reallink-cli 0.1.14 → 0.1.16

package/rust/src/main.rs

@@ -1,24 +1,26 @@
 use anyhow::{anyhow, Context, Result};
 use clap::{ArgAction, Args, Parser, Subcommand, ValueEnum};
+use regex::RegexBuilder;
 use reqwest::{Method, StatusCode};
 use serde::{Deserialize, Serialize};
 use sha2::Digest;
 use std::fs;
-use std::io::{self, Read, Write};
+use std::io::{self, Read, SeekFrom, Write};
 use std::path::{Path, PathBuf};
 use std::process::Command;
 use std::time::{Duration, SystemTime, UNIX_EPOCH};
 use tokio::fs as tokio_fs;
-use tokio::io::AsyncWriteExt;
+use tokio::io::{AsyncBufReadExt, AsyncReadExt, AsyncSeekExt, AsyncWriteExt, BufReader};
 use tokio::time::sleep;
 
-mod unreal;
 mod generated;
 mod logs;
+mod unreal;
 use unreal::{
-    LinkDoctorArgs, LinkOpenArgs, LinkPathsArgs, LinkPluginInstallArgs, LinkPluginListArgs,
-    LinkRemoveArgs, LinkRunArgs, LinkUnrealArgs, LinkUseArgs, PluginIndexFile, UnrealLinkRecord,
-    UnrealLinksConfig,
+    LinkConnectArgs, LinkDoctorArgs, LinkOpenArgs, LinkP2PCreateArgs, LinkP2PGetArgs,
+    LinkP2PListArgs, LinkP2PSignalArgs, LinkP2PWaitArgs, LinkPathsArgs, LinkPluginInstallArgs,
+    LinkPluginListArgs, LinkRemoveArgs, LinkRunArgs, LinkSourceArgs, LinkUnrealArgs, LinkUseArgs,
+    PluginIndexFile, SourceLinkRecord, SourceLinksConfig, UnrealLinkRecord, UnrealLinksConfig,
 };
 
 const DEFAULT_BASE_URL: &str = "https://api.real-agent.link";
@@ -62,6 +64,11 @@ enum Commands {
     Whoami(BaseArgs),
     Logout,
     SelfUpdate(SelfUpdateArgs),
+    Call(CallArgs),
+    Ops {
+        #[command(subcommand)]
+        command: OpsCommands,
+    },
     Org {
         #[command(subcommand)]
         command: OrgCommands,
@@ -78,6 +85,10 @@ enum Commands {
         #[command(subcommand)]
         command: TokenCommands,
     },
+    Credits {
+        #[command(subcommand)]
+        command: CreditsCommands,
+    },
     File {
         #[command(subcommand)]
         command: FileCommands,
@@ -102,6 +113,126 @@ struct BaseArgs {
     base_url: Option<String>,
 }
 
+#[derive(Subcommand)]
+enum OpsCommands {
+    List(OpsListArgs),
+    Search(OpsSearchArgs),
+    Show(OpsShowArgs),
+    Invoke(OpsInvokeArgs),
+}
+
+#[derive(Args)]
+struct AgentAuthArgs {
+    #[arg(long)]
+    base_url: Option<String>,
+    #[arg(long, help = "Bearer token override for agent/API-token usage")]
+    access_token: Option<String>,
+}
+
+#[derive(Args)]
+struct CallArgs {
+    #[command(flatten)]
+    auth: AgentAuthArgs,
+    #[arg(help = "HTTP method, for example GET or POST")]
+    method: String,
+    #[arg(help = "API path, for example /v1/projects or /projects")]
+    path: String,
+    #[arg(long = "query", action = ArgAction::Append, help = "Query pair in key=value form")]
+    query: Vec<String>,
+    #[arg(long = "header", action = ArgAction::Append, help = "Header in Name=Value form")]
+    header: Vec<String>,
+    #[arg(long, help = "Inline JSON/JSON5 body or @path/to/body.json")]
+    body: Option<String>,
+}
+
+#[derive(Args)]
+struct OpsListArgs {
+    #[command(flatten)]
+    auth: AgentAuthArgs,
+    #[arg(long)]
+    group: Option<String>,
+    #[arg(long)]
+    scope: Option<String>,
+}
+
+#[derive(Args)]
+struct OpsSearchArgs {
+    #[command(flatten)]
+    auth: AgentAuthArgs,
+    #[arg(help = "Free-text capability query")]
+    query: String,
+    #[arg(long)]
+    group: Option<String>,
+    #[arg(long)]
+    scope: Option<String>,
+}
+
+#[derive(Args)]
+struct OpsShowArgs {
+    #[command(flatten)]
+    auth: AgentAuthArgs,
+    #[arg(help = "Operation identifier from discover output")]
+    operation_id: String,
+}
+
+#[derive(Args)]
+struct OpsInvokeArgs {
+    #[command(flatten)]
+    auth: AgentAuthArgs,
+    #[arg(help = "Operation identifier from discover output")]
+    operation_id: String,
+    #[arg(long)]
+    org_id: Option<String>,
+    #[arg(long)]
+    project_id: Option<String>,
+    #[arg(long = "param", action = ArgAction::Append, help = "Path or query parameter in key=value form")]
+    param: Vec<String>,
+    #[arg(long = "header", action = ArgAction::Append, help = "Header in Name=Value form")]
+    header: Vec<String>,
+    #[arg(long, help = "Inline JSON/JSON5 body or @path/to/body.json")]
+    body: Option<String>,
+}
+
+#[derive(Args)]
+struct CreditsAccountArgs {
+    #[command(flatten)]
+    base: BaseArgs,
+    #[arg(long)]
+    org_id: String,
+}
+
+#[derive(Args)]
+struct CreditsLedgerArgs {
+    #[command(flatten)]
+    base: BaseArgs,
+    #[arg(long)]
+    org_id: String,
+    #[arg(long, default_value_t = 50)]
+    limit: u32,
+    #[arg(long, default_value_t = 0)]
+    offset: u32,
+}
+
+#[derive(Args)]
+struct CreditsProjectUsageArgs {
+    #[command(flatten)]
+    base: BaseArgs,
+    #[arg(long)]
+    project_id: String,
+    #[arg(long, default_value_t = 50)]
+    limit: u32,
+    #[arg(long, default_value_t = 0)]
+    offset: u32,
+}
+
+#[derive(Args)]
+struct CreditsRunUsageArgs {
+    #[command(flatten)]
+    base: BaseArgs,
+    #[arg(long)]
+    run_id: String,
+}
+
 #[derive(Args)]
 struct SelfUpdateArgs {
     #[arg(long, help = "Only check for updates; do not install")]
@@ -127,6 +258,14 @@ enum TokenCommands {
     Revoke(TokenRevokeArgs),
 }
 
+#[derive(Subcommand)]
+enum CreditsCommands {
+    Account(CreditsAccountArgs),
+    Ledger(CreditsLedgerArgs),
+    ProjectUsage(CreditsProjectUsageArgs),
+    RunUsage(CreditsRunUsageArgs),
+}
+
 #[derive(Subcommand)]
 enum ProjectCommands {
     List(ProjectListArgs),
@@ -204,6 +343,8 @@ enum ToolCommands {
     Run(ToolRunArgs),
     Runs(ToolRunsArgs),
     GetRun(ToolGetRunArgs),
+    Cancel(ToolCancelArgs),
+    Retry(ToolRetryArgs),
     RunEvents(ToolRunEventsArgs),
     TraceStatus(ToolTraceStatusArgs),
     Local {
@@ -240,6 +381,8 @@ enum SkillCommands {
     Run(ToolRunArgs),
     Runs(ToolRunsArgs),
     GetRun(ToolGetRunArgs),
+    Cancel(ToolCancelArgs),
+    Retry(ToolRetryArgs),
     RunEvents(ToolRunEventsArgs),
     TraceStatus(ToolTraceStatusArgs),
     Local {
@@ -287,6 +430,12 @@ struct FileListArgs {
     #[arg(long)]
     path: Option<String>,
     #[arg(long)]
+    search: Option<String>,
+    #[arg(long)]
+    sort_by: Option<String>,
+    #[arg(long)]
+    kind: Option<String>,
+    #[arg(long)]
     offset: Option<u32>,
     #[arg(long)]
     limit: Option<u32>,
@@ -521,7 +670,11 @@ struct ToolRunArgs {
     wait: bool,
     #[arg(long, default_value_t = 300_000, help = "Wait timeout in milliseconds")]
     timeout_ms: u64,
-    #[arg(long, default_value_t = 1_500, help = "Polling interval in milliseconds")]
+    #[arg(
+        long,
+        default_value_t = 1_500,
+        help = "Polling interval in milliseconds"
+    )]
     poll_interval_ms: u64,
     #[arg(long)]
     base_url: Option<String>,
@@ -555,7 +708,11 @@ struct ToolPromptArgs {
     wait: bool,
     #[arg(long, default_value_t = 300_000, help = "Wait timeout in milliseconds")]
     timeout_ms: u64,
-    #[arg(long, default_value_t = 1_500, help = "Polling interval in milliseconds")]
+    #[arg(
+        long,
+        default_value_t = 1_500,
+        help = "Polling interval in milliseconds"
+    )]
     poll_interval_ms: u64,
     #[arg(long)]
     base_url: Option<String>,
@@ -583,6 +740,44 @@ struct ToolGetRunArgs {
     base_url: Option<String>,
 }
 
+#[derive(Args)]
+struct ToolCancelArgs {
+    #[arg(long)]
+    run_id: String,
+    #[arg(long)]
+    reason: Option<String>,
+    #[arg(long, help = "Path to JSON/JSONC metadata file")]
+    metadata_file: Option<PathBuf>,
+    #[arg(long)]
+    base_url: Option<String>,
+}
+
+#[derive(Args)]
+struct ToolRetryArgs {
+    #[arg(long)]
+    run_id: String,
+    #[arg(long)]
+    reason: Option<String>,
+    #[arg(long, help = "Inline JSON object for retry input patch")]
+    input_json: Option<String>,
+    #[arg(long, help = "Path to JSON/JSONC file for retry input patch")]
+    input_file: Option<PathBuf>,
+    #[arg(long, help = "Path to JSON/JSONC metadata file")]
+    metadata_file: Option<PathBuf>,
+    #[arg(long, action = ArgAction::SetTrue, help = "Wait for completion before returning")]
+    wait: bool,
+    #[arg(long, default_value_t = 300_000, help = "Wait timeout in milliseconds")]
+    timeout_ms: u64,
+    #[arg(
+        long,
+        default_value_t = 1_500,
+        help = "Polling interval in milliseconds"
+    )]
+    poll_interval_ms: u64,
+    #[arg(long)]
+    base_url: Option<String>,
+}
+
 #[derive(Args)]
 struct ToolRunEventsArgs {
     #[arg(long)]
@@ -593,9 +788,15 @@ struct ToolRunEventsArgs {
     status: Option<String>,
     #[arg(long)]
     stage_prefix: Option<String>,
-    #[arg(long, help = "Only include events created after this ISO-8601 timestamp")]
+    #[arg(
+        long,
+        help = "Only include events created after this ISO-8601 timestamp"
+    )]
     since: Option<String>,
-    #[arg(long, help = "Only include events created at/before this ISO-8601 timestamp")]
+    #[arg(
+        long,
+        help = "Only include events created at/before this ISO-8601 timestamp"
+    )]
     until: Option<String>,
     #[arg(long)]
     base_url: Option<String>,
@@ -669,7 +870,10 @@ struct ToolLocalInstallArgs {
     version: Option<String>,
     #[arg(long = "output")]
     output_path: Option<PathBuf>,
-    #[arg(long, help = "Resume download from existing output file size using HTTP Range")]
+    #[arg(
+        long,
+        help = "Resume download from existing output file size using HTTP Range"
+    )]
     resume: bool,
     #[arg(long, help = "Only print install intent, do not download")]
     no_download: bool,
@@ -928,6 +1132,50 @@ struct SessionConfig {
     updated_at_epoch_ms: u128,
 }
 
+enum AgentAuth {
+    Session(SessionConfig),
+    Token {
+        base_url: String,
+        access_token: String,
+    },
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone)]
+#[serde(rename_all = "camelCase")]
+struct DiscoverOperationParameter {
+    name: String,
+    #[serde(rename = "in")]
+    location: String,
+    required: bool,
+    #[serde(default)]
+    schema: serde_json::Value,
+    description: Option<String>,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone)]
+#[serde(rename_all = "camelCase")]
+struct DiscoverOperation {
+    operation_id: String,
+    method: String,
+    path: String,
+    summary: String,
+    description: Option<String>,
+    group: String,
+    #[serde(default)]
+    tags: Vec<String>,
+    auth: String,
+    #[serde(default)]
+    required_scopes: Vec<String>,
+    requires_org_context: bool,
+    requires_project_context: bool,
+    visibility: String,
+    stability: String,
+    #[serde(default)]
+    parameters: Vec<DiscoverOperationParameter>,
+    request_body_schema: Option<serde_json::Value>,
+    example: Option<serde_json::Value>,
+}
+
 #[derive(Debug, Serialize, Deserialize, Clone)]
 struct UpdateCheckCache {
     last_checked_epoch_ms: u128,
@@ -1287,6 +1535,44 @@ fn load_jsonc_file(path: &Path, label: &str) -> Result<serde_json::Value> {
     parse_jsonc_str(&raw, &format!("{} file {}", label, path.display()))
 }
 
