premanmcp 0.10.6 → 0.10.7

package/bin/desktop.js

@@ -136,7 +136,7 @@ function mountedVolume(hdiutilOutput) {
 export async function installDesktopCommand(commandArgs = []) {
   const args = makeArgs(commandArgs);
 
-  if (process.platform !== "darwin") {
+  if (process.platform !== "darwin" && !args.has("--print-url")) {
     process.stdout.write(
       `The PreMan desktop app is macOS-only right now.\n` +
         `Downloads for other platforms: ${RELEASES_BASE}/latest\n`

package/bin/detect.js

@@ -246,6 +246,36 @@ function normalisePathTemplate(value) {
     .toLowerCase() || "/";
 }
 
+function normaliseBaseUrl(value) {
+  try {
+    const parsed = new URL(String(value || "").trim());
+    if (!isLoopback(parsed.href)) {
+      return `${parsed.protocol}//${parsed.host}${parsed.pathname}`.replace(/\/+$/, "");
+    }
+    const port = parsed.port || (parsed.protocol === "https:" ? "443" : "80");
+    const pathname = parsed.pathname.replace(/\/+$/, "");
+    return `${parsed.protocol}//loopback:${port}${pathname}`;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Prefer endpoints explicitly registered to this candidate. If none carry that
+ * base URL, preserve the existing repo-local workflow where a production
+ * inventory is retargeted to a local dev server and confirmed by route overlap.
+ */
+function inventoryForCandidate(candidate, inventory) {
+  const all = inventory || [];
+  const candidateBase = normaliseBaseUrl(candidate.url);
+  const matching = candidateBase
+    ? all.filter((ep) => normaliseBaseUrl(ep?.base_url) === candidateBase)
+    : [];
+  const selected = matching.length ? matching : all;
+  const scope = matching.length ? "matching_base_url" : "all_routes";
+  return { inventory: selected, scope };
+}
+
 /** Route keys the live app advertises through its generated spec, if it has one. */
 async function liveSpecRoutes(baseUrl, timeoutMs) {
   for (const specPath of SPEC_PATHS) {
@@ -305,7 +335,8 @@ export async function confirmCandidate(candidate, inventory, { timeoutMs = 2000
     let matched = 0;
     for (const key of expected) if (live.keys.has(key)) matched += 1;
     const overlap = matched / expected.size;
-    if (matched >= CONFIRM_MIN_ROUTES && overlap >= CONFIRM_MIN_OVERLAP) {
+    const requiredRoutes = Math.min(CONFIRM_MIN_ROUTES, expected.size);
+    if (matched >= requiredRoutes && overlap >= CONFIRM_MIN_OVERLAP) {
       return {
         ...candidate,
         confirmed: true,
@@ -366,9 +397,17 @@ export async function resolveLocalTarget(
   }
   const attempts = [];
   for (const candidate of candidates) {
-    const result = await confirmCandidate(candidate, inventory, { timeoutMs });
+    const scoped = inventoryForCandidate(candidate, inventory);
+    const result = await confirmCandidate(candidate, scoped.inventory, { timeoutMs });
     attempts.push(result);
-    if (result.confirmed) return { target: result, candidates: attempts };
+    if (result.confirmed) {
+      return {
+        target: result,
+        candidates: attempts,
+        inventory: scoped.inventory,
+        inventoryScope: scoped.scope,
+      };
+    }
   }
   return {
     target: null,

package/bin/hook.js

@@ -135,6 +135,10 @@ function embeddedInvocation(text) {
   return match ? match[1].trim() : "";
 }
 
+function isGeneratedInvocation(invocation) {
+  return invocation === "preman" || /^npm exec -y premanmcp@\S+ --$/.test(invocation);
+}
+
 function hookBody(invocation) {
   // `exec` is deliberately absent: we want the wrapper to survive the CLI exiting
   // non-zero and still exit 0 itself.
@@ -257,10 +261,15 @@ export function hookStatus({ probe = false } = {}) {
   if (!isOurHook(existing)) return { ...missing, state: "foreign" };
 
   const invocation = embeddedInvocation(existing);
+  const declared = declaredInvocation();
   // Falling back to what the file already carries keeps a machine that can no
   // longer prove any invocation -- offline, say -- from reporting a hook as out
   // of date and sending its owner to a reinstall that would refuse to write.
-  const wanted = provenInvocation() || invocation;
+  // A custom wrapper or direct Node command is itself the user's pin. Ambient
+  // PATH changes must not make it stale after PREMAN_HOOK_INVOCATION disappears.
+  const wanted =
+    declared ||
+    (isGeneratedInvocation(invocation) ? provenInvocation() || invocation : invocation);
   return {
     path: target,
     state: "installed",

