feat(cli): add structured output to list commands (#3067)

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>

Author: mrunalp

.agents/skills/openshell-cli/SKILL.md

@@ -333,10 +333,15 @@ provider instead of passing API keys, tokens, or other secrets to `sandbox exec`
 
 ```bash
 openshell sandbox provider list my-sandbox
+openshell sandbox provider list my-sandbox --output json
 openshell sandbox provider attach my-sandbox my-github
 openshell sandbox provider detach my-sandbox my-github
 ```
 
+Structured attachment output contains provider names, types, and sorted
+credential and config key names. It never contains credential, handle, or
+config values.
+
 ### View logs
 
 ```bash
@@ -498,6 +503,7 @@ View all revisions to understand how the policy evolved:
 
 ```bash
 openshell policy list dev --limit 50
+openshell policy list dev --output json
 ```
 
 Fetch a specific historical revision:
@@ -576,6 +582,17 @@ openshell sandbox delete my-app
 openshell sandbox create --from ./Dockerfile --name my-app --forward 8080
 ```
 
+Use structured output when automation needs the tracked forward metadata and
+validated process state:
+
+```bash
+openshell forward list --output json
+```
+
+Each record includes `sandbox`, `bind_address`, `port`, `pid`, and `alive`.
+The `alive` boolean validates the tracked process identity; it does not probe
+the forwarded socket.
+
 Create and forward in one command:
 
 ```bash
@@ -738,6 +755,7 @@ openshell forward service my-app --target-port 8000 --local 127.0.0.1:0
 # Expose and manage an HTTP service through the gateway.
 openshell service expose my-app 8080 web
 openshell service list my-app
+openshell service list my-app --output json
 openshell service get my-app web
 openshell service delete my-app web
 ```

.agents/skills/openshell-cli/cli-reference.md

@@ -57,25 +57,25 @@ openshell
 │   ├── download <name> <path> [dest]
 │   ├── ssh-config [name]
 │   └── provider
-│       ├── list [name]
+│       ├── list [name] [-o table|yaml|json]
 │       ├── attach <name> <provider>
 │       └── detach <name> <provider>
 ├── forward
 │   ├── start <port> [name] [-d]
 │   ├── stop <port> [name]
-│   ├── list
+│   ├── list [-o table|yaml|json]
 │   └── service [name] --target-port <port> [opts]
 ├── service
 │   ├── expose <sandbox> <target-port> [service]
-│   ├── list [sandbox]
+│   ├── list [sandbox] [-o table|yaml|json]
 │   ├── get <sandbox> [service]
 │   └── delete <sandbox> [service]
 ├── logs [name] [opts]
 ├── policy
 │   ├── set [name] --policy <path> [--global] [--wait]
 │   ├── update [name] [opts]
 │   ├── get [name] [--full|--base] [--global]
-│   ├── list [name] [--global]
+│   ├── list [name] [--global] [-o table|yaml|json]
 │   ├── delete --global
 │   └── prove --policy <path> --credentials <path> [opts]
 ├── settings
@@ -107,6 +107,15 @@ openshell
 │   │   └── delete <id>
 │   ├── update <name> [opts]
 │   └── delete <name>...
+├── workspace
+│   ├── create <name>
+│   ├── get <name>
+│   ├── list [opts]
+│   ├── delete <name>...
+│   └── member
+│       ├── add --workspace <name> --subject <subject> --role <role>
+│       ├── remove --workspace <name> --subject <subject>
+│       └── list --workspace <name> [-o table|yaml|json]
 ├── doctor
 │   └── check
 ├── term
@@ -321,10 +330,13 @@ Print an SSH config `Host` block. The name defaults to the last-used sandbox.
 
 Manage providers on an existing sandbox:
 
-- `openshell sandbox provider list [name]`
+- `openshell sandbox provider list [name] [--output table|yaml|json]`
 - `openshell sandbox provider attach <name> <provider>`
 - `openshell sandbox provider detach <name> <provider>`
 
+Structured list output contains `name`, `type`, and sorted `credential_keys`
+and `config_keys` arrays. It excludes all credential, handle, and config values.
+
 ---
 
 ## Port Forwarding Commands
@@ -343,9 +355,15 @@ Start forwarding a local port to a sandbox.
 
 Stop a background port forward. When the sandbox name is omitted, it is inferred from active forwards.
 
-### `openshell forward list`
+### `openshell forward list [--output table|yaml|json]`
 
-List all active port forwards (sandbox, port, PID, status).
+List all tracked port forwards. Table output shows the sandbox, bind address,
+port, PID, and status. JSON and YAML output expose `sandbox`, `bind_address`,
+`port`, `pid`, and the boolean `alive`; an empty result is an empty collection.
+
+| Flag | Default | Description |
+|------|---------|-------------|
+| `-o`, `--output <FORMAT>` | `table` | Output format: `table`, `yaml`, or `json` |
 
 ### `openshell forward service [name] --target-port <port>`
 
@@ -364,10 +382,13 @@ Forward a local TCP port to a loopback service inside a sandbox over the gRPC re
 Gateway-managed HTTP service endpoints:
 
 - `openshell service expose <sandbox> <target-port> [service]`
-- `openshell service list [sandbox] [--limit N] [--offset N]`
+- `openshell service list [sandbox] [--limit N] [--offset N] [--output table|yaml|json]`
 - `openshell service get <sandbox> [service]`
 - `openshell service delete <sandbox> [service]`
 
+Structured list records contain `workspace`, `sandbox`, `service`,
+`target_port`, and `url`. Empty lists serialize as empty collections.
+
 ---
 
 ## Logs Command
@@ -454,6 +475,11 @@ List policy revision history (version, hash, status, created, error).
 |------|---------|-------------|
 | `--limit <N>` | 20 | Max revisions to return |
 | `--global` | false | List global policy revisions |
+| `-o`, `--output <FORMAT>` | `table` | Output format: `table`, `yaml`, or `json` |
+
+Structured records use the policy metadata contract from `policy get`: scope,
+sandbox when applicable, version, full hash, normalized status, and available
+timestamps, load error, and provenance.
 
 ### `openshell policy delete --global`
 
@@ -486,6 +512,16 @@ Sandbox names default to the last-used sandbox. The CLI fetches and submits each
 
 ---
 
+## Workspace Member Commands
+
+### `openshell workspace member list --workspace <name>`
+
+List workspace members. Add `--output table|yaml|json` to select the format.
+Structured records contain `subject` and a normalized `role` of `admin`,
+`user`, or `unknown`; empty lists serialize as empty collections.
+
+---
+
 ## Settings Commands
 
 Settings support sandbox and gateway-global scopes: