thinkwork-cli 0.12.7 → 0.12.9

package/README.md

@@ -137,26 +137,31 @@ The CLI has two modes for every API-backed command:
 Any flag accepted by a command is also inferrable from env vars:
 `THINKWORK_STAGE`, `THINKWORK_TENANT`, `THINKWORK_API_KEY` (for CI).
 
-## Roadmap
+## Command surface
 
-The commands below are **scaffolded** in Phase 0 (help text + argument parsing
-ships now, so `thinkwork --help` shows the full surface area) and fill in
-phase-by-phase. Running a scaffolded command prints a "not yet implemented"
-message and exits with code 2.
+All 25 originally-scaffolded commands across Phases 1–5 are now live.
+`thinkwork <cmd> --help` is authoritative for flags + examples.
 
 | Phase | Domain | Commands |
 |-------|--------|----------|
-| **0 (now)** | Foundation | `login` (Cognito + AWS), `logout`, `me`, `--json`, GraphQL client, codegen, shared helpers |
-| 1 | Work & approvals | ✅ `thread`, `message`, `label`, `inbox` — **Phase 1 complete** |
-| 2 | Agents & workspace | ✅ `member`, `team`, `kb`, `template`, `tenant`, `agent` — **Phase 2 complete** |
-| 3 | Automation & integrations | ✅ `routine`, `scheduled-job`, `turn`, `wakeup`, `webhook`, `skill` — **Phase 3 complete** (`connector` retired) |
-| 4 | Memory & artifacts | ✅ `memory`, `recipe`, `artifact` — **Phase 4 complete** |
-| 5 | Observability & spend | ✅ `cost`, `budget`, `performance`, `trace`, `dashboard` — **Phase 5 complete** |
-
-Each phase ships as one PR. Mid-phase stubs keep `thinkwork --help` complete
-so the full surface is always discoverable; individual commands flip from
-stub to real implementation as their phase lands. Run any
-`thinkwork <cmd> --help` today to see the planned flags + examples.
+| 0 | Foundation | `login` (chains AWS profile + Cognito API session), `logout`, `me`, `--json`, GraphQL client, codegen, shared helpers |
+| 1 | Work & approvals | `thread`, `message`, `label`, `inbox` |
+| 2 | Agents & workspace | `member`, `team`, `kb`, `template`, `tenant`, `agent` |
+| 3 | Automation & integrations | `routine`, `scheduled-job`, `turn`, `wakeup`, `webhook`, `skill` (`connector` retired) |
+| 4 | Memory & artifacts | `memory`, `recipe`, `artifact` |
+| 5 | Observability & spend | `cost`, `budget`, `performance`, `trace`, `dashboard` |
+
+`skill create` and `skill update` were retired in favor of
+`thinkwork skill push <folder>` — that's the real custom-skill authoring
+surface. Invoking them prints "retired — use `skill push`" and exits 2.
+
+Auth model: the CLI's auto-fallback to the deploy-stage's
+`api_auth_secret` admits most admin-tier paths via the server's
+`requireAdminOrServiceCaller` gate. Paths that stamp a specific user
+identity onto the row (`createThread`, `sendMessage`, `core/*` member
+mutations) stay Cognito-required so service callers can't ghost-write
+as a user — sign in via `thinkwork login --stage <s>` (or the chained
+prompt from `thinkwork login`) for those.
 
 ## Interactive Init
 

package/dist/cli.js

@@ -2041,9 +2041,9 @@ function registerInitCommand(program2) {
         printError("Stage name is required. Pass -s <name> or re-run in an interactive terminal.");
         process.exit(1);
       }
-      const { input: input20 } = await import("@inquirer/prompts");
+      const { input: input21 } = await import("@inquirer/prompts");
       try {
-        stage = await input20({
+        stage = await input21({
           message: "Stage name (e.g. dev, staging, prod):",
           validate: (v) => validateStage(v).error ?? true
         });
@@ -2657,10 +2657,10 @@ async function getTenant(client, id) {
 async function getTenantBySlug(client, slug) {
   return client.fetch(`/api/tenants/by-slug/${encodeURIComponent(slug)}`);
 }
-async function updateTenant(client, id, input20) {
+async function updateTenant(client, id, input21) {
   return client.fetch(`/api/tenants/${encodeURIComponent(id)}`, {
     method: "PUT",
-    body: JSON.stringify(input20)
+    body: JSON.stringify(input21)
   });
 }
 
@@ -2671,12 +2671,12 @@ __export(admin_keys_exports, {
   listAdminKeys: () => listAdminKeys,
   revokeAdminKey: () => revokeAdminKey
 });
-async function createAdminKey(client, tenantIdOrSlug, input20 = {}) {
+async function createAdminKey(client, tenantIdOrSlug, input21 = {}) {
   return client.fetch(
     `/api/tenants/${encodeURIComponent(tenantIdOrSlug)}/mcp-admin-keys`,
     {
       method: "POST",
-      body: JSON.stringify(input20)
+      body: JSON.stringify(input21)
     }
   );
 }
@@ -2937,7 +2937,7 @@ Examples:
   ).action(
     async (nameArg, opts) => {
       try {
-        const { input: input20 } = await import("@inquirer/prompts");
+        const { input: input21 } = await import("@inquirer/prompts");
         const { stage, api, tenant } = await resolveMcpContext(opts);
         let name = nameArg;
         if (!name) {
@@ -2945,7 +2945,7 @@ Examples:
             printError("Name is required. Pass it as a positional arg.");
             process.exit(1);
           }
-          name = await input20({ message: "Server name:" });
+          name = await input21({ message: "Server name:" });
         }
         let url = opts.url;
         if (!url) {
@@ -2953,7 +2953,7 @@ Examples:
             printError("--url is required. Pass it as a flag.");
             process.exit(1);
           }
-          url = await input20({
+          url = await input21({
             message: "MCP server URL:",
             validate: (v) => v.startsWith("http://") || v.startsWith("https://") ? true : "URL must start with http:// or https://"
           });
@@ -3113,7 +3113,7 @@ Examples:
   ).option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--agent <id>", "Agent ID").action(
     async (mcpServerArg, opts) => {
       try {
-        const { input: input20 } = await import("@inquirer/prompts");
+        const { input: input21 } = await import("@inquirer/prompts");
         const { api, tenant } = await resolveMcpContext(opts);
         const server = await resolveServer(mcpServerArg, api, tenant.slug);
         let agent = opts.agent;
@@ -3122,7 +3122,7 @@ Examples:
             printError("--agent is required. Pass it as a flag.");
             process.exit(1);
           }
-          agent = await input20({ message: "Agent ID:" });
+          agent = await input21({ message: "Agent ID:" });
         }
         const result = await apiFetch(
           api.apiUrl,
@@ -3145,7 +3145,7 @@ Examples:
   ).option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--agent <id>", "Agent ID").action(
     async (mcpServerArg, opts) => {
       try {
-        const { input: input20 } = await import("@inquirer/prompts");
+        const { input: input21 } = await import("@inquirer/prompts");
         const { api, tenant } = await resolveMcpContext(opts);
         const server = await resolveServer(mcpServerArg, api, tenant.slug);
         let agent = opts.agent;
@@ -3154,7 +3154,7 @@ Examples:
