@aictiq/cli 0.0.0 → 0.2.0

package/dist/index.js

@@ -0,0 +1,3262 @@
+#!/usr/bin/env node
+
+// src/errors.ts
+var ExitCode = {
+  Ok: 0,
+  Error: 1,
+  Validation: 2,
+  Conflict: 3,
+  NotFound: 4,
+  Auth: 5
+};
+var CliError = class extends Error {
+  exitCode;
+  problem;
+  constructor(message3, exitCode = ExitCode.Error, problem) {
+    super(message3);
+    this.name = "CliError";
+    this.exitCode = exitCode;
+    this.problem = problem;
+  }
+};
+function exitCodeForStatus(status) {
+  if (status === 401) return ExitCode.Auth;
+  if (status === 403) return ExitCode.Auth;
+  if (status === 404) return ExitCode.NotFound;
+  if (status === 409) return ExitCode.Conflict;
+  if (status >= 400 && status < 500) return ExitCode.Validation;
+  return ExitCode.Error;
+}
+function formatProblem(problem, fallback) {
+  const lines = [problem?.title?.trim() || fallback];
+  if (problem?.detail && problem.detail !== problem.title) lines.push(problem.detail);
+  for (const [field, messages] of Object.entries(problem?.errors ?? {})) {
+    for (const message3 of messages) lines.push(`  ${field}: ${message3}`);
+  }
+  return lines.join("\n");
+}
+
+// src/program.ts
+import { Command as Command10 } from "commander";
+
+// src/commands/attachment.ts
+import { writeFile } from "fs/promises";
+import { Command } from "commander";
+
+// src/api/client.ts
+var AictiqClient = class {
+  baseUrl;
+  token;
+  doFetch;
+  constructor(options) {
+    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+    this.token = options.token;
+    this.doFetch = options.fetch ?? fetch;
+  }
+  async request(method, path, options = {}) {
+    const url = new URL(this.baseUrl + expand(path, options.path ?? {}));
+    for (const [key, value] of Object.entries(options.query ?? {})) {
+      if (value !== void 0 && value !== "") url.searchParams.set(key, String(value));
+    }
+    const headers = {
+      Authorization: `Bearer ${this.token}`,
+      Accept: "application/json",
+      "User-Agent": "aictiq-cli"
+    };
+    if (options.body !== void 0) headers["Content-Type"] = "application/json";
+    let response;
+    try {
+      response = await this.doFetch(url, {
+        method: method.toUpperCase(),
+        headers,
+        ...options.body === void 0 ? {} : { body: JSON.stringify(options.body) }
+      });
+    } catch (cause) {
+      throw new CliError(
+        `Cannot reach ${this.baseUrl}: ${cause instanceof Error ? cause.message : String(cause)}`,
+        ExitCode.Error
+      );
+    }
+    if (response.status === 204) return void 0;
+    const text = await response.text();
+    const payload = text.length === 0 ? void 0 : safeJson(text);
+    if (!response.ok) {
+      const problem = isProblem(payload) ? payload : void 0;
+      throw new CliError(
+        formatProblem(problem, `${response.status} ${response.statusText}`),
+        exitCodeForStatus(response.status),
+        problem
+      );
+    }
+    return payload;
+  }
+  /**
+   * Downloads an authenticated response without trying to interpret it as JSON. Attachments
+   * deliberately use the normal API route (rather than a presigned object-store URL), so a
+   * PAT's organization and project visibility checks remain in force.
+   */
+  async download(path, options = {}) {
+    const url = new URL(this.baseUrl + expand(path, options.path ?? {}));
+    for (const [key, value] of Object.entries(options.query ?? {})) {
+      if (value !== void 0 && value !== "") url.searchParams.set(key, String(value));
+    }
+    let response;
+    try {
+      response = await this.doFetch(url, {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${this.token}`,
+          Accept: "*/*",
+          "User-Agent": "aictiq-cli"
+        }
+      });
+    } catch (cause) {
+      throw new CliError(
+        `Cannot reach ${this.baseUrl}: ${cause instanceof Error ? cause.message : String(cause)}`,
+        ExitCode.Error
+      );
+    }
+    if (!response.ok) {
+      const text = await response.text();
+      const payload = text.length === 0 ? void 0 : safeJson(text);
+      const problem = isProblem(payload) ? payload : void 0;
+      throw new CliError(
+        formatProblem(problem, `${response.status} ${response.statusText}`),
+        exitCodeForStatus(response.status),
+        problem
+      );
+    }
+    return new Uint8Array(await response.arrayBuffer());
+  }
+};
+function expand(template, values) {
+  return template.replace(/\{(\w+)\}/g, (_match, name) => {
+    const value = values[name];
+    if (value === void 0) throw new Error(`Missing path parameter "${name}" for ${template}`);
+    return encodeURIComponent(value);
+  });
+}
+function safeJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { title: text.slice(0, 500) };
+  }
+}
+function isProblem(value) {
+  return typeof value === "object" && value !== null;
+}
+
+// src/config.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+function configPath(env = process.env) {
+  const base = env.AICTIQ_CONFIG_HOME ?? env.XDG_CONFIG_HOME ?? join(homedir(), ".config");
+  return join(base, "aictiq", "config.json");
+}
+function readConfig(path = configPath()) {
+  if (!existsSync(path)) return {};
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (typeof parsed !== "object" || parsed === null) return {};
+    const { url, token, org } = parsed;
+    return {
+      ...typeof url === "string" ? { url } : {},
+      ...typeof token === "string" ? { token } : {},
+      ...typeof org === "string" ? { org } : {}
+    };
+  } catch {
+    return {};
+  }
+}
+function writeConfig(config, path = configPath()) {
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync(path, `${JSON.stringify(config, null, 2)}
+`, { mode: 384 });
+  chmodSync(path, 384);
+}
+function clearConfig(path = configPath()) {
+  rmSync(path, { force: true });
+}
+
+// src/context.ts
+function resolveSettings(options, env = process.env, stored = readConfig()) {
+  return {
+    url: options.url ?? env.AICTIQ_URL ?? stored.url,
+    token: options.token ?? env.AICTIQ_TOKEN ?? stored.token,
+    org: options.org ?? env.AICTIQ_ORG ?? stored.org
+  };
+}
+function createContext(options) {
+  const settings = resolveSettings(options);
+  if (!settings.url) {
+    throw new CliError("No Aictiq URL. Run `aictiq auth login --url <url>`.", ExitCode.Auth);
+  }
+  if (!settings.token) {
+    throw new CliError("No personal access token. Run `aictiq auth login`.", ExitCode.Auth);
+  }
+  const client = new AictiqClient({ baseUrl: settings.url, token: settings.token });
+  let resolved;
+  return {
+    client,
+    json: options.json === true,
+    org() {
+      if (settings.org) return Promise.resolve(settings.org);
+      resolved ??= resolveOrg(client);
+      return resolved;
+    }
+  };
+}
+async function resolveOrg(client) {
+  const orgs = await client.request(
+    "get",
+    "/api/v1/orgs"
+  );
+  if (orgs.length === 0) {
+    throw new CliError("This account is not a member of any organization.", ExitCode.NotFound);
+  }
+  if (orgs.length > 1) {
+    const slugs = orgs.map((o) => o.slug).join(", ");
+    throw new CliError(
+      `This token can see several organizations (${slugs}). Pass --org, set AICTIQ_ORG, or run \`aictiq auth login --org <slug>\`.`,
+      ExitCode.Validation
+    );
+  }
+  return orgs[0].slug;
+}
+
+// src/commands/attachment.ts
+function attachmentCommand(globals) {
+  const attachment = new Command("attachment").description("Download an attachment");
+  attachment.command("get").description("Write an attachment to stdout, or to --output").argument("<id>", "Attachment UUID").option("-o, --output <path>", "Write to this path instead of stdout").action(async (id, options) => {
+    const ctx = createContext(globals());
+    const bytes = await ctx.client.download(
+      "/api/v1/orgs/{orgSlug}/attachments/{attachmentId}/download",
+      { path: { orgSlug: await ctx.org(), attachmentId: id } }
+    );
+    if (options.output) {
+      await writeFile(options.output, bytes, { mode: 384 });
+      return;
+    }
+    process.stdout.write(bytes);
+  });
+  return attachment;
+}
+
+// src/commands/auth.ts
+import { Command as Command2 } from "commander";
+
+// src/output.ts
+function renderTable(rows, columns) {
+  const cells = rows.map((row) => columns.map((column) => column.value(row) ?? ""));
+  const widths = columns.map(
+    (column, index) => Math.max(column.header.length, ...cells.map((row) => row[index]?.length ?? 0), 0)
+  );
+  const line = (values) => values.map(
+    (value, index) => index === values.length - 1 ? columns[index]?.align === "right" ? value.padStart(widths[index]) : value : columns[index]?.align === "right" ? value.padStart(widths[index]) : value.padEnd(widths[index])
+  ).join("  ").trimEnd();
+  return [line(columns.map((c) => c.header)), ...cells.map(line)].join("\n");
+}
+function renderFields(fields) {
+  const present = fields.filter((f) => f[1] !== void 0 && f[1] !== "");
+  const width = Math.max(0, ...present.map(([label]) => label.length));
+  return present.map(([label, value]) => `${label.padEnd(width)}  ${value}`).join("\n");
+}
+function print(text) {
+  process.stdout.write(text.endsWith("\n") ? text : `${text}
+`);
+}
+function printJson(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+}
+function formatDate(value) {
+  if (!value) return "";
+  const date = new Date(value);
+  return Number.isNaN(date.getTime()) ? String(value) : date.toISOString().slice(0, 10);
+}
+function formatNumber(value) {
+  return value === null || value === void 0 ? "" : String(value);
+}
+function formatDateTime(value) {
+  if (!value) return "";
+  const date = new Date(value);
+  return Number.isNaN(date.getTime()) ? String(value) : `${date.toISOString().slice(0, 19).replace("T", " ")}Z`;
+}
+
+// src/prompt.ts
+import { createInterface } from "readline";
+async function promptSecret(question) {
+  if (!process.stdin.isTTY) {
+    const chunks = [];
+    for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks).toString("utf8").trim();
+  }
+  const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+  try {
+    process.stdout.write(question);
+    const muted = rl;
+    const original = muted.output.write.bind(muted.output);
+    muted.output.write = (() => true);
+    const answer = await new Promise((resolve3) => rl.question("", resolve3));
+    muted.output.write = original;
+    process.stdout.write("\n");
+    return answer.trim();
+  } finally {
+    rl.close();
+  }
+}
+
+// src/commands/auth.ts
+function authCommand(globals) {
+  const auth = new Command2("auth").description(
+    "Sign in to a Aictiq instance and inspect the session"
+  );
+  auth.command("login").description("Store a personal access token for an instance").option("--url <url>", "Base URL of the Aictiq instance").option("--token <token>", "Personal access token (aiq_\u2026); read from stdin when omitted").option("--org <slug>", "Default organization slug for scoped commands").action(async (options) => {
+    const global = globals();
+    const url = options.url ?? global.url ?? process.env.AICTIQ_URL ?? readConfig().url;
+    if (!url)
+      throw new CliError(
+        "Pass --url with the address of your Aictiq instance.",
+        ExitCode.Validation
+      );
+    const token = options.token ?? global.token ?? process.env.AICTIQ_TOKEN ?? await promptSecret("Personal access token: ");
+    if (!token) throw new CliError("No token supplied.", ExitCode.Validation);
+    const client = new AictiqClient({ baseUrl: url, token });
+    const session = await client.request(
+      "get",
+      "/api/v1/auth/session"
+    );
+    const orgs = await client.request(
+      "get",
+      "/api/v1/orgs"
+    );
+    const org = options.org ?? global.org ?? (orgs.length === 1 ? orgs[0].slug : void 0);
+    writeConfig({ url: url.replace(/\/+$/, ""), token, ...org ? { org } : {} });
+    if (global.json) {
+      printJson({
+        url,
+        org: org ?? null,
+        user: session,
+        organizations: orgs,
+        configPath: configPath()
+      });
+      return;
+    }
+    print(`Signed in to ${url} as ${session.email}.`);
+    if (org) print(`Default organization: ${org}`);
+    else if (orgs.length > 1)
+      print(`Several organizations are visible; pass --org next time or set AICTIQ_ORG.`);
+    print(`Token stored in ${configPath()} (0600).`);
+  });
+  auth.command("status").description("Show the configured instance, identity and organizations").action(async () => {
+    const global = globals();
+    const settings = resolveSettings(global);
+    if (!settings.url || !settings.token) {
+      if (global.json) {
+        printJson({ authenticated: false, url: settings.url ?? null, configPath: configPath() });
+        return;
+      }
+      throw new CliError("Not signed in. Run `aictiq auth login --url <url>`.", ExitCode.Auth);
+    }
+    const client = new AictiqClient({ baseUrl: settings.url, token: settings.token });
+    const session = await client.request(
+      "get",
+      "/api/v1/auth/session"
+    );
+    const orgs = await client.request(
+      "get",
+      "/api/v1/orgs"
+    );
+    if (global.json) {
+      printJson({
+        authenticated: true,
+        url: settings.url,
+        org: settings.org ?? null,
+        user: session,
+        organizations: orgs,
+        configPath: configPath()
+      });
+      return;
+    }
+    print(
+      renderFields([
+        ["URL", settings.url],
+        ["User", `${session.email} (${session.id})`],
+        ["Organization", settings.org ?? "(not set)"],
+        ["Config", configPath()]
+      ])
+    );
+    if (orgs.length > 0) {
+      print("");
+      print(
+        renderTable(orgs, [
+          { header: "SLUG", value: (o) => o.slug },
+          { header: "NAME", value: (o) => o.name },
+          { header: "ROLE", value: (o) => o.role }
+        ])
+      );
+    }
+  });
+  auth.command("logout").description("Delete the stored token").action(() => {
+    clearConfig();
+    if (globals().json) printJson({ removed: configPath() });
+    else print(`Removed ${configPath()}.`);
+  });
+  return auth;
+}
+
+// src/commands/item.ts
+import { Command as Command3, Option } from "commander";
+
+// src/resolve.ts
+import { readFileSync as readFileSync2 } from "fs";
+function projectKeyOf(itemKey) {
+  const normalized = itemKey.trim().toUpperCase();
+  const dash = normalized.lastIndexOf("-");
+  if (dash <= 0) {
+    throw new CliError(
+      `"${itemKey}" is not a work item key (expected e.g. ACME-123).`,
+      ExitCode.Validation
+    );
+  }
+  return normalized.slice(0, dash);
+}
+function normalizeItemKey(itemKey) {
+  return itemKey.trim().toUpperCase();
+}
+async function getWorkflow(ctx, projectKey) {
+  const workflows = await ctx.client.request("get", "/api/v1/orgs/{orgSlug}/projects/{projectKey}/workflows", {
+    path: { orgSlug: await ctx.org(), projectKey }
+  });
+  const workflow = workflows.find((w) => w.isDefault) ?? workflows[0];
+  if (!workflow) throw new CliError(`Project ${projectKey} has no workflow.`, ExitCode.NotFound);
+  return workflow;
+}
+function findState(workflow, name) {
+  const wanted = name.trim().toLowerCase();
+  const state = workflow.states.find((s) => s.name.toLowerCase() === wanted);
+  if (!state) {
+    const names = workflow.states.map((s) => s.name).join(", ");
+    throw new CliError(`No workflow state named "${name}". States: ${names}.`, ExitCode.Validation);
+  }
+  return state;
+}
+async function getLabels(ctx, projectKey) {
+  return ctx.client.request("get", "/api/v1/orgs/{orgSlug}/projects/{projectKey}/labels", {
+    path: { orgSlug: await ctx.org(), projectKey }
+  });
+}
+async function getTeams(ctx, projectKey) {
+  return ctx.client.request("get", "/api/v1/orgs/{orgSlug}/projects/{projectKey}/teams", {
+    path: { orgSlug: await ctx.org(), projectKey }
+  });
+}
+async function getItem(ctx, itemKey) {
+  return ctx.client.request(
+    "get",
+    "/api/v1/orgs/{orgSlug}/items/{itemKey}",
+    { path: { orgSlug: await ctx.org(), itemKey: normalizeItemKey(itemKey) } }
+  );
+}
+function resolveLabelIds(spec, available, current) {
+  const tokens = spec.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
+  const adjusting = tokens.some((t) => t.startsWith("+") || t.startsWith("-"));
+  const replacing = tokens.some((t) => !t.startsWith("+") && !t.startsWith("-"));
+  if (adjusting && replacing) {
+    throw new CliError(
+      "Use either a plain label list (replaces all) or +/- adjustments, not both.",
+      ExitCode.Validation
+    );
+  }
+  const byName = new Map(available.map((label) => [label.name.toLowerCase(), label]));
+  const lookup = (name) => {
+    const label = byName.get(name.toLowerCase());
+    if (!label) {
+      throw new CliError(
+        `No label "${name}" in this project. Labels: ${available.map((l) => l.name).join(", ") || "(none)"}.`,
+        ExitCode.Validation
+      );
+    }
+    return label.id;
+  };
+  if (!adjusting) return tokens.map(lookup);
+  const ids = new Set(current.map((label) => label.id));
+  for (const token of tokens) {
+    const id = lookup(token.slice(1));
+    if (token.startsWith("+")) ids.add(id);
+    else ids.delete(id);
+  }
+  return [...ids];
+}
+async function readBody(message3, file) {
+  if (message3 !== void 0 && file !== void 0) {
+    throw new CliError("Pass either -m or --body-file, not both.", ExitCode.Validation);
+  }
+  if (message3 !== void 0) return message3;
+  if (file === void 0) return void 0;
+  if (file === "-") {
+    const chunks = [];
+    for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks).toString("utf8");
+  }
+  try {
+    return readFileSync2(file, "utf8");
+  } catch (cause) {
+    throw new CliError(
+      `Cannot read ${file}: ${cause instanceof Error ? cause.message : String(cause)}`,
+      ExitCode.Validation
+    );
+  }
+}
+function branchName(item, maxWords = 6) {
+  const slug = item.title.toLowerCase().normalize("NFKD").replace(/[^\da-z]+/g, " ").trim().split(/\s+/).filter((word) => word.length > 0).slice(0, maxWords).join("-");
+  return slug ? `${item.key.toLowerCase()}-${slug}` : item.key.toLowerCase();
+}
+
+// src/commands/item.ts
+var types = ["epic", "feature", "story", "task", "bug"];
+var priorities = ["none", "low", "medium", "high", "urgent"];
+function itemCommand(globals) {
+  const item = new Command3("item").description("Work items");
+  item.command("list").description("List work items in a project").requiredOption("-p, --project <key>", "Project key, e.g. ACME").option(
+    "-f, --filter <expression>",
+    'Item filter, e.g. "state:active assignee:@me label:backend"'
+  ).option("-q, --query <text>", "Full-text search within the project").option("-s, --sort <field>", "Sort expression accepted by the API").option("--page <n>", "Page number", "1").option("--page-size <n>", "Items per page (max 100)", "25").action(
+    async (options) => {
+      const ctx = createContext(globals());
+      const page = await ctx.client.request("get", "/api/v1/orgs/{orgSlug}/projects/{projectKey}/items", {
+        path: { orgSlug: await ctx.org(), projectKey: options.project.toUpperCase() },
+        query: {
+          filter: options.filter,
+          q: options.query,
+          sort: options.sort,
+          page: options.page,
+          pageSize: options.pageSize
+        }
+      });
+      if (ctx.json) return printJson(page);
+      if (page.items.length === 0) return print("No items match.");
+      print(
+        renderTable(page.items, [
+          { header: "KEY", value: (i) => i.key },
+          { header: "TYPE", value: (i) => i.type },
+          { header: "STATE", value: (i) => i.stateCategory },
+          { header: "PRIORITY", value: (i) => i.priority },
+          { header: "PTS", value: (i) => formatNumber(i.points), align: "right" },
+          { header: "TITLE", value: (i) => i.title }
+        ])
+      );
+      print("");
+      print(`Page ${page.page} of ${Math.max(1, page.totalPages)} \xB7 ${page.totalCount} items`);
+    }
+  );
+  item.command("view").description("Show one work item").argument("<key>", "Item key, e.g. ACME-123").option("--comments", "Include the comment thread").option("--links", "Include external links").action(async (key, options) => {
+    const ctx = createContext(globals());
+    const orgSlug = await ctx.org();
+    const itemKey = normalizeItemKey(key);
+    const found = await getItem(ctx, itemKey);
+    const comments = options.comments ? await listComments(ctx, orgSlug, itemKey) : void 0;
+    const links = options.links ? await listLinks(ctx, orgSlug, itemKey) : void 0;
+    if (ctx.json) {
+      return printJson({
+        ...found,
+        ...comments ? { comments } : {},
+        ...links ? { links } : {}
+      });
+    }
+    const state = await stateName(ctx, found);
+    print(`${found.key}  ${found.title}`);
+    print("");
+    print(
+      renderFields([
+        ["Type", found.type],
+        ["State", `${state} (${found.stateCategory})`],
+        ["Priority", found.priority],
+        ["Assignee", found.assigneeId ?? "(unassigned)"],
+        ["Claimed by", found.claimedBy ?? void 0],
+        ["Points", formatNumber(found.points)],
+        ["Remaining hours", formatNumber(found.remainingHours)],
+        ["Labels", found.labels.map((l) => l.name).join(", ")],
+        ["Blocked", found.blocked ? "yes" : ""],
+        ["Updated", formatDate(found.updatedAt)],
+        ["Version", String(found.version)]
+      ])
+    );
+    if (found.descriptionMarkdown.trim().length > 0) {
+      print("");
+      print(found.descriptionMarkdown.trim());
+    }
+    if (links && links.length > 0) {
+      print("");
+      print(
+        renderTable(links, [
+          { header: "KIND", value: (l) => l.kind },
+          { header: "URL", value: (l) => l.url },
+          { header: "TITLE", value: (l) => l.title ?? "" }
+        ])
+      );
+    }
+    if (comments) {
+      print("");
+      for (const comment of comments) {
+        if (comment.deletedAt) continue;
+        print(
+          `--- ${comment.author.displayName}${comment.author.isAgent ? " [agent]" : ""} \xB7 ${formatDate(comment.createdAt)}`
+        );
+        print(comment.bodyMarkdown.trim());
+        print("");
+      }
+    }
+  });
+  item.command("create").description("Create a work item").requiredOption("-p, --project <key>", "Project key, e.g. ACME").addOption(new Option("-t, --type <type>", "Item type").choices(types).default("task")).requiredOption("--title <title>", "Item title").option("-m, --body <markdown>", "Description in Markdown").option("--body-file <path>", "Read the description from a file, or - for stdin").addOption(new Option("--priority <priority>", "Priority").choices(priorities)).option("--parent <key>", "Parent item key, e.g. ACME-100").option("--team <key>", "Team key or name").option("--labels <names>", "Comma-separated label names").option("--points <n>", "Story points").option("--estimate <hours>", "Original estimate in hours").action(
+    async (options) => {
+      const ctx = createContext(globals());
+      const projectKey = options.project.toUpperCase();
+      const description = await readBody(options.body, options.bodyFile);
+      const parent = options.parent ? await getItem(ctx, options.parent) : void 0;
+      const teamId = options.team ? await resolveTeamId(ctx, projectKey, options.team) : void 0;
+      const labelIds = options.labels ? resolveLabelIds(options.labels, await getLabels(ctx, projectKey), []) : void 0;
+      const created = await ctx.client.request("post", "/api/v1/orgs/{orgSlug}/projects/{projectKey}/items", {
+        path: { orgSlug: await ctx.org(), projectKey },
+        body: {
+          type: options.type,
+          title: options.title,
+          ...description === void 0 ? {} : { descriptionMarkdown: description },
+          ...options.priority ? { priority: options.priority } : {},
+          ...parent ? { parentId: parent.id } : {},
+          ...teamId ? { teamId } : {},
+          ...labelIds ? { labelIds } : {},
+          ...options.points ? { points: number(options.points, "points") } : {},
+          ...options.estimate ? { estimateHours: number(options.estimate, "estimate") } : {}
+        }
+      });
+      if (ctx.json) return printJson(created);
+      print(`${created.key}  ${created.title}`);
+    }
+  );
+  item.command("update").description("Update a work item").argument("<key>", "Item key, e.g. ACME-123").option("--title <title>", "New title").option("-m, --body <markdown>", "New description in Markdown").option("--body-file <path>", "Read the description from a file, or - for stdin").addOption(new Option("--priority <priority>", "Priority").choices(priorities)).addOption(new Option("--type <type>", "Item type").choices(types)).option("--assignee <userId>", 'Assignee user id, or "none" to unassign').option("--labels <names>", "Label names: a plain list replaces, +name/-name adjusts").option("--points <n>", "Story points").option("--estimate <hours>", "Original estimate in hours").option("--remaining <hours>", "Remaining hours").option("--version <n>", "Expected version; read from the item when omitted").action(
+    async (key, options) => {
+      const ctx = createContext(globals());
+      const itemKey = normalizeItemKey(key);
+      const current = await getItem(ctx, itemKey);
+      const description = await readBody(options.body, options.bodyFile);
+      const labelIds = options.labels ? resolveLabelIds(
+        options.labels,
+        await getLabels(ctx, projectKeyOf(itemKey)),
+        current.labels
+      ) : void 0;
+      const updated = await ctx.client.request("patch", "/api/v1/orgs/{orgSlug}/items/{itemKey}", {
+        path: { orgSlug: await ctx.org(), itemKey },
+        body: {
+          // PATCH is an absolute assignment for the nullable fields - an omitted
+          // `parentId` unparents the item, an omitted `assigneeId` unassigns it. So the
+          // body starts from what the item currently holds and the flags overwrite it;
+          // otherwise `--priority high` would quietly detach a story from its feature.
+          type: current.type,
+          title: current.title,
+          descriptionMarkdown: current.descriptionMarkdown,
+          stateId: current.stateId,
+          priority: current.priority,
+          assigneeId: current.assigneeId,
+          teamId: current.teamId,
+          parentId: current.parentId,
+          points: current.points,
+          estimateHours: current.estimateHours,
+          remainingHours: current.remainingHours,
+          completedHours: current.completedHours,
+          dueDate: current.dueDate,
+          version: options.version ? number(options.version, "version") : current.version,
+          ...options.title === void 0 ? {} : { title: options.title },
+          ...description === void 0 ? {} : { descriptionMarkdown: description },
+          ...options.priority ? { priority: options.priority } : {},
+          ...options.type ? { type: options.type } : {},
+          ...options.assignee === void 0 ? {} : { assigneeId: options.assignee === "none" ? null : options.assignee },
+          ...labelIds ? { labelIds } : {},
+          ...options.points ? { points: number(options.points, "points") } : {},
+          ...options.estimate ? { estimateHours: number(options.estimate, "estimate") } : {},
+          ...options.remaining ? { remainingHours: number(options.remaining, "remaining") } : {}
+        }
+      });
+      if (ctx.json) return printJson(updated);
+      print(`${updated.key} updated (version ${updated.version}).`);
+    }
+  );
+  item.command("move").description("Move an item: to another workflow state, sprint, parent or backlog rank").argument("<key>", "Item key, e.g. ACME-123").option("--state <name>", 'Workflow state to transition to, e.g. "In Review"').option("--sprint <sprintId>", 'Sprint id, or "none" to return it to the backlog').option("--parent <key>", "New parent item key").option("--after <key>", "Rank it directly after this item").option("--before <key>", "Rank it directly before this item").option("--version <n>", "Expected version; read from the item when omitted").action(
+    async (key, options) => {
+      const ctx = createContext(globals());
+      const orgSlug = await ctx.org();
+      const itemKey = normalizeItemKey(key);
+      const current = await getItem(ctx, itemKey);
+      const version2 = options.version ? number(options.version, "version") : current.version;
+      const ranking = options.sprint !== void 0 || options.parent !== void 0 || options.after !== void 0 || options.before !== void 0;
+      if (!options.state && !ranking) {
+        throw new CliError(
+          "Pass --state, or one of --sprint/--parent/--after/--before.",
+          ExitCode.Validation
+        );
+      }
+      let result = current;
+      if (options.state) {
+        const workflow = await getWorkflow(ctx, projectKeyOf(itemKey));
+        const state = findState(workflow, options.state);
+        result = await ctx.client.request("post", "/api/v1/orgs/{orgSlug}/items/{itemKey}/transition", {
+          path: { orgSlug, itemKey },
+          body: { toStateId: state.id, version: version2 }
+        });
+      }
+      if (ranking) {
+        result = await ctx.client.request("post", "/api/v1/orgs/{orgSlug}/items/{itemKey}/move", {
+          path: { orgSlug, itemKey },
+          body: {
+            // The transition above already spent the version it read.