package/bin/hosted.js

@@ -37,7 +37,7 @@ export class CliError extends Error {
 
 // --- arg parsing (mirrors bin/cli.js; no --flag=value form) -----------------
 
-function makeArgs(commandArgs) {
+function makeHostedArgs(commandArgs) {
   return {
     positional: commandArgs.filter((a, i) => {
       if (a.startsWith("-")) return false;
@@ -297,7 +297,7 @@ async function promptToken() {
 // --- commands --------------------------------------------------------------
 
 export async function linkCommand(commandArgs) {
-  const args = makeArgs(commandArgs);
+  const args = makeHostedArgs(commandArgs);
   const target = args.positional[0];
   const envName = args.value("--env", "");
   if (!target) throw new CliError("Usage: preman link <mcp-url-or-id> --env <name> [--token pm_hmcp_…]");
@@ -343,7 +343,7 @@ export async function linkCommand(commandArgs) {
 }
 
 export async function toolsCommand(commandArgs) {
-  const args = makeArgs(commandArgs);
+  const args = makeHostedArgs(commandArgs);
   const config = readCliConfig();
   const profile = resolveProfile(config, args.value("--env", ""));
   const timeoutMs = Number(args.value("--timeout", "")) * 1000 || DEFAULT_TIMEOUT_MS;
@@ -368,7 +368,7 @@ export async function toolsCommand(commandArgs) {
 }
 
 export async function runCommand(commandArgs) {
-  const args = makeArgs(commandArgs);
+  const args = makeHostedArgs(commandArgs);
   const selection = args.positional[0];
   if (!selection) {
     throw new CliError(

package/bin/progress.js

@@ -10,6 +10,8 @@
  * CI, and cursor-movement escapes in a log file are worse than no animation.
  */
 
+import { truncate } from "./shared.js";
+
 const FRAMES = ["\u280b", "\u2819", "\u2839", "\u2838", "\u283c", "\u2834", "\u2826", "\u2827", "\u2807", "\u280f"];
 const FRAME_MS = 80;
 
@@ -23,11 +25,6 @@ const YELLOW = "\u001b[33m";
 const DIM = "\u001b[2m";
 const RESET = "\u001b[0m";
 
-function truncate(text, width) {
-  const value = String(text ?? "");
-  return value.length <= width ? value : `${value.slice(0, Math.max(0, width - 1))}\u2026`;
-}
-
 export function createReporter({ stream = process.stdout, live } = {}) {
   const isLive = live ?? Boolean(stream.isTTY);
   const slots = new Map();

package/bin/runner.js

@@ -38,14 +38,7 @@ import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
-import {
-  CREDENTIALS_DIR,
-  backendUrl,
-  callBackendJson,
-  cliInvocation,
-  makeArgs,
-  resolveApiKey,
-} from "./shared.js";
+import { CREDENTIALS_DIR, backendUrl, callBackendJson, cliInvocation, makeArgs, nowMs, onPath, packageVersion, resolveApiKey } from "./shared.js";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -137,15 +130,6 @@ export function deviceId(projectPath) {
   return `cli-${createHash("sha256").update(seed).digest("hex").slice(0, 32)}`;
 }
 
-export function packageVersion() {
-  try {
-    const pkg = JSON.parse(readFileSync(path.join(__dirname, "..", "package.json"), "utf8"));
-    return String(pkg.version || "0.0.0");
-  } catch {
-    return "0.0.0";
-  }
-}
-
 function readPid() {
   try {
     const pid = Number(readFileSync(RUNNER_PID_FILE, "utf8").trim());
@@ -208,7 +192,7 @@ export async function registerRunner(args, { agent, projectPath, label = "", api
         project_path: project,
         project_name: path.basename(project),
         platform: `${process.platform}-${process.arch}`,
-        app_version: packageVersion(),
+        app_version: packageVersion() || undefined,
         capabilities: RUNNER_CAPABILITIES,
       },
     }
@@ -250,7 +234,7 @@ export function agentCommand(agent, prompt, { fullAccess = false } = {}) {
     return { bin: "claude", args, stream: "claude-json" };
   }
   if (agent === "cursor") {
-    return { bin: "cursor-agent", args: ["-p", prompt], stream: "text" };
+    return { bin: "cursor-agent", args: ["--approve-mcps", "-p", prompt], stream: "text" };
   }
   if (agent === "codex") {
     const args = ["exec"];
@@ -261,13 +245,6 @@ export function agentCommand(agent, prompt, { fullAccess = false } = {}) {
   return null;
 }
 
-export function onPath(binary) {
-  const probe = spawnSync(process.platform === "win32" ? "where" : "which", [binary], {
-    stdio: "ignore",
-  });
-  return probe.status === 0;
-}
-
 function sanitizeId(value, cap) {
   return String(value || "")
     .replace(/[^A-Za-z0-9_.:-]/g, "_")
@@ -406,10 +383,6 @@ function childEnv() {
 
 // ── Job execution ───────────────────────────────────────────────────────
 
-function nowMs() {
-  return Number(process.hrtime.bigint() / 1000000n);
-}
-
 /** POST a runner callback. Never throws — a lost callback is retried or fenced. */
 async function callback(args, state, route, body, log) {
   try {

package/bin/shared.js

@@ -119,6 +119,30 @@ export function cliInvocation() {
     pathPremanOwner() === "premanmcp" ? "preman" : "npm exec -y premanmcp@latest --");
 }
 
+/**
+ * Is this binary on PATH?
+ *
+ * Lived in three files at once, which is two more places for "installed" to mean
+ * something slightly different than it does everywhere else.
+ */
+export function onPath(binary) {
+  const probe = spawnSync(process.platform === "win32" ? "where" : "which", [binary], {
+    stdio: "ignore",
+  });
+  return probe.status === 0;
+}
+
+/** Monotonic milliseconds, for durations that must not follow the wall clock. */
+export function nowMs() {
+  return Number(process.hrtime.bigint() / 1000000n);
+}
+
+/** Clip to `width`, ellipsis included in the count. */
+export function truncate(value, width) {
+  const text = String(value ?? "");
+  return text.length <= width ? text : `${text.slice(0, Math.max(0, width - 1))}…`;
+}
+
 /** The version of the package this process is running from, or "". */
 export function packageVersion() {
   try {
@@ -560,7 +584,7 @@ export function resolveApiKey(args) {
 export const LAUNCHER_COMMAND = "npm";
 export const LAUNCHER_ARGS = ["exec", "-y", "premanmcp@latest", "--"];
 
-export function buildServerConfig(args, { pairCode = "" } = {}) {
+export function buildServerConfig(args, { pairCode = "", codingAgent = "" } = {}) {
   const env = {
     PREMAN_BACKEND: backendUrl(args),
     PREMAN_FRONTEND: frontendUrl(args),
@@ -568,6 +592,7 @@ export function buildServerConfig(args, { pairCode = "" } = {}) {
   const apiKey = resolveApiKey(args);
   if (apiKey) env.PREMAN_API_KEY = apiKey;
   if (pairCode) env.PREMAN_PAIR_CODE = pairCode;
+  if (codingAgent) env.PREMAN_CODING_AGENT = codingAgent;
 
   return {
     command: LAUNCHER_COMMAND,

package/bin/status.js

@@ -6,7 +6,7 @@
  * section as possibly empty.
  */
 
-import { backendUrl, callBackendJson, cliInvocation, makeArgs, resolveApiKey } from "./shared.js";
+import { backendUrl, callBackendJson, cliInvocation, makeArgs, resolveApiKey, truncate } from "./shared.js";
 
 export const STATUS_HELP = `
 Status options:
@@ -47,11 +47,6 @@ function relativeTime(iso) {
   return `${Math.round(seconds / 86400)}d ago`;
 }
 
-function truncate(value, width) {
-  const text = String(value ?? "");
-  return text.length <= width ? text : `${text.slice(0, width - 1)}…`;
-}
-
 const MAX_TARGET_WIDTH = 46;
 