+fn parse_key_value_arg(raw: &str, label: &str) -> Result<(String, String)> {
+    let Some((key, value)) = raw.split_once('=') else {
+        return Err(anyhow!("{} must use key=value format", label));
+    };
+    let normalized_key = key.trim().to_string();
+    let normalized_value = value.trim().to_string();
+    if normalized_key.is_empty() {
+        return Err(anyhow!("{} key cannot be empty", label));
+    }
+    Ok((normalized_key, normalized_value))
+}
+
+fn parse_key_value_args(values: &[String], label: &str) -> Result<Vec<(String, String)>> {
+    values
+        .iter()
+        .map(|value| parse_key_value_arg(value, label))
+        .collect()
+}
+
+fn load_optional_json_body(body: Option<&str>) -> Result<Option<serde_json::Value>> {
+    let Some(raw) = body
+        .map(|value| value.trim())
+        .filter(|value| !value.is_empty())
+    else {
+        return Ok(None);
+    };
+    if let Some(path) = raw.strip_prefix('@') {
+        let path = PathBuf::from(path);
+        return Ok(Some(load_jsonc_file(&path, "request body")?));
+    }
+    Ok(Some(parse_jsonc_str(raw, "request body")?))
+}
+
+fn parse_scalar_json_value(raw: &str) -> serde_json::Value {
+    json5::from_str::<serde_json::Value>(raw)
+        .unwrap_or_else(|_| serde_json::Value::String(raw.to_string()))
+}
+
 fn parse_object_from_value(
     value: serde_json::Value,
     context: &str,
@@ -1792,6 +2078,25 @@ fn clean_virtual_path(value: &str) -> String {
         .join("/")
 }
 
+const API_VERSION_PREFIX: &str = "/v1";
+
+fn versioned_api_path(path: &str) -> String {
+    if path.starts_with("http://") || path.starts_with("https://") {
+        return path.to_string();
+    }
+    let normalized = if path.starts_with('/') {
+        path.to_string()
+    } else {
+        format!("/{}", path)
+    };
+    if normalized == API_VERSION_PREFIX
+        || normalized.starts_with(&format!("{}/", API_VERSION_PREFIX))
+    {
+        return normalized;
+    }
+    format!("{}{}", API_VERSION_PREFIX, normalized)
+}
+
 fn apply_base_url_override(session: &mut SessionConfig, base_url: Option<String>) {
     if let Some(base_url) = base_url {
         session.base_url = normalize_base_url(&base_url);
@@ -1838,7 +2143,12 @@ async fn authed_request_with_headers(
     body: Option<serde_json::Value>,
     extra_headers: &[(String, String)],
 ) -> Result<reqwest::Response> {
-    let url = format!("{}{}", normalize_base_url(&session.base_url), path);
+    let versioned_path = versioned_api_path(path);
+    let url = format!(
+        "{}{}",
+        normalize_base_url(&session.base_url),
+        versioned_path
+    );
     let mut request = with_cli_headers(
         client
             .request(method.clone(), &url)
@@ -1871,8 +2181,104 @@ async fn authed_request_with_headers(
     Ok(retry.send().await?)
 }
 
+fn resolve_agent_auth(auth: &AgentAuthArgs) -> Result<AgentAuth> {
+    if let Some(access_token) = auth
+        .access_token
+        .as_ref()
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty())
+    {
+        let base_url = normalize_base_url(auth.base_url.as_deref().unwrap_or(DEFAULT_BASE_URL));
+        return Ok(AgentAuth::Token {
+            base_url,
+            access_token,
+        });
+    }
+
+    let mut session = load_session()?;
+    apply_base_url_override(&mut session, auth.base_url.clone());
+    Ok(AgentAuth::Session(session))
+}
+
+fn agent_base_url(auth: &AgentAuth) -> &str {
+    match auth {
+        AgentAuth::Session(session) => &session.base_url,
+        AgentAuth::Token { base_url, .. } => base_url,
+    }
+}
+
+async fn agent_request_json(
+    client: &reqwest::Client,
+    auth: &mut AgentAuth,
+    method: Method,
+    path: &str,
+    body: Option<serde_json::Value>,
+    extra_headers: &[(String, String)],
+) -> Result<reqwest::Response> {
+    match auth {
+        AgentAuth::Session(session) => {
+            authed_request_with_headers(client, session, method, path, body, extra_headers).await
+        }
+        AgentAuth::Token {
+            base_url,
+            access_token,
+        } => {
+            let url = format!(
+                "{}{}",
+                normalize_base_url(base_url),
+                versioned_api_path(path)
+            );
+            let mut request =
+                with_cli_headers(client.request(method, &url).bearer_auth(access_token));
+            for (key, value) in extra_headers {
+                request = request.header(key, value);
+            }
+            if let Some(body_value) = body {
+                request = request.json(&body_value);
+            }
+            Ok(request.send().await?)
+        }
+    }
+}
+
+async fn parse_response_body(
+    response: reqwest::Response,
+) -> Result<(StatusCode, serde_json::Value)> {
+    let status = response.status();
+    let text = response.text().await.unwrap_or_default();
+    let body = serde_json::from_str::<serde_json::Value>(&text)
+        .unwrap_or_else(|_| serde_json::Value::String(text));
+    Ok((status, body))
+}
+
+async fn fetch_discover_operation(
+    client: &reqwest::Client,
+    auth: &mut AgentAuth,
+    operation_id: &str,
+) -> Result<DiscoverOperation> {
+    let path = format!("/discover/operations/{}", urlencoding::encode(operation_id));
+    let response = agent_request_json(client, auth, Method::GET, &path, None, &[]).await?;
+    let (status, body) = parse_response_body(response).await?;
+    if !status.is_success() {
+        return Err(anyhow!(
+            "discover operation lookup failed ({}): {}",
+            status,
+            body
+        ));
+    }
+    let operation = body
+        .get("operation")
+        .cloned()
+        .ok_or_else(|| anyhow!("discover operation response missing operation payload"))?;
+    Ok(serde_json::from_value(operation)?)
+}
+
 async fn refresh_session(client: &reqwest::Client, session: &mut SessionConfig) -> Result<()> {
-    let url = format!("{}/auth/refresh", normalize_base_url(&session.base_url));
+    let url = format!(
+        "{}{}",
+        normalize_base_url(&session.base_url),
+        versioned_api_path("/auth/refresh")
+    );
     let payload = RefreshRequest {
         refresh_token: session.refresh_token.clone(),
         session_id: session.session_id.clone(),
@@ -1918,64 +2324,304 @@ async fn existing_session_identity_for_base_url(
         .map(|email| email.to_string())
 }
 
-fn default_login_scopes() -> Vec<String> {
-    generated::contract::CLI_DEFAULT_LOGIN_SCOPES
+fn append_query_pairs_to_path(path: &str, query_pairs: &[(String, String)]) -> String {
+    if query_pairs.is_empty() {
+        return path.to_string();
+    }
+    let separator = if path.contains('?') { '&' } else { '?' };
+    let encoded = query_pairs
         .iter()
-        .map(|value| (*value).to_string())
-        .collect()
+        .map(|(key, value)| {
+            format!(
+                "{}={}",
+                urlencoding::encode(key),
+                urlencoding::encode(value)
+            )
+        })
+        .collect::<Vec<_>>()
+        .join("&");
+    format!("{}{}{}", path, separator, encoded)
 }
 
-fn default_login_scopes_with_tools() -> Vec<String> {
-    generated::contract::CLI_DEFAULT_LOGIN_SCOPES_WITH_TOOLS
-        .iter()
-        .map(|value| (*value).to_string())
-        .collect()
+async fn call_command(
+    client: &reqwest::Client,
+    args: CallArgs,
+    output: OutputFormat,
+) -> Result<()> {
+    let mut auth = resolve_agent_auth(&args.auth)?;
+    let query_pairs = parse_key_value_args(&args.query, "--query")?;
+    let headers = parse_key_value_args(&args.header, "--header")?;
+    let path = append_query_pairs_to_path(&args.path, &query_pairs);
+    let body = load_optional_json_body(args.body.as_deref())?;
+    let method = Method::from_bytes(args.method.trim().to_uppercase().as_bytes())
+        .with_context(|| format!("Unsupported HTTP method {}", args.method))?;
+    let response =
+        agent_request_json(client, &mut auth, method.clone(), &path, body, &headers).await?;
+    let (status, payload) = parse_response_body(response).await?;
+    let result = serde_json::json!({
+        "ok": status.is_success(),
+        "status": status.as_u16(),
+        "method": method.as_str(),
+        "baseUrl": agent_base_url(&auth),
+        "path": versioned_api_path(&args.path),
+        "body": payload
+    });
+    emit_text_or_json(
+        output,
+        &serde_json::to_string_pretty(&result)?,
+        result.clone(),
+    )?;
+    if !status.is_success() {
+        return Err(anyhow!("call failed with status {}", status));
+    }
+    Ok(())
 }
 
-async fn login_command(
+async fn ops_list_command(
     client: &reqwest::Client,
-    args: LoginArgs,
+    args: OpsListArgs,
     output: OutputFormat,
 ) -> Result<()> {
-    let base_url = normalize_base_url(&args.base_url);
-    if !args.force {
-        if let Some(email) = existing_session_identity_for_base_url(client, &base_url).await {
-            let payload = serde_json::json!({
-                "ok": true,
-                "alreadyLoggedIn": true,
-                "baseUrl": base_url,
-                "email": email,
-                "message": "Use `reallink logout` to sign out or `reallink login --force` to replace this session."
-            });
-            emit_text_or_json(
-                output,
-                &format!(
-                    "Already logged in. Use `reallink logout` to sign out or `reallink login --force` to replace this session."
-                ),
-                payload,
-            )?;
-            return Ok(());
-        }
+    let mut auth = resolve_agent_auth(&args.auth)?;
+    let mut query_pairs = Vec::new();
+    if let Some(group) = args.group.filter(|value| !value.trim().is_empty()) {
+        query_pairs.push(("group".to_string(), group));
+    }
+    if let Some(scope) = args.scope.filter(|value| !value.trim().is_empty()) {
+        query_pairs.push(("scope".to_string(), scope));
     }
+    let path = append_query_pairs_to_path("/discover", &query_pairs);
+    let response = agent_request_json(client, &mut auth, Method::GET, &path, None, &[]).await?;
+    let (status, payload) = parse_response_body(response).await?;
+    if !status.is_success() {
+        return Err(anyhow!("ops list failed ({}): {}", status, payload));
+    }
+    emit_text_or_json(output, &serde_json::to_string_pretty(&payload)?, payload)
+}
 
-    let (initial_scope, fallback_scope) = if args.scope.is_empty() {
-        (
-            default_login_scopes_with_tools(),
-            Some(default_login_scopes()),
-        )
-    } else {
-        (args.scope, None)
-    };
+async fn ops_search_command(
+    client: &reqwest::Client,
+    args: OpsSearchArgs,
+    output: OutputFormat,
+) -> Result<()> {
+    let mut auth = resolve_agent_auth(&args.auth)?;
+    let mut query_pairs = vec![("q".to_string(), args.query)];
+    if let Some(group) = args.group.filter(|value| !value.trim().is_empty()) {
+        query_pairs.push(("group".to_string(), group));
+    }
+    if let Some(scope) = args.scope.filter(|value| !value.trim().is_empty()) {
+        query_pairs.push(("scope".to_string(), scope));
+    }
+    let path = append_query_pairs_to_path("/discover/search", &query_pairs);
+    let response = agent_request_json(client, &mut auth, Method::GET, &path, None, &[]).await?;
+    let (status, payload) = parse_response_body(response).await?;
+    if !status.is_success() {
+        return Err(anyhow!("ops search failed ({}): {}", status, payload));
+    }
+    emit_text_or_json(output, &serde_json::to_string_pretty(&payload)?, payload)
+}
 
