diff --git a/.github/workflows/receive-endpoint-event.yml b/.github/workflows/receive-endpoint-event.yml
new file mode 100644
index 00000000..6ddaa13b
--- /dev/null
+++ b/.github/workflows/receive-endpoint-event.yml
@@ -0,0 +1,219 @@
+name: Receive endpoint change and generate CLI PR
+
+on:
+ workflow_dispatch:
+ inputs:
+ client_payload:
+ description: "Full client_payload JSON (the object under client_payload from the dispatch body)"
+ required: true
+ default: '{"relevant": true, "source_pr_url": "", "commit": "", "summary": "1 supported endpoint(s) affected: GET /api/v1/analytics/team", "changed_files": ["src/api/analytics/router.ts"], "changed_endpoints": [{"method": "GET", "path": "/api/v1/analytics/team", "change_type": "modified", "auth": ["userApiToken"], "summary": "team analytics", "source": "typescript", "api_server_files": ["src/api/analytics/router.ts"], "id": "analytics-team", "cli_command": "cloudos analytics team", "cli_source_file": "cloudos_cli/analytics/analytics.py", "query_params": ["teamId"]}]}'
+
+permissions:
+ contents: read
+
+jobs:
+ generate-pr:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v4
+ with:
+ token: ${{ secrets.AGENT_PR_PAT }}
+ fetch-depth: 0
+
+ - name: Resolve payload
+ id: payload
+ env:
+ # Use env vars to safely pass user inputs — avoids single-quote injection
+ # when the JSON payload contains quotes.
+ CLIENT_PAYLOAD: ${{ inputs.client_payload }}
+ run: |
+ if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+ # workflow_dispatch receives the client_payload object as a JSON string
+ # input — write it via env var (safe against single-quote injection).
+ printf '%s' "$CLIENT_PAYLOAD" > /tmp/payload.json
+ else
+ # repository_dispatch: client_payload is already JSON — write via tojson filter
+ cat <<'EOJSON' > /tmp/payload.json
+ ${{ toJson(github.event.client_payload) }}
+ EOJSON
+ fi
+
+ - name: Build Copilot PR body
+ run: |
+ python3 - <<'EOF'
+ import json
+ import sys
+
+ payload = json.load(open("/tmp/payload.json"))
+
+ if not payload.get("relevant", True):
+ print("Payload marked as not relevant — skipping.")
+ sys.exit(0)
+
+ endpoints = payload.get("changed_endpoints", [])
+ if not endpoints:
+ print("No changed endpoints in payload — skipping.")
+ sys.exit(0)
+
+ source_pr = payload.get("source_pr_url") or "manual trigger"
+ commit = payload.get("commit", "")
+ overall = payload.get("summary", "")
+ changed_files = payload.get("changed_files", [])
+ version = open("cloudos_cli/_version.py").read().strip()
+
+ fence = "```"
+
+ def fmt_list(items):
+ return ", ".join(items) if items else "—"
+
+ # Group endpoints by the CLI source file they map to, so the agent can
+ # tackle one module at a time.
+ by_file = {}
+ for ep in endpoints:
+ by_file.setdefault(ep.get("cli_source_file") or "(unknown)", []).append(ep)
+
+ lines = []
+ lines.append("## Sync cloudos-cli with a CloudOS API endpoint change\n")
+ lines.append(f"**Source PR:** {source_pr} ")
+ if commit:
+ lines.append(f"**api-server commit:** `{commit}` ")
+ lines.append(f"**Summary:** {overall}\n")
+
+ lines.append("### What changed (and where to act)\n")
+ lines.append(
+ "Each endpoint below was detected as changed in the api-server. "
+ "`source` tells you whether the change was found in the OpenAPI "
+ "`specification.yaml` (`specification`), in the TypeScript route/handler "
+ "code (`typescript`), or both. A `typescript`-only change means the "
+ "public contract may have shifted WITHOUT a spec update — read the "
+ "linked api-server files carefully before assuming the request/response "
+ "shape.\n"
+ )
+
+ for ep in endpoints:
+ method = ep.get("method") or ""
+ path = ep.get("path") or ""
+ change = ep.get("change_type") or "modified"
+ header = f"#### `{change}` — {method} {path}".strip()
+ lines.append(header)
+ if ep.get("new_path"):
+ lines.append(f"- **Renamed/new path:** `{ep['new_path']}`")
+ if ep.get("id"):
+ lines.append(f"- **Endpoint id:** `{ep['id']}` (key in `supported-endpoints.json`)")
+ if ep.get("cli_command"):
+ lines.append(f"- **CLI command to update:** `{ep['cli_command']}`")
+ if ep.get("cli_source_file"):
+ lines.append(f"- **CLI source file:** `{ep['cli_source_file']}`")
+ if ep.get("query_params"):
+ lines.append(f"- **Query params:** {fmt_list(ep['query_params'])}")
+ if ep.get("auth"):
+ lines.append(f"- **Auth strategies:** {fmt_list(ep['auth'])}")
+ lines.append(f"- **Detection source:** {ep.get('source', 'specification')}")
+ if ep.get("api_server_files"):
+ lines.append(
+ "- **api-server files that changed:** "
+ + fmt_list([f"`{f}`" for f in ep["api_server_files"]])
+ )
+ if ep.get("summary"):
+ lines.append(f"- **Notes:** {ep['summary']}")
+ lines.append("")
+
+ if changed_files:
+ lines.append("All changed api-server files
\n")
+ for f in changed_files:
+ lines.append(f"- `{f}`")
+ lines.append("\n