thinkwork-cli 0.8.0 → 0.8.1

package/dist/cli.js

@@ -251,41 +251,141 @@ function printSummary(command, stage, tiers, startTime) {
   console.log(chalk2.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
 }
 
-// src/commands/plan.ts
-function registerPlanCommand(program2) {
-  program2.command("plan").description("Run terraform plan for a stage").option("-p, --profile <name>", "AWS profile").requiredOption("-s, --stage <name>", "Deployment stage").option("-c, --component <tier>", "Component tier (foundation|data|app|all)", "all").action(async (opts) => {
-    const startTime = Date.now();
-    const stageCheck = validateStage(opts.stage);
-    if (!stageCheck.valid) {
-      printError(stageCheck.error);
-      process.exit(1);
+// src/lib/resolve-stage.ts
+import { select } from "@inquirer/prompts";
+
+// src/aws-discovery.ts
+import { execSync as execSync2 } from "child_process";
+function runAws(cmd) {
+  try {
+    return execSync2(`aws ${cmd}`, {
+      encoding: "utf-8",
+      timeout: 15e3,
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function listDeployedStages(region) {
+  const raw = runAws(
+    `lambda list-functions --region ${region} --query "Functions[?starts_with(FunctionName, 'thinkwork-')].FunctionName" --output json`
+  );
+  if (!raw) return [];
+  try {
+    const functions = JSON.parse(raw);
+    const stages = /* @__PURE__ */ new Set();
+    for (const fn of functions) {
+      const m = fn.match(/^thinkwork-(.+?)-api-graphql-http$/);
+      if (m) stages.add(m[1]);
     }
-    const compCheck = validateComponent(opts.component);
-    if (!compCheck.valid) {
-      printError(compCheck.error);
+    return [...stages].sort();
+  } catch {
+    return [];
+  }
+}
+function getApiEndpoint(stage, region) {
+  const raw = runAws(
+    `apigatewayv2 get-apis --region ${region} --query "Items[?Name=='thinkwork-${stage}-api'].ApiEndpoint|[0]" --output text`
+  );
+  return raw && raw !== "None" ? raw : null;
+}
+function getApiAuthSecretFromLambda(stage, region) {
+  const raw = runAws(
+    `lambda get-function-configuration --function-name thinkwork-${stage}-api-tenants --region ${region} --query "Environment.Variables.API_AUTH_SECRET" --output text`
+  );
+  return raw && raw !== "None" ? raw : null;
+}
+
+// src/lib/interactive.ts
+function isCancellation(err) {
+  return err instanceof Error && err.name === "ExitPromptError";
+}
+function isInteractive() {
+  return Boolean(process.stdin.isTTY);
+}
+function requireTty(label) {
+  if (!isInteractive()) {
+    printError(
+      `${label} is required. Pass it as a flag or re-run in an interactive terminal.`
+    );
+    process.exit(1);
+  }
+}
+
+// src/lib/resolve-stage.ts
+async function resolveStage(opts = {}) {
+  const region = opts.region ?? "us-east-1";
+  const validate = opts.validate ?? true;
+  const raw = opts.flag ?? process.env.THINKWORK_STAGE ?? loadCliConfig().defaultStage ?? await pickStage(region);
+  if (!raw) {
+    printError(
+      "No stage specified. Pass `--stage <name>`, set THINKWORK_STAGE, or run `thinkwork login --stage <name>`."
+    );
+    process.exit(1);
+  }
+  if (validate) {
+    const check = validateStage(raw);
+    if (!check.valid) {
+      printError(check.error);
       process.exit(1);
     }
-    const identity = getAwsIdentity();
-    printHeader("plan", opts.stage, identity);
-    const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
-    const tiers = expandComponent(opts.component);
-    for (let i = 0; i < tiers.length; i++) {
-      const tier = tiers[i];
-      printTierHeader(tier, i, tiers.length);
-      const cwd = resolveTierDir(terraformDir, opts.stage, tier);
-      await ensureInit(cwd);
-      await ensureWorkspace(cwd, opts.stage);
-      const code = await runTerraform(cwd, [
-        "plan",
-        `-var=stage=${opts.stage}`
-      ]);
-      if (code !== 0) {
-        printError(`Plan failed for ${tier} (exit ${code})`);
-        process.exit(code);
+  }
+  return raw;
+}
+async function pickStage(region) {
+  const stages = listDeployedStages(region);
+  if (stages.length === 0) {
+    printError(
+      `No Thinkwork deployments found in ${region}. Run \`thinkwork list\` or pass --region.`
+    );
+    process.exit(1);
+  }
+  if (stages.length === 1) {
+    console.log(`  Using the only deployed stage: ${stages[0]}`);
+    return stages[0];
+  }
+  requireTty("Stage");
+  return await select({
+    message: "Which stage?",
+    choices: stages.map((s) => ({ name: s, value: s })),
+    loop: false
+  });
+}
+
+// src/commands/plan.ts
+function registerPlanCommand(program2) {
+  program2.command("plan").description("Run terraform plan for a stage. Prompts for stage in a TTY when omitted.").option("-p, --profile <name>", "AWS profile").option("-s, --stage <name>", "Deployment stage").option("-c, --component <tier>", "Component tier (foundation|data|app|all)", "all").action(async (opts) => {
+    const startTime = Date.now();
+    try {
+      const stage = await resolveStage({ flag: opts.stage });
+      const compCheck = validateComponent(opts.component);
+      if (!compCheck.valid) {
+        printError(compCheck.error);
+        process.exit(1);
+      }
+      const identity = getAwsIdentity();
+      printHeader("plan", stage, identity);
+      const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
+      const tiers = expandComponent(opts.component);
+      for (let i = 0; i < tiers.length; i++) {
+        const tier = tiers[i];
+        printTierHeader(tier, i, tiers.length);
+        const cwd = resolveTierDir(terraformDir, stage, tier);
+        await ensureInit(cwd);
+        await ensureWorkspace(cwd, stage);
+        const code = await runTerraform(cwd, ["plan", `-var=stage=${stage}`]);
+        if (code !== 0) {
+          printError(`Plan failed for ${tier} (exit ${code})`);
+          process.exit(code);
+        }
       }
+      printSuccess("Plan complete");
+      printSummary("plan", stage, tiers, startTime);
+    } catch (err) {
+      if (isCancellation(err)) return;
+      throw err;
     }
-    printSuccess("Plan complete");
-    printSummary("plan", opts.stage, tiers, startTime);
   });
 }
 
@@ -306,131 +406,129 @@ async function confirm(message) {
 
 // src/commands/deploy.ts
 function registerDeployCommand(program2) {
-  program2.command("deploy").description("Run terraform apply for a stage").option("-p, --profile <name>", "AWS profile").requiredOption("-s, --stage <name>", "Deployment stage").option("-c, --component <tier>", "Component tier (foundation|data|app|all)", "all").option("-y, --yes", "Skip interactive confirmation (for CI)").action(async (opts) => {
+  program2.command("deploy").description("Run terraform apply for a stage. Prompts for stage in a TTY when omitted.").option("-p, --profile <name>", "AWS profile").option("-s, --stage <name>", "Deployment stage").option("-c, --component <tier>", "Component tier (foundation|data|app|all)", "all").option("-y, --yes", "Skip interactive confirmation (for CI)").action(async (opts) => {
     const startTime = Date.now();
-    const stageCheck = validateStage(opts.stage);
-    if (!stageCheck.valid) {
-      printError(stageCheck.error);
-      process.exit(1);
-    }
-    const compCheck = validateComponent(opts.component);
-    if (!compCheck.valid) {
-      printError(compCheck.error);
-      process.exit(1);
-    }
-    const identity = getAwsIdentity();
-    printHeader("deploy", opts.stage, identity);
-    if (!identity) {
-      printWarning("Could not resolve AWS identity. Is the AWS CLI configured?");
-    }
-    if (isProdLike(opts.stage) && !opts.yes) {
-      const ok = await confirm(
-        `  Stage "${opts.stage}" is production-like. Deploy?`
-      );
-      if (!ok) {
-        console.log("  Aborted.");
-        process.exit(0);
+    try {
+      const stage = await resolveStage({ flag: opts.stage });
+      const compCheck = validateComponent(opts.component);
+      if (!compCheck.valid) {
+        printError(compCheck.error);
+        process.exit(1);
       }
-    } else if (!opts.yes) {
-      const ok = await confirm(`  Deploy to stage "${opts.stage}"?`);
-      if (!ok) {
-        console.log("  Aborted.");
-        process.exit(0);
+      const identity = getAwsIdentity();
+      printHeader("deploy", stage, identity);
+      if (!identity) {
+        printWarning("Could not resolve AWS identity. Is the AWS CLI configured?");
       }
-    }
-    const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
-    const tiers = expandComponent(opts.component);
-    for (let i = 0; i < tiers.length; i++) {
-      const tier = tiers[i];
-      printTierHeader(tier, i, tiers.length);
-      const cwd = resolveTierDir(terraformDir, opts.stage, tier);
-      await ensureInit(cwd);
-      await ensureWorkspace(cwd, opts.stage);
-      const code = await runTerraform(cwd, [
-        "apply",
-        "-auto-approve",
-        `-var=stage=${opts.stage}`
-      ]);
-      if (code !== 0) {
-        printError(`Deploy failed for ${tier} (exit ${code})`);
-        process.exit(code);
+      if (isProdLike(stage) && !opts.yes) {
+        const ok = await confirm(`  Stage "${stage}" is production-like. Deploy?`);
+        if (!ok) {
+          console.log("  Aborted.");
+          process.exit(0);
+        }
+      } else if (!opts.yes) {
+        const ok = await confirm(`  Deploy to stage "${stage}"?`);
+        if (!ok) {
+          console.log("  Aborted.");
+          process.exit(0);
+        }
+      }
+      const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
+      const tiers = expandComponent(opts.component);
+      for (let i = 0; i < tiers.length; i++) {
+        const tier = tiers[i];
+        printTierHeader(tier, i, tiers.length);
+        const cwd = resolveTierDir(terraformDir, stage, tier);
+        await ensureInit(cwd);
+        await ensureWorkspace(cwd, stage);
+        const code = await runTerraform(cwd, [
+          "apply",
+          "-auto-approve",
+          `-var=stage=${stage}`
+        ]);
+        if (code !== 0) {
+          printError(`Deploy failed for ${tier} (exit ${code})`);
+          process.exit(code);
+        }
       }
+      printSuccess("Deploy complete");
+      printSummary("deploy", stage, tiers, startTime);
+    } catch (err) {
+      if (isCancellation(err)) return;
+      throw err;
     }
-    printSuccess("Deploy complete");
-    printSummary("deploy", opts.stage, tiers, startTime);
   });
 }
 
