit-rows [--dataset <datasetId|datasetUrl>] [--project <team/project>] --file <path>\n  orizu datasets delete-rows [--dataset <datasetId|datasetUrl>] [--project <team/project>] --row-ids <id1,id2>\n  orizu datasets lock [--dataset <datasetId|datasetUrl>] [--project <team/project>] [--reason <text>]\n  orizu datasets clone [--dataset <datasetId|datasetUrl>] [--project <team/project>] [--name <name>]\n  orizu tasks export [--task <taskId>] [--format <csv|json|jsonl>] [--out <path>]`)
 }
 
 let cliArgs = process.argv.slice(2)
@@ -198,7 +200,6 @@ async function parseJsonResponse<T>(response: Response, context: string): Promis
     )
   }
 }
-
 async function promptSelect<T>(
   title: string,
   items: T[],
@@ -559,18 +560,26 @@ function printTeamMembers(members: TeamMember[]) {
 
   const rows = members.map(member => ({
     id: member.id,
+    userId: member.user_id || '-',
     email: member.email || '-',
     role: member.role || '-',
   }))
 
   const idWidth = Math.max('MEMBER ID'.length, ...rows.map(row => row.id.length))
+  const userIdWidth = Math.max('USER ID'.length, ...rows.map(row => row.userId.length))
   const emailWidth = Math.max('EMAIL'.length, ...rows.map(row => row.email.length))
   const roleWidth = Math.max('ROLE'.length, ...rows.map(row => row.role.length))
 
-  console.log(`${'MEMBER ID'.padEnd(idWidth)}  ${'EMAIL'.padEnd(emailWidth)}  ${'ROLE'.padEnd(roleWidth)}`)
-  console.log(`${'-'.repeat(idWidth)}  ${'-'.repeat(emailWidth)}  ${'-'.repeat(roleWidth)}`)
+  console.log(
+    `${'MEMBER ID'.padEnd(idWidth)}  ${'USER ID'.padEnd(userIdWidth)}  ${'EMAIL'.padEnd(emailWidth)}  ${'ROLE'.padEnd(roleWidth)}`
+  )
+  console.log(
+    `${'-'.repeat(idWidth)}  ${'-'.repeat(userIdWidth)}  ${'-'.repeat(emailWidth)}  ${'-'.repeat(roleWidth)}`
+  )
   rows.forEach(row => {
-    console.log(`${row.id.padEnd(idWidth)}  ${row.email.padEnd(emailWidth)}  ${row.role.padEnd(roleWidth)}`)
+    console.log(
+      `${row.id.padEnd(idWidth)}  ${row.userId.padEnd(userIdWidth)}  ${row.email.padEnd(emailWidth)}  ${row.role.padEnd(roleWidth)}`
+    )
   })
 }
 
@@ -593,15 +602,34 @@ function printTaskStatusSummary(data: TaskStatusPayload) {
   }
 }
 
+const DEFAULT_AUTH_CALLBACK_PORT = 43123
+
+function resolveAuthCallbackPort(): number {
+  const envPort = process.env.ORIZU_AUTH_PORT
+  if (!envPort) {
+    return DEFAULT_AUTH_CALLBACK_PORT
+  }
+
+  const parsed = parseInt(envPort, 10)
+  if (Number.isNaN(parsed) || parsed < 1024 || parsed > 65535) {
+    throw new Error(
+      `Invalid ORIZU_AUTH_PORT: '${envPort}'. Must be a number between 1024 and 65535.`
+    )
+  }
+
+  return parsed
+}
+
 async function login() {
   const baseUrl = resolveLoginBaseUrl()
   const codeVerifier = createCodeVerifier()
   const codeChallenge = createCodeChallenge(codeVerifier)
+  const callbackPort = resolveAuthCallbackPort()
 
   const callbackCode = await new Promise<string>((resolve, reject) => {
     const server = createServer((request, response) => {
       try {
-        const url = new URL(request.url || '/', 'http://127.0.0.1:43123')
+        const url = new URL(request.url || '/', `http://127.0.0.1:${callbackPort}`)
         const code = url.searchParams.get('code')
 
         if (!code) {
@@ -622,11 +650,19 @@ async function login() {
       }
     })
 
