@agentuity/cli 1.0.40 → 1.0.42

package/dist/utils/zip.js

@@ -1,10 +1,11 @@
+import { readFileSync, lstatSync } from 'node:fs';
 import { relative } from 'node:path';
 import { Glob } from 'bun';
 import AdmZip from 'adm-zip';
 import { toForwardSlash } from './normalize-path';
 export async function zipDir(dir, outdir, options) {
     const zip = new AdmZip();
-    const files = await Array.fromAsync(new Glob('**/*').scan({ cwd: dir, absolute: true, dot: true }));
+    const files = await Array.fromAsync(new Glob('**/*').scan({ cwd: dir, absolute: true, dot: true, followSymlinks: false }));
     const total = files.length;
     let count = 0;
     for (const file of files) {
@@ -16,7 +17,22 @@ export async function zipDir(dir, outdir, options) {
             }
         }
         if (!skip) {
-            zip.addLocalFile(file, undefined, rel);
+            try {
+                // Skip symlinks and directories — symlinks are workspace artefacts
+                // (e.g. bun's node_modules links) that cannot be resolved portably
+                // across machines and would cause EISDIR errors on extraction.
+                const stat = lstatSync(file);
+                if (!stat.isSymbolicLink() && !stat.isDirectory()) {
+                    // Use addFile with explicit Unix permissions (0o644) instead of addLocalFile.
+                    // On Windows, addLocalFile relies on OS file stats which may produce zip entries
+                    // with incorrect Unix permission bits, causing EACCES errors when extracted on Linux.
+                    const data = readFileSync(file);
+                    zip.addFile(rel, data, '', 0o644);
+                }
+            }
+            catch (err) {
+                throw new Error(`Failed to add file to zip: ${rel} (${file})`, { cause: err });
+            }
         }
         count++;
         if (options?.progress) {

package/dist/utils/zip.js.map

@@ -1 +1 @@
-{"version":3,"file":"zip.js","sourceRoot":"","sources":["../../src/utils/zip.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAC3B,OAAO,MAAM,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAOlD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,MAAc,EAAE,OAAiB;IAC1E,MAAM,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAClC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAC9D,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAChD,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBAChC,IAAI,GAAG,IAAI,CAAC;YACb,CAAC;QACF,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,EAAE,CAAC;QACR,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;YACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,gDAAgD;QACtE,CAAC;IACF,CAAC;IACD,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;QACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,gDAAgD;IACvE,CAAC;AACF,CAAC"}
+{"version":3,"file":"zip.js","sourceRoot":"","sources":["../../src/utils/zip.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAC3B,OAAO,MAAM,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAOlD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,MAAc,EAAE,OAAiB;IAC1E,MAAM,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAClC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CACrF,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAChD,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBAChC,IAAI,GAAG,IAAI,CAAC;YACb,CAAC;QACF,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,CAAC;gBACJ,mEAAmE;gBACnE,mEAAmE;gBACnE,+DAA+D;gBAC/D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBACnD,8EAA8E;oBAC9E,iFAAiF;oBACjF,sFAAsF;oBACtF,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;oBAChC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;gBACnC,CAAC;YACF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,KAAK,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAChF,CAAC;QACF,CAAC;QACD,KAAK,EAAE,CAAC;QACR,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;YACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,gDAAgD;QACtE,CAAC;IACF,CAAC;IACD,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;QACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,gDAAgD;IACvE,CAAC;AACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@agentuity/cli",
-	"version": "1.0.40",
+	"version": "1.0.42",
 	"license": "Apache-2.0",
 	"author": "Agentuity employees and contributors",
 	"type": "module",
@@ -41,9 +41,9 @@
 		"prepublishOnly": "bun run clean && bun run build"
 	},
 	"dependencies": {
-		"@agentuity/auth": "1.0.40",
-		"@agentuity/core": "1.0.40",
-		"@agentuity/server": "1.0.40",
+		"@agentuity/auth": "1.0.42",
+		"@agentuity/core": "1.0.42",
+		"@agentuity/server": "1.0.42",
 		"@datasert/cronjs-parser": "^1.4.0",
 		"@vitejs/plugin-react": "^5.1.2",
 		"acorn-loose": "^8.5.2",
@@ -54,16 +54,15 @@
 		"enquirer": "^2.4.1",
 		"git-url-parse": "^16.1.0",
 		"json-colorizer": "^3.0.1",
-		"json5": "^2.2.3",
 		"tar": "^7.5.2",
 		"tar-fs": "^3.1.1",
 		"typescript": "^5.9.0",
 		"vite": "^7.2.7",
 		"zod": "^4.3.5",
-		"@agentuity/frontend": "1.0.40"
+		"@agentuity/frontend": "1.0.42"
 	},
 	"devDependencies": {
-		"@agentuity/test-utils": "1.0.40",
+		"@agentuity/test-utils": "1.0.42",
 		"@types/adm-zip": "^0.5.7",
 		"@types/bun": "latest",
 		"@types/tar-fs": "^2.0.4",

package/src/cli.ts

@@ -1215,7 +1215,7 @@ async function registerSubcommand(
 		}
 	}
 
-	// Add hidden --yes alias for --confirm if command has a confirm option
+	// Add hidden --yes and --force aliases for --confirm if command has a confirm option
 	if (subcommand.schema?.options) {
 		const parsed = parseOptionsSchema(subcommand.schema.options);
 		const hasConfirmOption = parsed.some((opt) => opt.name === 'confirm');
@@ -1224,6 +1224,14 @@ async function registerSubcommand(
 			const yesOption = cmd.createOption('--yes', 'Alias for --confirm');
 			yesOption.hideHelp();
 			cmd.addOption(yesOption);
+			// Add hidden --force option that sets confirm to true,
+			// but only if the schema doesn't already declare its own --force option
+			const hasForceOption = parsed.some((opt) => opt.name === 'force');
+			if (!hasForceOption) {
+				const forceOption = cmd.createOption('--force', 'Alias for --confirm');
+				forceOption.hideHelp();
+				cmd.addOption(forceOption);
+			}
 		}
 	}
 

package/src/cmd/build/ast.ts

@@ -9,7 +9,7 @@ import { StructuredError, type WorkbenchConfig } from '@agentuity/core';
 import type { LogLevel } from '../../types';
 
 import { existsSync, mkdirSync, statSync } from 'node:fs';
-import JSON5 from 'json5';
+import { parseJSONC } from '../../utils/jsonc';
 import { formatSchemaCode } from './format-schema';
 import { toForwardSlash } from '../../utils/normalize-path';
 import {
@@ -2963,8 +2963,11 @@ async function updateTsconfigPathMapping(rootDir: string, shouldAdd: boolean): P
 	try {
 		const tsconfigContent = await Bun.file(tsconfigPath).text();
 
-		// Use JSON5 to parse tsconfig.json (handles comments in input)
-		const tsconfig = JSON5.parse(tsconfigContent);
+		// Use JSONC parser to handle comments in tsconfig.json
+		const tsconfig = parseJSONC(tsconfigContent) as {
+			compilerOptions?: { paths?: Record<string, string[]> };
+			[key: string]: unknown;
+		};
 		const _before = JSON.stringify(tsconfig);
 
 		// Initialize compilerOptions and paths if they don't exist

package/src/cmd/build/typecheck.ts

@@ -24,6 +24,47 @@ export interface TypecheckOptions {
 	collector?: BuildReportCollector;
 }
 
+/**
+ * Filter tsc output to remove lines referencing node_modules paths.
+ *
+ * Some packages (e.g. @agentuity/runtime) ship .ts source files, which
+ * --skipLibCheck does not skip. Errors from those paths can crash the
+ * PEG-based tsc-output-parser because the parser expects every non-blank
+ * line to be a valid tsc error item.  Stripping these lines before parsing
+ * prevents the crash and avoids surfacing errors the user cannot fix.
+ *
+ * We also strip continuation lines (indented with 2+ leading spaces) that
+ * follow a node_modules error line, as they are part of the same diagnostic.
+ */
+function filterNodeModulesErrors(output: string): string {
+	const lines = output.split('\n');
+	const filtered: string[] = [];
+	let skipping = false;
+
+	for (const line of lines) {
+		// A tsc error line starts with a path, e.g. "node_modules/..." or "../node_modules/..."
+		// Also handle Windows-style paths with backslashes
+		const isNodeModulesError =
+			/^\.{0,2}[/\\]?node_modules[/\\]/.test(line) ||
+			/^[A-Za-z]:[/\\].*node_modules[/\\]/.test(line);
+
+		if (isNodeModulesError) {
+			skipping = true;
+			continue;
+		}
+
+		// Continuation lines of a multi-line tsc diagnostic start with whitespace
+		if (skipping && /^\s{2,}/.test(line)) {
+			continue;
+		}
+
+		skipping = false;
+		filtered.push(line);
+	}
+
+	return filtered.join('\n');
+}
+
 /**
  * run the typescript compiler and result formatted results
  *
@@ -39,7 +80,25 @@ export async function typecheck(dir: string, options?: TypecheckOptions): Promis
 		.nothrow();
 
 	const output = await result.text();
-	const errors = parse(output) as GrammarItem[];
+
+	// Filter out node_modules errors before parsing to prevent parser crashes.
+	// The PEG parser is strict and fails on lines it cannot match as tsc error items.
+	const filteredOutput = filterNodeModulesErrors(output);
+
+	let errors: GrammarItem[];
+	try {
+		errors = parse(filteredOutput) as GrammarItem[];
+	} catch {
+		// If the parser still fails (e.g. unexpected tsc output format), treat as
+		// an unknown error and show the raw output instead of crashing.
+		if (collector) {
+			collector.addGeneralError('typescript', output || result.stderr.toString());
+		}
+		return {
+			success: false,
+			output: output || result.stderr.toString(),
+		};
+	}
 
 	if (result.exitCode === 0) {
 		return {

package/src/cmd/build/vite/static-renderer.ts

@@ -29,30 +29,46 @@ interface RouteTreeNode {
 /**
  * Walks a TanStack Router route tree and extracts all non-parameterized paths.
  * Skips layout routes (no path) and parameterized routes (containing $).
+ *
+ * Accumulates the full URL path through the parent chain, since child routes
+ * under layout routes have relative paths (e.g., '/key-value' under a
+ * '/reference/api' layout should resolve to '/reference/api/key-value').
  */
 function extractRoutePaths(node: RouteTreeNode): string[] {
 	const paths = new Set<string>();
 
-	function walk(route: RouteTreeNode) {
-		const path: string | undefined = route.path ?? route.options?.path;
-		if (path && !path.includes('$')) {
-			// Normalize: strip trailing slashes, ensure leading slash
-			const normalized = path === '/' ? '/' : path.replace(/\/+$/, '');
+	function walk(route: RouteTreeNode, parentPath: string) {
+		const segment: string | undefined = route.path ?? route.options?.path;
+
+		// Build the full path by accumulating segments from parent routes.
+		// - Layout routes have no path (undefined) and don't contribute to the URL.
+		// - Index routes have path '/' and resolve to the parent path itself.
+		// - Leaf/layout routes have paths like '/reference/api' or '/key-value'.
+		let currentPath = parentPath;
+		if (segment && segment !== '/') {
+			// Non-root segment: append to parent path.
+			// Segments always start with '/' (TanStack Router convention).
+			currentPath = parentPath === '/' ? segment : parentPath + segment;
+		}
+
+		// Add non-parameterized, non-empty paths
+		if (currentPath && !currentPath.includes('$')) {
+			const normalized = currentPath === '/' ? '/' : currentPath.replace(/\/+$/, '');
 			if (normalized) {
 				paths.add(normalized);
 			}
 		}
 
-		// Recurse into children (TanStack Router stores them as an object)
+		// Recurse into children, passing the accumulated path
 		const children = route.children;
 		if (children && typeof children === 'object') {
 			for (const child of Object.values(children)) {
-				if (child) walk(child);
+				if (child) walk(child, currentPath);
 			}
 		}
 	}
 
-	walk(node);
+	walk(node, '');
 	return [...paths].sort();
 }
 

package/src/cmd/cloud/index.ts

@@ -14,6 +14,7 @@ import webhookCommand from './webhook';
 import { agentCommand } from './agent';
 import envCommand from './env';
 import apikeyCommand from './apikey';
+import oidcCommand from './oidc';
 import streamCommand from './stream';
 import vectorCommand from './vector';
 import { emailCommand } from './email';
@@ -23,6 +24,7 @@ import scheduleCommand from './schedule';
 import servicesCommand from './services';
 import { regionSubcommand } from './region';
 import { machineCommand } from './machine';
+import { monitorSubcommand } from './monitor';
 import { evalCommand } from './eval';
 import { evalRunCommand } from './eval-run';
 import { getCommand } from '../../command-prefix';
@@ -38,6 +40,7 @@ export const command = createCommand({
 	],
 	subcommands: [
 		apikeyCommand,
+		oidcCommand,
 		keyvalueCommand,
 		queueCommand,
 		webhookCommand,
@@ -60,6 +63,7 @@ export const command = createCommand({
 		threadCommand,
 		sshSubcommand,
 		scpSubcommand,
+		monitorSubcommand,
 		deploymentCommand,
 		regionSubcommand,
 		machineCommand,

