runwork 0.17.0 → 0.17.1

package/dist/index.js

@@ -411,6 +411,29 @@ class ApiClient {
     const res = await this.request("/api/dev/workspaces");
     return res.data;
   }
+  async listWorkspaceMembers(workspaceId) {
+    const res = await this.request(`/api/workspaces/${workspaceId}/members`);
+    return res.data.members;
+  }
+  async rawApiCall(method, path, opts) {
+    const targetPath = opts?.query ? `${path}${path.includes("?") ? "&" : "?"}${opts.query}` : path;
+    const url = `${this.baseUrl}${targetPath}`;
+    const headers = { ...opts?.headers || {} };
+    if (this.apiKey) {
+      headers["Authorization"] = `Bearer ${this.apiKey}`;
+    }
+    let body;
+    if (opts?.body !== undefined) {
+      body = typeof opts.body === "string" ? opts.body : JSON.stringify(opts.body);
+      if (!Object.keys(headers).some((h) => h.toLowerCase() === "content-type")) {
+        headers["Content-Type"] = "application/json";
+      }
+    }
+    const response = await httpFetch(url, { method: method.toUpperCase(), headers, body });
+    const contentType = response.headers.get("content-type") || "";
+    const responseBody = contentType.includes("application/json") ? await response.json() : await response.text();
+    return { status: response.status, ok: response.ok, contentType, body: responseBody };
+  }
   async listApps(workspaceId) {
     const query = workspaceId ? `?workspaceId=${workspaceId}` : "";
     const res = await this.request(`/api/dev/apps${query}`);
@@ -883,20 +906,28 @@ var init_subprocess = () => {};
 
 // src/git/credentials.ts
 import { existsSync as existsSync2 } from "fs";
-function buildHelperValue(execPath) {
+function buildHelperValue(execPath, scriptPath) {
   const normalised = execPath.replace(/\\/g, "/");
+  const runtimeName = normalised.split("/").pop()?.toLowerCase() ?? "";
+  if (SCRIPT_RUNTIMES.has(runtimeName) && scriptPath) {
+    const script = scriptPath.replace(/\\/g, "/");
+    return `!"${normalised}" "${script}" git-credential-helper`;
+  }
   return `!"${normalised}" git-credential-helper`;
 }
 async function configureGitCredentials(remoteUrl) {
   const origin = new URL(remoteUrl).origin;
-  const helperValue = buildHelperValue(process.execPath);
+  const key = `credential.${origin}.helper`;
+  const helperValue = buildHelperValue(process.execPath, process.argv[1]);
   try {
-    execFileSync("git", [
-      "config",
-      "--global",
-      `credential.${origin}.helper`,
-      helperValue
-    ], { stdio: "pipe" });
+    try {
+      execFileSync("git", ["config", "--global", "--unset-all", key], { stdio: "pipe" });
+    } catch (unsetErr) {
+      if (unsetErr?.code === "ENOENT")
+        throw unsetErr;
+    }
+    execFileSync("git", ["config", "--global", "--add", key, ""], { stdio: "pipe" });
+    execFileSync("git", ["config", "--global", "--add", key, helperValue], { stdio: "pipe" });
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT") {
@@ -915,14 +946,37 @@ function lookupCredentialHelper(origin) {
   } catch {
     return { status: "none" };
   }
-  const lines = helperConfig.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
-  const escapedOrigin = origin.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const scopedRegex = new RegExp(`^credential\\.${escapedOrigin}\\.helper\\s+(.+)$`);
-  const matchedLine = lines.find((line) => scopedRegex.test(line));
-  if (!matchedLine) {
-    return { status: "unscoped", otherCount: lines.length };
+  const keyName = `credential.${origin}.helper`;
+  let value = "";
+  let registered = false;
+  let hasReset = false;
+  let otherCount = 0;
+  for (const raw of helperConfig.split(/\r?\n/)) {
+    if (!raw.trim())
+      continue;
+    const m = raw.match(/^(\S+)(?:\s+(.*))?$/);
+    if (!m)
+      continue;
+    const key = m[1];
+    const val = (m[2] ?? "").trim();
+    if (key === keyName) {
+      if (val === "")
+        hasReset = true;
+      else if (!registered) {
+        registered = true;
+        value = val;
+      }
+    } else {
+      otherCount++;
+    }
+  }
+  if (registered) {
+    return { status: "registered", value, hasReset };
+  }
+  if (otherCount === 0 && !hasReset) {
+    return { status: "none" };
   }
-  return { status: "registered", value: scopedRegex.exec(matchedLine)?.[1] ?? "" };
+  return { status: "unscoped", otherCount };
 }
 function helperBinaryStatus(value) {
   const absoluteHelperRegex = /^!"?(\/|[A-Za-z]:[\\/])/;
@@ -942,7 +996,7 @@ async function ensureGitCredentialHelper(baseUrl) {
     return;
   }
   const lookup = lookupCredentialHelper(origin);
-  if (lookup.status === "registered" && helperBinaryStatus(lookup.value).ok) {
+  if (lookup.status === "registered" && helperBinaryStatus(lookup.value).ok && lookup.hasReset) {
     return;
   }
   await configureGitCredentials(baseUrl);
@@ -953,7 +1007,7 @@ async function removeGitCredentials(baseUrl) {
     execFileSync("git", [
       "config",
       "--global",
-      "--unset",
+      "--unset-all",
       `credential.${origin}.helper`
     ], { stdio: "pipe" });
   } catch {}
@@ -996,9 +1050,11 @@ function readStdin() {
       resolve(data);
   });
 }
+var SCRIPT_RUNTIMES;
 var init_credentials = __esm(() => {
   init_subprocess();
   init_store();
+  SCRIPT_RUNTIMES = new Set(["node", "node.exe", "bun", "bun.exe"]);
 });
 
 // src/auth/login-flow.ts
@@ -1429,8 +1485,8 @@ async function resolveWorkspace(client, nameOrId) {
   console.error(`Workspace "${nameOrId}" not found. Available: ${workspaces.map((w) => w.name).join(", ")}`);
   process.exit(1);
 }
-async function resolveApp(client, nameOrId) {
-  const apps = await client.listApps();
+async function resolveApp(client, nameOrId, workspaceId) {
+  const apps = await client.listApps(workspaceId);
   if (apps.length === 0) {
     console.error("No apps found.");
     process.exit(1);
@@ -2422,7 +2478,7 @@ var init_clone = __esm(() => {
   init_remote();
   init_repo_config();
   init_preflight();
-  cloneCommand = new Command3("clone").description("Clone a Runwork app to local development").argument("[appId]", "App ID to clone (interactive if omitted)").argument("[directory]", "Target directory").option("--app <name-or-id>", "App name or ID (skips interactive selection)").addHelpText("after", RESTRICTED_FS_HELP).action(async (rawAppId, rawDirectory, options) => {
+  cloneCommand = new Command3("clone").description("Clone a Runwork app to local development").argument("[appId]", "App ID to clone (interactive if omitted)").argument("[directory]", "Target directory").option("--app <name-or-id>", "App name or ID (skips interactive selection)").option("--workspace <name-or-id>", "Workspace to look up the app in (name or ID)").addHelpText("after", RESTRICTED_FS_HELP).action(async (rawAppId, rawDirectory, options) => {
     requireGit("clone");
     const { appId, directory } = normalizeCloneArgs(rawAppId, rawDirectory, options);
     const creds = requireAuth();
@@ -2430,10 +2486,15 @@ var init_clone = __esm(() => {
     const useJson = shouldOutputJson(undefined);
     let app;
     const appRef = options?.app || appId;
+    let workspaceId;
+    if (options?.workspace) {
+      const ws = await resolveWorkspace(client, options.workspace);
+      workspaceId = ws.id;
+    }
     if (appRef) {
-      app = await resolveApp(client, appRef);
+      app = await resolveApp(client, appRef, workspaceId);
     } else {
-      const apps = await client.listApps();
+      const apps = await client.listApps(workspaceId);
       if (apps.length === 0) {
         if (useJson) {
           jsonOut(buildErrorResponse("clone", "No apps found", "No apps are available to clone.", ["Create an app first with: runwork init my-app"]));
@@ -3307,13 +3368,20 @@ function resolvePollDeps(deps) {
 }
 async function pollForSession(appDir, expectedPid, expectedAppId, opts = {}) {
   const intervalMs = opts.intervalMs ?? 250;
-  const timeoutMs = opts.timeoutMs ?? 90000;
+  const timeoutMs = opts.timeoutMs ?? DETACH_READY_TIMEOUT_MS;
+  const heartbeatMs = opts.heartbeatMs ?? DETACH_WAITING_HEARTBEAT_MS;
   const d = resolvePollDeps(opts.deps);
-  const deadline = d.now() + timeoutMs;
+  const startedAt = d.now();
+  const deadline = startedAt + timeoutMs;
+  let lastHeartbeatAt = startedAt;
   while (d.now() < deadline) {
     if (opts.isChildAlive && !opts.isChildAlive()) {
       return { result: "child-exited" };
     }
+    if (opts.onWaiting && d.now() - lastHeartbeatAt >= heartbeatMs) {
+      lastHeartbeatAt = d.now();
+      opts.onWaiting(d.now() - startedAt);
+    }
     const file = readSessionFile(appDir);
     if (file && file.previewUrl && file.appId === expectedAppId) {
       if (file.pid === expectedPid) {
@@ -3349,7 +3417,9 @@ async function runAsDetachedParent(opts) {
     intervalMs: opts.intervalMs,
     timeoutMs: opts.timeoutMs,
     deps: opts.pollDeps,
-    isChildAlive: child.isAlive
+    isChildAlive: child.isAlive,
+    onWaiting: opts.onWaiting,
+    heartbeatMs: opts.heartbeatMs
   });
   if (outcome.result === "ready") {
     return { result: "started", file: outcome.file };
@@ -3366,22 +3436,27 @@ async function runAsDetachedParent(opts) {
   try {
     removeSessionFileIfOwned(opts.appDir, child.pid);
   } catch {}
-  const childLogTail = readChildStderrTail(opts.appDir);
+  const childLogTail = readChildLogTail(opts.appDir);
   if (outcome.result === "child-exited") {
     return { result: "child-exited", ourPid: child.pid, childLogTail };
   }
   return { result: "timeout", ourPid: child.pid, childLogTail };
 }
-function readChildStderrTail(appDir) {
-  try {
-    const paths = getSessionPaths(appDir);
-    if (!fs2.existsSync(paths.stderrLog))
-      return;
-    const raw = fs2.readFileSync(paths.stderrLog, "utf-8");
-    return raw.slice(-2000);
-  } catch {
-    return;
+function readChildLogTail(appDir) {
+  const paths = getSessionPaths(appDir);
+  const sections = [];
+  for (const [label, file] of [["stderr", paths.stderrLog], ["stdout", paths.stdoutLog]]) {
+    try {
+      if (!fs2.existsSync(file))
+        continue;
+      const tail = fs2.readFileSync(file, "utf-8").slice(-2000).trim();
+      if (tail)
+        sections.push(`--- ${label} (tail) ---
+${tail}`);
+    } catch {}
   }
+  return sections.length > 0 ? sections.join(`
+`) : undefined;
 }
 function defaultSpawnDetachedChild(childArgs) {
   const cwd = process.cwd();
@@ -3441,7 +3516,7 @@ function buildChildArgs(parentArgv) {
   }
   return [...stripInternalChildFlag(rest), INTERNAL_DETACHED_CHILD_FLAG];
 }
-var INTERNAL_DETACHED_CHILD_FLAG = "--internal-detached-child", realPollDeps;
+var INTERNAL_DETACHED_CHILD_FLAG = "--internal-detached-child", DETACH_READY_TIMEOUT_MS = 630000, DETACH_WAITING_HEARTBEAT_MS = 15000, realPollDeps;
 var init_detach = __esm(() => {
   init_session();
   realPollDeps = {
@@ -3450,6 +3525,104 @@ var init_detach = __esm(() => {
   };
 });
 
