feat(cli): add agent-safe exec and log filters

Adds Northflank-style parser-safe sandbox exec flags and top-level log filters for agent/operator workflows.

Author: robertohluna

README.md

@@ -147,6 +147,26 @@ Discover the full agent contract with:
 miosa capabilities --json
 ```
 
+### Agent-safe exec and logs
+
+Use explicit command flags when a command contains shell flags, pipes, redirects,
+or `bash -c` style arguments:
+
+```bash
+miosa sandbox exec <sandbox-id> \
+  --cwd /workspace \
+  --cmd "npm install && npm run build" \
+  --shell-cmd "bash -lc" \
+  --json
+```
+
+Top-level logs can target a resource explicitly and filter recent output:
+
+```bash
+miosa logs --deployment <app-id> --lines 200 --contains error --json
+miosa logs --sandbox <sandbox-id> --regex "500|panic|failed" --json
+```
+
 ### Deploy sub-commands
 
 ```bash

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@miosa/cli",
-  "version": "1.0.46",
+  "version": "1.0.47",
   "description": "MIOSA platform CLI — projects, sandboxes, deploys, databases, more",
   "type": "module",
   "bin": {

package.json

@@ -555,6 +555,51 @@ const manifest: CapabilitiesManifest = {
         "AUTH error",
       ],
     },
+    {
+      id: "operational_debugging",
+      title: "Inspect Logs And Exec Safely",
+      goal: "Give agents parser-safe command execution and filtered logs for app/debug loops.",
+      status: "stable",
+      steps: [
+        {
+          command:
+            'miosa sandbox exec <sandbox-id> --cwd /workspace --cmd "npm run build" --json',
+          purpose:
+            "Run a command string without requiring -- separator or argv reconstruction.",
+          json: true,
+        },
+        {
+          command:
+            'miosa sandbox exec <sandbox-id> --cwd /workspace --cmd "npm install && npm run build" --shell-cmd "bash -lc" --json',
+          purpose:
+            "Run shell expressions, pipes, redirects, and chained commands explicitly.",
+          json: true,
+        },
+        {
+          command:
+            'miosa logs --deployment <app-id> --lines 200 --contains error --json',
+          purpose:
+            "Fetch recent deployment logs filtered for a specific text signal.",
+          json: true,
+        },
+        {
+          command:
+            'miosa logs --sandbox <sandbox-id> --regex "500|panic|failed" --json',
+          purpose: "Filter sandbox logs by regex for automated diagnostics.",
+          json: true,
+        },
+      ],
+      success_signals: [
+        "exec exit_code 0",
+        "logs JSON parses",
+        "logs.count reflects filtered line count",
+      ],
+      failure_signals: [
+        "unknown option from command flags",
+        "empty logs during known failure",
+        "regex syntax error",
+      ],
+    },
     {
       id: "safe_workspace_cleanup",
       title: "Safe Workspace Cleanup",