package/src/cmd/cloud/monitor.ts

@@ -0,0 +1,375 @@
+import { z } from 'zod';
+import {
+	getMonitorNode,
+	listDistressedNodes,
+	listMonitorNodeContainers,
+	listMonitorNodes,
+	MonitorWebSocketClient,
+	type MachineMonitorState,
+	type MonitorMessage,
+	type MonitorScope,
+} from '@agentuity/core';
+import { getAPIBaseURL } from '../../api';
+import { getCommand } from '../../command-prefix';
+import { createSubcommand } from '../../types';
+import * as tui from '../../tui';
+
+const monitorOptionsSchema = z.object({
+	machine: z.string().optional().describe('Monitor a specific machine id'),
+	deployment: z.string().optional().describe('Monitor machines for a deployment id'),
+	distressed: z.boolean().optional().describe('Only include distressed machines'),
+	snapshot: z.boolean().optional().describe('One-shot snapshot (no stream watch)'),
+});
+
+export const monitorSubcommand = createSubcommand({
+	name: 'monitor',
+	description: 'Monitor infrastructure machines in real time',
+	tags: ['read-only', 'slow', 'requires-auth'],
+	requires: { auth: true, apiClient: true },
+	optional: { org: true },
+	idempotent: true,
+	examples: [
+		{ command: getCommand('cloud monitor --snapshot'), description: 'Show a monitor snapshot' },
+		{
+			command: getCommand('cloud monitor --distressed'),
+			description: 'Watch distressed machines',
+		},
+		{ command: getCommand('cloud monitor --machine mach_123'), description: 'Watch one machine' },
+	],
+	schema: {
+		options: monitorOptionsSchema,
+	},
+	webUrl: '/infrastructure/monitoring',
+
+	async handler(ctx) {
+		const { apiClient, options, opts, auth, config, orgId } = ctx;
+
+		if (opts.machine && opts.distressed) {
+			ctx.logger.fatal('--machine and --distressed are mutually exclusive.');
+		}
+
+		if (opts.deployment && opts.distressed) {
+			ctx.logger.fatal('--deployment and --distressed are mutually exclusive.');
+		}
+
+		if (opts.snapshot || options.json) {
+			const machines = await getSnapshotMachines({
+				apiClient,
+				machineId: opts.machine,
+				deploymentId: opts.deployment,
+				distressed: opts.distressed,
+			});
+
+			if (options.json) {
+				console.log(JSON.stringify(machines, null, 2));
+				return machines;
+			}
+
+			renderMachineTable(machines);
+			return machines;
+		}
+
+		const machineMap = new Map<string, MachineMonitorState>();
+
+		const initialMachines = await getSnapshotMachines({
+			apiClient,
+			machineId: opts.machine,
+			deploymentId: opts.deployment,
+			distressed: opts.distressed,
+		});
+
+		for (const machine of initialMachines) {
+			machineMap.set(machine.machineId, machine);
+		}
+
+		renderWatchTable(machineMap, {
+			mode: 'snapshot',
+			machineId: opts.machine,
+			deploymentId: opts.deployment,
+			distressed: opts.distressed,
+		});
+
+		tui.info('Connecting to monitoring stream...');
+
+		let processingChain = Promise.resolve();
+		let resolveWait: (() => void) | null = null;
+
+		const monitorClient = new MonitorWebSocketClient({
+			baseUrl: getAPIBaseURL(config),
+			token: auth.apiKey,
+			orgId,
+			scope: toMonitorScope(opts.machine, opts.deployment),
+			onOpen: () => {
+				tui.success('Connected to monitoring stream');
+			},
+			onError: (error) => {
+				tui.error(`Monitoring stream error: ${error.message}`);
+			},
+			onClose: () => {
+				tui.info('Monitoring stream disconnected');
+				resolveWait?.();
+			},
+			onMessage: (message) => {
+				processingChain = processingChain.then(async () => {
+					await applyMonitorMessage(machineMap, message, apiClient, opts.deployment);
+					renderWatchTable(machineMap, {
+						mode: 'watch',
+						machineId: opts.machine,
+						deploymentId: opts.deployment,
+						distressed: opts.distressed,
