The CLI now ships with @atproto/lexicon and 82 vendored lexicons (74 from tangled-core, 8 com.atproto.* from upstream), so record writes and XRPC calls are validated locally with field-level errors before any network round-trip. Output everywhere supports --json with standardized exit codes (0 ok, 2 auth, 3 not-found, 4 conflict, 5 permission, 6 timeout) and errors go to stderr as JSON when --json is set. New general-purpose commands: whoami, resolve, record get/list/put/delete, xrpc (with --as-service) New typed commands: repo show/list/edit/delete/fork/fork-sync/fork-status, collab list/remove, ref list/get, file get, pipeline wait/cancel, secret list/set/remove, lexicon list/show, batch (NDJSON command runner) The two highest-leverage additions for agents: pipeline wait blocks until a pipeline reaches terminal status and exits by outcome, and batch reads NDJSON commands from stdin so an agent can issue many ops without spawning the binary repeatedly. Two fixes along the way: - Auto-refresh the access JWT on 400 ExpiredToken (atproto returns expired tokens as 400, not 401, so long-running sessions used to stop working silently after the access JWT expired). - batch detects Bun-compiled mode via /\$bunfs/ argv prefix and uses process.execPath for self-spawning, since process.argv[0] is the bunfs virtual path which can't be re-executed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>