 // src/commands/destroy.ts
 function registerDestroyCommand(program2) {
-  program2.command("destroy").description("Run terraform destroy for a stage").option("-p, --profile <name>", "AWS profile").requiredOption("-s, --stage <name>", "Deployment stage").option("-c, --component <tier>", "Component tier (foundation|data|app|all)", "all").option("-y, --yes", "Skip interactive confirmation (for CI)").action(async (opts) => {
+  program2.command("destroy").description("Run terraform destroy for a stage. Prompts for stage in a TTY when omitted; always requires a destructive confirmation.").option("-p, --profile <name>", "AWS profile").option("-s, --stage <name>", "Deployment stage").option("-c, --component <tier>", "Component tier (foundation|data|app|all)", "all").option("-y, --yes", "Skip interactive confirmation (for CI)").action(async (opts) => {
     const startTime = Date.now();
-    const stageCheck = validateStage(opts.stage);
-    if (!stageCheck.valid) {
-      printError(stageCheck.error);
-      process.exit(1);
-    }
-    const compCheck = validateComponent(opts.component);
-    if (!compCheck.valid) {
-      printError(compCheck.error);
-      process.exit(1);
-    }
-    const identity = getAwsIdentity();
-    printHeader("destroy", opts.stage, identity);
-    if (!identity) {
-      printWarning("Could not resolve AWS identity. Is the AWS CLI configured?");
-    }
-    if (isProdLike(opts.stage)) {
-      printWarning(`Stage "${opts.stage}" is production-like.`);
-      if (!opts.yes) {
-        const ok = await confirm(
-          `  Type 'y' to confirm destruction of stage "${opts.stage}":`
-        );
+    try {
+      const stage = await resolveStage({ flag: opts.stage });
+      const compCheck = validateComponent(opts.component);
+      if (!compCheck.valid) {
+        printError(compCheck.error);
+        process.exit(1);
+      }
+      const identity = getAwsIdentity();
+      printHeader("destroy", stage, identity);
+      if (!identity) {
+        printWarning("Could not resolve AWS identity. Is the AWS CLI configured?");
+      }
+      if (isProdLike(stage)) {
+        printWarning(`Stage "${stage}" is production-like.`);
+        if (!opts.yes) {
+          const ok = await confirm(`  Type 'y' to confirm destruction of stage "${stage}":`);
+          if (!ok) {
+            console.log("  Aborted.");
+            process.exit(0);
+          }
+        }
+        console.log(`  Proceeding with destroy of "${stage}" (--yes provided).`);
+      } else if (!opts.yes) {
+        const ok = await confirm(`  Destroy stage "${stage}"?`);
         if (!ok) {
           console.log("  Aborted.");
           process.exit(0);
         }
       }
-      console.log(`  Proceeding with destroy of "${opts.stage}" (--yes provided).`);
-    } else if (!opts.yes) {
-      const ok = await confirm(`  Destroy stage "${opts.stage}"?`);
-      if (!ok) {
-        console.log("  Aborted.");
-        process.exit(0);
-      }
-    }
-    const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
-    const tiers = expandComponent(opts.component).reverse();
-    for (let i = 0; i < tiers.length; i++) {
-      const tier = tiers[i];
-      printTierHeader(tier, i, tiers.length);
-      const cwd = resolveTierDir(terraformDir, opts.stage, tier);
-      await ensureInit(cwd);
-      await ensureWorkspace(cwd, opts.stage);
-      const code = await runTerraform(cwd, [
-        "destroy",
-        "-auto-approve",
-        `-var=stage=${opts.stage}`
-      ]);
-      if (code !== 0) {
-        printError(`Destroy failed for ${tier} (exit ${code})`);
-        process.exit(code);
+      const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
+      const tiers = expandComponent(opts.component).reverse();
+      for (let i = 0; i < tiers.length; i++) {
+        const tier = tiers[i];
+        printTierHeader(tier, i, tiers.length);
+        const cwd = resolveTierDir(terraformDir, stage, tier);
+        await ensureInit(cwd);
+        await ensureWorkspace(cwd, stage);
+        const code = await runTerraform(cwd, [
+          "destroy",
+          "-auto-approve",
+          `-var=stage=${stage}`
+        ]);
+        if (code !== 0) {
+          printError(`Destroy failed for ${tier} (exit ${code})`);
+          process.exit(code);
+        }
       }
+      printSuccess("Destroy complete");
+      printSummary("destroy", stage, tiers, startTime);
+    } catch (err) {
+      if (isCancellation(err)) return;
+      throw err;
     }
-    printSuccess("Destroy complete");
-    printSummary("destroy", opts.stage, tiers, startTime);
   });
 }
 
 // src/commands/doctor.ts
 import chalk3 from "chalk";
-import { execSync as execSync2 } from "child_process";
+import { execSync as execSync3 } from "child_process";
 function checkAwsCli() {
   return {
     name: "AWS CLI installed",
     run: () => {
       try {
-        const v = execSync2("aws --version", { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
+        const v = execSync3("aws --version", { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
         return { pass: true, detail: v.split(" ")[0] ?? v };
       } catch {
         return { pass: false, detail: "aws CLI not found. Install: https://aws.amazon.com/cli/" };
@@ -443,7 +541,7 @@ function checkTerraformCli() {
     name: "Terraform CLI installed",
     run: () => {
       try {
-        const v = execSync2("terraform version -json", { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] });
+        const v = execSync3("terraform version -json", { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] });
         const parsed = JSON.parse(v);
         return { pass: true, detail: `v${parsed.terraform_version}` };
       } catch {
@@ -469,7 +567,7 @@ function checkBedrockAccess() {
     name: "Bedrock model access",
     run: () => {
       try {
-        execSync2(
+        execSync3(
           "aws bedrock get-foundation-model --model-identifier anthropic.claude-3-haiku-20240307-v1:0 --output json --region us-east-1",
           { encoding: "utf-8", timeout: 1e4, stdio: ["pipe", "pipe", "pipe"] }
         );
@@ -484,13 +582,15 @@ function checkBedrockAccess() {
   };
 }
 function registerDoctorCommand(program2) {
-  program2.command("doctor").description("Check AWS account prerequisites for a Thinkwork deployment").option("-p, --profile <name>", "AWS profile").requiredOption("-s, --stage <name>", "Deployment stage").action((opts) => {
-    const stageCheck = validateStage(opts.stage);
-    if (!stageCheck.valid) {
-      printError(stageCheck.error);
-      process.exit(1);
+  program2.command("doctor").description("Check AWS account prerequisites for a Thinkwork deployment. Prompts for stage in a TTY when omitted.").option("-p, --profile <name>", "AWS profile").option("-s, --stage <name>", "Deployment stage").action(async (opts) => {
+    let stage;
+    try {
+      stage = await resolveStage({ flag: opts.stage });
+    } catch (err) {
+      if (isCancellation(err)) return;
+      throw err;
     }
-    printHeader("doctor", opts.stage);
+    printHeader("doctor", stage);
     const checks = [
       checkAwsCli(),
       checkTerraformCli(),
@@ -518,31 +618,32 @@ function registerDoctorCommand(program2) {
 