             printError("--agent is required. Pass it as a flag.");
             process.exit(1);
           }
-          agent = await input20({ message: "Agent ID:" });
+          agent = await input21({ message: "Agent ID:" });
         }
         await apiFetch(
           api.apiUrl,
@@ -4341,6 +4341,8 @@ var CliUpdateScheduledJobDocument = { "kind": "Document", "definitions": [{ "kin
 var CliSchedJobTenantBySlugDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "query", "name": { "kind": "Name", "value": "CliSchedJobTenantBySlug" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "slug" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "String" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "tenantBySlug" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "slug" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "slug" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }] } }] } }] };
 var CliSkillCatalogDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "query", "name": { "kind": "Name", "value": "CliSkillCatalog" }, "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "skillCatalog" }, "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "skillId" } }, { "kind": "Field", "name": { "kind": "Name", "value": "displayName" } }, { "kind": "Field", "name": { "kind": "Name", "value": "description" } }, { "kind": "Field", "name": { "kind": "Name", "value": "category" } }, { "kind": "Field", "name": { "kind": "Name", "value": "icon" } }, { "kind": "Field", "name": { "kind": "Name", "value": "source" } }, { "kind": "Field", "name": { "kind": "Name", "value": "enabled" } }] } }] } }] };
 var CliSkillTenantBySlugDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "query", "name": { "kind": "Name", "value": "CliSkillTenantBySlug" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "slug" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "String" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "tenantBySlug" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "slug" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "slug" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }] } }] } }] };
+var CliInstallSkillDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "mutation", "name": { "kind": "Name", "value": "CliInstallSkill" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "input" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "InstallSkillInput" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "installSkill" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "input" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "input" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "tenantId" } }, { "kind": "Field", "name": { "kind": "Name", "value": "skillId" } }, { "kind": "Field", "name": { "kind": "Name", "value": "source" } }, { "kind": "Field", "name": { "kind": "Name", "value": "version" } }, { "kind": "Field", "name": { "kind": "Name", "value": "catalogVersion" } }, { "kind": "Field", "name": { "kind": "Name", "value": "enabled" } }, { "kind": "Field", "name": { "kind": "Name", "value": "installedAt" } }, { "kind": "Field", "name": { "kind": "Name", "value": "updatedAt" } }] } }] } }] };
+var CliUninstallSkillDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "mutation", "name": { "kind": "Name", "value": "CliUninstallSkill" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "tenantId" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "ID" } } } }, { "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "skillId" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "String" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "uninstallSkill" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "tenantId" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "tenantId" } } }, { "kind": "Argument", "name": { "kind": "Name", "value": "skillId" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "skillId" } } }] }] } }] };
 var CliTeamsDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "query", "name": { "kind": "Name", "value": "CliTeams" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "tenantId" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "ID" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "teams" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "tenantId" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "tenantId" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "name" } }, { "kind": "Field", "name": { "kind": "Name", "value": "slug" } }, { "kind": "Field", "name": { "kind": "Name", "value": "type" } }, { "kind": "Field", "name": { "kind": "Name", "value": "status" } }, { "kind": "Field", "name": { "kind": "Name", "value": "budgetMonthlyCents" } }, { "kind": "Field", "name": { "kind": "Name", "value": "createdAt" } }] } }] } }] };
 var CliTeamDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "query", "name": { "kind": "Name", "value": "CliTeam" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "id" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "ID" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "team" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "id" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "id" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "name" } }, { "kind": "Field", "name": { "kind": "Name", "value": "slug" } }, { "kind": "Field", "name": { "kind": "Name", "value": "description" } }, { "kind": "Field", "name": { "kind": "Name", "value": "type" } }, { "kind": "Field", "name": { "kind": "Name", "value": "status" } }, { "kind": "Field", "name": { "kind": "Name", "value": "budgetMonthlyCents" } }, { "kind": "Field", "name": { "kind": "Name", "value": "createdAt" } }, { "kind": "Field", "name": { "kind": "Name", "value": "updatedAt" } }, { "kind": "Field", "name": { "kind": "Name", "value": "agents" }, "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "agentId" } }, { "kind": "Field", "name": { "kind": "Name", "value": "role" } }, { "kind": "Field", "name": { "kind": "Name", "value": "joinedAt" } }] } }, { "kind": "Field", "name": { "kind": "Name", "value": "users" }, "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "userId" } }, { "kind": "Field", "name": { "kind": "Name", "value": "role" } }, { "kind": "Field", "name": { "kind": "Name", "value": "joinedAt" } }] } }] } }] } }] };
 var CliCreateTeamDocument = { "kind": "Document", "definitions": [{ "kind": "OperationDefinition", "operation": "mutation", "name": { "kind": "Name", "value": "CliCreateTeam" }, "variableDefinitions": [{ "kind": "VariableDefinition", "variable": { "kind": "Variable", "name": { "kind": "Name", "value": "input" } }, "type": { "kind": "NonNullType", "type": { "kind": "NamedType", "name": { "kind": "Name", "value": "CreateTeamInput" } } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "createTeam" }, "arguments": [{ "kind": "Argument", "name": { "kind": "Name", "value": "input" }, "value": { "kind": "Variable", "name": { "kind": "Name", "value": "input" } } }], "selectionSet": { "kind": "SelectionSet", "selections": [{ "kind": "Field", "name": { "kind": "Name", "value": "id" } }, { "kind": "Field", "name": { "kind": "Name", "value": "name" } }, { "kind": "Field", "name": { "kind": "Name", "value": "type" } }, { "kind": "Field", "name": { "kind": "Name", "value": "status" } }] } }] } }] };
@@ -4522,6 +4524,8 @@ var documents = {
   "\n  query CliSchedJobTenantBySlug($slug: String!) {\n    tenantBySlug(slug: $slug) {\n      id\n    }\n  }\n": CliSchedJobTenantBySlugDocument,
   "\n  query CliSkillCatalog {\n    skillCatalog {\n      id\n      skillId\n      displayName\n      description\n      category\n      icon\n      source\n      enabled\n    }\n  }\n": CliSkillCatalogDocument,
   "\n  query CliSkillTenantBySlug($slug: String!) {\n    tenantBySlug(slug: $slug) {\n      id\n    }\n  }\n": CliSkillTenantBySlugDocument,
+  "\n  mutation CliInstallSkill($input: InstallSkillInput!) {\n    installSkill(input: $input) {\n      id\n      tenantId\n      skillId\n      source\n      version\n      catalogVersion\n      enabled\n      installedAt\n      updatedAt\n    }\n  }\n": CliInstallSkillDocument,
+  "\n  mutation CliUninstallSkill($tenantId: ID!, $skillId: String!) {\n    uninstallSkill(tenantId: $tenantId, skillId: $skillId)\n  }\n": CliUninstallSkillDocument,
   "\n  query CliTeams($tenantId: ID!) {\n    teams(tenantId: $tenantId) {\n      id\n      name\n      slug\n      type\n      status\n      budgetMonthlyCents\n      createdAt\n    }\n  }\n": CliTeamsDocument,
   "\n  query CliTeam($id: ID!) {\n    team(id: $id) {\n      id\n      name\n      slug\n      description\n      type\n      status\n      budgetMonthlyCents\n      createdAt\n      updatedAt\n      agents {\n        id\n        agentId\n        role\n        joinedAt\n      }\n      users {\n        id\n        userId\n        role\n        joinedAt\n      }\n    }\n  }\n": CliTeamDocument,
   "\n  mutation CliCreateTeam($input: CreateTeamInput!) {\n    createTeam(input: $input) {\n      id\n      name\n      type\n      status\n    }\n  }\n": CliCreateTeamDocument,
@@ -5038,15 +5042,15 @@ async function runThreadCreate(title, opts) {
 // src/commands/thread/update.ts
 async function runThreadUpdate(id, opts) {
   const ctx = await resolveThreadContext(opts);
-  const input20 = {};
-  if (opts.title !== void 0) input20.title = opts.title;
-  if (opts.assignee !== void 0) input20.assigneeId = opts.assignee;
-  if (opts.due !== void 0) input20.dueAt = opts.due;
-  if (Object.keys(input20).length === 0) {
+  const input21 = {};
+  if (opts.title !== void 0) input21.title = opts.title;
+  if (opts.assignee !== void 0) input21.assigneeId = opts.assignee;
+  if (opts.due !== void 0) input21.dueAt = opts.due;
+  if (Object.keys(input21).length === 0) {
     printError("Nothing to update. Pass at least one of --title, --assignee, --due.");
     process.exit(1);
   }
-  const data = await gqlMutate(ctx.client, UpdateThreadDoc, { id, input: input20 });
+  const data = await gqlMutate(ctx.client, UpdateThreadDoc, { id, input: input21 });
   const updated = data.updateThread;
   if (isJsonMode()) {
     printJson(updated);
@@ -5668,15 +5672,15 @@ async function runLabelCreate(name, opts) {
 }
 async function runLabelUpdate(id, opts) {
   const ctx = await resolveLabelContext(opts);
-  const input20 = {};
-  if (opts.name !== void 0) input20.name = opts.name;
-  if (opts.color !== void 0) input20.color = validateColor(opts.color);
-  if (opts.description !== void 0) input20.description = opts.description;
-  if (Object.keys(input20).length === 0) {
+  const input21 = {};
+  if (opts.name !== void 0) input21.name = opts.name;
+  if (opts.color !== void 0) input21.color = validateColor(opts.color);
+  if (opts.description !== void 0) input21.description = opts.description;
+  if (Object.keys(input21).length === 0) {
     printError("Nothing to update. Pass at least one of --name, --color, --description.");
     process.exit(1);
   }
-  const data = await gqlMutate(ctx.client, UpdateThreadLabelDoc, { id, input: input20 });
+  const data = await gqlMutate(ctx.client, UpdateThreadLabelDoc, { id, input: input21 });
   const updated = data.updateThreadLabel;
   if (isJsonMode()) {
     printJson(updated);
@@ -6714,19 +6718,19 @@ async function runAgentUpdate(id, opts) {
   if (!systemPrompt && opts.systemPromptFile) {
     systemPrompt = await readFile4(opts.systemPromptFile, "utf-8");
   }
-  const input20 = {};
-  if (opts.name !== void 0) input20.name = opts.name;
-  if (opts.role !== void 0) input20.role = opts.role;
-  if (opts.type !== void 0) input20.type = parseEnum(opts.type, TYPE_BY_NAME, "--type");
-  if (opts.parent !== void 0) input20.parentAgentId = opts.parent;
-  if (opts.reportsTo !== void 0) input20.reportsTo = opts.reportsTo;
-  if (systemPrompt !== void 0) input20.systemPrompt = systemPrompt;
-  if (opts.model !== void 0) input20.runtimeConfig = { model: opts.model };
-  if (Object.keys(input20).length === 0) {
+  const input21 = {};
+  if (opts.name !== void 0) input21.name = opts.name;
+  if (opts.role !== void 0) input21.role = opts.role;
+  if (opts.type !== void 0) input21.type = parseEnum(opts.type, TYPE_BY_NAME, "--type");
+  if (opts.parent !== void 0) input21.parentAgentId = opts.parent;
+  if (opts.reportsTo !== void 0) input21.reportsTo = opts.reportsTo;
+  if (systemPrompt !== void 0) input21.systemPrompt = systemPrompt;
+  if (opts.model !== void 0) input21.runtimeConfig = { model: opts.model };
+  if (Object.keys(input21).length === 0) {
     printError("Nothing to update. Pass at least one field flag.");
     process.exit(1);
   }
-  const data = await gqlMutate(ctx.client, UpdateAgentDoc, { id, input: input20 });
+  const data = await gqlMutate(ctx.client, UpdateAgentDoc, { id, input: input21 });
   if (isJsonMode()) {
     printJson(data.updateAgent);
     return;
@@ -7360,7 +7364,7 @@ function registerComputerCommand(program2) {
       const tenantId = resolveTenantId(opts);
       const computerId = resolveComputerId(opts);
       const taskType = resolveTaskType(opts);
-      const input20 = taskType === "workspace_file_write" ? { path: opts.path, content: opts.content } : void 0;
+      const input21 = taskType === "workspace_file_write" ? { path: opts.path, content: opts.content } : void 0;
       if (!isJsonMode()) printHeader("computer task enqueue", stage);
       const response = await apiFetchRaw(
         api.apiUrl,
@@ -7372,7 +7376,7 @@ function registerComputerCommand(program2) {
             tenantId,
             computerId,
             taskType,
-            input: input20,
+            input: input21,
             idempotencyKey: opts.idempotencyKey
           })
         }
@@ -7644,15 +7648,15 @@ async function runTemplateUpdate(id, opts) {
       "--system-prompt-file is not yet wired in the CLI \u2014 edit prompt files via the admin UI."
     );
   }
-  const input20 = {};
-  if (opts.name !== void 0) input20.name = opts.name;
-  if (opts.model !== void 0) input20.model = opts.model;
-  if (opts.description !== void 0) input20.description = opts.description;
-  if (Object.keys(input20).length === 0) {
+  const input21 = {};
+  if (opts.name !== void 0) input21.name = opts.name;
+  if (opts.model !== void 0) input21.model = opts.model;
+  if (opts.description !== void 0) input21.description = opts.description;
+  if (Object.keys(input21).length === 0) {
     printError("Nothing to update. Pass at least one of --name, --model, --description.");
     process.exit(1);
   }
-  const data = await gqlMutate(ctx.client, UpdateAgentTemplateDoc, { id, input: input20 });
+  const data = await gqlMutate(ctx.client, UpdateAgentTemplateDoc, { id, input: input21 });
   if (isJsonMode()) {
     printJson(data.updateAgentTemplate);
     return;
@@ -7974,15 +7978,15 @@ async function runTenantUpdate(id, opts) {
     printMissingApiSessionError(stage, false);
     process.exit(1);
   }
-  const input20 = {};
-  if (opts.name !== void 0) input20.name = opts.name;
-  if (opts.plan !== void 0) input20.plan = opts.plan;
-  if (opts.issuePrefix !== void 0) input20.issuePrefix = opts.issuePrefix;
-  if (Object.keys(input20).length === 0) {
+  const input21 = {};
+  if (opts.name !== void 0) input21.name = opts.name;
+  if (opts.plan !== void 0) input21.plan = opts.plan;
+  if (opts.issuePrefix !== void 0) input21.issuePrefix = opts.issuePrefix;
+  if (Object.keys(input21).length === 0) {
     printError("Nothing to update. Pass at least one of --name, --plan, --issue-prefix.");
     process.exit(1);
   }
-  const data = await gqlMutate(client, UpdateTenantDoc, { id, input: input20 });
+  const data = await gqlMutate(client, UpdateTenantDoc, { id, input: input21 });
   if (isJsonMode()) {
     printJson(data.updateTenant);
     return;
@@ -8020,18 +8024,18 @@ async function runTenantSettingsSet(tenantArg, opts) {
     stage: opts.stage,
     tenant: tenantArg
   });
-  const input20 = {};
-  if (opts.defaultModel !== void 0) input20.defaultModel = opts.defaultModel;
+  const input21 = {};
+  if (opts.defaultModel !== void 0) input21.defaultModel = opts.defaultModel;
   if (opts.monthlyBudgetUsd !== void 0) {
-    input20.budgetMonthlyCents = Math.round(Number.parseFloat(opts.monthlyBudgetUsd) * 100);
+    input21.budgetMonthlyCents = Math.round(Number.parseFloat(opts.monthlyBudgetUsd) * 100);
   }
-  if (opts.maxAgents !== void 0) input20.maxAgents = Number.parseInt(opts.maxAgents, 10);
+  if (opts.maxAgents !== void 0) input21.maxAgents = Number.parseInt(opts.maxAgents, 10);
   if (opts.autoCloseAfterDays !== void 0) {
-    input20.autoCloseThreadMinutes = Math.round(Number.parseFloat(opts.autoCloseAfterDays) * 60 * 24);
+    input21.autoCloseThreadMinutes = Math.round(Number.parseFloat(opts.autoCloseAfterDays) * 60 * 24);
   }
   const features = parseFeatureFlags(opts.feature);
-  if (features !== void 0) input20.features = JSON.stringify(features);
-  if (Object.keys(input20).length === 0) {
+  if (features !== void 0) input21.features = JSON.stringify(features);
+  if (Object.keys(input21).length === 0) {
     printError(
       "Nothing to set. Pass at least one of --default-model, --monthly-budget-usd, --max-agents, --auto-close-after-days, --feature."
     );
@@ -8039,7 +8043,7 @@ async function runTenantSettingsSet(tenantArg, opts) {
   }
   const data = await gqlMutate(ctx.client, UpdateTenantSettingsDoc, {
     tenantId: ctx.tenantId,
-    input: input20
+    input: input21
   });
   if (isJsonMode()) {
     printJson(data.updateTenantSettings);
@@ -8284,14 +8288,14 @@ async function runMemberInvite(email, opts) {
 }
 async function runMemberUpdate(memberId, opts) {
   const ctx = await resolveMemberContext(opts);
-  const input20 = {};
-  if (opts.role !== void 0) input20.role = opts.role;
-  if (opts.status !== void 0) input20.status = opts.status;
-  if (Object.keys(input20).length === 0) {
+  const input21 = {};
+  if (opts.role !== void 0) input21.role = opts.role;
+  if (opts.status !== void 0) input21.status = opts.status;
+  if (Object.keys(input21).length === 0) {
     printError("Nothing to update. Pass at least one of --role, --status.");
     process.exit(1);
   }
-  const data = await gqlMutate(ctx.client, UpdateTenantMemberDoc, { id: memberId, input: input20 });
+  const data = await gqlMutate(ctx.client, UpdateTenantMemberDoc, { id: memberId, input: input21 });
   const updated = data.updateTenantMember;
   if (isJsonMode()) {
     printJson(updated);
@@ -8575,18 +8579,18 @@ async function runTeamCreate(name, opts) {
 }
 async function runTeamUpdate(id, opts) {
   const ctx = await resolveTeamContext(opts);
-  const input20 = {};
-  if (opts.name !== void 0) input20.name = opts.name;
-  if (opts.description !== void 0) input20.description = opts.description;
-  if (opts.status !== void 0) input20.status = opts.status;
+  const input21 = {};
+  if (opts.name !== void 0) input21.name = opts.name;
+  if (opts.description !== void 0) input21.description = opts.description;
+  if (opts.status !== void 0) input21.status = opts.status;
   if (opts.budgetUsd !== void 0) {
-    input20.budgetMonthlyCents = Math.round(Number.parseFloat(opts.budgetUsd) * 100);
+    input21.budgetMonthlyCents = Math.round(Number.parseFloat(opts.budgetUsd) * 100);
   }
-  if (Object.keys(input20).length === 0) {
+  if (Object.keys(input21).length === 0) {
     printError("Nothing to update. Pass at least one of --name, --description, --status, --budget-usd.");
     process.exit(1);
   }
-  const data = await gqlMutate(ctx.client, UpdateTeamDoc, { id, input: input20 });
+  const data = await gqlMutate(ctx.client, UpdateTeamDoc, { id, input: input21 });
   if (isJsonMode()) {
     printJson(data.updateTeam);
     return;
@@ -8910,14 +8914,14 @@ async function runKbCreate(name, opts) {
 }
 async function runKbUpdate(id, opts) {
   const ctx = await resolveKbContext(opts);
-  const input20 = {};
-  if (opts.name !== void 0) input20.name = opts.name;
-  if (opts.description !== void 0) input20.description = opts.description;
-  if (Object.keys(input20).length === 0) {
+  const input21 = {};
+  if (opts.name !== void 0) input21.name = opts.name;
+  if (opts.description !== void 0) input21.description = opts.description;
+  if (Object.keys(input21).length === 0) {
     printError("Nothing to update. Pass at least one of --name, --description.");
     process.exit(1);
   }
-  const data = await gqlMutate(ctx.client, UpdateKBDoc, { id, input: input20 });
+  const data = await gqlMutate(ctx.client, UpdateKBDoc, { id, input: input21 });
   if (isJsonMode()) {
     printJson(data.updateKnowledgeBase);
     return;
@@ -9366,12 +9370,12 @@ async function runRoutineCreate(name, opts) {
 }
 async function runRoutineUpdate(id, opts) {
   const ctx = await resolveRoutineContext(opts);
-  const input20 = {};
-  if (opts.name !== void 0) input20.name = opts.name;
-  if (opts.status !== void 0) input20.status = opts.status;
-  if (opts.agent !== void 0) input20.agentId = opts.agent;
-  if (opts.team !== void 0) input20.teamId = opts.team;
-  if (Object.keys(input20).length === 0) {
+  const input21 = {};
+  if (opts.name !== void 0) input21.name = opts.name;
+  if (opts.status !== void 0) input21.status = opts.status;
+  if (opts.agent !== void 0) input21.agentId = opts.agent;
+  if (opts.team !== void 0) input21.teamId = opts.team;
+  if (Object.keys(input21).length === 0) {
     printError("Nothing to update.");
     process.exit(1);
   }
@@ -9381,7 +9385,7 @@ async function runRoutineUpdate(id, opts) {
     );
     process.exit(1);
   }
-  const data = await gqlMutate(ctx.client, UpdateRoutineDoc, { id, input: input20 });
+  const data = await gqlMutate(ctx.client, UpdateRoutineDoc, { id, input: input21 });
   if (isJsonMode()) {
     printJson(data.updateRoutine);
     return;
@@ -9861,18 +9865,18 @@ async function runSchedDelete(id, opts) {
 }
 async function runSchedUpdate(id, opts) {
   const ctx = await resolveSchedContext(opts);
-  const input20 = {};
-  if (opts.name !== void 0) input20.name = opts.name;
-  if (opts.description !== void 0) input20.description = opts.description;
-  if (opts.prompt !== void 0) input20.prompt = opts.prompt;
+  const input21 = {};
+  if (opts.name !== void 0) input21.name = opts.name;
+  if (opts.description !== void 0) input21.description = opts.description;
+  if (opts.prompt !== void 0) input21.prompt = opts.prompt;
   if (opts.schedule !== void 0) {
-    input20.scheduleExpression = opts.schedule;
-    input20.scheduleType = opts.schedule.trim().startsWith("cron(") ? "cron" : "rate";
+    input21.scheduleExpression = opts.schedule;
+    input21.scheduleType = opts.schedule.trim().startsWith("cron(") ? "cron" : "rate";
   }
-  if (opts.timezone !== void 0) input20.timezone = opts.timezone;
+  if (opts.timezone !== void 0) input21.timezone = opts.timezone;
   if (opts.payload !== void 0) {
     try {
-      input20.config = JSON.stringify(JSON.parse(opts.payload));
+      input21.config = JSON.stringify(JSON.parse(opts.payload));
     } catch (err) {
       printError(`--payload is not valid JSON: ${err.message}`);
       process.exit(1);
@@ -9882,9 +9886,9 @@ async function runSchedUpdate(id, opts) {
     printError("--enable and --disable are mutually exclusive.");
     process.exit(1);
   }
-  if (opts.enable) input20.enabled = true;
-  if (opts.disable) input20.enabled = false;
-  if (Object.keys(input20).length === 0) {
+  if (opts.enable) input21.enabled = true;
+  if (opts.disable) input21.enabled = false;
+  if (Object.keys(input21).length === 0) {
     printError(
       "Nothing to update. Pass at least one of --schedule, --timezone, --payload, --enable/--disable, --name, --description, --prompt."
     );
@@ -9892,7 +9896,7 @@ async function runSchedUpdate(id, opts) {
   }
   const data = await gqlMutate(ctx.client, UpdateScheduledJobDoc, {
     id,
-    input: input20
+    input: input21
   });
   if (isJsonMode()) {
     printJson(data.updateScheduledJob);
@@ -10603,25 +10607,25 @@ async function runWebhookCreate(name, opts) {
 }
 async function runWebhookUpdate(id, opts) {
   const ctx = await resolveWebhookContext(opts);
-  const input20 = {};
-  if (opts.targetType !== void 0) input20.targetType = opts.targetType.toUpperCase();
+  const input21 = {};
+  if (opts.targetType !== void 0) input21.targetType = opts.targetType.toUpperCase();
   if (opts.targetId !== void 0) {
     const tt = (opts.targetType ?? "").toUpperCase();
-    if (tt === "AGENT") input20.agentId = opts.targetId;
-    else if (tt === "ROUTINE") input20.routineId = opts.targetId;
+    if (tt === "AGENT") input21.agentId = opts.targetId;
+    else if (tt === "ROUTINE") input21.routineId = opts.targetId;
     else {
       printError("--target-id requires --target-type <AGENT|ROUTINE> on the same call.");
       process.exit(1);
     }
   }
-  if (opts.rateLimit !== void 0) input20.rateLimit = Number.parseInt(opts.rateLimit, 10);
-  if (opts.enable) input20.enabled = true;
-  if (opts.disable) input20.enabled = false;
-  if (Object.keys(input20).length === 0) {
+  if (opts.rateLimit !== void 0) input21.rateLimit = Number.parseInt(opts.rateLimit, 10);
+  if (opts.enable) input21.enabled = true;
+  if (opts.disable) input21.enabled = false;
+  if (Object.keys(input21).length === 0) {
     printError("Nothing to update.");
     process.exit(1);
   }
-  const data = await gqlMutate(ctx.client, UpdateWebhookDoc, { id, input: input20 });
+  const data = await gqlMutate(ctx.client, UpdateWebhookDoc, { id, input: input21 });
   if (isJsonMode()) {
     printJson(data.updateWebhook);
     return;
@@ -10786,6 +10790,9 @@ Examples:
   ).option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--limit <n>", "Max rows (1-500)", "25").action(runWebhookDeliveries);
 }
 
+// src/commands/skill.ts
+import { input as input18 } from "@inquirer/prompts";
+
 // src/lib/plugin-zip.ts
 import { createReadStream, promises as fsp, statSync } from "fs";
 import { basename, join as join5, relative, resolve as resolve3, sep } from "path";
@@ -10926,12 +10933,12 @@ function hasParentSegment(relPath) {
 }
 
 // src/lib/plugin-push.ts
-async function pushPluginZip(input20) {
-  const base = input20.apiUrl.replace(/\/+$/, "");
+async function pushPluginZip(input21) {
+  const base = input21.apiUrl.replace(/\/+$/, "");
   const presignRes = await fetch(`${base}/api/plugins/presign`, {
     method: "POST",
-    headers: withJson(input20.headers),
-    body: JSON.stringify({ fileName: input20.fileName })
+    headers: withJson(input21.headers),
+    body: JSON.stringify({ fileName: input21.fileName })
   });
   if (!presignRes.ok) {
     throw new Error(`presign failed: ${await describeHttpError(presignRes)}`);
@@ -10945,14 +10952,14 @@ async function pushPluginZip(input20) {
   const putRes = await fetch(presign.uploadUrl, {
     method: "PUT",
     headers: { "Content-Type": "application/zip" },
-    body: new Uint8Array(input20.zipBuffer)
+    body: new Uint8Array(input21.zipBuffer)
   });
   if (!putRes.ok) {
     throw new Error(`S3 PUT failed: HTTP ${putRes.status}`);
   }
   const installRes = await fetch(`${base}/api/plugins/upload`, {
     method: "POST",
-    headers: withJson(input20.headers),
+    headers: withJson(input21.headers),
     body: JSON.stringify({ s3Key: presign.s3Key })
   });
   const installBody = await installRes.json().catch(() => ({}));
@@ -11015,14 +11022,59 @@ var SkillTenantBySlugDoc = graphql(`
     }
   }
 `);
+var InstallSkillDoc = graphql(`
+  mutation CliInstallSkill($input: InstallSkillInput!) {
+    installSkill(input: $input) {
+      id
+      tenantId
+      skillId
+      source
+      version
+      catalogVersion
+      enabled
+      installedAt
+      updatedAt
+    }
+  }
+`);
+var UninstallSkillDoc = graphql(`
+  mutation CliUninstallSkill($tenantId: ID!, $skillId: String!) {
+    uninstallSkill(tenantId: $tenantId, skillId: $skillId)
+  }
+`);
 async function resolveSkillContext(opts) {
   const region = opts.region ?? "us-east-1";
   const stage = await resolveStage({ flag: opts.stage, region });
   const session = loadStageSession(stage);
-  const { client } = await getGqlClient({ stage, region });
+  const { client, tenantSlug: ctxSlug } = await getGqlClient({ stage, region });
   if (!session) {
   }
-  return { stage, region, client };
+  return { stage, region, client, session, ctxSlug };
+}
+async function resolveTenantIdForSkill(ctx, tenantOpt) {
+  const flagOrEnv = tenantOpt ?? process.env.THINKWORK_TENANT;
+  if (flagOrEnv) {
+    if (ctx.session?.tenantSlug === flagOrEnv && ctx.session.tenantId) {
+      return ctx.session.tenantId;
+    }
+    const data = await gqlQuery(ctx.client, SkillTenantBySlugDoc, {
+      slug: flagOrEnv
+    });
+    if (!data.tenantBySlug) {
+      printError(`Tenant "${flagOrEnv}" not found.`);
+      process.exit(1);
+    }
+    return data.tenantBySlug.id;
+  }
+  if (ctx.session?.tenantId) return ctx.session.tenantId;
+  if (ctx.ctxSlug) {
+    const data = await gqlQuery(ctx.client, SkillTenantBySlugDoc, {
+      slug: ctx.ctxSlug
+    });
+    if (data.tenantBySlug) return data.tenantBySlug.id;
+  }
+  printMissingApiSessionError(ctx.stage, ctx.session !== null);
+  process.exit(1);
 }
 async function runSkillCatalog(opts) {
   const ctx = await resolveSkillContext(opts);
@@ -11087,13 +11139,59 @@ async function runSkillList(opts) {
     ]
   );
 }
-function notYetImplementedAtApi(verb) {
+async function runSkillInstall(slug, opts) {
+  const ctx = await resolveSkillContext(opts);
+  const tenantId = await resolveTenantIdForSkill(ctx, opts.tenant);
+  const data = await gqlMutate(ctx.client, InstallSkillDoc, {
+    input: { tenantId, skillId: slug, version: opts.version ?? null }
+  });
+  if (isJsonMode()) {
+    printJson(data.installSkill);
+    return;
+  }
+  printSuccess(
+    `Installed skill ${data.installSkill.skillId} (source=${data.installSkill.source}, version=${data.installSkill.version ?? "\u2014"}).`
+  );
+}
+async function runSkillDelete(slug, opts) {
+  const ctx = await resolveSkillContext(opts);
+  const tenantId = await resolveTenantIdForSkill(ctx, opts.tenant);
+  if (!opts.yes) {
+    if (!isInteractive()) {
+      printError(
+        "Refusing to uninstall without --yes in non-interactive mode."
+      );
+      process.exit(1);
+    }
+    requireTty("confirmation");
+    const answer = await promptOrExit(
+      () => input18({
+        message: `Uninstall skill "${slug}" from this tenant? Type "uninstall" to confirm:`
+      })
+    );
+    if (answer.trim() !== "uninstall") {
+      console.log("  Cancelled.");
+      return;
+    }
+  }
+  const data = await gqlMutate(ctx.client, UninstallSkillDoc, {
+    tenantId,
+    skillId: slug
+  });
+  if (isJsonMode()) {
+    printJson({ skillId: slug, uninstalled: data.uninstallSkill });
+    return;
+  }
+  if (data.uninstallSkill) {
+    printSuccess(`Uninstalled skill ${slug} from tenant.`);
+  } else {
+    console.log(`  Skill "${slug}" was not installed (no-op).`);
+  }
+}
+function retiredVerb(verb, hint) {
   printError(
-    `\`skill ${verb}\` is not yet implemented at the GraphQL API.
-  The current schema exposes skillCatalog (read), per-computer enableSkill/disableSkill,
-  and the REST \`skill push\` upload path. Tenant-scoped install/upgrade/create/update/delete
-  is tracked as a Phase-3 follow-up. Use \`thinkwork skill push <folder>\` to upload custom
-  plugins; toggle catalog skills per-agent via \`thinkwork agent skills set\` for now.`
+    `\`skill ${verb}\` was retired: ${hint}
+  See \`thinkwork skill --help\` for the supported verbs.`
   );
   process.exit(2);
 }
@@ -11103,11 +11201,27 @@ function registerSkillCommand(program2) {
   );
   skill.command("catalog").description("Browse the skill catalog. Client-side filters --search and --tag are applied locally.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--search <q>", "Filter by keyword").option("--tag <t>", "Filter by category").action(runSkillCatalog);
   skill.command("list").alias("ls").description("List skills available to the tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--custom-only", "Only show tenant-owned custom skills (source=tenant)").action(runSkillList);
-  skill.command("install <slug>").description("Install a public skill. (API surface pending \u2014 toggle per-agent via `agent skills set`.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--version <v>", "Pin to a specific version").action(() => notYetImplementedAtApi("install"));
-  skill.command("upgrade <slug>").description("Upgrade an installed skill. (API surface pending.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplementedAtApi("upgrade"));
-  skill.command("create [slug]").description("Publish a custom tenant-scoped skill. (Use `skill push <folder>` for now.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--name <n>").option("--description <text>").option("--manifest-file <path>", "Path to the MCP server manifest JSON").option("--endpoint <url>", "MCP server HTTP/SSE endpoint").action(() => notYetImplementedAtApi("create"));
-  skill.command("update <slug>").description("Update a custom skill. (API surface pending.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--name <n>").option("--description <text>").option("--manifest-file <path>").option("--endpoint <url>").action(() => notYetImplementedAtApi("update"));
-  skill.command("delete <slug>").description("Delete a custom skill. (API surface pending.)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplementedAtApi("delete"));
+  skill.command("install <slug>").description(
+    "Install a catalog skill into the tenant (upserts tenant_skills). Idempotent \u2014 re-running bumps the version. Per-agent assignment still goes through `agent skills set`."
+  ).option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--version <v>", "Pin to a specific version (defaults to catalog's current)").action(runSkillInstall);
+  skill.command("upgrade <slug>").description(
+    "Upgrade an installed skill to the catalog's current version (or to --version). Same mutation as `install`."
+  ).option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--version <v>", "Pin to a specific version").action(runSkillInstall);
+  skill.command("create [slug]").description("Retired \u2014 use `thinkwork skill push <folder>` to publish a custom skill.").action(
+    () => retiredVerb(
+      "create",
+      "custom-skill authoring is done by uploading a folder via `thinkwork skill push <folder>`."
+    )
+  );
+  skill.command("update <slug>").description("Retired \u2014 re-push the skill folder with `thinkwork skill push <folder>` to update.").action(
+    () => retiredVerb(
+      "update",
+      "updates are done by re-pushing the skill folder via `thinkwork skill push <folder>`."
+    )
+  );
+  skill.command("delete <slug>").description(
+    "Uninstall a skill from the tenant (deletes the tenant_skills row). Confirms unless --yes."
+  ).option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(runSkillDelete);
   skill.command("push <folder>").description(
     "Zip a local plugin folder and upload it to the tenant as a pending plugin."
   ).option("-s, --stage <name>", "Deployment stage").option("--region <name>", "AWS region", "us-east-1").addHelpText(
@@ -11471,7 +11585,7 @@ function registerMemoryCommand(program2) {
 }
 
 // src/commands/recipe.ts
-import { confirm as confirm15, input as input18 } from "@inquirer/prompts";
+import { confirm as confirm15, input as input19 } from "@inquirer/prompts";
 var RecipesDoc = graphql(`
   query CliRecipes($tenantId: ID!, $threadId: ID, $agentId: ID, $limit: Int, $cursor: String) {
     recipes(tenantId: $tenantId, threadId: $threadId, agentId: $agentId, limit: $limit, cursor: $cursor) {
@@ -11627,7 +11741,7 @@ async function runRecipeCreate(name, opts) {
       process.exit(1);
     }
     requireTty("Recipe name");
-    title = await promptOrExit(() => input18({ message: "Recipe title:" }));
+    title = await promptOrExit(() => input19({ message: "Recipe title:" }));
   }
   if (!opts.tool) {
     printError("--tool <server/tool> is required.");
@@ -11668,22 +11782,22 @@ async function runRecipeCreate(name, opts) {
 }
 async function runRecipeUpdate(id, opts) {
   const ctx = await resolveRecipeContext(opts);
-  const input20 = {};
-  if (opts.title !== void 0) input20.title = opts.title;
-  if (opts.summary !== void 0) input20.summary = opts.summary;
+  const input21 = {};
+  if (opts.title !== void 0) input21.title = opts.title;
+  if (opts.summary !== void 0) input21.summary = opts.summary;
   if (opts.params !== void 0) {
     try {
-      input20.params = JSON.parse(opts.params);
+      input21.params = JSON.parse(opts.params);
     } catch (err) {
       printError(`--params is not valid JSON: ${err.message}`);
       process.exit(1);
     }
   }
-  if (Object.keys(input20).length === 0) {
+  if (Object.keys(input21).length === 0) {
     printError("Nothing to update.");
     process.exit(1);
   }
-  const data = await gqlMutate(ctx.client, UpdateRecipeDoc, { id, input: input20 });
+  const data = await gqlMutate(ctx.client, UpdateRecipeDoc, { id, input: input21 });
   if (isJsonMode()) {
     printJson(data.updateRecipe);
     return;
@@ -13264,7 +13378,7 @@ async function runEvalTestCaseGet(id, opts) {
 
 // src/commands/eval/test-case/create.ts
 import { readFileSync as readFileSync4 } from "fs";
-import { input as input19, select as select8, checkbox as checkbox2 } from "@inquirer/prompts";
+import { input as input20, select as select8, checkbox as checkbox2 } from "@inquirer/prompts";
 var DEFAULT_EVALUATORS = [
   "Builtin.Helpfulness",
   "Builtin.Correctness",
@@ -13294,17 +13408,17 @@ async function runEvalTestCaseCreate(opts) {
   if (!name) {
     requireTty("Name");
     name = await promptOrExit(
-      () => input19({ message: "Test case name?", validate: (v) => v.trim().length > 0 || "Required" })
+      () => input20({ message: "Test case name?", validate: (v) => v.trim().length > 0 || "Required" })
     );
   }
   if (!category) {
     category = await promptOrExit(
-      () => input19({ message: "Category (free-form label)?", validate: (v) => v.trim().length > 0 || "Required" })
+      () => input20({ message: "Category (free-form label)?", validate: (v) => v.trim().length > 0 || "Required" })
     );
   }
   if (!query) {
     query = await promptOrExit(
-      () => input19({ message: "Query the agent under test will receive?", validate: (v) => v.trim().length > 0 || "Required" })
+      () => input20({ message: "Query the agent under test will receive?", validate: (v) => v.trim().length > 0 || "Required" })
     );
   }
   if (interactive && agentTemplateId === null) {
@@ -13370,28 +13484,28 @@ async function runEvalTestCaseCreate(opts) {
 import { readFileSync as readFileSync5 } from "fs";
 async function runEvalTestCaseUpdate(id, opts) {
   const ctx = await resolveEvalContext(opts);
-  const input20 = {};
-  if (opts.name !== void 0) input20.name = opts.name;
-  if (opts.category !== void 0) input20.category = opts.category;
-  if (opts.query !== void 0) input20.query = opts.query;
-  if (opts.systemPrompt !== void 0) input20.systemPrompt = opts.systemPrompt;
-  if (opts.agentTemplate !== void 0) input20.agentTemplateId = opts.agentTemplate;
-  if (opts.evaluator !== void 0) input20.agentcoreEvaluatorIds = opts.evaluator;
-  if (opts.tag !== void 0) input20.tags = opts.tag;
-  if (opts.enabled !== void 0) input20.enabled = opts.enabled;
+  const input21 = {};
+  if (opts.name !== void 0) input21.name = opts.name;
+  if (opts.category !== void 0) input21.category = opts.category;
+  if (opts.query !== void 0) input21.query = opts.query;
+  if (opts.systemPrompt !== void 0) input21.systemPrompt = opts.systemPrompt;
+  if (opts.agentTemplate !== void 0) input21.agentTemplateId = opts.agentTemplate;
+  if (opts.evaluator !== void 0) input21.agentcoreEvaluatorIds = opts.evaluator;
+  if (opts.tag !== void 0) input21.tags = opts.tag;