 /** Column widths are measured across every row we will print, so the failing and

package/bin/tests.js

@@ -0,0 +1,341 @@
+/**
+ * `preman tests generate|review|setup|enrich` — Collections workbench test generation.
+ *
+ * Thin HTTP wrappers over the same `/workbench/generate-tests` routes the
+ * dashboard uses. Distinct from `preman test <id>`, which generates + runs
+ * scenarios for one endpoint via `POST /mcp/call-tool`.
+ */
+
+import { callBackendJson, cliInvocation, makeArgs, resolveApiKey } from "./shared.js";
+
+export const TESTS_HELP = `
+Collections tests:
+  preman tests generate [--workspace id] [--integration-id id] [--json-out]
+      Scan the connected GitHub repo and write heuristic suites on saved requests.
+      No LLM. Writes and ambiguous routes are flagged for review.
+  preman tests review [--workspace id] [--json-out]
+      List suites still flagged (review_status=required) with the reason.
+  preman tests review --approve <request_id> [--workspace id] [--json-out]
+      Approve one flagged suite so it can be scheduled. Does not raise
+      unattended_policy. DELETE stays skipped unless allow_destructive.
+  preman tests review --all-required [--workspace id] [--json-out]
+      Approve every currently flagged suite. Same gates as --approve.
+  preman tests setup [--list] [--workspace id] [--json-out]
+      Harvest path-param fixture IDs from list GETs / schema examples.
+      Stores them on the workspace and prints a .env snippet.
+      Does not invent UUIDs, create secrets, or approve suites.
+      --list shows missing fixtures without calling the API.
+  preman tests enrich [--list] [--workspace id] [--json-out]
+      LLM-enrich remaining review-cleared heuristic suites (cap 40).
+      --list shows the remaining queue without calling the model.
+      Skips destructive/billing unless standing policy already allows that risk.
+      Does not enable writes and does not publish a Guard baseline.
+`;
+
+class CliError extends Error {
+  constructor(message, exitCode = 1) {
+    super(message);
+    this.exitCode = exitCode;
+  }
+}
+
+function requireKey(args) {
+  const token = resolveApiKey(args);
+  if (!token) {
+    throw new CliError(
+      `No PreMan API key. Run \`${cliInvocation()} login\` or pass --api-key pm_live_...`,
+      2,
+    );
+  }
+  return token;
+}
+
+function workspaceHeaders(args) {
+  return { "x-workspace-id": args.value("--workspace", "") };
+}
+
+function wantsJson(args) {
+  return args.has("--json-out") || args.has("--json");
+}
+
+function printJson(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+}
+
+function errorDetail(result) {
+  const detail = result.detail;
+  if (typeof detail === "string") return detail;
+  if (Array.isArray(detail)) {
+    return detail.map((item) => item.msg || JSON.stringify(item)).join("; ");
+  }
+  if (detail && typeof detail === "object") {
+    return detail.message || detail.error || JSON.stringify(detail);
+  }
+  return result.message || result.raw || "backend error";
+}
+
+async function workbench(args, method, routePath, { json } = {}) {
+  const token = requireKey(args);
+  const result = await callBackendJson(args, method, routePath, {
+    token,
+    json,
+    headers: workspaceHeaders(args),
+  });
+  if (!result.ok) {
+    throw new CliError(
+      `${method} ${routePath} failed: ${result.status_code} ${errorDetail(result)}`,
+    );
+  }
+  const { status_code, ...payload } = result;
+  return payload;
+}
+
+function flagLine(item) {
+  const method = item.method || "";
+  const url = item.url || item.name || "";
+  const reason = item.reason_label || item.reason || "Needs review";
+  const id = item.request_id || "";
+  return `  ${id}  ${method} ${url}  ${reason}`;
+}
+
+export function printGenerateSummary(payload) {
+  const generated = payload.suites_generated || 0;
+  const repo = payload.repo_url || "the connected repository";
+  process.stdout.write(`Generated ${generated} suite(s) from ${repo}\n`);
+  process.stdout.write(
+    `  scanned ${payload.scanned || 0}  matched ${payload.matched || 0}  unmatched ${payload.unmatched || 0}\n`,
+  );
+  process.stdout.write(
+    `  auto-approved ${payload.auto_approved || 0}  flagged ${payload.flagged_for_review || 0}` +
+      `  waiting for base URL ${payload.waiting_for_base_url || 0}\n`,
+  );
+  if (payload.bodies_filled_from_schema) {
+    process.stdout.write(`  bodies filled from schema ${payload.bodies_filled_from_schema}\n`);
+  }
+  const flagged = payload.flagged || [];
+  if (flagged.length) {
+    process.stdout.write(`\n${flagged.length} flagged for review:\n`);
+    for (const item of flagged) process.stdout.write(`${flagLine(item)}\n`);
+    process.stdout.write(
+      `\nNext: \`${cliInvocation()} tests review --approve <request_id>\` enables a read-only schedule only.\n`,
+    );
+  } else if ((payload.flagged_for_review || 0) === 0 && generated) {
+    process.stdout.write(
+      `\nNo suites flagged. Optional: \`${cliInvocation()} tests enrich\` to add LLM cases to remaining heuristic suites.\n`,
+    );
+  }
+  const samples = payload.unmatched_samples || [];
+  if (samples.length) {
+    process.stdout.write(`\nUnmatched repo routes (not imported):\n`);
+    for (const sample of samples.slice(0, 10)) process.stdout.write(`  ${sample}\n`);
+  }
+}
+
+export function printReviewList(payload) {
+  const items = payload.items || [];
+  const total = payload.total ?? items.length;
+  process.stdout.write(`${total} suite(s) flagged for review\n`);
+  for (const item of items) process.stdout.write(`${flagLine(item)}\n`);
+  if (total) {
+    process.stdout.write(
+      `\nApprove one: \`${cliInvocation()} tests review --approve <request_id>\`\n` +
+        `Approve enables a read-only schedule only. DELETE stays skipped unless allow_destructive.\n`,
+    );
+  }
+}
+
+export function printApproveResult(payload) {
+  const id = payload.request_id || "";
+  const status = payload.review_status || "approved";
+  const enabled = payload.enabled ? "enabled" : "disabled";
+  process.stdout.write(`Approved ${id}  ${status}  ${enabled}\n`);
+  process.stdout.write(
+    "Schedule is enabled. unattended_policy is unchanged; DELETE still skips unless allow_destructive.\n",
+  );
+}
+
+export function printApproveAll(results) {
+  process.stdout.write(`Approved ${results.length} flagged suite(s)\n`);
+  for (const payload of results) {
+    const enabled = payload.enabled ? "enabled" : "disabled";
+    process.stdout.write(`  ${payload.request_id || ""}  ${payload.review_status || "approved"}  ${enabled}\n`);
+  }
+  if (results.length) {
+    process.stdout.write(
+      "Schedule is enabled. unattended_policy is unchanged; DELETE still skips unless allow_destructive.\n",
+    );
+  }
+}
+
+export function printEnrichList(payload) {
+  const items = payload.items || [];
+  const total = payload.total ?? items.length;
+  process.stdout.write(`${total} suite(s) remaining for agent enrichment\n`);
+  for (const item of items) process.stdout.write(`${flagLine(item)}\n`);
+  if (total) {
+    process.stdout.write(
+      `\nRun \`${cliInvocation()} tests enrich\` to append LLM cases (cap 40). Does not enable writes.\n`,
+    );
+  }
+}
+
+export function printSetupList(payload) {
+  const items = (payload.items || []).filter((item) => !item.value_set);
+  const total = payload.total ?? items.length;
+  process.stdout.write(`${total} path-param fixture(s) still missing\n`);
+  for (const item of payload.items || []) {
+    const state = item.value_set ? "set" : "missing";
+    process.stdout.write(
+      `  ${item.name || item.param || ""}  ${item.method || ""} ${item.url || ""}  ${state}\n`,
+    );
+  }
+  if (payload.dotenv) {
+    process.stdout.write(`\nCurrent .env:\n${payload.dotenv}`);
+  }
+  if (total) {
+    process.stdout.write(
+      `\nRun \`${cliInvocation()} tests setup\` to harvest ids from list GETs.\n`,
+    );
+  }
+}
+
+export function printSetupSummary(payload) {
+  process.stdout.write(
+    `Stored ${payload.stored || 0} fixture(s). Missing ${payload.missing || 0}.\n`,
+  );
+  process.stdout.write(
+    `  harvested ${payload.harvested || 0}` +
+      `  list GETs ${payload.list_gets_called || 0}` +
+      `  from lists ${payload.from_list_get || 0}` +
+      `  from schema ${payload.from_schema || 0}\n`,
+  );
+  if (payload.dotenv) {
+    process.stdout.write(`\n.env\n${payload.dotenv}`);
+  }
+  const missing = payload.missing_items || [];
+  if (missing.length) {
+    process.stdout.write(`\nStill missing:\n`);
+    for (const item of missing) {
+      process.stdout.write(`  ${item.name || item.param || ""}  ${item.method || ""} ${item.url || ""}\n`);
+    }
+  }
+}
+
+export function printEnrichSummary(payload) {
+  process.stdout.write(
+    `Enriched ${payload.enriched || 0} suite(s). Remaining ${payload.remaining || 0}.\n`,
+  );
+  process.stdout.write(
+    `  skipped sensitive ${payload.skipped_sensitive || 0}` +
+      `  pending review ${payload.skipped_pending_review || 0}` +
+      `  already enriched ${payload.skipped_already_enriched || 0}` +
+      `  no suite ${payload.skipped_no_suite || 0}` +
+      `  failed ${payload.failed || 0}\n`,
+  );
+  const remaining = payload.remaining_items || [];
+  if (remaining.length) {
+    process.stdout.write(`\nStill remaining:\n`);
+    for (const item of remaining) process.stdout.write(`${flagLine(item)}\n`);
+  }
+}
+
+function requestIdFlag(args, flag) {
+  const value = args.value(flag, "");
+  if (!value || value.startsWith("-")) {
+    throw new CliError(`pass a request id after ${flag}${TESTS_HELP}`, 2);
+  }
+  return value;
+}
+
+async function generateCommand(args) {
+  const integrationId = args.value("--integration-id", "");
+  const json = {};
+  if (integrationId && !integrationId.startsWith("-")) json.integration_id = integrationId;
+  const payload = await workbench(args, "POST", "/workbench/generate-tests", { json });
+  if (wantsJson(args)) return printJson(payload);
+  printGenerateSummary(payload);
+  return payload;
+}
+
+async function reviewCommand(args) {
+  if (args.has("--approve") && args.has("--all-required")) {
+    throw new CliError("use either --approve <request_id> or --all-required, not both", 2);
+  }
+
+  if (args.has("--approve")) {
+    const requestId = encodeURIComponent(requestIdFlag(args, "--approve"));
+    const payload = await workbench(
+      args,
+      "POST",
+      `/workbench/generate-tests/review/${requestId}/approve`,
+    );
+    if (wantsJson(args)) return printJson(payload);
+    printApproveResult(payload);
+    return payload;
+  }
+
+  const listed = await workbench(args, "GET", "/workbench/generate-tests/review");
+  if (args.has("--all-required")) {
+    const items = listed.items || [];
+    const results = [];
+    for (const item of items) {
+      const requestId = encodeURIComponent(item.request_id || "");
+      if (!requestId) continue;
+      results.push(
+        await workbench(args, "POST", `/workbench/generate-tests/review/${requestId}/approve`),
+      );
+    }
+    if (wantsJson(args)) return printJson({ approved: results, listed });
+    if (!results.length) {
+      process.stdout.write("0 suite(s) flagged for review\n");
+      return { approved: results, listed };
+    }
+    printApproveAll(results);
+    return { approved: results, listed };
+  }
+
+  if (wantsJson(args)) return printJson(listed);
+  printReviewList(listed);
+  return listed;
+}
+
+async function setupCommand(args) {
+  if (args.has("--list")) {
+    const listed = await workbench(args, "GET", "/workbench/generate-tests/fixtures");
+    if (wantsJson(args)) return printJson(listed);
+    printSetupList(listed);
+    return listed;
+  }
+  const payload = await workbench(args, "POST", "/workbench/generate-tests/fixtures");
+  if (wantsJson(args)) return printJson(payload);
+  printSetupSummary(payload);
+  return payload;
+}
+
+async function enrichCommand(args) {
+  if (args.has("--list")) {
+    const listed = await workbench(args, "GET", "/workbench/generate-tests/enrich");
+    if (wantsJson(args)) return printJson(listed);
+    printEnrichList(listed);
+    return listed;
+  }
+  const payload = await workbench(args, "POST", "/workbench/generate-tests/enrich");
+  if (wantsJson(args)) return printJson(payload);
+  printEnrichSummary(payload);
+  return payload;
+}
+
+export async function testsCommand(commandArgs = []) {
+  const sub = commandArgs[0] && !commandArgs[0].startsWith("-") ? commandArgs[0] : "";
+  const rest = sub ? commandArgs.slice(1) : commandArgs;
+  const args = makeArgs(rest);
+
+  if (!sub || sub === "help") {
+    throw new CliError(`pass generate, review, setup, or enrich${TESTS_HELP}`, 2);
+  }
+  if (sub === "generate") return generateCommand(args);
+  if (sub === "review") return reviewCommand(args);
+  if (sub === "setup") return setupCommand(args);
+  if (sub === "enrich") return enrichCommand(args);
+  throw new CliError(`unknown tests subcommand: ${sub}${TESTS_HELP}`, 2);
+}