quoxcli 0.0.0-stage → 0.3.1

package/lib/commands/approvals.js

@@ -0,0 +1,119 @@
+/**
+ * Approvals commands: result (quox#791), grants list|create|revoke (fleet standing grants, 2026-10-13)
+ *
+ * After a human approves a held tool call (e.g. a gated ssh_exec) the collector
+ * runs it and stores the outcome. `quox approvals result <id>` reads it back.
+ */
+
+import { resolveEndpoint } from '../api/endpoints.js';
+
+import { attachWalkthrough } from './walkthrough.js';
+
+export function registerApprovalsCommands(program, ctx) {
+  const { client, auth } = ctx;
+
+  const approvals = program
+    .command('approvals')
+    .description('Tool approvals (held actions awaiting or past a human decision)');
+  attachWalkthrough(approvals, ctx, program);
+
+  approvals
+    .command('result <approvalId>')
+    .description('Show the status and stored output of an approved tool call')
+    .option('--org <id>', 'org ID (service-key automation callers; defaults to active org / QUOX_ORG_ID)')
+    .action(async (approvalId, options) => {
+      auth.requireAuth();
+      const ep = resolveEndpoint('v1.approvals.result', { id: approvalId });
+      const orgId = auth.getOrgId(options.org || process.env.QUOX_ORG_ID);
+      const query = orgId ? { org_id: orgId } : undefined;
+      const data = await client.get(ep.path, { service: ep.service, ...(query ? { query } : {}) });
+
+      if (program.opts().output === 'json') {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+      }
+      console.log(`Approval ${data.approval_id}  tool: ${data.tool}  status: ${data.status}`
+        + (data.executed_at ? `  executed: ${data.executed_at}` : ''));
+      if (data.result === null || data.result === undefined) {
+        if (data.status === 'pending') console.log('Still pending: a human has not decided yet.');
+        else if (data.status === 'resuming') console.log('Approved, executing. Re-run shortly.');
+        else console.log('No stored output.');
+        return;
+      }
+      const r = data.result;
+      if (typeof r === 'string') { console.log(r); return; }
+      if (r.success === false) console.log(`Failed: ${r.error || 'unknown error'}`);
+      const out = r.output ?? r.stdout ?? r.result;
+      if (out !== undefined) console.log(typeof out === 'string' ? out : JSON.stringify(out, null, 2));
+      else console.log(JSON.stringify(r, null, 2));
+    });
+
+  // Fleet standing grants: an org admin pre-approves ONE host + an anchored command
+  // shape + a VMID range until an expiry, for ssh_exec. Every use still lands in
+  // approvals history with an AEE envelope; anything outside the grant files HITL.
+  const grants = approvals
+    .command('grants')
+    .description('Standing grants: org-admin pre-approved fleet command lanes (ssh_exec)');
+
+  grants
+    .command('list')
+    .description('List active standing grants (--all includes revoked and expired)')
+    .option('--all', 'include revoked and expired grants')
+    .action(async (options) => {
+      auth.requireAuth();
+      const ep = resolveEndpoint('v1.approvals.grants.list');
+      const data = await client.get(ep.path, { service: ep.service, ...(options.all ? { query: { all: '1' } } : {}) });
+      if (program.opts().output === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
+      const rows = data.grants || [];
+      if (!rows.length) { console.log('No standing grants.'); return; }
+      for (const g of rows) {
+        const state = g.revoked_at ? `revoked ${g.revoked_at}` : `expires ${g.expires_at}`;
+        const range = g.vmid_min != null ? `  vmids ${g.vmid_min}-${g.vmid_max}` : '';
+        console.log(`${g.grant_id}  ${g.tool}@${g.host}${range}  ${g.preset || `${g.patterns.length} patterns`}  uses ${g.use_count}  ${state}`);
+        console.log(`  reason: ${g.reason}  (by ${g.created_by})`);
+      }
+    });
+
+  grants
+    .command('create')
+    .description('Create a standing grant (human org admin only)')
+    .requiredOption('--host <hostId>', 'the ONE host the grant covers')