+  if (opts.enabled !== void 0) input21.enabled = opts.enabled;
   if (opts.assertionsFile) {
     const parsed = JSON.parse(readFileSync5(opts.assertionsFile, "utf8"));
     if (!Array.isArray(parsed)) {
       printError(`--assertions-file must contain a JSON array.`);
       process.exit(1);
     }
-    input20.assertions = parsed;
+    input21.assertions = parsed;
   }
-  if (Object.keys(input20).length === 0) {
+  if (Object.keys(input21).length === 0) {
     printError("No fields to update. Pass at least one --<field>.");
     process.exit(1);
   }
-  const res = await gqlMutate(ctx.client, UpdateEvalTestCaseDoc, { id, input: input20 });
+  const res = await gqlMutate(ctx.client, UpdateEvalTestCaseDoc, { id, input: input21 });
   if (isJsonMode()) {
     printJson(res.updateEvalTestCase);
     return;
@@ -14852,12 +14966,12 @@ function awsOk(args) {
 
 // src/commands/enterprise/github.ts
 import { execFileSync as execFileSync2 } from "child_process";
-function parseGitHubRepository(input20) {
-  const trimmed = input20.trim();
+function parseGitHubRepository(input21) {
+  const trimmed = input21.trim();
   const match = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/.exec(trimmed);
   if (!match) {
     throw new Error(
-      `Invalid GitHub repository "${input20}". Use owner/name, for example acme/thinkwork-deploy.`
+      `Invalid GitHub repository "${input21}". Use owner/name, for example acme/thinkwork-deploy.`
     );
   }
   return {
@@ -15222,16 +15336,16 @@ async function resolveCustomerSlug(flag) {
   if (!process.stdin.isTTY) {
     throw new Error("Customer slug is required. Pass --customer <slug>.");
   }
-  const { input: input20 } = await import("@inquirer/prompts");
-  return input20({ message: "Customer slug:" });
+  const { input: input21 } = await import("@inquirer/prompts");
+  return input21({ message: "Customer slug:" });
 }
 async function resolveRepository(flag) {
   if (flag) return flag;
   if (!process.stdin.isTTY) {
     throw new Error("GitHub repository is required. Pass --repo <owner/name>.");
   }
-  const { input: input20 } = await import("@inquirer/prompts");
-  return input20({ message: "GitHub deployment repo (owner/name):" });
+  const { input: input21 } = await import("@inquirer/prompts");
+  return input21({ message: "GitHub deployment repo (owner/name):" });
 }
 function printBootstrapSummary(result) {
   console.log("");
@@ -15485,7 +15599,7 @@ async function applyEnterpriseOverlay(plan, client) {
         skipped: 0
       };
       for (const testCase of operation.testCases) {
-        const input20 = withOverlayTags(
+        const input21 = withOverlayTags(
           operation.pack,
           testCase,
           client.targetAgentTemplateId
@@ -15494,16 +15608,16 @@ async function applyEnterpriseOverlay(plan, client) {
           overlayKeyTag(operation.pack, testCase)
         );
         if (existingCase) {
-          if (sameEval(existingCase, input20)) {
+          if (sameEval(existingCase, input21)) {
             result.evals.skipped++;
             packResult.skipped++;
           } else {
-            await client.updateEvalTestCase(existingCase.id, input20);
+            await client.updateEvalTestCase(existingCase.id, input21);
             result.evals.updated++;
             packResult.updated++;
           }
         } else {
-          await client.createEvalTestCase(input20);
+          await client.createEvalTestCase(input21);
           result.evals.inserted++;
           packResult.inserted++;
         }
@@ -15673,19 +15787,19 @@ async function createOverlayApiClient(plan, opts) {
       });
       return data.evalTestCases;
     },
-    async createEvalTestCase(input20) {
+    async createEvalTestCase(input21) {
       await gqlMutate(ctx.client, CreateEvalTestCaseDoc, {
         tenantId: ctx.tenantId,
-        input: evalInput(input20)
+        input: evalInput(input21)
       });
     },
-    async updateEvalTestCase(id, input20) {
+    async updateEvalTestCase(id, input21) {
       await gqlMutate(ctx.client, UpdateEvalTestCaseDoc, {
         id,
-        input: evalInput(input20)
+        input: evalInput(input21)
       });
     },
-    async putWorkspaceFile(input20) {
+    async putWorkspaceFile(input21) {
       const response = await fetch(
         `${apiUrl.replace(/\/+$/, "")}/api/workspaces/files`,
         {
@@ -15698,15 +15812,15 @@ async function createOverlayApiClient(plan, opts) {
           body: JSON.stringify({
             action: "put",
             templateId,
-            path: input20.path,
-            content: input20.content
+            path: input21.path,
+            content: input21.content
           })
         }
       );
       if (!response.ok) {
         const text = await response.text();
         throw new Error(
-          `PUT ${input20.path} failed: ${response.status} ${text || response.statusText}`
+          `PUT ${input21.path} failed: ${response.status} ${text || response.statusText}`
         );
       }
     }
@@ -15724,17 +15838,17 @@ async function resolveTemplateId(client, tenantId, templateSlug) {
   }
   return template.id;
 }
-function evalInput(input20) {
+function evalInput(input21) {
   return {
-    name: input20.name,
-    category: input20.category,
-    query: input20.query,
-    systemPrompt: input20.systemPrompt ?? null,
-    agentTemplateId: input20.agentTemplateId ?? null,
-    assertions: input20.assertions,
-    agentcoreEvaluatorIds: input20.agentcoreEvaluatorIds ?? [],
-    tags: input20.tags ?? [],
-    enabled: input20.enabled ?? true
+    name: input21.name,
+    category: input21.category,
+    query: input21.query,
+    systemPrompt: input21.systemPrompt ?? null,
+    agentTemplateId: input21.agentTemplateId ?? null,
+    assertions: input21.assertions,
+    agentcoreEvaluatorIds: input21.agentcoreEvaluatorIds ?? [],
+    tags: input21.tags ?? [],
+    enabled: input21.enabled ?? true
   };
 }
 function publicPlan(plan) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkwork-cli",
-  "version": "0.12.7",
+  "version": "0.12.9",
   "description": "Thinkwork CLI — deploy, manage, and interact with your Thinkwork stack",
   "license": "Apache-2.0",
   "type": "module",