diff --git a/src/cli/crud.ts b/src/cli/crud.ts
index 928aeed..9c7ed99 100644
--- a/src/cli/crud.ts
+++ b/src/cli/crud.ts
@@ -279,7 +279,7 @@ export function registerResource(def: ResourceDef): void {
   if (def.customOperations) {
     for (const [verb, op] of Object.entries(def.customOperations)) {
       register({
-        name: `${def.plural}-${verb}`,
+        name: `${def.plural}-${verb.replace(/ /g, '-')}`,
         description: op.description,
         access: op.access,
         resource: def.plural,
diff --git a/src/cli/resources/groups.ts b/src/cli/resources/groups.ts
index 73ced9c..dc79e81 100644
--- a/src/cli/resources/groups.ts
+++ b/src/cli/resources/groups.ts
@@ -54,7 +54,7 @@ registerResource({
     {
       name: 'agent_provider',
       type: 'string',
-      description: 'Deprecated — use `ncl groups config-update --provider`. Kept for backwards compat.',
+      description: 'Deprecated — use `ncl groups config update --provider`. Kept for backwards compat.',
       updatable: false,
       default: null,
     },
@@ -62,7 +62,7 @@ registerResource({
   ],
   operations: { list: 'open', get: 'open', create: 'approval', update: 'approval', delete: 'approval' },
   customOperations: {
-    'config-get': {
+    'config get': {
       access: 'open',
       description: 'Show the container config for a group. Use --id <group-id>.',
       handler: async (args) => {
@@ -73,7 +73,7 @@ registerResource({
         return presentConfig(row);
       },
     },
-    'config-update': {
+    'config update': {
       access: 'approval',
       description:
         'Update container config scalar fields. Use --id <group-id> and any of: --provider, --model, --effort, --image-tag, --assistant-name, --max-messages-per-prompt.',
@@ -110,7 +110,7 @@ registerResource({
         return presentConfig(updated);
       },
     },
-    'config-add-mcp-server': {
+    'config add-mcp-server': {
       access: 'approval',
       description:
         'Add an MCP server to a group. Use --id <group-id> --name <server-name> --command <cmd> [--args <json-array>] [--env <json-object>].',
@@ -137,7 +137,7 @@ registerResource({
         return { added: name, servers };
       },
     },
-    'config-remove-mcp-server': {
+    'config remove-mcp-server': {
       access: 'approval',
       description: 'Remove an MCP server from a group. Use --id <group-id> --name <server-name>.',
       handler: async (args) => {
@@ -158,7 +158,7 @@ registerResource({
         return { removed: name };
       },
     },
-    'config-add-package': {
+    'config add-package': {
       access: 'approval',
       description: 'Add a package to a group. Use --id <group-id> and --apt <pkg> or --npm <pkg>.',
       handler: async (args) => {
@@ -193,7 +193,7 @@ registerResource({
         return { added: { apt: apt || null, npm: npm || null } };
       },
     },
-    'config-remove-package': {
+    'config remove-package': {
       access: 'approval',
       description: 'Remove a package from a group. Use --id <group-id> and --apt <pkg> or --npm <pkg>.',
       handler: async (args) => {
diff --git a/src/container-restart.ts b/src/container-restart.ts
index ff6ff51..74d7d4f 100644
--- a/src/container-restart.ts
+++ b/src/container-restart.ts
@@ -3,7 +3,7 @@
  *
  * Used by:
  * - self-mod approval handlers (after config change)
- * - ncl config-update (after CLI config change)
+ * - ncl groups config update (after CLI config change)
  */
 import { killContainer } from './container-runner.js';
 import { getSessionsByAgentGroup } from './db/sessions.js';