+// src/dev/boot-await.ts
+function isPermanentStartError(err) {
+  if (!(err instanceof Error))
+    return false;
+  const match = err.message.match(/^API error (\d{3})/);
+  if (!match)
+    return false;
+  const status = Number.parseInt(match[1], 10);
+  return status >= 400 && status < 500;
+}
+async function awaitDevSessionReady(opts) {
+  const now = opts.deps?.now ?? (() => Date.now());
+  const sleep = opts.deps?.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const timeoutMs = opts.timeoutMs ?? DEV_BOOT_TIMEOUT_MS;
+  const heartbeatMs = opts.heartbeatMs ?? DEV_BOOT_HEARTBEAT_MS;
+  const statusPollDelayMs = opts.statusPollDelayMs ?? DEV_BOOT_STATUS_POLL_DELAY_MS;
+  const statusPollIntervalMs = opts.statusPollIntervalMs ?? DEV_BOOT_STATUS_POLL_INTERVAL_MS;
+  const startedAt = now();
+  const elapsed = () => now() - startedAt;
+  const st = {
+    startResult: null,
+    startError: undefined,
+    startSettled: false,
+    permanentFailure: null,
+    statusReady: null,
+    statusInFlight: false
+  };
+  opts.start().then((session) => {
+    st.startResult = session;
+    st.startSettled = true;
+  }, (err) => {
+    st.startError = err;
+    st.startSettled = true;
+    if (isPermanentStartError(err)) {
+      st.permanentFailure = err;
+    } else {
+      opts.onStartError?.(err);
+    }
+  });
+  let lastStatusPollAt = -Infinity;
+  let lastHeartbeatAt = startedAt;
+  const readyResult = () => {
+    if (st.startResult && st.startResult.previewUrl) {
+      return { session: st.startResult, source: "start", elapsedMs: elapsed() };
+    }
+    if (st.statusReady) {
+      return { session: st.statusReady, source: "status", elapsedMs: elapsed() };
+    }
+    return null;
+  };
+  while (elapsed() < timeoutMs) {
+    if (st.permanentFailure)
+      throw st.permanentFailure;
+    const ready2 = readyResult();
+    if (ready2)
+      return ready2;
+    const startFailedOrEmpty = st.startSettled && !(st.startResult && st.startResult.previewUrl);
+    const pollingActive = elapsed() >= statusPollDelayMs || startFailedOrEmpty;
+    if (pollingActive && !st.statusInFlight && now() - lastStatusPollAt >= statusPollIntervalMs) {
+      st.statusInFlight = true;
+      lastStatusPollAt = now();
+      opts.pollStatus().then((session) => {
+        st.statusInFlight = false;
+        if (session.previewUrl)
+          st.statusReady = session;
+      }, () => {
+        st.statusInFlight = false;
+      });
+    }
+    if (now() - lastHeartbeatAt >= heartbeatMs) {
+      lastHeartbeatAt = now();
+      opts.onWaiting?.(elapsed());
+    }
+    await sleep(TICK_MS);
+  }
+  if (st.permanentFailure)
+    throw st.permanentFailure;
+  const ready = readyResult();
+  if (ready)
+    return ready;
+  throw new DevBootTimeoutError(elapsed(), st.startError);
+}
+var DEV_BOOT_TIMEOUT_MS = 600000, DEV_BOOT_HEARTBEAT_MS = 15000, DEV_BOOT_STATUS_POLL_DELAY_MS = 45000, DEV_BOOT_STATUS_POLL_INTERVAL_MS = 1e4, DevBootTimeoutError, TICK_MS = 250;
+var init_boot_await = __esm(() => {
+  DevBootTimeoutError = class DevBootTimeoutError extends Error {
+    elapsedMs;
+    startError;
+    constructor(elapsedMs, startError) {
+      const base = `Dev session did not become ready within ${Math.round(elapsedMs / 1000)}s`;
+      const cause = startError instanceof Error ? ` (boot call failed: ${startError.message})` : "";
+      super(`${base}${cause}`);
+      this.name = "DevBootTimeoutError";
+      this.elapsedMs = elapsedMs;
+      this.startError = startError;
+    }
+  };
+});
+
 // src/dev/stop.ts
 import * as fs3 from "fs";
 async function stopSession(appDir, expectedAppId, deps = {}) {
@@ -5652,6 +5825,13 @@ export interface JobRunRecord {
     completedAt?: number;
     result?: JobResult;
     error?: string;
+    /**
+     * Stack trace of the failure. Stored because the error MESSAGE alone made
+     * the 2026-07 "Could not serialize object of type ..." production failures
+     * undiagnosable: the message names the workerd serializer, not the framework
+     * call site that hit it (AGENTCLI-6).
+     */
+    errorStack?: string;
 }
 export interface ScheduleState {
     name: string;
@@ -7381,7 +7561,7 @@ function createKeyboardListener() {
 }
 
 // src/generated/version.ts
-var VERSION = "0.17.0";
+var VERSION = "0.17.1";
 
 // src/commands/dev.ts
 var exports_dev = {};
@@ -7515,7 +7695,64 @@ async function execDev(options) {
   } else {
     console.log(dim("Starting dev session..."));
   }
-  const session = await client.startDevSession(config.appId);
+  let session;
+  try {
+    const boot = await awaitDevSessionReady({
+      start: () => client.startDevSession(config.appId),
+      pollStatus: () => client.getDevStatus(config.appId),
+      onWaiting: (elapsedMs) => {
+        const seconds = Math.round(elapsedMs / 1000);
+        if (useJson) {
+          jsonLine({
+            event: "startup",
+            phase: "dev_session_waiting",
+            elapsedSeconds: seconds,
+            timestamp: ts(),
+            note: "Sandbox is booting. Cold boots can take a few minutes; keep waiting."
+          });
+        } else {
+          console.log(dim(`  Still starting the sandbox... (${seconds}s elapsed; cold boots can take a few minutes)`));
+        }
+      },
+      onStartError: (err) => {
+        const message = err instanceof Error ? err.message : String(err);
+        if (useJson) {
+          jsonLine({
+            event: "startup",
+            phase: "dev_session_retrying",
+            timestamp: ts(),
+            warning: `Boot call failed (${message}). The sandbox may still be booting server-side; watching status until it becomes ready.`
+          });
+        } else {
+          console.warn(yellow(`  Boot call failed (${message}); watching sandbox status in case the boot completes server-side...`));
+        }
+      }
+    });
+    session = boot.session;
+  } catch (error) {
+    const isTimeout = error instanceof DevBootTimeoutError;
+    const message = error instanceof Error ? error.message : String(error);
+    if (useJson) {
+      jsonLine({
+        event: "error",
+        phase: "dev_session",
+        timestamp: ts(),
+        error: {
+          message,
+          diagnosis: isTimeout ? "The preview sandbox did not become ready within the boot deadline. The sandbox provider may be degraded, or the app failed to boot server-side." : "The dev session boot call failed.",
+          suggestions: [
+            "Re-run `runwork dev --detach --json` in about a minute; if the sandbox finished booting server-side it will be picked up quickly",
+            "Run `runwork logs` to inspect sandbox logs for boot errors",
+            "Run `runwork doctor` to verify auth and connectivity"
+          ]
+        }
+      });
+    } else {
+      console.error(red(`Failed to start dev session: ${message}`));
+      console.error(dim("  Re-run `runwork dev` in about a minute; if the sandbox finished booting server-side it will be picked up quickly."));
+    }
+    process.exit(1);
+  }
   await populateSkill(cwd, client, config.appId);
   if (useJson)
     jsonLine({ event: "startup", phase: "skill_fetched", timestamp: ts() });
@@ -7804,7 +8041,21 @@ async function runDevDetachParent(opts) {
   const outcome = await runAsDetachedParent({
     appDir: cwd,
     expectedAppId: config.appId,
-    childArgs
+    childArgs,
+    onWaiting: (elapsedMs) => {
+      const seconds = Math.round(elapsedMs / 1000);
+      if (opts.json) {
+        jsonLine({
+          event: "waiting",
+          phase: "sandbox_boot",
+          elapsedSeconds: seconds,
+          timestamp: ts(),
+          note: "Sandbox is booting. Cold boots can take a few minutes; keep waiting for session_started."
+        });
+      } else {
+        console.log(dim(`  Still starting... (${seconds}s elapsed; cold boots can take a few minutes)`));
+      }
+    }
   });
   switch (outcome.result) {
     case "started": {
@@ -7862,9 +8113,10 @@ async function runDevDetachParent(opts) {
           timestamp: ts(),
           error: {
             message,
-            diagnosis: "The detached child process exited (typically due to missing auth, missing git, network failure, or a sync conflict) before it could publish a preview URL.",
+            diagnosis: "The detached child process exited (typically due to missing auth, missing git, network failure, a sync conflict, or a sandbox boot timeout) before it could publish a preview URL.",
             suggestions: [
-              "Inspect the child stderr at .runwork/dev-stderr.log",
+              "Check childLogTail below; the child logs structured errors to .runwork/dev-stdout.log (stderr carries crash traces)",
+              "If the child hit a sandbox boot timeout, re-run `runwork dev --detach --json` in about a minute; a boot that completed server-side is picked up quickly",
               "Run `runwork doctor` to verify auth and connectivity",
               "Try `runwork dev` (foreground) to see the failure inline"
             ],
@@ -7873,7 +8125,7 @@ async function runDevDetachParent(opts) {
         });
       } else {
         console.error(yellow(message));
-        console.error(dim("  Inspect .runwork/dev-stderr.log or run `runwork dev` to see what failed."));
+        console.error(dim("  Inspect .runwork/dev-stdout.log and dev-stderr.log, or run `runwork dev` to see what failed."));
         if (outcome.childLogTail) {
           console.error(dim("  Tail of child stderr:"));
           for (const line of outcome.childLogTail.split(`
@@ -7887,7 +8139,8 @@ async function runDevDetachParent(opts) {
       return;
     }
     case "timeout": {
-      const message = `Detached dev session did not become ready within 90s.`;
+      const timeoutSeconds = Math.round(DETACH_READY_TIMEOUT_MS / 1000);
+      const message = `Detached dev session did not become ready within ${timeoutSeconds}s.`;
       if (opts.json) {
         jsonLine({
           event: "error",
@@ -7895,9 +8148,10 @@ async function runDevDetachParent(opts) {
           timestamp: ts(),
           error: {
             message,
-            diagnosis: "The detached child process was spawned but never wrote a session file with a preview URL. The sandbox boot may have failed.",
+            diagnosis: "The detached child process was spawned but never wrote a session file with a preview URL. The sandbox boot may have failed or the sandbox provider may be degraded.",
             suggestions: [
-              "Inspect the child stderr at .runwork/dev-stderr.log",
+              "The sandbox may still finish booting server-side: re-run `runwork dev --detach --json` in about a minute; a completed boot is picked up quickly",
+              "Inspect the child logs at .runwork/dev-stdout.log and .runwork/dev-stderr.log",
               "Run `runwork doctor` to verify auth and connectivity",
               "Try `runwork dev` (foreground) to see the failure inline"
             ],
@@ -7906,7 +8160,7 @@ async function runDevDetachParent(opts) {
         });
       } else {
         console.error(yellow(message));
-        console.error(dim("  Inspect .runwork/dev-stderr.log or run `runwork dev` to see what failed."));
+        console.error(dim("  Inspect .runwork/dev-stdout.log and dev-stderr.log, or run `runwork dev` to see what failed."));
         if (outcome.childLogTail) {
           console.error(dim("  Tail of child stderr:"));
           for (const line of outcome.childLogTail.split(`
@@ -7956,6 +8210,7 @@ var init_dev = __esm(() => {
   init_tailer();
   init_session();
   init_detach();
+  init_boot_await();
   init_stop();
   init_attach();
   init_types_manager();
@@ -8291,7 +8546,7 @@ var init_welcome = __esm(() => {
 });
 
 // src/index.ts
-import { Command as Command34 } from "commander";
+import { Command as Command36 } from "commander";
 
 // src/commands/login.ts
 init_login_flow();
@@ -8394,8 +8649,23 @@ function getDeploySummary(cwd) {
 }
 
 // src/deploy/deploy-status.ts
+init_session();
 import { existsSync as existsSync16, mkdirSync as mkdirSync11, readFileSync as readFileSync13, writeFileSync as writeFileSync12 } from "fs";
 import { dirname as dirname4, join as join17 } from "path";
+function evaluateDeployStatus(status, deps = {}) {
+  if (status.state !== "in-progress") {
+    return { status, effectiveState: status.state };
+  }
+  const bootTime = deps.bootTime ?? currentBootTime;
+  const pidAlive = deps.pidAlive ?? isPidAlive;
+  if (typeof status.bootTime === "number" && Math.abs(bootTime() - status.bootTime) > BOOT_TIME_TOLERANCE_MS) {
+    return { status, effectiveState: "stale", staleReason: "boot-time-mismatch" };
+  }
+  if (typeof status.pid === "number" && !pidAlive(status.pid)) {
+    return { status, effectiveState: "stale", staleReason: "process-gone" };
+  }
+  return { status, effectiveState: "in-progress" };
+}
 function statusPath(cwd) {
   return join17(cwd, ".runwork", "deploy-status.json");
 }
@@ -8425,6 +8695,9 @@ function readDeployStatus(cwd) {
   }
 }
 
+// src/commands/deploy.ts
+init_session();
+
 // src/deploy/detach.ts
 init_detach();
 import * as fs5 from "fs";
@@ -8536,7 +8809,7 @@ var deployCommand = new Command5("deploy").description("Deploy the current app t
   if (opts.detach && !isChild) {
     const startedAt = new Date().toISOString();
     const handle = spawnDetachedDeploy(buildDeployChildArgs(process.argv), cwd);
-    writeDeployStatus(cwd, { state: "in-progress", startedAt, pid: handle.pid });
+    writeDeployStatus(cwd, { state: "in-progress", startedAt, pid: handle.pid, bootTime: currentBootTime() });
     if (useJson) {
       jsonLine({ event: "deploy_started", detached: true, pid: handle.pid, logPath: deployLogPath(cwd), startedAt, hint: "Poll `runwork deploy --status` for completion." });
     } else {
@@ -8639,7 +8912,7 @@ var deployCommand = new Command5("deploy").description("Deploy the current app t
   const deployed = deploymentUrl.length > 0;
   if (!deployed) {
     if (useJson) {
-      jsonOut(buildErrorResponse("deploy", "Deployment did not produce a URL", "The deploy API returned no deployment URL. The deploy may have been a no-op (no changes) or failed server-side.", ["Confirm your changes were committed and pushed (the sync step above succeeded)", "Run runwork info to check the deployed state", "Run runwork logs --production to inspect server-side errors", "Retry runwork deploy"]));
+      jsonOut(buildErrorResponse("deploy", "Deployment did not produce a URL", "The deploy API returned no deployment URL. The deploy may have been a no-op (no changes) or failed server-side (e.g. a build error).", ['Run `runwork logs --events --once` and look for a "Build failed" error in recent deployment events', "If a build failed on stale sandbox files, run `runwork dev --restart --detach` to resync, then retry the deploy", "Confirm your changes were committed and pushed (the sync step above succeeded)", "Run runwork info to check the deployed state", "Retry runwork deploy"]));
       process.exit(1);
     }
     console.error("Deploy did not return a URL. The deploy may have been a no-op or failed server-side.");
@@ -8679,14 +8952,24 @@ var deployCommand = new Command5("deploy").description("Deploy the current app t
 function printDeployStatus(cwd, useJson) {
   const status = readDeployStatus(cwd);
   const summary = getDeploySummary(cwd);
+  const evaluated = status ? evaluateDeployStatus(status) : null;
+  const staleHint = "The deploy process died before recording an outcome. The deploy may still have completed server-side (the push precedes the deploy call). Verify with `runwork logs --production --once` or `runwork apps info`, then re-run `runwork deploy` if needed.";
   if (useJson) {
-    jsonOut({ success: true, command: "deploy", result: { status, deploy: summary } });
+    jsonOut({
+      success: true,
+      command: "deploy",
+      result: {
+        status: evaluated ? { ...evaluated.status, state: evaluated.effectiveState, staleReason: evaluated.staleReason } : null,
+        deploy: summary,
+        hint: evaluated?.effectiveState === "stale" ? staleHint : undefined
+      }
+    });
     return;
   }
-  if (!status) {
+  if (!status || !evaluated) {
     console.log("No deploy has been started from this machine yet.");
   } else {
-    const label = status.state === "succeeded" ? green("succeeded") : status.state === "failed" ? yellow("failed") : "in-progress";
+    const label = evaluated.effectiveState === "succeeded" ? green("succeeded") : evaluated.effectiveState === "failed" ? yellow("failed") : evaluated.effectiveState === "stale" ? yellow(`stale (${evaluated.staleReason})`) : "in-progress";
     console.log(`Last deploy: ${label}`);
     console.log(dim(`  started:  ${status.startedAt}`));
     if (status.finishedAt)
@@ -8695,8 +8978,10 @@ function printDeployStatus(cwd, useJson) {
       console.log(dim(`  url:      ${status.url}`));
     if (status.error)
       console.log(yellow(`  error:    ${status.error}`));
-    if (status.state === "in-progress")
+    if (evaluated.effectiveState === "in-progress")
       console.log(dim(`  logs:     ${deployLogPath(cwd)}`));
+    if (evaluated.effectiveState === "stale")
+      console.log(yellow(`  ${staleHint}`));
   }
   if (summary.deployedShortSha) {
     const sync = summary.inSync === true ? green("in sync") : summary.inSync === false ? yellow("local has undeployed commits") : dim("unknown");
@@ -9280,9 +9565,14 @@ import { readFileSync as readFileSync18, existsSync as existsSync21 } from "fs";
 init_store();
 init_prompt();
 import { existsSync as existsSync20, readFileSync as readFileSync17 } from "fs";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function resolveWorkspace2(client, options = {}) {
   if (options.workspace) {
-    return { workspaceId: options.workspace, workspaceName: "", source: "flag" };
+    if (UUID_RE.test(options.workspace)) {
+      return { workspaceId: options.workspace, workspaceName: "", source: "flag" };
+    }
+    const ws2 = await resolveWorkspace(client, options.workspace);
+    return { workspaceId: ws2.id, workspaceName: ws2.name, source: "flag" };
   }
   if (process.env.WORKSPACE_ID) {
     return { workspaceId: process.env.WORKSPACE_ID, workspaceName: "", source: "flag" };
@@ -9317,6 +9607,10 @@ async function resolveWorkspace2(client, options = {}) {
     saveDefaultWorkspace(ws2.id, ws2.name);
     return { workspaceId: ws2.id, workspaceName: ws2.name, source: "prompt" };
   }
+  if (!process.stdout.isTTY) {
+    console.error(`Workspace required. Pass --workspace <name-or-id>. Available: ${workspaces.map((w) => w.name).join(", ")}`);
+    process.exit(1);
+  }
   const choices = workspaces.map((ws2) => ({ label: ws2.name, value: ws2.id }));
   const chosen = await promptSelect("Select a workspace:", choices);
   const ws = workspaces.find((w) => w.id === chosen.value);
@@ -9545,7 +9839,13 @@ async function parseCurlToRequest(curlStr) {
 }
 
 // src/commands/integrations.ts
-var searchCommand = new Command10("search").description("Search available integrations from the platform catalog").argument("<query>", 'Search query (e.g., "google drive", "hubspot", "slack")').option("--limit <n>", "Maximum results to show", "20").option("--workspace <id>", "Workspace ID (enables team usage info)").action(async (query, opts, command) => {
+function resolveIntegrationConnection(integrations, integration) {
+  const match = integrations.find((i) => (i.canonicalId || i.integrationId) === integration || i.provider === integration);
+  if (!match)
+    return null;
+  return { connectionId: match.id || match.integrationId, match };
+}
+var searchCommand = new Command10("search").description("Search available integrations from the platform catalog").argument("<query>", 'Search query (e.g., "google drive", "hubspot", "slack")').option("--limit <n>", "Maximum results to show", "20").option("--workspace <name-or-id>", "Workspace name or ID (enables team usage info)").action(async (query, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -9604,7 +9904,7 @@ Usage: Add the integration ID to APP_INTEGRATION_REQUIREMENTS in worker/integrat
     process.exit(1);
   }
 });
-var listCommand = new Command10("list").description("List connected workspace integrations").option("--workspace <id>", "Workspace ID").action(async (opts, command) => {
+var listCommand = new Command10("list").description("List connected workspace integrations").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -9657,7 +9957,7 @@ Used by your team (${teamOnly.length} more):
     process.exit(1);
   }
 });
-var callCommand = new Command10("call").description("Make a proxy call to a connected integration").argument("<integration>", "Integration name (e.g., hubspot, slack)").argument("[method]", "HTTP method (GET, POST, PUT, DELETE)").argument("[path]", "API path (e.g., /crm/v3/contacts)").option("--workspace <id>", "Workspace ID").option("--body <json>", "Request body JSON").option("--header <header>", "Request header (repeatable)", (val, prev) => [...prev, val], []).option("--query <query>", "Query string (e.g., limit=10&offset=0)").option("--curl <command>", 'Parse a curl command (paste from Chrome DevTools "Copy as cURL")').option("--curl-file <file>", "Read curl command from a file").action(async (integration, method, path2, opts, command) => {
+var callCommand = new Command10("call").description("Make a proxy call to a connected integration").argument("<integration>", "Integration name (e.g., hubspot, slack)").argument("[method]", "HTTP method (GET, POST, PUT, DELETE)").argument("[path]", "API path (e.g., /crm/v3/contacts)").option("--workspace <name-or-id>", "Workspace name or ID").option("--body <json>", "Request body JSON").option("--header <header>", "Request header (repeatable)", (val, prev) => [...prev, val], []).option("--query <query>", "Query string (e.g., limit=10&offset=0)").option("--curl <command>", 'Parse a curl command (paste from Chrome DevTools "Copy as cURL")').option("--curl-file <file>", "Read curl command from a file").action(async (integration, method, path2, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -9711,12 +10011,12 @@ var callCommand = new Command10("call").description("Make a proxy call to a conn
   }
   try {
     const integrations = await client.listConnectedIntegrations(workspaceId);
-    const match = integrations.find((i) => (i.canonicalId || i.integrationId) === integration || i.provider === integration);
-    if (!match) {
+    const resolved = resolveIntegrationConnection(integrations, integration);
+    if (!resolved) {
       console.error(`Integration "${integration}" not found. Run "runwork integrations list" to see connected integrations.`);
       process.exit(1);
     }
-    const result = await client.callIntegrationProxy(match.integrationId, finalMethod, finalPath, { body, headers: Object.keys(headers).length > 0 ? headers : undefined, query });
+    const result = await client.callIntegrationProxy(resolved.connectionId, finalMethod, finalPath, { body, headers: Object.keys(headers).length > 0 ? headers : undefined, query });
     if (useJson) {
       jsonOut(result);
       return;
@@ -10345,7 +10645,7 @@ function truncate(text2, max) {
     return first;
   return first.slice(0, max - 3) + "...";
 }
-var listCommand2 = new Command13("list").description("List workspace skills (app, external, MCP-generated)").option("--workspace <id>", "Workspace ID").action(async (opts, command) => {
+var listCommand2 = new Command13("list").description("List workspace skills (app, external, MCP-generated)").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -10402,7 +10702,7 @@ async function readStdin2() {
   }
   return Buffer.concat(chunks).toString("utf-8");
 }
-var pushCommand = new Command13("push").description("Upload a local skill file to workspace (upsert by name). Accepts piped content via stdin.").argument("[first]", "Skill name (if piping content) or file path (name from frontmatter)").argument("[second]", "File path (when first arg is the skill name)").option("--workspace <id>", "Workspace ID").action(async (first, second, opts, command) => {
+var pushCommand = new Command13("push").description("Upload a local skill file to workspace (upsert by name). Accepts piped content via stdin.").argument("[first]", "Skill name (if piping content) or file path (name from frontmatter)").argument("[second]", "File path (when first arg is the skill name)").option("--workspace <name-or-id>", "Workspace name or ID").action(async (first, second, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -10497,7 +10797,7 @@ var pushCommand = new Command13("push").description("Upload a local skill file t
     process.exit(1);
   }
 });
-var pullCommand = new Command13("pull").alias("download").description("Download a skill from the workspace and print to stdout (or save to file)").argument("<name>", "Skill name or ID").option("--workspace <id>", "Workspace ID").option("-o, --output <file>", "Save to file instead of stdout").action(async (nameOrId, opts, command) => {
+var pullCommand = new Command13("pull").alias("download").description("Download a skill from the workspace and print to stdout (or save to file)").argument("<name>", "Skill name or ID").option("--workspace <name-or-id>", "Workspace name or ID").option("-o, --output <file>", "Save to file instead of stdout").action(async (nameOrId, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -10600,7 +10900,7 @@ var searchCommand2 = new Command13("search").description("Search community skill
     process.exit(1);
   }
 });
-var installCommand = new Command13("install").description("Install a community skill from skills.sh into your workspace").argument("<identifier>", "Skill identifier: source/skill-id (e.g. vercel-labs/skills/find-skills)").option("--workspace <id>", "Workspace ID").action(async (identifier, opts, command) => {
+var installCommand = new Command13("install").description("Install a community skill from skills.sh into your workspace").argument("<identifier>", "Skill identifier: source/skill-id (e.g. vercel-labs/skills/find-skills)").option("--workspace <name-or-id>", "Workspace name or ID").action(async (identifier, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -13517,14 +13817,15 @@ var AGENT_REGISTRY = [
       method: "any",
       target: [
         { method: "path", target: { macos: "/Applications/Codex.app" } },
-        { method: "windows-appx", target: "OpenAI.Codex" }
+        { method: "macos-bundle-id", target: "com.openai.codex" },
+        { method: "windows-appx", target: ["OpenAI.Codex"] }
       ]
     },
-    launch: { app: { macos: "Codex", windows: "Codex" } },
+    launch: { app: { macos: "Codex", windows: "Codex" }, bundleId: { macos: "com.openai.codex" } },
     logo: "codex",
     downloadUrl: "https://openai.com/codex/",
     skillsPaths: { global: ".codex/skills", project: ".agents/skills" },
-    instructionFile: { global: ".codex/instructions.md", project: "AGENTS.md" },
+    instructionFile: { global: ".codex/AGENTS.md", project: "AGENTS.md" },
     firstClass: true,
     resumeCapability: {
       mode: "file-drop-only",
@@ -13549,7 +13850,7 @@ var AGENT_REGISTRY = [
     logo: "codex",
     downloadUrl: "https://github.com/openai/codex",
     skillsPaths: { global: ".codex/skills", project: ".agents/skills" },
-    instructionFile: { global: ".codex/instructions.md", project: "AGENTS.md" },
+    instructionFile: { global: ".codex/AGENTS.md", project: "AGENTS.md" },
     firstClass: true,
     resumeCapability: {
       mode: "cli-resume",
@@ -13643,10 +13944,11 @@ var AGENT_REGISTRY = [
       method: "any",
       target: [
         { method: "path", target: { macos: "/Applications/ChatGPT.app" } },
-        { method: "windows-appx", target: "OpenAI.ChatGPT" }
+        { method: "macos-bundle-id", target: "com.openai.chat" },
+        { method: "windows-appx", target: ["OpenAI.ChatGPT"] }
       ]
     },
-    launch: { app: { macos: "ChatGPT", windows: "ChatGPT" }, url: "https://chatgpt.com/?prompt={prompt}" },
+    launch: { app: { macos: "ChatGPT", windows: "ChatGPT" }, bundleId: { macos: "com.openai.chat" }, url: "https://chatgpt.com/?prompt={prompt}" },
     logo: "openai",
     downloadUrl: "https://chatgpt.com/download",
     firstClass: true,
@@ -13936,14 +14238,28 @@ function resolveToAbsolute(ps, scope) {
   return scope === "global" ? join26(homedir9(), resolved) : join26(process.cwd(), resolved);
 }
 
+// src/agents/detection-probes.ts
+function powershellQuote(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function isValidBundleId(id) {
+  return /^[A-Za-z0-9][A-Za-z0-9.-]*$/.test(id);
+}
+function macosBundleIdProbeScript(id) {
+  return `p=$(mdfind "kMDItemCFBundleIdentifier == '${id}'" 2>/dev/null | head -1); ` + `if [ -n "$p" ]; then exit 0; fi; ` + `for a in /Applications/*.app "$HOME"/Applications/*.app; do ` + `[ -e "$a" ] || continue; ` + `if [ "$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "$a/Contents/Info.plist" 2>/dev/null)" = "${id}" ]; then exit 0; fi; ` + `done; exit 1`;
+}
+function appxPackageProbeScript(pkg) {
+  return `$p = Get-AppxPackage -Name ${powershellQuote(pkg)} -ErrorAction SilentlyContinue; if ($null -ne $p) { exit 0 } exit 1`;
+}
+function startAppProbeScript(pattern) {
+  return `$a = Get-StartApps -Name ${powershellQuote(pattern)} -ErrorAction SilentlyContinue | Select-Object -First 1; if ($null -ne $a) { exit 0 } exit 1`;
+}
+
 // src/agents/detection.ts
 var execFileAsync = promisify(execFile);
 function isWindows() {
   return platform7() === "win32";
 }
-function powershellQuote(value) {
-  return `'${value.replace(/'/g, "''")}'`;
-}
 function toList(value) {
   return Array.isArray(value) ? value : [value];
 }
@@ -13963,23 +14279,30 @@ function checkPath(target) {
     return existsSync32(resolved);
   return existsSync32(join27(homedir10(), resolved));
 }
+async function checkMacosBundleId(target) {
+  if (platform7() !== "darwin")
+    return false;
+  for (const id of toList(target)) {
+    if (!isValidBundleId(id))
+      continue;
+    try {
+      await execFileAsync("sh", ["-c", macosBundleIdProbeScript(id)]);
+      return true;
+    } catch {}
+  }
+  return false;
+}
 async function checkWindowsAppxPackage(target) {
   if (!isWindows())
     return false;
-  const probes = toList(target).map((pkg) => {
-    const script = `$p = Get-AppxPackage -Name ${powershellQuote(pkg)} -ErrorAction SilentlyContinue; if ($null -ne $p) { exit 0 } exit 1`;
-    return runPowerShell(script);
-  });
+  const probes = toList(target).map((pkg) => runPowerShell(appxPackageProbeScript(pkg)));
   const results = await Promise.all(probes);
   return results.some(Boolean);
 }
 async function checkWindowsStartApp(target) {
   if (!isWindows())
     return false;
-  const probes = toList(target).map((pattern) => {
-    const script = `$a = Get-StartApps -Name ${powershellQuote(pattern)} -ErrorAction SilentlyContinue | Select-Object -First 1; if ($null -ne $a) { exit 0 } exit 1`;
-    return runPowerShell(script);
-  });
+  const probes = toList(target).map((pattern) => runPowerShell(startAppProbeScript(pattern)));
   const results = await Promise.all(probes);
   return results.some(Boolean);
 }
@@ -13995,6 +14318,8 @@ async function runAgentDetection(detection) {
       return checkWindowsAppxPackage(detection.target);
     case "windows-start-app":
       return checkWindowsStartApp(detection.target);
+    case "macos-bundle-id":
+      return checkMacosBundleId(detection.target);
     case "any": {
       const probes = await Promise.all(detection.target.map((p) => runAgentDetection(p)));
       return probes.some(Boolean);
@@ -14106,6 +14431,26 @@ class CodexAdapter {
         }
       }
     }
+    if (config.networkAllowlist?.length) {
+      const features = parsed.features && typeof parsed.features === "object" ? parsed.features : undefined;
+      const proxy = features?.network_proxy;
+      if (proxy && proxy.enabled === true) {
+        if (!proxy.domains || typeof proxy.domains !== "object")
+          proxy.domains = {};
+        const domains = proxy.domains;
+        for (const host of config.networkAllowlist) {
+          if (!(host in domains))
+            domains[host] = "allow";
+        }
+      } else {
+        if (!parsed.sandbox_workspace_write || typeof parsed.sandbox_workspace_write !== "object") {
+          parsed.sandbox_workspace_write = {};
+        }
+        const sww = parsed.sandbox_workspace_write;
+        if (sww.network_access === undefined)
+          sww.network_access = true;
+      }
+    }
     mkdirSync20(join28(configPath, ".."), { recursive: true });
     writeFileSync21(configPath, stringify(parsed));
   }
@@ -15412,7 +15757,7 @@ function parseJson(content, source) {
 }
 
