runwork 0.16.1 → 0.17.1

package/dist/index.js

@@ -411,6 +411,29 @@ class ApiClient {
     const res = await this.request("/api/dev/workspaces");
     return res.data;
   }
+  async listWorkspaceMembers(workspaceId) {
+    const res = await this.request(`/api/workspaces/${workspaceId}/members`);
+    return res.data.members;
+  }
+  async rawApiCall(method, path, opts) {
+    const targetPath = opts?.query ? `${path}${path.includes("?") ? "&" : "?"}${opts.query}` : path;
+    const url = `${this.baseUrl}${targetPath}`;
+    const headers = { ...opts?.headers || {} };
+    if (this.apiKey) {
+      headers["Authorization"] = `Bearer ${this.apiKey}`;
+    }
+    let body;
+    if (opts?.body !== undefined) {
+      body = typeof opts.body === "string" ? opts.body : JSON.stringify(opts.body);
+      if (!Object.keys(headers).some((h) => h.toLowerCase() === "content-type")) {
+        headers["Content-Type"] = "application/json";
+      }
+    }
+    const response = await httpFetch(url, { method: method.toUpperCase(), headers, body });
+    const contentType = response.headers.get("content-type") || "";
+    const responseBody = contentType.includes("application/json") ? await response.json() : await response.text();
+    return { status: response.status, ok: response.ok, contentType, body: responseBody };
+  }
   async listApps(workspaceId) {
     const query = workspaceId ? `?workspaceId=${workspaceId}` : "";
     const res = await this.request(`/api/dev/apps${query}`);
@@ -883,20 +906,28 @@ var init_subprocess = () => {};
 
 // src/git/credentials.ts
 import { existsSync as existsSync2 } from "fs";
-function buildHelperValue(execPath) {
+function buildHelperValue(execPath, scriptPath) {
   const normalised = execPath.replace(/\\/g, "/");
+  const runtimeName = normalised.split("/").pop()?.toLowerCase() ?? "";
+  if (SCRIPT_RUNTIMES.has(runtimeName) && scriptPath) {
+    const script = scriptPath.replace(/\\/g, "/");
+    return `!"${normalised}" "${script}" git-credential-helper`;
+  }
   return `!"${normalised}" git-credential-helper`;
 }
 async function configureGitCredentials(remoteUrl) {
   const origin = new URL(remoteUrl).origin;
-  const helperValue = buildHelperValue(process.execPath);
+  const key = `credential.${origin}.helper`;
+  const helperValue = buildHelperValue(process.execPath, process.argv[1]);
   try {
-    execFileSync("git", [
-      "config",
-      "--global",
-      `credential.${origin}.helper`,
-      helperValue
-    ], { stdio: "pipe" });
+    try {
+      execFileSync("git", ["config", "--global", "--unset-all", key], { stdio: "pipe" });
+    } catch (unsetErr) {
+      if (unsetErr?.code === "ENOENT")
+        throw unsetErr;
+    }
+    execFileSync("git", ["config", "--global", "--add", key, ""], { stdio: "pipe" });
+    execFileSync("git", ["config", "--global", "--add", key, helperValue], { stdio: "pipe" });
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT") {
@@ -915,14 +946,37 @@ function lookupCredentialHelper(origin) {
   } catch {
     return { status: "none" };
   }
-  const lines = helperConfig.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
-  const escapedOrigin = origin.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const scopedRegex = new RegExp(`^credential\\.${escapedOrigin}\\.helper\\s+(.+)$`);
-  const matchedLine = lines.find((line) => scopedRegex.test(line));
-  if (!matchedLine) {
-    return { status: "unscoped", otherCount: lines.length };
+  const keyName = `credential.${origin}.helper`;
+  let value = "";
+  let registered = false;
+  let hasReset = false;
+  let otherCount = 0;
+  for (const raw of helperConfig.split(/\r?\n/)) {
+    if (!raw.trim())
+      continue;
+    const m = raw.match(/^(\S+)(?:\s+(.*))?$/);
+    if (!m)
+      continue;
+    const key = m[1];
+    const val = (m[2] ?? "").trim();
+    if (key === keyName) {
+      if (val === "")
+        hasReset = true;
+      else if (!registered) {
+        registered = true;
+        value = val;
+      }
+    } else {
+      otherCount++;
+    }
+  }
+  if (registered) {
+    return { status: "registered", value, hasReset };
+  }
+  if (otherCount === 0 && !hasReset) {
+    return { status: "none" };
   }
-  return { status: "registered", value: scopedRegex.exec(matchedLine)?.[1] ?? "" };
+  return { status: "unscoped", otherCount };
 }
 function helperBinaryStatus(value) {
   const absoluteHelperRegex = /^!"?(\/|[A-Za-z]:[\\/])/;
@@ -942,7 +996,7 @@ async function ensureGitCredentialHelper(baseUrl) {
     return;
   }
   const lookup = lookupCredentialHelper(origin);
-  if (lookup.status === "registered" && helperBinaryStatus(lookup.value).ok) {
+  if (lookup.status === "registered" && helperBinaryStatus(lookup.value).ok && lookup.hasReset) {
     return;
   }
   await configureGitCredentials(baseUrl);
@@ -953,7 +1007,7 @@ async function removeGitCredentials(baseUrl) {
     execFileSync("git", [
       "config",
       "--global",
-      "--unset",
+      "--unset-all",
       `credential.${origin}.helper`
     ], { stdio: "pipe" });
   } catch {}
@@ -996,9 +1050,11 @@ function readStdin() {
       resolve(data);
   });
 }
+var SCRIPT_RUNTIMES;
 var init_credentials = __esm(() => {
   init_subprocess();
   init_store();
+  SCRIPT_RUNTIMES = new Set(["node", "node.exe", "bun", "bun.exe"]);
 });
 
 // src/auth/login-flow.ts
@@ -1429,8 +1485,8 @@ async function resolveWorkspace(client, nameOrId) {
   console.error(`Workspace "${nameOrId}" not found. Available: ${workspaces.map((w) => w.name).join(", ")}`);
   process.exit(1);
 }
-async function resolveApp(client, nameOrId) {
-  const apps = await client.listApps();
+async function resolveApp(client, nameOrId, workspaceId) {
+  const apps = await client.listApps(workspaceId);
   if (apps.length === 0) {
     console.error("No apps found.");
     process.exit(1);
@@ -2422,7 +2478,7 @@ var init_clone = __esm(() => {
   init_remote();
   init_repo_config();
   init_preflight();
-  cloneCommand = new Command3("clone").description("Clone a Runwork app to local development").argument("[appId]", "App ID to clone (interactive if omitted)").argument("[directory]", "Target directory").option("--app <name-or-id>", "App name or ID (skips interactive selection)").addHelpText("after", RESTRICTED_FS_HELP).action(async (rawAppId, rawDirectory, options) => {
+  cloneCommand = new Command3("clone").description("Clone a Runwork app to local development").argument("[appId]", "App ID to clone (interactive if omitted)").argument("[directory]", "Target directory").option("--app <name-or-id>", "App name or ID (skips interactive selection)").option("--workspace <name-or-id>", "Workspace to look up the app in (name or ID)").addHelpText("after", RESTRICTED_FS_HELP).action(async (rawAppId, rawDirectory, options) => {
     requireGit("clone");
     const { appId, directory } = normalizeCloneArgs(rawAppId, rawDirectory, options);
     const creds = requireAuth();
@@ -2430,10 +2486,15 @@ var init_clone = __esm(() => {
     const useJson = shouldOutputJson(undefined);
     let app;
     const appRef = options?.app || appId;
+    let workspaceId;
+    if (options?.workspace) {
+      const ws = await resolveWorkspace(client, options.workspace);
+      workspaceId = ws.id;
+    }
     if (appRef) {
-      app = await resolveApp(client, appRef);
+      app = await resolveApp(client, appRef, workspaceId);
     } else {
-      const apps = await client.listApps();
+      const apps = await client.listApps(workspaceId);
       if (apps.length === 0) {
         if (useJson) {
           jsonOut(buildErrorResponse("clone", "No apps found", "No apps are available to clone.", ["Create an app first with: runwork init my-app"]));
@@ -3307,13 +3368,20 @@ function resolvePollDeps(deps) {
 }
 async function pollForSession(appDir, expectedPid, expectedAppId, opts = {}) {
   const intervalMs = opts.intervalMs ?? 250;
-  const timeoutMs = opts.timeoutMs ?? 90000;
+  const timeoutMs = opts.timeoutMs ?? DETACH_READY_TIMEOUT_MS;
+  const heartbeatMs = opts.heartbeatMs ?? DETACH_WAITING_HEARTBEAT_MS;
   const d = resolvePollDeps(opts.deps);
-  const deadline = d.now() + timeoutMs;
+  const startedAt = d.now();
+  const deadline = startedAt + timeoutMs;
+  let lastHeartbeatAt = startedAt;
   while (d.now() < deadline) {
     if (opts.isChildAlive && !opts.isChildAlive()) {
       return { result: "child-exited" };
     }
+    if (opts.onWaiting && d.now() - lastHeartbeatAt >= heartbeatMs) {
+      lastHeartbeatAt = d.now();
+      opts.onWaiting(d.now() - startedAt);
+    }
     const file = readSessionFile(appDir);
     if (file && file.previewUrl && file.appId === expectedAppId) {
       if (file.pid === expectedPid) {
@@ -3349,7 +3417,9 @@ async function runAsDetachedParent(opts) {
     intervalMs: opts.intervalMs,
     timeoutMs: opts.timeoutMs,
     deps: opts.pollDeps,
-    isChildAlive: child.isAlive
+    isChildAlive: child.isAlive,
+    onWaiting: opts.onWaiting,
+    heartbeatMs: opts.heartbeatMs
   });
   if (outcome.result === "ready") {
     return { result: "started", file: outcome.file };
@@ -3366,22 +3436,27 @@ async function runAsDetachedParent(opts) {
   try {
     removeSessionFileIfOwned(opts.appDir, child.pid);
   } catch {}
-  const childLogTail = readChildStderrTail(opts.appDir);
+  const childLogTail = readChildLogTail(opts.appDir);
   if (outcome.result === "child-exited") {
     return { result: "child-exited", ourPid: child.pid, childLogTail };
   }
   return { result: "timeout", ourPid: child.pid, childLogTail };
 }
-function readChildStderrTail(appDir) {
-  try {
-    const paths = getSessionPaths(appDir);
-    if (!fs2.existsSync(paths.stderrLog))
-      return;
-    const raw = fs2.readFileSync(paths.stderrLog, "utf-8");
-    return raw.slice(-2000);
-  } catch {
-    return;
+function readChildLogTail(appDir) {
+  const paths = getSessionPaths(appDir);
+  const sections = [];
+  for (const [label, file] of [["stderr", paths.stderrLog], ["stdout", paths.stdoutLog]]) {
+    try {
+      if (!fs2.existsSync(file))
+        continue;
+      const tail = fs2.readFileSync(file, "utf-8").slice(-2000).trim();
+      if (tail)
+        sections.push(`--- ${label} (tail) ---
+${tail}`);
+    } catch {}
   }
+  return sections.length > 0 ? sections.join(`
+`) : undefined;
 }
 function defaultSpawnDetachedChild(childArgs) {
   const cwd = process.cwd();
@@ -3441,7 +3516,7 @@ function buildChildArgs(parentArgv) {
   }
   return [...stripInternalChildFlag(rest), INTERNAL_DETACHED_CHILD_FLAG];
 }
-var INTERNAL_DETACHED_CHILD_FLAG = "--internal-detached-child", realPollDeps;
+var INTERNAL_DETACHED_CHILD_FLAG = "--internal-detached-child", DETACH_READY_TIMEOUT_MS = 630000, DETACH_WAITING_HEARTBEAT_MS = 15000, realPollDeps;
 var init_detach = __esm(() => {
   init_session();
   realPollDeps = {
@@ -3450,6 +3525,104 @@ var init_detach = __esm(() => {
   };
 });
 
+// src/dev/boot-await.ts
+function isPermanentStartError(err) {
+  if (!(err instanceof Error))
+    return false;
+  const match = err.message.match(/^API error (\d{3})/);
+  if (!match)
+    return false;
+  const status = Number.parseInt(match[1], 10);
+  return status >= 400 && status < 500;
+}
+async function awaitDevSessionReady(opts) {
+  const now = opts.deps?.now ?? (() => Date.now());
+  const sleep = opts.deps?.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const timeoutMs = opts.timeoutMs ?? DEV_BOOT_TIMEOUT_MS;
+  const heartbeatMs = opts.heartbeatMs ?? DEV_BOOT_HEARTBEAT_MS;
+  const statusPollDelayMs = opts.statusPollDelayMs ?? DEV_BOOT_STATUS_POLL_DELAY_MS;
+  const statusPollIntervalMs = opts.statusPollIntervalMs ?? DEV_BOOT_STATUS_POLL_INTERVAL_MS;
+  const startedAt = now();
+  const elapsed = () => now() - startedAt;
+  const st = {
+    startResult: null,
+    startError: undefined,
+    startSettled: false,
+    permanentFailure: null,
+    statusReady: null,
+    statusInFlight: false
+  };
+  opts.start().then((session) => {
+    st.startResult = session;
+    st.startSettled = true;
+  }, (err) => {
+    st.startError = err;
+    st.startSettled = true;
+    if (isPermanentStartError(err)) {
+      st.permanentFailure = err;
+    } else {
+      opts.onStartError?.(err);
+    }
+  });
+  let lastStatusPollAt = -Infinity;
+  let lastHeartbeatAt = startedAt;
+  const readyResult = () => {
+    if (st.startResult && st.startResult.previewUrl) {
+      return { session: st.startResult, source: "start", elapsedMs: elapsed() };
+    }
+    if (st.statusReady) {
+      return { session: st.statusReady, source: "status", elapsedMs: elapsed() };
+    }
+    return null;
+  };
+  while (elapsed() < timeoutMs) {
+    if (st.permanentFailure)
+      throw st.permanentFailure;
+    const ready2 = readyResult();
+    if (ready2)
+      return ready2;
+    const startFailedOrEmpty = st.startSettled && !(st.startResult && st.startResult.previewUrl);
+    const pollingActive = elapsed() >= statusPollDelayMs || startFailedOrEmpty;
+    if (pollingActive && !st.statusInFlight && now() - lastStatusPollAt >= statusPollIntervalMs) {
+      st.statusInFlight = true;
+      lastStatusPollAt = now();
+      opts.pollStatus().then((session) => {
+        st.statusInFlight = false;
+        if (session.previewUrl)
+          st.statusReady = session;
+      }, () => {
+        st.statusInFlight = false;
+      });
+    }
+    if (now() - lastHeartbeatAt >= heartbeatMs) {
+      lastHeartbeatAt = now();
+      opts.onWaiting?.(elapsed());
+    }
+    await sleep(TICK_MS);
+  }
+  if (st.permanentFailure)
+    throw st.permanentFailure;
+  const ready = readyResult();
+  if (ready)
+    return ready;
+  throw new DevBootTimeoutError(elapsed(), st.startError);
+}
+var DEV_BOOT_TIMEOUT_MS = 600000, DEV_BOOT_HEARTBEAT_MS = 15000, DEV_BOOT_STATUS_POLL_DELAY_MS = 45000, DEV_BOOT_STATUS_POLL_INTERVAL_MS = 1e4, DevBootTimeoutError, TICK_MS = 250;
+var init_boot_await = __esm(() => {
+  DevBootTimeoutError = class DevBootTimeoutError extends Error {
+    elapsedMs;
+    startError;
+    constructor(elapsedMs, startError) {
+      const base = `Dev session did not become ready within ${Math.round(elapsedMs / 1000)}s`;
+      const cause = startError instanceof Error ? ` (boot call failed: ${startError.message})` : "";
+      super(`${base}${cause}`);
+      this.name = "DevBootTimeoutError";
+      this.elapsedMs = elapsedMs;
+      this.startError = startError;
+    }
+  };
+});
+
 // src/dev/stop.ts
 import * as fs3 from "fs";
 async function stopSession(appDir, expectedAppId, deps = {}) {
@@ -5652,6 +5825,13 @@ export interface JobRunRecord {
     completedAt?: number;
     result?: JobResult;
     error?: string;
+    /**
+     * Stack trace of the failure. Stored because the error MESSAGE alone made
+     * the 2026-07 "Could not serialize object of type ..." production failures
+     * undiagnosable: the message names the workerd serializer, not the framework
+     * call site that hit it (AGENTCLI-6).
+     */
+    errorStack?: string;
 }
 export interface ScheduleState {
     name: string;
@@ -7381,7 +7561,7 @@ function createKeyboardListener() {
 }
 
 // src/generated/version.ts
-var VERSION = "0.16.1";
+var VERSION = "0.17.1";
 
 // src/commands/dev.ts
 var exports_dev = {};
@@ -7515,7 +7695,64 @@ async function execDev(options) {
   } else {
     console.log(dim("Starting dev session..."));
   }
-  const session = await client.startDevSession(config.appId);
+  let session;
+  try {
+    const boot = await awaitDevSessionReady({
+      start: () => client.startDevSession(config.appId),
+      pollStatus: () => client.getDevStatus(config.appId),
+      onWaiting: (elapsedMs) => {
+        const seconds = Math.round(elapsedMs / 1000);
+        if (useJson) {
+          jsonLine({
+            event: "startup",
+            phase: "dev_session_waiting",
+            elapsedSeconds: seconds,
+            timestamp: ts(),
+            note: "Sandbox is booting. Cold boots can take a few minutes; keep waiting."
+          });
+        } else {
+          console.log(dim(`  Still starting the sandbox... (${seconds}s elapsed; cold boots can take a few minutes)`));
+        }
+      },
+      onStartError: (err) => {
+        const message = err instanceof Error ? err.message : String(err);
+        if (useJson) {
+          jsonLine({
+            event: "startup",
+            phase: "dev_session_retrying",
+            timestamp: ts(),
+            warning: `Boot call failed (${message}). The sandbox may still be booting server-side; watching status until it becomes ready.`
+          });
+        } else {
+          console.warn(yellow(`  Boot call failed (${message}); watching sandbox status in case the boot completes server-side...`));
+        }
+      }
+    });
+    session = boot.session;
+  } catch (error) {
+    const isTimeout = error instanceof DevBootTimeoutError;
+    const message = error instanceof Error ? error.message : String(error);
+    if (useJson) {
+      jsonLine({
+        event: "error",
+        phase: "dev_session",
+        timestamp: ts(),
+        error: {
+          message,
+          diagnosis: isTimeout ? "The preview sandbox did not become ready within the boot deadline. The sandbox provider may be degraded, or the app failed to boot server-side." : "The dev session boot call failed.",
+          suggestions: [
+            "Re-run `runwork dev --detach --json` in about a minute; if the sandbox finished booting server-side it will be picked up quickly",
+            "Run `runwork logs` to inspect sandbox logs for boot errors",
+            "Run `runwork doctor` to verify auth and connectivity"
+          ]
+        }
+      });
+    } else {
+      console.error(red(`Failed to start dev session: ${message}`));
+      console.error(dim("  Re-run `runwork dev` in about a minute; if the sandbox finished booting server-side it will be picked up quickly."));
+    }
+    process.exit(1);
+  }
   await populateSkill(cwd, client, config.appId);
   if (useJson)
     jsonLine({ event: "startup", phase: "skill_fetched", timestamp: ts() });
@@ -7804,7 +8041,21 @@ async function runDevDetachParent(opts) {
   const outcome = await runAsDetachedParent({
     appDir: cwd,
     expectedAppId: config.appId,
-    childArgs
+    childArgs,
+    onWaiting: (elapsedMs) => {
+      const seconds = Math.round(elapsedMs / 1000);
+      if (opts.json) {
+        jsonLine({
+          event: "waiting",
+          phase: "sandbox_boot",
+          elapsedSeconds: seconds,
+          timestamp: ts(),
+          note: "Sandbox is booting. Cold boots can take a few minutes; keep waiting for session_started."
+        });
+      } else {
+        console.log(dim(`  Still starting... (${seconds}s elapsed; cold boots can take a few minutes)`));
+      }
+    }
   });
   switch (outcome.result) {
     case "started": {
@@ -7862,9 +8113,10 @@ async function runDevDetachParent(opts) {
           timestamp: ts(),
           error: {
             message,
-            diagnosis: "The detached child process exited (typically due to missing auth, missing git, network failure, or a sync conflict) before it could publish a preview URL.",
+            diagnosis: "The detached child process exited (typically due to missing auth, missing git, network failure, a sync conflict, or a sandbox boot timeout) before it could publish a preview URL.",
             suggestions: [
-              "Inspect the child stderr at .runwork/dev-stderr.log",
+              "Check childLogTail below; the child logs structured errors to .runwork/dev-stdout.log (stderr carries crash traces)",
+              "If the child hit a sandbox boot timeout, re-run `runwork dev --detach --json` in about a minute; a boot that completed server-side is picked up quickly",
               "Run `runwork doctor` to verify auth and connectivity",
               "Try `runwork dev` (foreground) to see the failure inline"
             ],
@@ -7873,7 +8125,7 @@ async function runDevDetachParent(opts) {
         });
       } else {
         console.error(yellow(message));
-        console.error(dim("  Inspect .runwork/dev-stderr.log or run `runwork dev` to see what failed."));
+        console.error(dim("  Inspect .runwork/dev-stdout.log and dev-stderr.log, or run `runwork dev` to see what failed."));
         if (outcome.childLogTail) {
           console.error(dim("  Tail of child stderr:"));
           for (const line of outcome.childLogTail.split(`
@@ -7887,7 +8139,8 @@ async function runDevDetachParent(opts) {
       return;
     }
     case "timeout": {
-      const message = `Detached dev session did not become ready within 90s.`;
+      const timeoutSeconds = Math.round(DETACH_READY_TIMEOUT_MS / 1000);
+      const message = `Detached dev session did not become ready within ${timeoutSeconds}s.`;
       if (opts.json) {
         jsonLine({
           event: "error",
@@ -7895,9 +8148,10 @@ async function runDevDetachParent(opts) {
           timestamp: ts(),
           error: {
             message,
-            diagnosis: "The detached child process was spawned but never wrote a session file with a preview URL. The sandbox boot may have failed.",
+            diagnosis: "The detached child process was spawned but never wrote a session file with a preview URL. The sandbox boot may have failed or the sandbox provider may be degraded.",
             suggestions: [
-              "Inspect the child stderr at .runwork/dev-stderr.log",
+              "The sandbox may still finish booting server-side: re-run `runwork dev --detach --json` in about a minute; a completed boot is picked up quickly",
+              "Inspect the child logs at .runwork/dev-stdout.log and .runwork/dev-stderr.log",
               "Run `runwork doctor` to verify auth and connectivity",
               "Try `runwork dev` (foreground) to see the failure inline"
             ],
@@ -7906,7 +8160,7 @@ async function runDevDetachParent(opts) {
         });
       } else {
         console.error(yellow(message));
-        console.error(dim("  Inspect .runwork/dev-stderr.log or run `runwork dev` to see what failed."));
+        console.error(dim("  Inspect .runwork/dev-stdout.log and dev-stderr.log, or run `runwork dev` to see what failed."));
         if (outcome.childLogTail) {
           console.error(dim("  Tail of child stderr:"));
           for (const line of outcome.childLogTail.split(`
@@ -7956,6 +8210,7 @@ var init_dev = __esm(() => {
   init_tailer();
   init_session();
   init_detach();
+  init_boot_await();
   init_stop();
   init_attach();
   init_types_manager();
@@ -8291,7 +8546,7 @@ var init_welcome = __esm(() => {
 });
 
 // src/index.ts
-import { Command as Command34 } from "commander";
+import { Command as Command36 } from "commander";
 
 // src/commands/login.ts
 init_login_flow();
@@ -8394,8 +8649,23 @@ function getDeploySummary(cwd) {
 }
 
 // src/deploy/deploy-status.ts
+init_session();
 import { existsSync as existsSync16, mkdirSync as mkdirSync11, readFileSync as readFileSync13, writeFileSync as writeFileSync12 } from "fs";
 import { dirname as dirname4, join as join17 } from "path";
+function evaluateDeployStatus(status, deps = {}) {
+  if (status.state !== "in-progress") {
+    return { status, effectiveState: status.state };
+  }
+  const bootTime = deps.bootTime ?? currentBootTime;
+  const pidAlive = deps.pidAlive ?? isPidAlive;
+  if (typeof status.bootTime === "number" && Math.abs(bootTime() - status.bootTime) > BOOT_TIME_TOLERANCE_MS) {
+    return { status, effectiveState: "stale", staleReason: "boot-time-mismatch" };
+  }
+  if (typeof status.pid === "number" && !pidAlive(status.pid)) {
+    return { status, effectiveState: "stale", staleReason: "process-gone" };
+  }
+  return { status, effectiveState: "in-progress" };
+}
 function statusPath(cwd) {
   return join17(cwd, ".runwork", "deploy-status.json");
 }
@@ -8425,6 +8695,9 @@ function readDeployStatus(cwd) {
   }
 }
 
+// src/commands/deploy.ts
+init_session();
+
 // src/deploy/detach.ts
 init_detach();
 import * as fs5 from "fs";
@@ -8536,7 +8809,7 @@ var deployCommand = new Command5("deploy").description("Deploy the current app t
   if (opts.detach && !isChild) {
     const startedAt = new Date().toISOString();
     const handle = spawnDetachedDeploy(buildDeployChildArgs(process.argv), cwd);
-    writeDeployStatus(cwd, { state: "in-progress", startedAt, pid: handle.pid });
+    writeDeployStatus(cwd, { state: "in-progress", startedAt, pid: handle.pid, bootTime: currentBootTime() });
     if (useJson) {
       jsonLine({ event: "deploy_started", detached: true, pid: handle.pid, logPath: deployLogPath(cwd), startedAt, hint: "Poll `runwork deploy --status` for completion." });
     } else {
@@ -8639,7 +8912,7 @@ var deployCommand = new Command5("deploy").description("Deploy the current app t
   const deployed = deploymentUrl.length > 0;
   if (!deployed) {
     if (useJson) {
-      jsonOut(buildErrorResponse("deploy", "Deployment did not produce a URL", "The deploy API returned no deployment URL. The deploy may have been a no-op (no changes) or failed server-side.", ["Confirm your changes were committed and pushed (the sync step above succeeded)", "Run runwork info to check the deployed state", "Run runwork logs --production to inspect server-side errors", "Retry runwork deploy"]));
+      jsonOut(buildErrorResponse("deploy", "Deployment did not produce a URL", "The deploy API returned no deployment URL. The deploy may have been a no-op (no changes) or failed server-side (e.g. a build error).", ['Run `runwork logs --events --once` and look for a "Build failed" error in recent deployment events', "If a build failed on stale sandbox files, run `runwork dev --restart --detach` to resync, then retry the deploy", "Confirm your changes were committed and pushed (the sync step above succeeded)", "Run runwork info to check the deployed state", "Retry runwork deploy"]));
       process.exit(1);
     }
     console.error("Deploy did not return a URL. The deploy may have been a no-op or failed server-side.");
@@ -8679,14 +8952,24 @@ var deployCommand = new Command5("deploy").description("Deploy the current app t
 function printDeployStatus(cwd, useJson) {
   const status = readDeployStatus(cwd);
   const summary = getDeploySummary(cwd);
+  const evaluated = status ? evaluateDeployStatus(status) : null;
+  const staleHint = "The deploy process died before recording an outcome. The deploy may still have completed server-side (the push precedes the deploy call). Verify with `runwork logs --production --once` or `runwork apps info`, then re-run `runwork deploy` if needed.";
   if (useJson) {
-    jsonOut({ success: true, command: "deploy", result: { status, deploy: summary } });
+    jsonOut({
+      success: true,
+      command: "deploy",
+      result: {
+        status: evaluated ? { ...evaluated.status, state: evaluated.effectiveState, staleReason: evaluated.staleReason } : null,
+        deploy: summary,
+        hint: evaluated?.effectiveState === "stale" ? staleHint : undefined
+      }
+    });
     return;
   }
-  if (!status) {
+  if (!status || !evaluated) {
     console.log("No deploy has been started from this machine yet.");
   } else {
-    const label = status.state === "succeeded" ? green("succeeded") : status.state === "failed" ? yellow("failed") : "in-progress";
+    const label = evaluated.effectiveState === "succeeded" ? green("succeeded") : evaluated.effectiveState === "failed" ? yellow("failed") : evaluated.effectiveState === "stale" ? yellow(`stale (${evaluated.staleReason})`) : "in-progress";
     console.log(`Last deploy: ${label}`);
     console.log(dim(`  started:  ${status.startedAt}`));
     if (status.finishedAt)
@@ -8695,8 +8978,10 @@ function printDeployStatus(cwd, useJson) {
       console.log(dim(`  url:      ${status.url}`));
     if (status.error)
       console.log(yellow(`  error:    ${status.error}`));
-    if (status.state === "in-progress")
+    if (evaluated.effectiveState === "in-progress")
       console.log(dim(`  logs:     ${deployLogPath(cwd)}`));
+    if (evaluated.effectiveState === "stale")
+      console.log(yellow(`  ${staleHint}`));
   }
   if (summary.deployedShortSha) {
     const sync = summary.inSync === true ? green("in sync") : summary.inSync === false ? yellow("local has undeployed commits") : dim("unknown");
@@ -9280,9 +9565,14 @@ import { readFileSync as readFileSync18, existsSync as existsSync21 } from "fs";
 init_store();
 init_prompt();
 import { existsSync as existsSync20, readFileSync as readFileSync17 } from "fs";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function resolveWorkspace2(client, options = {}) {
   if (options.workspace) {
-    return { workspaceId: options.workspace, workspaceName: "", source: "flag" };
+    if (UUID_RE.test(options.workspace)) {
+      return { workspaceId: options.workspace, workspaceName: "", source: "flag" };
+    }
+    const ws2 = await resolveWorkspace(client, options.workspace);
+    return { workspaceId: ws2.id, workspaceName: ws2.name, source: "flag" };
   }
   if (process.env.WORKSPACE_ID) {
     return { workspaceId: process.env.WORKSPACE_ID, workspaceName: "", source: "flag" };
@@ -9317,6 +9607,10 @@ async function resolveWorkspace2(client, options = {}) {
     saveDefaultWorkspace(ws2.id, ws2.name);
     return { workspaceId: ws2.id, workspaceName: ws2.name, source: "prompt" };
   }
+  if (!process.stdout.isTTY) {
+    console.error(`Workspace required. Pass --workspace <name-or-id>. Available: ${workspaces.map((w) => w.name).join(", ")}`);
+    process.exit(1);
+  }
   const choices = workspaces.map((ws2) => ({ label: ws2.name, value: ws2.id }));
   const chosen = await promptSelect("Select a workspace:", choices);
   const ws = workspaces.find((w) => w.id === chosen.value);
@@ -9545,7 +9839,13 @@ async function parseCurlToRequest(curlStr) {
 }
 
 // src/commands/integrations.ts
-var searchCommand = new Command10("search").description("Search available integrations from the platform catalog").argument("<query>", 'Search query (e.g., "google drive", "hubspot", "slack")').option("--limit <n>", "Maximum results to show", "20").option("--workspace <id>", "Workspace ID (enables team usage info)").action(async (query, opts, command) => {
+function resolveIntegrationConnection(integrations, integration) {
+  const match = integrations.find((i) => (i.canonicalId || i.integrationId) === integration || i.provider === integration);
+  if (!match)
+    return null;
+  return { connectionId: match.id || match.integrationId, match };
+}
+var searchCommand = new Command10("search").description("Search available integrations from the platform catalog").argument("<query>", 'Search query (e.g., "google drive", "hubspot", "slack")').option("--limit <n>", "Maximum results to show", "20").option("--workspace <name-or-id>", "Workspace name or ID (enables team usage info)").action(async (query, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -9604,7 +9904,7 @@ Usage: Add the integration ID to APP_INTEGRATION_REQUIREMENTS in worker/integrat
     process.exit(1);
   }
 });
-var listCommand = new Command10("list").description("List connected workspace integrations").option("--workspace <id>", "Workspace ID").action(async (opts, command) => {
+var listCommand = new Command10("list").description("List connected workspace integrations").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -9657,7 +9957,7 @@ Used by your team (${teamOnly.length} more):
     process.exit(1);
   }
 });
-var callCommand = new Command10("call").description("Make a proxy call to a connected integration").argument("<integration>", "Integration name (e.g., hubspot, slack)").argument("[method]", "HTTP method (GET, POST, PUT, DELETE)").argument("[path]", "API path (e.g., /crm/v3/contacts)").option("--workspace <id>", "Workspace ID").option("--body <json>", "Request body JSON").option("--header <header>", "Request header (repeatable)", (val, prev) => [...prev, val], []).option("--query <query>", "Query string (e.g., limit=10&offset=0)").option("--curl <command>", 'Parse a curl command (paste from Chrome DevTools "Copy as cURL")').option("--curl-file <file>", "Read curl command from a file").action(async (integration, method, path2, opts, command) => {
+var callCommand = new Command10("call").description("Make a proxy call to a connected integration").argument("<integration>", "Integration name (e.g., hubspot, slack)").argument("[method]", "HTTP method (GET, POST, PUT, DELETE)").argument("[path]", "API path (e.g., /crm/v3/contacts)").option("--workspace <name-or-id>", "Workspace name or ID").option("--body <json>", "Request body JSON").option("--header <header>", "Request header (repeatable)", (val, prev) => [...prev, val], []).option("--query <query>", "Query string (e.g., limit=10&offset=0)").option("--curl <command>", 'Parse a curl command (paste from Chrome DevTools "Copy as cURL")').option("--curl-file <file>", "Read curl command from a file").action(async (integration, method, path2, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -9711,12 +10011,12 @@ var callCommand = new Command10("call").description("Make a proxy call to a conn
   }
   try {
     const integrations = await client.listConnectedIntegrations(workspaceId);
-    const match = integrations.find((i) => (i.canonicalId || i.integrationId) === integration || i.provider === integration);
-    if (!match) {
+    const resolved = resolveIntegrationConnection(integrations, integration);
+    if (!resolved) {
       console.error(`Integration "${integration}" not found. Run "runwork integrations list" to see connected integrations.`);
       process.exit(1);
     }
-    const result = await client.callIntegrationProxy(match.integrationId, finalMethod, finalPath, { body, headers: Object.keys(headers).length > 0 ? headers : undefined, query });
+    const result = await client.callIntegrationProxy(resolved.connectionId, finalMethod, finalPath, { body, headers: Object.keys(headers).length > 0 ? headers : undefined, query });
     if (useJson) {
       jsonOut(result);
       return;
@@ -10345,7 +10645,7 @@ function truncate(text2, max) {
     return first;
   return first.slice(0, max - 3) + "...";
 }
-var listCommand2 = new Command13("list").description("List workspace skills (app, external, MCP-generated)").option("--workspace <id>", "Workspace ID").action(async (opts, command) => {
+var listCommand2 = new Command13("list").description("List workspace skills (app, external, MCP-generated)").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -10402,7 +10702,7 @@ async function readStdin2() {
   }
   return Buffer.concat(chunks).toString("utf-8");
 }
-var pushCommand = new Command13("push").description("Upload a local skill file to workspace (upsert by name). Accepts piped content via stdin.").argument("[first]", "Skill name (if piping content) or file path (name from frontmatter)").argument("[second]", "File path (when first arg is the skill name)").option("--workspace <id>", "Workspace ID").action(async (first, second, opts, command) => {
+var pushCommand = new Command13("push").description("Upload a local skill file to workspace (upsert by name). Accepts piped content via stdin.").argument("[first]", "Skill name (if piping content) or file path (name from frontmatter)").argument("[second]", "File path (when first arg is the skill name)").option("--workspace <name-or-id>", "Workspace name or ID").action(async (first, second, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -10497,7 +10797,7 @@ var pushCommand = new Command13("push").description("Upload a local skill file t
     process.exit(1);
   }
 });
-var pullCommand = new Command13("pull").alias("download").description("Download a skill from the workspace and print to stdout (or save to file)").argument("<name>", "Skill name or ID").option("--workspace <id>", "Workspace ID").option("-o, --output <file>", "Save to file instead of stdout").action(async (nameOrId, opts, command) => {
+var pullCommand = new Command13("pull").alias("download").description("Download a skill from the workspace and print to stdout (or save to file)").argument("<name>", "Skill name or ID").option("--workspace <name-or-id>", "Workspace name or ID").option("-o, --output <file>", "Save to file instead of stdout").action(async (nameOrId, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -10600,7 +10900,7 @@ var searchCommand2 = new Command13("search").description("Search community skill
     process.exit(1);
   }
 });
-var installCommand = new Command13("install").description("Install a community skill from skills.sh into your workspace").argument("<identifier>", "Skill identifier: source/skill-id (e.g. vercel-labs/skills/find-skills)").option("--workspace <id>", "Workspace ID").action(async (identifier, opts, command) => {
+var installCommand = new Command13("install").description("Install a community skill from skills.sh into your workspace").argument("<identifier>", "Skill identifier: source/skill-id (e.g. vercel-labs/skills/find-skills)").option("--workspace <name-or-id>", "Workspace name or ID").action(async (identifier, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -11118,6 +11418,33 @@ function formatCombinedDigest(sessions, opts = { days: 7 }) {
 // src/agents/utils/json-config.ts
 import { readFileSync as readFileSync22, writeFileSync as writeFileSync14, mkdirSync as mkdirSync13, existsSync as existsSync25 } from "fs";
 import { dirname as dirname5 } from "path";
+
+// src/sync/hash.ts
+import { createHash as createHash2 } from "crypto";
+function contentHash(content) {
+  return "sha256:" + createHash2("sha256").update(content).digest("hex");
+}
+function stableStringify(value) {
+  return JSON.stringify(sortValue(value));
+}
+function sortValue(value) {
+  if (Array.isArray(value))
+    return value.map(sortValue);
+  if (value !== null && typeof value === "object") {
+    const obj = value;
+    const sorted = {};
+    for (const key of Object.keys(obj).sort()) {
+      sorted[key] = sortValue(obj[key]);
+    }
+    return sorted;
+  }
+  return value;
+}
+function configHash(value) {
+  return contentHash(stableStringify(value));
+}
+
+// src/agents/utils/json-config.ts
 function isRunworkManagedKey(key) {
   return key === RUNWORK_WORKSPACE_MCP_NAME || key.startsWith(RUNWORK_MCP_PREFIX) || key.startsWith(RUNWORK_MCP_PREFIX_LEGACY);
 }
@@ -11156,6 +11483,14 @@ function removeRunworkMcpServers(filePath, topKey) {
 function mergeJsonMcpServers(filePath, servers, topKey) {
   const config = readJsonConfig(filePath);
   const existing = config[topKey] || {};
+  const managedBefore = {};
+  for (const key of Object.keys(existing)) {
+    if (isRunworkManagedKey(key))
+      managedBefore[key] = existing[key];
+  }
+  const changed = configHash(managedBefore) !== configHash(servers);
+  if (!changed)
+    return false;
   for (const key of Object.keys(existing)) {
     if (isRunworkManagedKey(key)) {
       delete existing[key];
@@ -11164,6 +11499,7 @@ function mergeJsonMcpServers(filePath, servers, topKey) {
   Object.assign(existing, servers);
   config[topKey] = existing;
   writeJsonConfig(filePath, config);
+  return true;
 }
 
 // src/agents/utils/instruction-hint.ts
@@ -11487,6 +11823,19 @@ function resolveAgentDefaults(input) {
   };
 }
 
+// src/ui/verbosity.ts
+var verbose = false;
+function setVerbose(value) {
+  verbose = value;
+}
+function isVerbose() {
+  return verbose;
+}
+function vlog(...args) {
+  if (verbose)
+    console.log(...args);
+}
+
 // src/agents/claude-code.ts
 var PLUGIN_NAME = "runwork";
 var PLUGIN_VERSION = "1.0.0";
@@ -11589,7 +11938,7 @@ class ClaudeCodeAdapter {
       ]
     };
     writeFileSync16(join21(hooksDir, "hooks.json"), JSON.stringify(hooksManifest, null, 2));
-    console.log(`  [Claude Code] Installed SessionStart hook (${label}) -> ${scriptPath}`);
+    vlog(`  [Claude Code] Installed SessionStart hook (${label}) -> ${scriptPath}`);
   }
   async writeSkills(skills, scope) {
     const baseDir = scope === "project" ? join21(process.cwd(), ".claude", "skills") : join21(homedir5(), ".claude", "skills");
@@ -11622,6 +11971,7 @@ class ClaudeCodeAdapter {
       }
       this.registerPlugin(pluginDir);
     }
+    return skills.length;
   }
   async writeBuiltInHooks(scope) {
     if (scope !== "user")
@@ -12116,7 +12466,7 @@ ${instructions}`;
       lastUpdated: new Date().toISOString()
     };
     writeJsonConfig(marketplacesPath, marketplaces);
-    console.log(`  [Claude Code] ${wasRegistered ? "Refreshed" : "Registered"} plugin ` + `${pluginKey} v${PLUGIN_VERSION} -> ${installedPath}`);
+    vlog(`  [Claude Code] ${wasRegistered ? "Refreshed" : "Registered"} plugin ` + `${pluginKey} v${PLUGIN_VERSION} -> ${installedPath}`);
     const settingsPath = join21(homedir5(), ".claude", "settings.json");
     const settings = readJsonConfig(settingsPath);
     if (!settings["enabledPlugins"]) {
@@ -12416,12 +12766,12 @@ class ClaudeDesktopAdapter {
     if (rpm) {
       writePluginMetadata(rpm.pluginPath, getPluginMetadata());
       writePluginSkills(rpm.pluginPath, skills);
-      return;
+      return skills.length;
     }
     const pluginsDir = findCoworkPluginsDir();
     if (!pluginsDir) {
       console.warn("  [Claude Desktop] Cowork plugins directory not found. Open Claude Desktop at least once first.");
-      return;
+      return 0;
     }
     const cacheDir = join23(pluginsDir, "cache", "runwork", PLUGIN_NAME2, PLUGIN_VERSION2);
     const marketRoot = join23(pluginsDir, "marketplaces", "runwork");
@@ -12456,6 +12806,7 @@ class ClaudeDesktopAdapter {
     };
     writeJsonConfig(marketplacesPath, marketplaces);
     setCoworkPluginEnabled(pluginsDir, true);
+    return skills.length;
   }
   async writeInstructionHint(hint, _scope) {
     for (const path2 of getCoworkMemoryClaudeMdPaths()) {
@@ -12946,7 +13297,7 @@ class CursorAdapter {
   }
   async writeSkills(skills, scope) {
     if (scope === "user")
-      return;
+      return 0;
     const rulesDir = join24(process.cwd(), ".cursor", "rules");
     mkdirSync18(rulesDir, { recursive: true });
     for (const skill of skills) {
@@ -12958,6 +13309,7 @@ alwaysApply: false
 ${skill.content}`;
       writeFileSync19(join24(rulesDir, `${skill.filename}.mdc`), mdcContent);
     }
+    return skills.length;
   }
   async writeInstructionHint(hint, scope) {
     const filePath = scope === "project" ? join24(process.cwd(), ".cursor", "rules", "runwork.mdc") : join24(homedir7(), ".cursor", "rules", "runwork.mdc");
@@ -13210,7 +13562,7 @@ class WindsurfAdapter {
   }
   async writeSkills(skills, scope) {
     if (scope === "user")
-      return;
+      return 0;
     const rulesDir = join25(process.cwd(), ".windsurf", "rules");
     mkdirSync19(rulesDir, { recursive: true });
     for (const skill of skills) {
@@ -13221,6 +13573,7 @@ trigger: manual
 ${skill.content}`;
       writeFileSync20(join25(rulesDir, `${skill.filename}.md`), content);
     }
+    return skills.length;
   }
   async writeTeamInstructions(instructions, scope) {
     const filePath = scope === "project" ? join25(process.cwd(), ".windsurf", "rules", "runwork-team.md") : join25(getWindsurfDataDir(), "rules", "runwork-team.md");
@@ -13464,14 +13817,15 @@ var AGENT_REGISTRY = [
       method: "any",
       target: [
         { method: "path", target: { macos: "/Applications/Codex.app" } },
-        { method: "windows-appx", target: "OpenAI.Codex" }
+        { method: "macos-bundle-id", target: "com.openai.codex" },
+        { method: "windows-appx", target: ["OpenAI.Codex"] }
       ]
     },
-    launch: { app: { macos: "Codex", windows: "Codex" } },
-    logo: "openai",
+    launch: { app: { macos: "Codex", windows: "Codex" }, bundleId: { macos: "com.openai.codex" } },
+    logo: "codex",
     downloadUrl: "https://openai.com/codex/",
     skillsPaths: { global: ".codex/skills", project: ".agents/skills" },
-    instructionFile: { global: ".codex/instructions.md", project: "AGENTS.md" },
+    instructionFile: { global: ".codex/AGENTS.md", project: "AGENTS.md" },
     firstClass: true,
     resumeCapability: {
       mode: "file-drop-only",
@@ -13493,10 +13847,10 @@ var AGENT_REGISTRY = [
     category: "cli",
     detection: { method: "binary", target: "codex" },
     launch: { cli: "codex", cliAcceptsPrompt: true },
-    logo: "openai",
+    logo: "codex",
     downloadUrl: "https://github.com/openai/codex",
     skillsPaths: { global: ".codex/skills", project: ".agents/skills" },
-    instructionFile: { global: ".codex/instructions.md", project: "AGENTS.md" },
+    instructionFile: { global: ".codex/AGENTS.md", project: "AGENTS.md" },
     firstClass: true,
     resumeCapability: {
       mode: "cli-resume",
@@ -13590,10 +13944,11 @@ var AGENT_REGISTRY = [
       method: "any",
       target: [
         { method: "path", target: { macos: "/Applications/ChatGPT.app" } },
-        { method: "windows-appx", target: "OpenAI.ChatGPT" }
+        { method: "macos-bundle-id", target: "com.openai.chat" },
+        { method: "windows-appx", target: ["OpenAI.ChatGPT"] }
       ]
     },
-    launch: { app: { macos: "ChatGPT", windows: "ChatGPT" }, url: "https://chatgpt.com/?prompt={prompt}" },
+    launch: { app: { macos: "ChatGPT", windows: "ChatGPT" }, bundleId: { macos: "com.openai.chat" }, url: "https://chatgpt.com/?prompt={prompt}" },
     logo: "openai",
     downloadUrl: "https://chatgpt.com/download",
     firstClass: true,
@@ -13883,14 +14238,28 @@ function resolveToAbsolute(ps, scope) {
   return scope === "global" ? join26(homedir9(), resolved) : join26(process.cwd(), resolved);
 }
 
+// src/agents/detection-probes.ts
+function powershellQuote(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function isValidBundleId(id) {
+  return /^[A-Za-z0-9][A-Za-z0-9.-]*$/.test(id);
+}
+function macosBundleIdProbeScript(id) {
+  return `p=$(mdfind "kMDItemCFBundleIdentifier == '${id}'" 2>/dev/null | head -1); ` + `if [ -n "$p" ]; then exit 0; fi; ` + `for a in /Applications/*.app "$HOME"/Applications/*.app; do ` + `[ -e "$a" ] || continue; ` + `if [ "$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "$a/Contents/Info.plist" 2>/dev/null)" = "${id}" ]; then exit 0; fi; ` + `done; exit 1`;
+}
+function appxPackageProbeScript(pkg) {
+  return `$p = Get-AppxPackage -Name ${powershellQuote(pkg)} -ErrorAction SilentlyContinue; if ($null -ne $p) { exit 0 } exit 1`;
+}
+function startAppProbeScript(pattern) {
+  return `$a = Get-StartApps -Name ${powershellQuote(pattern)} -ErrorAction SilentlyContinue | Select-Object -First 1; if ($null -ne $a) { exit 0 } exit 1`;
+}
+
 // src/agents/detection.ts
 var execFileAsync = promisify(execFile);
 function isWindows() {
   return platform7() === "win32";
 }
-function powershellQuote(value) {
-  return `'${value.replace(/'/g, "''")}'`;
-}
 function toList(value) {
   return Array.isArray(value) ? value : [value];
 }
@@ -13910,23 +14279,30 @@ function checkPath(target) {
     return existsSync32(resolved);
   return existsSync32(join27(homedir10(), resolved));
 }
+async function checkMacosBundleId(target) {
+  if (platform7() !== "darwin")
+    return false;
+  for (const id of toList(target)) {
+    if (!isValidBundleId(id))
+      continue;
+    try {
+      await execFileAsync("sh", ["-c", macosBundleIdProbeScript(id)]);
+      return true;
+    } catch {}
+  }
+  return false;
+}
 async function checkWindowsAppxPackage(target) {
   if (!isWindows())
     return false;
-  const probes = toList(target).map((pkg) => {
-    const script = `$p = Get-AppxPackage -Name ${powershellQuote(pkg)} -ErrorAction SilentlyContinue; if ($null -ne $p) { exit 0 } exit 1`;
-    return runPowerShell(script);
-  });
+  const probes = toList(target).map((pkg) => runPowerShell(appxPackageProbeScript(pkg)));
   const results = await Promise.all(probes);
   return results.some(Boolean);
 }
 async function checkWindowsStartApp(target) {
   if (!isWindows())
     return false;
-  const probes = toList(target).map((pattern) => {
-    const script = `$a = Get-StartApps -Name ${powershellQuote(pattern)} -ErrorAction SilentlyContinue | Select-Object -First 1; if ($null -ne $a) { exit 0 } exit 1`;
-    return runPowerShell(script);
-  });
+  const probes = toList(target).map((pattern) => runPowerShell(startAppProbeScript(pattern)));
   const results = await Promise.all(probes);
   return results.some(Boolean);
 }
@@ -13942,6 +14318,8 @@ async function runAgentDetection(detection) {
       return checkWindowsAppxPackage(detection.target);
     case "windows-start-app":
       return checkWindowsStartApp(detection.target);
+    case "macos-bundle-id":
+      return checkMacosBundleId(detection.target);
     case "any": {
       const probes = await Promise.all(detection.target.map((p) => runAgentDetection(p)));
       return probes.some(Boolean);
@@ -14016,6 +14394,7 @@ class CodexAdapter {
       mkdirSync20(skillDir, { recursive: true });
       writeFileSync21(join28(skillDir, "SKILL.md"), buildSkillMd2(skill));
     }
+    return skills.length;
   }
   async writeInstructionHint(hint, scope) {
     const filePath = scope === "project" ? join28(process.cwd(), "AGENTS.md") : join28(homedir11(), ".codex", "AGENTS.md");
@@ -14052,6 +14431,26 @@ class CodexAdapter {
         }
       }
     }
+    if (config.networkAllowlist?.length) {
+      const features = parsed.features && typeof parsed.features === "object" ? parsed.features : undefined;
+      const proxy = features?.network_proxy;
+      if (proxy && proxy.enabled === true) {
+        if (!proxy.domains || typeof proxy.domains !== "object")
+          proxy.domains = {};
+        const domains = proxy.domains;
+        for (const host of config.networkAllowlist) {
+          if (!(host in domains))
+            domains[host] = "allow";
+        }
+      } else {
+        if (!parsed.sandbox_workspace_write || typeof parsed.sandbox_workspace_write !== "object") {
+          parsed.sandbox_workspace_write = {};
+        }
+        const sww = parsed.sandbox_workspace_write;
+        if (sww.network_access === undefined)
+          sww.network_access = true;
+      }
+    }
     mkdirSync20(join28(configPath, ".."), { recursive: true });
     writeFileSync21(configPath, stringify(parsed));
   }
@@ -14377,12 +14776,13 @@ class ClineAdapter {
   }
   async writeSkills(skills, scope) {
     if (scope === "user")
-      return;
+      return 0;
     const rulesDir = join29(process.cwd(), ".clinerules");
     mkdirSync21(rulesDir, { recursive: true });
     for (const skill of skills) {
       writeFileSync22(join29(rulesDir, `${skill.filename}.md`), buildSkillMd2(skill));
     }
+    return skills.length;
   }
   async writeInstructionHint(hint, scope) {
     if (scope === "user")
@@ -14507,6 +14907,7 @@ class GeminiAdapter {
       mkdirSync22(skillDir, { recursive: true });
       writeFileSync23(join30(skillDir, "SKILL.md"), buildSkillMd2(skill));
     }
+    return skills.length;
   }
   async writeInstructionHint(hint, scope) {
     const filePath = scope === "project" ? join30(process.cwd(), "GEMINI.md") : join30(homedir13(), ".gemini", "GEMINI.md");
@@ -14606,13 +15007,13 @@ class GenericAgentAdapter {
   }
   async writeSkills(skills, scope) {
     if (!this.def.skillsPaths)
-      return;
+      return 0;
     const pathTemplate = scope === "project" ? this.def.skillsPaths.project : this.def.skillsPaths.global;
     if (!pathTemplate)
-      return;
+      return 0;
     const baseDir = resolveToAbsolute(pathTemplate, scope === "project" ? "project" : "global");
     if (!baseDir)
-      return;
+      return 0;
     for (const skill of skills) {
       if (skill.name !== skill.filename) {
         const oldDir = join31(baseDir, skill.name);
@@ -14626,6 +15027,7 @@ class GenericAgentAdapter {
       mkdirSync23(skillDir, { recursive: true });
       writeFileSync24(join31(skillDir, "SKILL.md"), buildSkillMd2(skill));
     }
+    return skills.length;
   }
   async writeInstructionHint(hint, scope) {
     if (!this.def.instructionFile)
@@ -14740,9 +15142,9 @@ function printNoAgentsMessage() {
 }
 
 // src/utils/insight-id.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 function computeInsightId(userSeed, localKey) {
-  return createHash2("sha256").update(`${userSeed}:${localKey}`).digest("hex").slice(0, 22);
+  return createHash3("sha256").update(`${userSeed}:${localKey}`).digest("hex").slice(0, 22);
 }
 function insightLocalKey(teaches, slug) {
   return `${teaches}:${slug}`.toLowerCase().replace(/[^a-z0-9:_-]+/g, "-").replace(/-+/g, "-");
@@ -15355,7 +15757,7 @@ function parseJson(content, source) {
 }
 
 // src/commands/entities.ts
-var listCommand3 = new Command15("list").description("List entities registered in the workspace").option("--workspace <id>", "Workspace ID").option("--app <id>", "Filter by app name or ID").option("--preview", "Show preview-mode entities only").action(async (opts, command) => {
+var listCommand3 = new Command15("list").description("List entities registered in the workspace").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <id>", "Filter by app name or ID").option("--preview", "Show preview-mode entities only").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15390,7 +15792,7 @@ Workspace: ${workspaceName || workspaceId}
     process.exit(1);
   }
 });
-var recordsCommand = new Command15("records").description("List records for an entity").argument("<entity>", "Entity name").option("--workspace <id>", "Workspace ID").option("--limit <n>", "Number of records to return", "20").option("--cursor <cursor>", "Pagination cursor").option("--preview", "Query preview-mode data").action(async (entity, opts, command) => {
+var recordsCommand = new Command15("records").description("List records for an entity").argument("<entity>", "Entity name").option("--workspace <name-or-id>", "Workspace name or ID").option("--limit <n>", "Number of records to return", "20").option("--cursor <cursor>", "Pagination cursor").option("--preview", "Query preview-mode data").action(async (entity, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15422,7 +15824,7 @@ Next cursor: ${result.next}`);
     process.exit(1);
   }
 });
-var getCommand = new Command15("get").description("Get a single entity record by ID").argument("<entity>", "Entity name").argument("<id>", "Record ID").option("--workspace <id>", "Workspace ID").action(async (entity, id, opts, command) => {
+var getCommand = new Command15("get").description("Get a single entity record by ID").argument("<entity>", "Entity name").argument("<id>", "Record ID").option("--workspace <name-or-id>", "Workspace name or ID").action(async (entity, id, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15439,7 +15841,7 @@ var getCommand = new Command15("get").description("Get a single entity record by
     process.exit(1);
   }
 });
-var createCommand = new Command15("create").description("Create a new entity record").argument("<entity>", "Entity name").option("--workspace <id>", "Workspace ID").option("--data <json>", "Record data as JSON string, @file.json, or pipe via stdin").option("--preview", "Create in preview-mode data store").action(async (entity, opts, command) => {
+var createCommand = new Command15("create").description("Create a new entity record").argument("<entity>", "Entity name").option("--workspace <name-or-id>", "Workspace name or ID").option("--data <json>", "Record data as JSON string, @file.json, or pipe via stdin").option("--preview", "Create in preview-mode data store").action(async (entity, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15458,7 +15860,7 @@ var createCommand = new Command15("create").description("Create a new entity rec
     process.exit(1);
   }
 });
-var updateCommand = new Command15("update").description("Update an existing entity record").argument("<entity>", "Entity name").argument("<id>", "Record ID").option("--workspace <id>", "Workspace ID").option("--data <json>", "Record data as JSON string, @file.json, or pipe via stdin").action(async (entity, id, opts, command) => {
+var updateCommand = new Command15("update").description("Update an existing entity record").argument("<entity>", "Entity name").argument("<id>", "Record ID").option("--workspace <name-or-id>", "Workspace name or ID").option("--data <json>", "Record data as JSON string, @file.json, or pipe via stdin").action(async (entity, id, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15477,7 +15879,7 @@ var updateCommand = new Command15("update").description("Update an existing enti
     process.exit(1);
   }
 });
-var deleteCommand = new Command15("delete").description("Delete an entity record").argument("<entity>", "Entity name").argument("<id>", "Record ID").option("--workspace <id>", "Workspace ID").option("--yes", "Skip confirmation prompt").action(async (entity, id, opts, command) => {
+var deleteCommand = new Command15("delete").description("Delete an entity record").argument("<entity>", "Entity name").argument("<id>", "Record ID").option("--workspace <name-or-id>", "Workspace name or ID").option("--yes", "Skip confirmation prompt").action(async (entity, id, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15516,7 +15918,7 @@ function truncate2(text2, max) {
     return first;
   return first.slice(0, max - 3) + "...";
 }
-var listCommand4 = new Command16("list").description("List workflows in a workspace").option("--workspace <id>", "Workspace ID").option("--app <name>", "Filter by app name or ID").action(async (opts, command) => {
+var listCommand4 = new Command16("list").description("List workflows in a workspace").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name>", "Filter by app name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15550,7 +15952,7 @@ Workspace: ${workspaceName || workspaceId}
     process.exit(1);
   }
 });
-var triggerCommand = new Command16("trigger").description("Trigger a workflow by name").argument("<name>", "Workflow name").option("--workspace <id>", "Workspace ID").option("--app <name>", "App name or ID (required if not in a project directory)").option("--params <json>", "JSON string of parameters to pass to the workflow").option("--instance-id <id>", "Custom instance ID for the workflow run").action(async (name, opts, command) => {
+var triggerCommand = new Command16("trigger").description("Trigger a workflow by name").argument("<name>", "Workflow name").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name>", "App name or ID (required if not in a project directory)").option("--params <json>", "JSON string of parameters to pass to the workflow").option("--instance-id <id>", "Custom instance ID for the workflow run").action(async (name, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15584,7 +15986,7 @@ var triggerCommand = new Command16("trigger").description("Trigger a workflow by
     process.exit(1);
   }
 });
-var instancesCommand = new Command16("instances").description("List workflow instances for an app").option("--workspace <id>", "Workspace ID").option("--app <name>", "App name or ID (required if not in a project directory)").option("--workflow <name>", "Filter by workflow name").option("--status <status>", "Filter by instance status").option("--limit <n>", "Maximum number of instances to return").action(async (opts, command) => {
+var instancesCommand = new Command16("instances").description("List workflow instances for an app").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name>", "App name or ID (required if not in a project directory)").option("--workflow <name>", "Filter by workflow name").option("--status <status>", "Filter by instance status").option("--limit <n>", "Maximum number of instances to return").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15617,7 +16019,7 @@ var instancesCommand = new Command16("instances").description("List workflow ins
     process.exit(1);
   }
 });
-var instanceCommand = new Command16("instance").description("Get details for a specific workflow instance").argument("<id>", "Workflow instance ID").option("--workspace <id>", "Workspace ID").option("--app <name>", "App name or ID (optional)").action(async (id, opts, command) => {
+var instanceCommand = new Command16("instance").description("Get details for a specific workflow instance").argument("<id>", "Workflow instance ID").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name>", "App name or ID (optional)").action(async (id, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15645,16 +16047,64 @@ var workflowsCommand = new Command16("workflows").description("Manage workspace
 init_store();
 init_client();
 import { Command as Command17 } from "commander";
-function truncate3(text2, max) {
-  if (!text2)
+// src/utils/table.ts
+function clip(value, max) {
+  if (max <= 0)
     return "";
-  const first = text2.split(`
-`)[0];
-  if (first.length <= max)
-    return first;
-  return first.slice(0, max - 3) + "...";
+  if (value.length <= max)
+    return value;
+  if (max <= 3)
+    return value.slice(0, max);
+  return value.slice(0, max - 3) + "...";
+}
+function renderTable(columns, rows, indent = "  ") {
+  const gap = "  ";
+  const lastIdx = columns.length - 1;
+  const data = rows.map((row) => columns.map((c, i) => {
+    const raw = row[i] == null ? "" : String(row[i]);
+    return c.max !== undefined ? clip(raw, c.max) : raw;
+  }));
+  const widths = columns.map((c, i) => {
+    let w = c.header.length;
+    for (const row of data)
+      w = Math.max(w, row[i].length);
+    return w;
+  });
+  const renderRow = (cells, colorize) => {
+    const parts = cells.map((cell, i) => {
+      const padded = i === lastIdx ? cell : cell.padEnd(widths[i]);
+      const color = columns[i].color;
+      return colorize && color ? color(padded) : padded;
+    });
+    return (indent + parts.join(gap)).replace(/\s+$/, "");
+  };
+  const out = [renderRow(columns.map((c) => c.header), false)];
+  const total = widths.reduce((a, b) => a + b, 0) + gap.length * Math.max(0, columns.length - 1);
+  out.push(indent + "-".repeat(total));
+  for (const row of data)
+    out.push(renderRow(row, true));
+  return out.join(`
+`);
+}
+
+// src/commands/schedules.ts
+function extractScheduleHistoryRecords(data) {
+  if (!data || !Array.isArray(data.records))
+    return [];
+  return data.records;
+}
+function scheduleRowCells(s) {
+  const mode = s.deploymentMode ? ` (${s.deploymentMode})` : "";
+  const status = s.status ? s.status + mode : mode.trim() || "-";
+  return [
+    s.scheduleName || "(unnamed)",
+    s.appName || s.appId || "-",
+    s.schedule || "-",
+    status,
+    s.description || ""
+  ];
 }
-var listCommand5 = new Command17("list").description("List scheduled jobs in the workspace").option("--workspace <id>", "Workspace ID").option("--app <name|id>", "Filter by app name or ID").action(async (opts, command) => {
+var listCommand5 = new Command17("list").description("List scheduled jobs in the workspace").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name|id>", "Filter by app name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15676,20 +16126,20 @@ var listCommand5 = new Command17("list").description("List scheduled jobs in the
     console.log(`
 Workspace: ${workspaceName || workspaceId}
 `);
-    console.log("  " + "Name".padEnd(24) + "App".padEnd(20) + "Schedule".padEnd(18) + "Status".padEnd(12) + "Description");
-    console.log("  " + "-".repeat(90));
-    for (const s of schedules) {
-      const mode = s.deploymentMode ? ` (${s.deploymentMode})` : "";
-      const status = s.status ? s.status + mode : mode.trim() || "-";
-      console.log("  " + s.name.padEnd(24) + (s.appName || s.appId).slice(0, 18).padEnd(20) + (s.schedule || "-").padEnd(18) + status.padEnd(12) + truncate3(s.description, 40));
-    }
+    console.log(renderTable([
+      { header: "Name" },
+      { header: "App" },
+      { header: "Schedule" },
+      { header: "Status" },
+      { header: "Description", max: 60 }
+    ], schedules.map(scheduleRowCells)));
     console.log("");
   } catch (err) {
     console.error("Failed to list schedules:", err instanceof Error ? err.message : err);
     process.exit(1);
   }
 });
-var triggerCommand2 = new Command17("trigger").description("Manually trigger a scheduled job").argument("<name>", "Schedule name").option("--workspace <id>", "Workspace ID").option("--app <name|id>", "App name or ID").option("--preview", "Trigger in preview (sandbox) mode instead of production").action(async (name, opts, command) => {
+var triggerCommand2 = new Command17("trigger").description("Manually trigger a scheduled job").argument("<name>", "Schedule name").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name|id>", "App name or ID").option("--preview", "Trigger in preview (sandbox) mode instead of production").action(async (name, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15715,7 +16165,7 @@ var triggerCommand2 = new Command17("trigger").description("Manually trigger a s
     process.exit(1);
   }
 });
-var historyCommand = new Command17("history").description("Show execution history for scheduled jobs in an app").option("--workspace <id>", "Workspace ID").option("--app <name|id>", "App name or ID (required)").action(async (opts, command) => {
+var historyCommand = new Command17("history").description("Show execution history for scheduled jobs in an app").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name|id>", "App name or ID (required)").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15723,25 +16173,34 @@ var historyCommand = new Command17("history").description("Show execution histor
   const { appId, appName } = await resolveApp2(client, workspaceId, opts);
   try {
     const data = await client.getScheduleHistory(workspaceId, appId);
+    const records = extractScheduleHistoryRecords(data);
     if (useJson) {
-      jsonOut({ history: data.history, appId, appName });
+      jsonOut({ history: records, appId, appName });
       return;
     }
-    if (!data.history || data.history.length === 0) {
+    if (records.length === 0) {
       console.log(`No schedule history found for app "${appName}".`);
       return;
     }
     console.log(`
 Schedule history for app: ${appName}
 `);
-    console.log("  " + "Schedule".padEnd(24) + "Executed At".padEnd(26) + "Status".padEnd(12) + "Duration");
-    console.log("  " + "-".repeat(72));
-    for (const entry of data.history) {
+    const nameW = Math.max("Schedule".length, ...records.map((r) => (r.jobName || "-").length));
+    console.log("  " + "Schedule".padEnd(nameW + 2) + "Started At".padEnd(26) + "Status".padEnd(12) + "Duration");
+    console.log("  " + "-".repeat(nameW + 2 + 26 + 12 + 8));
+    for (const entry of records) {
+      const startedAt = entry.startedAt ? new Date(entry.startedAt).toISOString() : "-";
       const duration = entry.durationMs != null ? `${entry.durationMs}ms` : "-";
-      console.log("  " + entry.scheduleName.padEnd(24) + entry.executedAt.padEnd(26) + entry.status.padEnd(12) + duration);
+      console.log("  " + (entry.jobName || "-").padEnd(nameW + 2) + startedAt.padEnd(26) + entry.status.padEnd(12) + duration);
       if (entry.error) {
         console.log(`    Error: ${entry.error}`);
       }
+      if (entry.errorStack) {
+        for (const line of entry.errorStack.split(`
+`).slice(0, 8)) {
+          console.log(`      ${line.trim()}`);
+        }
+      }
     }
     console.log("");
   } catch (err) {
@@ -15749,7 +16208,7 @@ Schedule history for app: ${appName}
     process.exit(1);
   }
 });
-var statusCommand = new Command17("status").description("Show runtime status of scheduled jobs for an app").argument("<name>", "Schedule name").option("--workspace <id>", "Workspace ID").option("--app <name|id>", "App name or ID (required)").action(async (name, opts, command) => {
+var statusCommand = new Command17("status").description("Show runtime status of scheduled jobs for an app").argument("<name>", "Schedule name").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name|id>", "App name or ID (required)").action(async (name, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15771,7 +16230,7 @@ Schedule "${name}" status for app "${appName}":
     process.exit(1);
   }
 });
-var pauseCommand = new Command17("pause").description("Pause a scheduled job").argument("<name>", "Schedule name").option("--workspace <id>", "Workspace ID").option("--app <name|id>", "App name or ID (required)").action(async (name, opts, command) => {
+var pauseCommand = new Command17("pause").description("Pause a scheduled job").argument("<name>", "Schedule name").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name|id>", "App name or ID (required)").action(async (name, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15789,7 +16248,7 @@ var pauseCommand = new Command17("pause").description("Pause a scheduled job").a
     process.exit(1);
   }
 });
-var resumeCommand = new Command17("resume").description("Resume a paused scheduled job").argument("<name>", "Schedule name").option("--workspace <id>", "Workspace ID").option("--app <name|id>", "App name or ID (required)").action(async (name, opts, command) => {
+var resumeCommand = new Command17("resume").description("Resume a paused scheduled job").argument("<name>", "Schedule name").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name|id>", "App name or ID (required)").action(async (name, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15814,7 +16273,7 @@ init_store();
 init_client();
 import { Command as Command18 } from "commander";
 init_http();
-function truncate4(text2, max) {
+function truncate3(text2, max) {
   if (!text2)
     return "";
   const first = text2.split(`
@@ -15823,7 +16282,7 @@ function truncate4(text2, max) {
     return first;
   return first.slice(0, max - 3) + "...";
 }
-var listCommand6 = new Command18("list").description("List workspace public endpoints").option("--workspace <id>", "Workspace ID").option("--app <name>", "Filter by app name or ID").action(async (opts, command) => {
+var listCommand6 = new Command18("list").description("List workspace public endpoints").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name>", "Filter by app name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15851,7 +16310,7 @@ Workspace: ${workspaceName || workspaceId}
       const path2 = e.endpointPath.padEnd(36);
       const app = (e.appName || e.appId).padEnd(20);
       const auth = (e.auth || "").padEnd(10);
-      const desc = truncate4(e.description, 40);
+      const desc = truncate3(e.description, 40);
       const mode = e.deploymentMode ? ` [${e.deploymentMode}]` : "";
       console.log(`  ${method} ${path2} ${app} ${auth} ${desc}${mode}`);
     }
@@ -15861,7 +16320,7 @@ Workspace: ${workspaceName || workspaceId}
     process.exit(1);
   }
 });
-var callCommand2 = new Command18("call").description("Call a workspace endpoint directly").argument("<method>", "HTTP method (GET, POST, PUT, DELETE, etc.)").argument("<path>", "Endpoint path (e.g. /my-endpoint)").option("--workspace <id>", "Workspace ID").option("--app <name>", "App name or ID (narrows endpoint lookup)").option("--body <json>", "Request body as JSON string").option("--header <header>", 'Request header (format: "Key: Value", repeatable)', (val, prev) => [...prev, val], []).option("--query <string>", 'Query string to append to the URL (e.g. "foo=bar&baz=1")').option("--api-key <key>", "API key for Authorization: Bearer header").action(async (method, path2, opts, command) => {
+var callCommand2 = new Command18("call").description("Call a workspace endpoint directly").argument("<method>", "HTTP method (GET, POST, PUT, DELETE, etc.)").argument("<path>", "Endpoint path (e.g. /my-endpoint)").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name>", "App name or ID (narrows endpoint lookup)").option("--body <json>", "Request body as JSON string").option("--header <header>", 'Request header (format: "Key: Value", repeatable)', (val, prev) => [...prev, val], []).option("--query <string>", 'Query string to append to the URL (e.g. "foo=bar&baz=1")').option("--api-key <key>", "API key for Authorization: Bearer header").action(async (method, path2, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15992,7 +16451,7 @@ function formatSize(bytes) {
     return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
   return `${(bytes / (1024 * 1024 * 1024)).toFixed(1)}GB`;
 }
-var listCommand7 = new Command19("list").description("List file storage buckets in the workspace").option("--workspace <id>", "Workspace ID").action(async (opts, command) => {
+var listCommand7 = new Command19("list").description("List file storage buckets in the workspace").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16022,7 +16481,7 @@ Workspace: ${workspaceName || workspaceId}
     process.exit(1);
   }
 });
-var lsCommand = new Command19("ls").description("List files in a bucket").argument("<bucket>", "Bucket name").argument("[prefix]", "Key prefix to filter by").option("--workspace <id>", "Workspace ID").option("--delimiter <char>", "Delimiter for hierarchical listing", "/").action(async (bucket, prefix, opts, command) => {
+var lsCommand = new Command19("ls").description("List files in a bucket").argument("<bucket>", "Bucket name").argument("[prefix]", "Key prefix to filter by").option("--workspace <name-or-id>", "Workspace name or ID").option("--delimiter <char>", "Delimiter for hierarchical listing", "/").action(async (bucket, prefix, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16059,7 +16518,7 @@ var lsCommand = new Command19("ls").description("List files in a bucket").argume
     process.exit(1);
   }
 });
-var downloadCommand = new Command19("download").description("Download a file from a bucket").argument("<bucket>", "Bucket name").argument("<key>", "Object key to download").argument("[output]", "Local output path (defaults to basename of key)").option("--workspace <id>", "Workspace ID").action(async (bucket, key, output, opts, command) => {
+var downloadCommand = new Command19("download").description("Download a file from a bucket").argument("<bucket>", "Bucket name").argument("<key>", "Object key to download").argument("[output]", "Local output path (defaults to basename of key)").option("--workspace <name-or-id>", "Workspace name or ID").action(async (bucket, key, output, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16082,7 +16541,7 @@ var downloadCommand = new Command19("download").description("Download a file fro
     process.exit(1);
   }
 });
-var uploadCommand = new Command19("upload").description("Upload a local file to a bucket").argument("<bucket>", "Bucket name").argument("<localPath>", "Local file path to upload").argument("[key]", "Object key in bucket (defaults to basename of local path)").option("--workspace <id>", "Workspace ID").action(async (bucket, localPath, key, opts, command) => {
+var uploadCommand = new Command19("upload").description("Upload a local file to a bucket").argument("<bucket>", "Bucket name").argument("<localPath>", "Local file path to upload").argument("[key]", "Object key in bucket (defaults to basename of local path)").option("--workspace <name-or-id>", "Workspace name or ID").action(async (bucket, localPath, key, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16105,7 +16564,7 @@ var uploadCommand = new Command19("upload").description("Upload a local file to
     process.exit(1);
   }
 });
-var deleteCommand2 = new Command19("delete").description("Delete a file from a bucket").argument("<bucket>", "Bucket name").argument("<key>", "Object key to delete").option("--workspace <id>", "Workspace ID").option("--yes", "Skip confirmation prompt").action(async (bucket, key, opts, command) => {
+var deleteCommand2 = new Command19("delete").description("Delete a file from a bucket").argument("<bucket>", "Bucket name").argument("<key>", "Object key to delete").option("--workspace <name-or-id>", "Workspace name or ID").option("--yes", "Skip confirmation prompt").action(async (bucket, key, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16135,7 +16594,7 @@ var filesCommand = new Command19("files").description("Manage workspace file sto
 init_store();
 init_client();
 import { Command as Command20 } from "commander";
-var listCommand8 = new Command20("list").description("List components registered in the workspace").option("--workspace <id>", "Workspace ID").option("--app <id>", "Filter by app name or ID").action(async (opts, command) => {
+var listCommand8 = new Command20("list").description("List components registered in the workspace").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <id>", "Filter by app name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16174,7 +16633,7 @@ init_store();
 init_client();
 import { Command as Command21 } from "commander";
 init_prompt();
-var listCommand9 = new Command21("list").description("List API keys for the workspace").option("--workspace <id>", "Workspace ID").action(async (opts, command) => {
+var listCommand9 = new Command21("list").description("List API keys for the workspace").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16209,7 +16668,7 @@ Workspace: ${workspaceName || workspaceId}
     process.exit(1);
   }
 });
-var createCommand2 = new Command21("create").description("Create a new API key").option("--workspace <id>", "Workspace ID").option("--name <name>", "API key name").option("--app <id>", "Restrict key to a specific app (name or ID)").option("--scopes <scopes>", "Comma-separated list of scopes").action(async (opts, command) => {
+var createCommand2 = new Command21("create").description("Create a new API key").option("--workspace <name-or-id>", "Workspace name or ID").option("--name <name>", "API key name").option("--app <id>", "Restrict key to a specific app (name or ID)").option("--scopes <scopes>", "Comma-separated list of scopes").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16257,7 +16716,7 @@ var apiKeysCommand = new Command21("api-keys").description("Manage workspace API
 init_store();
 init_client();
 import { Command as Command22 } from "commander";
-function truncate5(text2, max) {
+function truncate4(text2, max) {
   if (!text2)
     return "";
   const first = text2.split(`
@@ -16266,7 +16725,7 @@ function truncate5(text2, max) {
     return first;
   return first.slice(0, max - 3) + "...";
 }
-var listCommand10 = new Command22("list").description("List agents in workspace").option("--workspace <id>", "Workspace ID").option("--app <id>", "Filter by app name or ID").action(async (opts, command) => {
+var listCommand10 = new Command22("list").description("List agents in workspace").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <id>", "Filter by app name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16292,8 +16751,8 @@ Workspace: ${workspaceName || workspaceId}
     for (const a of agents) {
       const name = a.agentName.padEnd(24);
       const type = a.type.padEnd(16);
-      const app = truncate5(a.appName, 18).padEnd(20);
-      const desc = truncate5(a.description, 40).padEnd(42);
+      const app = truncate4(a.appName, 18).padEnd(20);
+      const desc = truncate4(a.description, 40).padEnd(42);
       const integrations = (a.integrations?.join(", ") || "").padEnd(20);
       const entities = (a.entities?.join(", ") || "").padEnd(20);
       const mode = a.deploymentMode || "";
@@ -16305,7 +16764,7 @@ Workspace: ${workspaceName || workspaceId}
     process.exit(1);
   }
 });
-var statusCommand2 = new Command22("status").description("Get status of a specific agent").argument("<name>", "Agent name").option("--workspace <id>", "Workspace ID").option("--app <id>", "App name or ID (required)").action(async (name, opts, command) => {
+var statusCommand2 = new Command22("status").description("Get status of a specific agent").argument("<name>", "Agent name").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <id>", "App name or ID (required)").action(async (name, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16323,7 +16782,7 @@ var statusCommand2 = new Command22("status").description("Get status of a specif
     process.exit(1);
   }
 });
-var executionsCommand = new Command22("executions").description("List agent execution history for workspace").option("--workspace <id>", "Workspace ID").action(async (opts, command) => {
+var executionsCommand = new Command22("executions").description("List agent execution history for workspace").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16342,9 +16801,9 @@ var executionsCommand = new Command22("executions").description("List agent exec
     console.log("  " + "-".repeat(160));
     for (const e of executions) {
       const sessionId = e.sessionId.padEnd(36);
-      const agent = truncate5(e.agentName, 20).padEnd(22);
-      const app = truncate5(e.appId, 20).padEnd(22);
-      const prompt = truncate5(e.prompt, 50).padEnd(52);
+      const agent = truncate4(e.agentName, 20).padEnd(22);
+      const app = truncate4(e.appId, 20).padEnd(22);
+      const prompt = truncate4(e.prompt, 50).padEnd(52);
       const status = e.status.padEnd(12);
       const duration = e.durationMs != null ? `${e.durationMs}ms` : "";
       const usage = e.usage ? `${e.usage.inputTokens}/${e.usage.outputTokens}` : "";
@@ -16356,7 +16815,7 @@ var executionsCommand = new Command22("executions").description("List agent exec
     process.exit(1);
   }
 });
-var executionCommand = new Command22("execution").description("Get execution stream for a specific session").argument("<sessionId>", "Session ID").option("--workspace <id>", "Workspace ID").action(async (sessionId, opts, command) => {
+var executionCommand = new Command22("execution").description("Get execution stream for a specific session").argument("<sessionId>", "Session ID").option("--workspace <name-or-id>", "Workspace name or ID").action(async (sessionId, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16380,7 +16839,7 @@ init_store();
 init_client();
 import { Command as Command23 } from "commander";
 init_prompt();
-var listCommand11 = new Command23("list").description("List workspace MCP servers").option("--workspace <id>", "Workspace ID").action(async (opts, command) => {
+var listCommand11 = new Command23("list").description("List workspace MCP servers").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16436,7 +16895,7 @@ Workspace: ${workspaceName || workspaceId}
     process.exit(1);
   }
 });
-var addCommand = new Command23("add").description("Add an MCP server to workspace").argument("<name>", "Server name").argument("<url>", "Server URL (Streamable HTTP or SSE endpoint)").option("--transport <type>", "Transport type: streamable-http or sse", "streamable-http").option("--workspace <id>", "Workspace ID").action(async (name, url, opts, command) => {
+var addCommand = new Command23("add").description("Add an MCP server to workspace").argument("<name>", "Server name").argument("<url>", "Server URL (Streamable HTTP or SSE endpoint)").option("--transport <type>", "Transport type: streamable-http or sse", "streamable-http").option("--workspace <name-or-id>", "Workspace name or ID").action(async (name, url, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16464,7 +16923,7 @@ var addCommand = new Command23("add").description("Add an MCP server to workspac
     process.exit(1);
   }
 });
-var removeCommand = new Command23("remove").description("Remove an MCP server from workspace").argument("<name>", "Server name").option("--yes", "Skip confirmation").option("--workspace <id>", "Workspace ID").action(async (name, opts, command) => {
+var removeCommand = new Command23("remove").description("Remove an MCP server from workspace").argument("<name>", "Server name").option("--yes", "Skip confirmation").option("--workspace <name-or-id>", "Workspace name or ID").action(async (name, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16527,7 +16986,7 @@ var searchCommand3 = new Command23("search").description("Search community MCP s
     process.exit(1);
   }
 });
-var installCommand2 = new Command23("install").description("Install a community MCP server from the MCP Registry into your workspace").argument("<query>", "Server name or search query").option("--workspace <id>", "Workspace ID").action(async (query, opts, command) => {
+var installCommand2 = new Command23("install").description("Install a community MCP server from the MCP Registry into your workspace").argument("<query>", "Server name or search query").option("--workspace <name-or-id>", "Workspace name or ID").action(async (query, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16664,19 +17123,6 @@ async function collectTelemetryEvents(params) {
   const now = params.now ?? new Date().toISOString();
   const events = [];
   const adapterResults = [];
-  const previouslyReported = new Set(params.state.reportedAgentSlugs ?? []);
-  const newlyReportedAgents = [];
-  for (const slug of params.state.configuredAgents) {
-    if (!previouslyReported.has(slug)) {
-      events.push({
-        eventType: "local_agent.detected",
-        agentSlug: slug,
-        metadata: { installed: true },
-        timestamp: now
-      });
-      newlyReportedAgents.push(slug);
-    }
-  }
   for (const adapter2 of params.adapters) {
     let stats = "unsupported";
     let skills = "unsupported";
@@ -16768,11 +17214,12 @@ async function collectTelemetryEvents(params) {
       syncedMcpServers: params.syncedMcpServersCount,
       teamInstructionsApplied: params.teamInstructionsApplied,
       agentConfigsApplied: params.agentConfigsApplied,
+      agents: [...params.state.configuredAgents],
       ...params.state.persona?.label ? { persona: params.state.persona.label } : {}
     },
     timestamp: now
   });
-  return { events, adapterResults, newlyReportedAgents, healthReported };
+  return { events, adapterResults, healthReported };
 }
 function formatStatsLine(stats) {
   const parts = [];
@@ -16818,10 +17265,6 @@ function printTelemetryVerbose(result) {
     const errSuffix = r.error ? ` (error: ${r.error})` : "";
     console.log(`    [${r.name}] stats: ${statsLabel}; skills: ${skillsLabel}${errSuffix}`);
   }
-  if (result.newlyReportedAgents.length > 0) {
-    console.log(`
-  First-time detections: ${result.newlyReportedAgents.join(", ")}`);
-  }
   if (result.healthReported) {
     console.log("  Health report: due (daily)");
   }
@@ -17451,12 +17894,6 @@ function buildSaveConversationSkill() {
   };
 }
 
-// src/sync/hash.ts
-import { createHash as createHash3 } from "crypto";
-function contentHash(content) {
-  return "sha256:" + createHash3("sha256").update(content).digest("hex");
-}
-
 // src/sync/change-detect.ts
 function computeSyncPlan(input) {
   const { storedHashes, localSkills, remoteSkills } = input;
@@ -17488,6 +17925,16 @@ function computeSyncPlan(input) {
     const localChanged = localHash !== null && localHash !== stored.localHash;
     const remoteChanged = remoteHash !== stored.remoteHash;
     if (!local) {
+      if (remote.source === "app" && !remoteChanged) {
+        plan.skips.push({
+          name: remote.name,
+          action: "skip",
+          source: remote.source,
+          remoteId: remote.remoteId,
+          appId: remote.appId
+        });
+        continue;
+      }
       plan.pulls.push({
         name: remote.name,
         action: "pull",
@@ -17667,6 +18114,47 @@ function resolveConflictNonInteractive(prefer) {
   return prefer;
 }
 
+// src/sync/summary-format.ts
+function summarizeSkillPlan(plan) {
+  return {
+    added: plan.pulls.filter((p) => p.action === "new-remote").map((p) => p.name),
+    updated: plan.pulls.filter((p) => p.action === "pull").map((p) => p.name),
+    removed: plan.deletions.map((p) => p.name),
+    pushed: plan.pushes.map((p) => p.name),
+    unchanged: plan.skips.length,
+    conflicts: plan.conflicts.length
+  };
+}
+function formatNameList(names, cap2 = 6) {
+  if (names.length <= cap2)
+    return names.join(", ");
+  return `${names.slice(0, cap2).join(", ")}, +${names.length - cap2} more`;
+}
+function formatSkillSummaryLine(c) {
+  const parts = [];
+  if (c.added.length)
+    parts.push(`${c.added.length} added (${formatNameList(c.added)})`);
+  if (c.updated.length)
+    parts.push(`${c.updated.length} updated (${formatNameList(c.updated)})`);
+  if (c.removed.length)
+    parts.push(`${c.removed.length} removed (${formatNameList(c.removed)})`);
+  if (c.pushed.length)
+    parts.push(`${c.pushed.length} pushed (${formatNameList(c.pushed)})`);
+  if (c.conflicts)
+    parts.push(`${c.conflicts} conflict${c.conflicts === 1 ? "" : "s"}`);
+  parts.push(`${c.unchanged} up to date`);
+  return parts.join(", ");
+}
+var REASON_LABEL = {
+  mcp: "MCP",
+  settings: "settings"
+};
+function formatRestartChanges(changes) {
+  if (changes.length === 0)
+    return "none";
+  return changes.map((c) => `${c.name} (${c.reasons.map((r) => REASON_LABEL[r]).join(", ")})`).join("; ");
+}
+
 // src/sync/executor.ts
 async function executeSyncPlan(plan, resolvedConflicts, ctx) {
   const newHashes = {};
@@ -17682,7 +18170,7 @@ async function executeSyncPlan(plan, resolvedConflicts, ctx) {
       remoteId: action.remoteId,
       appId: action.appId
     };
-    console.log(`  Pulled: ${action.name}`);
+    vlog(`  Pulled: ${action.name}`);
   }
   for (const action of plan.pushes) {
     if (!action.localContent || !action.remoteId)
@@ -17699,7 +18187,7 @@ async function executeSyncPlan(plan, resolvedConflicts, ctx) {
       source: "external",
       remoteId: action.remoteId
     };
-    console.log(`  Pushed: ${action.name}`);
+    vlog(`  Pushed: ${action.name}`);
   }
   for (const action of plan.conflicts) {
     const resolution = resolvedConflicts.get(action.name);
@@ -17713,7 +18201,7 @@ async function executeSyncPlan(plan, resolvedConflicts, ctx) {
       });
       const hash = contentHash(action.localContent);
       newHashes[action.name] = { localHash: hash, remoteHash: hash, source: "external", remoteId: action.remoteId };
-      console.log(`  Pushed (conflict resolved): ${action.name}`);
+      vlog(`  Pushed (conflict resolved): ${action.name}`);
     } else if (resolution === "remote" && action.remoteContent) {
       const skillFile = makeSkillFile(action.name, action.remoteContent);
       await writeSkillToAgents(skillFile, action.source, ctx);
@@ -17723,12 +18211,12 @@ async function executeSyncPlan(plan, resolvedConflicts, ctx) {
         source: "external",
         remoteId: action.remoteId
       };
-      console.log(`  Pulled (conflict resolved): ${action.name}`);
+      vlog(`  Pulled (conflict resolved): ${action.name}`);
     }
   }
   for (const _action of plan.skips) {}
   for (const action of plan.deletions) {
-    console.log(`  Deleted locally: ${action.name}`);
+    vlog(`  Deleted locally: ${action.name}`);
   }
   return newHashes;
 }
@@ -17758,6 +18246,53 @@ function extractDescription(content) {
   return match ? match[1].trim() : "";
 }
 
+// src/sync/restart-stamp.ts
+function computeRestartReasons(input) {
+  const settingsSet = new Set(input.settingsChangedSlugs);
+  const out = {};
+  for (const agent of input.agents) {
+    if (agent.connectOnly)
+      continue;
+    const reasons = [];
+    if ((input.mcpChanged || agent.isNew) && agent.receivesMcp)
+      reasons.push("mcp");
+    if (settingsSet.has(agent.slug))
+      reasons.push("settings");
+    if (reasons.length > 0)
+      out[agent.slug] = reasons;
+  }
+  return out;
+}
+function summarizeRealSkillChanges(newLocalHashes, priorLocalHashes, materializedDeletions) {
+  const added = [];
+  const updated = [];
+  for (const [name, hash] of Object.entries(newLocalHashes)) {
+    if (!(name in priorLocalHashes))
+      added.push(name);
+    else if (priorLocalHashes[name] !== hash)
+      updated.push(name);
+  }
+  return {
+    added: added.sort(),
+    updated: updated.sort(),
+    removed: [...materializedDeletions].sort()
+  };
+}
+function hasRealSkillChange(c) {
+  return c.added.length > 0 || c.updated.length > 0 || c.removed.length > 0;
+}
+function sameStringSet(a, b) {
+  const setA = new Set(a ?? []);
+  const setB = new Set(b ?? []);
+  if (setA.size !== setB.size)
+    return false;
+  for (const item of setA) {
+    if (!setB.has(item))
+      return false;
+  }
+  return true;
+}
+
 // src/commands/sync.ts
 async function printAdoptionHint(credentials, workspaceId) {
   if (!workspaceId)
@@ -17842,6 +18377,7 @@ async function refreshConfiguredAgents(state) {
 }
 async function syncFromState(state, statePath2, credentials, opts) {
   const client = new ApiClient(credentials);
+  setVerbose(!!opts.verbose);
   if (!state.workspaceName || state.workspaceName === state.workspaceId || !state.workspaceSlug) {
     try {
       const workspaces = await client.listWorkspaces();
@@ -17853,11 +18389,12 @@ async function syncFromState(state, statePath2, credentials, opts) {
     } catch {}
   }
   console.log(`Syncing workspace: ${state.workspaceName || state.workspaceId}`);
+  let addedThisSync = [];
   if (shouldRedetect(state, opts)) {
     console.log("  Detecting installed agents...");
-    const added = await refreshConfiguredAgents(state);
-    if (added.length > 0) {
-      console.log(`  Detected new agent${added.length > 1 ? "s" : ""}: ${added.join(", ")}`);
+    addedThisSync = await refreshConfiguredAgents(state);
+    if (addedThisSync.length > 0) {
+      console.log(`  Detected new agent${addedThisSync.length > 1 ? "s" : ""}: ${addedThisSync.join(", ")}`);
     }
   }
   console.log("  Fetching workspace data...");
@@ -17899,6 +18436,8 @@ async function syncFromState(state, statePath2, credentials, opts) {
     headers: { Authorization: `Bearer ${credentials.apiKey}` },
     description: "Runwork workspace tools: query entities, trigger workflows, manage integrations, run agents, and access shared data across your team's apps."
   });
+  const mcpEntriesHash = configHash([...mcpEntries].sort((a, b) => a.name.localeCompare(b.name)));
+  const mcpChanged = state.lastMcpEntriesHash !== undefined && state.lastMcpEntriesHash !== mcpEntriesHash;
   const remoteSkills = [];
   for (const s of externalSkills) {
     remoteSkills.push({ name: s.name, content: s.content, source: "external", remoteId: s.id });
@@ -17928,12 +18467,9 @@ async function syncFromState(state, statePath2, credentials, opts) {
     plan.skips.push(...plan.conflicts.map((c) => ({ ...c, action: "skip" })));
     plan.conflicts = [];
   }
-  const hasChanges = plan.pulls.length > 0 || plan.pushes.length > 0 || plan.conflicts.length > 0 || plan.deletions.length > 0;
-  if (hasChanges) {
+  console.log(`  Skills: ${formatSkillSummaryLine(summarizeSkillPlan(plan))}`);
+  if (isVerbose())
     printSyncSummary(plan);
-  } else {
-    console.log("  All skills up to date.");
-  }
   const adapters = [];
   for (const slug of state.configuredAgents) {
     const adapter2 = getAdapterBySlug(slug);
@@ -17973,6 +18509,7 @@ async function syncFromState(state, statePath2, credentials, opts) {
       }
     }
   }
+  const settingsChangedSlugs = [];
   const scopes = state.scope === "both" ? ["project", "user"] : [state.scope];
   if (adapters.length > 0) {
     console.log(`  Syncing to: ${adapters.map((a) => a.name).join(", ")}`);
@@ -18021,6 +18558,8 @@ async function syncFromState(state, statePath2, credentials, opts) {
     buildSaveConversationSkill()
   ];
   const builtInNames = builtInSkills.map((s) => s.name);
+  const builtInSkillsHash = configHash(builtInSkills.map((s) => s.content));
+  const builtInSkillsChanged = state.builtInSkillsHash !== undefined && state.builtInSkillsHash !== builtInSkillsHash;
   const summary = {
     adaptersProcessed: 0,
     adaptersFailed: 0,
@@ -18030,16 +18569,18 @@ async function syncFromState(state, statePath2, credentials, opts) {
     instructionHintWrites: 0,
     hookInstallCalls: 0
   };
+  const mcpFailedAdapters = new Set;
+  const skillFailedAdapters = new Set;
   for (const adapter2 of adapters) {
     if (isConnectOnlyAgent(getRegistryAgent(adapter2.slug))) {
-      console.log(`  [${adapter2.name}] Connect-only agent: no local files to sync`);
+      vlog(`  [${adapter2.name}] Connect-only agent: no local files to sync`);
       summary.adaptersProcessed++;
       continue;
     }
     let adapterFailedAnyScope = false;
     for (const scope of scopes) {
-      try {
-        if (adapter2.supportsSkills()) {
+      if (adapter2.supportsSkills()) {
+        try {
           const skipAppSkills = adapter2.mcpProvidesSkills && mcpEntries.length > 0;
           const scopeSkills = remoteSkills.filter((s) => {
             if (builtInNameSet.has(s.name))
@@ -18059,25 +18600,41 @@ async function syncFromState(state, statePath2, credentials, opts) {
             description: s.source === "app" ? buildAppSkillDescription(s.name, registries) || `${s.name} - Runwork workspace application` : `${s.name} - Runwork workspace skill`
           }));
           const allSkillFiles = [...builtInSkills, ...workspaceSkillFiles];
-          await adapter2.writeSkills(allSkillFiles, scope);
-          summary.skillWrites++;
-          summary.skillFilesWritten += allSkillFiles.length;
-          console.log(`  [${adapter2.name}] Wrote ${allSkillFiles.length} skills (${scope}): ` + `${builtInSkills.length} built-in [${builtInNames.join(", ")}], ` + `${workspaceSkillFiles.length} workspace`);
-        } else {
-          console.log(`  [${adapter2.name}] Skipped skills (${scope}): adapter does not support skills`);
+          const written = await adapter2.writeSkills(allSkillFiles, scope);
+          if (written > 0) {
+            summary.skillWrites++;
+            summary.skillFilesWritten += written;
+            vlog(`  [${adapter2.name}] Wrote ${written} skills (${scope}): ` + `${builtInSkills.length} built-in [${builtInNames.join(", ")}], ` + `${workspaceSkillFiles.length} workspace`);
+          } else {
+            vlog(`  [${adapter2.name}] Skipped skills (${scope}): adapter writes none at this scope`);
+          }
+        } catch (err) {
+          adapterFailedAnyScope = true;
+          skillFailedAdapters.add(adapter2.slug);
+          console.warn(`  [${adapter2.name}] Failed skills (${scope}): ${err instanceof Error ? err.message : err}`);
         }
-        if (adapter2.supportsMcpScope(scope) && mcpEntries.length > 0) {
+      } else {
+        vlog(`  [${adapter2.name}] Skipped skills (${scope}): adapter does not support skills`);
+      }
+      if (adapter2.supportsMcpScope(scope) && mcpEntries.length > 0) {
+        try {
           await adapter2.writeMcpServers(mcpEntries, scope);
           summary.mcpServerWrites++;
-          console.log(`  [${adapter2.name}] Updated ${mcpEntries.length} MCP server${mcpEntries.length > 1 ? "s" : ""} (${scope})`);
-        } else if (mcpEntries.length === 0) {
-          console.log(`  [${adapter2.name}] Skipped MCP servers (${scope}): no workspace MCP servers configured`);
-        } else if (!adapter2.supportsMcpScope(scope)) {
-          console.log(`  [${adapter2.name}] Skipped MCP servers (${scope}): adapter does not support MCP at this scope`);
+          vlog(`  [${adapter2.name}] Updated ${mcpEntries.length} MCP server${mcpEntries.length > 1 ? "s" : ""} (${scope})`);
+        } catch (err) {
+          adapterFailedAnyScope = true;
+          mcpFailedAdapters.add(adapter2.slug);
+          console.warn(`  [${adapter2.name}] Failed MCP servers (${scope}): ${err instanceof Error ? err.message : err}`);
         }
+      } else if (mcpEntries.length === 0) {
+        vlog(`  [${adapter2.name}] Skipped MCP servers (${scope}): no workspace MCP servers configured`);
+      } else if (!adapter2.supportsMcpScope(scope)) {
+        vlog(`  [${adapter2.name}] Skipped MCP servers (${scope}): adapter does not support MCP at this scope`);
+      }
+      try {
         await adapter2.writeInstructionHint(instructionHint, scope);
         summary.instructionHintWrites++;
-        console.log(`  [${adapter2.name}] Updated instruction hints (${scope})`);
+        vlog(`  [${adapter2.name}] Updated instruction hints (${scope})`);
         if (adapter2.writeBuiltInHooks) {
           await adapter2.writeBuiltInHooks(scope);
           summary.hookInstallCalls++;
@@ -18116,7 +18673,7 @@ async function syncFromState(state, statePath2, credentials, opts) {
       try {
         await adapter2.writeTeamInstructions(fullInstructions, scope);
         teamInstructionsApplied = true;
-        console.log(`  [${adapter2.name}] Updated team instructions (${scope})`);
+        vlog(`  [${adapter2.name}] Updated team instructions (${scope})`);
       } catch {}
     }
   }
@@ -18137,7 +18694,7 @@ async function syncFromState(state, statePath2, credentials, opts) {
           await adapter2.writeAgentConfig(configWithoutInstructions, scope);
           agentConfigsApplied++;
           const configKeys = Object.keys(configWithoutInstructions).join(", ");
-          console.log(`  [${adapter2.name}] Updated agent config: ${configKeys} (${scope})`);
+          vlog(`  [${adapter2.name}] Updated agent config: ${configKeys} (${scope})`);
         } catch {}
       }
     }
@@ -18192,6 +18749,12 @@ async function syncFromState(state, statePath2, credentials, opts) {
       try {
         const baseline = agentState?.lastInjected;
         await adapter2.writeAgentConfig(mergedConfig, "user", baseline);
+        if (baked && !resolved.bootstrapped) {
+          const prev = agentState?.lastInjected;
+          if (!sameStringSet(prev?.allow, resolved.applicableAllow) || !sameStringSet(prev?.deny, resolved.applicableDeny)) {
+            settingsChangedSlugs.push(slug);
+          }
+        }
         if (baked) {
           const nextState = {
             lastInjected: {
@@ -18205,11 +18768,11 @@ async function syncFromState(state, statePath2, credentials, opts) {
           };
           state.agentDefaults[slug] = nextState;
           if (resolved.bootstrapped) {
-            console.log(`  [${adapter2.name}] Bootstrapped default-rule tracking (defaults apply on next sync)`);
+            vlog(`  [${adapter2.name}] Bootstrapped default-rule tracking (defaults apply on next sync)`);
           } else if (resolved.applicableAllow.length || resolved.applicableDeny.length || resolved.removalsThisSync.allow || resolved.removalsThisSync.deny) {
             const totalRemovals = resolved.removalsThisSync.allow + resolved.removalsThisSync.deny;
             const removalNote = totalRemovals > 0 ? ` (${totalRemovals} new opt-out${totalRemovals > 1 ? "s" : ""} honored)` : "";
-            console.log(`  [${adapter2.name}] Applied defaults: ${resolved.applicableAllow.length} allow, ${resolved.applicableDeny.length} deny${removalNote}`);
+            vlog(`  [${adapter2.name}] Applied defaults: ${resolved.applicableAllow.length} allow, ${resolved.applicableDeny.length} deny${removalNote}`);
           }
         }
         if (team)
@@ -18223,11 +18786,12 @@ async function syncFromState(state, statePath2, credentials, opts) {
       const runworkDir = join35(homedir17(), ".runwork");
       const result = adapter2.registerDesktopWorkspace(runworkDir, "Runwork");
       if (result === "written") {
-        console.log(`  [${adapter2.name}] Registered workspace in Codex desktop app`);
+        vlog(`  [${adapter2.name}] Registered workspace in Codex desktop app`);
       }
       break;
     }
   }
+  const prevMcpNames = state.mcpServers ?? [];
   state.lastSyncAt = new Date().toISOString();
   state.mcpServers = mcpEntries.map((e) => e.name);
   state.skills = remoteSkills.map((s) => s.name);
@@ -18235,6 +18799,57 @@ async function syncFromState(state, statePath2, credentials, opts) {
     "runwork",
     ...remoteSkills.map((s) => s.name.toLowerCase().replace(/[^a-z0-9]+/g, "-"))
   ];
+  const priorSkillHashes = state.skillHashes || {};
+  const newLocalHashes = {};
+  for (const [name, h] of Object.entries(newHashes))
+    newLocalHashes[name] = h.localHash;
+  const priorLocalHashes = {};
+  for (const [name, h] of Object.entries(priorSkillHashes))
+    priorLocalHashes[name] = h.localHash;
+  const materializedDeletions = plan.deletions.filter((d) => d.localContent !== undefined).map((d) => d.name);
+  const skillChanges = summarizeRealSkillChanges(newLocalHashes, priorLocalHashes, materializedDeletions);
+  const newMcpNames = mcpEntries.map((e) => e.name);
+  const prevMcpSet = new Set(prevMcpNames);
+  const newMcpSet = new Set(newMcpNames);
+  const mcpAdded = mcpChanged ? newMcpNames.filter((n) => !prevMcpSet.has(n)) : [];
+  const mcpRemoved = mcpChanged ? prevMcpNames.filter((n) => !newMcpSet.has(n)) : [];
+  const addedSet = new Set(addedThisSync);
+  const restartReasons = computeRestartReasons({
+    agents: adapters.map((a) => ({
+      slug: a.slug,
+      receivesMcp: mcpEntries.length > 0 && scopes.some((sc) => a.supportsMcpScope(sc)) && !mcpFailedAdapters.has(a.slug),
+      connectOnly: isConnectOnlyAgent(getRegistryAgent(a.slug)),
+      isNew: !!opts.initialSetup || addedSet.has(a.slug)
+    })),
+    mcpChanged,
+    settingsChangedSlugs
+  });
+  if (Object.keys(restartReasons).length > 0) {
+    if (!state.agentConfigChangedAt)
+      state.agentConfigChangedAt = {};
+    for (const [slug, reasons] of Object.entries(restartReasons)) {
+      state.agentConfigChangedAt[slug] = { changedAt: state.lastSyncAt, reasons };
+    }
+  }
+  if (hasRealSkillChange(skillChanges) || builtInSkillsChanged || mcpChanged || settingsChangedSlugs.length > 0) {
+    state.lastSyncChange = {
+      at: state.lastSyncAt,
+      skills: skillChanges,
+      builtInSkillsChanged,
+      mcp: { changed: mcpChanged, added: mcpAdded, removed: mcpRemoved },
+      settingsSlugs: settingsChangedSlugs
+    };
+  }
+  if (mcpFailedAdapters.size === 0)
+    state.lastMcpEntriesHash = mcpEntriesHash;
+  if (skillFailedAdapters.size === 0)
+    state.builtInSkillsHash = builtInSkillsHash;
+  const nameBySlug = new Map(adapters.map((a) => [a.slug, a.name]));
+  const restartChanges = Object.entries(restartReasons).map(([slug, reasons]) => ({
+    name: nameBySlug.get(slug) ?? slug,
+    reasons
+  }));
+  console.log(`  Restart-worthy changes: ${formatRestartChanges(restartChanges)}`);
   const mergedHashes = { ...state.skillHashes || {} };
   for (const [name, hash] of Object.entries(newHashes)) {
     mergedHashes[name] = hash;
@@ -18256,25 +18871,29 @@ async function syncFromState(state, statePath2, credentials, opts) {
     if (opts.verbose)
       printTelemetryVerbose(telemetry);
     await client.reportTelemetry(state.workspaceId, telemetry.events);
-    if (telemetry.healthReported)
+    if (telemetry.healthReported) {
       state.lastHealthReportAt = new Date().toISOString();
-    state.reportedAgentSlugs = [
-      ...new Set([...state.reportedAgentSlugs ?? [], ...telemetry.newlyReportedAgents])
-    ];
-    writeFileSync29(statePath2, JSON.stringify(state, null, 2));
+      writeFileSync29(statePath2, JSON.stringify(state, null, 2));
+    }
   } catch {}
-  const summaryParts = [];
-  summaryParts.push(`${summary.adaptersProcessed} adapter${summary.adaptersProcessed === 1 ? "" : "s"}`);
-  if (summary.adaptersFailed > 0)
-    summaryParts.push(`${summary.adaptersFailed} failed`);
-  summaryParts.push(`${summary.skillWrites} skill write${summary.skillWrites === 1 ? "" : "s"} (${summary.skillFilesWritten} files)`);
-  if (summary.mcpServerWrites > 0)
-    summaryParts.push(`${summary.mcpServerWrites} MCP config write${summary.mcpServerWrites === 1 ? "" : "s"}`);
-  if (summary.hookInstallCalls > 0)
-    summaryParts.push(`${summary.hookInstallCalls} hook install${summary.hookInstallCalls === 1 ? "" : "s"}`);
-  summaryParts.push(`${summary.instructionHintWrites} instruction hint write${summary.instructionHintWrites === 1 ? "" : "s"}`);
-  console.log(`
+  const failedNote = summary.adaptersFailed > 0 ? ` (${summary.adaptersFailed} failed)` : "";
+  if (isVerbose()) {
+    const summaryParts = [];
+    summaryParts.push(`${summary.adaptersProcessed} adapter${summary.adaptersProcessed === 1 ? "" : "s"}`);
+    if (summary.adaptersFailed > 0)
+      summaryParts.push(`${summary.adaptersFailed} failed`);
+    summaryParts.push(`${summary.skillWrites} skill write${summary.skillWrites === 1 ? "" : "s"} (${summary.skillFilesWritten} files)`);
+    if (summary.mcpServerWrites > 0)
+      summaryParts.push(`${summary.mcpServerWrites} MCP config write${summary.mcpServerWrites === 1 ? "" : "s"}`);
+    if (summary.hookInstallCalls > 0)
+      summaryParts.push(`${summary.hookInstallCalls} hook install${summary.hookInstallCalls === 1 ? "" : "s"}`);
+    summaryParts.push(`${summary.instructionHintWrites} instruction hint write${summary.instructionHintWrites === 1 ? "" : "s"}`);
+    console.log(`
   Summary: ${summaryParts.join(", ")}.`);
+  } else {
+    console.log(`
+  ${summary.adaptersProcessed} agent${summary.adaptersProcessed === 1 ? "" : "s"} synced${failedNote}.`);
+  }
   try {
     const cadence = loadCadenceState();
     const lastMs = cadence.lastReflectedAt ? new Date(cadence.lastReflectedAt).getTime() : 0;
@@ -18372,7 +18991,7 @@ async function resolveAndPersistWorkspace(client, opts) {
   }
   return { workspaceId, workspaceName, workspaceSlug };
 }
-var setupCommand = new Command25("setup").description("Configure local AI agents with workspace skills and MCP servers").option("--workspace <id>", "Workspace ID").option("--agent <slug>", "Only configure a specific agent (e.g. claude-code, cursor)").option("--dry-run", "Show what would be configured without writing files").option("-y, --yes", "Skip all prompts, configure all detected agents with user scope").option("--persona <level>", "Technical-level persona for agent instructions (1=everyday, 2=curious, 3=engineer)").action(async (opts) => {
+var setupCommand = new Command25("setup").description("Configure local AI agents with workspace skills and MCP servers").option("--workspace <name-or-id>", "Workspace name or ID").option("--agent <slug>", "Only configure a specific agent (e.g. claude-code, cursor)").option("--dry-run", "Show what would be configured without writing files").option("-y, --yes", "Skip all prompts, configure all detected agents with user scope").option("--persona <level>", "Technical-level persona for agent instructions (1=everyday, 2=curious, 3=engineer)").action(async (opts) => {
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
   const { workspaceId, workspaceName, workspaceSlug } = await resolveAndPersistWorkspace(client, opts);
@@ -18467,7 +19086,8 @@ Syncing workspace data...
       dryRun: false,
       pullOnly: true,
       yes: true,
-      prefer: "remote"
+      prefer: "remote",
+      initialSetup: true
     });
   }
   console.log("\nSetup complete. Run `runwork sync` anytime to refresh.");
@@ -18723,7 +19343,7 @@ init_store();
 init_client();
 import { Command as Command28 } from "commander";
 init_init();
-var listCommand12 = new Command28("list").description("List apps in workspace").option("--workspace <id>", "Workspace ID").action(async (opts, command) => {
+var listCommand12 = new Command28("list").description("List apps in workspace").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -18756,7 +19376,7 @@ Workspace: ${workspaceName || workspaceId}
 var createCommand3 = new Command28("create").description("Create a new Runwork app").argument("[name]", "App name").action(async (name) => {
   await runCreateFlow(name);
 });
-var infoCommand2 = new Command28("info").description("Show detailed app info, preview status, and registries").argument("[app]", "App ID, name, or slug").option("--workspace <id>", "Workspace ID").action(async (appArg, opts, command) => {
+var infoCommand2 = new Command28("info").description("Show detailed app info, preview status, and registries").argument("[app]", "App ID, name, or slug").option("--workspace <name-or-id>", "Workspace name or ID").action(async (appArg, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -18783,15 +19403,157 @@ var infoCommand2 = new Command28("info").description("Show detailed app info, pr
 });
 var appsCommand = new Command28("apps").description("Manage workspace apps").addCommand(listCommand12).addCommand(createCommand3).addCommand(infoCommand2);
 
+// src/commands/members.ts
+init_store();
+init_client();
+import { Command as Command29 } from "commander";
+function formatMemberRows(members) {
+  return members.map((m) => ({
+    name: m.user.displayName || m.user.email,
+    email: m.user.email,
+    role: m.role,
+    status: m.status,
+    userId: m.userId
+  }));
+}
+var listCommand13 = new Command29("list").description("List members of a workspace (name, email, role)").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
+  const useJson = shouldOutputJson(command.optsWithGlobals().json);
+  const credentials = requireAuth();
+  const client = new ApiClient(credentials);
+  const { workspaceId, workspaceName } = await resolveWorkspace2(client, opts);
+  try {
+    const members = await client.listWorkspaceMembers(workspaceId);
+    if (useJson) {
+      jsonOut({ workspaceId, workspaceName, members });
+      return;
+    }
+    if (members.length === 0) {
+      console.log("No members found in this workspace.");
+      return;
+    }
+    console.log(`
+Workspace: ${workspaceName || workspaceId}
+`);
+    console.log(`  ${"NAME".padEnd(24)} ${"EMAIL".padEnd(32)} ${"ROLE".padEnd(10)} STATUS`);
+    console.log("  " + "-".repeat(76));
+    for (const row of formatMemberRows(members)) {
+      console.log(`  ${row.name.padEnd(24)} ${row.email.padEnd(32)} ${row.role.padEnd(10)} ${row.status}`);
+    }
+    console.log("");
+  } catch (err) {
+    console.error("Failed to list members:", err instanceof Error ? err.message : err);
+    process.exit(1);
+  }
+});
+var membersCommand = new Command29("members").description("List workspace members").addCommand(listCommand13);
+
+// src/commands/api.ts
+init_store();
+init_client();
+import { Command as Command30 } from "commander";
+import { readFileSync as readFileSync37 } from "fs";
+function normalizeApiPath(rawPath, baseUrl) {
+  if (/^https?:\/\//i.test(rawPath)) {
+    const target = new URL(rawPath);
+    const base = new URL(baseUrl);
+    if (target.origin !== base.origin) {
+      throw new Error(`Refusing to call ${target.origin}: \`runwork api\` only calls the platform API at ${base.origin}.`);
+    }
+    return target.pathname + target.search;
+  }
+  return rawPath.startsWith("/") ? rawPath : `/${rawPath}`;
+}
+var apiCommand = new Command30("api").description("Make an authenticated request to the Runwork platform API (escape hatch for endpoints the CLI does not cover)").argument("<method>", "HTTP method (GET, POST, PUT, DELETE, etc.)").argument("[path]", "API path (e.g. /api/workspaces); optional with --curl").option("--body <json>", "Request body JSON (or @file.json)").option("--header <header>", 'Request header (format: "Key: Value", repeatable)', (val, prev) => [...prev, val], []).option("--query <query>", "Query string (e.g. limit=10&offset=0)").option("--curl <command>", "Parse a curl command (method, path, headers, body)").option("--curl-file <file>", "Read curl command from a file").addHelpText("after", `
+Examples:
+  runwork api GET /api/workspaces
+  runwork api GET /api/workspaces/<id>/members
+  runwork api POST /api/workspaces/<id>/skills --body '{"name":"my-skill"}'
+
+Authentication uses your stored Runwork credentials; the API key never needs
+to be read or pasted manually. Prefer a dedicated command when one exists
+(runwork apps/members/schedules/...).`).action(async (method, path2, opts, command) => {
+  const useJson = shouldOutputJson(command.optsWithGlobals().json);
+  const credentials = requireAuth();
+  const client = new ApiClient(credentials);
+  let finalMethod = method;
+  let finalPath = path2;
+  const headers = {};
+  let body;
+  const query = opts.query;
+  if (opts.curl || opts.curlFile) {
+    let curlStr = opts.curl;
+    if (opts.curlFile) {
+      try {
+        curlStr = readFileSync37(opts.curlFile, "utf-8");
+      } catch (err) {
+        console.error(`Could not read --curl-file: ${err instanceof Error ? err.message : err}`);
+        process.exit(1);
+      }
+    }
+    const parsed = await parseCurlToRequest(curlStr);
+    finalMethod = parsed.method;
+    finalPath = parsed.path + (parsed.query ? `?${parsed.query}` : "");
+    Object.assign(headers, parsed.headers);
+    body = parsed.body;
+  }
+  for (const h of opts.header || []) {
+    const [key, ...rest] = h.split(":");
+    headers[key.trim()] = rest.join(":").trim();
+  }
+  if (opts.body) {
+    let raw = opts.body;
+    if (raw.startsWith("@")) {
+      try {
+        raw = readFileSync37(raw.slice(1), "utf-8");
+      } catch (err) {
+        console.error(`Could not read body file: ${err instanceof Error ? err.message : err}`);
+        process.exit(1);
+      }
+    }
+    try {
+      body = JSON.parse(raw);
+    } catch {
+      console.error("Invalid JSON in --body");
+      process.exit(1);
+    }
+  }
+  if (!finalPath) {
+    console.error("Usage: runwork api <method> <path>");
+    console.error('   or: runwork api <method> --curl "curl ..."');
+    process.exit(1);
+  }
+  try {
+    const normalizedPath = normalizeApiPath(finalPath, credentials.baseUrl || "https://runwork.ai");
+    const result = await client.rawApiCall(finalMethod, normalizedPath, {
+      body,
+      headers: Object.keys(headers).length > 0 ? headers : undefined,
+      query
+    });
+    if (useJson) {
+      jsonOut({ success: result.ok, status: result.status, body: result.body });
+    } else if (typeof result.body === "string") {
+      console.log(result.body);
+    } else {
+      console.log(JSON.stringify(result.body, null, 2));
+    }
+    if (!result.ok)
+      process.exit(1);
+  } catch (err) {
+    console.error("API call failed:", err instanceof Error ? err.message : err);
+    process.exit(1);
+  }
+});
+
 // src/commands/doctor.ts
 init_colors();
-import { Command as Command29 } from "commander";
+import { Command as Command31 } from "commander";
 
 // src/health/checks.ts
 init_subprocess();
 init_store();
 init_client();
-import { existsSync as existsSync44, readFileSync as readFileSync37 } from "fs";
+import { parse as parse2 } from "smol-toml";
+import { existsSync as existsSync44, readFileSync as readFileSync38 } from "fs";
 import { join as join40, sep as sep3 } from "path";
 import { homedir as homedir22, platform as osPlatform2, arch as osArch } from "os";
 init_http();
@@ -18827,7 +19589,7 @@ function buildContext() {
   const configPath = join40(process.cwd(), ".runwork.json");
   if (existsSync44(configPath)) {
     try {
-      config = JSON.parse(readFileSync37(configPath, "utf-8"));
+      config = JSON.parse(readFileSync38(configPath, "utf-8"));
     } catch {}
   }
   return { credentials, client, config, cwd: process.cwd() };
@@ -19047,6 +19809,14 @@ async function checkGitCredentialHelper(ctx) {
       fix: "runwork doctor --fix (re-registers with the current binary path)"
     };
   }
+  if (!lookup.hasReset) {
+    return {
+      name: "git-credential-helper",
+      status: "fail",
+      message: `helper registered for ${origin} but the credential-manager reset entry is missing (Windows may show a Git Credential Manager popup)`,
+      fix: "runwork doctor --fix"
+    };
+  }
   return {
     name: "git-credential-helper",
     status: "pass",
@@ -19176,7 +19946,7 @@ function loadSetupState5() {
   for (const p of [projectPath, userPath]) {
     if (existsSync44(p)) {
       try {
-        return JSON.parse(readFileSync37(p, "utf-8"));
+        return JSON.parse(readFileSync38(p, "utf-8"));
       } catch {
         continue;
       }
@@ -19184,6 +19954,95 @@ function loadSetupState5() {
   }
   return null;
 }
+var RUNWORK_NETWORK_DOMAINS = ["runwork.ai", "*.runwork.ai"];
+async function checkCodexNetwork() {
+  const name = "codex-network";
+  const state = loadSetupState5();
+  if (!state || !state.configuredAgents.includes("codex")) {
+    return { name, status: "skip", message: "Codex not configured for Runwork" };
+  }
+  const configPath = join40(homedir22(), ".codex", "config.toml");
+  if (!existsSync44(configPath)) {
+    return { name, status: "skip", message: "no Codex config found" };
+  }
+  let parsed;
+  try {
+    parsed = parse2(readFileSync38(configPath, "utf-8"));
+  } catch {
+    return { name, status: "warn", message: "could not parse ~/.codex/config.toml" };
+  }
+  const features = parsed.features && typeof parsed.features === "object" ? parsed.features : undefined;
+  const proxy = features?.network_proxy;
+  if (proxy && proxy.enabled === true) {
+    const domains = proxy.domains && typeof proxy.domains === "object" ? proxy.domains : {};
+    if (RUNWORK_NETWORK_DOMAINS.some((d) => domains[d] === "deny")) {
+      return {
+        name,
+        status: "warn",
+        message: "network proxy denies runwork.ai; the Runwork CLI is blocked",
+        fix: 'remove the runwork.ai "deny" rule in ~/.codex/config.toml'
+      };
+    }
+    if (RUNWORK_NETWORK_DOMAINS.every((d) => domains[d] === "allow")) {
+      return { name, status: "pass", message: "proxy-allowlisted: runwork.ai permitted, other domains scoped by your proxy" };
+    }
+    return {
+      name,
+      status: "warn",
+      message: "network proxy is on but runwork.ai is not allowlisted",
+      fix: "runwork sync"
+    };
+  }
+  const sww = parsed.sandbox_workspace_write && typeof parsed.sandbox_workspace_write === "object" ? parsed.sandbox_workspace_write : undefined;
+  const sandboxMode = typeof parsed.sandbox_mode === "string" ? parsed.sandbox_mode : undefined;
+  if (sww?.network_access === true || sandboxMode === "danger-full-access") {
+    return { name, status: "pass", message: "open: outbound network enabled (all domains)" };
+  }
+  if (sww?.network_access === false) {
+    return {
+      name,
+      status: "warn",
+      message: "off: network explicitly disabled; the Runwork CLI cannot reach the network",
+      fix: "set [sandbox_workspace_write] network_access = true, or run runwork sync"
+    };
+  }
+  return {
+    name,
+    status: "warn",
+    message: "off: network is disabled by default in Codex workspace-write sandbox; the Runwork CLI cannot reach the network",
+    fix: "runwork sync"
+  };
+}
+async function checkCodexDesktopProject() {
+  const name = "codex-desktop-project";
+  const state = loadSetupState5();
+  const usesCodex = !!state && (state.configuredAgents.includes("codex-app") || state.configuredAgents.includes("codex"));
+  if (!usesCodex) {
+    return { name, status: "skip", message: "Codex not configured for Runwork" };
+  }
+  const statePath2 = join40(homedir22(), ".codex", ".codex-global-state.json");
+  if (!existsSync44(statePath2)) {
+    return { name, status: "skip", message: "Codex desktop app not detected" };
+  }
+  let savedRoots = [];
+  try {
+    const parsed = JSON.parse(readFileSync38(statePath2, "utf-8"));
+    const roots = parsed["electron-saved-workspace-roots"];
+    savedRoots = Array.isArray(roots) ? roots.filter((r) => typeof r === "string") : [];
+  } catch {
+    return { name, status: "warn", message: "could not read Codex desktop state" };
+  }
+  const runworkDir = join40(homedir22(), ".runwork");
+  if (savedRoots.includes(runworkDir)) {
+    return { name, status: "pass", message: "Runwork project added to Codex desktop sidebar" };
+  }
+  return {
+    name,
+    status: "warn",
+    message: "Runwork project not added to Codex desktop sidebar",
+    fix: "quit the Codex app, then run runwork sync (sync skips this while Codex is open)"
+  };
+}
 async function checkAgentSetup() {
   const state = loadSetupState5();
   if (!state) {
@@ -19228,7 +20087,7 @@ async function checkAgentSetup() {
     const mcpConfigPath = getMcpConfigPath2(slug, "user");
     if (mcpConfigPath && existsSync44(mcpConfigPath)) {
       try {
-        const content = readFileSync37(mcpConfigPath, "utf-8");
+        const content = readFileSync38(mcpConfigPath, "utf-8");
         const missingMcp = state.mcpServers.filter((name) => !content.includes(name));
         if (missingMcp.length > 0) {
           details.push(`${missingMcp.length} MCP server(s) missing from ${slug} config`);
@@ -19286,7 +20145,8 @@ function getMcpConfigPath2(slug, scope) {
     case "windsurf":
       return scope === "project" ? join40(process.cwd(), ".windsurf", "mcp.json") : join40(home, ".windsurf", "mcp.json");
     case "codex":
-      return scope === "user" ? join40(home, ".codex", "mcp.json") : null;
+    case "codex-app":
+      return scope === "user" ? join40(home, ".codex", "config.toml") : null;
     case "gemini":
       return scope === "user" ? join40(home, ".gemini", "settings.json") : null;
     default:
@@ -19299,6 +20159,7 @@ function getSkillsDir(slug, scope) {
     case "claude-code":
       return scope === "project" ? join40(process.cwd(), ".claude", "skills") : join40(home, ".claude", "skills");
     case "codex":
+    case "codex-app":
       return scope === "project" ? join40(process.cwd(), ".codex", "skills") : join40(home, ".codex", "skills");
     case "gemini":
       return scope === "project" ? join40(process.cwd(), ".gemini", "skills") : join40(home, ".gemini", "skills");
@@ -19325,7 +20186,9 @@ var CHECK_RUNNERS = [
   { names: ["app-exists"], run: async (ctx) => [await checkAppExists(ctx)] },
   { names: ["git-remote"], run: async (ctx) => [await checkGitRemote(ctx)] },
   { names: ["deploy-freshness"], run: async (ctx) => [await checkDeployFreshness(ctx)] },
-  { names: ["agent-setup"], run: async () => [await checkAgentSetup()] }
+  { names: ["agent-setup"], run: async () => [await checkAgentSetup()] },
+  { names: ["codex-network"], run: async () => [await checkCodexNetwork()] },
+  { names: ["codex-desktop-project"], run: async () => [await checkCodexDesktopProject()] }
 ];
 var ALL_CHECK_NAMES = CHECK_RUNNERS.flatMap((r) => r.names);
 async function runAllChecks(options) {
@@ -19398,7 +20261,7 @@ async function applyDoctorFixes(ctx, failingNames) {
 }
 
 // src/agents/runtime-detection.ts
-import { existsSync as existsSync46, readFileSync as readFileSync38, statSync as statSync6, readdirSync as readdirSync13 } from "fs";
+import { existsSync as existsSync46, readFileSync as readFileSync39, statSync as statSync6, readdirSync as readdirSync13 } from "fs";
 import { homedir as homedir23 } from "os";
 import { join as join42 } from "path";
 var RUNWORK_SESSIONS_DIR = join42(homedir23(), ".runwork", "sessions");
@@ -19468,7 +20331,7 @@ function readHookSessionInfo(sessionId) {
   if (!existsSync46(path2))
     return null;
   try {
-    const raw = readFileSync38(path2, "utf8");
+    const raw = readFileSync39(path2, "utf8");
     const parsed = JSON.parse(raw);
     return parsed;
   } catch {
@@ -19688,7 +20551,9 @@ var CHECK_LABELS = {
   "app-exists": "App exists",
   "git-remote": "Git remote",
   "deploy-freshness": "Deploy freshness",
-  "agent-setup": "Agent setup"
+  "agent-setup": "Agent setup",
+  "codex-network": "Codex network",
+  "codex-desktop-project": "Codex project"
 };
 function printHumanReport(report) {
   console.log("");
@@ -19753,7 +20618,7 @@ function parseCheckNames(raw) {
   const unknown = requested.filter((n) => !known.has(n));
   return { only, unknown };
 }
-var doctorCommand = new Command29("doctor").description("Check system health: auth, network, project config, agent setup").option("-v, --verbose", "Include host-agent detection results, runtime info, and allowlisted env vars (useful for AI agents debugging their own environment)").option("--check <names>", `Run only the named checks (comma-separated). Available: ${ALL_CHECK_NAMES.join(", ")}`).option("--fix", "Auto-remediate fixable failures (git credential helper, runwork remote), then re-check").action(async (opts, command) => {
+var doctorCommand = new Command31("doctor").description("Check system health: auth, network, project config, agent setup").option("-v, --verbose", "Include host-agent detection results, runtime info, and allowlisted env vars (useful for AI agents debugging their own environment)").option("--check <names>", `Run only the named checks (comma-separated). Available: ${ALL_CHECK_NAMES.join(", ")}`).option("--fix", "Auto-remediate fixable failures (git credential helper, runwork remote), then re-check").action(async (opts, command) => {
   const asJson = shouldOutputJson(command.optsWithGlobals().json);
   let only;
   if (opts.check) {
@@ -19804,8 +20669,8 @@ var doctorCommand = new Command29("doctor").description("Check system health: au
 // src/commands/share-convo.ts
 init_store();
 init_client();
-import { Command as Command30 } from "commander";
-import { readFileSync as readFileSync39, existsSync as existsSync47 } from "fs";
+import { Command as Command32 } from "commander";
+import { readFileSync as readFileSync40, existsSync as existsSync47 } from "fs";
 import { createHash as createHash4 } from "crypto";
 function nativeBundleFormatForAgent(slug) {
   if (slug === "claude-code" || slug === "claude-desktop")
@@ -19847,7 +20712,7 @@ async function runShareConvo(opts, command, isPersonalAlias = false) {
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
   const { workspaceId } = await resolveWorkspace2(client, { workspace: opts.workspace });
-  const transcriptContent = readFileSync39(opts.transcriptFile, "utf8");
+  const transcriptContent = readFileSync40(opts.transcriptFile, "utf8");
   const bundles = [
     {
       format: "transcript",
@@ -19872,7 +20737,7 @@ async function runShareConvo(opts, command, isPersonalAlias = false) {
     const nativeFormat = nativeBundleFormatForAgent(sourceAgent);
     if (nativeFormat) {
       try {
-        const content = readFileSync39(nativeFilePath, "utf8");
+        const content = readFileSync40(nativeFilePath, "utf8");
         bundles.push({
           format: nativeFormat,
           content,
@@ -19888,7 +20753,7 @@ async function runShareConvo(opts, command, isPersonalAlias = false) {
   let metadata = {};
   if (opts.metadataFile) {
     try {
-      metadata = JSON.parse(readFileSync39(opts.metadataFile, "utf8"));
+      metadata = JSON.parse(readFileSync40(opts.metadataFile, "utf8"));
     } catch (err) {
       console.error(`Error: --metadata-file is not valid JSON: ${err instanceof Error ? err.message : err}`);
       process.exit(1);
@@ -19943,17 +20808,17 @@ Skipped: ${result.skipped.map((s) => `${s.identifier} (${s.reason})`).join(", ")
     process.exit(1);
   }
 }
-var shareConvoCommand = new Command30("share-convo").description("Share the current AI conversation with a teammate").option("--to <email>", "Recipient email (repeatable)", (value, prev = []) => [...prev, value], []).option("--transcript-file <path>", "Path to the LLM-emitted markdown transcript (required)").option("--native-file <path>", "Path to the native session file (optional; auto-detected from env vars otherwise)").option("--source-agent <slug>", "Override host-agent detection (e.g. claude-code, codex, claude-desktop)").option("--title <string>", "Short title for the conversation (required)").option("--note <string>", "Optional personal note to recipients").option("--ttl-days <n>", "Days until expiration (1-30, default 7)").option("--metadata-json <json>", "Inline JSON object with workMode, openQuestions, suggestedNextStep, etc.").option("--metadata-file <path>", "Path to a JSON file with the same metadata fields").option("--workspace <id>", "Workspace ID").action((opts, command) => runShareConvo(opts, command, false));
+var shareConvoCommand = new Command32("share-convo").description("Share the current AI conversation with a teammate").option("--to <email>", "Recipient email (repeatable)", (value, prev = []) => [...prev, value], []).option("--transcript-file <path>", "Path to the LLM-emitted markdown transcript (required)").option("--native-file <path>", "Path to the native session file (optional; auto-detected from env vars otherwise)").option("--source-agent <slug>", "Override host-agent detection (e.g. claude-code, codex, claude-desktop)").option("--title <string>", "Short title for the conversation (required)").option("--note <string>", "Optional personal note to recipients").option("--ttl-days <n>", "Days until expiration (1-30, default 7)").option("--metadata-json <json>", "Inline JSON object with workMode, openQuestions, suggestedNextStep, etc.").option("--metadata-file <path>", "Path to a JSON file with the same metadata fields").option("--workspace <name-or-id>", "Workspace name or ID").action((opts, command) => runShareConvo(opts, command, false));
 
 // src/commands/save-convo.ts
-import { Command as Command31 } from "commander";
-var saveConvoCommand = new Command31("save-convo").description("Save the current AI conversation as a personal checkpoint").option("--transcript-file <path>", "Path to the LLM-emitted markdown transcript (required)").option("--native-file <path>", "Path to the native session file (optional; auto-detected from env vars)").option("--source-agent <slug>", "Override host-agent detection").option("--title <string>", "Short title for the conversation (required)").option("--note <string>", "Optional note to your future self").option("--ttl-days <n>", "Days until expiration (1-30, default 7)").option("--metadata-json <json>", "Inline JSON object with workMode, openQuestions, etc.").option("--metadata-file <path>", "Path to a JSON file with metadata fields").option("--workspace <id>", "Workspace ID").action((opts, command) => runShareConvo({ ...opts, personal: true }, command, true));
+import { Command as Command33 } from "commander";
+var saveConvoCommand = new Command33("save-convo").description("Save the current AI conversation as a personal checkpoint").option("--transcript-file <path>", "Path to the LLM-emitted markdown transcript (required)").option("--native-file <path>", "Path to the native session file (optional; auto-detected from env vars)").option("--source-agent <slug>", "Override host-agent detection").option("--title <string>", "Short title for the conversation (required)").option("--note <string>", "Optional note to your future self").option("--ttl-days <n>", "Days until expiration (1-30, default 7)").option("--metadata-json <json>", "Inline JSON object with workMode, openQuestions, etc.").option("--metadata-file <path>", "Path to a JSON file with metadata fields").option("--workspace <name-or-id>", "Workspace name or ID").action((opts, command) => runShareConvo({ ...opts, personal: true }, command, true));
 
 // src/commands/inbox.ts
 init_store();
 init_client();
-import { Command as Command32 } from "commander";
-var inboxCommand = new Command32("inbox").description("List shared conversations visible to you").option("--filter <scope>", "Filter: all | received | sent | saved", "all").option("--limit <n>", "Max rows to return", "50").option("--workspace <id>", "Workspace ID").action(async (opts, command) => {
+import { Command as Command34 } from "commander";
+var inboxCommand = new Command34("inbox").description("List shared conversations visible to you").option("--filter <scope>", "Filter: all | received | sent | saved", "all").option("--limit <n>", "Max rows to return", "50").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const scope = opts.filter === "received" || opts.filter === "sent" || opts.filter === "saved" ? opts.filter : "all";
   const limit = opts.limit ? parseInt(opts.limit, 10) : 50;
@@ -19993,7 +20858,7 @@ Shared conversations (${scope}, ${total}):
 // src/commands/resume.ts
 init_store();
 init_client();
-import { Command as Command33 } from "commander";
+import { Command as Command35 } from "commander";
 import { writeFileSync as writeFileSync31, mkdirSync as mkdirSync28, realpathSync } from "fs";
 import { homedir as homedir24 } from "os";
 import { join as join43 } from "path";
@@ -20067,7 +20932,7 @@ function isAgentInstalled(agent) {
   }
   return false;
 }
-var resumeCommand2 = new Command33("resume").description("Resume a shared conversation locally in your agent of choice").argument("<share-id>", "The share ID (sc_*) returned by share-convo or save-convo").option("--agent <slug>", "Override target agent (e.g. claude-code, codex)").option("--into <path>", "Override target cwd (defaults to current $PWD)").option("--dry-run", "Print the resume command instead of executing it").option("--pick", "Show interactive picker (requires TTY) - not yet implemented").option("--workspace <id>", "Workspace ID").action(async (shareId, opts, command) => {
+var resumeCommand2 = new Command35("resume").description("Resume a shared conversation locally in your agent of choice").argument("<share-id>", "The share ID (sc_*) returned by share-convo or save-convo").option("--agent <slug>", "Override target agent (e.g. claude-code, codex)").option("--into <path>", "Override target cwd (defaults to current $PWD)").option("--dry-run", "Print the resume command instead of executing it").option("--pick", "Show interactive picker (requires TTY) - not yet implemented").option("--workspace <name-or-id>", "Workspace name or ID").action(async (shareId, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -20292,7 +21157,7 @@ process.on("uncaughtException", (err) => {
   console.error(`Uncaught exception: ${formatError(err)}`);
   process.exit(1);
 });
-var program = new Command34;
+var program = new Command36;
 program.name("runwork").description("Runwork CLI - local development for Runwork apps").version(VERSION).option("--json", "Output as JSON (auto-enabled when stdout is not a TTY)");
 program.addCommand(infoCommand);
 program.addCommand(loginCommand);
@@ -20321,6 +21186,8 @@ program.addCommand(syncCommand);
 program.addCommand(buildPluginCommand);
 program.addCommand(uninstallCommand);
 program.addCommand(appsCommand);
+program.addCommand(membersCommand);
+program.addCommand(apiCommand);
 program.addCommand(doctorCommand);
 program.addCommand(shareConvoCommand);
 program.addCommand(saveConvoCommand);