+    .requiredOption('--reason <text>', 'why (shown in history and evidence)')
+    .option('--preset <name>', 'proxmox-test-vm-lane (clone/power/destroy/guest-exec in a VMID range)')
+    .option('--template <vmid>', 'template VMID the lane clones from (preset)')
+    .option('--vmid-range <min-max>', 'VMID range, e.g. 9100-9199')
+    .option('--name-prefix <prefix>', 'VM name prefix the lane may create (preset)', 'z2h')
+    .option('--pattern <regex>', 'custom anchored command regex (repeatable; instead of --preset)', (v, a) => (a || []).concat([v]))
+    .option('--days <n>', 'expiry in days (max 30)', '14')
+    .action(async (options) => {
+      auth.requireAuth();
+      const body = { tool: 'ssh_exec', host: options.host, reason: options.reason, expires_in_days: Number(options.days) };
+      if (options.vmidRange) {
+        const m = /^(\d+)-(\d+)$/.exec(options.vmidRange);
+        if (!m) { console.error('--vmid-range must look like 9100-9199'); process.exitCode = 1; return; }
+        body.vmid_min = Number(m[1]); body.vmid_max = Number(m[2]);
+      }
+      if (options.preset) {
+        body.preset = options.preset; body.template_vmid = Number(options.template); body.name_prefix = options.namePrefix;
+      } else {
+        body.patterns = options.pattern || [];
+      }
+      const ep = resolveEndpoint('v1.approvals.grants.create');
+      const data = await client.post(ep.path, { service: ep.service, body });
+      if (program.opts().output === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
+      const g = data.grant || {};
+      console.log(`Created ${g.grant_id}: ${g.tool}@${g.host}${g.vmid_min != null ? ` vmids ${g.vmid_min}-${g.vmid_max}` : ''}, expires ${g.expires_at}`);
+      console.log(`Revoke any time: quox approvals grants revoke ${g.grant_id}`);
+    });
+
+  grants
+    .command('revoke <grantId>')
+    .description('Revoke a standing grant now (human org admin only)')
+    .action(async (grantId) => {
+      auth.requireAuth();
+      const ep = resolveEndpoint('v1.approvals.grants.revoke', { id: grantId });
+      const data = await client.post(ep.path, { service: ep.service, body: {} });
+      if (program.opts().output === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
+      console.log(`Revoked ${data.grant?.grant_id || grantId} at ${data.grant?.revoked_at || 'now'}.`);
+    });
+}

package/lib/commands/aside.js

@@ -0,0 +1,24 @@
+/**
+ * quox aside "<question>"
+ *
+ * A read-only side question: the model gets no tools and no conversation, so nothing it says can change
+ * anything or land in a conversation's history. The TUI's /aside is the same call with the recent
+ * exchanges passed as read-only context.
+ */
+import { askAside } from '../core/aside.js';
+
+export function registerAsideCommand(program, ctx) {
+  const { client, auth } = ctx;
+  program
+    .command('aside')
+    .description('Ask a read-only side question: no tools, not saved to any conversation')
+    .argument('<question...>', 'the question')
+    .option('--agent <id>', 'who answers (default quox)')
+    .action(async (words, opts) => {
+      auth.requireAuth();
+      const r = await askAside(client, { question: words.join(' '), agent: opts.agent });
+      if (program.opts().output === 'json') { console.log(JSON.stringify({ answer: r.text, model: r.model, provider: r.provider, tools_used: r.tools, read_only: true }, null, 2)); return; }
+      console.log(r.text || '(no answer)');
+      console.log(`· aside, read only: no tools, not saved${r.model ? ` · ${r.provider ? `${r.provider}/` : ''}${r.model}` : ''}`);
+    });
+}

package/lib/commands/ask.js

@@ -0,0 +1,144 @@
+/**
+ * `quox ask`: a session puts a fork in front of a human through the Approvals inbox (one inbox item, kind decision).
+ * Who is asking, what, why, the options, the recommendation and the expiry travel with it, so ONE HITL session
+ * can answer for twenty terminals. Not an approval of an action: no step-up PIN unless --high-risk.
+ */
+import { readFileSync, existsSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { resolveEndpoint } from '../api/endpoints.js';
+import { resolveOrgId } from './helpers.js';
+import { readPresence, approvalPresenceFields } from './presence.js';
+import { toRepoRelative, LOOSENING_HINT } from '../core/repoPath.js';
+import { parseOptions, parseDuration, YN_OPTIONS, waitForDecision, EXIT_NO_ANSWER } from '../core/askDecision.js';
+
+function heldSlotFor(session) {
+  try {
+    const all = JSON.parse(readFileSync(join(homedir(), '.quox', 'held-slots.json'), 'utf8'));
+    const want = String(session || '').toLowerCase();
+    return Object.keys(all).find((k) => String(all[k]?.session || '').toLowerCase() === want) || null;
+  } catch { return null; }
+}
+
+export function registerAskCommands(program, { client, auth }) {
+  const err = (s) => process.stderr.write(`${s}\n`);
+
+  async function waitAndPrint(orgId, id, { timeoutSec = null } = {}) {
+    const r = await waitForDecision({
+      poll: (w) => { const ep = resolveEndpoint('inbox.decision.get', { orgId, id }); return client.get(ep.path, { service: ep.service, query: { wait: w }, timeout: (w + 15) * 1000, retries: 0 }); },
+      log: err,
+      maxWaitMs: timeoutSec != null ? timeoutSec * 1000 : null,
+    });
+    if (r.stdout) console.log(r.stdout);
+    process.exitCode = r.code;
+    return r;
+  }
+
+  const ask = program
+    .command('ask')
+    .description('Ask a human a question through the Approvals inbox: who asks, what, why, the options. Use this instead of asking in your own terminal')
+    .option('--session <name>', 'which session is asking (default: $QUOX_SESSION)')
+    .option('--title <text>', 'what you are asking, one line')
+    .option('--why <text>', 'a simple why: what the human needs to know to decide')
+    .option('--justify <text>', 'for a loosening (a check made easier to pass): why it is safe, in plain words; the card shows it on its JUSTIFY line and defaults to No without one')
+    .option('--options <list>', 'the choices: "a: Ship now|b: Wait for review|c: Drop it"')
+    .option('--yn', 'shorthand for a yes/no question (options y and n)')
+    .option('--default <key>', 'the option you would take if nobody answers (shown, never applied for you)')
+    .option('--recommend <key>', 'the option you recommend')
+    .option('--expires <dur>', 'how long it stays open: 30m, 2h, 1d (default 24h, max 30d)')
+    .option('--slot <name>', 'your slot, so the answer is also posted there (default: found from held slots)')
+    .option('--agent <name>', 'the agent asking, when it is an agent rather than a session')
+    .option('--high-risk', 'the answer needs the human step-up PIN')
+    .option('--wait', 'block until answered; prints the chosen option key (and any note) on stdout, exits 2 on expiry or deny')
+    .option('--timeout <dur>', 'with --wait: stop waiting after this long (the question stays open)')
+    .action((options) => fileAsk(options));
+
+  async function fileAsk(options) {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const session = options.session || process.env.QUOX_SESSION;
+      if (!session) throw new Error('say which session is asking: --session <NAME>');
+      if (!options.title) throw new Error('say what you are asking: --title "<what>"');
+      if (options.yn && options.options) throw new Error('use --yn or --options, not both');
+      if (!options.yn && !options.options) throw new Error('give the choices: --options "a: Ship now|b: Wait" (or --yn)');
+      // QUOXON 2026-10-17: a high-risk ask (a loosening, anything the owner must PIN) carries a plain justification
+      // 2026-10-19: three PIN approvals were wasted on loosening asks filed without --high-risk or with unusable paths
+      if (!options.highRisk && /^\s*approve\s+(?:loosening|test)/i.test(options.title)) { err(`A test-edit approval must go through the loosening verb, which sets --high-risk and repo-relative paths for you:\n  ${LOOSENING_HINT}`); process.exitCode = 2; return; }
+      if (options.highRisk && !String(options.justify || '').trim()) { err('High-risk asks need --justify "<2-3 plain lines the owner can judge>"'); process.exitCode = 2; return; }
+      const opts = options.yn ? YN_OPTIONS : parseOptions(options.options);
+      const body = {
+        session, title: options.title, why: options.why, options: opts,
+        ...(options.justify ? { justification: options.justify } : {}),
+        default: options.default, recommend: options.recommend,
+        ...(options.expires ? { expires_in_seconds: parseDuration(options.expires) } : {}),
+        high_risk: Boolean(options.highRisk),
+        slot: options.slot || heldSlotFor(session) || undefined,
+        profile: program.opts().profile || process.env.QUOX_PROFILE || undefined,
+        agent: options.agent,
+      };
+      const ep = resolveEndpoint('inbox.decision.create', { orgId });
+      const data = await client.post(ep.path, { service: ep.service, body });
+      // PRESENCE (owner 2026-10-16): say now whether the human is away, so this session can work on
+      // something else instead of waiting. The question is filed and queued exactly as before.
+      const presence = approvalPresenceFields(await readPresence(client, orgId));
+      const d = { ...data.decision, ...presence };
+      if (program.opts().output === 'json' && !options.wait) { console.log(JSON.stringify(d, null, 2)); return; }
+      err(`asked: ${d.id} (${session}: ${d.title}); it shows in /approvals${d.expires_at ? `, open until ${d.expires_at}` : ''}`);
+      if (presence.owner_away) err(`${presence.owner_away_notice}. Expect a wait: work on something else meanwhile.`);
+      if (!options.wait) { console.log(d.id); return; }
+      await waitAndPrint(orgId, d.id, { timeoutSec: options.timeout ? parseDuration(options.timeout) : null });
+  }
+
+  ask
+    .command('loosening')
+    .description('Ask a human to approve edits to test files (a check made easier to pass). Files a yes/no, high-risk (PIN) ask with repo-relative paths')
+    .option('--paths <files...>', 'every test file the commit edits (absolute, worktree or repo-relative: all are normalised)')
+    .option('--justify <text>', 'why it is safe, in plain words (required)')
+    .option('--why <text>', 'detail: the findings, before and after lines')
+    .option('--session <name>', 'which session is asking (default: $QUOX_SESSION)')
+    .option('--slot <name>', 'your slot')
+    .option('--expires <dur>', 'how long it stays open')
+    .option('--wait', 'block until answered')
+    .option('--timeout <dur>', 'with --wait: stop waiting after this long')
+    .action(async (subOptions) => {
+      // commander lets the parent `ask` swallow flags it shares with this verb (--justify, --why, --session...), so merge both
+      const options = { ...ask.opts(), ...Object.fromEntries(Object.entries(subOptions).filter(([, v]) => v !== undefined)) };
+      if (!String(options.justify || '').trim()) { err('say why it is safe: --justify "<plain words>"'); process.exitCode = 2; return; }
+      const raw = [].concat(options.paths || []).flatMap((x) => String(x).split(',')).map((x) => x.trim()).filter(Boolean);
+      let root;
+      try { root = execFileSync('git', ['rev-parse', '--show-toplevel'], { encoding: 'utf8' }).trim(); } catch { root = process.cwd(); }
+      const paths = [...new Set(raw.map(toRepoRelative))];
+      const missing = paths.filter((p) => !p || !existsSync(join(root, p)));
+      if (!paths.length || missing.length) { err(`not found in this repo (${root}): ${missing.join(', ') || '(no paths)'}. Run from the worktree and name files that exist.`); process.exitCode = 2; return; }
+      // 2026-10-19: the server truncates long titles, and the attestation names only paths found in title+body,
+      // so a 7-file ask covered 3. Every path also goes in the body.
+      const files = `Files (${paths.length}):\n${paths.map((p) => `- ${p}`).join('\n')}`;
+      await fileAsk({ ...options, title: `Approve test edits: ${paths.join(' ')}`, why: options.why ? `${files}\n\n${options.why}` : files, yn: true, highRisk: true, justify: options.justify });
+    });
+
+  ask
+    .command('status')
+    .description('Show where a question stands: pending, answered, denied or expired, with the answer')
+    .argument('<id>', 'the id `quox ask` printed')
+    .action(async (id) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('inbox.decision.get', { orgId, id });
+      const d = (await client.get(ep.path, { service: ep.service })).decision;
+      if (program.opts().output === 'json') { console.log(JSON.stringify(d, null, 2)); return; }
+      console.log(`${d.state}${d.answer?.option ? ` ${d.answer.option}` : ''}${d.answer?.note ? ` (${d.answer.note})` : ''}`);
+      if (d.state === 'expired' || d.state === 'denied') process.exitCode = EXIT_NO_ANSWER;
+    });
+
+  ask
+    .command('wait')
+    .description('Block until a question is answered; prints the chosen option key (and note), exits 2 on expiry or deny')
+    .argument('<id>', 'the id `quox ask` printed')
+    .option('--timeout <dur>', 'stop waiting after this long (the question stays open)')
+    .action(async (id, options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      await waitAndPrint(orgId, id, { timeoutSec: options.timeout ? parseDuration(options.timeout) : null });
+    });
+}

package/lib/commands/assistant.js

@@ -0,0 +1,169 @@
+/**
+ * Assistant commands: CRUD, deploy, fork
+ */
+
+import { formatOutput, formatDetail, printSuccess } from '../core/output.js';
+import { resolveOrgId } from './helpers.js';
+import { resolveEndpoint } from '../api/endpoints.js';
+import { QuoxError } from '../core/errors.js';
+
+// #1049: auth routes/assistants.js DEPLOYMENT_MODES (the server is the authority).
+const DEPLOY_MODES = ['private', 'shared', 'public'];
+
+export function registerAssistantCommands(program, ctx) {
+  const { client, auth } = ctx;
+
+  const assistant = program
+    .command('assistant')
+    .description('Manage assistants');
+
+  assistant
+    .command('list')
+    .description('List assistants')
+    .action(async () => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const data = await client.get(resolveEndpoint('assistants.list', { orgId }).path, { service: resolveEndpoint('assistants.list', { orgId }).service });
+      formatOutput({
+        // fleet #392: route returns active_deployments, not deployed.
+        columns: ['id', 'name', 'status', 'active_deployments', 'created_at'],
+        headers: ['ID', 'Name', 'Status', 'Deployed', 'Created'],
+        rows: data.items || data.assistants || data,
+      }, { format: program.opts().output });
+    });
+
+  assistant
+    .command('get')
+    .description('Get assistant details')
+    .argument('<assistantId>', 'assistant ID')
+    .action(async (assistantId) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const data = await client.get(resolveEndpoint('assistants.get', { orgId, assistantId }).path, { service: resolveEndpoint('assistants.get', { orgId, assistantId }).service });
+      formatDetail(data.assistant || data, { format: program.opts().output, title: data.assistant?.name || data.name });
+    });
+
+  assistant
+    .command('create')
+    .description('Create an assistant')
+    .requiredOption('--name <name>', 'assistant name')
+    .option('--persona <text>', 'persona/system prompt')
+    .option('--description <desc>', 'description')
+    .action(async (options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const body = { name: options.name };
+      if (options.persona) body.persona = options.persona;
+      if (options.description) body.description = options.description;
+      await client.post(resolveEndpoint('assistants.create', { orgId }).path, { service: resolveEndpoint('assistants.create', { orgId }).service, body });
+      printSuccess(`Assistant "${options.name}" created.`);
+    });
+
+  assistant
+    .command('update')
+    .description('Update an assistant')
+    .argument('<assistantId>', 'assistant ID')
+    .option('--name <name>', 'new name')
+    .option('--persona <text>', 'new persona')
+    .option('--description <desc>', 'new description')
+    .action(async (assistantId, options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const body = {};
+      if (options.name) body.name = options.name;
+      if (options.persona) body.persona = options.persona;
+      if (options.description) body.description = options.description;
+      await client.patch(resolveEndpoint('assistants.update', { orgId, assistantId }).path, { service: resolveEndpoint('assistants.update', { orgId, assistantId }).service, body });
+      printSuccess('Assistant updated.');
+    });
+
+  assistant
+    .command('delete')
+    .description('Delete an assistant')
+    .argument('<assistantId>', 'assistant ID')
+    .action(async (assistantId) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      await client.delete(resolveEndpoint('assistants.delete', { orgId, assistantId }).path, { service: resolveEndpoint('assistants.delete', { orgId, assistantId }).service });
+      printSuccess('Assistant deleted.');
+    });
+
+  assistant
+    .command('publish')
+    .description('Publish a draft assistant (draft to active), so it can be deployed')
+    .argument('<assistantId>', 'assistant ID')
+    .action(async (assistantId) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      // #1028: create makes a draft and deploy refuses anything not active; this is the step between.
