feat(cli): retrofit commands to agent-first JSON envelopes

.agents/skills/cli-design/agents/openai.yaml

@@ -0,0 +1,3 @@
+interface:
+  icon_small: "./assets/small-logo.svg"
+  icon_large: "./assets/large-logo.png"

.changeset/native-keychain-auto-reauth.md

@@ -0,0 +1,13 @@
+---
+"@godaddy/cli": minor
+---
+
+Replace keytar native addon with cross-platform OS keychain (macOS security CLI, Linux secret-tool, Windows PasswordVault). No native Node addons required.
+
+Fix CLI error routing: validation guard no longer misclassifies AuthenticationError and NetworkError as input validation errors.
+
+Fix `application list` to use Relay connection syntax (edges/node) matching the updated GraphQL schema.
+
+Add `--scope` option to `auth login` for requesting additional OAuth scopes beyond the defaults.
+
+Add `--scope` option to `api` command with automatic re-authentication on 403: decodes the JWT to detect missing scopes, triggers the browser auth flow, and retries the request.

.changeset/quiet-foxes-divide.md

@@ -0,0 +1,5 @@
+---
+"@godaddy/cli": patch
+---
+
+Fix `application deploy` by using the correct GraphQL enum casing when requesting the latest release.

.gitignore

@@ -197,4 +197,6 @@ schema.graphql
 graphql-env.d.ts
 
 # Alternative package manager lockfiles
-bun.lock
+bun.lock
+
+.pnpm-store

AGENTS.md

@@ -0,0 +1,39 @@
+# Agent Notes
+
+## Effect-First Patterns (Required)
+- Command handlers must use `Command.action(...)` with `Effect` values.
+- Do not use `actionAsync` anywhere.
+- Prefer `Effect.gen` for multi-step flows and `Effect.sync` for pure sync handlers.
+- Use `Effect.catchAll` at command boundaries to map runtime errors into structured CLI envelopes.
+
+## API Layer Pattern
+- Public module APIs use this shape:
+  1. Internal Promise implementation: `async function fooPromise(...)`.
+  2. Effect API: `export function fooEffect(...) => Effect.tryPromise(...)`.
+  3. Promise boundary wrapper (for compatibility): `export function foo(...) => Effect.runPromise(fooEffect(...))`.
+- Keep `Effect.runPromise` usage at boundaries only (CLI entrypoint and compatibility wrappers).
+
+## Imports and Dependencies
+- Use `import * as Effect from "effect/Effect"` directly.
+- Do not reintroduce `toEffect`/`effect-interop`; wrappers are explicit per function.
+- Prefer static imports of `*Effect` APIs over dynamic imports in commands.
+
+## Streaming / Long-Running Commands
+- For streamed command output, emit:
+  1. start event,
+  2. progress/step events,
+  3. final result event,
+  4. mapped stream error event on failure.
+- Keep stream callbacks best-effort and non-fatal.
+
+## Verification Checklist
+- `pnpm exec tsc --noEmit`
+- `pnpm run build`
+- `pnpm test tests/integration/cli-smoke.test.ts tests/unit/application-deploy-security.test.ts tests/unit/cli/deploy-stream.test.ts`
+- `rg "export async function" src` should be `0`.
+- `rg "toEffect|effect-interop" src` should be `0`.
+
+## Migration Pitfalls Seen
+- Name collisions: if a file already has a hand-written `*Effect` (example: deploy), do not route compatibility wrappers to the wrong effect signature.
+- Codemods can break import blocks; run typecheck immediately after broad transforms.
+- Keep command-level error emission consistent (`mapRuntimeError` + `nextActionsFor(...)`).

CLAUDE.md

@@ -1,7 +1,11 @@
-# CLAUDE.md
+# CLAUDE.md - GoDaddy CLI
 
 This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
 
+## Local Development Ports
+
+This is a command-line application that does not run on a network port.
+
 # GoDaddy CLI Development Guide
 
 ## Commands