-    server.on('error', reject)
+    server.on('error', (error: NodeJS.ErrnoException) => {
+      if (error.code === 'EADDRINUSE') {
+        reject(new Error(
+          `Port ${callbackPort} is already in use. Set ORIZU_AUTH_PORT to a different port (1024–65535) and retry.`
+        ))
+      } else {
+        reject(error)
+      }
+    })
 
-    server.listen(43123, '127.0.0.1', async () => {
+    server.listen(callbackPort, '127.0.0.1', async () => {
       try {
-        const redirectUri = 'http://127.0.0.1:43123/callback'
+        const redirectUri = `http://127.0.0.1:${callbackPort}/callback`
         const response = await fetch(`${baseUrl}/api/cli/auth/start`, {
           method: 'POST',
           headers: { 'Content-Type': 'application/json' },
@@ -921,12 +957,18 @@ async function linkAppDataset() {
   const project = getArg('--project')
   let appId = getArg('--app')
   const versionArg = getArg('--version')
-  const versionNum = versionArg ? Number(versionArg) : undefined
+  const parsedVersionNum = versionArg ? Number(versionArg) : Number.NaN
+  const versionNum =
+    Number.isInteger(parsedVersionNum) && parsedVersionNum > 0 ? parsedVersionNum : undefined
 
   if (!datasetId) {
     throw new Error('Usage: orizu apps link-dataset --dataset <datasetId> [--app <appId>] [--project <team/project>] [--version <n>]')
   }
 
+  if (versionArg && versionNum === undefined) {
+    throw new Error('--version must be a positive integer')
+  }
+
   if (!appId) {
     const selected = await selectAppIdInteractively(project)
     appId = selected.appId
@@ -972,12 +1014,20 @@ async function createTask() {
   const appId = getArg('--app')
   const title = getArg('--title')
   const assignees = parseCommaSeparated(getArg('--assignees'))
+  const versionArg = getArg('--version')
   const instructions = getArg('--instructions')
   const labelsPerItemArg = getArg('--labels-per-item')
   const labelsPerItem = labelsPerItemArg ? Number(labelsPerItemArg) : 1
+  const parsedVersionNum = versionArg ? Number(versionArg) : Number.NaN
+  const versionNum =
+    Number.isInteger(parsedVersionNum) && parsedVersionNum > 0 ? parsedVersionNum : null
 
   if (!projectSlug || !datasetId || !appId || !title || assignees.length === 0) {
-    throw new Error('Usage: orizu tasks create --project <team/project> --dataset <datasetId> --app <appId> --title <title> --assignees <userId1,userId2> [--instructions <text>] [--labels-per-item <n>]')
+    throw new Error('Usage: orizu tasks create --project <team/project> --dataset <datasetId> --app <appId> --title <title> --assignees <userIdOrEmail1,userIdOrEmail2> [--version <n>] [--instructions <text>] [--labels-per-item <n>] [--json]')
+  }
+
+  if (versionArg && versionNum === null) {
+    throw new Error('--version must be a positive integer')
   }
 
   const response = await authedFetch('/api/cli/tasks', {
@@ -987,6 +1037,7 @@ async function createTask() {
       projectSlug,
       datasetId,
       appId,
+      versionNum,
       title,
       memberIds: assignees,
       instructions,
@@ -995,15 +1046,59 @@ async function createTask() {
   })
 
   if (!response.ok) {
-    throw new Error(`Failed to create task: ${await response.text()}`)
+    const cliError = await formatTaskCreateError(response)
+    if (hasArg('--json')) {
+      const payload = cliError.structuredPayload ?? { error: cliError.message }
+      console.log(JSON.stringify({
+        ...payload,
+        httpStatus: cliError.httpStatus,
+      }, null, 2))
+    }
+    throw cliError
   }
 