+            version: options.state ? result.version : version2,
+            ...options.sprint === void 0 ? {} : options.sprint === "none" ? { removeSprint: true } : { sprintId: options.sprint },
+            ...options.parent === void 0 ? {} : { parentKey: normalizeItemKey(options.parent) },
+            ...options.after === void 0 ? {} : { afterKey: normalizeItemKey(options.after) },
+            ...options.before === void 0 ? {} : { beforeKey: normalizeItemKey(options.before) }
+          }
+        });
+      }
+      if (ctx.json) return printJson(result);
+      print(`${result.key} moved (version ${result.version}).`);
+    }
+  );
+  item.command("claim").description("Claim an item for the authenticated identity (compare-and-swap)").argument("<key>", "Item key, e.g. ACME-123").option("--version <n>", "Expected version; read from the item when omitted").action(async (key, options) => {
+    const ctx = createContext(globals());
+    const itemKey = normalizeItemKey(key);
+    const version2 = options.version ? number(options.version, "version") : (await getItem(ctx, itemKey)).version;
+    const result = await ctx.client.request("post", "/api/v1/orgs/{orgSlug}/items/{itemKey}/claim", {
+      path: { orgSlug: await ctx.org(), itemKey },
+      body: { version: version2 }
+    });
+    if (ctx.json) return printJson(result);
+    print(`${itemKey} claimed.`);
+  });
+  item.command("release").description("Release a claim you hold").argument("<key>", "Item key, e.g. ACME-123").action(async (key) => {
+    const ctx = createContext(globals());
+    const itemKey = normalizeItemKey(key);
+    await ctx.client.request(
+      "post",
+      "/api/v1/orgs/{orgSlug}/items/{itemKey}/release",
+      { path: { orgSlug: await ctx.org(), itemKey } }
+    );
+    if (ctx.json) return printJson({ key: itemKey, released: true });
+    print(`${itemKey} released.`);
+  });
+  item.command("heartbeat").description("Refresh the claim heartbeat so the claim does not go stale").argument("<key>", "Item key, e.g. ACME-123").action(async (key) => {
+    const ctx = createContext(globals());
+    const itemKey = normalizeItemKey(key);
+    await ctx.client.request(
+      "post",
+      "/api/v1/orgs/{orgSlug}/items/{itemKey}/heartbeat",
+      { path: { orgSlug: await ctx.org(), itemKey } }
+    );
+    if (ctx.json) return printJson({ key: itemKey, heartbeat: (/* @__PURE__ */ new Date()).toISOString() });
+    print(`${itemKey} heartbeat sent.`);
+  });
+  item.command("comment").description("Add a comment to an item").argument("<key>", "Item key, e.g. ACME-123").option("-m, --body <markdown>", "Comment body in Markdown").option("--body-file <path>", "Read the body from a file, or - for stdin").action(async (key, options) => {
+    const ctx = createContext(globals());
+    const body = await readBody(options.body, options.bodyFile);
+    if (!body || body.trim().length === 0) {
+      throw new CliError('Pass -m "text" or --body-file <path>.', ExitCode.Validation);
+    }
+    const comment = await ctx.client.request("post", "/api/v1/orgs/{orgSlug}/items/{itemKey}/comments", {
+      path: { orgSlug: await ctx.org(), itemKey: normalizeItemKey(key) },
+      body: { bodyMarkdown: body }
+    });
+    if (ctx.json) return printJson(comment);
+    print(`Comment added to ${normalizeItemKey(key)}.`);
+  });
+  item.command("subtask").description("Create a child item under an existing one").argument("<key>", "Parent item key, e.g. ACME-123").requiredOption("--title <title>", "Subtask title").addOption(new Option("-t, --type <type>", "Item type").choices(types).default("task")).option("-m, --body <markdown>", "Description in Markdown").option("--body-file <path>", "Read the description from a file, or - for stdin").option("--estimate <hours>", "Original estimate in hours").action(
+    async (key, options) => {
+      const ctx = createContext(globals());
+      const parentKey = normalizeItemKey(key);
+      const parent = await getItem(ctx, parentKey);
+      const description = await readBody(options.body, options.bodyFile);
+      const created = await ctx.client.request("post", "/api/v1/orgs/{orgSlug}/projects/{projectKey}/items", {
+        path: { orgSlug: await ctx.org(), projectKey: projectKeyOf(parentKey) },
+        body: {
+          type: options.type,
+          title: options.title,
+          parentId: parent.id,
+          ...parent.teamId ? { teamId: parent.teamId } : {},
+          ...description === void 0 ? {} : { descriptionMarkdown: description },
+          ...options.estimate ? { estimateHours: number(options.estimate, "estimate") } : {}
+        }
+      });
+      if (ctx.json) return printJson(created);
+      print(`${created.key}  ${created.title}`);
+    }
+  );
+  item.command("link").description("Attach an external link to an item").argument("<key>", "Item key, e.g. ACME-123").option("--url <url>", "Any public URL").option("--pr <url>", "Pull request URL (an alias for --url)").action(async (key, options) => {
+    const ctx = createContext(globals());
+    const url = options.url ?? options.pr;
+    if (!url) throw new CliError("Pass --url <url> or --pr <url>.", ExitCode.Validation);
+    const link = await ctx.client.request("post", "/api/v1/orgs/{orgSlug}/items/{itemKey}/links", {
+      path: { orgSlug: await ctx.org(), itemKey: normalizeItemKey(key) },
+      body: { url }
+    });
+    if (ctx.json) return printJson(link);
+    print(`Linked ${link.url} to ${normalizeItemKey(key)}.`);
+  });
+  item.command("branch").description("Print the branch name convention for an item").argument("<key>", "Item key, e.g. ACME-123").action(async (key) => {
+    const ctx = createContext(globals());
+    const found = await getItem(ctx, key);
+    const branch = branchName(found);
+    if (ctx.json) return printJson({ key: found.key, branch });
+    print(branch);
+  });
+  return item;
+}
+async function listComments(ctx, orgSlug, itemKey) {
+  const page = await ctx.client.request("get", "/api/v1/orgs/{orgSlug}/items/{itemKey}/comments", {
+    path: { orgSlug, itemKey },
+    query: { pageSize: 100 }
+  });
+  return page.items;
+}
+async function listLinks(ctx, orgSlug, itemKey) {
+  return ctx.client.request(
+    "get",
+    "/api/v1/orgs/{orgSlug}/items/{itemKey}/links",
+    { path: { orgSlug, itemKey } }
+  );
+}
+async function stateName(ctx, item) {
+  const workflow = await getWorkflow(ctx, projectKeyOf(item.key));
+  return workflow.states.find((s) => s.id === item.stateId)?.name ?? item.stateCategory;
+}
+async function resolveTeamId(ctx, projectKey, wanted) {
+  const teams = await getTeams(ctx, projectKey);
+  const needle = wanted.trim().toLowerCase();
+  const team = teams.find(
+    (t) => t.key.toLowerCase() === needle || t.name.toLowerCase() === needle || t.id === wanted
+  );
+  if (!team) {
+    throw new CliError(
+      `No team "${wanted}" in ${projectKey}. Teams: ${teams.map((t) => t.key).join(", ") || "(none)"}.`,
+      ExitCode.Validation
+    );
+  }
+  return team.id;
+}
+function number(raw, field) {
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed)) {
+    throw new CliError(`--${field} must be a number, got "${raw}".`, ExitCode.Validation);
+  }
+  return parsed;
+}
+
+// src/commands/mcp.ts
+import { Command as Command4 } from "commander";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  CallToolRequestSchema,
+  GetPromptRequestSchema,
+  ListPromptsRequestSchema,
+  ListResourceTemplatesRequestSchema,
+  ListResourcesRequestSchema,
+  ListToolsRequestSchema,
+  ReadResourceRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+
+// src/version.ts
+import { createRequire } from "module";
+var manifest = createRequire(import.meta.url)("../package.json");
+var version = manifest.version ?? "0.0.0";
+
+// src/commands/mcp.ts
+function mcpCommand(globals) {
+  return new Command4("mcp").description("Run a stdio MCP server bridged to this instance (for Claude Code and friends)").action(async () => {
+    const settings = resolveSettings(globals());
+    if (!settings.url || !settings.token) {
+      throw new CliError(
+        "No instance configured. Run `aictiq auth login --url <url>` or set AICTIQ_URL and AICTIQ_TOKEN.",
+        ExitCode.Auth
+      );
+    }
+    const upstream = new Client({ name: "aictiq-cli", version }, { capabilities: {} });
+    try {
+      await upstream.connect(
+        new StreamableHTTPClientTransport(
+          new URL("/mcp", `${settings.url.replace(/\/+$/, "")}/`),
+          { requestInit: { headers: { Authorization: `Bearer ${settings.token}` } } }
+        )
+      );
+    } catch (cause) {
+      const detail = cause instanceof Error ? cause.message : String(cause);
+      throw new CliError(
+        detail.includes("403") || detail.includes("401") ? `${settings.url} refused the token for /mcp. It needs the "mcp" scope and must be bound to one organization - create it under Settings \u2192 Access tokens with an organization selected.` : `Cannot open an MCP session at ${settings.url}/mcp: ${detail}`,
+        ExitCode.Auth
+      );
+    }
+    const capabilities = upstream.getServerCapabilities() ?? {};
+    const server = new Server(
+      { name: "aictiq", version },
+      {
+        capabilities: {
+          ...capabilities.tools ? { tools: capabilities.tools } : {},
+          ...capabilities.resources ? { resources: capabilities.resources } : {},
+          ...capabilities.prompts ? { prompts: capabilities.prompts } : {}
+        }
+      }
+    );
+    if (capabilities.tools) {
+      server.setRequestHandler(
+        ListToolsRequestSchema,
+        (request) => upstream.listTools(request.params)
+      );
+      server.setRequestHandler(
+        CallToolRequestSchema,
+        (request) => upstream.callTool(request.params)
+      );
+    }
+    if (capabilities.resources) {
+      server.setRequestHandler(
+        ListResourcesRequestSchema,
+        (request) => upstream.listResources(request.params)
+      );
+      server.setRequestHandler(
+        ListResourceTemplatesRequestSchema,
+        (request) => upstream.listResourceTemplates(request.params)
+      );
+      server.setRequestHandler(
+        ReadResourceRequestSchema,
+        (request) => upstream.readResource(request.params)
+      );
+    }
+    if (capabilities.prompts) {
+      server.setRequestHandler(
+        ListPromptsRequestSchema,
+        (request) => upstream.listPrompts(request.params)
+      );
+      server.setRequestHandler(
+        GetPromptRequestSchema,
+        (request) => upstream.getPrompt(request.params)
+      );
+    }
+    await server.connect(new StdioServerTransport());
+    const shutdown = async () => {
+      await Promise.allSettled([server.close(), upstream.close()]);
+      process.exit(0);
+    };
+    process.on("SIGINT", () => void shutdown());
+    process.on("SIGTERM", () => void shutdown());
+    await new Promise((resolve3) => process.stdin.once("close", resolve3));
+    await shutdown();
+  });
+}
+
+// src/commands/project.ts
+import { Command as Command5 } from "commander";
+function projectCommand(globals) {
+  const project = new Command5("project").description("Projects in the organization");
+  project.command("list").description("List the projects you can see").option("--archived", "Include archived projects").action(async (options) => {
+    const ctx = createContext(globals());
+    const projects = await ctx.client.request("get", "/api/v1/orgs/{orgSlug}/projects", {
+      path: { orgSlug: await ctx.org() },
+      query: { includeArchived: options.archived === true }
+    });
+    if (ctx.json) return printJson(projects);
+    if (projects.length === 0) return print("No projects.");
+    print(
+      renderTable(projects, [
+        { header: "KEY", value: (p) => p.key },
+        { header: "NAME", value: (p) => p.name },
+        { header: "ROLE", value: (p) => p.role },
+        { header: "VISIBILITY", value: (p) => p.visibility },
+        { header: "STATUS", value: (p) => p.isArchived ? "archived" : "active" }
+      ])
+    );
+  });
+  return project;
+}
+
+// src/commands/run.ts
+import { Command as Command6 } from "commander";
+var statuses = [
+  "queued",
+  "assigned",
+  "running",
+  "succeeded",
+  "failed",
+  "cancelled",
+  "timedOut"
+];
+var terminal = /* @__PURE__ */ new Set(["succeeded", "failed", "cancelled", "timedOut"]);
+var logPageSize = 200;
+var truncatedSeq = 2147483647;
+var defaultPollMs = 2e3;
+function pollIntervalMs(env = process.env) {
+  const raw = env.AICTIQ_RUN_POLL_MS;
+  if (raw === void 0 || raw === "") return defaultPollMs;
+  const parsed = Number(raw);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : defaultPollMs;
+}
+function runCommand(globals) {
+  const run = new Command6("run").description("Factory runs: hand an item to an agent and watch it");
+  run.command("start").description("Dispatch a run for a work item").argument("<key>", "Work item key, e.g. ACME-123").option("--playbook <nameOrId>", "One of the project's playbooks; the default when omitted").option(
+    "--agent <nameOrId>",
+    "An agent of the project; the project's default agent when omitted"
+  ).action(async (key, options) => {
+    const ctx = createContext(globals());
+    const orgSlug = await ctx.org();
+    const itemKey = normalizeItemKey(key);
+    const playbookId = options.playbook ? await resolvePlaybookId(ctx, projectKeyOf(itemKey), options.playbook) : void 0;
+    const agentId = options.agent ? await resolveAgentId(ctx, options.agent) : void 0;
+    const started = await ctx.client.request("post", "/api/v1/orgs/{orgSlug}/items/{itemKey}/runs", {
+      path: { orgSlug, itemKey },
+      body: {
+        ...playbookId === void 0 ? {} : { playbookId },
+        ...agentId === void 0 ? {} : { agentId }
+      }
+    });
+    if (ctx.json) return printJson(started);
+    print(
+      renderFields([
+        ["Run", started.id],
+        ["Item", started.itemKey],
+        ["Status", started.status],
+        ["Agent", started.agentName ?? started.agentId],
+        ["Playbook", started.playbookName ?? started.playbookId]
+      ])
+    );
+  });
+  run.command("list").description("List runs, newest first").option("-p, --project <key>", "Only runs in this project").option("--status <status>", `One of ${statuses.join(", ")}`).option("--agent <id>", "Only runs by this agent (user id)").option("--item <key>", "Only runs for this item").option("--page <n>", "Page number", "1").option("--page-size <n>", "Runs per page (max 100)", "25").action(
+    async (options) => {
+      const ctx = createContext(globals());
+      if (options.status !== void 0 && !statuses.includes(options.status)) {
+        throw new CliError(
+          `Unknown run status "${options.status}". Statuses: ${statuses.join(", ")}.`,
+          ExitCode.Validation
+        );
+      }
+      const page = await ctx.client.request("get", "/api/v1/orgs/{orgSlug}/runs", {
+        path: { orgSlug: await ctx.org() },
+        query: {
+          project: options.project?.toUpperCase(),
+          status: options.status,
+          agent: options.agent,
+          item: options.item === void 0 ? void 0 : normalizeItemKey(options.item),
+          page: options.page,
+          pageSize: options.pageSize
+        }
+      });
+      if (ctx.json) return printJson(page);
+      if (page.items.length === 0) return print("No runs match.");
+      print(
+        renderTable(page.items, [
+          { header: "ID", value: (r) => r.id },
+          { header: "ITEM", value: (r) => r.itemKey },
+          { header: "STATUS", value: (r) => r.status },
+          { header: "AGENT", value: (r) => r.agentName ?? r.agentId },
+          { header: "PLAYBOOK", value: (r) => r.playbookName ?? r.playbookId },
+          { header: "QUEUED", value: (r) => formatDateTime(r.queuedAt) },
+          { header: "FINISHED", value: (r) => formatDateTime(r.finishedAt) },
+          { header: "PR", value: (r) => r.pullRequestUrl ?? "" }
+        ])
+      );
+      print("");
+      print(`Page ${page.page} of ${Math.max(1, page.totalPages)} \xB7 ${page.totalCount} runs`);
+    }
+  );
+  run.command("view").description("Show a run").argument("<runId>", "Run id").action(async (runId) => {
+    const ctx = createContext(globals());
+    const found = await getRun(ctx, await ctx.org(), runId);
+    if (ctx.json) return printJson(found);
+    const cost = found.costUsd === null && found.inputTokens === null && found.outputTokens === null ? void 0 : [
+      found.costUsd === null ? void 0 : `$${found.costUsd.toFixed(4)}`,
+      found.inputTokens === null && found.outputTokens === null ? void 0 : `${formatNumber(found.inputTokens) || "0"} in / ${formatNumber(found.outputTokens) || "0"} out tokens`
+    ].filter((part) => part !== void 0).join(" \xB7 ");
+    print(
+      renderFields([
+        ["Run", found.id],
+        ["Item", found.itemKey],
+        ["Status", found.status],
+        ["Agent", found.agentName ?? found.agentId],
+        ["Playbook", found.playbookName ?? found.playbookId],
+        ["Runner", found.runnerName ?? found.runnerId ?? void 0],
+        ["Harness", found.harness],
+        [
+          "Requested by",
+          found.requestedBy ?? (found.ruleId ? `rule: ${found.ruleName ?? "(deleted)"}` : void 0)
+        ],
+        ["Max minutes", String(found.maxMinutes)],
+        ["Queued", formatDateTime(found.queuedAt)],
+        ["Assigned", formatDateTime(found.assignedAt)],
+        ["Started", formatDateTime(found.startedAt)],
+        ["Finished", formatDateTime(found.finishedAt)],
+        ["Last heartbeat", formatDateTime(found.lastHeartbeatAt)],
+        ["Cancel requested", found.cancelRequested ? "yes" : void 0],
+        ["Outcome", found.outcomeSummary ?? void 0],
+        ["PR", found.pullRequestUrl ?? void 0],
+        ["Exit code", found.exitCode === null ? void 0 : String(found.exitCode)],
+        ["Cost", cost],
+        ["Failure", found.failureReason ?? void 0]
+      ])
+    );
+  });
+  run.command("logs").description("Print a run's log; --follow keeps polling until the run finishes").argument("<runId>", "Run id").option("-f, --follow", "Poll for new output every 2 s until the run is finished").action(async (runId, options) => {
+    const ctx = createContext(globals());
+    await streamLog(ctx, await ctx.org(), runId, options.follow === true, pollIntervalMs());
+  });
+  run.command("cancel").description("Ask a run to stop; the runner ends the harness and the run records cancelled").argument("<runId>", "Run id").action(async (runId) => {
+    const ctx = createContext(globals());
+    await ctx.client.request(
+      "post",
+      "/api/v1/orgs/{orgSlug}/runs/{runId}/cancel",
+      { path: { orgSlug: await ctx.org(), runId } }
+    );
+    if (ctx.json) return printJson({ id: runId, cancelRequested: true });
+    print(`Cancel requested for run ${runId}.`);
+  });
+  return run;
+}
+async function getRun(ctx, orgSlug, runId) {
+  return ctx.client.request(
+    "get",
+    "/api/v1/orgs/{orgSlug}/runs/{runId}",
+    { path: { orgSlug, runId } }
+  );
+}
+async function streamLog(ctx, orgSlug, runId, follow, pollMs) {
+  let after = -1;
+  let notedTruncation = false;
+  for (; ; ) {
+    const finished = follow ? terminal.has((await getRun(ctx, orgSlug, runId)).status) : true;
+    for (; ; ) {
+      const page = await ctx.client.request("get", "/api/v1/orgs/{orgSlug}/runs/{runId}/log", {
+        path: { orgSlug, runId },
+        query: { after, pageSize: logPageSize }
+      });
+      for (const entry of page.items) {
+        after = Math.max(after, entry.seq);
+        if (entry.seq !== truncatedSeq) print(formatLogEntry(entry));
+      }
+      if (page.truncated && !notedTruncation) {
+        notedTruncation = true;
+        print("(log truncated)");
+      }
+      if (page.items.length < logPageSize) break;