 // src/commands/outputs.ts
 function registerOutputsCommand(program2) {
-  program2.command("outputs").description("Show terraform outputs for a stage").option("-p, --profile <name>", "AWS profile").requiredOption("-s, --stage <name>", "Deployment stage").option("-c, --component <tier>", "Component tier (foundation|data|app|all)", "all").action(async (opts) => {
-    const stageCheck = validateStage(opts.stage);
-    if (!stageCheck.valid) {
-      printError(stageCheck.error);
-      process.exit(1);
-    }
-    const compCheck = validateComponent(opts.component);
-    if (!compCheck.valid) {
-      printError(compCheck.error);
-      process.exit(1);
-    }
-    printHeader("outputs", opts.stage);
-    const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
-    const tiers = expandComponent(opts.component);
-    for (let i = 0; i < tiers.length; i++) {
-      const tier = tiers[i];
-      printTierHeader(tier, i, tiers.length);
-      const cwd = resolveTierDir(terraformDir, opts.stage, tier);
-      await ensureInit(cwd);
-      await ensureWorkspace(cwd, opts.stage);
-      const code = await runTerraform(cwd, ["output"]);
-      if (code !== 0) {
-        printError(`Outputs failed for ${tier} (exit ${code})`);
-        process.exit(code);
+  program2.command("outputs").description("Show terraform outputs for a stage. Prompts for stage in a TTY when omitted.").option("-p, --profile <name>", "AWS profile").option("-s, --stage <name>", "Deployment stage").option("-c, --component <tier>", "Component tier (foundation|data|app|all)", "all").action(async (opts) => {
+    try {
+      const stage = await resolveStage({ flag: opts.stage });
+      const compCheck = validateComponent(opts.component);
+      if (!compCheck.valid) {
+        printError(compCheck.error);
+        process.exit(1);
       }
+      printHeader("outputs", stage);
+      const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
+      const tiers = expandComponent(opts.component);
+      for (let i = 0; i < tiers.length; i++) {
+        const tier = tiers[i];
+        printTierHeader(tier, i, tiers.length);
+        const cwd = resolveTierDir(terraformDir, stage, tier);
+        await ensureInit(cwd);
+        await ensureWorkspace(cwd, stage);
+        const code = await runTerraform(cwd, ["output"]);
+        if (code !== 0) {
+          printError(`Outputs failed for ${tier} (exit ${code})`);
+          process.exit(code);
+        }
+      }
+    } catch (err) {
+      if (isCancellation(err)) return;
+      throw err;
     }
   });
 }
@@ -701,13 +802,15 @@ function registerConfigCommand(program2) {
     console.log(`  Show details: ${chalk4.cyan("thinkwork config list -s <stage>")}`);
     console.log("");
   });
-  config.command("get <key>").description("Get a configuration value (e.g. enable-hindsight)").requiredOption("-s, --stage <name>", "Deployment stage").action((key, opts) => {
-    const stageCheck = validateStage(opts.stage);
-    if (!stageCheck.valid) {
-      printError(stageCheck.error);
-      process.exit(1);
+  config.command("get <key>").description("Get a configuration value (e.g. enable-hindsight). Prompts for stage in a TTY when omitted.").option("-s, --stage <name>", "Deployment stage").action(async (key, opts) => {
+    let stage;
+    try {
+      stage = await resolveStage({ flag: opts.stage });
+    } catch (err) {
+      if (isCancellation(err)) return;
+      throw err;
     }
-    const tfvarsPath = resolveTfvarsPath(opts.stage);
+    const tfvarsPath = resolveTfvarsPath(stage);
     const tfKey = key.replace(/-/g, "_");
     const value = readTfVar(tfvarsPath, tfKey);
     if (value === null) {
@@ -716,11 +819,13 @@ function registerConfigCommand(program2) {
       console.log(`  ${key} = ${value}`);
     }
   });
-  config.command("set <key> <value>").description("Set a configuration value and optionally deploy").requiredOption("-s, --stage <name>", "Deployment stage").option("--apply", "Run terraform apply after changing the value").action(async (key, value, opts) => {
-    const stageCheck = validateStage(opts.stage);
-    if (!stageCheck.valid) {
-      printError(stageCheck.error);
-      process.exit(1);
+  config.command("set <key> <value>").description("Set a configuration value and optionally deploy. Prompts for stage in a TTY when omitted.").option("-s, --stage <name>", "Deployment stage").option("--apply", "Run terraform apply after changing the value").action(async (key, value, opts) => {
+    let stage;
+    try {
+      stage = await resolveStage({ flag: opts.stage });
+    } catch (err) {
+      if (isCancellation(err)) return;
+      throw err;
     }
     let tfKey = key.replace(/-/g, "_");
     let tfValue = value;
@@ -738,13 +843,13 @@ function registerConfigCommand(program2) {
       process.exit(1);
     }
     const identity = getAwsIdentity();
-    printHeader("config set", opts.stage, identity);
-    const tfvarsPath = resolveTfvarsPath(opts.stage);
+    printHeader("config set", stage, identity);
+    const tfvarsPath = resolveTfvarsPath(stage);
     const oldValue = readTfVar(tfvarsPath, tfKey);
     setTfVar(tfvarsPath, tfKey, tfValue);
     console.log(`  ${tfKey}: ${oldValue ?? "(unset)"} \u2192 ${tfValue}`);
     if (opts.apply) {
-      const tfDir = resolveTerraformDir(opts.stage);
+      const tfDir = resolveTerraformDir(stage);
       if (!tfDir) {
         printError("Cannot find terraform directory. Run `thinkwork init` first.");
         process.exit(1);
@@ -752,11 +857,11 @@ function registerConfigCommand(program2) {
       console.log("");
       console.log("  Applying configuration change...");
       await ensureInit(tfDir);
-      await ensureWorkspace(tfDir, opts.stage);
+      await ensureWorkspace(tfDir, stage);
       const code = await runTerraform(tfDir, [
         "apply",
         "-auto-approve",
-        `-var=stage=${opts.stage}`
+        `-var=stage=${stage}`
       ]);
       if (code !== 0) {
         printError(`Deploy failed (exit ${code})`);
@@ -796,18 +901,20 @@ function runScript(scriptPath, args) {
   });
 }
 function registerBootstrapCommand(program2) {
-  program2.command("bootstrap").description("Seed workspace defaults, skill catalog, and per-tenant files for a stage").requiredOption("-s, --stage <name>", "Deployment stage").action(async (opts) => {
-    const stageCheck = validateStage(opts.stage);
-    if (!stageCheck.valid) {
-      printError(stageCheck.error);
-      process.exit(1);
+  program2.command("bootstrap").description("Seed workspace defaults, skill catalog, and per-tenant files for a stage. Prompts for stage in a TTY when omitted.").option("-s, --stage <name>", "Deployment stage").action(async (opts) => {
+    let stage;
+    try {
+      stage = await resolveStage({ flag: opts.stage });
+    } catch (err) {
+      if (isCancellation(err)) return;
+      throw err;
     }
     const identity = getAwsIdentity();
-    printHeader("bootstrap", opts.stage, identity);
+    printHeader("bootstrap", stage, identity);
     const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
-    const cwd = resolveTierDir(terraformDir, opts.stage, "app");
+    const cwd = resolveTierDir(terraformDir, stage, "app");
     await ensureInit(cwd);
-    await ensureWorkspace(cwd, opts.stage);
+    await ensureWorkspace(cwd, stage);
     let bucket;
     let dbEndpoint;
     let dbPassword;
@@ -829,7 +936,7 @@ function registerBootstrapCommand(program2) {
     const databaseUrl = `postgresql://thinkwork_admin:${encodeURIComponent(dbPassword)}@${dbEndpoint}:5432/thinkwork?sslmode=no-verify`;
     const repoRoot = resolve(terraformDir);
     const scriptPath = resolve(repoRoot, "scripts/bootstrap-workspace.sh");
-    const code = await runScript(scriptPath, [opts.stage, bucket, databaseUrl]);
+    const code = await runScript(scriptPath, [stage, bucket, databaseUrl]);
     if (code !== 0) {
       printError(`Bootstrap failed (exit ${code})`);
       process.exit(code);
@@ -841,7 +948,7 @@ function registerBootstrapCommand(program2) {
 // src/commands/login.ts
 import { execSync as execSync6 } from "child_process";
 import { createInterface as createInterface2 } from "readline";
-import { select, Separator } from "@inquirer/prompts";
+import { select as select2, Separator } from "@inquirer/prompts";
 import chalk7 from "chalk";
 
 // src/aws-profiles.ts
@@ -921,14 +1028,14 @@ function listAwsProfiles() {
 }
 
 // src/prerequisites.ts
-import { execSync as execSync3 } from "child_process";
+import { execSync as execSync4 } from "child_process";
 import { mkdirSync as mkdirSync3, createWriteStream, chmodSync } from "fs";
 import { join as join4 } from "path";
 import { homedir as homedir4, platform, arch } from "os";
 import chalk5 from "chalk";
 function run(cmd, opts) {
   try {
-    return execSync3(cmd, {
+    return execSync4(cmd, {
       encoding: "utf-8",
       timeout: 3e4,
       stdio: opts?.silent ? ["pipe", "pipe", "pipe"] : void 0
@@ -1042,10 +1149,10 @@ async function ensurePrerequisites() {
 }
 
 // src/cognito-discovery.ts
-import { execSync as execSync4 } from "child_process";
-function runAws(cmd) {
+import { execSync as execSync5 } from "child_process";
+function runAws2(cmd) {
   try {
-    return execSync4(`aws ${cmd}`, {
+    return execSync5(`aws ${cmd}`, {
       encoding: "utf-8",
       timeout: 15e3,
       stdio: ["pipe", "pipe", "pipe"]
@@ -1065,7 +1172,7 @@ function tryTerraformOutput(stage) {
   }
   const read = (key) => {
     try {
-      return execSync4(`terraform output -raw ${key}`, {
+      return execSync5(`terraform output -raw ${key}`, {
         cwd,
         encoding: "utf-8",
         timeout: 15e3,
@@ -1081,7 +1188,7 @@ function tryTerraformOutput(stage) {
   return { userPoolId, clientId, domain };
 }
 function tryAwsDiscovery(stage, region) {
-  const listRaw = runAws(
+  const listRaw = runAws2(
     `cognito-idp list-user-pools --max-results 60 --region ${region} --output json`
   );
   if (!listRaw) return {};
@@ -1093,7 +1200,7 @@ function tryAwsDiscovery(stage, region) {
     )
   );
   if (!pool) return {};
-  const clientsRaw = runAws(
+  const clientsRaw = runAws2(
     `cognito-idp list-user-pool-clients --user-pool-id ${pool.Id} --region ${region} --output json`
   );
   let clientId;
@@ -1364,70 +1471,11 @@ function escapeHtml(s) {
   });
 }
 
-// src/aws-discovery.ts
-import { execSync as execSync5 } from "child_process";
-function runAws2(cmd) {
-  try {
-    return execSync5(`aws ${cmd}`, {
-      encoding: "utf-8",
-      timeout: 15e3,
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
-  } catch {
-    return null;
-  }
-}
-function listDeployedStages(region) {
-  const raw = runAws2(
-    `lambda list-functions --region ${region} --query "Functions[?starts_with(FunctionName, 'thinkwork-')].FunctionName" --output json`
-  );
-  if (!raw) return [];
-  try {
-    const functions = JSON.parse(raw);
-    const stages = /* @__PURE__ */ new Set();
-    for (const fn of functions) {
-      const m = fn.match(/^thinkwork-(.+?)-api-graphql-http$/);
-      if (m) stages.add(m[1]);
-    }
-    return [...stages].sort();
-  } catch {
-    return [];
-  }
-}
-function getApiEndpoint(stage, region) {
-  const raw = runAws2(
-    `apigatewayv2 get-apis --region ${region} --query "Items[?Name=='thinkwork-${stage}-api'].ApiEndpoint|[0]" --output text`
-  );
-  return raw && raw !== "None" ? raw : null;
-}
-function getApiAuthSecretFromLambda(stage, region) {
-  const raw = runAws2(
-    `lambda get-function-configuration --function-name thinkwork-${stage}-api-tenants --region ${region} --query "Environment.Variables.API_AUTH_SECRET" --output text`
-  );
-  return raw && raw !== "None" ? raw : null;
-}
-
-// src/lib/interactive.ts
-function isCancellation(err) {
-  return err instanceof Error && err.name === "ExitPromptError";
-}
-function isInteractive() {
-  return Boolean(process.stdin.isTTY);
-}
-function requireTty(label) {
-  if (!isInteractive()) {
-    printError(
-      `${label} is required. Pass it as a flag or re-run in an interactive terminal.`
-    );
-    process.exit(1);
-  }
-}
-
 // src/commands/login.ts
-function ask(prompt2) {
+function ask(prompt) {
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
   return new Promise((resolve3) => {
-    rl.question(prompt2, (answer) => {
+    rl.question(prompt, (answer) => {
       rl.close();
       resolve3(answer.trim());
     });
@@ -1480,7 +1528,7 @@ async function pickProfile(profiles) {
     description: "Run `aws sso login` against the configured SSO profile."
   });
   try {
-    const picked = await select({
+    const picked = await select2({
       message: "Pick an AWS profile for Thinkwork:",
       choices,
       loop: false,
@@ -1842,7 +1890,7 @@ Registered callback URL:
 }
 