   const data = await parseJsonResponse<{
-    task: { id: string; title: string; status: string; requiredAssignmentsPerRow: number }
+    task: {
+      id: string
+      title: string
+      status: string
+      requiredAssignmentsPerRow: number
+      versionId: string
+      versionNum: number
+    }
     assignmentsCreated: number
+    assignmentShortfall?: number
+    warning?: string
   }>(response, 'Task create')
+
+  if (hasArg('--json')) {
+    console.log(JSON.stringify({
+      taskId: data.task.id,
+      datasetId,
+      versionId: data.task.versionId,
+      versionNum: data.task.versionNum,
+      taskUrl: `${getBaseUrl()}/d/${projectSlug}/tasks/${data.task.id}`,
+      title: data.task.title,
+      status: data.task.status,
+      requiredAssignmentsPerRow: data.task.requiredAssignmentsPerRow,
+      assignmentsCreated: data.assignmentsCreated,
+      ...(data.assignmentShortfall !== undefined ? { assignmentShortfall: data.assignmentShortfall } : {}),
+      ...(data.warning ? { warning: data.warning } : {}),
+    }, null, 2))
+    return
+  }
+
+  const baseUrl = getBaseUrl()
+  const taskUrl = `${baseUrl}/d/${projectSlug}/tasks/${data.task.id}`
   console.log(
-    `Created task ${data.task.title} (${data.task.id}) [${data.task.status}], labels/item=${data.task.requiredAssignmentsPerRow}, assignments=${data.assignmentsCreated}`
+    `Created task ${data.task.title} (${data.task.id}) [${data.task.status}]` +
+    `\n  Task ID:    ${data.task.id}` +
+    `\n  Dataset ID: ${datasetId}` +
+    `\n  Version:    v${data.task.versionNum} (${data.task.versionId})` +
+    `\n  Labels/row: ${data.task.requiredAssignmentsPerRow}` +
+    `\n  Assignments: ${data.assignmentsCreated}` +
+    (data.warning ? `\n  Warning:    ${data.warning}` : '') +
+    `\n  URL:        ${taskUrl}`
   )
 }
 
@@ -1037,7 +1132,31 @@ async function taskStatus() {
 
   const response = await authedFetch(`/api/cli/tasks/${encodeURIComponent(taskId)}/status`)
   if (!response.ok) {
-    throw new Error(`Failed to fetch task status: ${await response.text()}`)
+    const rawBody = await response.text()
+    if (hasArg('--json')) {
+      let errorPayload: Record<string, unknown> = { error: rawBody }
+      try {
+        const parsed = JSON.parse(rawBody)
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+          errorPayload = parsed as Record<string, unknown>
+        }
+      } catch {
+        // keep raw body as error
+      }
+      console.log(JSON.stringify({
+        ...errorPayload,
+        httpStatus: response.status,
+      }, null, 2))
+    }
+
+    let errorMsg = rawBody
+    try {
+      const parsed = JSON.parse(rawBody)
+      if (parsed && typeof parsed === 'object' && typeof parsed.error === 'string') {
+        errorMsg = parsed.error
+      }
+    } catch { /* use rawBody as-is */ }
+    throw new Error(`Failed to fetch task status: ${errorMsg}`)
   }
 
   const data = await parseJsonResponse<TaskStatusPayload>(response, 'Task status')
@@ -1049,6 +1168,97 @@ async function taskStatus() {
   printTaskStatusSummary(data)
 }
 