+    }
+    if (finished) return;
+    await new Promise((resolve3) => setTimeout(resolve3, pollMs));
+  }
+}
+function formatLogEntry(entry) {
+  const text = entry.text.endsWith("\n") ? entry.text.slice(0, -1) : entry.text;
+  if (entry.stream === "stdout") return text;
+  const prefix = entry.stream === "stderr" ? "[stderr] " : "[event] ";
+  return text.split("\n").map((line) => `${prefix}${line}`).join("\n");
+}
+var uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function resolvePlaybookId(ctx, projectKey, playbook) {
+  if (uuid.test(playbook)) return playbook;
+  const playbooks = await ctx.client.request("get", "/api/v1/orgs/{orgSlug}/projects/{projectKey}/playbooks", {
+    path: { orgSlug: await ctx.org(), projectKey }
+  });
+  const wanted = playbook.trim().toLowerCase();
+  const matches = playbooks.filter((p) => p.name.toLowerCase() === wanted);
+  if (matches.length === 1) return matches[0].id;
+  if (matches.length === 0) {
+    throw new CliError(
+      `No playbook "${playbook}" in ${projectKey}. Playbooks: ${playbooks.map((p) => p.name).join(", ") || "(none)"}.`,
+      ExitCode.Validation
+    );
+  }
+  throw new CliError(
+    `Several playbooks in ${projectKey} are named "${playbook}"; pass one by id: ${matches.map((p) => p.id).join(", ")}.`,
+    ExitCode.Validation
+  );
+}
+async function resolveAgentId(ctx, agent) {
+  if (uuid.test(agent)) return agent;
+  const agents = await ctx.client.request(
+    "get",
+    "/api/v1/orgs/{orgSlug}/agents",
+    { path: { orgSlug: await ctx.org() } }
+  );
+  const byId = agents.find((a) => a.userId === agent);
+  if (byId) return byId.userId;
+  const wanted = agent.trim().toLowerCase();
+  const matches = agents.filter((a) => a.displayName.toLowerCase() === wanted);
+  if (matches.length === 1) return matches[0].userId;
+  if (matches.length === 0) {
+    throw new CliError(
+      `No agent "${agent}" in this organization. Agents: ${agents.map((a) => a.displayName).join(", ") || "(none)"}.`,
+      ExitCode.Validation
+    );
+  }
+  throw new CliError(
+    `Several agents are named "${agent}"; pass one by id: ${matches.map((a) => a.userId).join(", ")}.`,
+    ExitCode.Validation
+  );
+}
+
+// src/commands/runner.ts
+import { Command as Command7 } from "commander";
+import { existsSync as existsSync3 } from "fs";
+import { arch, platform } from "os";
+import { resolve as resolve2 } from "path";
+
+// src/runner/client.ts
+var RunnerHttpError = class extends Error {
+  status;
+  problem;
+  constructor(status, problem, message3) {
+    super(message3);
+    this.name = "RunnerHttpError";
+    this.status = status;
+    this.problem = problem;
+  }
+  /** A disabled, deleted or rotated runner: retrying cannot help, so the process must stop. */
+  get revoked() {
+    return this.status === 401;
+  }
+};
+var RunnerNetworkError = class extends Error {
+  constructor(message3) {
+    super(message3);
+    this.name = "RunnerNetworkError";
+  }
+};
+var RunnerClient = class {
+  baseUrl;
+  token;
+  doFetch;
+  constructor(options) {
+    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+    this.token = options.token;
+    this.doFetch = options.fetch ?? fetch;
+  }
+  hello(capabilities) {
+    return this.send("/runner/hello", { capabilities });
+  }
+  async heartbeat(capabilities) {
+    await this.send("/runner/heartbeat", { capabilities });
+  }
+  /** Long-polls; null when the server had nothing within its poll timeout. */
+  async claim(harnesses2, slots, signal2) {
+    return await this.send("/runner/runs/claim", { harnesses: harnesses2, slots }, signal2) ?? null;
+  }
+  async started(runId) {
+    await this.send(`/runner/runs/${runId}/started`);
+  }
+  async log(runId, chunks) {
+    await this.send(`/runner/runs/${runId}/log`, { chunks });
+  }
+  async runHeartbeat(runId) {
+    return this.send(`/runner/runs/${runId}/heartbeat`);
+  }
+  async finish(runId, report) {
+    await this.send(`/runner/runs/${runId}/finish`, report);
+  }
+  async repoToken(runId) {
+    const response = await this.send(`/runner/runs/${runId}/repo-token`);
+    return response?.token ?? null;
+  }
+  /** Lists committed attachments on an item, including attachments posted in its comments. */
+  listAttachments(run) {
+    return this.get(
+      `/orgs/${encodeURIComponent(run.organizationSlug)}/items/${encodeURIComponent(run.itemKey)}/attachments?include=comments`,
+      run.agentToken
+    );
+  }
+  /** Downloads attachment bytes using the short-lived agent credential, never the runner secret. */
+  async downloadAttachment(run, attachmentId) {
+    const path = `/orgs/${encodeURIComponent(run.organizationSlug)}/attachments/${encodeURIComponent(attachmentId)}/download`;
+    const response = await this.request(path, "GET", void 0, void 0, run.agentToken);
+    if (!response.ok) throw await this.error(path, response);
+    return new Uint8Array(await response.arrayBuffer());
+  }
+  /**
+   * Keeps the item's claim fresh with the agent's own token. Without it the claim goes
+   * stale after `Claims:StaleAfterMinutes` and another agent may take the item mid-run.
+   */
+  async itemHeartbeat(run) {
+    await this.send(
+      `/orgs/${encodeURIComponent(run.organizationSlug)}/items/${encodeURIComponent(run.itemKey)}/heartbeat`,
+      void 0,
+      void 0,
+      run.agentToken
+    );
+  }
+  async send(path, body, signal2, token = this.token) {
+    const response = await this.request(path, "POST", body, signal2, token);
+    if (response.status === 204) return void 0;
+    if (!response.ok) throw await this.error(path, response);
+    const text = await response.text();
+    let payload;
+    try {
+      payload = text.length === 0 ? void 0 : JSON.parse(text);
+    } catch {
+      payload = void 0;
+    }
+    return payload;
+  }
+  async get(path, token) {
+    const response = await this.request(path, "GET", void 0, void 0, token);
+    if (!response.ok) throw await this.error(path, response);
+    return await response.json();
+  }
+  async request(path, method, body, signal2, token = this.token) {
+    try {
+      return await this.doFetch(`${this.baseUrl}/api/v1${path}`, {
+        method,
+        headers: {
+          Authorization: `Bearer ${token}`,
+          Accept: "application/json",
+          "User-Agent": "aictiq-runner",
+          ...body === void 0 ? {} : { "Content-Type": "application/json" }
+        },
+        ...body === void 0 ? {} : { body: JSON.stringify(body) },
+        ...signal2 ? { signal: signal2 } : {}
+      });
+    } catch (cause) {
+      if (signal2?.aborted) throw cause;
+      throw new RunnerNetworkError(`Cannot reach ${this.baseUrl}: ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+  }
+  async error(path, response) {
+    if (response.status >= 502 && response.status <= 504) return new RunnerNetworkError(`${this.baseUrl} answered ${response.status}`);
+    const text = await response.text();
+    let payload;
+    try {
+      payload = text.length === 0 ? void 0 : JSON.parse(text);
+    } catch {
+      payload = void 0;
+    }
+    const problem = typeof payload === "object" && payload !== null ? payload : void 0;
+    return new RunnerHttpError(response.status, problem, `${path}: ${response.status} ${problem?.title ?? response.statusText}${problem?.detail ? ` - ${problem.detail}` : ""}`);
+  }
+};
+
+// src/runner/config.ts
+import { chmodSync as chmodSync3, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname2, join as join3 } from "path";
+
+// src/runner/workspace.ts
+import { spawn } from "child_process";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, realpathSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { isAbsolute, join as join2, relative, resolve } from "path";
+
+// src/runner/types.ts
+var RunFailure = class extends Error {
+  reason;
+  constructor(reason, message3) {
+    super(message3);
+    this.name = "RunFailure";
+    this.reason = reason;
+  }
+};
+
+// src/runner/workspace.ts
+var DefaultAttachmentMaxCount = 25;
+var DefaultAttachmentMaxBytes = 25 * 1024 * 1024;
+function defaultWorkspaceRoot(env = process.env) {
+  const base = env.XDG_DATA_HOME ?? join2(homedir2(), ".local", "share");
+  return join2(base, "aictiq", "runner");
+}
+var TOKEN_ENV = "AICTIQ_GIT_TOKEN";
+var CREDENTIAL_HELPER = `!f() { test "$1" = get || return 0; echo username=x-access-token; echo "password=$${TOKEN_ENV}"; }; f`;
+var ASKPASS_SCRIPT = `#!/bin/sh
+case "$1" in
+  *[Uu]sername*) echo x-access-token ;;
+  *) echo "$${TOKEN_ENV}" ;;
+esac
+`;
+async function provisionWorkspace(run, options) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(run.runId)) {
+    throw new RunFailure(
+      "workspace-failed",
+      `Refusing to create a workspace for run id "${run.runId}".`
+    );
+  }
+  const runDir = join2(options.root, run.runId);
+  const checkout = join2(runDir, "repo");
+  const promptFile = join2(runDir, "prompt.md");
+  const mcpConfigFile = join2(runDir, "mcp.json");
+  const attachmentsDir = join2(runDir, "attachments");
+  const env = options.env ?? process.env;
+  let source = null;
+  const cleanup = async () => {
+    if (options.keep) return;
+    if (source !== null) {
+      await git(["worktree", "remove", "--force", checkout], { cwd: source, env }).catch(
+        () => void 0
+      );
+      await git(["worktree", "prune"], { cwd: source, env }).catch(() => void 0);
+    }
+    try {
+      rmSync2(runDir, { recursive: true, force: true });
+    } catch {
+    }
+  };
+  mkdirSync2(options.root, { recursive: true, mode: 448 });
+  rmSync2(runDir, { recursive: true, force: true });
+  mkdirSync2(runDir, { mode: 448 });
+  chmodSync2(runDir, 448);
+  try {
+    const mcpConfig = {
+      mcpServers: { aictiq: { command: options.mcpServer.command, args: options.mcpServer.args } }
+    };
+    writePrivate(mcpConfigFile, `${JSON.stringify(mcpConfig, null, 2)}
+`);
+    await assertRefName(run.branchName, "branch", env);
+    await assertRefName(run.defaultBranch, "default branch", env);
+    let harnessEnv = {};
+    if (run.repo.source === "local") {
+      source = await provisionLocal(run, checkout, options, env);
+    } else {
+      harnessEnv = await provisionGithub(run, runDir, checkout, options, env);
+    }
+    const prompt = await provisionAttachments(run, attachmentsDir, options);
+    writePrivate(promptFile, prompt);
+    return {
+      runDir,
+      checkout,
+      branch: run.branchName,
+      promptFile,
+      mcpConfigFile,
+      attachmentsDir,
+      prompt,
+      env: harnessEnv,
+      cleanup
+    };
+  } catch (error) {
+    await cleanup();
+    throw error;
+  }
+}
+async function provisionAttachments(run, attachmentsDir, options) {
+  if (!options.attachments) return run.prompt;
+  const maxCount = limit(options.attachmentMaxCount, DefaultAttachmentMaxCount);
+  const maxBytes = limit(options.attachmentMaxBytes, DefaultAttachmentMaxBytes);
+  if (maxCount === 0 || maxBytes === 0) {
+    options.event("Attachment provisioning is disabled by this runner configuration");
+    return `${run.prompt}
+
+## Attachments
+
+Attachment provisioning is disabled on this runner. Use the attachment download URL from Aictiq if needed.
+`;
+  }
+  let attachments;
+  try {
+    attachments = await options.attachments.list();
+  } catch (error) {
+    options.event(`Could not list item attachments: ${message(error)}`);
+    return run.prompt;
+  }
+  if (attachments.length === 0) return run.prompt;
+  mkdirSync2(attachmentsDir, { recursive: true, mode: 448 });
+  chmodSync2(attachmentsDir, 448);
+  let total = 0;
+  const names = /* @__PURE__ */ new Set();
+  const provisioned = [];
+  for (const attachment of attachments) {
+    if (provisioned.length >= maxCount) {
+      options.event(`Skipped attachment "${attachment.fileName}" (limit: ${maxCount} files)`);
+      continue;
+    }
+    if (!Number.isSafeInteger(attachment.sizeBytes) || attachment.sizeBytes < 0 || total + attachment.sizeBytes > maxBytes) {
+      options.event(`Skipped attachment "${attachment.fileName}" (would exceed ${formatBytes(maxBytes)} total)`);
+      continue;
+    }
+    try {
+      const bytes = await options.attachments.download(attachment.id);
+      if (bytes.byteLength > attachment.sizeBytes || total + bytes.byteLength > maxBytes) {
+        options.event(`Skipped attachment "${attachment.fileName}" (download exceeds ${formatBytes(maxBytes)} total)`);
+        continue;
+      }
+      const name = uniqueFileName(sanitiseFileName(attachment.fileName, attachment.id), names);
+      writePrivate(join2(attachmentsDir, name), bytes);
+      total += bytes.byteLength;
+      provisioned.push({ ...attachment, localName: name });
+    } catch (error) {
+      options.event(`Failed to download attachment "${attachment.fileName}": ${message(error)}`);
+    }
+  }
+  if (provisioned.length === 0) return run.prompt;
+  options.event(`Provisioned ${provisioned.length} attachment${provisioned.length === 1 ? "" : "s"}: ${provisioned.map((x) => x.localName).join(", ")}`);
+  const inventory = provisioned.map((attachment) => {
+    const source = attachment.commentId ? `comment ${attachment.commentId}` : "item description";
+    const url = `/api/v1/orgs/${encodeURIComponent(run.organizationSlug)}/attachments/${encodeURIComponent(attachment.id)}/download`;
+    return `- ${join2(attachmentsDir, attachment.localName)} - original: ${attachment.fileName}; ${attachment.contentType}; ${formatBytes(attachment.sizeBytes)}; from ${source}; replaces ${url}`;
+  }).join("\n");
+  const images = provisioned.filter((attachment) => attachment.contentType.startsWith("image/"));
+  return `${run.prompt}
+
+## Attachments
+
+These files are outside the git checkout at \`${attachmentsDir}\`; do not add or commit them. ${images.length > 0 ? "Look at these images before planning." : ""}
+
+${inventory}
+`;
+}
+function limit(value, fallback) {
+  return Number.isSafeInteger(value) && value !== void 0 && value >= 0 ? value : fallback;
+}
+function sanitiseFileName(value, id) {
+  const clean = value.replace(/[\\/\p{Cc}]/gu, "_").trim().replace(/^\.+$/, "");
+  return (clean || `attachment-${id}`).slice(0, 200);
+}
+function uniqueFileName(value, existing) {
+  const extension = value.lastIndexOf(".") > 0 ? value.slice(value.lastIndexOf(".")) : "";
+  const stem = extension ? value.slice(0, -extension.length) : value;
+  let candidate = value;
+  let sequence = 2;
+  while (existing.has(candidate.toLocaleLowerCase())) candidate = `${stem}-${sequence++}${extension}`;
+  existing.add(candidate.toLocaleLowerCase());
+  return candidate;
+}
+function formatBytes(value) {
+  return value >= 1024 * 1024 ? `${(value / (1024 * 1024)).toFixed(1)} MiB` : `${value} bytes`;
+}
+function resolveLocalRepository(run, options) {
+  const mapped = options.repositories[run.projectKey];
+  if (mapped !== void 0) return { path: mapped, root: null };
+  const hint = run.repo.localPathHint?.trim();
+  const roots = options.repoRoots ?? [];
+  if (hint) {
+    const expanded = expandHome(hint);
+    if (isAbsolute(expanded)) {
+      const real = realpathOrSelf(expanded);
+      for (const configured of roots) {
+        const expandedRoot = expandHome(configured);
+        if (!isAbsolute(expandedRoot)) continue;
+        const root = realpathOrSelf(expandedRoot);
+        if (isWithin(real, root)) return { path: real, root };
+      }
+    }
+  }
+  const example = `("${run.projectKey}": "/path/to/repository")`;
+  const detail = !hint ? ` Add it to the \`workspaces\` map in runner.json ${example}, or set the project's path hint and list its parent directory in \`repoRoots\`.` : roots.length === 0 ? ` The project suggests ${hint}. Add its parent directory to \`repoRoots\` in runner.json (\`aictiq runner root <path>\`), or map it in \`workspaces\` ${example}.` : ` The project suggests ${hint}, which is not under any of this runner's repoRoots (${roots.join(", ")}). Add a root that contains it, or map it in \`workspaces\` ${example}.`;
+  throw new RunFailure(
+    "no-local-repository",
+    `No local repository is mapped for project ${run.projectKey}.${detail}`
+  );
+}
+function expandHome(path) {
+  if (path === "~") return homedir2();
+  return path.startsWith("~/") ? join2(homedir2(), path.slice(2)) : path;
+}
+function realpathOrSelf(path) {
+  const normalised = resolve(path);
+  try {
+    return realpathSync(normalised);
+  } catch {
+    return normalised;
+  }
+}
+function isWithin(path, root) {
+  const rel = relative(root, path);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function message(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function provisionLocal(run, checkout, options, env) {
+  const { path: mapped, root } = resolveLocalRepository(run, options);
+  const origin = root === null ? "mapped for project" : "the path hint for project";
+  const toplevel = await git(["rev-parse", "--show-toplevel"], {
+    cwd: mapped,
+    env,
+    signal: options.signal
+  }).catch((error) => {
+    if (isAbort(error)) throw error;
+    throw new RunFailure(
+      "no-local-repository",
+      `${mapped}, ${origin} ${run.projectKey}, is not a git repository.`
+    );
+  });
+  if (root !== null && !isWithin(realpathOrSelf(toplevel.trim()), root)) {
+    throw new RunFailure(
+      "no-local-repository",
+      `${mapped}, the path hint for project ${run.projectKey}, is not a git repository under ${root}.`
+    );
+  }
+  const repo = toplevel.trim();
+  const call = (args) => gitStep(args, { cwd: repo, env, signal: options.signal });
+  const hasOrigin = await git(["remote", "get-url", "origin"], {
+    cwd: repo,
+    env,
+    signal: options.signal
+  }).then(
+    () => true,
+    (error) => {
+      if (isAbort(error)) throw error;
+      return false;
+    }
+  );
+  let base = run.defaultBranch;
+  if (hasOrigin) {
+    options.event(`Fetching origin in ${repo}`);
+    await call(["fetch", "origin"]);
+    base = `origin/${run.defaultBranch}`;
+  }
+  const branchExists = await git(
+    ["rev-parse", "--verify", "--quiet", `refs/heads/${run.branchName}`],
+    {
+      cwd: repo,
+      env,
+      signal: options.signal
+    }
+  ).then(
+    () => true,
+    (error) => {
+      if (isAbort(error)) throw error;
+      return false;
+    }
+  );
+  if (branchExists) {
+    await call(["worktree", "add", checkout, run.branchName]);
+    options.event(`Created worktree ${checkout} on existing branch ${run.branchName}`);
+  } else {
+    await call(["worktree", "add", "--no-track", "-b", run.branchName, checkout, base]);
+    options.event(`Created worktree ${checkout} on branch ${run.branchName} from ${base}`);
+  }
+  return repo;
+}
+async function provisionGithub(run, runDir, checkout, options, env) {
+  const full = run.repo.repoFullName;
+  if (!full || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(full)) {
+    throw new RunFailure(
+      "workspace-failed",
+      `The run names no valid GitHub repository (${full ?? "none"}).`
+    );
+  }
+  const token = run.repo.cloneToken ?? await options.refreshCloneToken?.() ?? null;
+  if (!token) {
+    throw new RunFailure(
+      "repository-token-unavailable",
+      `No GitHub installation token is available to clone ${full}. Check that the GitHub App is still installed on the repository.`
+    );
+  }
+  const askpass = join2(runDir, "askpass.sh");
+  writeFileSync2(askpass, ASKPASS_SCRIPT, { mode: 448 });
+  chmodSync2(askpass, 448);
+  const secretEnv = { GIT_ASKPASS: askpass, [TOKEN_ENV]: token };
+  const cloneEnv = { ...env, ...secretEnv };
+  const base = (options.githubBaseUrl ?? "https://github.com").replace(/\/+$/, "");
+  const url = `${base}/${full}.git`;
+  await gitStep(
+    // An empty credential.helper resets the user's own helpers, so a global `store` helper
+    // cannot write the token to ~/.git-credentials after the clone succeeds.
+    [
+      "-c",
+      "credential.helper=",
+      "clone",
+      "--depth",
+      "50",
+      "--branch",
+      run.defaultBranch,
+      url,
+      checkout
+    ],
+    { cwd: runDir, env: cloneEnv, signal: options.signal },
+    token
+  );
+  options.event(`Cloned ${full} (depth 50)`);
+  const call = (args) => gitStep(args, { cwd: checkout, env, signal: options.signal }, token);
+  await call(["checkout", "-b", run.branchName]);
+  options.event(`Created branch ${run.branchName} from ${run.defaultBranch}`);
+  await call(["config", "--local", "--replace-all", "credential.helper", ""]);
+  await call(["config", "--local", "--add", "credential.helper", CREDENTIAL_HELPER]);
+  return { [TOKEN_ENV]: token };
+}
+function writePrivate(path, content) {
+  writeFileSync2(path, content, { mode: 384 });
+  chmodSync2(path, 384);
+}
+async function assertRefName(name, what, env) {
+  const valid = await git(["check-ref-format", "--branch", name], { cwd: process.cwd(), env }).then(
+    () => true,
+    () => false
+  );
+  if (!valid)
+    throw new RunFailure(
+      "workspace-failed",
+      `The run's ${what} "${name}" is not a valid git branch name.`
+    );
+}
+var GitError = class extends Error {
+  stderr;
+  constructor(args, code, stderr) {
+    super(
+      `git ${args[0] === "-c" ? args[2] ?? "" : args[0] ?? ""} exited with ${code ?? "a signal"}`
+    );
+    this.stderr = stderr;
+  }
+};
+async function gitStep(args, options, secret) {
+  try {
+    return await git(args, options);
+  } catch (error) {
+    if (error instanceof GitError) {
+      const tail = error.stderr.trim().split("\n").slice(-20).join("\n");
+      let message3 = tail ? `${error.message}:
+${tail}` : error.message;
+      if (secret) message3 = message3.replaceAll(secret, "***");
+      throw new RunFailure("workspace-failed", message3);
+    }
+    throw error;
+  }
+}
+function git(args, options) {
+  return new Promise((resolve3, reject) => {
+    const child = spawn("git", args, {
+      cwd: options.cwd,
+      env: { ...options.env, GIT_TERMINAL_PROMPT: "0" },
+      stdio: ["ignore", "pipe", "pipe"],
+      signal: options.signal
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.setEncoding("utf8").on("data", (chunk) => stdout += chunk);
+    child.stderr.setEncoding("utf8").on("data", (chunk) => {
+      stderr = (stderr + chunk).slice(-16384);
+    });
+    child.on("error", reject);
+    child.on("close", (code) => {
+      if (code === 0) resolve3(stdout);
+      else reject(new GitError(args, code, stderr));
+    });
+  });
+}
+function isAbort(error) {
+  return error instanceof Error && error.name === "AbortError";
+}
+
+// src/runner/config.ts
+function runnerConfigPath(env = process.env) {
+  const base = env.AICTIQ_CONFIG_HOME ?? env.XDG_CONFIG_HOME ?? join3(homedir3(), ".config");
+  return join3(base, "aictiq", "runner.json");
+}
+function readRunnerConfig(path = runnerConfigPath()) {
+  if (!existsSync2(path)) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync3(path, "utf8"));
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const { url, token, name, workspaces, repoRoots, attachments } = parsed;
+  if (typeof url !== "string" || typeof token !== "string") return null;
+  const mapped = {};
+  if (typeof workspaces === "object" && workspaces !== null) {
+    for (const [key, value] of Object.entries(workspaces)) {
+      if (typeof value === "string") mapped[key] = value;
+    }
+  }
+  const roots = Array.isArray(repoRoots) ? repoRoots.filter((root) => typeof root === "string" && root.trim() !== "") : [];
+  const rawLimits = typeof attachments === "object" && attachments !== null ? attachments : {};
+  return {
+    url,
+    token,
+    ...typeof name === "string" ? { name } : {},
+    workspaces: mapped,
+    repoRoots: roots,
+    attachments: {
+      maxCount: validLimit(rawLimits.maxCount, DefaultAttachmentMaxCount),
+      maxBytes: validLimit(rawLimits.maxBytes, DefaultAttachmentMaxBytes)
+    }
+  };
+}
+function writeRunnerConfig(config, path = runnerConfigPath()) {
+  mkdirSync3(dirname2(path), { recursive: true, mode: 448 });
+  writeFileSync3(path, `${JSON.stringify(config, null, 2)}
+`, { mode: 384 });
+  chmodSync3(path, 384);
+}
+function validLimit(value, fallback) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : fallback;
+}
+
+// src/runner/execute.ts
+import { execFile } from "child_process";
+import { stripVTControlCharacters } from "util";
+
+// src/runner/log.ts
+var MaxChunkChars = 65536;
+var MaxChunksPerBatch = 512;
+function redact(text, secrets) {
+  let result = text;
+  for (const secret of [...secrets].filter((s) => s.length >= 8).sort((a, b) => b.length - a.length)) {
+    result = result.split(secret).join("[redacted]");
+  }
+  return result;
+}
+var LogStreamer = class {
+  options;
+  queue = [];
+  seq = 0;
+  timer;
+  sending = Promise.resolve();
+  capped = false;
+  closed = false;
+  closing = false;
+  constructor(options) {
+    this.options = options;
+  }
+  /** True once the server refused the log for exceeding its cap; later lines are dropped. */
+  get truncated() {
+    return this.capped;
+  }
+  push(stream, line) {
+    if (this.capped || this.closed) return;
+    const text = redact(line, this.options.secrets);
+    const at = (this.options.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
+    for (const piece of splitByBytes(text, Math.min(this.options.maxBatchBytes, MaxChunkChars))) {
+      this.queue.push({ seq: this.seq++, stream, text: piece, at });
+    }
+    if (this.queuedBytes() >= this.options.maxBatchBytes) {
+      void this.flush();
+    } else {
+      this.timer ??= setTimeout(() => {
+        this.timer = void 0;
+        void this.flush();
+      }, this.options.flushIntervalMs ?? 1e3);
+    }
+  }
+  /** Sends everything queued so far; resolves once it is stored or the log is capped. */
+  flush() {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = void 0;
+    }
+    this.sending = this.sending.then(() => this.drain());
+    return this.sending;
+  }
+  /** Flushes and stops accepting lines. */
+  async close() {
+    this.closing = true;
+    await this.flush();
+    this.closed = true;
+  }
+  async drain() {
+    while (this.queue.length > 0 && !this.capped) {
+      const batch = this.takeBatch();
+      let attempt = 0;
+      while (true) {
+        try {
+          await this.options.send(batch);
+          this.queue.splice(0, batch.length);
+          break;
+        } catch (error) {
+          if (error instanceof RunnerHttpError && error.status === 413) {
+            this.capped = true;
+            this.queue.length = 0;
+            this.options.local?.(
+              "The instance capped this run log; further output is kept out of it."
+            );
+            return;
+          }
+          if (error instanceof RunnerHttpError) {
+            this.queue.length = 0;
+            this.capped = true;
+            this.options.local?.(`The instance refused the run log: ${error.message}`);
+            return;
+          }
+          attempt++;
+          if (attempt > 8 && this.closing) {
+            this.queue.length = 0;
+            return;
+          }
+          await delay(this.options.retryDelayMs?.(attempt) ?? Math.min(3e4, 500 * 2 ** attempt));
+        }
+      }
+    }
+  }
+  takeBatch() {
+    const batch = [];
+    let bytes = 0;
+    for (const chunk of this.queue) {
+      const size = Buffer.byteLength(chunk.text, "utf8");
+      if (batch.length > 0 && (bytes + size > this.options.maxBatchBytes || batch.length >= MaxChunksPerBatch))
+        break;
+      batch.push(chunk);
+      bytes += size;
+    }
+    return batch;
+  }
+  queuedBytes() {
+    let bytes = 0;
+    for (const chunk of this.queue) bytes += Buffer.byteLength(chunk.text, "utf8");
+    return bytes;
+  }
+};
+function splitByBytes(text, maxBytes) {
+  if (Buffer.byteLength(text, "utf8") <= maxBytes) return [text];
+  const pieces = [];
+  let current = "";
+  let bytes = 0;
+  for (const char of text) {
+    const size = Buffer.byteLength(char, "utf8");
+    if (bytes + size > maxBytes) {
+      pieces.push(current);
+      current = "";
+      bytes = 0;
+    }
+    current += char;
+    bytes += size;
+  }
+  pieces.push(current);
+  return pieces;
+}
+function delay(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+
+// src/runner/process.ts
+import { spawn as spawn2 } from "child_process";
+import { StringDecoder } from "string_decoder";
+function spawnSupervised(options) {
+  const child = spawn2(options.command, options.args, {
+    cwd: options.cwd,
+    env: options.env,
+    detached: process.platform !== "win32",
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  const exited = new Promise((resolve3) => {
+    let settled = false;
+    const settle = (code) => {
+      if (settled) return;
+      settled = true;
+      resolve3(code);
+    };
+    child.on("error", (error) => {
+      options.onLine("stderr", `Could not start ${options.command}: ${error.message}`);
+      settle(error.code === "ENOENT" ? 127 : 1);
+    });
+    child.on("close", (code) => {
+      settle(code);
+      signal(child, "SIGKILL");
+    });
+    child.on("exit", (code) => {
+      setTimeout(() => {
+        settle(code);
+        signal(child, "SIGKILL");
+      }, 2e3);
+    });
+  });
+  splitLines(child, "stdout", options.onLine);
+  splitLines(child, "stderr", options.onLine);
+  child.stdin?.on("error", () => {
+  });
+  child.stdin?.end(options.stdin ?? "");
+  return {
+    pid: child.pid,
+    exited,
+    async stop(graceMs = 1e4) {
+      signal(child, "SIGTERM");
+      const timer = setTimeout(() => signal(child, "SIGKILL"), graceMs);
+      try {
+        return await exited;
+      } finally {
+        clearTimeout(timer);
+        signal(child, "SIGKILL");
+      }
+    }
+  };
+}
+function signal(child, name) {
+  if (child.pid === void 0) return;
+  try {
+    if (process.platform === "win32") child.kill(name);
+    else process.kill(-child.pid, name);
+  } catch {
+  }
+}
+function splitLines(child, stream, onLine) {
+  const source = child[stream];
+  if (!source) return;
+  const decoder = new StringDecoder("utf8");
+  let buffer = "";
+  source.on("data", (data) => {
+    buffer += decoder.write(data);
+    let index;
+    while ((index = buffer.indexOf("\n")) >= 0) {
+      onLine(stream, buffer.slice(0, index).replace(/\r$/, ""));
+      buffer = buffer.slice(index + 1);
+    }
+  });
+  source.on("end", () => {
+    buffer += decoder.end();
+    if (buffer.length > 0) onLine(stream, buffer);
+    buffer = "";
+  });
+}
+
+// src/runner/execute.ts
+var MaxSummary = 4e3;
+var MaxFailureReason = 500;
+var PullRequestUrl = /https:\/\/github\.com\/[\w.-]+\/[\w.-]+\/pull\/\d+/g;
+async function executeRun(run, options) {
+  const { client } = options;
+  const local = options.local ?? (() => {
+  });
+  const log = new LogStreamer({
+    send: (chunks) => client.log(run.runId, chunks),
+    secrets: [run.agentToken, options.runnerToken, run.repo.cloneToken ?? ""],
+    maxBatchBytes: options.hello.maxLogBatchBytes,
+    flushIntervalMs: options.flushIntervalMs ?? 1e3,
+    local: (message3) => local(`${run.itemKey}: ${message3}`)
+  });
+  const event = (line) => log.push("event", line);
+  let harness;
+  let stopReason;
+  const abort = new AbortController();
+  const stop = (reason) => {
+    if (stopReason) return;
+    stopReason = reason;
+    abort.abort();
+    void harness?.stop(options.graceMs ?? 1e4);
+  };
+  const onShutdown = () => stop("shutdown");
+  options.shutdown?.addEventListener("abort", onShutdown, { once: true });
+  if (options.shutdown?.aborted) onShutdown();
+  let workspace;
+  let revoked;
+  let heartbeat;
+  let beating = Promise.resolve();
+  let deadline;
+  const report = await (async () => {
+    try {
+      await client.started(run.runId);
+    } catch (error) {
+      if (error instanceof RunnerHttpError && (error.status === 409 || error.status === 404)) {
+        local(`${run.itemKey}: the instance closed run ${run.runId} before it started`);
+        return null;
+      }
+      throw error;
+    }
+    event(`Runner picked up ${run.itemKey} with ${run.harness}`);
+    const beat = async () => {
+      try {
+        const { cancelRequested } = await client.runHeartbeat(run.runId);
+        if (cancelRequested) {
+          event("Cancel requested; stopping the harness");
+          stop("cancelled");
+        }
+      } catch (error) {
+        if (error instanceof RunnerHttpError && error.revoked) {
+          revoked ??= error;
+          stop("closed");
+          return;
+        }
+        if (error instanceof RunnerHttpError && (error.status === 409 || error.status === 404)) {
+          local(`${run.itemKey}: the instance closed run ${run.runId}; stopping it here`);
+          stop("closed");
+          return;
+        }
+        local(`${run.itemKey}: run heartbeat failed: ${message2(error)}`);
+      }
+      try {
+        await client.itemHeartbeat(run);
+      } catch (error) {
+        local(`${run.itemKey}: item heartbeat failed: ${message2(error)}`);
+      }
+    };
+    const tick = () => {
+      beating = beat();
+    };
+    tick();
+    heartbeat = setInterval(
+      tick,
+      options.heartbeatMs ?? run.heartbeatIntervalSeconds * 1e3
+    );
+    deadline = setTimeout(() => {
+      event(`The run reached its limit of ${run.maxMinutes} minutes; stopping the harness`);
+      stop("timed-out");
+    }, run.maxMinutes * 6e4);
+    const adapter = options.adapters[run.harness];
+    const info = adapter ? await adapter.available() : null;
+    if (!adapter || !info) {
+      event(`Harness "${run.harness}" is not installed on this runner`);
+      return failed(
+        "harness-unavailable",
+        `This runner has no working "${run.harness}" on its PATH.`
+      );
+    }
+    event(`Using ${run.harness} ${info.version ?? ""}`.trim());
+    try {
+      workspace = await (options.provision ?? provisionWorkspace)(run, {
+        ...options.workspace,
+        event,
+        refreshCloneToken: () => client.repoToken(run.runId),
+        attachments: {
+          list: () => client.listAttachments(run),
+          download: (attachmentId) => client.downloadAttachment(run, attachmentId)
+        },
+        signal: abort.signal
+      });
+    } catch (error) {
+      if (stopReason) return stopped(null, []);
+      if (error instanceof RunFailure) {
+        event(error.message);
+        return failed(error.reason, error.message);
+      }
+      event(`Workspace provisioning failed: ${message2(error)}`);
+      return failed("workspace-failed", message2(error));
+    }
+    if (stopReason) return stopped(null, []);
+    const invocation = adapter.invocation({
+      prompt: workspace.prompt,
+      promptFile: workspace.promptFile,
+      workspace: workspace.checkout,
+      attachmentsDir: workspace.attachmentsDir,
+      mcpConfigFile: workspace.mcpConfigFile,
+      mcpServer: options.workspace.mcpServer
+    });
+    const env = {
+      ...process.env,
+      ...invocation.env,
+      ...workspace.env,
+      // The agent reaches the instance as itself, never as the runner: `aictiq mcp` and the
+      // CLI both read these, and they exist only in this process tree.
+      AICTIQ_URL: run.aictiqUrl ?? client.baseUrl,
+      AICTIQ_TOKEN: run.agentToken,
+      AICTIQ_ORG: run.organizationSlug,
+      AICTIQ_ITEM: run.itemKey,
+      AICTIQ_RUN: run.runId
+    };
+    const lastLines = [];
+    let lastResult = null;
+    let pullRequestUrl = null;
+    let costUsd;
+    let inputTokens;
+    let outputTokens;
+    const remember = (line) => {
+      lastLines.push(line);
+      if (lastLines.length > 20) lastLines.shift();
+    };
+    event(`Starting ${invocation.command} in ${workspace.checkout}`);
+    harness = spawnSupervised({
+      command: invocation.command,
+      args: invocation.args,
+      cwd: workspace.checkout,
+      env,
+      ...invocation.stdin === void 0 ? {} : { stdin: invocation.stdin },
+      onLine: (stream, raw) => {
+        const line = stripVTControlCharacters(raw);
+        for (const match of line.matchAll(PullRequestUrl)) pullRequestUrl = match[0];
+        if (stream === "stderr") {
+          log.push("stderr", line);
+          remember(line);
+          return;
+        }
+        const parsed = adapter.parse(line);
+        const tally = (total, value) => value === void 0 ? total : parsed.accumulate ? (total ?? 0) + value : value;
+        costUsd = tally(costUsd, parsed.costUsd);
+        inputTokens = tally(inputTokens, parsed.inputTokens);
+        outputTokens = tally(outputTokens, parsed.outputTokens);
+        if (parsed.result !== void 0) lastResult = parsed.result;
+        if (parsed.log !== null) {
+          log.push("stdout", parsed.log);
+          remember(parsed.log);
+        }
+      }
+    });
+    if (stopReason) void harness.stop(options.graceMs ?? 1e4);
+    const exitCode = await harness.exited;
+    event(exitCode === null ? "Harness was killed" : `Harness exited with code ${exitCode}`);
+    const usage = { costUsd, inputTokens, outputTokens, exitCode };
+    if (stopReason) return stopped(exitCode, lastLines, usage);
+    const verdict = adapter.outcome(exitCode, lastLines, lastResult);
+    if (verdict.outcome === "succeeded" && !pullRequestUrl) {
+      pullRequestUrl = await (options.findPullRequest ?? findPullRequest)(
+        workspace.checkout,
+        run.branchName,
+        env
+      );
+    }
+    if (pullRequestUrl) event(`Pull request: ${pullRequestUrl}`);
+    return {
+      outcome: verdict.outcome,
+      exitCode,
+      summary: truncate(verdict.summary, MaxSummary),
+      pullRequestUrl,
+      failureReason: verdict.outcome === "failed" ? truncate(verdict.failureReason ?? "harness-failed", MaxFailureReason) : null,
+      costUsd: costUsd ?? null,
+      inputTokens: inputTokens ?? null,
+      outputTokens: outputTokens ?? null
+    };
+  })().catch((error) => {
+    if (error instanceof RunnerHttpError && error.revoked) throw error;
+    local(`${run.itemKey}: ${message2(error)}`);
+    event(`Runner error: ${message2(error)}`);
+    return failed("runner-error", message2(error));
+  }).finally(() => {
+    clearInterval(heartbeat);
+    clearTimeout(deadline);
+    options.shutdown?.removeEventListener("abort", onShutdown);
+  });
+  if (report?.outcome === "failed" && report.failureReason)
+    event(`Run failed: ${report.failureReason}`);
+  await beating;
+  await log.close();
+  await workspace?.cleanup();
+  if (revoked) throw revoked;
+  if (!report) return null;
+  return await sendFinish(client, run, report, local) ? report : null;
+  function failed(reason, detail) {
+    return {
+      outcome: "failed",
+      failureReason: truncate(reason, MaxFailureReason),
+      summary: truncate(detail, MaxSummary)
+    };
+  }
+  function stopped(exitCode, lines, usage = {}) {
+    const tail = lines.length > 0 ? lines.join("\n") : null;
+    switch (stopReason) {
+      case "closed":
+        return null;
+      case "timed-out":
+        return {
+          ...usage,
+          outcome: "failed",
+          exitCode,
+          failureReason: "timed-out",
+          summary: truncate(tail, MaxSummary)
+        };
+      case "shutdown":
+        return {
+          ...usage,
+          outcome: "cancelled",
+          exitCode,
+          failureReason: "runner-shutdown",
+          summary: "The runner was stopped before the run finished."
+        };
+      default:
+        return { ...usage, outcome: "cancelled", exitCode, summary: truncate(tail, MaxSummary) };
+    }
+  }
+}
+async function sendFinish(client, run, report, local) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await client.finish(run.runId, report);
+      local(
+        `${run.itemKey}: ${report.outcome}${report.failureReason ? ` (${report.failureReason})` : ""}`
+      );
+      return true;
+    } catch (error) {
+      if (error instanceof RunnerNetworkError && attempt < 30) {
+        await new Promise((resolve3) => setTimeout(resolve3, Math.min(3e4, 1e3 * 2 ** attempt)));
+        continue;
+      }
+      if (error instanceof RunnerHttpError && error.revoked) throw error;
+      local(`${run.itemKey}: could not report the outcome: ${message2(error)}`);
+      return false;
+    }
+  }
+}
+function findPullRequest(checkout, branch, env) {
+  return new Promise((resolve3) => {
+    execFile(
+      "gh",
+      ["pr", "view", branch, "--json", "url", "--jq", ".url"],
+      { cwd: checkout, env, timeout: 15e3 },
+      (error, stdout) => {
+        const url = error ? "" : stdout.trim();
+        resolve3(/^https:\/\/\S+\/pull\/\d+$/.test(url) ? url : null);
+      }
+    );
+  });
+}
+function truncate(value, max) {
+  if (!value) return null;
+  return value.length <= max ? value : `${value.slice(0, max - 1)}\u2026`;
+}
+function message2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/runner/harness/claude.ts
+import { execFile as execFile2 } from "child_process";
+var limit2 = (value, length) => value.length > length ? `${value.slice(0, Math.max(0, length - 1))}\u2026` : value;
+var recordOf = (value) => typeof value === "object" && value !== null ? value : null;
+function versionOf(command, env = process.env) {
+  return new Promise((resolve3) => {
+    execFile2(command, ["--version"], { env, timeout: 5e3 }, (error, stdout, stderr) => {
+      if (error) return resolve3(null);
+      const output = String(stdout || stderr).trim();
+      const firstLine = output.split(/\r?\n/)[0]?.slice(0, 100) ?? "";
+      resolve3(firstLine || null);
+    });
+  });
+}
+function failedOutcome(exitCode, lastLines) {
+  return {
+    outcome: "failed",
+    failureReason: exitCode === null ? "harness-killed" : `harness-exit-${exitCode}`,
+    summary: limit2(lastLines.slice(-20).join("\n"), 4e3) || null
+  };
+}
+var claude = {
+  name: "claude",
+  async available(env) {
+    const version2 = await versionOf("claude", env);
+    return version2 === null ? null : { name: "claude", version: version2 };
+  },
+  invocation(context) {
+    return {
+      command: "claude",
+      args: [
+        "-p",
+        "--output-format",
+        "stream-json",
+        "--verbose",
+        "--permission-mode",
+        "bypassPermissions",
+        "--mcp-config",
+        context.mcpConfigFile,
+        // Claude's working directory remains the checkout. Attachments are deliberately
+        // beside it, so grant this one read-only run directory explicitly.
+        "--add-dir",
+        context.attachmentsDir
+      ],
+      // Claude's -p mode consumes stdin when there is no positional prompt.
+      stdin: context.prompt
+    };
+  },
+  parse(line) {
+    let event;
+    try {
+      const parsed = JSON.parse(line);
+      event = recordOf(parsed) ?? (() => {
+        throw new Error("not an object");
+      })();
+    } catch {
+      return { log: line };
+    }
+    if (event.type === "system" && event.subtype === "init") {
+      return { log: `[init] model ${typeof event.model === "string" ? event.model : "unknown"}` };
+    }
+    if (event.type === "assistant") {
+      const message3 = recordOf(event.message);
+      const content = Array.isArray(message3?.content) ? message3.content : [];
+      const logs = content.flatMap((block) => {
+        const part = recordOf(block);
+        if (!part || part.type === "thinking") return [];
+        if (part.type === "text" && typeof part.text === "string") return [part.text];
+        if (part.type === "tool_use") {
+          const name = typeof part.name === "string" ? part.name : "tool";
+          const input = limit2(JSON.stringify(part.input ?? {}), 200);
+          return [`\u2192 ${name} ${input}`];
+        }
+        return [];
+      });
+      return { log: logs.length > 0 ? logs.join("\n") : null };
+    }
+    if (event.type === "user") {
+      const message3 = recordOf(event.message);
+      const content = Array.isArray(message3?.content) ? message3.content[0] : message3?.content;
+      const result = recordOf(content);
+      if (result?.type !== "tool_result") return { log: null };
+      const text = typeof result.content === "string" ? result.content : JSON.stringify(result.content ?? "");
+      const error = result.is_error === true ? "[error] " : "";
+      return { log: `\u2190 ${error}${limit2(text.split(/\r?\n/)[0] ?? "", 200)}` };
+    }
+    if (event.type === "result") {
+      const usage = recordOf(event.usage);
+      const input = numberOf(usage?.input_tokens) + numberOf(usage?.cache_creation_input_tokens) + numberOf(usage?.cache_read_input_tokens);
+      return {
+        // The marker is what `outcome` reads: the runner keeps the logged lines, not the raw JSON.
+        log: `[result] ${typeof event.subtype === "string" ? event.subtype : "unknown"}${event.is_error === true ? " (error)" : ""} in ${numberOf(event.duration_ms)}ms`,
+        costUsd: numberOrUndefined(event.total_cost_usd),
+        inputTokens: input || void 0,
+        outputTokens: numberOrUndefined(usage?.output_tokens),
+        result: typeof event.result === "string" ? event.result : void 0
+      };
+    }
+    return { log: null };
+  },
+  outcome(exitCode, lastLines, lastResult) {
+    if (exitCode !== 0) return failedOutcome(exitCode, lastLines);
+    if (lastLines.some((line) => /^\[result\] .*\(error\)/.test(line))) {
+      return { ...failedOutcome(exitCode, lastLines), failureReason: "harness-error" };
+    }
+    return {
+      outcome: "succeeded",
+      failureReason: null,
+      summary: limit2(lastResult ?? lastLines.slice(-20).join("\n"), 4e3) || null
+    };
+  }
+};
+function numberOf(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function numberOrUndefined(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+
+// src/runner/harness/codex.ts
+var limit3 = (value, length) => value.length > length ? `${value.slice(0, Math.max(0, length - 1))}\u2026` : value;
+var recordOf2 = (value) => typeof value === "object" && value !== null ? value : null;
+var MCP_ENV = ["AICTIQ_URL", "AICTIQ_TOKEN", "AICTIQ_ORG", "AICTIQ_ITEM", "AICTIQ_RUN"];
+var codex = {
+  name: "codex",
+  async available(env) {
+    const version2 = await versionOf("codex", env);
+    return version2 === null ? null : { name: "codex", version: version2 };
+  },
+  invocation(context) {
+    return {
+      command: "codex",
+      args: [
+        "exec",
+        "--json",
+        // 0.154.0 removed --full-auto. The runner is the ticket's explicit trust boundary:
+        // the agent needs unrestricted network access for the MCP server and git push.
+        "--dangerously-bypass-approvals-and-sandbox",
+        // This mode also permits the absolute attachment paths named in prompt.md outside
+        // the checkout. The runner itself remains the trust boundary for those files.
+        "--skip-git-repo-check",
+        "-C",
+        context.workspace,
+        "-c",
+        `mcp_servers.aictiq.command=${JSON.stringify(context.mcpServer.command)}`,
+        "-c",
+        `mcp_servers.aictiq.args=${JSON.stringify(context.mcpServer.args)}`,
+        // Codex starts MCP servers with a scrubbed environment; without this the bridge
+        // never sees the run's credential and the handshake fails. Names only - the values
+        // stay in the process environment, out of argv.
+        "-c",
+        `mcp_servers.aictiq.env_vars=${JSON.stringify(MCP_ENV)}`,
+        "-"
+      ],
+      stdin: context.prompt
+    };
+  },
+  parse(line) {
+    let event;
+    try {
+      const parsed = JSON.parse(line);
+      event = recordOf2(parsed) ?? (() => {
+        throw new Error("not an object");
+      })();
+    } catch {
+      return { log: line };
+    }
+    const item = recordOf2(event.item);
+    if ((event.type === "item.completed" || event.type === "item.started") && item) {
+      if (item.type === "agent_message" && typeof item.text === "string") {
+        return { log: item.text, result: item.text };
+      }
+      if (item.type === "command_execution") {
+        if (event.type === "item.completed") return { log: null };
+        const command = typeof item.command === "string" ? item.command : JSON.stringify(item.command ?? "");
+        return { log: `\u2192 command ${limit3(command, 200)}` };
+      }
+      if (item.type === "file_change") {
+        const changes = Array.isArray(item.changes) ? item.changes : [];
+        const paths = changes.map((change) => recordOf2(change)?.path).filter((path) => typeof path === "string");
+        return { log: paths.length > 0 ? `\u2192 file_change ${limit3(paths.join(", "), 200)}` : null };
+      }
+    }
+    const usage = usageOf(event);
+    if (usage) {
+      const input = numberOf2(usage.input_tokens) + numberOf2(usage.cached_input_tokens) + numberOf2(usage.cache_write_input_tokens);
+      return {
+        log: null,
+        inputTokens: input || void 0,
+        outputTokens: numberOrUndefined2(usage.output_tokens)
+      };
+    }
+    return { log: null };
+  },
+  outcome(exitCode, lastLines, lastResult) {
+    if (exitCode !== 0) return failedOutcome2(exitCode, lastLines);
+    return {
+      outcome: "succeeded",
+      failureReason: null,
+      summary: limit3(lastResult ?? lastLines.slice(-20).join("\n"), 4e3) || null
+    };
+  }
+};
+function usageOf(event) {
+  if (event.type === "turn.completed") return recordOf2(event.usage);
+  if (event.type === "token_count") return recordOf2(event.usage) ?? recordOf2(event.info);
+  const payload = recordOf2(event.payload);
+  if (payload?.type === "token_count") {
+    return recordOf2(payload.usage) ?? recordOf2(recordOf2(payload.info)?.total_token_usage);
+  }
+  return null;
+}
+function failedOutcome2(exitCode, lastLines) {
+  return {
+    outcome: "failed",
+    failureReason: exitCode === null ? "harness-killed" : `harness-exit-${exitCode}`,
+    summary: limit3(lastLines.slice(-20).join("\n"), 4e3) || null
+  };
+}
+function numberOf2(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function numberOrUndefined2(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+
+// src/runner/harness/opencode.ts
+var limit4 = (value, length) => value.length > length ? `${value.slice(0, Math.max(0, length - 1))}\u2026` : value;
+var recordOf3 = (value) => typeof value === "object" && value !== null ? value : null;
+var opencode = {
+  name: "opencode",
+  async available(env) {
+    const version2 = await versionOf("opencode", env);
+    return version2 === null ? null : { name: "opencode", version: version2 };
+  },
+  invocation(context) {
+    return {
+      command: "opencode",
+      // `--file` is a variadic option: anything after it is taken as another file to
+      // attach, so the message goes first and the prompt file last.
+      args: [
+        "run",
+        "Follow the instructions in the attached file.",
+        "--format",
+        "json",
+        "--dir",
+        context.workspace,
+        "--file",
+        context.promptFile,
+        context.attachmentsDir
+      ],
+      env: {
+        OPENCODE_CONFIG_CONTENT: JSON.stringify({
+          $schema: "https://opencode.ai/config.json",
+          mcp: {
+            aictiq: {
+              type: "local",
+              command: [context.mcpServer.command, ...context.mcpServer.args],
+              enabled: true
+            }
+          }
+        })
+      }
+    };
+  },
+  parse(line) {
+    let event;
+    try {
+      const parsed = JSON.parse(line);
+      event = recordOf3(parsed) ?? (() => {
+        throw new Error("not an object");
+      })();
+    } catch {
+      return { log: line };
+    }
+    const part = recordOf3(event.part);
+    if (!part) return { log: null };
+    if (event.type === "text" && typeof part.text === "string") {
+      return { log: part.text, result: part.text };
+    }
+    if (event.type === "tool_use") {
+      const tool = typeof part.tool === "string" ? part.tool : typeof part.name === "string" ? part.name : "tool";
+      const state = recordOf3(part.state);
+      return { log: `\u2192 ${tool} ${limit4(JSON.stringify(state?.input ?? part.input ?? {}), 200)}` };
+    }
+    if (event.type === "step_finish") {
+      const tokens = recordOf3(part.tokens);
+      const cache = recordOf3(tokens?.cache);
+      return {
+        log: null,
+        accumulate: true,
+        costUsd: numberOrUndefined3(part.cost),
+        inputTokens: sumOf(tokens?.input, cache?.read, cache?.write),
+        outputTokens: sumOf(tokens?.output, tokens?.reasoning)
+      };
+    }
+    return { log: null };
+  },
+  outcome(exitCode, lastLines, lastResult) {
+    if (exitCode !== 0) return failedOutcome3(exitCode, lastLines);
+    return {
+      outcome: "succeeded",
+      failureReason: null,
+      summary: limit4(lastResult ?? lastLines.slice(-20).join("\n"), 4e3) || null
+    };
+  }
+};
+function failedOutcome3(exitCode, lastLines) {
+  return {
+    outcome: "failed",
+    failureReason: exitCode === null ? "harness-killed" : `harness-exit-${exitCode}`,
+    summary: limit4(lastLines.slice(-20).join("\n"), 4e3) || null
+  };
+}
+function sumOf(...values) {
+  const numbers = values.filter(
+    (value) => typeof value === "number" && Number.isFinite(value)
+  );
+  return numbers.length === 0 ? void 0 : numbers.reduce((total, value) => total + value, 0);
+}
+function numberOrUndefined3(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+
+// src/runner/harness/index.ts
+var harnesses = { claude, codex, opencode };
+async function probeHarnesses(env) {
+  const found = await Promise.all(Object.values(harnesses).map((harness) => harness.available(env)));
+  return found.filter((info) => info !== null);
+}
+
+// src/runner/loop.ts
+var KnownHarnesses = ["claude", "codex", "opencode"];
+var RunnerRevokedError = class extends Error {
+  constructor(message3) {
+    super(message3);
+    this.name = "RunnerRevokedError";
+  }
+};
+var RunnerLoop = class {
+  options;
+  active = /* @__PURE__ */ new Set();
+  claimAbort = new AbortController();
+  shutdown = new AbortController();
+  stopping = false;
+  revoked;
+  wake;
+  constructor(options) {
+    this.options = options;
+  }
+  get inFlight() {
+    return this.active.size;
+  }
+  stop() {
+    this.stopping = true;
+    this.claimAbort.abort();
+    this.wake?.();
+  }
+  abort() {
+    this.stop();
+    this.shutdown.abort();
+  }
+  /** Resolves when the loop has stopped and every run it took is reported. */
+  async run() {
+    const { client, local } = this.options;
+    let capabilities = await this.options.probe();
+    const hello = await this.retrying(() => client.hello(capabilities));
+    if (!hello) return;
+    local(
+      `Runner "${hello.name}" connected to ${client.baseUrl} (${hello.organizationSlug}); harnesses: ${capabilities.harnesses.map((h) => h.name).join(", ") || "none detected"}`
+    );
+    const heartbeat = setInterval(() => {
+      void (async () => {
+        try {
+          capabilities = await this.options.probe();
+          await client.heartbeat(capabilities);
+        } catch (error) {
+          if (error instanceof RunnerHttpError && error.revoked) this.revoke(error);
+          else local(`Heartbeat failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+      })();
+    }, hello.heartbeatIntervalSeconds * 1e3);
+    try {
+      let attempt = 0;
+      while (!this.stopping) {
+        const free = this.options.parallel - this.active.size;
+        if (free <= 0) {
+          await this.waitForSlot();
+          continue;
+        }
+        const detected = capabilities.harnesses.map((h) => h.name);
+        const offered = detected.length > 0 ? detected : [...KnownHarnesses];
+        let claimed;
+        try {
+          claimed = await client.claim(offered, free, this.claimAbort.signal);
+          attempt = 0;
+        } catch (error) {
+          if (this.stopping) break;
+          if (error instanceof RunnerHttpError && error.revoked) {
+            this.revoke(error);
+            break;
+          }
+          attempt++;
+          const wait = this.options.backoffMs?.(attempt) ?? Math.min(6e4, 1e3 * 2 ** (attempt - 1));
+          local(
+            `Claim failed (${error instanceof Error ? error.message : String(error)}); retrying in ${Math.round(wait / 1e3)}s`
+          );
+          await this.sleep(wait);
+          continue;
+        }
+        if (!claimed) continue;
+        local(`Claimed ${claimed.itemKey} (run ${claimed.runId}, ${claimed.harness})`);
+        const execution = this.options.execute(claimed, hello, this.shutdown.signal).then(() => void 0).catch((error) => {
+          if (error instanceof RunnerHttpError && error.revoked) this.revoke(error);
+          else
+            local(
+              `Run ${claimed.runId} ended with an error: ${error instanceof Error ? error.message : String(error)}`
+            );
+        }).finally(() => {
+          this.active.delete(execution);
+          this.wake?.();
+        });
+        this.active.add(execution);
+      }
+      if (this.active.size > 0) local(`Waiting for ${this.active.size} run(s) to finish\u2026`);
+      await Promise.all([...this.active]);
+    } finally {
+      clearInterval(heartbeat);
+    }
+    if (this.revoked) throw this.revoked;
+  }
+  revoke(error) {
+    this.revoked ??= new RunnerRevokedError(
+      error.problem?.type?.endsWith("token-revoked") ? "This runner was disabled, deleted or rotated. Register it again with `aictiq runner register`." : `The instance refused the runner secret (${error.message}). Register it again with \`aictiq runner register\`.`
+    );
+    this.abort();
+  }
+  /** Retries network failures until stopped; a refusal is thrown. */
+  async retrying(action) {
+    for (let attempt = 1; !this.stopping; attempt++) {
+      try {
+        return await action();
+      } catch (error) {
+        if (error instanceof RunnerHttpError && error.revoked) {
+          this.revoke(error);
+          throw this.revoked;
+        }
+        if (!(error instanceof RunnerNetworkError)) throw error;
+        const wait = this.options.backoffMs?.(attempt) ?? Math.min(6e4, 1e3 * 2 ** (attempt - 1));
+        this.options.local(`${error.message}; retrying in ${Math.round(wait / 1e3)}s`);
+        await this.sleep(wait);
+      }
+    }
+    return null;
+  }
+  waitForSlot() {
+    return new Promise((resolve3) => {
+      this.wake = () => {
+        this.wake = void 0;
+        resolve3();
+      };
+    });
+  }
+  sleep(ms) {
+    return new Promise((resolve3) => {
+      const timer = setTimeout(done, ms);
+      this.wake = done;
+      function done() {
+        clearTimeout(timer);
+        resolve3();
+      }
+    });
+  }
+};
+
+// src/commands/runner.ts
+function runnerCommand(globals) {
+  const runner = new Command7("runner").description(
+    "Run agent work dispatched from a Aictiq instance on this machine"
+  );
+  runner.command("register").description("Store a runner secret (jrn_\u2026) from Factory \u2192 Runners and check it").option("--url <url>", "Base URL of the Aictiq instance").option("--token <token>", "Runner secret; read from stdin when omitted").option("--name <name>", "A local label for this runner (the instance keeps its own name)").action(async (options) => {
+    const global = globals();
+    const rawUrl = options.url ?? global.url;
+    if (!rawUrl) {
+      throw new CliError(
+        "Pass --url with the address of your Aictiq instance.",
+        ExitCode.Validation
+      );
+    }
+    const token = options.token ?? global.token ?? process.env.AICTIQ_RUNNER_TOKEN ?? await promptSecret("Runner secret: ");
+    if (!token?.startsWith("jrn_")) {
+      throw new CliError(
+        "A runner secret starts with jrn_. Create one under Factory \u2192 Runners.",
+        ExitCode.Validation
+      );
+    }
+    const url = rawUrl.replace(/\/+$/, "");
+    const capabilities = await probe(1);
+    const hello = await new RunnerClient({ baseUrl: url, token }).hello(capabilities).catch((error) => {
+      throw asCliError(error);
+    });
+    const existing = readRunnerConfig();
+    const config = {
+      url,
+      token,
+      ...options.name ? { name: options.name } : existing?.name ? { name: existing.name } : {},
+      // Re-registering (a rotated secret) keeps the repository map someone built up.
+      workspaces: existing?.workspaces ?? {},
+      repoRoots: existing?.repoRoots ?? [],
+      attachments: existing?.attachments ?? { maxCount: DefaultAttachmentMaxCount, maxBytes: DefaultAttachmentMaxBytes }
+    };
+    writeRunnerConfig(config);
+    if (globals().json) {
+      printJson({ url, runner: hello, capabilities, configPath: runnerConfigPath() });
+      return;
+    }
+    print(
+      `Registered runner "${hello.name}" with ${url} (${hello.organizationSlug}).
+Harnesses: ${capabilities.harnesses.map((h) => h.name).join(", ") || "none found on PATH"}
+Config written to ${runnerConfigPath()}. Start it with \`aictiq runner start\`.`
+    );
+  });
+  runner.command("map").description(
+    "Map a project key to a local clone, for projects whose repository source is local"
+  ).argument("<projectKey>", "Project key, e.g. ACME").argument("[path]", "Path of the clone (default: the current directory); omit with --remove").option("--remove", "Remove the mapping").action((projectKey, path, options) => {
+    const config = requireConfig();
+    const key = projectKey.toUpperCase();
+    if (options.remove) {
+      delete config.workspaces[key];
+    } else {
+      const absolute = resolve2(path ?? ".");
+      if (!existsSync3(absolute))
+        throw new CliError(`${absolute} does not exist.`, ExitCode.Validation);
+      config.workspaces[key] = absolute;
+    }
+    writeRunnerConfig(config);
+    print(
+      options.remove ? `Removed the mapping for ${key}.` : `${key} \u2192 ${config.workspaces[key]}`
+    );
+  });
+  runner.command("root").description(
+    "Trust the web UI's path hint for local projects whose clone is under this directory"
+  ).argument("[path]", "Directory that holds your clones (default: the current directory)").option("--remove", "Stop trusting path hints under this directory").action((path, options) => {
+    const config = requireConfig();
+    const absolute = resolve2(path ?? ".");
+    if (options.remove) {
+      config.repoRoots = config.repoRoots.filter((root) => resolve2(root) !== absolute);
+    } else {
+      if (!existsSync3(absolute))
+        throw new CliError(`${absolute} does not exist.`, ExitCode.Validation);
+      if (!config.repoRoots.some((root) => resolve2(root) === absolute))
+        config.repoRoots.push(absolute);
+    }
+    writeRunnerConfig(config);
+    print(
+      options.remove ? `Path hints under ${absolute} are no longer used.` : `Path hints under ${absolute} are used for projects without a mapping.`
+    );
+  });
+  runner.command("status").description("Show the registration, detected harnesses and mapped repositories").action(async () => {
+    const config = requireConfig();
+    const capabilities = await probe(1);
+    let registration;
+    let registrationText;
+    try {
+      const hello = await new RunnerClient({ baseUrl: config.url, token: config.token }).hello(
+        capabilities
+      );
+      registration = hello;
+      registrationText = `ok - "${hello.name}" in ${hello.organizationSlug}`;
+    } catch (error) {
+      registration = { error: error instanceof Error ? error.message : String(error) };
+      registrationText = `failing - ${error instanceof Error ? error.message : String(error)}`;
+      if (error instanceof RunnerHttpError && error.revoked) process.exitCode = ExitCode.Auth;
+    }
+    if (globals().json) {
+      printJson({ url: config.url, registration, capabilities, workspaces: config.workspaces, repoRoots: config.repoRoots, attachments: config.attachments });
+      return;
+    }
+    print(
+      renderFields([
+        ["Instance", config.url],
+        ["Registration", registrationText],
+        ["Config", runnerConfigPath()],
+        ["Workspaces", defaultWorkspaceRoot()],
+        ["Attachments", `${config.attachments.maxCount} files / ${formatBytes2(config.attachments.maxBytes)} per run`],
+        ["CLI", `${version} (${capabilities.os}/${capabilities.arch})`]
+      ])
+    );
+    print("");
+    print(
+      capabilities.harnesses.length === 0 ? "No harness found on PATH (claude, codex, opencode)." : renderTable(capabilities.harnesses, [
+        { header: "HARNESS", value: (h) => h.name },
+        { header: "VERSION", value: (h) => h.version ?? "" }
+      ])
+    );
+    print("");
+    const mapped = Object.entries(config.workspaces);
+    print(
+      mapped.length === 0 ? "No local repositories mapped (`aictiq runner map <KEY> <path>`)." : renderTable(mapped, [
+        { header: "PROJECT", value: ([key]) => key },
+        { header: "REPOSITORY", value: ([, path]) => path }
+      ])
+    );
+    print("");
+    print(
+      config.repoRoots.length === 0 ? "No repository roots; path hints from the web UI are not used (`aictiq runner root <path>`)." : renderTable(config.repoRoots, [{ header: "REPOSITORY ROOT", value: (root) => root }])
+    );
+  });
+  runner.command("start").description("Poll for runs and execute them until interrupted").option("--parallel <n>", "Runs executed at the same time", "1").option("--keep-workspaces", "Leave each run\u2019s checkout on disk after it finishes").option("--workspace-root <path>", "Where run checkouts are created").action(
+    async (options) => {
+      const config = requireConfig();
+      const parallel = Number.parseInt(options.parallel, 10);
+      if (!Number.isInteger(parallel) || parallel < 1 || parallel > 16) {
+        throw new CliError("--parallel is between 1 and 16.", ExitCode.Validation);
+      }
+      const client = new RunnerClient({ baseUrl: config.url, token: config.token });
+      const local = (message3) => process.stderr.write(`${(/* @__PURE__ */ new Date()).toISOString()} ${message3}
+`);
+      const workspaceRoot = resolve2(options.workspaceRoot ?? defaultWorkspaceRoot());
+      const loop = new RunnerLoop({
+        client,
+        parallel,
+        probe: () => probe(parallel),
+        local,
+        execute: (run, hello, shutdown) => {
+          const current = readRunnerConfig() ?? config;
+          return executeRun(run, {
+            client,
+            hello,
+            adapters: harnesses,
+            runnerToken: config.token,
+            shutdown,
+            local,
+            workspace: {
+              root: workspaceRoot,
+              repositories: current.workspaces,
+              repoRoots: current.repoRoots,
+              keep: options.keepWorkspaces === true,
+              mcpServer: mcpServerCommand(),
+              attachmentMaxCount: current.attachments.maxCount,
+              attachmentMaxBytes: current.attachments.maxBytes
+            }
+          });
+        }
+      });
+      let interrupts = 0;
+      const onSignal = (signal2) => {
+        interrupts++;
+        if (interrupts === 1 && loop.inFlight > 0) {
+          local(
+            `${signal2}: finishing ${loop.inFlight} run(s) in flight; send it again to cancel them`
+          );
+          loop.stop();
+        } else if (interrupts === 1) {
+          loop.stop();
+        } else {
+          local(`${signal2}: cancelling runs in flight`);
+          loop.abort();
+        }
+      };
+      process.on("SIGINT", onSignal);
+      process.on("SIGTERM", onSignal);
+      try {
+        await loop.run();
+      } catch (error) {
+        throw asCliError(error);
+      } finally {
+        process.off("SIGINT", onSignal);
+        process.off("SIGTERM", onSignal);
+      }
+    }
+  );
+  runner.command("install-service").description("Print a systemd user unit that keeps `aictiq runner start` running").option("--parallel <n>", "Runs executed at the same time", "1").action((options) => {
+    print(systemdUnit(process.execPath, cliEntry(), options.parallel));
+  });
+  return runner;
+}
+function systemdUnit(node, entry, parallel) {
+  return `# Save as ~/.config/systemd/user/aictiq-runner.service, then:
+#   systemctl --user daemon-reload
+#   systemctl --user enable --now aictiq-runner
+#   loginctl enable-linger "$USER"   # keep it running after you log out
+#
+# The runner executes agents as this user, with this user's harness sign-ins and git
+# credentials: one runner is one trust domain. SIGTERM lets runs in flight finish;
+# TimeoutStopSec bounds how long systemd waits before it cancels them.
+[Unit]
+Description=Aictiq runner
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${node} ${entry} runner start --parallel ${parallel}
+Restart=on-failure
+RestartSec=10
+# Exit 5 means the secret was revoked; restarting cannot fix that.
+RestartPreventExitStatus=5
+KillMode=mixed
+TimeoutStopSec=15min
+Environment=PATH=${process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin"}
+
+[Install]
+WantedBy=default.target
+`;
+}
+async function probe(maxParallel) {
+  return {
+    v: 1,
+    harnesses: await probeHarnesses(),
+    os: platform(),
+    arch: arch(),
+    cliVersion: version,
+    maxParallel
+  };
+}
+function cliEntry() {
+  return resolve2(process.argv[1] ?? "aictiq");
+}
+function mcpServerCommand() {
+  return { command: process.execPath, args: [cliEntry(), "mcp"] };
+}
+function formatBytes2(value) {
+  return value >= 1024 * 1024 ? `${(value / (1024 * 1024)).toFixed(1)} MiB` : `${value} bytes`;
+}
+function requireConfig() {
+  const config = readRunnerConfig();
+  if (!config) {
+    throw new CliError(
+      `This machine is not registered as a runner (${runnerConfigPath()}). Run \`aictiq runner register --url <url> --token <jrn_\u2026>\`.`,
+      ExitCode.Auth
+    );
+  }
+  return config;
+}
+function asCliError(error) {
+  if (error instanceof RunnerRevokedError) return new CliError(error.message, ExitCode.Auth);
+  if (error instanceof RunnerHttpError) {
+    return new CliError(
+      error.status === 401 ? `The instance refused the runner secret: ${error.message}` : error.message,
+      error.status === 401 ? ExitCode.Auth : ExitCode.Error
+    );
+  }
+  return error;
+}
+
+// src/commands/sprint.ts
+import { Command as Command8 } from "commander";
+function sprintCommand(globals) {
+  const sprint = new Command8("sprint").description("Sprints");
+  sprint.command("list").description("List a team's sprints, newest first").requiredOption("-t, --team <key>", "Team key, name or id").option("-p, --project <key>", "Project key; required when the team is named, not an id").action(async (options) => {
+    const ctx = createContext(globals());
+    const teamId = await resolveTeamId2(ctx, options.team, options.project);
+    const sprints = await ctx.client.request("get", "/api/v1/orgs/{orgSlug}/teams/{teamId}/sprints", {
+      path: { orgSlug: await ctx.org(), teamId }
+    });
+    if (ctx.json) return printJson(sprints);
+    if (sprints.length === 0) return print("No sprints.");
+    print(
+      renderTable(sprints, [
+        { header: "ID", value: (s) => s.id },
+        { header: "NAME", value: (s) => s.name },
+        { header: "STATE", value: (s) => s.state },
+        { header: "STARTS", value: (s) => s.startsOn },
+        { header: "ENDS", value: (s) => s.endsOn },
+        {
+          header: "DONE",
+          value: (s) => `${s.progress.completedItems}/${s.progress.totalItems}`,
+          align: "right"
+        }
+      ])
+    );
+  });
+  sprint.command("view").description("Show a sprint and its taskboard").argument("<sprintId>", "Sprint id").option("--taskboard", "Include the taskboard rows").action(async (sprintId, options) => {
+    const ctx = createContext(globals());
+    const orgSlug = await ctx.org();
+    const found = await ctx.client.request("get", "/api/v1/orgs/{orgSlug}/sprints/{sprintId}", { path: { orgSlug, sprintId } });
+    const taskboard = options.taskboard ? await ctx.client.request("get", "/api/v1/orgs/{orgSlug}/sprints/{sprintId}/taskboard", {
+      path: { orgSlug, sprintId }
+    }) : void 0;
+    if (ctx.json) return printJson({ ...found, ...taskboard ? { taskboard } : {} });
+    print(
+      renderFields([
+        ["Sprint", found.name],
+        ["Goal", found.goal],
+        ["State", found.state],
+        ["Dates", `${found.startsOn} \u2192 ${found.endsOn}`],
+        ["Days left", String(found.daysLeft)],
+        ["Items", `${found.progress.completedItems}/${found.progress.totalItems}`],
+        [
+          "Points",
+          `${formatNumber(found.progress.pointsDone)}/${formatNumber(found.progress.pointsTotal)}`
+        ],
+        ["Remaining hours", formatNumber(found.progress.remainingHours)]
+      ])
+    );
+    if (taskboard) {
+      for (const row of taskboard.rows) {
+        print("");
+        print(`${row.parentKey ?? "(no parent)"}  ${row.name}`);
+        for (const cell of row.cells) {
+          for (const task of cell.tasks) {
+            print(`  [${cell.name}] ${task.key}  ${task.title}`);
+          }
+        }
+      }
+    }
+  });
+  return sprint;
+}
+async function resolveTeamId2(ctx, team, projectKey) {
+  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(team)) return team;
+  if (!projectKey) {
+    throw new CliError(
+      "Pass -p <projectKey> alongside a team key or name, or give the team id.",
+      ExitCode.Validation
+    );
+  }
+  const teams = await getTeams(ctx, projectKey.toUpperCase());
+  const needle = team.trim().toLowerCase();
+  const found = teams.find((t) => t.key.toLowerCase() === needle || t.name.toLowerCase() === needle);
+  if (!found) {
+    throw new CliError(
+      `No team "${team}" in ${projectKey}. Teams: ${teams.map((t) => t.key).join(", ") || "(none)"}.`,
+      ExitCode.Validation
+    );
+  }
+  return found.id;
+}
+
+// src/commands/wiki.ts
+import { Command as Command9 } from "commander";
+function wikiCommand(globals) {
+  const wiki = new Command9("wiki").description("Project wiki pages");
+  wiki.command("tree").description("List the page tree of a project").requiredOption("-p, --project <key>", "Project key, e.g. ACME").action(async (options) => {
+    const ctx = createContext(globals());
+    const pages = await fetchTree(ctx, options.project.toUpperCase());
+    if (ctx.json) return printJson(pages);
+    if (pages.length === 0) return print("No wiki pages.");
+    const paths = pathsOf(pages);
+    print(
+      renderTable(pages, [
+        { header: "PATH", value: (p) => paths.get(p.id) ?? p.slug },
+        { header: "TITLE", value: (p) => p.title }
+      ])
+    );
+  });
+  wiki.command("get").description("Print a wiki page as Markdown").argument("<project>", "Project key, e.g. ACME").argument("<path>", "Slug path, e.g. specs/login").action(async (project, path) => {
+    const ctx = createContext(globals());
+    const pages = await fetchTree(ctx, project.toUpperCase());
+    const page = findByPath(pages, path);
+    if (!page) throw new CliError(`No wiki page at "${path}" in ${project}.`, ExitCode.NotFound);
+    const full = await ctx.client.request("get", "/api/v1/orgs/{orgSlug}/wiki/pages/{pageId}", {
+      path: { orgSlug: await ctx.org(), pageId: page.id }
+    });
+    if (ctx.json) return printJson(full);
+    print(full.contentMarkdown);
+  });
+  wiki.command("put").description("Create or replace a wiki page from Markdown").argument("<project>", "Project key, e.g. ACME").argument("<path>", "Slug path, e.g. specs/login").option("--file <path>", "Markdown file, or - for stdin", "-").option("-m, --body <markdown>", "Markdown body given inline").option("--title <title>", "Page title; defaults to the last path segment").option("--summary <text>", "Revision summary recorded in the history").action(
+    async (project, path, options) => {
+      const ctx = createContext(globals());
+      const orgSlug = await ctx.org();
+      const projectKey = project.toUpperCase();
+      const content = await readBody(
+        options.body,
+        options.body ? void 0 : options.file ?? "-"
+      );
+      if (content === void 0 || content.trim().length === 0) {
+        throw new CliError("The page body is empty.", ExitCode.Validation);
+      }
+      const pages = await fetchTree(ctx, projectKey);
+      const existing = findByPath(pages, path);
+      if (existing) {
+        const current = await ctx.client.request("get", "/api/v1/orgs/{orgSlug}/wiki/pages/{pageId}", {
+          path: { orgSlug, pageId: existing.id }
+        });
+        const updated = await ctx.client.request("patch", "/api/v1/orgs/{orgSlug}/wiki/pages/{pageId}", {
+          path: { orgSlug, pageId: existing.id },
+          body: {
+            contentMd: content,
+            version: current.version,
+            ...options.title ? { title: options.title } : {},
+            ...options.summary ? { summary: options.summary } : {}
+          }
+        });
+        if (ctx.json) return printJson(updated);
+        return print(`Updated ${path} (revision ${updated.revisionNumber}).`);
+      }
+      const segments = path.split("/").filter((s) => s.length > 0);
+      const parentPath = segments.slice(0, -1).join("/");
+      const parent = parentPath ? findByPath(pages, parentPath) : void 0;
+      if (parentPath && !parent) {
+        throw new CliError(
+          `The parent page "${parentPath}" does not exist; create it first.`,
+          ExitCode.NotFound
+        );
+      }
+      const created = await ctx.client.request("post", "/api/v1/orgs/{orgSlug}/projects/{projectKey}/wiki/pages", {
+        path: { orgSlug, projectKey },
+        body: {
+          title: options.title ?? titleFrom(segments.at(-1) ?? path),
+          contentMd: content,
+          ...parent ? { parentId: parent.id } : {}
+        }
+      });
+      if (ctx.json) return printJson(created);
+      print(`Created ${created.slug} (${created.title}).`);
+    }
+  );
+  return wiki;
+}
+async function fetchTree(ctx, projectKey) {
+  return ctx.client.request("get", "/api/v1/orgs/{orgSlug}/projects/{projectKey}/wiki/tree", {
+    path: { orgSlug: await ctx.org(), projectKey }
+  });
+}
+function pathsOf(pages) {
+  const byId = new Map(pages.map((page) => [page.id, page]));
+  const paths = /* @__PURE__ */ new Map();
+  const walk = (page) => {
+    const cached = paths.get(page.id);
+    if (cached) return cached;
+    const parent = page.parentId ? byId.get(page.parentId) : void 0;
+    const path = parent ? `${walk(parent)}/${page.slug}` : page.slug;
+    paths.set(page.id, path);
+    return path;
+  };
+  for (const page of pages) walk(page);
+  return paths;
+}
+function findByPath(pages, path) {
+  const wanted = path.split("/").filter((s) => s.length > 0).join("/").toLowerCase();
+  const paths = pathsOf(pages);
+  return pages.find((page) => paths.get(page.id)?.toLowerCase() === wanted);
+}
+function titleFrom(slug) {
+  const words = slug.replace(/[-_]+/g, " ").trim();
+  return words.charAt(0).toUpperCase() + words.slice(1);
+}
+
+// src/program.ts
+function createProgram() {
+  const program = new Command10("aictiq").description("Aictiq from the command line, for people and for agents").version(version, "-v, --version").option("--url <url>", "Aictiq base URL (overrides AICTIQ_URL and the config file)").option("--token <token>", "Personal access token (overrides AICTIQ_TOKEN)").option("--org <slug>", "Organization slug (overrides AICTIQ_ORG)").option("--json", "Print machine-readable JSON instead of a table").showHelpAfterError();
+  const globals = () => program.opts();
+  program.addCommand(authCommand(globals));
+  program.addCommand(attachmentCommand(globals));
+  program.addCommand(projectCommand(globals));
+  program.addCommand(itemCommand(globals));
+  program.addCommand(sprintCommand(globals));
+  program.addCommand(wikiCommand(globals));
+  program.addCommand(runCommand(globals));
+  program.addCommand(mcpCommand(globals));
+  program.addCommand(runnerCommand(globals));
+  return program;
+}
+
+// src/index.ts
+async function main() {
+  const program = createProgram();
+  program.exitOverride((error) => {
+    if (error.code === "commander.helpDisplayed" || error.code === "commander.version") {
+      process.exit(ExitCode.Ok);
+    }
+    process.exit(error.exitCode === 0 ? ExitCode.Ok : ExitCode.Validation);
+  });
+  await program.parseAsync(process.argv);
+}
+main().catch((error) => {
+  if (error instanceof CliError) {
+    process.stderr.write(`${error.message}
+`);
+    process.exit(error.exitCode);
+  }
+  process.stderr.write(`${error instanceof Error ? error.message : String(error)}
+`);
+  process.exit(ExitCode.Error);
+});
+//# sourceMappingURL=index.js.map