goodeye login
    Interactive sign-in for humans: browser/device-code flow; saves
    credentials on success.

goodeye login --email EMAIL
    Non-interactive email-code login start for agents and automation. Does not
    save credentials until you run goodeye login-verify with the emailed code.

goodeye login-verify --email EMAIL --code CODE
    Complete non-interactive email login and save credentials locally.

goodeye register --email EMAIL
    Start non-interactive account registration (emails a code when eligible).

goodeye register-verify --email EMAIL --code CODE
    Complete registration and save credentials locally.

goodeye logout
    Sign out on this machine by removing saved credentials. The key stays
    valid on the server; use `goodeye auth revoke-key` to disable it.

goodeye whoami
    Show who you're signed in as.

goodeye auth create-key --name NAME [--copy]
    Create a new API key. The secret is shown once - save it somewhere safe.

goodeye auth list-keys [--limit N] [--cursor TOKEN] [--all] [--json|--table]
    List your API keys. Secrets are never shown. Fetches one page by default;
    --all follows cursors and returns a combined items envelope.

goodeye auth revoke-key <key-id-or-name>
    Revoke an API key. The key stops working immediately. The argument may
    be the ID shown by `auth list-keys` or a unique key name.

goodeye workflows list [--filter mine|shared-with-me|all] [--tag TAG] [--search QUERY] [--limit N] [--cursor TOKEN] [--all] [--include-archived] [--json|--table]
    List workflows you can access (owned + shared with you via grants). The
    ID column is accepted by `get`, `archive`, `delete`, and grant commands.
    When signed in, you can also use your own workflow name (slug). Fetches
    one page by default; --all follows cursors and returns a combined items
    envelope. Pass --include-archived to also list your own archived
    workflows; the table then adds an "Archived at" column (restore with
    `workflows unarchive`).

goodeye workflows search <query> [--filter mine|shared-with-me|all] [--tag TAG] [--limit N] [--json|--table]
    LLM-ranked natural-language search over workflows you can access.
    Use this when you remember roughly what a workflow does but not its
    name; use `list` for plain enumeration or tag filtering. Defaults to
    --limit 5.

goodeye workflows get <id-or-name> [--version N] [--output PATH] [--json]
    Download a workflow. Prints markdown to stdout (wrapped with
    agent-facing markers); --json prints the full record. Authentication is
    required: workflows are private.

goodeye workflows publish <file.md|-> [--name NAME] [--description TEXT] [--outcome TEXT] [--tag TAG] [--expected-version-token TOKEN]
    Publish a workflow from markdown. Use `-` to read markdown from stdin,
    which is preferred for generated agent output. File input is still useful
    for durable local files. Always private. If a workflow with the same name
    already exists under your account, a new version is appended (pass
    --expected-version-token to confirm the parent version). Metadata may come
    from flags, front matter, or both; flags override front matter. `name`,
    `description`, and `outcome` are required. Repeat --tag to set tags. To
    share publicly, run `goodeye templates publish <workflow-uuid-or-name>` as
    a separate step.

goodeye workflows archive <id-or-name> [--yes]
    Archive a workflow you own. Archiving hides it from list results and
    grants but keeps every version and file intact. Reversible with
    `workflows unarchive`. Prefer this over `delete` unless you truly want
    permanent removal.

goodeye workflows unarchive <id-or-name>
    Restore an archived workflow you own (the inverse of `archive`). It
    becomes visible again in list results and grants.

goodeye workflows delete <id-or-name> [--yes]
    Permanently and immediately delete a workflow you own: the workflow, all
    its versions, all attached files, and all access grants are removed at
    once. There is NO recovery path; use `archive` for a reversible
    alternative.

goodeye workflows delete-version <id-or-name> <version> [--yes]
    Permanently and immediately delete a single non-current workflow version
    and its attached files. The current (live) version cannot be removed this
    way; use `delete` for the whole workflow. There is NO recovery path.
    Surviving version numbers are not renumbered.

goodeye workflows teach <id-or-name> [--trigger-context JSON]
    Fetch the teach SKILL pack for an existing workflow. The pack is
    printed to stdout for the calling agent to follow; persist the
    refined workflow with `goodeye workflows publish - --name <name> --description <description> --outcome <outcome> --source teach --expected-version-token <captured token>`.

goodeye workflows lineage <id-or-name> [--json]
    Show a workflow's fork lineage (parent template, upstream latest).

goodeye workflows grant <id-or-name> <grantee> <view|edit|admin> [--include-history]
    Share a workflow with a user email or @team handle. By default the
    grantee sees the version current at share time and later; pass
    --include-history to share the workflow's full version history.

goodeye workflows revoke-grant <id-or-name> <grantee>
    Revoke a direct grant.

goodeye workflows grants <id-or-name> [--json|--table]
    List grants on a workflow. Currently unpaginated.

goodeye workflows leave <id-or-name> [--yes]
    Remove your own direct grant on a shared workflow.

goodeye workflows transfer-ownership <id-or-name> <new-owner>
    Transfer a workflow you own to another user.

goodeye workflows sync [--target DIR] [--force] [--yes] [--json|--table]
    Pull every configured target, then print where each workflow stands.
    Equivalent to running `sync pull` followed by `sync status`. --force and
    --yes apply to that pull; they are ignored when a subcommand is given.

goodeye workflows sync target add <DIR> [--scope owned|all|selected] [--only GLOB] [--json|--table]
goodeye workflows sync target add --preset claude|agents|cursor [--scope owned|all|selected] [--only GLOB]
    Add a local directory to mirror workflows into. Give a path or a --preset
    (claude, agents, or cursor), not both. --scope picks which workflows land
    here: owned (the default), all (everything you can access), or selected
    (only the slugs or globs given with repeated --only). Local-only step; it
    does not contact the registry.

goodeye workflows sync target list [--json|--table]
    List the configured local sync targets with their scope.

goodeye workflows sync target remove <DIR>
    Remove a configured local sync target by its directory.

goodeye workflows sync auto [on [--interval SECONDS] | off] [--json|--table]
    Turn opt-in automatic background pulls on or off, or (with no argument)
    show the current setting and the last automatic-pull time. When on, the
    CLI keeps the safe set of your configured targets (new and behind-registry
    workflows) fresh in the background after a command finishes, no more often
    than the interval (default 3600 seconds). It never overwrites local edits,
    never deletes a local copy, and never blocks your command. Off by default.

goodeye workflows sync pull [SLUG...] [--target DIR] [--force] [--yes] [--json|--table]
    Pull registry workflows down to the configured directories, each written
    to <target>/<slug>/SKILL.md. Omit slugs to pull everything in scope. A
    locally edited file is preserved unless --force overwrites it. A workflow
    deleted on the registry has its local copy removed after a confirmation
    prompt (--yes skips it); this only ever touches local files.

goodeye workflows sync status [--target DIR] [--json|--table]
    Report drift between the registry and the local directories without
    fetching or writing anything: each workflow is classified clean, edited
    locally, behind the registry, conflicted, deleted upstream, or an
    untracked local directory, with the next step to reconcile it.

goodeye workflows sync push [SLUG...] [--target DIR] [--json|--table]
    Upload locally edited workflows back to the registry. Only files that
    differ from the last sync are sent, and each upload is checked against the
    registry's current version: if it moved since the last sync, that workflow
    is reported as a conflict and left untouched (reconcile with `sync pull`
    first). Omit slugs to push every locally edited workflow in scope.

goodeye templates list [--filter all|mine] [--search QUERY] [--limit N] [--cursor TOKEN] [--all] [--include-archived] [--json|--table]
    Browse the public template catalog. Anonymous reads allowed. Fetches one
    page by default; --all follows cursors and returns a combined items
    envelope. Pass --include-archived to also list your own archived
    templates (restore with `templates unarchive`); a template still appears
    only while at least one of its versions remains published.

goodeye templates search <query> [--filter all|mine] [--limit N] [--json|--table]
    LLM-ranked natural-language search over public templates. Defaults to
    --limit 5.

goodeye templates get <identifier> [--version N] [--output PATH] [--json]
    Fetch a public template by UUID or @handle/slug[@vN]. Anonymous reads
    allowed; non-owner reads include an unverified-template safety banner.

goodeye templates publish <workflow-uuid-or-name> [--release-notes TEXT]
    Publish a private workflow as a new public template version.
    Requires a claimed handle.