 // src/commands/logout.ts
-import { select as select2 } from "@inquirer/prompts";
+import { select as select3 } from "@inquirer/prompts";
 function registerLogoutCommand(program2) {
   program2.command("logout").description(
     "Forget a stored session. Touches only ~/.thinkwork/config.json; your AWS profile and Cognito pool are untouched."
@@ -1880,7 +1928,7 @@ Examples:
           console.log(`  Only one session stored: ${stage}`);
         } else {
           requireTty("Stage");
-          stage = await select2({
+          stage = await select3({
             message: "Forget which stage's session?",
             choices: keys.map((s) => ({ name: s, value: s })),
             loop: false
@@ -1915,19 +1963,19 @@ import { fileURLToPath } from "url";
 import { createInterface as createInterface3 } from "readline";
 import chalk8 from "chalk";
 var __dirname = dirname2(fileURLToPath(import.meta.url));
-function ask2(prompt2, defaultVal = "") {
+function ask2(prompt, defaultVal = "") {
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
   const suffix = defaultVal ? chalk8.dim(` [${defaultVal}]`) : "";
   return new Promise((resolve3) => {
-    rl.question(`  ${prompt2}${suffix}: `, (answer) => {
+    rl.question(`  ${prompt}${suffix}: `, (answer) => {
       rl.close();
       resolve3(answer.trim() || defaultVal);
     });
   });
 }
-function choose(prompt2, options, defaultVal) {
+function choose(prompt, options, defaultVal) {
   const optStr = options.map((o) => o === defaultVal ? chalk8.bold(o) : chalk8.dim(o)).join(" / ");
-  return ask2(`${prompt2} (${optStr})`, defaultVal);
+  return ask2(`${prompt} (${optStr})`, defaultVal);
 }
 function generateSecret(length = 32) {
   const chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
@@ -1994,14 +2042,34 @@ function buildTfvars(config) {
   return lines.join("\n");
 }
 function registerInitCommand(program2) {
-  program2.command("init").description("Initialize a new Thinkwork environment").requiredOption("-s, --stage <name>", "Stage name (e.g. dev, staging, prod)").option("-d, --dir <path>", "Target directory", ".").option("--defaults", "Skip interactive prompts, use all defaults").action(async (opts) => {
-    const stageCheck = validateStage(opts.stage);
+  program2.command("init").description("Initialize a new Thinkwork environment. Prompts for a stage name in a TTY when omitted (init creates a stage \u2014 the picker isn't applicable here).").option("-s, --stage <name>", "Stage name (e.g. dev, staging, prod)").option("-d, --dir <path>", "Target directory", ".").option("--defaults", "Skip interactive prompts, use all defaults").action(async (opts) => {
+    let stage = opts.stage;
+    if (!stage) {
+      if (!process.stdin.isTTY) {
+        printError("Stage name is required. Pass -s <name> or re-run in an interactive terminal.");
+        process.exit(1);
+      }
+      const { input: input3 } = await import("@inquirer/prompts");
+      try {
+        stage = await input3({
+          message: "Stage name (e.g. dev, staging, prod):",
+          validate: (v) => validateStage(v).error ?? true
+        });
+      } catch (err) {
+        if (err instanceof Error && err.name === "ExitPromptError") {
+          console.log("  Cancelled.");
+          return;
+        }
+        throw err;
+      }
+    }
+    const stageCheck = validateStage(stage);
     if (!stageCheck.valid) {
       printError(stageCheck.error);
       process.exit(1);
     }
     const identity = getAwsIdentity();
-    printHeader("init", opts.stage, identity);
+    printHeader("init", stage, identity);
     const prereqsOk = await ensurePrerequisites();
     if (!prereqsOk) {
       process.exit(1);
@@ -2023,10 +2091,10 @@ function registerInitCommand(program2) {
       console.log("");
     }
     const config = {
-      stage: opts.stage,
+      stage,
       account_id: identity.account,
       db_password: generateSecret(24),
-      api_auth_secret: `tw-${opts.stage}-${generateSecret(16)}`
+      api_auth_secret: `tw-${stage}-${generateSecret(16)}`
     };
     if (opts.defaults) {
       config.region = identity.region !== "unknown" ? identity.region : "us-east-1";
@@ -2287,7 +2355,7 @@ output "agentcore_memory_id" {
     try {
       execSync7("terraform init", { cwd: tfDir, stdio: "inherit" });
     } catch {
-      printWarning("Terraform init failed. Run `thinkwork doctor -s " + opts.stage + "` to check prerequisites.");
+      printWarning("Terraform init failed. Run `thinkwork doctor -s " + stage + "` to check prerequisites.");
       return;
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -2301,13 +2369,13 @@ output "agentcore_memory_id" {
       createdAt: now,
       updatedAt: now
     });
-    printSuccess(`Environment "${opts.stage}" initialized`);
+    printSuccess(`Environment "${stage}" initialized`);
     console.log("");
     console.log("  Next steps:");
-    console.log(`    ${chalk8.cyan("1.")} thinkwork plan -s ${opts.stage}        ${chalk8.dim("# Review infrastructure plan")}`);
-    console.log(`    ${chalk8.cyan("2.")} thinkwork deploy -s ${opts.stage}       ${chalk8.dim("# Deploy to AWS (~5 min)")}`);
-    console.log(`    ${chalk8.cyan("3.")} thinkwork bootstrap -s ${opts.stage}    ${chalk8.dim("# Seed workspace files + skills")}`);
-    console.log(`    ${chalk8.cyan("4.")} thinkwork outputs -s ${opts.stage}      ${chalk8.dim("# Show API URL, Cognito IDs, etc.")}`);
+    console.log(`    ${chalk8.cyan("1.")} thinkwork plan -s ${stage}        ${chalk8.dim("# Review infrastructure plan")}`);
+    console.log(`    ${chalk8.cyan("2.")} thinkwork deploy -s ${stage}       ${chalk8.dim("# Deploy to AWS (~5 min)")}`);
+    console.log(`    ${chalk8.cyan("3.")} thinkwork bootstrap -s ${stage}    ${chalk8.dim("# Seed workspace files + skills")}`);
+    console.log(`    ${chalk8.cyan("4.")} thinkwork outputs -s ${stage}      ${chalk8.dim("# Show API URL, Cognito IDs, etc.")}`);
     console.log("");
   });
 }
@@ -2604,20 +2672,112 @@ function resolveApiConfig(stage, regionOverride) {
   return { apiUrl, authSecret };
 }
 