+						lastMessage: message,
+					});
+				});
+			},
+		});
+
+		monitorClient.connect();
+
+		await new Promise<void>((resolve) => {
+			resolveWait = resolve;
+			const onSigInt = () => {
+				monitorClient.close();
+				process.off('SIGINT', onSigInt);
+				resolve();
+			};
+			process.on('SIGINT', onSigInt);
+		});
+
+		return Array.from(machineMap.values());
+	},
+});
+
+async function getSnapshotMachines(params: {
+	apiClient: Parameters<typeof listMonitorNodes>[0];
+	machineId?: string;
+	deploymentId?: string;
+	distressed?: boolean;
+}): Promise<MachineMonitorState[]> {
+	const { apiClient, machineId, deploymentId, distressed } = params;
+
+	let machines: MachineMonitorState[];
+	if (distressed) {
+		machines = await listDistressedNodes(apiClient);
+	} else if (machineId) {
+		machines = [await getMonitorNode(apiClient, machineId)];
+	} else {
+		machines = await listMonitorNodes(apiClient);
+	}
+
+	if (!deploymentId) {
+		return machines;
+	}
+
+	const results = await Promise.all(
+		machines.map(async (machine) => {
+			const containers = await listMonitorNodeContainers(apiClient, machine.machineId);
+			const hasDeployment = containers.some(
+				(container) => container.deploymentId === deploymentId
+			);
+			return hasDeployment ? machine : null;
+		})
+	);
+	return results.filter((m): m is MachineMonitorState => m !== null);
+}
+
+function toMonitorScope(machineId?: string, deploymentId?: string): MonitorScope {
+	if (machineId) {
+		return { scope: 'machine', machineId };
+	}
+	if (deploymentId) {
+		return { scope: 'deployment', deploymentId };
+	}
+	return { scope: 'org' };
+}
+
+async function applyMonitorMessage(
+	machineMap: Map<string, MachineMonitorState>,
+	message: MonitorMessage,
+	apiClient: Parameters<typeof listMonitorNodes>[0],
+	deploymentId?: string
+) {
+	if (message.type === 'snapshot') {
+		machineMap.clear();
+		for (const machine of message.machines) {
+			machineMap.set(machine.machineId, machine);
+		}
+		if (deploymentId) {
+			await filterMapByDeployment(machineMap, apiClient, deploymentId);
+		}
+		return;
+	}
+
+	if (message.type === 'update') {
+		const existing = machineMap.get(message.machineId);
+		const next: MachineMonitorState = {
+			machineId: message.machineId,
+			orgId: existing?.orgId ?? '',
+			report: message.report,
+			compositeScore: message.report.capacity?.compositeScore ?? existing?.compositeScore ?? 0,
+			health: message.health,
+			reportedAt: usecToISO(message.report.reportedAtUs) ?? existing?.reportedAt ?? '',
+			updatedAt: new Date().toISOString(),
+			gravity: existing?.gravity ?? '',
+		};
+
+		if (deploymentId) {
+			const containers = await listMonitorNodeContainers(apiClient, message.machineId);
+			const include = containers.some((container) => container.deploymentId === deploymentId);
+			if (!include) {
+				machineMap.delete(message.machineId);
+				return;
+			}
+		}
+
+		machineMap.set(message.machineId, next);
+		return;
+	}
+
+	const existing = machineMap.get(message.machineId);
+	if (existing) {
+		existing.health = message.health;
+		existing.updatedAt = new Date().toISOString();
+		machineMap.set(message.machineId, existing);
+	}
+}
+
+async function filterMapByDeployment(
+	machineMap: Map<string, MachineMonitorState>,
+	apiClient: Parameters<typeof listMonitorNodes>[0],
+	deploymentId: string
+) {
+	const entries = Array.from(machineMap.keys());
+	const results = await Promise.all(
+		entries.map(async (machineId) => {
+			const containers = await listMonitorNodeContainers(apiClient, machineId);
+			const include = containers.some((container) => container.deploymentId === deploymentId);
+			return { machineId, include };
+		})
+	);