goodeye templates unpublish <template-ref> <version>
    Soft-unpublish a single template version. Existing forks keep working.
    <template-ref> is a template UUID or @handle/slug.

goodeye templates fork <identifier> [--version N] [--name NAME]
    Fork a public template into a private workflow. Authentication required.

goodeye templates archive <template-ref> [--reason TEXT] [--yes]
    Archive a template you own. Archiving hides it from the public catalog
    but keeps every version and fork lineage intact; existing forks keep
    working. Reversible with `templates unarchive`. <template-ref> is a
    template UUID or @handle/slug.

goodeye templates unarchive <template-ref>
    Restore an archived template you own (the inverse of `archive`). It
    becomes visible again in the public catalog.
    <template-ref> is a template UUID or @handle/slug.

goodeye templates delete <template-ref> [--yes]
    Permanently and immediately delete a template you own: the template, all
    its versions, all attached files, and all version verification records
    are removed at once. There is NO recovery path; use `archive` for a
    reversible alternative. A template that is not archived and still has a
    published version is refused (unpublish those versions or archive it
    first). Forks keep their own content; their parent pointer is severed and
    `workflows lineage` reports the source as permanently deleted.
    <template-ref> is a template UUID or @handle/slug.

goodeye templates delete-version <template-ref> <version> [--yes]
    Permanently and immediately delete a single template version, its files,
    and its verification records. The version must be unpublished first (use
    `templates unpublish`). There is NO recovery path. Surviving version
    numbers are not renumbered. <template-ref> is a template UUID or
    @handle/slug.

goodeye templates deprecate-version <template-ref> <version> --message TEXT
    Flag a single template version as deprecated, with a message shown
    to anyone who forks that version.
    <template-ref> is a template UUID or @handle/slug.

goodeye templates transfer-ownership <template-ref> <user-id-or-email-or-handle>
    Hand a template off to another Goodeye user. Owner only.
    <template-ref> is a template UUID or @handle/slug.

goodeye verifiers deploy <config.json|->
    Deploy a verifier from JSON config (or append a new version). Use `-` to
    read verifier config JSON from stdin, which is preferred for generated
    agent output. File input is still useful for durable local config files.
    Required fields: name, description, criterion, input_contract. input_fields
    required for text and text_image contracts; few_shot_examples and
    model_settings optional. expected_version_token is required when
    re-deploying an existing verifier (get it from `verifiers list`).

goodeye verifiers list [--limit N] [--cursor TOKEN] [--all] [--json|--table]
    List active verifiers you own with their current version and version token.
    Fetches one page by default; --all follows cursors and returns a combined
    items envelope.

goodeye verifiers show <verifier_id> [--version N] [--json]
    Show one verifier version: criterion, contract, calibration, config_hash.

goodeye verifiers run <verifier_id> [--inputs-json JSON] [--media-url URL] \
                                    [--version N] [--workflow-id UUID] \
                                    [--workflow-version N] [--workflow-ref TEXT] \
                                    [--run-id TEXT] [--anonymous] [--json]
    Run a verifier and print PASS/FAIL plus reasoning. <verifier_id> is a
    UUID, system:<name>, or your caller-owned name (resolved client-side
    via a single get_verifier call before the run). --anonymous skips
    credentials for the public-preview path; rate limited and requires a
    UUID or system:<name> (names cannot be resolved without auth).
    --inputs-json keys must match the version's input_fields exactly.
    --media-url is required for text_image and image contracts.

goodeye verifiers revoke <verifier_id> [--yes]
    Revoke a verifier you own. Irreversible; existing run rows are kept.

goodeye design
    Print the workflow-designer prompt to stdout. Pipe it into your AI
    assistant to start designing a workflow + verifier:
        goodeye design
    Only redirect to a file when you intentionally want a durable local prompt copy.

goodeye me claim-handle <handle>
    Claim a handle (your publish identity).

goodeye me rename-handle <new-handle>
    Change a previously claimed handle. Subject to a cooldown and yearly
    cap; old-handle template URLs redirect for a 90-day window.

goodeye teams list [--filter all|mine|member] [--json|--table]
    List teams visible to you. Currently unpaginated; JSON output is an
    items envelope.

goodeye teams members <team> [--json|--table]
    List members of a team. Currently unpaginated; JSON output is an
    items envelope.