+// src/lib/resolve-tenant.ts
+import { select as select4 } from "@inquirer/prompts";
+async function resolveTenant(opts) {
+  const override = opts.flag ?? process.env.THINKWORK_TENANT;
+  if (override) {
+    const cached = loadStageSession(opts.stage);
+    if (cached && cached.tenantSlug === override) {
+      return { slug: override, id: cached.tenantId };
+    }
+    return { slug: override };
+  }
+  const session = loadStageSession(opts.stage);
+  if (session?.tenantSlug) {
+    return { slug: session.tenantSlug, id: session.tenantId };
+  }
+  if (!opts.listTenants) {
+    printError(
+      `No tenant resolved for stage "${opts.stage}". Pass --tenant <slug>, set THINKWORK_TENANT, or re-run \`thinkwork login --stage ${opts.stage}\`.`
+    );
+    process.exit(1);
+  }
+  const tenants = await opts.listTenants();
+  if (tenants.length === 0) {
+    printError(
+      "No tenants available. You may need to be invited to a workspace first."
+    );
+    process.exit(1);
+  }
+  if (tenants.length === 1) {
+    const only = tenants[0];
+    console.log(`  Using the only tenant: ${only.name} (${only.slug})`);
+    cacheTenant(opts.stage, only);
+    return { slug: only.slug, id: only.id };
+  }
+  requireTty("Tenant");
+  const slug = await select4({
+    message: "Which tenant?",
+    choices: tenants.map((t) => ({
+      name: `${t.name}  (slug: ${t.slug})`,
+      value: t.slug
+    })),
+    loop: false
+  });
+  const picked = tenants.find((t) => t.slug === slug);
+  cacheTenant(opts.stage, picked);
+  return { slug: picked.slug, id: picked.id };
+}
+function cacheTenant(stage, tenant) {
+  const session = loadStageSession(stage);
+  if (!session) return;
+  saveStageSession(stage, { ...session, tenantId: tenant.id, tenantSlug: tenant.slug });
+}
+
+// src/lib/resolve-tenant-rest.ts
+async function resolveTenantRest(opts) {
+  return resolveTenant({
+    flag: opts.flag,
+    stage: opts.stage,
+    listTenants: async () => {
+      const list = await apiFetch(
+        opts.apiUrl,
+        opts.authSecret,
+        "/api/tenants"
+      );
+      return list;
+    }
+  });
+}
+
 // src/commands/mcp.ts
+async function resolveMcpContext(opts) {
+  const stage = await resolveStage({ flag: opts.stage });
+  const api = resolveApiConfig(stage);
+  if (!api) process.exit(1);
+  const tenant = await resolveTenantRest({
+    flag: opts.tenant,
+    stage,
+    apiUrl: api.apiUrl,
+    authSecret: api.authSecret
+  });
+  return { stage, api, tenant };
+}
 function registerMcpCommand(program2) {
   const mcp = program2.command("mcp").description("Manage MCP servers for your tenant");
-  mcp.command("list").description("List registered MCP servers").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
-    }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
-    printHeader("mcp list", opts.stage);
+  mcp.command("list").alias("ls").description("List registered MCP servers. Prompts for stage/tenant in a TTY when omitted.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+    "after",
+    `
+Examples:
+  # Interactive \u2014 picks stage + tenant from the deployed ones
+  $ thinkwork mcp list
+
+  # Scriptable
+  $ thinkwork mcp list -s dev -t acme
+  $ thinkwork mcp list -s prod -t acme --json | jq '.[].slug'
+`
+  ).action(async (opts) => {
     try {
-      const { servers } = await apiFetch(api.apiUrl, api.authSecret, "/api/skills/mcp-servers", {}, { "x-tenant-slug": opts.tenant });
+      const { stage, api, tenant } = await resolveMcpContext(opts);
+      printHeader("mcp list", stage);
+      const { servers } = await apiFetch(
+        api.apiUrl,
+        api.authSecret,
+        "/api/skills/mcp-servers",
+        {},
+        { "x-tenant-slug": tenant.slug }
+      );
       if (!servers || servers.length === 0) {
         console.log(chalk10.dim("  No MCP servers registered."));
         return;
@@ -2630,74 +2790,104 @@ function registerMcpCommand(program2) {
         console.log(`    URL:       ${s.url}`);
         console.log(`    Transport: ${s.transport}`);
         console.log(`    Auth:      ${authLabel}`);
-        if (s.tools?.length) {
-          console.log(`    Tools:     ${s.tools.length} cached`);
-        }
+        if (s.tools?.length) console.log(`    Tools:     ${s.tools.length} cached`);
         console.log("");
       }
     } catch (err) {
-      printError(err.message);
-      process.exit(1);
-    }
-  });
-  mcp.command("add <name>").description("Register an MCP server").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").requiredOption("--url <url>", "MCP server URL").option("--transport <type>", "Transport type (streamable-http|sse)", "streamable-http").option("--auth-type <type>", "Auth type (none|tenant_api_key|per_user_oauth)", "none").option("--api-key <token>", "API key (for tenant_api_key auth)").option("--oauth-provider <name>", "OAuth provider name (for per_user_oauth auth)").action(async (name, opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
-    }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
-    const body = {
-      name,
-      url: opts.url,
-      transport: opts.transport
-    };
-    if (opts.authType !== "none") body.authType = opts.authType;
-    if (opts.apiKey) body.apiKey = opts.apiKey;
-    if (opts.oauthProvider) body.oauthProvider = opts.oauthProvider;
-    try {
-      const result = await apiFetch(api.apiUrl, api.authSecret, "/api/skills/mcp-servers", {
-        method: "POST",
-        body: JSON.stringify(body)
-      }, { "x-tenant-slug": opts.tenant });
-      printSuccess(`MCP server "${name}" ${result.created ? "registered" : "updated"} (slug: ${result.slug})`);
-    } catch (err) {
-      printError(err.message);
+      if (isCancellation(err)) return;
+      printError(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
   });
-  mcp.command("remove <id>").description("Remove an MCP server").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (id, opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
+  mcp.command("add [name]").description("Register an MCP server. Prompts for missing fields in a TTY.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--url <url>", "MCP server URL").option("--transport <type>", "Transport type (streamable-http|sse)", "streamable-http").option("--auth-type <type>", "Auth type (none|tenant_api_key|per_user_oauth)", "none").option("--api-key <token>", "API key (for tenant_api_key auth)").option("--oauth-provider <name>", "OAuth provider name (for per_user_oauth auth)").addHelpText(
+    "after",
+    `
+Examples:
+  # Fully interactive \u2014 prompts for name, URL, and auth
+  $ thinkwork mcp add
+
+  # Scripted \u2014 API-key auth
+  $ thinkwork mcp add my-tools --url https://mcp.example.com/crm \\
+      --auth-type tenant_api_key --api-key sk-abc -s dev -t acme
+
+  # OAuth connector (users connect from the mobile app)
+  $ thinkwork mcp add lastmile --url https://mcp-dev.lastmile-tei.com/crm \\
+      --auth-type per_user_oauth --oauth-provider lastmile -s dev -t acme
+`
+  ).action(
+    async (nameArg, opts) => {
+      try {
+        const { input: input3 } = await import("@inquirer/prompts");
+        const { stage, api, tenant } = await resolveMcpContext(opts);
+        let name = nameArg;
+        if (!name) {
+          if (!process.stdin.isTTY) {
+            printError("Name is required. Pass it as a positional arg.");
+            process.exit(1);
+          }
+          name = await input3({ message: "Server name:" });
+        }
+        let url = opts.url;
+        if (!url) {
+          if (!process.stdin.isTTY) {
+            printError("--url is required. Pass it as a flag.");
+            process.exit(1);
+          }
+          url = await input3({
+            message: "MCP server URL:",
+            validate: (v) => v.startsWith("http://") || v.startsWith("https://") ? true : "URL must start with http:// or https://"
+          });
+        }
+        const body = { name, url, transport: opts.transport };
+        if (opts.authType !== "none") body.authType = opts.authType;
+        if (opts.apiKey) body.apiKey = opts.apiKey;
+        if (opts.oauthProvider) body.oauthProvider = opts.oauthProvider;
+        printHeader("mcp add", stage);
+        const result = await apiFetch(
+          api.apiUrl,
+          api.authSecret,
+          "/api/skills/mcp-servers",
+          { method: "POST", body: JSON.stringify(body) },
+          { "x-tenant-slug": tenant.slug }
+        );
+        printSuccess(
+          `MCP server "${name}" ${result.created ? "registered" : "updated"} (slug: ${result.slug})`
+        );
+      } catch (err) {
+        if (isCancellation(err)) return;
+        printError(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
     }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
+  );
+  mcp.command("remove <id>").alias("rm").description("Remove an MCP server. Prompts for stage/tenant in a TTY when omitted.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(async (id, opts) => {
     try {
-      await apiFetch(api.apiUrl, api.authSecret, `/api/skills/mcp-servers/${id}`, {
-        method: "DELETE"
-      }, { "x-tenant-slug": opts.tenant });
-      printSuccess(`MCP server removed.`);
+      const { api, tenant } = await resolveMcpContext(opts);
+      await apiFetch(
+        api.apiUrl,
+        api.authSecret,
+        `/api/skills/mcp-servers/${id}`,
+        { method: "DELETE" },
+        { "x-tenant-slug": tenant.slug }
+      );
+      printSuccess("MCP server removed.");
     } catch (err) {
-      printError(err.message);
+      if (isCancellation(err)) return;
+      printError(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
   });
-  mcp.command("test <id>").description("Test connection and discover tools").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (id, opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
-    }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
-    printHeader("mcp test", opts.stage);
+  mcp.command("test <id>").description("Test connection and discover tools. Prompts for stage/tenant in a TTY when omitted.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(async (id, opts) => {
     try {
-      const result = await apiFetch(api.apiUrl, api.authSecret, `/api/skills/mcp-servers/${id}/test`, {
-        method: "POST"
-      }, { "x-tenant-slug": opts.tenant });
+      const { stage, api, tenant } = await resolveMcpContext(opts);
+      printHeader("mcp test", stage);
+      const result = await apiFetch(
+        api.apiUrl,
+        api.authSecret,
+        `/api/skills/mcp-servers/${id}/test`,
+        { method: "POST" },
+        { "x-tenant-slug": tenant.slug }
+      );
       if (result.ok) {
         printSuccess("Connection successful.");
         if (result.tools?.length) {
@@ -2705,7 +2895,9 @@ function registerMcpCommand(program2) {
   Discovered tools (${result.tools.length}):
 `));
           for (const t of result.tools) {
-            console.log(`    ${chalk10.cyan(t.name)}${t.description ? chalk10.dim(` - ${t.description}`) : ""}`);
+            console.log(
+              `    ${chalk10.cyan(t.name)}${t.description ? chalk10.dim(` - ${t.description}`) : ""}`
+            );
           }
           console.log("");
         } else {
@@ -2716,86 +2908,112 @@ function registerMcpCommand(program2) {
         process.exit(1);
       }
     } catch (err) {
-      printError(err.message);
-      process.exit(1);
-    }
-  });
-  mcp.command("assign <mcpServerId>").description("Assign an MCP server to an agent").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--agent <id>", "Agent ID").action(async (mcpServerId, opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
-    }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
-    try {
-      const result = await apiFetch(api.apiUrl, api.authSecret, `/api/skills/agents/${opts.agent}/mcp-servers`, {
-        method: "POST",
-        body: JSON.stringify({ mcpServerId })
-      });
-      printSuccess(`MCP server assigned to agent. (${result.created ? "new" : "updated"})`);
-    } catch (err) {
-      printError(err.message);
+      if (isCancellation(err)) return;
+      printError(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
   });
-  mcp.command("unassign <mcpServerId>").description("Remove an MCP server from an agent").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--agent <id>", "Agent ID").action(async (mcpServerId, opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
+  mcp.command("assign <mcpServerId>").description("Assign an MCP server to an agent. Prompts for stage/agent when omitted in a TTY.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--agent <id>", "Agent ID").action(
+    async (mcpServerId, opts) => {
+      try {
+        const { input: input3 } = await import("@inquirer/prompts");
+        const { api } = await resolveMcpContext(opts);
+        let agent = opts.agent;
+        if (!agent) {
+          if (!process.stdin.isTTY) {
+            printError("--agent is required. Pass it as a flag.");
+            process.exit(1);
+          }
+          agent = await input3({ message: "Agent ID:" });
+        }
+        const result = await apiFetch(
+          api.apiUrl,
+          api.authSecret,
+          `/api/skills/agents/${agent}/mcp-servers`,
+          { method: "POST", body: JSON.stringify({ mcpServerId }) }
+        );
+        printSuccess(`MCP server assigned to agent. (${result.created ? "new" : "updated"})`);
+      } catch (err) {
+        if (isCancellation(err)) return;
+        printError(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
     }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
-    try {
-      await apiFetch(api.apiUrl, api.authSecret, `/api/skills/agents/${opts.agent}/mcp-servers/${mcpServerId}`, {
-        method: "DELETE"
-      });
-      printSuccess("MCP server unassigned from agent.");
-    } catch (err) {
-      printError(err.message);
-      process.exit(1);
+  );
+  mcp.command("unassign <mcpServerId>").description("Remove an MCP server from an agent. Prompts for stage/agent when omitted in a TTY.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--agent <id>", "Agent ID").action(
+    async (mcpServerId, opts) => {
+      try {
+        const { input: input3 } = await import("@inquirer/prompts");
+        const { api } = await resolveMcpContext(opts);
+        let agent = opts.agent;
+        if (!agent) {
+          if (!process.stdin.isTTY) {
+            printError("--agent is required. Pass it as a flag.");
+            process.exit(1);
+          }
+          agent = await input3({ message: "Agent ID:" });
+        }
+        await apiFetch(
+          api.apiUrl,
+          api.authSecret,
+          `/api/skills/agents/${agent}/mcp-servers/${mcpServerId}`,
+          { method: "DELETE" }
+        );
+        printSuccess("MCP server unassigned from agent.");
+      } catch (err) {
+        if (isCancellation(err)) return;
+        printError(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
     }
-  });
+  );
 }
 