-    let mut selected_scope = initial_scope;
-    let mut device_code_response =
-        with_cli_headers(client.post(format!("{}/auth/device/code", base_url)))
-            .json(&DeviceCodeRequest {
-                client_id: args.client_id.clone(),
-                scope: selected_scope.clone(),
-            })
-            .send()
-            .await?;
+async fn ops_show_command(
+    client: &reqwest::Client,
+    args: OpsShowArgs,
+    output: OutputFormat,
+) -> Result<()> {
+    let mut auth = resolve_agent_auth(&args.auth)?;
+    let operation = fetch_discover_operation(client, &mut auth, &args.operation_id).await?;
+    let payload = serde_json::to_value(operation)?;
+    emit_text_or_json(output, &serde_json::to_string_pretty(&payload)?, payload)
+}
+
+async fn ops_invoke_command(
+    client: &reqwest::Client,
+    args: OpsInvokeArgs,
+    output: OutputFormat,
+) -> Result<()> {
+    let mut auth = resolve_agent_auth(&args.auth)?;
+    let operation = fetch_discover_operation(client, &mut auth, &args.operation_id).await?;
+    let param_pairs = parse_key_value_args(&args.param, "--param")?;
+    let headers = parse_key_value_args(&args.header, "--header")?;
+    let mut path = operation.path.clone();
+    let mut query_pairs: Vec<(String, String)> = Vec::new();
+    let mut consumed_keys = std::collections::HashSet::new();
+
+    for parameter in &operation.parameters {
+        let value = param_pairs
+            .iter()
+            .find(|(key, _)| key == &parameter.name)
+            .map(|(_, value)| value.clone())
+            .or_else(|| {
+                if parameter.name == "orgId" {
+                    args.org_id.clone()
+                } else if parameter.name == "projectId" {
+                    args.project_id.clone()
+                } else {
+                    None
+                }
+            });
+        if let Some(value) = value {
+            consumed_keys.insert(parameter.name.clone());
+            if parameter.location == "path" {
+                path = path.replace(
+                    &format!("{{{}}}", parameter.name),
+                    &urlencoding::encode(&value),
+                );
+            } else if parameter.location == "query" {
+                query_pairs.push((parameter.name.clone(), value));
+            }
+        }
+    }
+
+    if path.contains('{') {
+        return Err(anyhow!(
+            "missing required path parameter(s) for {}",
+            operation.operation_id
+        ));
+    }
+
+    let mut body = load_optional_json_body(args.body.as_deref())?;
+    let should_create_body = operation.method != Method::GET.as_str()
+        && (body.is_some()
+            || !param_pairs.is_empty()
+            || args.org_id.is_some()
+            || args.project_id.is_some());
+    if should_create_body && body.is_none() {
+        body = Some(serde_json::Value::Object(serde_json::Map::new()));
+    }
+    if let Some(serde_json::Value::Object(map)) = body.as_mut() {
+        if let Some(org_id) = args.org_id.clone() {
+            map.entry("orgId".to_string())
+                .or_insert_with(|| serde_json::Value::String(org_id));
+        }
+        if let Some(project_id) = args.project_id.clone() {
+            map.entry("projectId".to_string())
+                .or_insert_with(|| serde_json::Value::String(project_id));
+        }
+        for (key, value) in &param_pairs {
+            if consumed_keys.contains(key) {
+                continue;
+            }
+            map.entry(key.clone())
+                .or_insert_with(|| parse_scalar_json_value(value));
+        }
+    }
+
+    if let Some(org_id) = args.org_id.clone() {
+        if !query_pairs.iter().any(|(key, _)| key == "orgId")
+            && operation
+                .parameters
+                .iter()
+                .any(|parameter| parameter.location == "query" && parameter.name == "orgId")
+        {
+            query_pairs.push(("orgId".to_string(), org_id));
+        }
+    }
+    if let Some(project_id) = args.project_id.clone() {
+        if !query_pairs.iter().any(|(key, _)| key == "projectId")
+            && operation
+                .parameters
+                .iter()
+                .any(|parameter| parameter.location == "query" && parameter.name == "projectId")
+        {
+            query_pairs.push(("projectId".to_string(), project_id));
+        }
+    }
+
+    let request_path = append_query_pairs_to_path(&path, &query_pairs);
+    let method = Method::from_bytes(operation.method.as_bytes())?;
+    let response = agent_request_json(
+        client,
+        &mut auth,
+        method.clone(),
+        &request_path,
+        body.clone(),
+        &headers,
+    )
+    .await?;
+    let (status, payload) = parse_response_body(response).await?;
+    let result = serde_json::json!({
+        "ok": status.is_success(),
+        "status": status.as_u16(),
+        "operation": operation,
+        "request": {
+            "method": method.as_str(),
+            "path": request_path,
+            "body": body
+        },
+        "response": payload
+    });
+    emit_text_or_json(
+        output,
+        &serde_json::to_string_pretty(&result)?,
+        result.clone(),
+    )?;
+    if !status.is_success() {
+        return Err(anyhow!("ops invoke failed with status {}", status));
+    }
+    Ok(())
+}
+
+fn default_login_scopes() -> Vec<String> {
+    generated::contract::CLI_DEFAULT_LOGIN_SCOPES
+        .iter()
+        .map(|value| (*value).to_string())
+        .collect()
+}
+
+fn default_login_scopes_with_tools() -> Vec<String> {
+    generated::contract::CLI_DEFAULT_LOGIN_SCOPES_WITH_TOOLS
+        .iter()
+        .map(|value| (*value).to_string())
+        .collect()
+}
+
+async fn login_command(
+    client: &reqwest::Client,
+    args: LoginArgs,
+    output: OutputFormat,
+) -> Result<()> {
+    let base_url = normalize_base_url(&args.base_url);
+    if !args.force {
+        if let Some(email) = existing_session_identity_for_base_url(client, &base_url).await {
+            let payload = serde_json::json!({
+                "ok": true,
+                "alreadyLoggedIn": true,
+                "baseUrl": base_url,
+                "email": email,
+                "message": "Use `reallink logout` to sign out or `reallink login --force` to replace this session."
+            });
+            emit_text_or_json(
+                output,
+                &format!(
+                    "Already logged in. Use `reallink logout` to sign out or `reallink login --force` to replace this session."
+                ),
+                payload,
+            )?;
+            return Ok(());
+        }
+    }
+
+    let (initial_scope, fallback_scope) = if args.scope.is_empty() {
+        (
+            default_login_scopes_with_tools(),
+            Some(default_login_scopes()),
+        )
+    } else {
+        (args.scope, None)
+    };
+
+    let mut selected_scope = initial_scope;
+    let mut device_code_response = with_cli_headers(client.post(format!(
+        "{}{}",
+        base_url,
+        versioned_api_path("/auth/device/code")
+    )))
+    .json(&DeviceCodeRequest {
+        client_id: args.client_id.clone(),
+        scope: selected_scope.clone(),
+    })
+    .send()
+    .await?;
 
     if !device_code_response.status().is_success() {
         let body = read_error_body(device_code_response).await;
@@ -1989,14 +2635,17 @@ async fn login_command(
                 );
             }
             selected_scope = fallback_scope.unwrap_or_default();
-            device_code_response =
-                with_cli_headers(client.post(format!("{}/auth/device/code", base_url)))
-                    .json(&DeviceCodeRequest {
-                        client_id: args.client_id.clone(),
-                        scope: selected_scope.clone(),
-                    })
-                    .send()
-                    .await?;
+            device_code_response = with_cli_headers(client.post(format!(
+                "{}{}",
+                base_url,
+                versioned_api_path("/auth/device/code")
+            )))
+            .json(&DeviceCodeRequest {
+                client_id: args.client_id.clone(),
+                scope: selected_scope.clone(),
+            })
+            .send()
+            .await?;
             if !device_code_response.status().is_success() {
                 let retry_body = read_error_body(device_code_response).await;
                 return Err(anyhow!("Failed to start device flow: {}", retry_body));
@@ -2049,15 +2698,18 @@ async fn login_command(
 
         sleep(poll_interval).await;
 
-        let token_response =
-            with_cli_headers(client.post(format!("{}/auth/device/token", base_url)))
-                .json(&DeviceTokenRequest {
-                    grant_type: "urn:ietf:params:oauth:grant-type:device_code".to_string(),
-                    device_code: device_code.device_code.clone(),
-                    client_id: args.client_id.clone(),
-                })
-                .send()
-                .await?;
+        let token_response = with_cli_headers(client.post(format!(
+            "{}{}",
+            base_url,
+            versioned_api_path("/auth/device/token")
+        )))
+        .json(&DeviceTokenRequest {
+            grant_type: "urn:ietf:params:oauth:grant-type:device_code".to_string(),
+            device_code: device_code.device_code.clone(),
+            client_id: args.client_id.clone(),
+        })
+        .send()
+        .await?;
 
         if token_response.status().is_success() {
             let tokens: DeviceTokenSuccess = token_response.json().await?;
@@ -2375,7 +3027,10 @@ async fn logs_upload_command(
         });
         emit_text_or_json(
             output,
-            &format!("Dry run complete. {} log files are ready to upload.", payload["count"]),
+            &format!(
+                "Dry run complete. {} log files are ready to upload.",
+                payload["count"]
+            ),
             payload,
         )?;
         return Ok(());
@@ -2418,7 +3073,10 @@ async fn logs_upload_command(
                 .unwrap_or_default();
             if file_name.eq_ignore_ascii_case("runtime.jsonl") {
                 fs::write(&candidate.local_path, b"").with_context(|| {
-                    format!("Failed to clear runtime log {}", candidate.local_path.display())
+                    format!(
+                        "Failed to clear runtime log {}",
+                        candidate.local_path.display()
+                    )
                 })?;
             } else {
                 let _ = fs::remove_file(&candidate.local_path);
@@ -2528,11 +3186,87 @@ async fn token_revoke_command(client: &reqwest::Client, args: TokenRevokeArgs) -
     Ok(())
 }
 
+async fn credits_account_command(client: &reqwest::Client, args: CreditsAccountArgs) -> Result<()> {
+    let mut session = load_session()?;
+    apply_base_url_override(&mut session, args.base.base_url);
+
+    let path = format!("/orgs/{}/credits/account", args.org_id);
+    let response = authed_request(client, &mut session, Method::GET, &path, None).await?;
+    if !response.status().is_success() {
+        let body = read_error_body(response).await;
+        return Err(anyhow!("credits account failed: {}", body));
+    }
+    let payload: serde_json::Value = response.json().await?;
+    println!("{}", serde_json::to_string_pretty(&payload)?);
+    save_session(&session)?;
+    Ok(())
+}
+
+async fn credits_ledger_command(client: &reqwest::Client, args: CreditsLedgerArgs) -> Result<()> {
+    let mut session = load_session()?;
+    apply_base_url_override(&mut session, args.base.base_url);
+
+    let path = format!(
+        "/orgs/{}/credits/ledger?limit={}&offset={}",
+        args.org_id, args.limit, args.offset
+    );
+    let response = authed_request(client, &mut session, Method::GET, &path, None).await?;
+    if !response.status().is_success() {
+        let body = read_error_body(response).await;
+        return Err(anyhow!("credits ledger failed: {}", body));
+    }
+    let payload: serde_json::Value = response.json().await?;
+    println!("{}", serde_json::to_string_pretty(&payload)?);
+    save_session(&session)?;
+    Ok(())
+}
+
+async fn credits_project_usage_command(
+    client: &reqwest::Client,
+    args: CreditsProjectUsageArgs,
+) -> Result<()> {
+    let mut session = load_session()?;
+    apply_base_url_override(&mut session, args.base.base_url);
+
+    let path = format!(
+        "/projects/{}/usage?limit={}&offset={}",
+        args.project_id, args.limit, args.offset
+    );
+    let response = authed_request(client, &mut session, Method::GET, &path, None).await?;
+    if !response.status().is_success() {
+        let body = read_error_body(response).await;
+        return Err(anyhow!("project usage failed: {}", body));
+    }
+    let payload: serde_json::Value = response.json().await?;
+    println!("{}", serde_json::to_string_pretty(&payload)?);
+    save_session(&session)?;
+    Ok(())
+}
+
+async fn credits_run_usage_command(
+    client: &reqwest::Client,
+    args: CreditsRunUsageArgs,
+) -> Result<()> {
+    let mut session = load_session()?;
+    apply_base_url_override(&mut session, args.base.base_url);
+
+    let path = format!("/tools/runs/{}/usage", args.run_id);
+    let response = authed_request(client, &mut session, Method::GET, &path, None).await?;
+    if !response.status().is_success() {
+        let body = read_error_body(response).await;
+        return Err(anyhow!("run usage failed: {}", body));
+    }
+    let payload: serde_json::Value = response.json().await?;
+    println!("{}", serde_json::to_string_pretty(&payload)?);
+    save_session(&session)?;
+    Ok(())
+}
+
 async fn org_list_command(client: &reqwest::Client, args: BaseArgs) -> Result<()> {
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
-    let response = authed_request(client, &mut session, Method::GET, "/core/orgs", None).await?;
+    let response = authed_request(client, &mut session, Method::GET, "/orgs", None).await?;
     if !response.status().is_success() {
         let body = read_error_body(response).await;
         return Err(anyhow!("org list failed: {}", body));
@@ -2551,7 +3285,7 @@ async fn org_create_command(client: &reqwest::Client, args: OrgCreateArgs) -> Re
         client,
         &mut session,
         Method::POST,
-        "/core/orgs",
+        "/orgs",
         Some(serde_json::json!({
             "name": args.name
         })),
@@ -2571,7 +3305,7 @@ async fn org_get_command(client: &reqwest::Client, args: OrgGetArgs) -> Result<(
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
-    let path = format!("/core/orgs/{}", args.org_id);
+    let path = format!("/orgs/{}", args.org_id);
     let response = authed_request(client, &mut session, Method::GET, &path, None).await?;
     if !response.status().is_success() {
         let body = read_error_body(response).await;
@@ -2587,7 +3321,7 @@ async fn org_update_command(client: &reqwest::Client, args: OrgUpdateArgs) -> Re
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
-    let path = format!("/core/orgs/{}", args.org_id);
+    let path = format!("/orgs/{}", args.org_id);
     let response = authed_request(
         client,
         &mut session,
@@ -2612,7 +3346,7 @@ async fn org_delete_command(client: &reqwest::Client, args: OrgDeleteArgs) -> Re
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
-    let path = format!("/core/orgs/{}", args.org_id);
+    let path = format!("/orgs/{}", args.org_id);
     let response = authed_request(client, &mut session, Method::DELETE, &path, None).await?;
     if !response.status().is_success() {
         let body = read_error_body(response).await;
@@ -2628,7 +3362,7 @@ async fn org_invites_command(client: &reqwest::Client, args: OrgInvitesArgs) ->
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
-    let path = format!("/core/orgs/{}/invites", args.org_id);
+    let path = format!("/orgs/{}/invites", args.org_id);
     let response = authed_request(client, &mut session, Method::GET, &path, None).await?;
     if !response.status().is_success() {
         let body = read_error_body(response).await;
@@ -2667,13 +3401,17 @@ async fn org_invite_command(client: &reqwest::Client, args: OrgInviteArgs) -> Re
 
     let role = args.role.trim().to_lowercase();
     if role != "member" && role != "admin" {
-        return Err(anyhow!("org invite role must be either 'member' or 'admin'"));
+        return Err(anyhow!(
+            "org invite role must be either 'member' or 'admin'"
+        ));
     }
     if args.expires_in_days == 0 || args.expires_in_days > 30 {
-        return Err(anyhow!("org invite expires_in_days must be between 1 and 30"));
+        return Err(anyhow!(
+            "org invite expires_in_days must be between 1 and 30"
+        ));
     }
 
-    let path = format!("/core/orgs/{}/invites", args.org_id);
+    let path = format!("/orgs/{}/invites", args.org_id);
     let response = authed_request(
         client,
         &mut session,
@@ -2729,7 +3467,7 @@ async fn org_members_command(client: &reqwest::Client, args: OrgMembersArgs) ->
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
-    let path = format!("/core/orgs/{}/members", args.org_id);
+    let path = format!("/orgs/{}/members", args.org_id);
     let response = authed_request(client, &mut session, Method::GET, &path, None).await?;
     if !response.status().is_success() {
         let body = read_error_body(response).await;
@@ -2745,7 +3483,7 @@ async fn org_add_member_command(client: &reqwest::Client, args: OrgAddMemberArgs
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
-    let path = format!("/core/orgs/{}/members", args.org_id);
+    let path = format!("/orgs/{}/members", args.org_id);
     let response = authed_request(
         client,
         &mut session,
@@ -2767,11 +3505,14 @@ async fn org_add_member_command(client: &reqwest::Client, args: OrgAddMemberArgs
     Ok(())
 }
 
-async fn org_update_member_command(client: &reqwest::Client, args: OrgUpdateMemberArgs) -> Result<()> {
+async fn org_update_member_command(
+    client: &reqwest::Client,
+    args: OrgUpdateMemberArgs,
+) -> Result<()> {
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
-    let path = format!("/core/orgs/{}/members/{}", args.org_id, args.user_id);
+    let path = format!("/orgs/{}/members/{}", args.org_id, args.user_id);
     let response = authed_request(
         client,
         &mut session,
@@ -2792,11 +3533,14 @@ async fn org_update_member_command(client: &reqwest::Client, args: OrgUpdateMemb
     Ok(())
 }
 
-async fn org_remove_member_command(client: &reqwest::Client, args: OrgRemoveMemberArgs) -> Result<()> {
+async fn org_remove_member_command(
+    client: &reqwest::Client,
+    args: OrgRemoveMemberArgs,
+) -> Result<()> {
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
-    let path = format!("/core/orgs/{}/members/{}", args.org_id, args.user_id);
+    let path = format!("/orgs/{}/members/{}", args.org_id, args.user_id);
     let response = authed_request(client, &mut session, Method::DELETE, &path, None).await?;
     if !response.status().is_success() {
         let body = read_error_body(response).await;
@@ -2814,9 +3558,9 @@ async fn project_list_command(client: &reqwest::Client, args: ProjectListArgs) -
 
     let path = match args.org_id {
         Some(org_id) if !org_id.trim().is_empty() => {
-            format!("/core/projects?orgId={}", org_id.trim())
+            format!("/projects?orgId={}", org_id.trim())
         }
-        _ => "/core/projects".to_string(),
+        _ => "/projects".to_string(),
     };
 
     let response = authed_request(client, &mut session, Method::GET, &path, None).await?;
@@ -2848,7 +3592,7 @@ async fn project_create_command(client: &reqwest::Client, args: ProjectCreateArg
         client,
         &mut session,
         Method::POST,
-        "/core/projects",
+        "/projects",
         Some(serde_json::Value::Object(body)),
     )
     .await?;
@@ -2866,7 +3610,7 @@ async fn project_get_command(client: &reqwest::Client, args: ProjectGetArgs) ->
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
-    let path = format!("/core/projects/{}", args.project_id);
+    let path = format!("/projects/{}", args.project_id);
     let response = authed_request(client, &mut session, Method::GET, &path, None).await?;
     if !response.status().is_success() {
         let body = read_error_body(response).await;
@@ -2901,7 +3645,7 @@ async fn project_update_command(client: &reqwest::Client, args: ProjectUpdateArg
         ));
     }
 
-    let path = format!("/core/projects/{}", args.project_id);
+    let path = format!("/projects/{}", args.project_id);
     let response = authed_request(
         client,
         &mut session,
@@ -2924,7 +3668,7 @@ async fn project_delete_command(client: &reqwest::Client, args: ProjectDeleteArg
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
-    let path = format!("/core/projects/{}", args.project_id);
+    let path = format!("/projects/{}", args.project_id);
     let response = authed_request(client, &mut session, Method::DELETE, &path, None).await?;
     if !response.status().is_success() {
         let body = read_error_body(response).await;
@@ -2940,7 +3684,7 @@ async fn project_members_command(client: &reqwest::Client, args: ProjectMembersA
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
-    let path = format!("/core/projects/{}/members", args.project_id);
+    let path = format!("/projects/{}/members", args.project_id);
     let response = authed_request(client, &mut session, Method::GET, &path, None).await?;
     if !response.status().is_success() {
         let body = read_error_body(response).await;
@@ -2952,11 +3696,14 @@ async fn project_members_command(client: &reqwest::Client, args: ProjectMembersA
     Ok(())
 }
 
-async fn project_add_member_command(client: &reqwest::Client, args: ProjectAddMemberArgs) -> Result<()> {
+async fn project_add_member_command(
+    client: &reqwest::Client,
+    args: ProjectAddMemberArgs,
+) -> Result<()> {
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
-    let path = format!("/core/projects/{}/members", args.project_id);
+    let path = format!("/projects/{}/members", args.project_id);
     let response = authed_request(
         client,
         &mut session,
@@ -2985,7 +3732,7 @@ async fn project_update_member_command(
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
-    let path = format!("/core/projects/{}/members/{}", args.project_id, args.user_id);
+    let path = format!("/projects/{}/members/{}", args.project_id, args.user_id);
     let response = authed_request(
         client,
         &mut session,
@@ -3013,7 +3760,7 @@ async fn project_remove_member_command(
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
-    let path = format!("/core/projects/{}/members/{}", args.project_id, args.user_id);
+    let path = format!("/projects/{}/members/{}", args.project_id, args.user_id);
     let response = authed_request(client, &mut session, Method::DELETE, &path, None).await?;
     if !response.status().is_success() {
         let body = read_error_body(response).await;
@@ -3030,7 +3777,7 @@ async fn verify_project_access(
     session: &mut SessionConfig,
     project_id: &str,
 ) -> Result<()> {
-    let path = format!("/core/projects/{}", project_id);
+    let path = format!("/projects/{}", project_id);
     let response = authed_request(client, session, Method::GET, &path, None).await?;
     if response.status().is_success() {
         return Ok(());
@@ -3115,7 +3862,10 @@ async fn sync_unreal_link_manifest_asset(
     .await
 }
 
-pub(crate) async fn link_unreal_command(client: &reqwest::Client, args: LinkUnrealArgs) -> Result<()> {
+pub(crate) async fn link_unreal_command(
+    client: &reqwest::Client,
+    args: LinkUnrealArgs,
+) -> Result<()> {
     let uproject_path = resolve_uproject_path(&args.uproject)?;
     let project_root = uproject_path
         .parent()
@@ -3396,7 +4146,10 @@ pub(crate) async fn link_paths_command(args: LinkPathsArgs) -> Result<()> {
     Ok(())
 }
 
-pub(crate) async fn link_doctor_command(client: &reqwest::Client, args: LinkDoctorArgs) -> Result<()> {
+pub(crate) async fn link_doctor_command(
+    client: &reqwest::Client,
+    args: LinkDoctorArgs,
+) -> Result<()> {
     let config = load_unreal_links()?;
     if config.links.is_empty() {
         return Err(anyhow!(
@@ -4380,6 +5133,15 @@ async fn file_list_command(client: &reqwest::Client, args: FileListArgs) -> Resu
             query_parts.push(format!("path={}", cleaned));
         }
     }
+    if let Some(search) = args.search.as_deref() {
+        query_parts.push(format!("search={}", urlencoding::encode(search)));
+    }
+    if let Some(sort_by) = args.sort_by.as_deref() {
+        query_parts.push(format!("sortBy={}", urlencoding::encode(sort_by)));
+    }
+    if let Some(kind) = args.kind.as_deref() {
+        query_parts.push(format!("kind={}", urlencoding::encode(kind)));
+    }
     if let Some(offset) = args.offset {
         query_parts.push(format!("offset={}", offset));
     }
@@ -4494,10 +5256,7 @@ async fn file_thumbnail_command(client: &reqwest::Client, args: FileThumbnailArg
     if let Some(parent) = output_path.parent() {
         if !parent.as_os_str().is_empty() {
             tokio_fs::create_dir_all(parent).await.with_context(|| {
-                format!(
-                    "Failed to create output directory {}",
-                    parent.display()
-                )
+                format!("Failed to create output directory {}", parent.display())
             })?;
         }
     }
@@ -4756,10 +5515,16 @@ async fn file_set_command(client: &reqwest::Client, args: FileSetArgs) -> Result
         );
     }
     if let Some(asset_type) = args.asset_type {
-        body.insert("assetType".to_string(), serde_json::Value::String(asset_type));
+        body.insert(
+            "assetType".to_string(),
+            serde_json::Value::String(asset_type),
+        );
     }
     if let Some(visibility) = args.visibility {
-        body.insert("visibility".to_string(), serde_json::Value::String(visibility));
+        body.insert(
+            "visibility".to_string(),
+            serde_json::Value::String(visibility),
+        );
     }
 
     let path = format!("/assets/{}", args.asset_id);
@@ -4781,7 +5546,10 @@ async fn file_set_command(client: &reqwest::Client, args: FileSetArgs) -> Result
     Ok(())
 }
 
-async fn file_move_folder_command(client: &reqwest::Client, args: FileMoveFolderArgs) -> Result<()> {
+async fn file_move_folder_command(
+    client: &reqwest::Client,
+    args: FileMoveFolderArgs,
+) -> Result<()> {
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
@@ -4921,7 +5689,10 @@ async fn tool_publish_command(client: &reqwest::Client, args: ToolPublishArgs) -
         body.insert("channel".to_string(), serde_json::Value::String(channel));
     }
     if let Some(visibility) = args.visibility {
-        body.insert("visibility".to_string(), serde_json::Value::String(visibility));
+        body.insert(
+            "visibility".to_string(),
+            serde_json::Value::String(visibility),
+        );
     }
     if let Some(notes) = args.notes {
         body.insert("notes".to_string(), serde_json::Value::String(notes));
@@ -5383,57 +6154,186 @@ async fn tool_get_run_command(client: &reqwest::Client, args: ToolGetRunArgs) ->
     Ok(())
 }
 
-async fn tool_run_events_command(client: &reqwest::Client, args: ToolRunEventsArgs) -> Result<()> {
+async fn tool_cancel_command(client: &reqwest::Client, args: ToolCancelArgs) -> Result<()> {
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
-    let mut path = format!("/tools/runs/{}/events", args.run_id);
-    let mut query_parts: Vec<String> = Vec::new();
-    if let Some(limit) = args.limit {
-        query_parts.push(format!("limit={}", limit));
-    }
-    if let Some(status) = args.status {
-        query_parts.push(format!("status={}", status));
-    }
-    if let Some(stage_prefix) = args.stage_prefix {
-        query_parts.push(format!("stagePrefix={}", stage_prefix));
-    }
-    if let Some(since) = args.since {
-        query_parts.push(format!("since={}", since));
-    }
-    if let Some(until) = args.until {
-        query_parts.push(format!("until={}", until));
+    let path = format!("/tools/runs/{}/cancel", args.run_id);
+    let mut body = serde_json::Map::new();
+    if let Some(reason) = args.reason {
+        let normalized = reason.trim();
+        if !normalized.is_empty() {
+            body.insert(
+                "reason".to_string(),
+                serde_json::Value::String(normalized.to_string()),
+            );
+        }
     }
-    if !query_parts.is_empty() {
-        path.push_str(&format!("?{}", query_parts.join("&")));
+    if let Some(metadata_file) = args.metadata_file {
+        let metadata = load_jsonc_file(&metadata_file, "tool cancel metadata")?;
+        let metadata_obj = parse_object_from_value(metadata, "tool cancel metadata")?;
+        body.insert(
+            "metadata".to_string(),
+            serde_json::Value::Object(metadata_obj),
+        );
     }
+    let payload = if body.is_empty() {
+        None
+    } else {
+        Some(serde_json::Value::Object(body))
+    };
 
-    let response = authed_request(client, &mut session, Method::GET, &path, None).await?;
+    let response = authed_request(client, &mut session, Method::POST, &path, payload).await?;
     if !response.status().is_success() {
         let body = read_error_body(response).await;
-        return Err(anyhow!("tool run-events failed: {}", body));
+        return Err(anyhow!("tool cancel failed: {}", body));
     }
     let payload: serde_json::Value = response.json().await?;
     println!(
         "{}",
-        serde_json::to_string_pretty(payload.get("events").unwrap_or(&payload))?
+        serde_json::to_string_pretty(payload.get("run").unwrap_or(&payload))?
     );
     save_session(&session)?;
     Ok(())
 }
 
-fn resolve_report_url(base_url: &str, report_download_path: Option<&str>) -> Option<String> {
-    let path = report_download_path?.trim();
-    if path.is_empty() {
-        return None;
-    }
-    if path.starts_with("http://") || path.starts_with("https://") {
-        return Some(path.to_string());
+async fn tool_retry_command(client: &reqwest::Client, args: ToolRetryArgs) -> Result<()> {
+    let mut session = load_session()?;
+    apply_base_url_override(&mut session, args.base_url);
+
+    if args.input_json.is_some() && args.input_file.is_some() {
+        return Err(anyhow!(
+            "Provide either --input-json or --input-file, not both"
+        ));
     }
-    Some(format!("{}{}", normalize_base_url(base_url), path))
-}
 
-fn extract_tool_run_report_paths(
+    let mut body = serde_json::Map::new();
+    if let Some(reason) = args.reason {
+        let normalized = reason.trim();
+        if !normalized.is_empty() {
+            body.insert(
+                "reason".to_string(),
+                serde_json::Value::String(normalized.to_string()),
+            );
+        }
+    }
+
+    if let Some(path) = args.input_file {
+        let input_patch = load_jsonc_file(&path, "tool retry input patch")?;
+        let input_patch_obj = parse_object_from_value(input_patch, "tool retry input patch")?;
+        body.insert(
+            "inputPatch".to_string(),
+            serde_json::Value::Object(input_patch_obj),
+        );
+    } else if let Some(input_json) = args.input_json {
+        let input_patch = parse_jsonc_str(&input_json, "tool retry input patch")?;
+        let input_patch_obj = parse_object_from_value(input_patch, "tool retry input patch")?;
+        body.insert(
+            "inputPatch".to_string(),
+            serde_json::Value::Object(input_patch_obj),
+        );
+    }
+
+    if let Some(metadata_file) = args.metadata_file {
+        let metadata = load_jsonc_file(&metadata_file, "tool retry metadata")?;
+        let metadata_obj = parse_object_from_value(metadata, "tool retry metadata")?;
+        body.insert(
+            "metadata".to_string(),
+            serde_json::Value::Object(metadata_obj),
+        );
+    }
+
+    if args.wait {
+        body.insert(
+            "waitForCompletion".to_string(),
+            serde_json::Value::Bool(true),
+        );
+        body.insert(
+            "timeoutMs".to_string(),
+            serde_json::Value::Number(args.timeout_ms.into()),
+        );
+        body.insert(
+            "pollIntervalMs".to_string(),
+            serde_json::Value::Number(args.poll_interval_ms.into()),
+        );
+    }
+
+    let payload = if body.is_empty() {
+        None
+    } else {
+        Some(serde_json::Value::Object(body))
+    };
+
+    let path = format!("/tools/runs/{}/retry", args.run_id);
+    let response = authed_request(client, &mut session, Method::POST, &path, payload).await?;
+    if !response.status().is_success() {
+        let body = read_error_body(response).await;
+        return Err(anyhow!("tool retry failed: {}", body));
+    }
+    let payload: serde_json::Value = response.json().await?;
+    println!(
+        "{}",
+        serde_json::to_string_pretty(payload.get("run").unwrap_or(&payload))?
+    );
+    save_session(&session)?;
+    Ok(())
+}
+
+async fn tool_run_events_command(client: &reqwest::Client, args: ToolRunEventsArgs) -> Result<()> {
+    let mut session = load_session()?;
+    apply_base_url_override(&mut session, args.base_url);
+
+    let mut path = format!("/tools/runs/{}/events", args.run_id);
+    let mut query_parts: Vec<String> = Vec::new();
+    if let Some(limit) = args.limit {
+        query_parts.push(format!("limit={}", limit));
+    }
+    if let Some(status) = args.status {
+        query_parts.push(format!("status={}", status));
+    }
+    if let Some(stage_prefix) = args.stage_prefix {
+        query_parts.push(format!("stagePrefix={}", stage_prefix));
+    }
+    if let Some(since) = args.since {
+        query_parts.push(format!("since={}", since));
+    }
+    if let Some(until) = args.until {
+        query_parts.push(format!("until={}", until));
+    }
+    if !query_parts.is_empty() {
+        path.push_str(&format!("?{}", query_parts.join("&")));
+    }
+
+    let response = authed_request(client, &mut session, Method::GET, &path, None).await?;
+    if !response.status().is_success() {
+        let body = read_error_body(response).await;
+        return Err(anyhow!("tool run-events failed: {}", body));
+    }
+    let payload: serde_json::Value = response.json().await?;
+    println!(
+        "{}",
+        serde_json::to_string_pretty(payload.get("events").unwrap_or(&payload))?
+    );
+    save_session(&session)?;
+    Ok(())
+}
+
+fn resolve_report_url(base_url: &str, report_download_path: Option<&str>) -> Option<String> {
+    let path = report_download_path?.trim();
+    if path.is_empty() {
+        return None;
+    }
+    if path.starts_with("http://") || path.starts_with("https://") {
+        return Some(path.to_string());
+    }
+    Some(format!(
+        "{}{}",
+        normalize_base_url(base_url),
+        versioned_api_path(path)
+    ))
+}
+
+fn extract_tool_run_report_paths(
     run: &serde_json::Map<String, serde_json::Value>,
     base_url: &str,
 ) -> serde_json::Value {
@@ -5450,7 +6350,11 @@ fn extract_tool_run_report_paths(
     let report_download_path = output
         .get("reportHtmlDownloadPath")
         .and_then(|value| value.as_str())
-        .or_else(|| output.get("reportDownloadPath").and_then(|value| value.as_str()));
+        .or_else(|| {
+            output
+                .get("reportDownloadPath")
+                .and_then(|value| value.as_str())
+        });
     let report_url = resolve_report_url(base_url, report_download_path);
     let runtime = output
         .get("runtime")
@@ -5475,7 +6379,10 @@ fn extract_tool_run_report_paths(
     })
 }
 
-async fn tool_trace_status_command(client: &reqwest::Client, args: ToolTraceStatusArgs) -> Result<()> {
+async fn tool_trace_status_command(
+    client: &reqwest::Client,
+    args: ToolTraceStatusArgs,
+) -> Result<()> {
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
@@ -5512,6 +6419,10 @@ async fn tool_trace_status_command(client: &reqwest::Client, args: ToolTraceStat
             .get("id")
             .and_then(|value| value.as_str())
             .unwrap_or_default();
+        let run_name = run_obj
+            .get("uniqueName")
+            .and_then(|value| value.as_str())
+            .unwrap_or(run_id);
         let status = run_obj
             .get("status")
             .and_then(|value| value.as_str())
@@ -5532,6 +6443,7 @@ async fn tool_trace_status_command(client: &reqwest::Client, args: ToolTraceStat
 
         items.push(serde_json::json!({
             "runId": run_id,
+            "runName": run_name,
             "toolId": tool_id,
             "status": status,
             "createdAt": created_at,
@@ -5586,7 +6498,10 @@ fn build_tool_context_path(
     Ok(path)
 }
 
-async fn tool_context_put_command(client: &reqwest::Client, args: ToolContextPutArgs) -> Result<()> {
+async fn tool_context_put_command(
+    client: &reqwest::Client,
+    args: ToolContextPutArgs,
+) -> Result<()> {
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
@@ -5628,7 +6543,10 @@ async fn tool_context_put_command(client: &reqwest::Client, args: ToolContextPut
     Ok(())
 }
 
-async fn tool_context_get_command(client: &reqwest::Client, args: ToolContextGetArgs) -> Result<()> {
+async fn tool_context_get_command(
+    client: &reqwest::Client,
+    args: ToolContextGetArgs,
+) -> Result<()> {
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
@@ -5648,7 +6566,10 @@ async fn tool_context_get_command(client: &reqwest::Client, args: ToolContextGet
     Ok(())
 }
 
-async fn tool_local_catalog_command(client: &reqwest::Client, args: ToolLocalCatalogArgs) -> Result<()> {
+async fn tool_local_catalog_command(
+    client: &reqwest::Client,
+    args: ToolLocalCatalogArgs,
+) -> Result<()> {
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
@@ -5656,10 +6577,7 @@ async fn tool_local_catalog_command(client: &reqwest::Client, args: ToolLocalCat
     let platform = args.platform.unwrap_or(default_platform);
     let arch = args.arch.unwrap_or(default_arch);
 
-    let mut query_parts = vec![
-        format!("platform={}", platform),
-        format!("arch={}", arch),
-    ];
+    let mut query_parts = vec![format!("platform={}", platform), format!("arch={}", arch)];
     if let Some(org_id) = args.org_id {
         query_parts.push(format!("orgId={}", org_id));
     }
@@ -5682,7 +6600,10 @@ async fn tool_local_catalog_command(client: &reqwest::Client, args: ToolLocalCat
     Ok(())
 }
 
-async fn tool_local_install_command(client: &reqwest::Client, args: ToolLocalInstallArgs) -> Result<()> {
+async fn tool_local_install_command(
+    client: &reqwest::Client,
+    args: ToolLocalInstallArgs,
+) -> Result<()> {
     let mut session = load_session()?;
     apply_base_url_override(&mut session, args.base_url);
 
@@ -5754,9 +6675,9 @@ async fn tool_local_install_command(client: &reqwest::Client, args: ToolLocalIns
     }
     if let Some(parent) = output_path.parent() {
         if !parent.as_os_str().is_empty() {
-            tokio_fs::create_dir_all(parent)
-                .await
-                .with_context(|| format!("Failed to create output directory {}", parent.display()))?;
+            tokio_fs::create_dir_all(parent).await.with_context(|| {
+                format!("Failed to create output directory {}", parent.display())
+            })?;
         }
     }
 
@@ -5815,7 +6736,8 @@ async fn tool_local_install_command(client: &reqwest::Client, args: ToolLocalIns
         return Err(anyhow!("tool local install download failed: {}", body));
     }
 
-    let append_mode = resume_from.is_some() && download_response.status() == StatusCode::PARTIAL_CONTENT;
+    let append_mode =
+        resume_from.is_some() && download_response.status() == StatusCode::PARTIAL_CONTENT;
     let mut output_file = if append_mode {
         tokio_fs::OpenOptions::new()
             .append(true)
@@ -6082,14 +7004,1139 @@ async fn self_update_command(
     Ok(())
 }
 
+// ---------------------------------------------------------------------------
+// Source Bridge: link source + connect
+// ---------------------------------------------------------------------------
+
+const SOURCE_LINKS_FILE_NAME: &str = "source-links.json";
+const DEFAULT_CONNECT_URL: &str = "wss://reallink-connect.radiantclay.workers.dev";
+
+fn source_links_path() -> Result<PathBuf> {
+    Ok(state_root_path()?.join(SOURCE_LINKS_FILE_NAME))
+}
+
+fn load_source_links() -> SourceLinksConfig {
+    let path = match source_links_path() {
+        Ok(p) => p,
+        Err(_) => return SourceLinksConfig::default(),
+    };
+    let raw = match std::fs::read(&path) {
+        Ok(data) => data,
+        Err(_) => return SourceLinksConfig::default(),
+    };
+    serde_json::from_slice(&raw).unwrap_or_default()
+}
+
+fn save_source_links(config: &SourceLinksConfig) -> Result<()> {
+    let path = source_links_path()?;
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent)?;
+    }
+    let json = serde_json::to_string_pretty(config)?;
+    write_atomic(&path, json.as_bytes())?;
+    Ok(())
+}
+
+pub(crate) async fn link_source_command(
+    _client: &reqwest::Client,
+    args: LinkSourceArgs,
+) -> Result<()> {
+    let folder_path = args.path.canonicalize().with_context(|| {
+        format!(
+            "Path does not exist or is not accessible: {}",
+            args.path.display()
+        )
+    })?;
+    if !folder_path.is_dir() {
+        return Err(anyhow!(
+            "Path is not a directory: {}",
+            folder_path.display()
+        ));
+    }
+
+    let mut config = load_source_links();
+    let folder_str = folder_path.display().to_string();
+
+    // Upsert
+    let existing = config
+        .links
+        .iter_mut()
+        .find(|l| l.project_id == args.project_id && l.folder_path == folder_str);
+    if let Some(link) = existing {
+        link.folder_label = args.label.clone();
+        link.created_at_epoch_ms = now_epoch_ms();
+    } else {
+        config.links.push(SourceLinkRecord {
+            project_id: args.project_id.clone(),
+            folder_path: folder_str.clone(),
+            folder_label: args.label.clone(),
+            created_at_epoch_ms: now_epoch_ms(),
+        });
+    }
+    config.version = 1;
+    save_source_links(&config)?;
+
+    let payload = serde_json::json!({
+        "ok": true,
+        "projectId": args.project_id,
+        "folderPath": folder_str,
+        "label": args.label,
+    });
+    println!("{}", serde_json::to_string_pretty(&payload)?);
+    Ok(())
+}
+
+pub(crate) async fn link_connect_command(
+    client: &reqwest::Client,
+    args: LinkConnectArgs,
+) -> Result<()> {
+    use futures_util::{SinkExt, StreamExt};
+    use tokio_tungstenite::tungstenite::http;
+    use tokio_tungstenite::tungstenite::Message;
+
+    let config = load_source_links();
+    let maybe_session = if args.access_token.is_some() && args.base_url.is_some() {
+        None
+    } else {
+        Some(load_session()?)
+    };
+
+    // Determine project ID
+    let project_id = args.project_id
+        .or_else(|| {
+            let unreal = load_unreal_links().ok().unwrap_or_default();
+            unreal.default_project_id.clone()
+        })
+        .ok_or_else(|| anyhow!("No project ID specified and no default project set. Use --project-id or run `reallink link use`"))?;
+
+    // Find source links for this project
+    let folders: Vec<_> = config
+        .links
+        .iter()
+        .filter(|l| l.project_id == project_id)
+        .map(|l| serde_json::json!({ "path": l.folder_path, "label": l.folder_label }))
+        .collect();
+
+    if folders.is_empty() {
+        return Err(anyhow!(
+            "No source folders linked for project {}. Run `reallink link source` first.",
+            project_id
+        ));
+    }
+
+    // Fetch connect ticket from API gateway (verifies user auth + project access)
+    eprintln!("Requesting connect ticket...");
+    let base_url = args
+        .base_url
+        .as_deref()
+        .or_else(|| maybe_session.as_ref().map(|session| session.base_url.as_str()))
+        .ok_or_else(|| anyhow!("No base URL specified and no saved session available. Use --base-url or run `reallink login`"))?;
+    let access_token = args
+        .access_token
+        .as_deref()
+        .or_else(|| maybe_session.as_ref().map(|session| session.access_token.as_str()))
+        .ok_or_else(|| anyhow!("No access token specified and no saved session available. Use --access-token or run `reallink login`"))?;
+    let ticket_url = format!(
+        "{}/v1/projects/{}/connect/ticket",
+        base_url,
+        urlencoding::encode(&project_id)
+    );
+    let ticket_resp = client
+        .post(&ticket_url)
+        .header("Authorization", format!("Bearer {}", access_token))
+        .header("Content-Type", "application/json")
+        .send()
+        .await
+        .with_context(|| "Failed to request connect ticket")?;
+
+    if !ticket_resp.status().is_success() {
+        let status = ticket_resp.status();
+        let body = ticket_resp.text().await.unwrap_or_default();
+        return Err(anyhow!(
+            "Connect ticket request failed ({}): {}",
+            status,
+            body
+        ));
+    }
+
+    let ticket: serde_json::Value = ticket_resp.json().await?;
+    let connect_token = ticket
+        .get("connectToken")
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| anyhow!("No connectToken in ticket response"))?
+        .to_string();
+    let ws_base_url = ticket
+        .get("wsUrl")
+        .and_then(|v| v.as_str())
+        .map(|s| s.to_string());
+
+    // Build WS URL: use ticket wsUrl, or CLI override, or default
+    let connect_base = args
+        .connect_url
+        .or(ws_base_url.map(|u| {
+            // wsUrl is like wss://connect.../ws/projId — extract the base
+            u.rsplit_once("/ws/")
+                .map(|(base, _)| base.to_string())
+                .unwrap_or(u)
+        }))
+        .unwrap_or_else(|| DEFAULT_CONNECT_URL.to_string());
+    let ws_url = format!("{}/ws/{}", connect_base, project_id);
+
+    eprintln!("Connecting to project {} ...", project_id);
+    eprintln!("Source folders:");
+    for link in &config.links {
+        if link.project_id == project_id {
+            eprintln!("  [{}] {}", link.folder_label, link.folder_path);
+        }
+    }
+
+    // Resolve allowed root paths for security
+    let allowed_roots: Vec<std::path::PathBuf> = config
+        .links
+        .iter()
+        .filter(|l| l.project_id == project_id)
+        .filter_map(|l| std::path::PathBuf::from(&l.folder_path).canonicalize().ok())
+        .collect();
+
+    let hostname = hostname::get()
+        .map(|h| h.to_string_lossy().to_string())
+        .unwrap_or_else(|_| "unknown".to_string());
+    let workspace_id = args.workspace_id.clone().unwrap_or_else(|| {
+        format!(
+            "{}:{}:{}",
+            project_id,
+            hostname,
+            args.transport.trim().to_lowercase()
+        )
+    });
+
+    // Reconnect loop with exponential backoff
+    let mut backoff_ms: u64 = 1000;
+    let max_backoff_ms: u64 = 30_000;
+
+    loop {
+        eprintln!("Connecting WebSocket...");
+        let ws_request = http::Request::builder()
+            .uri(&ws_url)
+            .header("x-reallink-service-token", &connect_token)
+            .header(
+                "Host",
+                ws_url
+                    .replace("wss://", "")
+                    .replace("ws://", "")
+                    .split('/')
+                    .next()
+                    .unwrap_or(""),
+            )
+            .header("Upgrade", "websocket")
+            .header("Connection", "Upgrade")
+            .header(
+                "Sec-WebSocket-Key",
+                tokio_tungstenite::tungstenite::handshake::client::generate_key(),
+            )
+            .header("Sec-WebSocket-Version", "13")
+            .body(())
+            .expect("Failed to build WS request");
+        let connect_result = tokio_tungstenite::connect_async(ws_request).await;
+        let (mut ws_stream, _) = match connect_result {
+            Ok(pair) => {
+                backoff_ms = 1000; // Reset on successful connect
+                eprintln!("Connected.");
+                pair
+            }
+            Err(e) => {
+                eprintln!("Connection failed: {}. Retrying in {}ms...", e, backoff_ms);
+                tokio::time::sleep(std::time::Duration::from_millis(backoff_ms)).await;
+                backoff_ms = (backoff_ms * 2).min(max_backoff_ms);
+                continue;
+            }
+        };
+
+        // Send register message
+        let register_msg = serde_json::json!({
+            "type": "register",
+            "workspaceId": workspace_id,
+            "transport": args.transport.trim().to_lowercase(),
+            "hostname": hostname,
+            "os": std::env::consts::OS,
+            "userId": "",
+            "folders": folders,
+            "capabilities": ["stat", "read", "readRange", "readLines", "list", "search", "write", "mkdir", "delete"],
+            "metadata": {
+                "cliVersion": env!("CARGO_PKG_VERSION"),
+            }
+        });
+        if let Err(e) = ws_stream
+            .send(Message::Text(register_msg.to_string()))
+            .await
+        {
+            eprintln!("Failed to send register: {}. Reconnecting...", e);
+            tokio::time::sleep(std::time::Duration::from_millis(backoff_ms)).await;
+            backoff_ms = (backoff_ms * 2).min(max_backoff_ms);
+            continue;
+        }
+        backoff_ms = 1000; // Reset backoff after successful register
+
+        // Main message loop with heartbeat
+        let heartbeat_interval = std::time::Duration::from_secs(30);
+        let mut heartbeat_timer = tokio::time::interval(heartbeat_interval);
+        heartbeat_timer.tick().await; // consume initial tick
+
+        loop {
+            tokio::select! {
+                msg_opt = ws_stream.next() => {
+                    match msg_opt {
+                        Some(Ok(Message::Text(text))) => {
+                            if let Err(e) = handle_ws_message(&text, &allowed_roots, &mut ws_stream).await {
+                                eprintln!("Error handling message: {}", e);
+                            }
+                        },
+                        Some(Ok(Message::Close(_))) | None => {
+                            eprintln!("Connection closed. Reconnecting...");
+                            break;
+                        },
+                        Some(Ok(_)) => {}, // ping/pong/binary — ignore
+                        Some(Err(e)) => {
+                            eprintln!("WebSocket error: {}. Reconnecting...", e);
+                            break;
+                        }
+                    }
+                },
+                _ = heartbeat_timer.tick() => {
+                    let hb = serde_json::json!({"type": "heartbeat"});
+                    if let Err(e) = ws_stream.send(Message::Text(hb.to_string())).await {
+                        eprintln!("Failed to send heartbeat: {}. Reconnecting...", e);
+                        break;
+                    }
+                },
+                _ = tokio::signal::ctrl_c() => {
+                    eprintln!("\nDisconnecting...");
+                    let _ = ws_stream.close(None).await;
+                    return Ok(());
+                }
+            }
+        }
+
+        // Backoff before reconnect
+        tokio::time::sleep(std::time::Duration::from_millis(backoff_ms)).await;
+        backoff_ms = (backoff_ms * 2).min(max_backoff_ms);
+    }
+}
+
+pub(crate) async fn link_p2p_create_command(
+    client: &reqwest::Client,
+    args: LinkP2PCreateArgs,
+) -> Result<()> {
+    let mut auth = resolve_agent_auth(&AgentAuthArgs {
+        base_url: args.base_url.clone(),
+        access_token: args.access_token.clone(),
+    })?;
+    let metadata = match load_optional_json_body(args.metadata.as_deref())? {
+        Some(value) => Some(serde_json::Value::Object(parse_object_from_value(
+            value,
+            "p2p metadata",
+        )?)),
+        None => None,
+    };
+    let mut body = serde_json::Map::new();
+    if let Some(workspace_id) = args.workspace_id.filter(|value| !value.trim().is_empty()) {
+        body.insert(
+            "workspaceId".to_string(),
+            serde_json::Value::String(workspace_id),
+        );
+    }
+    if let Some(client_id) = args.client_id.filter(|value| !value.trim().is_empty()) {
+        body.insert("clientId".to_string(), serde_json::Value::String(client_id));
+    }
+    if let Some(peer_client_id) = args.peer_client_id.filter(|value| !value.trim().is_empty()) {
+        body.insert(
+            "peerClientId".to_string(),
+            serde_json::Value::String(peer_client_id),
+        );
+    }
+    if let Some(ttl_seconds) = args.ttl_seconds {
+        body.insert(
+            "ttlSeconds".to_string(),
+            serde_json::Value::Number(serde_json::Number::from(ttl_seconds)),
+        );
+    }
+    if let Some(metadata_value) = metadata {
+        body.insert("metadata".to_string(), metadata_value);
+    }
+    let path = format!(
+        "/projects/{}/connect/p2p/sessions",
+        urlencoding::encode(&args.project_id)
+    );
+    let response = agent_request_json(
+        client,
+        &mut auth,
+        Method::POST,
+        &path,
+        Some(serde_json::Value::Object(body)),
+        &[],
+    )
+    .await?;
+    let (status, payload) = parse_response_body(response).await?;
+    print_json(&payload)?;
+    if !status.is_success() {
+        return Err(anyhow!("link p2p create failed with status {}", status));
+    }
+    Ok(())
+}
+
+pub(crate) async fn link_p2p_get_command(
+    client: &reqwest::Client,
+    args: LinkP2PGetArgs,
+) -> Result<()> {
+    let mut auth = resolve_agent_auth(&AgentAuthArgs {
+        base_url: args.base_url.clone(),
+        access_token: args.access_token.clone(),
+    })?;
+    let path = format!(
+        "/projects/{}/connect/p2p/sessions/{}",
+        urlencoding::encode(&args.project_id),
+        urlencoding::encode(&args.session_id)
+    );
+    let response = agent_request_json(client, &mut auth, Method::GET, &path, None, &[]).await?;
+    let (status, payload) = parse_response_body(response).await?;
+    print_json(&payload)?;
+    if !status.is_success() {
+        return Err(anyhow!("link p2p get failed with status {}", status));
+    }
+    Ok(())
+}
+
+pub(crate) async fn link_p2p_list_command(
+    client: &reqwest::Client,
+    args: LinkP2PListArgs,
+) -> Result<()> {
+    let mut auth = resolve_agent_auth(&AgentAuthArgs {
+        base_url: args.base_url.clone(),
+        access_token: args.access_token.clone(),
+    })?;
+    let mut query_pairs = Vec::new();
+    if let Some(workspace_id) = args.workspace_id.filter(|value| !value.trim().is_empty()) {
+        query_pairs.push(("workspaceId".to_string(), workspace_id));
+    }
+    if let Some(client_id) = args.client_id.filter(|value| !value.trim().is_empty()) {
+        query_pairs.push(("clientId".to_string(), client_id));
+    }
+    if let Some(status) = args.status.filter(|value| !value.trim().is_empty()) {
+        query_pairs.push(("status".to_string(), status));
+    }
+    query_pairs.push(("limit".to_string(), args.limit.to_string()));
+    let path = append_query_pairs_to_path(
+        &format!(
+            "/projects/{}/connect/p2p/sessions",
+            urlencoding::encode(&args.project_id)
+        ),
+        &query_pairs,
+    );
+    let response = agent_request_json(client, &mut auth, Method::GET, &path, None, &[]).await?;
+    let (status, payload) = parse_response_body(response).await?;
+    print_json(&payload)?;
+    if !status.is_success() {
+        return Err(anyhow!("link p2p list failed with status {}", status));
+    }
+    Ok(())
+}
+
+pub(crate) async fn link_p2p_wait_command(
+    client: &reqwest::Client,
+    args: LinkP2PWaitArgs,
+) -> Result<()> {
+    let mut auth = resolve_agent_auth(&AgentAuthArgs {
+        base_url: args.base_url.clone(),
+        access_token: args.access_token.clone(),
+    })?;
+    let desired_status = args.status.trim().to_string();
+    if desired_status.is_empty() {
+        return Err(anyhow!("wait status must not be empty"));
+    }
+    let path = format!(
+        "/projects/{}/connect/p2p/sessions/{}",
+        urlencoding::encode(&args.project_id),
+        urlencoding::encode(&args.session_id)
+    );
+    let start = std::time::Instant::now();
+    loop {
+        let response = agent_request_json(client, &mut auth, Method::GET, &path, None, &[]).await?;
+        let (status, payload) = parse_response_body(response).await?;
+        if !status.is_success() {
+            print_json(&payload)?;
+            return Err(anyhow!("link p2p wait failed with status {}", status));
+        }
+        let current_status = payload
+            .get("session")
+            .and_then(|session| session.get("status"))
+            .and_then(|value| value.as_str())
+            .unwrap_or("");
+        if current_status == desired_status {
+            print_json(&payload)?;
+            return Ok(());
+        }
+        if start.elapsed() >= Duration::from_millis(args.timeout_ms) {
+            print_json(&payload)?;
+            return Err(anyhow!(
+                "link p2p wait timed out waiting for status {}",
+                desired_status
+            ));
+        }
+        sleep(Duration::from_millis(args.poll_interval_ms)).await;
+    }
+}
+
+pub(crate) async fn link_p2p_signal_command(
+    client: &reqwest::Client,
+    args: LinkP2PSignalArgs,
+) -> Result<()> {
+    let mut auth = resolve_agent_auth(&AgentAuthArgs {
+        base_url: args.base_url.clone(),
+        access_token: args.access_token.clone(),
+    })?;
+    let payload = load_optional_json_body(Some(args.payload.as_str()))?
+        .ok_or_else(|| anyhow!("signal payload is required"))?;
+    let payload =
+        serde_json::Value::Object(parse_object_from_value(payload, "p2p signal payload")?);
+    let mut body = serde_json::Map::new();
+    body.insert(
+        "role".to_string(),
+        serde_json::Value::String(args.role.as_api_str().to_string()),
+    );
+    body.insert(
+        "signalType".to_string(),
+        serde_json::Value::String(args.signal_type.as_api_str().to_string()),
+    );
+    body.insert("payload".to_string(), payload);
+    if let Some(signal_id) = args.signal_id.filter(|value| !value.trim().is_empty()) {
+        body.insert("signalId".to_string(), serde_json::Value::String(signal_id));
+    }
+    if let Some(from_client_id) = args.from_client_id.filter(|value| !value.trim().is_empty()) {
+        body.insert(
+            "fromClientId".to_string(),
+            serde_json::Value::String(from_client_id),
+        );
+    }
+    let path = format!(
+        "/projects/{}/connect/p2p/sessions/{}/signal",
+        urlencoding::encode(&args.project_id),
+        urlencoding::encode(&args.session_id)
+    );
+    let response = agent_request_json(
+        client,
+        &mut auth,
+        Method::POST,
+        &path,
+        Some(serde_json::Value::Object(body)),
+        &[],
+    )
+    .await?;
+    let (status, payload) = parse_response_body(response).await?;
+    print_json(&payload)?;
+    if !status.is_success() {
+        return Err(anyhow!("link p2p signal failed with status {}", status));
+    }
+    Ok(())
+}
+
+async fn handle_ws_message(
+    text: &str,
+    allowed_roots: &[std::path::PathBuf],
+    ws_stream: &mut (impl futures_util::Sink<
+        tokio_tungstenite::tungstenite::Message,
+        Error = tokio_tungstenite::tungstenite::Error,
+    > + Unpin),
+) -> Result<()> {
+    use futures_util::SinkExt;
+    use tokio_tungstenite::tungstenite::Message;
+
+    let msg: serde_json::Value = match serde_json::from_str(text) {
+        Ok(v) => v,
+        Err(e) => {
+            eprintln!("Ignoring malformed server message: {}", e);
+            return Ok(());
+        }
+    };
+    let msg_type = msg.get("type").and_then(|v| v.as_str()).unwrap_or("");
+
+    match msg_type {
+        "registered" => {
+            let client_id = msg.get("clientId").and_then(|v| v.as_str()).unwrap_or("?");
+            eprintln!("Registered as {}", client_id);
+        }
+        "tool_request" => {
+            let request_id = msg
+                .get("requestId")
+                .and_then(|v| v.as_str())
+                .unwrap_or("")
+                .to_string();
+            let tool = msg.get("tool").and_then(|v| v.as_str()).unwrap_or("");
+            let input = msg.get("input").cloned().unwrap_or(serde_json::Value::Null);
+
+            let result = execute_local_tool(tool, &input, allowed_roots).await;
+            let response = serde_json::json!({
+                "type": "tool_result",
+                "requestId": request_id,
+                "result": result,
+            });
+            ws_stream.send(Message::Text(response.to_string())).await?;
+        }
+        "error" => {
+            let message = msg
+                .get("message")
+                .and_then(|v| v.as_str())
+                .unwrap_or("unknown");
+            eprintln!("Server error: {}", message);
+        }
+        _ => {} // ignore unknown types
+    }
+    Ok(())
+}
+
+async fn execute_local_tool(
+    tool: &str,
+    input: &serde_json::Value,
+    allowed_roots: &[std::path::PathBuf],
+) -> serde_json::Value {
+    match tool {
+        "stat" => execute_stat_tool(input, allowed_roots).await,
+        "read" => execute_read_tool(input, allowed_roots).await,
+        "readRange" => execute_read_range_tool(input, allowed_roots).await,
+        "readLines" => execute_read_lines_tool(input, allowed_roots).await,
+        "list" => execute_list_tool(input, allowed_roots).await,
+        "search" => execute_search_tool(input, allowed_roots).await,
+        "write" => execute_write_tool(input, allowed_roots).await,
+        "mkdir" => execute_mkdir_tool(input, allowed_roots).await,
+        "delete" => execute_delete_tool(input, allowed_roots).await,
+        _ => serde_json::json!({"ok": false, "error": format!("unknown tool: {}", tool)}),
+    }
+}
+
+fn resolve_safe_path(
+    path_str: &str,
+    allowed_roots: &[std::path::PathBuf],
+) -> Option<std::path::PathBuf> {
+    // Try each allowed root and resolve the path relative to it
+    for root in allowed_roots {
+        let candidate = root.join(path_str);
+        // Canonicalize to resolve .. and symlinks
+        if let Ok(resolved) = candidate.canonicalize() {
+            if resolved.starts_with(root) {
+                return Some(resolved);
+            }
+        }
+    }
+    None
+}
+
+fn resolve_safe_path_allow_missing(
+    path_str: &str,
+    allowed_roots: &[std::path::PathBuf],
+) -> Option<std::path::PathBuf> {
+    for root in allowed_roots {
+        let candidate = root.join(path_str);
+        if let Some(parent) = candidate.parent() {
+            if let Ok(resolved_parent) = parent.canonicalize() {
+                if resolved_parent.starts_with(root) {
+                    return Some(candidate);
+                }
+            }
+        } else if candidate.starts_with(root) {
+            return Some(candidate);
+        }
+    }
+    None
+}
+
+async fn execute_stat_tool(
+    input: &serde_json::Value,
+    allowed_roots: &[std::path::PathBuf],
+) -> serde_json::Value {
+    let path_str = input.get("path").and_then(|v| v.as_str()).unwrap_or("");
+    if path_str.is_empty() {
+        return serde_json::json!({"ok": false, "error": "path required"});
+    }
+    let resolved = match resolve_safe_path(path_str, allowed_roots) {
+        Some(path) => path,
+        None => return serde_json::json!({"ok": false, "error": "path not within allowed folders"}),
+    };
+    match tokio::fs::metadata(&resolved).await {
+        Ok(metadata) => serde_json::json!({
+            "ok": true,
+            "data": {
+                "path": path_str.replace("\\\\", "/"),
+                "name": resolved.file_name().map(|value| value.to_string_lossy().to_string()).unwrap_or_default(),
+                "isDirectory": metadata.is_dir(),
+                "size": if metadata.is_file() { Some(metadata.len()) } else { None::<u64> },
+                "lastModified": metadata.modified().ok().and_then(|value| value.duration_since(std::time::UNIX_EPOCH).ok()).map(|value| value.as_secs()),
+                "backend": "bridge",
+            }
+        }),
+        Err(error) => serde_json::json!({"ok": false, "error": error.to_string()}),
+    }
+}
+
+async fn execute_read_tool(
+    input: &serde_json::Value,
+    allowed_roots: &[std::path::PathBuf],
+) -> serde_json::Value {
+    if input.get("startByte").and_then(|v| v.as_u64()).is_some()
+        || input.get("length").and_then(|v| v.as_u64()).is_some()
+    {
+        return execute_read_range_tool(input, allowed_roots).await;
+    }
+    let path_str = input.get("path").and_then(|v| v.as_str()).unwrap_or("");
+    if path_str.is_empty() {
+        return serde_json::json!({"ok": false, "error": "path required"});
+    }
+    let resolved = match resolve_safe_path(path_str, allowed_roots) {
+        Some(p) => p,
+        None => return serde_json::json!({"ok": false, "error": "path not within allowed folders"}),
+    };
+    match tokio::fs::read_to_string(&resolved).await {
+        Ok(content) => serde_json::json!({"ok": true, "data": content}),
+        Err(e) => serde_json::json!({"ok": false, "error": e.to_string()}),
+    }
+}
+
+async fn execute_read_range_tool(
+    input: &serde_json::Value,
+    allowed_roots: &[std::path::PathBuf],
+) -> serde_json::Value {
+    let path_str = input.get("path").and_then(|v| v.as_str()).unwrap_or("");
+    let start_byte = input.get("startByte").and_then(|v| v.as_u64()).unwrap_or(0);
+    let length = input
+        .get("length")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(4096)
+        .clamp(1, 256 * 1024);
+    if path_str.is_empty() {
+        return serde_json::json!({"ok": false, "error": "path required"});
+    }
+    let resolved = match resolve_safe_path(path_str, allowed_roots) {
+        Some(p) => p,
+        None => return serde_json::json!({"ok": false, "error": "path not within allowed folders"}),
+    };
+
+    let mut file = match tokio::fs::File::open(&resolved).await {
+        Ok(file) => file,
+        Err(error) => return serde_json::json!({"ok": false, "error": error.to_string()}),
+    };
+    let metadata = match file.metadata().await {
+        Ok(metadata) => metadata,
+        Err(error) => return serde_json::json!({"ok": false, "error": error.to_string()}),
+    };
+    let total_bytes = metadata.len();
+    let safe_start = start_byte.min(total_bytes);
+    if let Err(error) = file.seek(SeekFrom::Start(safe_start)).await {
+        return serde_json::json!({"ok": false, "error": error.to_string()});
+    }
+    let mut reader = file.take(length);
+    let mut buffer = Vec::new();
+    if let Err(error) = reader.read_to_end(&mut buffer).await {
+        return serde_json::json!({"ok": false, "error": error.to_string()});
+    }
+    let end_byte = safe_start + buffer.len() as u64;
+    serde_json::json!({
+        "ok": true,
+        "data": {
+            "path": path_str.replace("\\\\", "/"),
+            "content": String::from_utf8_lossy(&buffer).to_string(),
+            "startByte": safe_start,
+            "endByte": end_byte,
+            "totalBytes": total_bytes,
+            "truncated": end_byte < total_bytes,
+        }
+    })
+}
+
+async fn execute_read_lines_tool(
+    input: &serde_json::Value,
+    allowed_roots: &[std::path::PathBuf],
+) -> serde_json::Value {
+    let path_str = input.get("path").and_then(|v| v.as_str()).unwrap_or("");
+    let center_line = input
+        .get("centerLine")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(1) as usize;
+    let context_lines = input
+        .get("contextLines")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(20) as usize;
+    // Clamp context to prevent excessive memory use
+    let context_lines = context_lines.min(500);
+
+    if path_str.is_empty() {
+        return serde_json::json!({"ok": false, "error": "path required"});
+    }
+    if center_line == 0 {
+        return serde_json::json!({"ok": false, "error": "centerLine must be >= 1"});
+    }
+    let resolved = match resolve_safe_path(path_str, allowed_roots) {
+        Some(p) => p,
+        None => return serde_json::json!({"ok": false, "error": "path not within allowed folders"}),
+    };
+    match tokio::fs::read_to_string(&resolved).await {
+        Ok(content) => {
+            // Use .lines() to avoid trailing empty element from split('\n')
+            let lines: Vec<&str> = content.lines().collect();
+            let start = center_line.saturating_sub(1 + context_lines);
+            let end = (center_line + context_lines).min(lines.len());
+            let formatted: Vec<String> = lines[start..end]
+                .iter()
+                .enumerate()
+                .map(|(idx, line)| {
+                    let line_num = start + idx + 1;
+                    let marker = if line_num == center_line {
+                        ">>>"
+                    } else {
+                        "   "
+                    };
+                    format!("{} {:5}: {}", marker, line_num, line)
+                })
+                .collect();
+            serde_json::json!({"ok": true, "data": formatted.join("\n")})
+        }
+        Err(e) => serde_json::json!({"ok": false, "error": e.to_string()}),
+    }
+}
+
+async fn execute_list_tool(
+    input: &serde_json::Value,
+    allowed_roots: &[std::path::PathBuf],
+) -> serde_json::Value {
+    let path_str = input.get("path").and_then(|v| v.as_str()).unwrap_or("");
+    let resolved = if path_str.is_empty() {
+        // List all allowed roots
+        let entries: Vec<serde_json::Value> = allowed_roots.iter().map(|root| {
+            serde_json::json!({
+                "path": root.display().to_string(),
+                "name": root.file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_default(),
+                "isDirectory": true,
+            })
+        }).collect();
+        return serde_json::json!({"ok": true, "data": entries});
+    } else {
+        match resolve_safe_path(path_str, allowed_roots) {
+            Some(p) => p,
+            None => {
+                return serde_json::json!({"ok": false, "error": "path not within allowed folders"})
+            }
+        }
+    };
+
+    match tokio::fs::read_dir(&resolved).await {
+        Ok(mut dir) => {
+            let mut entries = Vec::new();
+            while let Ok(Some(entry)) = dir.next_entry().await {
+                let meta = entry.metadata().await.ok();
+                entries.push(serde_json::json!({
+                    "path": entry.path().display().to_string(),
+                    "name": entry.file_name().to_string_lossy().to_string(),
+                    "isDirectory": meta.as_ref().map(|m| m.is_dir()).unwrap_or(false),
+                    "size": meta.as_ref().map(|m| m.len()).unwrap_or(0),
+                }));
+            }
+            serde_json::json!({"ok": true, "data": entries})
+        }
+        Err(e) => serde_json::json!({"ok": false, "error": e.to_string()}),
+    }
+}
+
+async fn execute_search_tool(
+    input: &serde_json::Value,
+    allowed_roots: &[std::path::PathBuf],
+) -> serde_json::Value {
+    let mode = input.get("mode").and_then(|v| v.as_str()).unwrap_or("");
+    let filename = input.get("filename").and_then(|v| v.as_str()).unwrap_or("");
+    let pattern = input.get("pattern").and_then(|v| v.as_str()).unwrap_or("");
+    let content_pattern = input
+        .get("contentPattern")
+        .and_then(|v| v.as_str())
+        .unwrap_or("");
+    let target = if !content_pattern.is_empty() {
+        content_pattern
+    } else if !filename.is_empty() {
+        filename
+    } else {
+        pattern
+    };
+    if target.is_empty() {
+        return serde_json::json!({"ok": false, "error": "filename, pattern, or contentPattern required"});
+    }
+
+    let content_mode = mode.eq_ignore_ascii_case("content") || !content_pattern.is_empty();
+    let case_sensitive = input
+        .get("caseSensitive")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false);
+    let regex_enabled = input
+        .get("regex")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false);
+    let max_results = input
+        .get("maxResults")
+        .and_then(|v| v.as_u64())
+        .unwrap_or(25)
+        .clamp(1, 250) as usize;
+    let path_prefix = input
+        .get("pathPrefix")
+        .and_then(|v| v.as_str())
+        .map(|value| value.replace("\\", "/").trim_start_matches('/').to_string());
+    let target_lower = target.to_lowercase();
+    let matcher: Option<regex::Regex> = if regex_enabled {
+        match RegexBuilder::new(target)
+            .case_insensitive(!case_sensitive)
+            .build()
+        {
+            Ok(regex) => Some(regex),
+            Err(error) => {
+                return serde_json::json!({"ok": false, "error": format!("invalid regex: {}", error)})
+            }
+        }
+    } else {
+        None
+    };
+
+    let mut results: Vec<serde_json::Value> = Vec::new();
+    'outer: for root in allowed_roots {
+        for entry in walkdir::WalkDir::new(root)
+            .max_depth(20)
+            .follow_links(false)
+            .into_iter()
+            .filter_map(|e| e.ok())
+        {
+            if results.len() >= max_results {
+                break 'outer;
+            }
+            if !entry.file_type().is_file() {
+                continue;
+            }
+            let rel_path = entry
+                .path()
+                .strip_prefix(root)
+                .map(|p| p.display().to_string().replace("\\", "/"))
+                .unwrap_or_else(|_| entry.path().display().to_string().replace("\\", "/"));
+            if let Some(prefix) = path_prefix.as_ref() {
+                if !rel_path.starts_with(prefix) {
+                    continue;
+                }
+            }
+
+            if !content_mode {
+                let name = entry.file_name().to_string_lossy().to_string();
+                let matched = if let Some(regex) = matcher.as_ref() {
+                    regex.is_match(&name)
+                } else if case_sensitive {
+                    name.contains(target)
+                } else {
+                    name.to_lowercase().contains(&target_lower)
+                };
+                if matched {
+                    results.push(serde_json::json!({
+                        "path": rel_path,
+                        "kind": "filename",
+                    }));
+                }
+                continue;
+            }
+
+            let file = match tokio::fs::File::open(entry.path()).await {
+                Ok(file) => file,
+                Err(_) => continue,
+            };
+            let mut reader = BufReader::new(file);
+            let mut line = String::new();
+            let mut line_number = 0usize;
+            let mut scanned_bytes = 0usize;
+            let max_bytes_per_file = 2 * 1024 * 1024usize;
+            loop {
+                line.clear();
+                let bytes_read = match reader.read_line(&mut line).await {
+                    Ok(bytes) => bytes,
+                    Err(_) => break,
+                };
+                if bytes_read == 0 {
+                    break;
+                }
+                scanned_bytes += bytes_read;
+                if scanned_bytes > max_bytes_per_file || line.as_bytes().contains(&0) {
+                    break;
+                }
+                line_number += 1;
+                let line_text = line.trim_end_matches(&['\r', '\n'][..]);
+                let found_at = if let Some(regex) = matcher.as_ref() {
+                    regex
+                        .find(line_text)
+                        .map(|m| (m.start(), m.as_str().to_string()))
+                } else if case_sensitive {
+                    line_text
+                        .find(target)
+                        .map(|index| (index, line_text[index..index + target.len()].to_string()))
+                } else {
+                    line_text
+                        .to_lowercase()
+                        .find(&target_lower)
+                        .map(|index| (index, line_text[index..index + target.len()].to_string()))
+                };
+                if let Some((column, matched_text)) = found_at {
+                    results.push(serde_json::json!({
+                        "path": rel_path,
+                        "kind": "content",
+                        "line": line_number,
+                        "column": column + 1,
+                        "match": matched_text,
+                        "preview": line_text,
+                    }));
+                    if results.len() >= max_results {
+                        break 'outer;
+                    }
+                }
+            }
+        }
+    }
+    serde_json::json!({"ok": true, "data": results})
+}
+
+async fn execute_write_tool(
+    input: &serde_json::Value,
+    allowed_roots: &[std::path::PathBuf],
+) -> serde_json::Value {
+    let path_str = input.get("path").and_then(|v| v.as_str()).unwrap_or("");
+    let content = input.get("content").and_then(|v| v.as_str()).unwrap_or("");
+    let create_parents = input
+        .get("createParents")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(true);
+    let overwrite = input
+        .get("overwrite")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(true);
+
+    if path_str.is_empty() {
+        return serde_json::json!({"ok": false, "error": "path required"});
+    }
+
+    let resolved = match resolve_safe_path_allow_missing(path_str, allowed_roots) {
+        Some(path) => path,
+        None => return serde_json::json!({"ok": false, "error": "path not within allowed folders"}),
+    };
+
+    if create_parents {
+        if let Some(parent) = resolved.parent() {
+            if let Err(error) = tokio::fs::create_dir_all(parent).await {
+                return serde_json::json!({"ok": false, "error": error.to_string()});
+            }
+        }
+    }
+
+    if !overwrite && resolved.exists() {
+        return serde_json::json!({"ok": false, "error": format!("file already exists: {}", path_str)});
+    }
+
+    match tokio::fs::write(&resolved, content).await {
+        Ok(_) => match tokio::fs::metadata(&resolved).await {
+            Ok(metadata) => serde_json::json!({
+                "ok": true,
+                "data": {
+                    "path": path_str.replace("\\\\", "/"),
+                    "name": resolved.file_name().map(|value| value.to_string_lossy().to_string()).unwrap_or_default(),
+                    "isDirectory": metadata.is_dir(),
+                    "size": if metadata.is_file() { Some(metadata.len()) } else { None::<u64> },
+                    "lastModified": metadata.modified().ok().and_then(|value| value.duration_since(std::time::UNIX_EPOCH).ok()).map(|value| value.as_secs()),
+                    "backend": "bridge",
+                }
+            }),
+            Err(error) => serde_json::json!({"ok": false, "error": error.to_string()}),
+        },
+        Err(error) => serde_json::json!({"ok": false, "error": error.to_string()}),
+    }
+}
+
+async fn execute_mkdir_tool(
+    input: &serde_json::Value,
+    allowed_roots: &[std::path::PathBuf],
+) -> serde_json::Value {
+    let path_str = input.get("path").and_then(|v| v.as_str()).unwrap_or("");
+    let create_parents = input
+        .get("createParents")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(true);
+    if path_str.is_empty() {
+        return serde_json::json!({"ok": false, "error": "path required"});
+    }
+
+    let resolved = match resolve_safe_path_allow_missing(path_str, allowed_roots) {
+        Some(path) => path,
+        None => return serde_json::json!({"ok": false, "error": "path not within allowed folders"}),
+    };
+
+    let result = if create_parents {
+        tokio::fs::create_dir_all(&resolved).await
+    } else {
+        tokio::fs::create_dir(&resolved).await
+    };
+
+    match result {
+        Ok(_) => serde_json::json!({
+            "ok": true,
+            "data": {
+                "path": path_str.replace("\\\\", "/"),
+                "name": resolved.file_name().map(|value| value.to_string_lossy().to_string()).unwrap_or_default(),
+                "isDirectory": true,
+                "backend": "bridge",
+            }
+        }),
+        Err(error) => serde_json::json!({"ok": false, "error": error.to_string()}),
+    }
+}
+
+async fn execute_delete_tool(
+    input: &serde_json::Value,
+    allowed_roots: &[std::path::PathBuf],
+) -> serde_json::Value {
+    let path_str = input.get("path").and_then(|v| v.as_str()).unwrap_or("");
+    let recursive = input
+        .get("recursive")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false);
+    if path_str.is_empty() {
+        return serde_json::json!({"ok": false, "error": "path required"});
+    }
+
+    let resolved = match resolve_safe_path(path_str, allowed_roots) {
+        Some(path) => path,
+        None => return serde_json::json!({"ok": false, "error": "path not within allowed folders"}),
+    };
+
+    match tokio::fs::metadata(&resolved).await {
+        Ok(metadata) => {
+            let result = if metadata.is_dir() {
+                if recursive {
+                    tokio::fs::remove_dir_all(&resolved).await
+                } else {
+                    tokio::fs::remove_dir(&resolved).await
+                }
+            } else {
+                tokio::fs::remove_file(&resolved).await
+            };
+            match result {
+                Ok(_) => serde_json::json!({"ok": true, "data": true}),
+                Err(error) => serde_json::json!({"ok": false, "error": error.to_string()}),
+            }
+        }
+        Err(error) => serde_json::json!({"ok": false, "error": error.to_string()}),
+    }
+}
+
 #[cfg(test)]
 mod tests {
+    use super::unreal::{PluginIndexFile, PluginIndexPlugin, PluginIndexVersion};
     use super::{
         compose_plugin_archive_url, default_login_scopes, default_login_scopes_with_tools,
         file_name_component, normalize_public_bucket_base, normalize_sha256_hex, parse_api_error,
         resolve_plugin_from_index,
     };
-    use super::unreal::{PluginIndexFile, PluginIndexPlugin, PluginIndexVersion};
 
     #[test]
     fn normalizes_public_bucket_base() {
@@ -6223,6 +8270,13 @@ async fn run_cli(cli: Cli) -> Result<()> {
         Commands::Whoami(args) => whoami_command(&client, args).await?,
         Commands::Logout => logout_command(&client, cli.output).await?,
         Commands::SelfUpdate(args) => self_update_command(&client, args, cli.output).await?,
+        Commands::Call(args) => call_command(&client, args, cli.output).await?,
+        Commands::Ops { command } => match command {
+            OpsCommands::List(args) => ops_list_command(&client, args, cli.output).await?,
+            OpsCommands::Search(args) => ops_search_command(&client, args, cli.output).await?,
+            OpsCommands::Show(args) => ops_show_command(&client, args, cli.output).await?,
+            OpsCommands::Invoke(args) => ops_invoke_command(&client, args, cli.output).await?,
+        },
         Commands::Org { command } => match command {
             OrgCommands::List(args) => org_list_command(&client, args).await?,
             OrgCommands::Create(args) => org_create_command(&client, args).await?,
@@ -6257,6 +8311,14 @@ async fn run_cli(cli: Cli) -> Result<()> {
             TokenCommands::Create(args) => token_create_command(&client, args).await?,
             TokenCommands::Revoke(args) => token_revoke_command(&client, args).await?,
         },
+        Commands::Credits { command } => match command {
+            CreditsCommands::Account(args) => credits_account_command(&client, args).await?,
+            CreditsCommands::Ledger(args) => credits_ledger_command(&client, args).await?,
+            CreditsCommands::ProjectUsage(args) => {
+                credits_project_usage_command(&client, args).await?
+            }
+            CreditsCommands::RunUsage(args) => credits_run_usage_command(&client, args).await?,
+        },
         Commands::File { command } => match command {
             FileCommands::List(args) => file_list_command(&client, args).await?,
             FileCommands::Tree(args) => file_tree_command(&client, args).await?,
@@ -6286,11 +8348,17 @@ async fn run_cli(cli: Cli) -> Result<()> {
             SkillCommands::Run(args) => tool_run_command(&client, args).await?,
             SkillCommands::Runs(args) => tool_runs_command(&client, args).await?,
             SkillCommands::GetRun(args) => tool_get_run_command(&client, args).await?,
+            SkillCommands::Cancel(args) => tool_cancel_command(&client, args).await?,
+            SkillCommands::Retry(args) => tool_retry_command(&client, args).await?,
             SkillCommands::RunEvents(args) => tool_run_events_command(&client, args).await?,
             SkillCommands::TraceStatus(args) => tool_trace_status_command(&client, args).await?,
             SkillCommands::Local { command } => match command {
-                ToolLocalCommands::Catalog(args) => tool_local_catalog_command(&client, args).await?,
-                ToolLocalCommands::Install(args) => tool_local_install_command(&client, args).await?,
+                ToolLocalCommands::Catalog(args) => {
+                    tool_local_catalog_command(&client, args).await?
+                }
+                ToolLocalCommands::Install(args) => {
+                    tool_local_install_command(&client, args).await?
+                }
                 ToolLocalCommands::CompleteRun(args) => {
                     tool_local_complete_run_command(&client, args).await?
                 }
@@ -6310,11 +8378,17 @@ async fn run_cli(cli: Cli) -> Result<()> {
             ToolCommands::Run(args) => tool_run_command(&client, args).await?,
             ToolCommands::Runs(args) => tool_runs_command(&client, args).await?,
             ToolCommands::GetRun(args) => tool_get_run_command(&client, args).await?,
+            ToolCommands::Cancel(args) => tool_cancel_command(&client, args).await?,
+            ToolCommands::Retry(args) => tool_retry_command(&client, args).await?,
             ToolCommands::RunEvents(args) => tool_run_events_command(&client, args).await?,
             ToolCommands::TraceStatus(args) => tool_trace_status_command(&client, args).await?,
             ToolCommands::Local { command } => match command {
-                ToolLocalCommands::Catalog(args) => tool_local_catalog_command(&client, args).await?,
-                ToolLocalCommands::Install(args) => tool_local_install_command(&client, args).await?,
+                ToolLocalCommands::Catalog(args) => {
+                    tool_local_catalog_command(&client, args).await?
+                }
+                ToolLocalCommands::Install(args) => {
+                    tool_local_install_command(&client, args).await?
+                }
                 ToolLocalCommands::CompleteRun(args) => {
                     tool_local_complete_run_command(&client, args).await?
                 }