+      const ep = resolveEndpoint('assistants.publish', { orgId, assistantId });
+      await client.post(ep.path, { service: ep.service });
+      printSuccess('Assistant published.');
+    });
+
+  assistant
+    .command('deploy')
+    .description('Deploy an active assistant to a scope (scope ids: quox org divisions list, quox department list, quox team list)')
+    .argument('<assistantId>', 'assistant ID')
+    .option('--scope <scopeId>', 'scope ID to deploy to (required)')
+    .option('--target <scopeId>', 'alias for --scope')
+    .option('--mode <mode>', `${DEPLOY_MODES.join(', ')} (default shared)`)
+    .action(async (assistantId, options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      // #998: the auth route requires scope_id; the CLI used to send { target }.
+      const scopeId = options.scope || options.target;
+      if (!scopeId) throw new QuoxError('assistant deploy needs --scope <scopeId>.', 1);
+      // #1049: the server's modes (auth routes/assistants.js DEPLOYMENT_MODES); refuse anything else here.
+      if (options.mode && !DEPLOY_MODES.includes(options.mode)) {
+        throw new QuoxError(`--mode must be one of: ${DEPLOY_MODES.join(', ')} (got "${options.mode}").`, 1);
+      }
+      const body = { scope_id: scopeId };
+      if (options.mode) body.mode = options.mode;
+      await client.post(resolveEndpoint('assistants.deploy', { orgId, assistantId }).path, { service: resolveEndpoint('assistants.deploy', { orgId, assistantId }).service, body });
+      printSuccess('Assistant deployed.');
+    });
+
+  assistant
+    .command('undeploy')
+    .description('Remove a deployment of an assistant (by --deployment id, or the active one at --scope)')
+    .argument('<assistantId>', 'assistant ID')
+    .option('--deployment <deploymentId>', 'deployment ID to remove (see quox assistant get)')
+    .option('--scope <scopeId>', 'remove the active deployment at this scope')
+    .action(async (assistantId, options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      // #1049: a deployed assistant could not be removed from the CLI.
+      let deploymentId = options.deployment;
+      if (!deploymentId) {
+        if (!options.scope) throw new QuoxError('assistant undeploy needs --deployment <id> or --scope <scopeId>.', 1);
+        const g = resolveEndpoint('assistants.get', { orgId, assistantId });
+        const data = await client.get(g.path, { service: g.service });
+        const deps = (data && data.assistant && data.assistant.deployments) || (data && data.deployments) || [];
+        const live = deps.filter((d) => d.status === 'active');
+        const hit = live.find((d) => d.scope_id === options.scope);
+        if (!hit) {
+          const where = live.length ? live.map((d) => `${d.scope_id} (${d.id})`).join(', ') : 'nowhere';
+          throw new QuoxError(`No active deployment of ${assistantId} at scope ${options.scope}. It is deployed at: ${where}.`, 1);
+        }
+        deploymentId = hit.id;
+      }
+      const ep = resolveEndpoint('assistants.undeploy', { orgId, assistantId, deploymentId });
+      await client.delete(ep.path, { service: ep.service });
+      printSuccess(`Deployment ${deploymentId} removed.`);
+    });
+
+  assistant
+    .command('fork')
+    .description('Fork an assistant')
+    .argument('<assistantId>', 'assistant ID to fork')
+    .option('--name <name>', 'name for the fork')
+    .action(async (assistantId, options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const body = {};
+      if (options.name) body.name = options.name;
+      await client.post(resolveEndpoint('assistants.fork', { orgId, assistantId }).path, { service: resolveEndpoint('assistants.fork', { orgId, assistantId }).service, body });
+      printSuccess('Assistant forked.');
+    });
+}