+async function updateTaskStatus(targetStatus: 'paused' | 'active') {
+  const taskId = getArg('--task')
+  if (!taskId) {
+    const verb = targetStatus === 'paused' ? 'pause' : 'unpause'
+    throw new Error(`Usage: orizu tasks ${verb} --task <taskId>`)
+  }
+
+  const response = await authedFetch(`/api/cli/tasks/${encodeURIComponent(taskId)}/status`, {
+    method: 'PATCH',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ status: targetStatus }),
+  })
+
+  if (!response.ok) {
+    const verb = targetStatus === 'paused' ? 'pause' : 'unpause'
+    throw new Error(`Failed to ${verb} task: ${await response.text()}`)
+  }
+
+  const data = await parseJsonResponse<{ task: { id: string; status: string } }>(response, 'Task status update')
+  const action = targetStatus === 'paused' ? 'Paused' : 'Unpaused'
+  console.log(`${action} task ${data.task.id} [${data.task.status}]`)
+}
+
+interface AppDetailPayload {
+  id: string
+  name: string
+  currentVersionNum: number | null
+  currentVersion: {
+    versionId: string
+    versionNum: number
+    inputJsonSchema: unknown
+    outputJsonSchema: unknown
+  } | null
+  createdAt: string
+  updatedAt: string
+  projectId: string | null
+  compatibleDatasetsCount: number
+  totalDatasetsCount: number
+  createdByName: string | null
+  createdByEmail: string | null
+  teamSlug: string
+  teamName: string
+  projectSlug: string
+  projectName: string
+}
+
+async function appDetail() {
+  const appId = getArg('--app')
+  const project = getArg('--project')
+
+  if (!appId) {
+    throw new Error('Usage: orizu apps detail --app <appId> [--project <team/project>] [--json]')
+  }
+
+  const projectSlug = project || await resolveProjectSlug(null)
+
+  // Single fetch — the apps endpoint already returns full detail (ALI-544)
+  const detailResponse = await authedFetch(`/api/cli/apps?project=${encodeURIComponent(projectSlug)}`)
+  if (!detailResponse.ok) {
+    throw new Error(`Failed to fetch app detail: ${await detailResponse.text()}`)
+  }
+
+  const detailData = await parseJsonResponse<{ apps: AppDetailPayload[] }>(detailResponse, 'App detail')
+  const detail = detailData.apps.find(a => a.id === appId)
+
+  if (!detail) {
+    throw new Error(`App '${appId}' not found in project '${projectSlug}'`)
+  }
+
+  if (hasArg('--json')) {
+    console.log(JSON.stringify(detail, null, 2))
+    return
+  }
+
+  console.log(`App: ${detail.name} (${detail.id})`)
+  console.log(`  Project: ${detail.teamSlug}/${detail.projectSlug}`)
+  if (detail.currentVersion) {
+    console.log(`  Current version: v${detail.currentVersion.versionNum} (${detail.currentVersion.versionId})`)
+    console.log(`  Input schema: ${detail.currentVersion.inputJsonSchema ? 'defined' : 'none'}`)
+    console.log(`  Output schema: ${detail.currentVersion.outputJsonSchema ? 'defined' : 'none'}`)
+  } else {
+    console.log(`  Current version: none`)
+  }
+  console.log(`  Compatible datasets: ${detail.compatibleDatasetsCount}/${detail.totalDatasetsCount}`)
+  if (detail.createdByEmail) {
+    console.log(`  Created by: ${detail.createdByName || detail.createdByEmail}`)
+  }
+  console.log(`  Created: ${detail.createdAt}`)
+  console.log(`  Updated: ${detail.updatedAt}`)
+}
+
 async function listTeamMembers() {
   const teamSlug = await resolveTeamSlug(getArg('--team'))
 
@@ -1222,6 +1432,29 @@ async function downloadDataset() {
   console.log(`Saved dataset ${datasetId} (${format.toUpperCase()}) to ${filename}`)
 }
 