 // src/commands/tools.ts
-import { createInterface as createInterface4 } from "readline";
+import { select as select5, password } from "@inquirer/prompts";
 import chalk11 from "chalk";
-function prompt(question) {
-  const rl = createInterface4({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve3) => {
-    rl.question(question, (answer) => {
-      rl.close();
-      resolve3(answer.trim());
-    });
-  });
-}
 var TOOL_PROVIDERS = {
   "web-search": ["exa", "serpapi"]
 };
+async function resolveCtx(opts) {
+  const stage = await resolveStage({ flag: opts.stage });
+  const api = resolveApiConfig(stage);
+  if (!api) process.exit(1);
+  const tenant = await resolveTenantRest({
+    flag: opts.tenant,
+    stage,
+    apiUrl: api.apiUrl,
+    authSecret: api.authSecret
+  });
+  return { stage, api, tenant };
+}
 function registerToolsCommand(program2) {
   const tools = program2.command("tools").description("Configure built-in agent tools (web_search, \u2026) for your tenant");
-  tools.command("list").description("List configured built-in tools").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
-    }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
-    printHeader("tools list", opts.stage);
+  tools.command("list").alias("ls").description("List configured built-in tools. Prompts for stage/tenant in a TTY when omitted.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+    "after",
+    `
+Examples:
+  # Interactive \u2014 picks stage + tenant
+  $ thinkwork tools list
+
+  # Scripted
+  $ thinkwork tools list -s dev -t acme
+  $ thinkwork tools list --json | jq '.[] | .toolSlug'
+`
+  ).action(async (opts) => {
     try {
+      const { stage, api, tenant } = await resolveCtx(opts);
+      printHeader("tools list", stage);
       const { tools: rows } = await apiFetch(
         api.apiUrl,
         api.authSecret,
         "/api/skills/builtin-tools",
         {},
-        { "x-tenant-slug": opts.tenant }
+        { "x-tenant-slug": tenant.slug }
       );
       if (!rows || rows.length === 0) {
         console.log(chalk11.dim("  No built-in tools configured."));
-        console.log(chalk11.dim("  Try: thinkwork tools web-search set --tenant <slug> -s <stage>"));
+        console.log(chalk11.dim("  Try: thinkwork tools web-search set"));
         return;
       }
       console.log("");
@@ -2806,75 +3024,84 @@ function registerToolsCommand(program2) {
         console.log(`  ${chalk11.bold(r.toolSlug)}  ${status}`);
         console.log(`    Provider:  ${provider}`);
         console.log(`    Has key:   ${key}`);
-        if (r.lastTestedAt) {
-          console.log(`    Tested:    ${new Date(r.lastTestedAt).toLocaleString()}`);
-        }
+        if (r.lastTestedAt) console.log(`    Tested:    ${new Date(r.lastTestedAt).toLocaleString()}`);
         console.log("");
       }
     } catch (err) {
-      printError(err.message);
+      if (isCancellation(err)) return;
+      printError(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
   });
   const webSearch = tools.command("web-search").description("Configure the web_search built-in tool");
-  webSearch.command("set").description("Set or update web_search provider + API key (enables the tool)").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").option("--provider <name>", `Provider (${TOOL_PROVIDERS["web-search"].join("|")})`).option("--key <key>", "API key").action(async (opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
-    }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
-    let provider = opts.provider;
-    if (!provider) {
-      provider = (await prompt(`Provider [${TOOL_PROVIDERS["web-search"].join("/")}]: `)).toLowerCase();
-    }
-    if (!TOOL_PROVIDERS["web-search"].includes(provider)) {
-      printError(`provider must be one of: ${TOOL_PROVIDERS["web-search"].join(", ")}`);
-      process.exit(1);
-    }
-    let apiKey = opts.key;
-    if (!apiKey) {
-      apiKey = await prompt(`${provider} API key: `);
-    }
-    if (!apiKey) {
-      printError("API key is required");
-      process.exit(1);
-    }
-    try {
-      await apiFetch(
-        api.apiUrl,
-        api.authSecret,
-        "/api/skills/builtin-tools/web-search",
-        {
-          method: "PUT",
-          body: JSON.stringify({ provider, apiKey, enabled: true })
-        },
-        { "x-tenant-slug": opts.tenant }
-      );
-      printSuccess(`web_search configured with provider=${provider}, enabled=true`);
-      printWarning("Run `thinkwork tools web-search test` to verify connectivity.");
-    } catch (err) {
-      printError(err.message);
-      process.exit(1);
-    }
-  });
-  webSearch.command("test").description("Test the stored web_search provider + key against the provider API").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
+  webSearch.command("set").description("Set or update web_search provider + API key (enables the tool). Prompts when flags are missing in a TTY.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--provider <name>", `Provider (${TOOL_PROVIDERS["web-search"].join("|")})`).option("--key <key>", "API key (will prompt hidden if omitted)").addHelpText(
+    "after",
+    `
+Examples:
+  # Fully interactive \u2014 stage/tenant picker, provider picker, hidden key prompt
+  $ thinkwork tools web-search set
+
+  # Scripted (secret from env)
+  $ thinkwork tools web-search set -s dev -t acme --provider exa --key "$EXA_KEY"
+`
+  ).action(
+    async (opts) => {
+      try {
+        const { api, tenant } = await resolveCtx(opts);
+        let provider = opts.provider;
+        if (!provider) {
+          if (!process.stdin.isTTY) {
+            printError(`--provider is required. One of: ${TOOL_PROVIDERS["web-search"].join(", ")}`);
+            process.exit(1);
+          }
+          provider = await select5({
+            message: "Provider:",
+            choices: TOOL_PROVIDERS["web-search"].map((p) => ({ name: p, value: p })),
+            loop: false
+          });
+        }
+        if (!TOOL_PROVIDERS["web-search"].includes(provider)) {
+          printError(`provider must be one of: ${TOOL_PROVIDERS["web-search"].join(", ")}`);
+          process.exit(1);
+        }
+        let apiKey = opts.key;
+        if (!apiKey) {
+          if (!process.stdin.isTTY) {
+            printError("--key is required. Pass it as a flag or pipe via env.");
+            process.exit(1);
+          }
+          apiKey = await password({ message: `${provider} API key:`, mask: "*" });
+        }
+        if (!apiKey) {
+          printError("API key is required");
+          process.exit(1);
+        }
+        await apiFetch(
+          api.apiUrl,
+          api.authSecret,
+          "/api/skills/builtin-tools/web-search",
+          { method: "PUT", body: JSON.stringify({ provider, apiKey, enabled: true }) },
+          { "x-tenant-slug": tenant.slug }
+        );
+        printSuccess(`web_search configured with provider=${provider}, enabled=true`);
+        printWarning("Run `thinkwork tools web-search test` to verify connectivity.");
+      } catch (err) {
+        if (isCancellation(err)) return;
+        printError(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
     }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
-    printHeader("tools web-search test", opts.stage);
+  );
+  webSearch.command("test").description("Test the stored web_search provider + key against the provider API.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(async (opts) => {
     try {
+      const { stage, api, tenant } = await resolveCtx(opts);
+      printHeader("tools web-search test", stage);
       const result = await apiFetch(
         api.apiUrl,
         api.authSecret,
         "/api/skills/builtin-tools/web-search/test",
         { method: "POST", body: "{}" },
-        { "x-tenant-slug": opts.tenant }
+        { "x-tenant-slug": tenant.slug }
       );
       if (result.ok) {
         printSuccess(`${result.provider}: ${result.resultCount} result(s) returned.`);
@@ -2883,51 +3110,42 @@ function registerToolsCommand(program2) {
         process.exit(1);
       }
     } catch (err) {
-      printError(err.message);
+      if (isCancellation(err)) return;
+      printError(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
   });
-  webSearch.command("disable").description("Disable web_search without deleting the stored key").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
-    }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
+  webSearch.command("disable").description("Disable web_search without deleting the stored key.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(async (opts) => {
     try {
+      const { api, tenant } = await resolveCtx(opts);
       await apiFetch(
         api.apiUrl,
         api.authSecret,
         "/api/skills/builtin-tools/web-search",
         { method: "PUT", body: JSON.stringify({ enabled: false }) },
-        { "x-tenant-slug": opts.tenant }
+        { "x-tenant-slug": tenant.slug }
       );
       printSuccess("web_search disabled.");
     } catch (err) {
-      printError(err.message);
+      if (isCancellation(err)) return;
+      printError(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
   });
-  webSearch.command("clear").description("Remove web_search config entirely (deletes stored key)").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
-    }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
+  webSearch.command("clear").description("Remove web_search config entirely (deletes stored key).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(async (opts) => {
     try {
+      const { api, tenant } = await resolveCtx(opts);
       await apiFetch(
         api.apiUrl,
         api.authSecret,
         "/api/skills/builtin-tools/web-search",
         { method: "DELETE" },
-        { "x-tenant-slug": opts.tenant }
+        { "x-tenant-slug": tenant.slug }
       );
       printSuccess("web_search configuration cleared.");
     } catch (err) {
-      printError(err.message);
+      if (isCancellation(err)) return;
+      printError(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
   });
@@ -3024,7 +3242,7 @@ function registerUpdateCommand(program2) {
 