+	for (const { machineId, include } of results) {
+		if (!include) {
+			machineMap.delete(machineId);
+		}
+	}
+}
+
+function renderWatchTable(
+	machineMap: Map<string, MachineMonitorState>,
+	params: {
+		mode: 'snapshot' | 'watch';
+		machineId?: string;
+		deploymentId?: string;
+		distressed?: boolean;
+		lastMessage?: MonitorMessage;
+	}
+) {
+	console.clear();
+
+	const subtitle = [
+		params.mode === 'watch' ? 'Live mode' : 'Snapshot mode',
+		params.machineId ? `machine=${params.machineId}` : undefined,
+		params.deploymentId ? `deployment=${params.deploymentId}` : undefined,
+		params.distressed ? 'distressed=true' : undefined,
+	]
+		.filter(Boolean)
+		.join(' • ');
+
+	tui.header('Cloud Monitor');
+	if (subtitle) {
+		tui.info(subtitle);
+	}
+	if (params.lastMessage && params.lastMessage.type === 'state_change') {
+		tui.warning(
+			`${params.lastMessage.machineId}: ${params.lastMessage.previousHealth} -> ${params.lastMessage.health}`
+		);
+	}
+
+	renderMachineTable(Array.from(machineMap.values()));
+	tui.info('Press Ctrl+C to stop watching.');
+}
+
+function renderMachineTable(machines: MachineMonitorState[]) {
+	if (machines.length === 0) {
+		tui.info('No machines found');
+		return;
+	}
+
+	const rows = machines
+		.slice()
+		.sort((a, b) => a.machineId.localeCompare(b.machineId))
+		.map((machine) => ({
+			Machine: machine.machineId,
+			Health: formatHealth(machine.health),
+			CPU: formatPercent(machine.report?.host?.cpu?.usagePercent),
+			Memory: formatPercent(machine.report?.host?.memory?.usagePercent),
+			Disk: formatPercent(maxDiskUsage(machine.report?.host?.disks)),
+			Pressure: formatScore(machine.compositeScore),
+			Containers: `${machine.report?.capacity?.runningContainers ?? 0}/${machine.report?.capacity?.totalContainers ?? 0}`,
+			'Last Report': formatAge(machine.reportedAt),
+		}));
+
+	tui.table(rows, [
+		{ name: 'Machine' },
+		{ name: 'Health' },
+		{ name: 'CPU', alignment: 'right' },
+		{ name: 'Memory', alignment: 'right' },
+		{ name: 'Disk', alignment: 'right' },
+		{ name: 'Pressure', alignment: 'right' },
+		{ name: 'Containers', alignment: 'right' },
+		{ name: 'Last Report' },
+	]);
+}
+
+function formatHealth(health: string): string {
+	if (health === 'CONNECTED') return '● CONNECTED';
+	if (health === 'STALE') return '◌ STALE';
+	if (health === 'DISCONNECTED') return '○ DISCONNECTED';
+	return health;
+}
+
+function formatPercent(value?: number): string {
+	if (value === undefined || value === null || Number.isNaN(value)) {
+		return '-';
+	}
+	return `${value.toFixed(1)}%`;
+}
+
+function formatScore(score?: number): string {
+	if (score === undefined || score === null || Number.isNaN(score)) {
+		return '-';
+	}
+	if (score >= 0.85) {
+		return `${score.toFixed(2)} ⚠`;
+	}
+	return score.toFixed(2);
+}
+
+function maxDiskUsage(disks?: Array<{ usagePercent: number }>): number | undefined {
+	if (!disks || disks.length === 0) {
+		return undefined;
+	}
+	return Math.max(...disks.map((d) => d.usagePercent));
+}
+
+function formatAge(timestamp: string): string {
+	const date = new Date(timestamp);
+	const time = date.getTime();
+	if (Number.isNaN(time)) {
+		return '-';
+	}
+
+	const diff = Date.now() - time;
+	if (diff < 60_000) return `${Math.max(0, Math.floor(diff / 1000))}s ago`;
+	if (diff < 3_600_000) return `${Math.floor(diff / 60_000)}m ago`;
+	if (diff < 86_400_000) return `${Math.floor(diff / 3_600_000)}h ago`;
+	return `${Math.floor(diff / 86_400_000)}d ago`;
+}
+
+function usecToISO(us?: number): string | undefined {
+	if (us === undefined || us <= 0 || Number.isNaN(us)) {
+		return undefined;
+	}
+	return new Date(Math.floor(us / 1000)).toISOString();
+}
+
+export default monitorSubcommand;