 // src/commands/entities.ts
-var listCommand3 = new Command15("list").description("List entities registered in the workspace").option("--workspace <id>", "Workspace ID").option("--app <id>", "Filter by app name or ID").option("--preview", "Show preview-mode entities only").action(async (opts, command) => {
+var listCommand3 = new Command15("list").description("List entities registered in the workspace").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <id>", "Filter by app name or ID").option("--preview", "Show preview-mode entities only").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15447,7 +15792,7 @@ Workspace: ${workspaceName || workspaceId}
     process.exit(1);
   }
 });
-var recordsCommand = new Command15("records").description("List records for an entity").argument("<entity>", "Entity name").option("--workspace <id>", "Workspace ID").option("--limit <n>", "Number of records to return", "20").option("--cursor <cursor>", "Pagination cursor").option("--preview", "Query preview-mode data").action(async (entity, opts, command) => {
+var recordsCommand = new Command15("records").description("List records for an entity").argument("<entity>", "Entity name").option("--workspace <name-or-id>", "Workspace name or ID").option("--limit <n>", "Number of records to return", "20").option("--cursor <cursor>", "Pagination cursor").option("--preview", "Query preview-mode data").action(async (entity, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15479,7 +15824,7 @@ Next cursor: ${result.next}`);
     process.exit(1);
   }
 });
-var getCommand = new Command15("get").description("Get a single entity record by ID").argument("<entity>", "Entity name").argument("<id>", "Record ID").option("--workspace <id>", "Workspace ID").action(async (entity, id, opts, command) => {
+var getCommand = new Command15("get").description("Get a single entity record by ID").argument("<entity>", "Entity name").argument("<id>", "Record ID").option("--workspace <name-or-id>", "Workspace name or ID").action(async (entity, id, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15496,7 +15841,7 @@ var getCommand = new Command15("get").description("Get a single entity record by
     process.exit(1);
   }
 });
-var createCommand = new Command15("create").description("Create a new entity record").argument("<entity>", "Entity name").option("--workspace <id>", "Workspace ID").option("--data <json>", "Record data as JSON string, @file.json, or pipe via stdin").option("--preview", "Create in preview-mode data store").action(async (entity, opts, command) => {
+var createCommand = new Command15("create").description("Create a new entity record").argument("<entity>", "Entity name").option("--workspace <name-or-id>", "Workspace name or ID").option("--data <json>", "Record data as JSON string, @file.json, or pipe via stdin").option("--preview", "Create in preview-mode data store").action(async (entity, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15515,7 +15860,7 @@ var createCommand = new Command15("create").description("Create a new entity rec
     process.exit(1);
   }
 });
-var updateCommand = new Command15("update").description("Update an existing entity record").argument("<entity>", "Entity name").argument("<id>", "Record ID").option("--workspace <id>", "Workspace ID").option("--data <json>", "Record data as JSON string, @file.json, or pipe via stdin").action(async (entity, id, opts, command) => {
+var updateCommand = new Command15("update").description("Update an existing entity record").argument("<entity>", "Entity name").argument("<id>", "Record ID").option("--workspace <name-or-id>", "Workspace name or ID").option("--data <json>", "Record data as JSON string, @file.json, or pipe via stdin").action(async (entity, id, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15534,7 +15879,7 @@ var updateCommand = new Command15("update").description("Update an existing enti
     process.exit(1);
   }
 });
-var deleteCommand = new Command15("delete").description("Delete an entity record").argument("<entity>", "Entity name").argument("<id>", "Record ID").option("--workspace <id>", "Workspace ID").option("--yes", "Skip confirmation prompt").action(async (entity, id, opts, command) => {
+var deleteCommand = new Command15("delete").description("Delete an entity record").argument("<entity>", "Entity name").argument("<id>", "Record ID").option("--workspace <name-or-id>", "Workspace name or ID").option("--yes", "Skip confirmation prompt").action(async (entity, id, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15573,7 +15918,7 @@ function truncate2(text2, max) {
     return first;
   return first.slice(0, max - 3) + "...";
 }
-var listCommand4 = new Command16("list").description("List workflows in a workspace").option("--workspace <id>", "Workspace ID").option("--app <name>", "Filter by app name or ID").action(async (opts, command) => {
+var listCommand4 = new Command16("list").description("List workflows in a workspace").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name>", "Filter by app name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15607,7 +15952,7 @@ Workspace: ${workspaceName || workspaceId}
     process.exit(1);
   }
 });
-var triggerCommand = new Command16("trigger").description("Trigger a workflow by name").argument("<name>", "Workflow name").option("--workspace <id>", "Workspace ID").option("--app <name>", "App name or ID (required if not in a project directory)").option("--params <json>", "JSON string of parameters to pass to the workflow").option("--instance-id <id>", "Custom instance ID for the workflow run").action(async (name, opts, command) => {
+var triggerCommand = new Command16("trigger").description("Trigger a workflow by name").argument("<name>", "Workflow name").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name>", "App name or ID (required if not in a project directory)").option("--params <json>", "JSON string of parameters to pass to the workflow").option("--instance-id <id>", "Custom instance ID for the workflow run").action(async (name, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15641,7 +15986,7 @@ var triggerCommand = new Command16("trigger").description("Trigger a workflow by
     process.exit(1);
   }
 });
-var instancesCommand = new Command16("instances").description("List workflow instances for an app").option("--workspace <id>", "Workspace ID").option("--app <name>", "App name or ID (required if not in a project directory)").option("--workflow <name>", "Filter by workflow name").option("--status <status>", "Filter by instance status").option("--limit <n>", "Maximum number of instances to return").action(async (opts, command) => {
+var instancesCommand = new Command16("instances").description("List workflow instances for an app").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name>", "App name or ID (required if not in a project directory)").option("--workflow <name>", "Filter by workflow name").option("--status <status>", "Filter by instance status").option("--limit <n>", "Maximum number of instances to return").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15674,7 +16019,7 @@ var instancesCommand = new Command16("instances").description("List workflow ins
     process.exit(1);
   }
 });
-var instanceCommand = new Command16("instance").description("Get details for a specific workflow instance").argument("<id>", "Workflow instance ID").option("--workspace <id>", "Workspace ID").option("--app <name>", "App name or ID (optional)").action(async (id, opts, command) => {
+var instanceCommand = new Command16("instance").description("Get details for a specific workflow instance").argument("<id>", "Workflow instance ID").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name>", "App name or ID (optional)").action(async (id, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15702,16 +16047,64 @@ var workflowsCommand = new Command16("workflows").description("Manage workspace
 init_store();
 init_client();
 import { Command as Command17 } from "commander";
-function truncate3(text2, max) {
-  if (!text2)
+// src/utils/table.ts
+function clip(value, max) {
+  if (max <= 0)
     return "";
-  const first = text2.split(`
-`)[0];
-  if (first.length <= max)
-    return first;
-  return first.slice(0, max - 3) + "...";
+  if (value.length <= max)
+    return value;
+  if (max <= 3)
+    return value.slice(0, max);
+  return value.slice(0, max - 3) + "...";
+}
+function renderTable(columns, rows, indent = "  ") {
+  const gap = "  ";
+  const lastIdx = columns.length - 1;
+  const data = rows.map((row) => columns.map((c, i) => {
+    const raw = row[i] == null ? "" : String(row[i]);
+    return c.max !== undefined ? clip(raw, c.max) : raw;
+  }));
+  const widths = columns.map((c, i) => {
+    let w = c.header.length;
+    for (const row of data)
+      w = Math.max(w, row[i].length);
+    return w;
+  });
+  const renderRow = (cells, colorize) => {
+    const parts = cells.map((cell, i) => {
+      const padded = i === lastIdx ? cell : cell.padEnd(widths[i]);
+      const color = columns[i].color;
+      return colorize && color ? color(padded) : padded;
+    });
+    return (indent + parts.join(gap)).replace(/\s+$/, "");
+  };
+  const out = [renderRow(columns.map((c) => c.header), false)];
+  const total = widths.reduce((a, b) => a + b, 0) + gap.length * Math.max(0, columns.length - 1);
+  out.push(indent + "-".repeat(total));
+  for (const row of data)
+    out.push(renderRow(row, true));
+  return out.join(`
+`);
+}
+
+// src/commands/schedules.ts
+function extractScheduleHistoryRecords(data) {
+  if (!data || !Array.isArray(data.records))
+    return [];
+  return data.records;
+}
+function scheduleRowCells(s) {
+  const mode = s.deploymentMode ? ` (${s.deploymentMode})` : "";
+  const status = s.status ? s.status + mode : mode.trim() || "-";
+  return [
+    s.scheduleName || "(unnamed)",
+    s.appName || s.appId || "-",
+    s.schedule || "-",
+    status,
+    s.description || ""
+  ];
 }
-var listCommand5 = new Command17("list").description("List scheduled jobs in the workspace").option("--workspace <id>", "Workspace ID").option("--app <name|id>", "Filter by app name or ID").action(async (opts, command) => {
+var listCommand5 = new Command17("list").description("List scheduled jobs in the workspace").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name|id>", "Filter by app name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15733,20 +16126,20 @@ var listCommand5 = new Command17("list").description("List scheduled jobs in the
     console.log(`
 Workspace: ${workspaceName || workspaceId}
 `);
-    console.log("  " + "Name".padEnd(24) + "App".padEnd(20) + "Schedule".padEnd(18) + "Status".padEnd(12) + "Description");
-    console.log("  " + "-".repeat(90));
-    for (const s of schedules) {
-      const mode = s.deploymentMode ? ` (${s.deploymentMode})` : "";
-      const status = s.status ? s.status + mode : mode.trim() || "-";
-      console.log("  " + s.name.padEnd(24) + (s.appName || s.appId).slice(0, 18).padEnd(20) + (s.schedule || "-").padEnd(18) + status.padEnd(12) + truncate3(s.description, 40));
-    }
+    console.log(renderTable([
+      { header: "Name" },
+      { header: "App" },
+      { header: "Schedule" },
+      { header: "Status" },
+      { header: "Description", max: 60 }
+    ], schedules.map(scheduleRowCells)));
     console.log("");
   } catch (err) {
     console.error("Failed to list schedules:", err instanceof Error ? err.message : err);
     process.exit(1);
   }
 });
-var triggerCommand2 = new Command17("trigger").description("Manually trigger a scheduled job").argument("<name>", "Schedule name").option("--workspace <id>", "Workspace ID").option("--app <name|id>", "App name or ID").option("--preview", "Trigger in preview (sandbox) mode instead of production").action(async (name, opts, command) => {
+var triggerCommand2 = new Command17("trigger").description("Manually trigger a scheduled job").argument("<name>", "Schedule name").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name|id>", "App name or ID").option("--preview", "Trigger in preview (sandbox) mode instead of production").action(async (name, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15772,7 +16165,7 @@ var triggerCommand2 = new Command17("trigger").description("Manually trigger a s
     process.exit(1);
   }
 });
-var historyCommand = new Command17("history").description("Show execution history for scheduled jobs in an app").option("--workspace <id>", "Workspace ID").option("--app <name|id>", "App name or ID (required)").action(async (opts, command) => {
+var historyCommand = new Command17("history").description("Show execution history for scheduled jobs in an app").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name|id>", "App name or ID (required)").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15780,25 +16173,34 @@ var historyCommand = new Command17("history").description("Show execution histor
   const { appId, appName } = await resolveApp2(client, workspaceId, opts);
   try {
     const data = await client.getScheduleHistory(workspaceId, appId);
+    const records = extractScheduleHistoryRecords(data);
     if (useJson) {
-      jsonOut({ history: data.history, appId, appName });
+      jsonOut({ history: records, appId, appName });
       return;
     }
-    if (!data.history || data.history.length === 0) {
+    if (records.length === 0) {
       console.log(`No schedule history found for app "${appName}".`);
       return;
     }
     console.log(`
 Schedule history for app: ${appName}
 `);
-    console.log("  " + "Schedule".padEnd(24) + "Executed At".padEnd(26) + "Status".padEnd(12) + "Duration");
-    console.log("  " + "-".repeat(72));
-    for (const entry of data.history) {
+    const nameW = Math.max("Schedule".length, ...records.map((r) => (r.jobName || "-").length));
+    console.log("  " + "Schedule".padEnd(nameW + 2) + "Started At".padEnd(26) + "Status".padEnd(12) + "Duration");
+    console.log("  " + "-".repeat(nameW + 2 + 26 + 12 + 8));
+    for (const entry of records) {
+      const startedAt = entry.startedAt ? new Date(entry.startedAt).toISOString() : "-";
       const duration = entry.durationMs != null ? `${entry.durationMs}ms` : "-";
-      console.log("  " + entry.scheduleName.padEnd(24) + entry.executedAt.padEnd(26) + entry.status.padEnd(12) + duration);
+      console.log("  " + (entry.jobName || "-").padEnd(nameW + 2) + startedAt.padEnd(26) + entry.status.padEnd(12) + duration);
       if (entry.error) {
         console.log(`    Error: ${entry.error}`);
       }
+      if (entry.errorStack) {
+        for (const line of entry.errorStack.split(`
+`).slice(0, 8)) {
+          console.log(`      ${line.trim()}`);
+        }
+      }
     }
     console.log("");
   } catch (err) {
@@ -15806,7 +16208,7 @@ Schedule history for app: ${appName}
     process.exit(1);
   }
 });
-var statusCommand = new Command17("status").description("Show runtime status of scheduled jobs for an app").argument("<name>", "Schedule name").option("--workspace <id>", "Workspace ID").option("--app <name|id>", "App name or ID (required)").action(async (name, opts, command) => {
+var statusCommand = new Command17("status").description("Show runtime status of scheduled jobs for an app").argument("<name>", "Schedule name").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name|id>", "App name or ID (required)").action(async (name, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15828,7 +16230,7 @@ Schedule "${name}" status for app "${appName}":
     process.exit(1);
   }
 });
-var pauseCommand = new Command17("pause").description("Pause a scheduled job").argument("<name>", "Schedule name").option("--workspace <id>", "Workspace ID").option("--app <name|id>", "App name or ID (required)").action(async (name, opts, command) => {
+var pauseCommand = new Command17("pause").description("Pause a scheduled job").argument("<name>", "Schedule name").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name|id>", "App name or ID (required)").action(async (name, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15846,7 +16248,7 @@ var pauseCommand = new Command17("pause").description("Pause a scheduled job").a
     process.exit(1);
   }
 });
-var resumeCommand = new Command17("resume").description("Resume a paused scheduled job").argument("<name>", "Schedule name").option("--workspace <id>", "Workspace ID").option("--app <name|id>", "App name or ID (required)").action(async (name, opts, command) => {
+var resumeCommand = new Command17("resume").description("Resume a paused scheduled job").argument("<name>", "Schedule name").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name|id>", "App name or ID (required)").action(async (name, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15871,7 +16273,7 @@ init_store();
 init_client();
 import { Command as Command18 } from "commander";
 init_http();
-function truncate4(text2, max) {
+function truncate3(text2, max) {
   if (!text2)
     return "";
   const first = text2.split(`
@@ -15880,7 +16282,7 @@ function truncate4(text2, max) {
     return first;
   return first.slice(0, max - 3) + "...";
 }
-var listCommand6 = new Command18("list").description("List workspace public endpoints").option("--workspace <id>", "Workspace ID").option("--app <name>", "Filter by app name or ID").action(async (opts, command) => {
+var listCommand6 = new Command18("list").description("List workspace public endpoints").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name>", "Filter by app name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -15908,7 +16310,7 @@ Workspace: ${workspaceName || workspaceId}
       const path2 = e.endpointPath.padEnd(36);
       const app = (e.appName || e.appId).padEnd(20);
       const auth = (e.auth || "").padEnd(10);
-      const desc = truncate4(e.description, 40);
+      const desc = truncate3(e.description, 40);
       const mode = e.deploymentMode ? ` [${e.deploymentMode}]` : "";
       console.log(`  ${method} ${path2} ${app} ${auth} ${desc}${mode}`);
     }
@@ -15918,7 +16320,7 @@ Workspace: ${workspaceName || workspaceId}
     process.exit(1);
   }
 });
-var callCommand2 = new Command18("call").description("Call a workspace endpoint directly").argument("<method>", "HTTP method (GET, POST, PUT, DELETE, etc.)").argument("<path>", "Endpoint path (e.g. /my-endpoint)").option("--workspace <id>", "Workspace ID").option("--app <name>", "App name or ID (narrows endpoint lookup)").option("--body <json>", "Request body as JSON string").option("--header <header>", 'Request header (format: "Key: Value", repeatable)', (val, prev) => [...prev, val], []).option("--query <string>", 'Query string to append to the URL (e.g. "foo=bar&baz=1")').option("--api-key <key>", "API key for Authorization: Bearer header").action(async (method, path2, opts, command) => {
+var callCommand2 = new Command18("call").description("Call a workspace endpoint directly").argument("<method>", "HTTP method (GET, POST, PUT, DELETE, etc.)").argument("<path>", "Endpoint path (e.g. /my-endpoint)").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <name>", "App name or ID (narrows endpoint lookup)").option("--body <json>", "Request body as JSON string").option("--header <header>", 'Request header (format: "Key: Value", repeatable)', (val, prev) => [...prev, val], []).option("--query <string>", 'Query string to append to the URL (e.g. "foo=bar&baz=1")').option("--api-key <key>", "API key for Authorization: Bearer header").action(async (method, path2, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16049,7 +16451,7 @@ function formatSize(bytes) {
     return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
   return `${(bytes / (1024 * 1024 * 1024)).toFixed(1)}GB`;
 }
-var listCommand7 = new Command19("list").description("List file storage buckets in the workspace").option("--workspace <id>", "Workspace ID").action(async (opts, command) => {
+var listCommand7 = new Command19("list").description("List file storage buckets in the workspace").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16079,7 +16481,7 @@ Workspace: ${workspaceName || workspaceId}
     process.exit(1);
   }
 });
-var lsCommand = new Command19("ls").description("List files in a bucket").argument("<bucket>", "Bucket name").argument("[prefix]", "Key prefix to filter by").option("--workspace <id>", "Workspace ID").option("--delimiter <char>", "Delimiter for hierarchical listing", "/").action(async (bucket, prefix, opts, command) => {
+var lsCommand = new Command19("ls").description("List files in a bucket").argument("<bucket>", "Bucket name").argument("[prefix]", "Key prefix to filter by").option("--workspace <name-or-id>", "Workspace name or ID").option("--delimiter <char>", "Delimiter for hierarchical listing", "/").action(async (bucket, prefix, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16116,7 +16518,7 @@ var lsCommand = new Command19("ls").description("List files in a bucket").argume
     process.exit(1);
   }
 });
-var downloadCommand = new Command19("download").description("Download a file from a bucket").argument("<bucket>", "Bucket name").argument("<key>", "Object key to download").argument("[output]", "Local output path (defaults to basename of key)").option("--workspace <id>", "Workspace ID").action(async (bucket, key, output, opts, command) => {
+var downloadCommand = new Command19("download").description("Download a file from a bucket").argument("<bucket>", "Bucket name").argument("<key>", "Object key to download").argument("[output]", "Local output path (defaults to basename of key)").option("--workspace <name-or-id>", "Workspace name or ID").action(async (bucket, key, output, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16139,7 +16541,7 @@ var downloadCommand = new Command19("download").description("Download a file fro
     process.exit(1);
   }
 });
-var uploadCommand = new Command19("upload").description("Upload a local file to a bucket").argument("<bucket>", "Bucket name").argument("<localPath>", "Local file path to upload").argument("[key]", "Object key in bucket (defaults to basename of local path)").option("--workspace <id>", "Workspace ID").action(async (bucket, localPath, key, opts, command) => {
+var uploadCommand = new Command19("upload").description("Upload a local file to a bucket").argument("<bucket>", "Bucket name").argument("<localPath>", "Local file path to upload").argument("[key]", "Object key in bucket (defaults to basename of local path)").option("--workspace <name-or-id>", "Workspace name or ID").action(async (bucket, localPath, key, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16162,7 +16564,7 @@ var uploadCommand = new Command19("upload").description("Upload a local file to
     process.exit(1);
   }
 });
-var deleteCommand2 = new Command19("delete").description("Delete a file from a bucket").argument("<bucket>", "Bucket name").argument("<key>", "Object key to delete").option("--workspace <id>", "Workspace ID").option("--yes", "Skip confirmation prompt").action(async (bucket, key, opts, command) => {
+var deleteCommand2 = new Command19("delete").description("Delete a file from a bucket").argument("<bucket>", "Bucket name").argument("<key>", "Object key to delete").option("--workspace <name-or-id>", "Workspace name or ID").option("--yes", "Skip confirmation prompt").action(async (bucket, key, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16192,7 +16594,7 @@ var filesCommand = new Command19("files").description("Manage workspace file sto
 init_store();
 init_client();
 import { Command as Command20 } from "commander";
-var listCommand8 = new Command20("list").description("List components registered in the workspace").option("--workspace <id>", "Workspace ID").option("--app <id>", "Filter by app name or ID").action(async (opts, command) => {
+var listCommand8 = new Command20("list").description("List components registered in the workspace").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <id>", "Filter by app name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16231,7 +16633,7 @@ init_store();
 init_client();
 import { Command as Command21 } from "commander";
 init_prompt();
-var listCommand9 = new Command21("list").description("List API keys for the workspace").option("--workspace <id>", "Workspace ID").action(async (opts, command) => {
+var listCommand9 = new Command21("list").description("List API keys for the workspace").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16266,7 +16668,7 @@ Workspace: ${workspaceName || workspaceId}
     process.exit(1);
   }
 });
-var createCommand2 = new Command21("create").description("Create a new API key").option("--workspace <id>", "Workspace ID").option("--name <name>", "API key name").option("--app <id>", "Restrict key to a specific app (name or ID)").option("--scopes <scopes>", "Comma-separated list of scopes").action(async (opts, command) => {
+var createCommand2 = new Command21("create").description("Create a new API key").option("--workspace <name-or-id>", "Workspace name or ID").option("--name <name>", "API key name").option("--app <id>", "Restrict key to a specific app (name or ID)").option("--scopes <scopes>", "Comma-separated list of scopes").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16314,7 +16716,7 @@ var apiKeysCommand = new Command21("api-keys").description("Manage workspace API
 init_store();
 init_client();
 import { Command as Command22 } from "commander";
-function truncate5(text2, max) {
+function truncate4(text2, max) {
   if (!text2)
     return "";
   const first = text2.split(`
@@ -16323,7 +16725,7 @@ function truncate5(text2, max) {
     return first;
   return first.slice(0, max - 3) + "...";
 }
-var listCommand10 = new Command22("list").description("List agents in workspace").option("--workspace <id>", "Workspace ID").option("--app <id>", "Filter by app name or ID").action(async (opts, command) => {
+var listCommand10 = new Command22("list").description("List agents in workspace").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <id>", "Filter by app name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16349,8 +16751,8 @@ Workspace: ${workspaceName || workspaceId}
     for (const a of agents) {
       const name = a.agentName.padEnd(24);
       const type = a.type.padEnd(16);
-      const app = truncate5(a.appName, 18).padEnd(20);
-      const desc = truncate5(a.description, 40).padEnd(42);
+      const app = truncate4(a.appName, 18).padEnd(20);
+      const desc = truncate4(a.description, 40).padEnd(42);
       const integrations = (a.integrations?.join(", ") || "").padEnd(20);
       const entities = (a.entities?.join(", ") || "").padEnd(20);
       const mode = a.deploymentMode || "";
@@ -16362,7 +16764,7 @@ Workspace: ${workspaceName || workspaceId}
     process.exit(1);
   }
 });
-var statusCommand2 = new Command22("status").description("Get status of a specific agent").argument("<name>", "Agent name").option("--workspace <id>", "Workspace ID").option("--app <id>", "App name or ID (required)").action(async (name, opts, command) => {
+var statusCommand2 = new Command22("status").description("Get status of a specific agent").argument("<name>", "Agent name").option("--workspace <name-or-id>", "Workspace name or ID").option("--app <id>", "App name or ID (required)").action(async (name, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16380,7 +16782,7 @@ var statusCommand2 = new Command22("status").description("Get status of a specif
     process.exit(1);
   }
 });
-var executionsCommand = new Command22("executions").description("List agent execution history for workspace").option("--workspace <id>", "Workspace ID").action(async (opts, command) => {
+var executionsCommand = new Command22("executions").description("List agent execution history for workspace").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16399,9 +16801,9 @@ var executionsCommand = new Command22("executions").description("List agent exec
     console.log("  " + "-".repeat(160));
     for (const e of executions) {
       const sessionId = e.sessionId.padEnd(36);
-      const agent = truncate5(e.agentName, 20).padEnd(22);
-      const app = truncate5(e.appId, 20).padEnd(22);
-      const prompt = truncate5(e.prompt, 50).padEnd(52);
+      const agent = truncate4(e.agentName, 20).padEnd(22);
+      const app = truncate4(e.appId, 20).padEnd(22);
+      const prompt = truncate4(e.prompt, 50).padEnd(52);
       const status = e.status.padEnd(12);
       const duration = e.durationMs != null ? `${e.durationMs}ms` : "";
       const usage = e.usage ? `${e.usage.inputTokens}/${e.usage.outputTokens}` : "";
@@ -16413,7 +16815,7 @@ var executionsCommand = new Command22("executions").description("List agent exec
     process.exit(1);
   }
 });
-var executionCommand = new Command22("execution").description("Get execution stream for a specific session").argument("<sessionId>", "Session ID").option("--workspace <id>", "Workspace ID").action(async (sessionId, opts, command) => {
+var executionCommand = new Command22("execution").description("Get execution stream for a specific session").argument("<sessionId>", "Session ID").option("--workspace <name-or-id>", "Workspace name or ID").action(async (sessionId, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16437,7 +16839,7 @@ init_store();
 init_client();
 import { Command as Command23 } from "commander";
 init_prompt();
-var listCommand11 = new Command23("list").description("List workspace MCP servers").option("--workspace <id>", "Workspace ID").action(async (opts, command) => {
+var listCommand11 = new Command23("list").description("List workspace MCP servers").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16493,7 +16895,7 @@ Workspace: ${workspaceName || workspaceId}
     process.exit(1);
   }
 });
-var addCommand = new Command23("add").description("Add an MCP server to workspace").argument("<name>", "Server name").argument("<url>", "Server URL (Streamable HTTP or SSE endpoint)").option("--transport <type>", "Transport type: streamable-http or sse", "streamable-http").option("--workspace <id>", "Workspace ID").action(async (name, url, opts, command) => {
+var addCommand = new Command23("add").description("Add an MCP server to workspace").argument("<name>", "Server name").argument("<url>", "Server URL (Streamable HTTP or SSE endpoint)").option("--transport <type>", "Transport type: streamable-http or sse", "streamable-http").option("--workspace <name-or-id>", "Workspace name or ID").action(async (name, url, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16521,7 +16923,7 @@ var addCommand = new Command23("add").description("Add an MCP server to workspac
     process.exit(1);
   }
 });
-var removeCommand = new Command23("remove").description("Remove an MCP server from workspace").argument("<name>", "Server name").option("--yes", "Skip confirmation").option("--workspace <id>", "Workspace ID").action(async (name, opts, command) => {
+var removeCommand = new Command23("remove").description("Remove an MCP server from workspace").argument("<name>", "Server name").option("--yes", "Skip confirmation").option("--workspace <name-or-id>", "Workspace name or ID").action(async (name, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -16584,7 +16986,7 @@ var searchCommand3 = new Command23("search").description("Search community MCP s
     process.exit(1);
   }
 });
-var installCommand2 = new Command23("install").description("Install a community MCP server from the MCP Registry into your workspace").argument("<query>", "Server name or search query").option("--workspace <id>", "Workspace ID").action(async (query, opts, command) => {
+var installCommand2 = new Command23("install").description("Install a community MCP server from the MCP Registry into your workspace").argument("<query>", "Server name or search query").option("--workspace <name-or-id>", "Workspace name or ID").action(async (query, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -18589,7 +18991,7 @@ async function resolveAndPersistWorkspace(client, opts) {
   }
   return { workspaceId, workspaceName, workspaceSlug };
 }
-var setupCommand = new Command25("setup").description("Configure local AI agents with workspace skills and MCP servers").option("--workspace <id>", "Workspace ID").option("--agent <slug>", "Only configure a specific agent (e.g. claude-code, cursor)").option("--dry-run", "Show what would be configured without writing files").option("-y, --yes", "Skip all prompts, configure all detected agents with user scope").option("--persona <level>", "Technical-level persona for agent instructions (1=everyday, 2=curious, 3=engineer)").action(async (opts) => {
+var setupCommand = new Command25("setup").description("Configure local AI agents with workspace skills and MCP servers").option("--workspace <name-or-id>", "Workspace name or ID").option("--agent <slug>", "Only configure a specific agent (e.g. claude-code, cursor)").option("--dry-run", "Show what would be configured without writing files").option("-y, --yes", "Skip all prompts, configure all detected agents with user scope").option("--persona <level>", "Technical-level persona for agent instructions (1=everyday, 2=curious, 3=engineer)").action(async (opts) => {
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
   const { workspaceId, workspaceName, workspaceSlug } = await resolveAndPersistWorkspace(client, opts);
@@ -18941,7 +19343,7 @@ init_store();
 init_client();
 import { Command as Command28 } from "commander";
 init_init();
-var listCommand12 = new Command28("list").description("List apps in workspace").option("--workspace <id>", "Workspace ID").action(async (opts, command) => {
+var listCommand12 = new Command28("list").description("List apps in workspace").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -18974,7 +19376,7 @@ Workspace: ${workspaceName || workspaceId}
 var createCommand3 = new Command28("create").description("Create a new Runwork app").argument("[name]", "App name").action(async (name) => {
   await runCreateFlow(name);
 });
-var infoCommand2 = new Command28("info").description("Show detailed app info, preview status, and registries").argument("[app]", "App ID, name, or slug").option("--workspace <id>", "Workspace ID").action(async (appArg, opts, command) => {
+var infoCommand2 = new Command28("info").description("Show detailed app info, preview status, and registries").argument("[app]", "App ID, name, or slug").option("--workspace <name-or-id>", "Workspace name or ID").action(async (appArg, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -19001,15 +19403,157 @@ var infoCommand2 = new Command28("info").description("Show detailed app info, pr
 });
 var appsCommand = new Command28("apps").description("Manage workspace apps").addCommand(listCommand12).addCommand(createCommand3).addCommand(infoCommand2);
 
+// src/commands/members.ts
+init_store();
+init_client();
+import { Command as Command29 } from "commander";
+function formatMemberRows(members) {
+  return members.map((m) => ({
+    name: m.user.displayName || m.user.email,
+    email: m.user.email,
+    role: m.role,
+    status: m.status,
+    userId: m.userId
+  }));
+}
+var listCommand13 = new Command29("list").description("List members of a workspace (name, email, role)").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
+  const useJson = shouldOutputJson(command.optsWithGlobals().json);
+  const credentials = requireAuth();
+  const client = new ApiClient(credentials);
+  const { workspaceId, workspaceName } = await resolveWorkspace2(client, opts);
+  try {
+    const members = await client.listWorkspaceMembers(workspaceId);
+    if (useJson) {
+      jsonOut({ workspaceId, workspaceName, members });
+      return;
+    }
+    if (members.length === 0) {
+      console.log("No members found in this workspace.");
+      return;
+    }
+    console.log(`
+Workspace: ${workspaceName || workspaceId}
+`);
+    console.log(`  ${"NAME".padEnd(24)} ${"EMAIL".padEnd(32)} ${"ROLE".padEnd(10)} STATUS`);
+    console.log("  " + "-".repeat(76));
+    for (const row of formatMemberRows(members)) {
+      console.log(`  ${row.name.padEnd(24)} ${row.email.padEnd(32)} ${row.role.padEnd(10)} ${row.status}`);
+    }
+    console.log("");
+  } catch (err) {
+    console.error("Failed to list members:", err instanceof Error ? err.message : err);
+    process.exit(1);
+  }
+});
+var membersCommand = new Command29("members").description("List workspace members").addCommand(listCommand13);
+
+// src/commands/api.ts
+init_store();
+init_client();
+import { Command as Command30 } from "commander";
+import { readFileSync as readFileSync37 } from "fs";
+function normalizeApiPath(rawPath, baseUrl) {
+  if (/^https?:\/\//i.test(rawPath)) {
+    const target = new URL(rawPath);
+    const base = new URL(baseUrl);
+    if (target.origin !== base.origin) {
+      throw new Error(`Refusing to call ${target.origin}: \`runwork api\` only calls the platform API at ${base.origin}.`);
+    }
+    return target.pathname + target.search;
+  }
+  return rawPath.startsWith("/") ? rawPath : `/${rawPath}`;
+}
+var apiCommand = new Command30("api").description("Make an authenticated request to the Runwork platform API (escape hatch for endpoints the CLI does not cover)").argument("<method>", "HTTP method (GET, POST, PUT, DELETE, etc.)").argument("[path]", "API path (e.g. /api/workspaces); optional with --curl").option("--body <json>", "Request body JSON (or @file.json)").option("--header <header>", 'Request header (format: "Key: Value", repeatable)', (val, prev) => [...prev, val], []).option("--query <query>", "Query string (e.g. limit=10&offset=0)").option("--curl <command>", "Parse a curl command (method, path, headers, body)").option("--curl-file <file>", "Read curl command from a file").addHelpText("after", `
+Examples:
+  runwork api GET /api/workspaces
+  runwork api GET /api/workspaces/<id>/members
+  runwork api POST /api/workspaces/<id>/skills --body '{"name":"my-skill"}'
+
+Authentication uses your stored Runwork credentials; the API key never needs
+to be read or pasted manually. Prefer a dedicated command when one exists
+(runwork apps/members/schedules/...).`).action(async (method, path2, opts, command) => {
+  const useJson = shouldOutputJson(command.optsWithGlobals().json);
+  const credentials = requireAuth();
+  const client = new ApiClient(credentials);
+  let finalMethod = method;
+  let finalPath = path2;
+  const headers = {};
+  let body;
+  const query = opts.query;
+  if (opts.curl || opts.curlFile) {
+    let curlStr = opts.curl;
+    if (opts.curlFile) {
+      try {
+        curlStr = readFileSync37(opts.curlFile, "utf-8");
+      } catch (err) {
+        console.error(`Could not read --curl-file: ${err instanceof Error ? err.message : err}`);
+        process.exit(1);
+      }
+    }
+    const parsed = await parseCurlToRequest(curlStr);
+    finalMethod = parsed.method;
+    finalPath = parsed.path + (parsed.query ? `?${parsed.query}` : "");
+    Object.assign(headers, parsed.headers);
+    body = parsed.body;
+  }
+  for (const h of opts.header || []) {
+    const [key, ...rest] = h.split(":");
+    headers[key.trim()] = rest.join(":").trim();
+  }
+  if (opts.body) {
+    let raw = opts.body;
+    if (raw.startsWith("@")) {
+      try {
+        raw = readFileSync37(raw.slice(1), "utf-8");
+      } catch (err) {
+        console.error(`Could not read body file: ${err instanceof Error ? err.message : err}`);
+        process.exit(1);
+      }
+    }
+    try {
+      body = JSON.parse(raw);
+    } catch {
+      console.error("Invalid JSON in --body");
+      process.exit(1);
+    }
+  }
+  if (!finalPath) {
+    console.error("Usage: runwork api <method> <path>");
+    console.error('   or: runwork api <method> --curl "curl ..."');
+    process.exit(1);
+  }
+  try {
+    const normalizedPath = normalizeApiPath(finalPath, credentials.baseUrl || "https://runwork.ai");
+    const result = await client.rawApiCall(finalMethod, normalizedPath, {
+      body,
+      headers: Object.keys(headers).length > 0 ? headers : undefined,
+      query
+    });
+    if (useJson) {
+      jsonOut({ success: result.ok, status: result.status, body: result.body });
+    } else if (typeof result.body === "string") {
+      console.log(result.body);
+    } else {
+      console.log(JSON.stringify(result.body, null, 2));
+    }
+    if (!result.ok)
+      process.exit(1);
+  } catch (err) {
+    console.error("API call failed:", err instanceof Error ? err.message : err);
+    process.exit(1);
+  }
+});
+
 // src/commands/doctor.ts
 init_colors();
-import { Command as Command29 } from "commander";
+import { Command as Command31 } from "commander";
 
 // src/health/checks.ts
 init_subprocess();
 init_store();
 init_client();
-import { existsSync as existsSync44, readFileSync as readFileSync37 } from "fs";
+import { parse as parse2 } from "smol-toml";
+import { existsSync as existsSync44, readFileSync as readFileSync38 } from "fs";
 import { join as join40, sep as sep3 } from "path";
 import { homedir as homedir22, platform as osPlatform2, arch as osArch } from "os";
 init_http();
@@ -19045,7 +19589,7 @@ function buildContext() {
   const configPath = join40(process.cwd(), ".runwork.json");
   if (existsSync44(configPath)) {
     try {
-      config = JSON.parse(readFileSync37(configPath, "utf-8"));
+      config = JSON.parse(readFileSync38(configPath, "utf-8"));
     } catch {}
   }
   return { credentials, client, config, cwd: process.cwd() };
@@ -19265,6 +19809,14 @@ async function checkGitCredentialHelper(ctx) {
       fix: "runwork doctor --fix (re-registers with the current binary path)"
     };
   }
+  if (!lookup.hasReset) {
+    return {
+      name: "git-credential-helper",
+      status: "fail",
+      message: `helper registered for ${origin} but the credential-manager reset entry is missing (Windows may show a Git Credential Manager popup)`,
+      fix: "runwork doctor --fix"
+    };
+  }
   return {
     name: "git-credential-helper",
     status: "pass",
@@ -19394,7 +19946,7 @@ function loadSetupState5() {
   for (const p of [projectPath, userPath]) {
     if (existsSync44(p)) {
       try {
-        return JSON.parse(readFileSync37(p, "utf-8"));
+        return JSON.parse(readFileSync38(p, "utf-8"));
       } catch {
         continue;
       }
@@ -19402,6 +19954,95 @@ function loadSetupState5() {
   }
   return null;
 }
+var RUNWORK_NETWORK_DOMAINS = ["runwork.ai", "*.runwork.ai"];
+async function checkCodexNetwork() {
+  const name = "codex-network";
+  const state = loadSetupState5();
+  if (!state || !state.configuredAgents.includes("codex")) {
+    return { name, status: "skip", message: "Codex not configured for Runwork" };
+  }
+  const configPath = join40(homedir22(), ".codex", "config.toml");
+  if (!existsSync44(configPath)) {
+    return { name, status: "skip", message: "no Codex config found" };
+  }
+  let parsed;
+  try {
+    parsed = parse2(readFileSync38(configPath, "utf-8"));
+  } catch {
+    return { name, status: "warn", message: "could not parse ~/.codex/config.toml" };
+  }
+  const features = parsed.features && typeof parsed.features === "object" ? parsed.features : undefined;
+  const proxy = features?.network_proxy;
+  if (proxy && proxy.enabled === true) {
+    const domains = proxy.domains && typeof proxy.domains === "object" ? proxy.domains : {};
+    if (RUNWORK_NETWORK_DOMAINS.some((d) => domains[d] === "deny")) {
+      return {
+        name,
+        status: "warn",
+        message: "network proxy denies runwork.ai; the Runwork CLI is blocked",
+        fix: 'remove the runwork.ai "deny" rule in ~/.codex/config.toml'
+      };
+    }
+    if (RUNWORK_NETWORK_DOMAINS.every((d) => domains[d] === "allow")) {
+      return { name, status: "pass", message: "proxy-allowlisted: runwork.ai permitted, other domains scoped by your proxy" };
+    }
+    return {
+      name,
+      status: "warn",
+      message: "network proxy is on but runwork.ai is not allowlisted",
+      fix: "runwork sync"
+    };
+  }
+  const sww = parsed.sandbox_workspace_write && typeof parsed.sandbox_workspace_write === "object" ? parsed.sandbox_workspace_write : undefined;
+  const sandboxMode = typeof parsed.sandbox_mode === "string" ? parsed.sandbox_mode : undefined;
+  if (sww?.network_access === true || sandboxMode === "danger-full-access") {
+    return { name, status: "pass", message: "open: outbound network enabled (all domains)" };
+  }
+  if (sww?.network_access === false) {
+    return {
+      name,
+      status: "warn",
+      message: "off: network explicitly disabled; the Runwork CLI cannot reach the network",
+      fix: "set [sandbox_workspace_write] network_access = true, or run runwork sync"
+    };
+  }
+  return {
+    name,
+    status: "warn",
+    message: "off: network is disabled by default in Codex workspace-write sandbox; the Runwork CLI cannot reach the network",
+    fix: "runwork sync"
+  };
+}
+async function checkCodexDesktopProject() {
+  const name = "codex-desktop-project";
+  const state = loadSetupState5();
+  const usesCodex = !!state && (state.configuredAgents.includes("codex-app") || state.configuredAgents.includes("codex"));
+  if (!usesCodex) {
+    return { name, status: "skip", message: "Codex not configured for Runwork" };
+  }
+  const statePath2 = join40(homedir22(), ".codex", ".codex-global-state.json");
+  if (!existsSync44(statePath2)) {
+    return { name, status: "skip", message: "Codex desktop app not detected" };
+  }
+  let savedRoots = [];
+  try {
+    const parsed = JSON.parse(readFileSync38(statePath2, "utf-8"));
+    const roots = parsed["electron-saved-workspace-roots"];
+    savedRoots = Array.isArray(roots) ? roots.filter((r) => typeof r === "string") : [];
+  } catch {
+    return { name, status: "warn", message: "could not read Codex desktop state" };
+  }
+  const runworkDir = join40(homedir22(), ".runwork");
+  if (savedRoots.includes(runworkDir)) {
+    return { name, status: "pass", message: "Runwork project added to Codex desktop sidebar" };
+  }
+  return {
+    name,
+    status: "warn",
+    message: "Runwork project not added to Codex desktop sidebar",
+    fix: "quit the Codex app, then run runwork sync (sync skips this while Codex is open)"
+  };
+}
 async function checkAgentSetup() {
   const state = loadSetupState5();
   if (!state) {
@@ -19446,7 +20087,7 @@ async function checkAgentSetup() {
     const mcpConfigPath = getMcpConfigPath2(slug, "user");
     if (mcpConfigPath && existsSync44(mcpConfigPath)) {
       try {
-        const content = readFileSync37(mcpConfigPath, "utf-8");
+        const content = readFileSync38(mcpConfigPath, "utf-8");
         const missingMcp = state.mcpServers.filter((name) => !content.includes(name));
         if (missingMcp.length > 0) {
           details.push(`${missingMcp.length} MCP server(s) missing from ${slug} config`);
@@ -19504,7 +20145,8 @@ function getMcpConfigPath2(slug, scope) {
     case "windsurf":
       return scope === "project" ? join40(process.cwd(), ".windsurf", "mcp.json") : join40(home, ".windsurf", "mcp.json");
     case "codex":
-      return scope === "user" ? join40(home, ".codex", "mcp.json") : null;
+    case "codex-app":
+      return scope === "user" ? join40(home, ".codex", "config.toml") : null;
     case "gemini":
       return scope === "user" ? join40(home, ".gemini", "settings.json") : null;
     default:
@@ -19517,6 +20159,7 @@ function getSkillsDir(slug, scope) {
     case "claude-code":
       return scope === "project" ? join40(process.cwd(), ".claude", "skills") : join40(home, ".claude", "skills");
     case "codex":
+    case "codex-app":
       return scope === "project" ? join40(process.cwd(), ".codex", "skills") : join40(home, ".codex", "skills");
     case "gemini":
       return scope === "project" ? join40(process.cwd(), ".gemini", "skills") : join40(home, ".gemini", "skills");
@@ -19543,7 +20186,9 @@ var CHECK_RUNNERS = [
   { names: ["app-exists"], run: async (ctx) => [await checkAppExists(ctx)] },
   { names: ["git-remote"], run: async (ctx) => [await checkGitRemote(ctx)] },
   { names: ["deploy-freshness"], run: async (ctx) => [await checkDeployFreshness(ctx)] },
-  { names: ["agent-setup"], run: async () => [await checkAgentSetup()] }
+  { names: ["agent-setup"], run: async () => [await checkAgentSetup()] },
+  { names: ["codex-network"], run: async () => [await checkCodexNetwork()] },
+  { names: ["codex-desktop-project"], run: async () => [await checkCodexDesktopProject()] }
 ];
 var ALL_CHECK_NAMES = CHECK_RUNNERS.flatMap((r) => r.names);
 async function runAllChecks(options) {
@@ -19616,7 +20261,7 @@ async function applyDoctorFixes(ctx, failingNames) {
 }
 
 // src/agents/runtime-detection.ts
-import { existsSync as existsSync46, readFileSync as readFileSync38, statSync as statSync6, readdirSync as readdirSync13 } from "fs";
+import { existsSync as existsSync46, readFileSync as readFileSync39, statSync as statSync6, readdirSync as readdirSync13 } from "fs";
 import { homedir as homedir23 } from "os";
 import { join as join42 } from "path";
 var RUNWORK_SESSIONS_DIR = join42(homedir23(), ".runwork", "sessions");
@@ -19686,7 +20331,7 @@ function readHookSessionInfo(sessionId) {
   if (!existsSync46(path2))
     return null;
   try {
-    const raw = readFileSync38(path2, "utf8");
+    const raw = readFileSync39(path2, "utf8");
     const parsed = JSON.parse(raw);
     return parsed;
   } catch {
@@ -19906,7 +20551,9 @@ var CHECK_LABELS = {
   "app-exists": "App exists",
   "git-remote": "Git remote",
   "deploy-freshness": "Deploy freshness",
-  "agent-setup": "Agent setup"
+  "agent-setup": "Agent setup",
+  "codex-network": "Codex network",
+  "codex-desktop-project": "Codex project"
 };
 function printHumanReport(report) {
   console.log("");
@@ -19971,7 +20618,7 @@ function parseCheckNames(raw) {
   const unknown = requested.filter((n) => !known.has(n));
   return { only, unknown };
 }
-var doctorCommand = new Command29("doctor").description("Check system health: auth, network, project config, agent setup").option("-v, --verbose", "Include host-agent detection results, runtime info, and allowlisted env vars (useful for AI agents debugging their own environment)").option("--check <names>", `Run only the named checks (comma-separated). Available: ${ALL_CHECK_NAMES.join(", ")}`).option("--fix", "Auto-remediate fixable failures (git credential helper, runwork remote), then re-check").action(async (opts, command) => {
+var doctorCommand = new Command31("doctor").description("Check system health: auth, network, project config, agent setup").option("-v, --verbose", "Include host-agent detection results, runtime info, and allowlisted env vars (useful for AI agents debugging their own environment)").option("--check <names>", `Run only the named checks (comma-separated). Available: ${ALL_CHECK_NAMES.join(", ")}`).option("--fix", "Auto-remediate fixable failures (git credential helper, runwork remote), then re-check").action(async (opts, command) => {
   const asJson = shouldOutputJson(command.optsWithGlobals().json);
   let only;
   if (opts.check) {
@@ -20022,8 +20669,8 @@ var doctorCommand = new Command29("doctor").description("Check system health: au
 // src/commands/share-convo.ts
 init_store();
 init_client();
-import { Command as Command30 } from "commander";
-import { readFileSync as readFileSync39, existsSync as existsSync47 } from "fs";
+import { Command as Command32 } from "commander";
+import { readFileSync as readFileSync40, existsSync as existsSync47 } from "fs";
 import { createHash as createHash4 } from "crypto";
 function nativeBundleFormatForAgent(slug) {
   if (slug === "claude-code" || slug === "claude-desktop")
@@ -20065,7 +20712,7 @@ async function runShareConvo(opts, command, isPersonalAlias = false) {
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
   const { workspaceId } = await resolveWorkspace2(client, { workspace: opts.workspace });
-  const transcriptContent = readFileSync39(opts.transcriptFile, "utf8");
+  const transcriptContent = readFileSync40(opts.transcriptFile, "utf8");
   const bundles = [
     {
       format: "transcript",
@@ -20090,7 +20737,7 @@ async function runShareConvo(opts, command, isPersonalAlias = false) {
     const nativeFormat = nativeBundleFormatForAgent(sourceAgent);
     if (nativeFormat) {
       try {
-        const content = readFileSync39(nativeFilePath, "utf8");
+        const content = readFileSync40(nativeFilePath, "utf8");
         bundles.push({
           format: nativeFormat,
           content,
@@ -20106,7 +20753,7 @@ async function runShareConvo(opts, command, isPersonalAlias = false) {
   let metadata = {};
   if (opts.metadataFile) {
     try {
-      metadata = JSON.parse(readFileSync39(opts.metadataFile, "utf8"));
+      metadata = JSON.parse(readFileSync40(opts.metadataFile, "utf8"));
     } catch (err) {
       console.error(`Error: --metadata-file is not valid JSON: ${err instanceof Error ? err.message : err}`);
       process.exit(1);
@@ -20161,17 +20808,17 @@ Skipped: ${result.skipped.map((s) => `${s.identifier} (${s.reason})`).join(", ")
     process.exit(1);
   }
 }
-var shareConvoCommand = new Command30("share-convo").description("Share the current AI conversation with a teammate").option("--to <email>", "Recipient email (repeatable)", (value, prev = []) => [...prev, value], []).option("--transcript-file <path>", "Path to the LLM-emitted markdown transcript (required)").option("--native-file <path>", "Path to the native session file (optional; auto-detected from env vars otherwise)").option("--source-agent <slug>", "Override host-agent detection (e.g. claude-code, codex, claude-desktop)").option("--title <string>", "Short title for the conversation (required)").option("--note <string>", "Optional personal note to recipients").option("--ttl-days <n>", "Days until expiration (1-30, default 7)").option("--metadata-json <json>", "Inline JSON object with workMode, openQuestions, suggestedNextStep, etc.").option("--metadata-file <path>", "Path to a JSON file with the same metadata fields").option("--workspace <id>", "Workspace ID").action((opts, command) => runShareConvo(opts, command, false));
+var shareConvoCommand = new Command32("share-convo").description("Share the current AI conversation with a teammate").option("--to <email>", "Recipient email (repeatable)", (value, prev = []) => [...prev, value], []).option("--transcript-file <path>", "Path to the LLM-emitted markdown transcript (required)").option("--native-file <path>", "Path to the native session file (optional; auto-detected from env vars otherwise)").option("--source-agent <slug>", "Override host-agent detection (e.g. claude-code, codex, claude-desktop)").option("--title <string>", "Short title for the conversation (required)").option("--note <string>", "Optional personal note to recipients").option("--ttl-days <n>", "Days until expiration (1-30, default 7)").option("--metadata-json <json>", "Inline JSON object with workMode, openQuestions, suggestedNextStep, etc.").option("--metadata-file <path>", "Path to a JSON file with the same metadata fields").option("--workspace <name-or-id>", "Workspace name or ID").action((opts, command) => runShareConvo(opts, command, false));
 
 // src/commands/save-convo.ts
-import { Command as Command31 } from "commander";
-var saveConvoCommand = new Command31("save-convo").description("Save the current AI conversation as a personal checkpoint").option("--transcript-file <path>", "Path to the LLM-emitted markdown transcript (required)").option("--native-file <path>", "Path to the native session file (optional; auto-detected from env vars)").option("--source-agent <slug>", "Override host-agent detection").option("--title <string>", "Short title for the conversation (required)").option("--note <string>", "Optional note to your future self").option("--ttl-days <n>", "Days until expiration (1-30, default 7)").option("--metadata-json <json>", "Inline JSON object with workMode, openQuestions, etc.").option("--metadata-file <path>", "Path to a JSON file with metadata fields").option("--workspace <id>", "Workspace ID").action((opts, command) => runShareConvo({ ...opts, personal: true }, command, true));
+import { Command as Command33 } from "commander";
+var saveConvoCommand = new Command33("save-convo").description("Save the current AI conversation as a personal checkpoint").option("--transcript-file <path>", "Path to the LLM-emitted markdown transcript (required)").option("--native-file <path>", "Path to the native session file (optional; auto-detected from env vars)").option("--source-agent <slug>", "Override host-agent detection").option("--title <string>", "Short title for the conversation (required)").option("--note <string>", "Optional note to your future self").option("--ttl-days <n>", "Days until expiration (1-30, default 7)").option("--metadata-json <json>", "Inline JSON object with workMode, openQuestions, etc.").option("--metadata-file <path>", "Path to a JSON file with metadata fields").option("--workspace <name-or-id>", "Workspace name or ID").action((opts, command) => runShareConvo({ ...opts, personal: true }, command, true));
 
 // src/commands/inbox.ts
 init_store();
 init_client();
-import { Command as Command32 } from "commander";
-var inboxCommand = new Command32("inbox").description("List shared conversations visible to you").option("--filter <scope>", "Filter: all | received | sent | saved", "all").option("--limit <n>", "Max rows to return", "50").option("--workspace <id>", "Workspace ID").action(async (opts, command) => {
+import { Command as Command34 } from "commander";
+var inboxCommand = new Command34("inbox").description("List shared conversations visible to you").option("--filter <scope>", "Filter: all | received | sent | saved", "all").option("--limit <n>", "Max rows to return", "50").option("--workspace <name-or-id>", "Workspace name or ID").action(async (opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const scope = opts.filter === "received" || opts.filter === "sent" || opts.filter === "saved" ? opts.filter : "all";
   const limit = opts.limit ? parseInt(opts.limit, 10) : 50;
@@ -20211,7 +20858,7 @@ Shared conversations (${scope}, ${total}):
 // src/commands/resume.ts
 init_store();
 init_client();
-import { Command as Command33 } from "commander";
+import { Command as Command35 } from "commander";
 import { writeFileSync as writeFileSync31, mkdirSync as mkdirSync28, realpathSync } from "fs";
 import { homedir as homedir24 } from "os";
 import { join as join43 } from "path";
@@ -20285,7 +20932,7 @@ function isAgentInstalled(agent) {
   }
   return false;
 }
-var resumeCommand2 = new Command33("resume").description("Resume a shared conversation locally in your agent of choice").argument("<share-id>", "The share ID (sc_*) returned by share-convo or save-convo").option("--agent <slug>", "Override target agent (e.g. claude-code, codex)").option("--into <path>", "Override target cwd (defaults to current $PWD)").option("--dry-run", "Print the resume command instead of executing it").option("--pick", "Show interactive picker (requires TTY) - not yet implemented").option("--workspace <id>", "Workspace ID").action(async (shareId, opts, command) => {
+var resumeCommand2 = new Command35("resume").description("Resume a shared conversation locally in your agent of choice").argument("<share-id>", "The share ID (sc_*) returned by share-convo or save-convo").option("--agent <slug>", "Override target agent (e.g. claude-code, codex)").option("--into <path>", "Override target cwd (defaults to current $PWD)").option("--dry-run", "Print the resume command instead of executing it").option("--pick", "Show interactive picker (requires TTY) - not yet implemented").option("--workspace <name-or-id>", "Workspace name or ID").action(async (shareId, opts, command) => {
   const useJson = shouldOutputJson(command.optsWithGlobals().json);
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
@@ -20510,7 +21157,7 @@ process.on("uncaughtException", (err) => {
   console.error(`Uncaught exception: ${formatError(err)}`);
   process.exit(1);
 });
-var program = new Command34;
+var program = new Command36;
 program.name("runwork").description("Runwork CLI - local development for Runwork apps").version(VERSION).option("--json", "Output as JSON (auto-enabled when stdout is not a TTY)");
 program.addCommand(infoCommand);
 program.addCommand(loginCommand);
@@ -20539,6 +21186,8 @@ program.addCommand(syncCommand);
 program.addCommand(buildPluginCommand);
 program.addCommand(uninstallCommand);
 program.addCommand(appsCommand);
+program.addCommand(membersCommand);
+program.addCommand(apiCommand);
 program.addCommand(doctorCommand);
 program.addCommand(shareConvoCommand);
 program.addCommand(saveConvoCommand);