+const MAX_INPUT_FILE_SIZE_BYTES = 50 * 1024 * 1024 // 50 MB
+const APPEND_CHUNK_SIZE_ROWS = 500
+
+async function appendChunk(
+  datasetId: string,
+  rows: Array<Record<string, unknown>>
+): Promise<{ dataset: { id: string; name: string; rowCount: number }; appendedCount: number }> {
+  const response = await authedFetch(`/api/cli/datasets/${encodeURIComponent(datasetId)}/rows`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ rows }),
+  })
+
+  if (!response.ok) {
+    throw new Error(`Append failed: ${await response.text()}`)
+  }
+
+  return parseJsonResponse<{
+    dataset: { id: string; name: string; rowCount: number }
+    appendedCount: number
+  }>(response, 'Dataset append')
+}
+
 async function appendDatasetRows() {
   const projectArg = getArg('--project')
   const datasetInput = getDatasetReferenceInput()
@@ -1240,57 +1473,145 @@ async function appendDatasetRows() {
   }
 
   const file = expandHomePath(fileArg)
+
+  // Check file size before reading to prevent OOM on large files (ALI-565).
+  // Wrap statSync in try/catch so missing/inaccessible files get friendly
+  // errors instead of raw Node.js ENOENT/EPERM (ALI-554).
+  let fileSizeBytes: number
+  try {
+    fileSizeBytes = statSync(file).size
+  } catch (error) {
+    const maybeError = error as NodeJS.ErrnoException
+    if (maybeError.code === 'ENOENT') {
+      throw new Error(
+        `File not found: ${file}. Check the path and filename, then retry.`
+      )
+    }
+    if (maybeError.code === 'EPERM' || maybeError.code === 'EACCES') {
+      throw new Error(
+        `Cannot read file: ${file}. Grant folder permission to your terminal app and retry.`
+      )
+    }
+    throw new Error(`Failed to access file ${file}: ${maybeError.message}`)
+  }
+  if (fileSizeBytes > MAX_INPUT_FILE_SIZE_BYTES) {
+    const sizeMb = (fileSizeBytes / (1024 * 1024)).toFixed(1)
+    throw new Error(
+      `Input file is ${sizeMb} MB, which exceeds the 50 MB limit. Split the file into smaller parts and append each separately.`
+    )
+  }
+
   const { rows } = parseDatasetFile(file)
   if (!Array.isArray(rows) || rows.length === 0) {
     throw new Error('Dataset append file must contain at least one row')
   }
 
+  if (rows.length <= APPEND_CHUNK_SIZE_ROWS) {
+    const data = await appendChunk(datasetId, rows)
+    console.log(
+      `Appended ${data.appendedCount} rows to dataset ${data.dataset.name} (${data.dataset.id}). New row count: ${data.dataset.rowCount}`
+    )
+    return
+  }
+
+  // Chunked upload for large row counts (ALI-555: track partial progress)
+  let totalAppended = 0
+  let lastResult: { dataset: { id: string; name: string; rowCount: number } } | null = null
+  const totalChunks = Math.ceil(rows.length / APPEND_CHUNK_SIZE_ROWS)
+
+  for (let offset = 0; offset < rows.length; offset += APPEND_CHUNK_SIZE_ROWS) {
+    const chunk = rows.slice(offset, offset + APPEND_CHUNK_SIZE_ROWS)
+    const chunkIndex = Math.floor(offset / APPEND_CHUNK_SIZE_ROWS) + 1
+
+    console.log(`Uploading chunk ${chunkIndex}/${totalChunks} (${chunk.length} rows)...`)
+    try {
+      const data = await appendChunk(datasetId, chunk)
+      totalAppended += data.appendedCount
+      lastResult = data
+    } catch (error) {
+      const msg = error instanceof Error ? error.message : String(error)
+      throw new Error(
+        `Chunk ${chunkIndex}/${totalChunks} failed: ${msg}\n` +
+        `${totalAppended} rows from ${chunkIndex - 1} chunk(s) were already appended. ` +
+        `To retry, remove the first ${totalAppended} rows from your file and re-run the command.`
+      )
+    }
+  }
+
+  if (lastResult) {
+    console.log(
+      `Appended ${totalAppended} rows to dataset ${lastResult.dataset.name} (${lastResult.dataset.id}). New row count: ${lastResult.dataset.rowCount}`
+    )
+  }
+}
+
+async function editDatasetRows() {
+  const projectArg = getArg('--project')
+  const datasetInput = getDatasetReferenceInput()
+  const fileArg = getArg('--file')
+
+  if (!fileArg) {
+    throw new Error('Usage: orizu datasets edit-rows [--dataset <datasetId|datasetUrl>] [--project <team/project>] --file <path>')
+  }
+
+  let datasetId: string
+  if (datasetInput) {
+    datasetId = parseDatasetReference(datasetInput).datasetId
+  } else {
+    const selected = await selectDatasetInteractively(projectArg)
+    datasetId = selected.datasetId
+  }
+
+  const file = expandHomePath(fileArg)
+  const { rows } = parseDatasetFile(file)
+  if (!Array.isArray(rows) || rows.length === 0) {
+    throw new Error('Dataset edit file must contain at least one row')
+  }
+
+  const normalizedRows = rows.map((row, index) => {
+    if (typeof row !== 'object' || row === null || Array.isArray(row)) {
+      throw new Error(`Dataset edit file rows[${index}] must be an object`)
+    }
+
+    const rowRecord = row as Record<string, unknown>
+    const rowId = typeof rowRecord.id === 'string' ? rowRecord.id.trim() : ''
+    if (!rowId) {
+      throw new Error(`Dataset edit file rows[${index}] must include a non-empty string id`)
+    }
+
+    return {
+      ...rowRecord,
+      id: rowId,
+    }
+  })
+
   const response = await authedFetch(`/api/cli/datasets/${encodeURIComponent(datasetId)}/rows`, {
-    method: 'POST',
+    method: 'PATCH',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ rows }),
+    body: JSON.stringify({ rows: normalizedRows }),
   })
 
   if (!response.ok) {
-    throw new Error(`Append failed: ${await response.text()}`)
+    throw new Error(`Edit rows failed: ${await response.text()}`)
   }
 
   const data = await parseJsonResponse<{
     dataset: { id: string; name: string; rowCount: number }
-    appendedCount: number
-  }>(response, 'Dataset append')
+    updatedCount: number
+  }>(response, 'Dataset edit rows')
 
   console.log(
-    `Appended ${data.appendedCount} rows to dataset ${data.dataset.name} (${data.dataset.id}). New row count: ${data.dataset.rowCount}`
+    `Updated ${data.updatedCount} rows in dataset ${data.dataset.name} (${data.dataset.id}). Current row count: ${data.dataset.rowCount}`
   )
 }
 
-function parseCommaSeparatedIntegers(value: string | null): number[] {
-  if (!value) {
-    return []
-  }
-
-  const rawItems = value
-    .split(',')
-    .map(item => item.trim())
-    .filter(Boolean)
-  const parsed = rawItems.map(item => Number(item))
-  const invalid = parsed.some(item => !Number.isInteger(item) || item < 0)
-  if (invalid) {
-    throw new Error('row-indices must be comma-separated non-negative integers')
-  }
-
-  return parsed
-}
-
 async function deleteDatasetRows() {
   const projectArg = getArg('--project')
   const datasetInput = getDatasetReferenceInput()
   const rowIds = parseCommaSeparated(getArg('--row-ids'))
-  const rowIndices = parseCommaSeparatedIntegers(getArg('--row-indices'))
 
-  if (rowIds.length === 0 && rowIndices.length === 0) {
-    throw new Error('Usage: orizu datasets delete-rows [--dataset <datasetId|datasetUrl>] [--project <team/project>] [--row-ids <id1,id2>] [--row-indices <n1,n2>]')
+  if (rowIds.length === 0) {
+    throw new Error('Usage: orizu datasets delete-rows [--dataset <datasetId|datasetUrl>] [--project <team/project>] --row-ids <id1,id2>')
   }
 
   let datasetId: string
@@ -1306,7 +1627,6 @@ async function deleteDatasetRows() {
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({
       rowIds,
-      rowIndices,
     }),
   })
 
@@ -1324,6 +1644,81 @@ async function deleteDatasetRows() {
   )
 }
 
+async function lockDataset() {
+  const projectArg = getArg('--project')
+  const datasetInput = getDatasetReferenceInput()
+  const reason = getArg('--reason')
+
+  let datasetId: string
+  if (datasetInput) {
+    datasetId = parseDatasetReference(datasetInput).datasetId
+  } else {
+    const selected = await selectDatasetInteractively(projectArg)
+    datasetId = selected.datasetId
+  }
+
+  const response = await authedFetch(`/api/cli/datasets/${encodeURIComponent(datasetId)}/lock`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(reason ? { reason } : {}),
+  })
+
+  if (!response.ok) {
+    throw new Error(`Lock failed: ${await response.text()}`)
+  }
+
+  const data = await parseJsonResponse<{
+    dataset: {
+      id: string
+      name: string
+      rowCount: number
+      lockedAt: string
+      lockedBy: string | null
+    }
+  }>(response, 'Dataset lock')
+
+  console.log(
+    `Locked dataset ${data.dataset.name} (${data.dataset.id}) at ${data.dataset.lockedAt}. Row count: ${data.dataset.rowCount}`
+  )
+}
+
+async function cloneDataset() {
+  const projectArg = getArg('--project')
+  const datasetInput = getDatasetReferenceInput()
+  const name = getArg('--name')
+
+  let datasetId: string
+  if (datasetInput) {
+    datasetId = parseDatasetReference(datasetInput).datasetId
+  } else {
+    const selected = await selectDatasetInteractively(projectArg)
+    datasetId = selected.datasetId
+  }
+
+  const response = await authedFetch(`/api/cli/datasets/${encodeURIComponent(datasetId)}/clone`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(name ? { name } : {}),
+  })
+
+  if (!response.ok) {
+    throw new Error(`Clone failed: ${await response.text()}`)
+  }
+
+  const data = await parseJsonResponse<{
+    dataset: {
+      id: string
+      name: string
+      rowCount: number
+      parentDatasetId: string
+    }
+  }>(response, 'Dataset clone')
+
+  console.log(
+    `Cloned dataset ${data.dataset.parentDatasetId} -> ${data.dataset.name} (${data.dataset.id}). Row count: ${data.dataset.rowCount}`
+  )
+}
+
 async function downloadAnnotations() {
   let taskId = getArg('--task')
   const format = (getArg('--format') || 'jsonl') as 'csv' | 'json' | 'jsonl'
@@ -1439,6 +1834,11 @@ async function main() {
     return
   }
 
+  if (command === 'apps' && subcommand === 'detail') {
+    await appDetail()
+    return
+  }
+
   if (command === 'tasks' && subcommand === 'list') {
     await listTasks()
     return
@@ -1459,6 +1859,16 @@ async function main() {
     return
   }
 
+  if (command === 'tasks' && subcommand === 'pause') {
+    await updateTaskStatus('paused')
+    return
+  }
+
+  if (command === 'tasks' && subcommand === 'unpause') {
+    await updateTaskStatus('active')
+    return
+  }
+
   if (command === 'datasets' && subcommand === 'upload') {
     await uploadDataset()
     return
@@ -1474,11 +1884,26 @@ async function main() {
     return
   }
 
+  if (command === 'datasets' && subcommand === 'edit-rows') {
+    await editDatasetRows()
+    return
+  }
+
   if (command === 'datasets' && subcommand === 'delete-rows') {
     await deleteDatasetRows()
     return
   }
 
+  if (command === 'datasets' && subcommand === 'lock') {
+    await lockDataset()
+    return
+  }
+
+  if (command === 'datasets' && subcommand === 'clone') {
+    await cloneDataset()
+    return
+  }
+
   if (command === 'tasks' && subcommand === 'export') {
     await downloadAnnotations()
     return