 // src/commands/user.ts
 import { spawn as spawn4 } from "child_process";
-import { input, select as select3 } from "@inquirer/prompts";
+import { input as input2, select as select6 } from "@inquirer/prompts";
 function getTerraformOutput2(cwd, key) {
   return new Promise((resolve3, reject) => {
     const proc = spawn4("terraform", ["output", "-raw", key], {
@@ -3067,9 +3285,6 @@ function runAwsCognitoReset(userPoolId, username, region) {
     proc.on("close", (code) => resolve3({ code: code ?? 1, stdout, stderr }));
   });
 }
-function isCancellation2(err) {
-  return err instanceof Error && err.name === "ExitPromptError";
-}
 function requireTty2(label) {
   if (!process.stdin.isTTY) {
     printError(
@@ -3080,7 +3295,7 @@ function requireTty2(label) {
 }
 async function promptEmail() {
   requireTty2("Email");
-  return await input({
+  return await input2({
     message: "Email address of the person to invite:",
     validate: (v) => v.trim().includes("@") ? true : "That doesn't look like an email."
   });
@@ -3098,7 +3313,7 @@ async function promptStage(region) {
     console.log(`  Using the only deployed stage: ${stages[0]}`);
     return stages[0];
   }
-  return await select3({
+  return await select6({
     message: "Which stage?",
     choices: stages.map((s) => ({ name: s, value: s })),
     loop: false
@@ -3117,7 +3332,7 @@ async function promptTenant(apiUrl, authSecret) {
     console.log(`  Using the only tenant: ${list[0].name} (${list[0].slug})`);
     return list[0].slug;
   }
-  return await select3({
+  return await select6({
     message: "Which tenant?",
     choices: list.map((t) => ({
       name: `${t.name}  (slug: ${t.slug})`,
@@ -3128,7 +3343,7 @@ async function promptTenant(apiUrl, authSecret) {
 }
 async function promptOptionalName() {
   if (!process.stdin.isTTY) return void 0;
-  const answer = await input({
+  const answer = await input2({
     message: "Display name (optional, press Enter to skip):",
     default: ""
   });
@@ -3136,7 +3351,7 @@ async function promptOptionalName() {
 }
 async function promptRole() {
   if (!process.stdin.isTTY) return "member";
-  return await select3({
+  return await select6({
     message: "Role:",
     choices: [
       { name: "member \u2014 regular access", value: "member" },
@@ -3245,7 +3460,7 @@ Agents / scripts that pass all flags stay non-interactive.
           `Invited ${email} to "${tenant}" (role: ${result.body.role}). Cognito has emailed a temporary password; the user sets a new password on first sign-in.`
         );
       } catch (err) {
-        if (isCancellation2(err)) {
+        if (isCancellation(err)) {
           console.log("");
           console.log("  Cancelled.");
           return;
@@ -3258,15 +3473,18 @@ Agents / scripts that pass all flags stay non-interactive.
     }
   );
   user.command("reset-password <email>").description(
-    "Trigger Cognito's forgot-password flow for a user (admin-initiated). Sends them a verification code email."
-  ).option("-p, --profile <name>", "AWS profile").requiredOption("-s, --stage <name>", "Deployment stage (e.g. dev, prod)").option(
+    "Trigger Cognito's forgot-password flow for a user (admin-initiated). Prompts for stage in a TTY when omitted."
+  ).option("-p, --profile <name>", "AWS profile").option("-s, --stage <name>", "Deployment stage (e.g. dev, prod)").option(
     "-r, --region <name>",
     "AWS region (defaults to AWS CLI default / AWS_REGION)"
   ).addHelpText(
     "after",
     `
 Examples:
-  # Admin-triggered password reset \u2014 works even if the account is locked
+  # Fully interactive \u2014 picks stage from the deployed ones
+  $ thinkwork user reset-password alice@example.com
+
+  # Scripted
   $ thinkwork user reset-password alice@example.com -s dev
 
   # Target a specific AWS profile + region
@@ -3279,10 +3497,12 @@ FORCE_CHANGE_PASSWORD or has been disabled.
 `
   ).action(
     async (email, opts) => {
-      const stageCheck = validateStage(opts.stage);
-      if (!stageCheck.valid) {
-        printError(stageCheck.error);
-        process.exit(1);
+      let stage;
+      try {
+        stage = await resolveStage({ flag: opts.stage, region: opts.region });
+      } catch (err) {
+        if (isCancellation(err)) return;
+        throw err;
       }
       if (!email || !email.includes("@")) {
         printError(
@@ -3290,11 +3510,11 @@ FORCE_CHANGE_PASSWORD or has been disabled.
         );
         process.exit(1);
       }
-      printHeader("user reset-password", opts.stage);
+      printHeader("user reset-password", stage);
       const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
-      const cwd = resolveTierDir(terraformDir, opts.stage, "app");
+      const cwd = resolveTierDir(terraformDir, stage, "app");
       await ensureInit(cwd);
-      await ensureWorkspace(cwd, opts.stage);
+      await ensureWorkspace(cwd, stage);
       let userPoolId;
       try {
         userPoolId = await getTerraformOutput2(cwd, "user_pool_id");
@@ -3341,47 +3561,6 @@ FORCE_CHANGE_PASSWORD or has been disabled.
 // src/commands/me.ts
 import { gql } from "@urql/core";
 
-// src/lib/resolve-stage.ts
-import { select as select4 } from "@inquirer/prompts";
-async function resolveStage(opts = {}) {
-  const region = opts.region ?? "us-east-1";
-  const validate = opts.validate ?? true;
-  const raw = opts.flag ?? process.env.THINKWORK_STAGE ?? loadCliConfig().defaultStage ?? await pickStage(region);
-  if (!raw) {
-    printError(
-      "No stage specified. Pass `--stage <name>`, set THINKWORK_STAGE, or run `thinkwork login --stage <name>`."
-    );
-    process.exit(1);
-  }
-  if (validate) {
-    const check = validateStage(raw);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
-    }
-  }
-  return raw;
-}
-async function pickStage(region) {
-  const stages = listDeployedStages(region);
-  if (stages.length === 0) {
-    printError(
-      `No Thinkwork deployments found in ${region}. Run \`thinkwork list\` or pass --region.`
-    );
-    process.exit(1);
-  }
-  if (stages.length === 1) {
-    console.log(`  Using the only deployed stage: ${stages[0]}`);
-    return stages[0];
-  }
-  requireTty("Stage");
-  return await select4({
-    message: "Which stage?",
-    choices: stages.map((s) => ({ name: s, value: s })),
-    loop: false
-  });
-}
-
 // src/lib/gql-client.ts
 import {
   Client,
@@ -3675,8 +3854,8 @@ Examples:
   $ thinkwork thread label remove thr-abc lbl-ops
 `
   ).action(() => notYetImplemented("thread label", 1));
-  thread.command("escalate <id>").description("Escalate a thread to another agent (carries context, records actor).").requiredOption("--to-agent <id>", "Agent to escalate to").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--reason <text>", "Reason note (appears in activity log)").action(() => notYetImplemented("thread escalate", 1));
-  thread.command("delegate <id>").description("Delegate ownership to another agent without the 'escalation' semantics.").requiredOption("--to-agent <id>", "Agent to delegate to").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("thread delegate", 1));
+  thread.command("escalate <id>").description("Escalate a thread to another agent (carries context, records actor).").option("--to-agent <id>", "Agent to escalate to").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--reason <text>", "Reason note (appears in activity log)").action(() => notYetImplemented("thread escalate", 1));
+  thread.command("delegate <id>").description("Delegate ownership to another agent without the 'escalation' semantics.").option("--to-agent <id>", "Agent to delegate to").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("thread delegate", 1));
   thread.command("delete <id>").description("Permanently delete a thread (not just close). Requires confirmation.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip the confirmation prompt").addHelpText(
     "after",
     `
@@ -3759,7 +3938,7 @@ Examples:
 `
   ).action(() => notYetImplemented("inbox approve", 1));
   inbox.command("reject <id>").description("Reject an inbox item. Downstream agents stop.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--notes <text>", "Rejection reason").action(() => notYetImplemented("inbox reject", 1));
-  inbox.command("request-revision <id>").description("Ask for changes \u2014 the agent gets the item back with your notes.").requiredOption("--notes <text>", "What needs to change").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("inbox request-revision", 1));
+  inbox.command("request-revision <id>").description("Ask for changes \u2014 the agent gets the item back with your notes.").option("--notes <text>", "What needs to change").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("inbox request-revision", 1));
   inbox.command("resubmit <id>").description("Resubmit a revised inbox item for approval.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--notes <text>", "What changed").action(() => notYetImplemented("inbox resubmit", 1));
   inbox.command("cancel <id>").description("Cancel a pending approval request (originator or admin).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("inbox cancel", 1));
   inbox.command("comment <id> [content]").description("Add a comment to an inbox item without deciding on it yet.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--file <path>", "Read comment body from a file").action(() => notYetImplemented("inbox comment", 1));
@@ -3811,15 +3990,15 @@ Examples:
   ).action(() => notYetImplemented("agent status", 2));
   agent.command("unpause <id>").description("Resume an agent paused by a budget policy trigger.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent unpause", 2));
   const capabilities = agent.command("capabilities").alias("cap").description("Toggle built-in capabilities (email inbox, web search, etc.).");
-  capabilities.command("set <agentId>").description("Enable/disable capabilities on an agent.").requiredOption("--capability <name>", "Capability name (email, web-search, file-upload, \u2026)").option("--enabled", "Enable (default if flag present)").option("--disabled", "Disable").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent capabilities set", 2));
+  capabilities.command("set <agentId>").description("Enable/disable capabilities on an agent.").option("--capability <name>", "Capability name (email, web-search, file-upload, \u2026)").option("--enabled", "Enable (default if flag present)").option("--disabled", "Disable").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent capabilities set", 2));
   const skills = agent.command("skills").description("Attach or configure MCP-backed skills on an agent.");
-  skills.command("set <agentId>").description("Enable/disable/configure a skill for an agent.").requiredOption("--skill <id>", "Skill ID (see `thinkwork skill list`)").option("--enabled", "Enable").option("--disabled", "Disable").option("--config <json>", "Inline JSON config for the skill").option("--rate-limit <rps>", "Rate limit in requests/sec").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent skills set", 2));
+  skills.command("set <agentId>").description("Enable/disable/configure a skill for an agent.").option("--skill <id>", "Skill ID (see `thinkwork skill list`)").option("--enabled", "Enable").option("--disabled", "Disable").option("--config <json>", "Inline JSON config for the skill").option("--rate-limit <rps>", "Rate limit in requests/sec").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent skills set", 2));
   const budget = agent.command("budget").description("Per-agent spend caps \u2014 pause or alert when exceeded.");
-  budget.command("set <agentId>").description("Set or update an agent's budget policy.").requiredOption("--limit-usd <amount>", "USD ceiling for the window").option("--window <w>", "daily | weekly | monthly", "monthly").option("--action <a>", "PAUSE | ALERT", "PAUSE").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent budget set", 2));
+  budget.command("set <agentId>").description("Set or update an agent's budget policy.").option("--limit-usd <amount>", "USD ceiling for the window").option("--window <w>", "daily | weekly | monthly", "monthly").option("--action <a>", "PAUSE | ALERT", "PAUSE").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent budget set", 2));
   budget.command("clear <agentId>").description("Remove an agent's budget policy (falls back to tenant-wide).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent budget clear", 2));
   const apiKey = agent.command("api-key").description("Agent API keys \u2014 service-to-service credentials tied to one agent.");
   apiKey.command("list <agentId>").description("List API keys for an agent (metadata only; plaintext shown on create).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent api-key list", 2));
-  apiKey.command("create <agentId>").description("Generate a new API key. The plaintext is printed once \u2014 save it.").requiredOption("--name <n>", "Human label for the key (e.g. 'GitHub Actions')").option("--expires <iso>", "Expiration (ISO-8601). Omit for no expiry.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+  apiKey.command("create <agentId>").description("Generate a new API key. The plaintext is printed once \u2014 save it.").option("--name <n>", "Human label for the key (e.g. 'GitHub Actions')").option("--expires <iso>", "Expiration (ISO-8601). Omit for no expiry.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
     "after",
     `
 Examples:
@@ -3956,7 +4135,7 @@ Examples:
   kb.command("update <id>").description("Update knowledge base metadata (name, description). Source changes need re-create.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--name <n>").option("--description <text>").action(() => notYetImplemented("kb update", 2));
   kb.command("delete <id>").description("Delete a knowledge base. Embeddings + index are destroyed.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("kb delete", 2));
   kb.command("sync <id>").description("Re-embed from S3. Idempotent; safe to re-run.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--wait", "Block until the sync finishes").action(() => notYetImplemented("kb sync", 2));
-  kb.command("attach <kbId>").description("Attach a knowledge base to an agent.").requiredOption("--agent <id>", "Agent ID").option("--config <json>", "Retrieval config (topK, score threshold, \u2026)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+  kb.command("attach <kbId>").description("Attach a knowledge base to an agent.").option("--agent <id>", "Agent ID").option("--config <json>", "Retrieval config (topK, score threshold, \u2026)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
     "after",
     `
 Examples:
@@ -3964,7 +4143,7 @@ Examples:
   $ thinkwork kb attach kb-runbooks --agent agt-oncall --config '{"topK":5}'
 `
   ).action(() => notYetImplemented("kb attach", 2));
-  kb.command("detach <kbId>").description("Detach a knowledge base from an agent.").requiredOption("--agent <id>", "Agent ID").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("kb detach", 2));
+  kb.command("detach <kbId>").description("Detach a knowledge base from an agent.").option("--agent <id>", "Agent ID").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("kb detach", 2));
 }
 
 // src/commands/routine.ts
@@ -3987,7 +4166,7 @@ Examples:
   run2.command("list <routineId>").alias("ls").description("List recent runs of a routine.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--limit <n>", "Max rows", "25").option("--cursor <c>", "Pagination cursor").action(() => notYetImplemented("routine run list", 3));
   run2.command("get <runId>").description("Fetch one run with its step outputs.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("routine run get", 3));
   const trigger = routine.command("trigger-config").description("Manage a routine's triggers (cron, webhook, event).");
-  trigger.command("set <routineId>").description("Set or replace a trigger for a routine.").requiredOption("--type <t>", "CRON | WEBHOOK | EVENT").option("--schedule <cron>", "Cron expression (for CRON triggers)").option("--event <name>", "Event name (for EVENT triggers)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+  trigger.command("set <routineId>").description("Set or replace a trigger for a routine.").option("--type <t>", "CRON | WEBHOOK | EVENT").option("--schedule <cron>", "Cron expression (for CRON triggers)").option("--event <name>", "Event name (for EVENT triggers)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
     "after",
     `
 Examples:
@@ -4040,7 +4219,7 @@ Examples:
 function registerWakeupCommand(program2) {
   const wake = program2.command("wakeup").alias("wakeups").description("View and create agent wakeup requests (deferred/enqueued invocations).");
   wake.command("list").alias("ls").description("List queued wakeups in the tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("wakeup list", 3));
-  wake.command("create").description("Queue a wakeup for an agent (ad-hoc or deferred).").requiredOption("--agent <id>", "Target agent").option("--thread <id>", "Thread to operate on (optional)").option("--delay-seconds <n>", "Wait N seconds before firing", "0").option("--payload <json>", "Optional input payload").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+  wake.command("create").description("Queue a wakeup for an agent (ad-hoc or deferred).").option("--agent <id>", "Target agent").option("--thread <id>", "Thread to operate on (optional)").option("--delay-seconds <n>", "Wait N seconds before firing", "0").option("--payload <json>", "Optional input payload").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
     "after",
     `
 Examples:
@@ -4122,12 +4301,12 @@ Examples:
 // src/commands/memory.ts
 function registerMemoryCommand(program2) {
   const memory = program2.command("memory").description("Inspect, search, and edit an agent's memory records and graph.");
-  memory.command("list").alias("ls").description("List memory records for an agent in a namespace.").requiredOption("--agent <id>", "Agent (assistant) ID").option(
+  memory.command("list").alias("ls").description("List memory records for an agent in a namespace.").option("--agent <id>", "Agent (assistant) ID").option(
     "--namespace <ns>",
     "Memory namespace (semantic | preferences | episodes | reflections)",
     "semantic"
   ).option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("memory list", 4));
-  memory.command("search").description("Search an agent's memory by query string.").requiredOption("--agent <id>", "Agent (assistant) ID").requiredOption("--query <q>", "Search query").option("--strategy <s>", "Retrieval strategy (semantic | keyword | hybrid)", "semantic").option("--limit <n>", "Max results", "10").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+  memory.command("search").description("Search an agent's memory by query string.").option("--agent <id>", "Agent (assistant) ID").option("--query <q>", "Search query").option("--strategy <s>", "Retrieval strategy (semantic | keyword | hybrid)", "semantic").option("--limit <n>", "Max results", "10").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
     "after",
     `
 Examples:
@@ -4136,9 +4315,9 @@ Examples:
 `
   ).action(() => notYetImplemented("memory search", 4));
   memory.command("get <recordId>").description("Fetch one memory record in full.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("memory get", 4));
-  memory.command("update <recordId>").description("Replace a memory record's content.").requiredOption("--content <text>", "New content").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("memory update", 4));
+  memory.command("update <recordId>").description("Replace a memory record's content.").option("--content <text>", "New content").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("memory update", 4));
   memory.command("delete <recordId>").description("Remove a memory record.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("memory delete", 4));
-  memory.command("graph").description("Print the agent's memory graph (summary in human mode; full JSON with --json).").requiredOption("--agent <id>", "Agent (assistant) ID").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("memory graph", 4));
+  memory.command("graph").description("Print the agent's memory graph (summary in human mode; full JSON with --json).").option("--agent <id>", "Agent (assistant) ID").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("memory graph", 4));
 }
 
 // src/commands/recipe.ts
@@ -4199,7 +4378,7 @@ function registerBudgetCommand(program2) {
   const budget = program2.command("budget").alias("budgets").description("Manage budget policies (tenant-wide or per-agent) and inspect current status.");
   budget.command("list").alias("ls").description("List budget policies in the tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("budget list", 5));
   budget.command("status").description("Show each budget's current spend vs. limit.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("budget status", 5));
-  budget.command("upsert").description("Create or update a budget policy.").requiredOption("--limit-usd <amount>", "USD ceiling for the window").option("--scope <s>", "tenant | agent", "tenant").option("--agent <id>", "Required if --scope=agent").option("--window <w>", "daily | weekly | monthly", "monthly").option("--action <a>", "PAUSE | ALERT", "PAUSE").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+  budget.command("upsert").description("Create or update a budget policy.").option("--limit-usd <amount>", "USD ceiling for the window").option("--scope <s>", "tenant | agent", "tenant").option("--agent <id>", "Required if --scope=agent").option("--window <w>", "daily | weekly | monthly", "monthly").option("--action <a>", "PAUSE | ALERT", "PAUSE").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
     "after",
     `
 Examples: