@anyforge/control 0.2.4 → 0.3.0

package/README.md

@@ -1,6 +1,11 @@
 # @anyforge/control
 
-Governed LLM proxy for any agent. Use the AI tools you already use — Claude Code, Cursor, Cline, Continue, or your own SDK — and route every call through AnyForge for cost analytics, audit log, and policy enforcement.
+Two things in one binary:
+
+1. **A governed LLM proxy** for any agent — Claude Code, Cursor, Cline, Continue, or your own SDK. Route their calls through AnyForge for cost analytics, audit log, and policy enforcement.
+2. **A scriptable AnyForge client** — approvals, crews, work items and workflows from a shell, with no browser and no agent in the loop.
+
+The second half is what makes AnyForge usable from CI. Every command speaks the same `/api/v1/control/*` API the MCP server does, but without needing a language model to drive it.
 
 ## Install
 
@@ -50,12 +55,55 @@ Claude Code recognises both, but they behave differently. `ANTHROPIC_API_KEY` is
 
 ## Commands
 
+### Setup
+
 | | |
 |---|---|
 | `anyforge init` | Authorise this device and patch local agent configs |
-| `anyforge whoami` | Show the company tied to the saved key |
+| `anyforge whoami` | Show the company, scopes and endpoint this key acts as (asks the server) |
 | `anyforge status` | Verify the proxy is reachable and your BYOK key is configured |
 | `anyforge logout` | Clear the local credential file **and revert patched configs** (does not revoke server-side) |
+| `anyforge apply-patch` | Apply a unified diff from a file or stdin via `git apply` |
+
+### Scriptable
+
+| | | Scope |
+|---|---|---|
+| `anyforge approvals` | List HIL approvals awaiting a decision | `read` |
+| `anyforge approve <id>` | Approve one (`--notes` is recorded in the audit trail) | `approve` |
+| `anyforge reject <id>` | Reject one | `approve` |
+| `anyforge crews` | List crews (`--active` for non-terminal only) | `read` |
+| `anyforge crew <id>` | Show one crew, its status and recent output | `read` |
+| `anyforge halt <id>` / `resume <id>` | Stop or restart a crew | `approve` |
+| `anyforge work` | List work items (`--status`, `--type`, `--priority`, `--search`, …) | `read` |
+| `anyforge workflows` | List operator workflows | `read` |
+| `anyforge run <id>` | Dispatch a run (`--input '{"repo":"acme/web"}'`) | `write` |
+| `anyforge ask <question>` | Ask the Oracle one question | `read` |
+
+Every command takes `--json`, which prints the API payload verbatim:
+
+```bash
+anyforge approvals --json | jq 'length'
+anyforge crews --active --json | jq -r '.[].id' | xargs -n1 anyforge halt
+```
+
+### Exit codes
+
+CI gates on these, so they are a contract:
+
+| | |
+|---|---|
+| `0` | Success — an empty list included |
+| `1` | Network or unexpected failure (retryable) |
+| `2` | Usage error |
+| `3` | Not authenticated — run `init`, or set `ANYFORGE_API_TOKEN` |
+| `4` | The API refused; its error code prints to stderr |
+
+Errors and progress go to stderr, so a `--json` pipe stays parseable under a failure.
+
+### Unattended use
+
+Set `ANYFORGE_API_TOKEN` (and optionally `ANYFORGE_API_URL`) instead of running `init` — no browser, no credential file. Mint the key under **Settings → API keys** with the narrowest scope the job needs.
 
 ## Endpoints
 
@@ -63,8 +111,8 @@ The CLI defaults to `https://crew.anyforge.ai`. Override per-invocation with `--
 
 The proxy exposes:
 
-- `POST /v1/anthropic/messages` — drop-in for `https://api.anthropic.com/v1/messages`. Use `Authorization: Bearer sk_anyforge_…` instead of `x-api-key`.
-- `POST /v1/openai/chat/completions` — drop-in for `https://api.openai.com/v1/chat/completions`.
+- `POST /v1/anthropic/v1/messages` — drop-in for `https://api.anthropic.com/v1/messages`. Use `Authorization: Bearer sk_anyforge_…` instead of `x-api-key`. The `/v1` repeats because you set `ANTHROPIC_BASE_URL` to `https://crew.anyforge.ai/v1/anthropic` and the Anthropic SDK appends `/v1/messages` to it.
+- `POST /v1/openai/v1/chat/completions` — drop-in for `https://api.openai.com/v1/chat/completions`.
 
 Both validate your AnyForge API key, look up your company's BYOK provider key, forward the request, and stream the response back unchanged. Token counts and cost are logged to your usage dashboard.
 

package/dist/cli.js

@@ -1,141 +1,97 @@
 #!/usr/bin/env node
-/**
- * @anyforge/control — entrypoint.
- *
- * Subcommands:
- *   init         — browser-based auth flow + config patching
- *   whoami       — show current identity
- *   logout       — clear stored credentials
- *   status       — connectivity + key health check
- *   apply-patch  — apply a unified diff (file or stdin) via git apply
- *   proxy        — local proxy mode (Phase 2 — coming soon)
- *
- * Each subcommand is a separate module under src/commands/. The
- * argv parsing here is deliberately tiny — no commander, no yargs.
- * For three flags and four commands, hand-rolled is shorter than
- * the lib + plugin chain.
- */
-import { red, yellow, dim, bold } from 'kleur/colors';
-import { runInit } from './commands/init.js';
-import { runWhoami } from './commands/whoami.js';
-import { runLogout } from './commands/logout.js';
-import { runStatus } from './commands/status.js';
-import { runApplyPatch } from './commands/applyPatch.js';
-function parseArgs(argv) {
-    const a = { positional: [] };
-    for (let i = 0; i < argv.length; i += 1) {
-        const v = argv[i];
-        if (!a.command && !v.startsWith('-')) {
-            a.command = v;
-            continue;
-        }
-        if (v === '--help' || v === '-h')
-            a.help = true;
-        else if (v === '--version' || v === '-V')
-            a.version = true;
-        else if (v === '--endpoint' && argv[i + 1]) {
-            a.endpoint = argv[i + 1];
-            i += 1;
-        }
-        else if (v === '--3way')
-            a.threeWay = true;
-        else if (v === '--dry-run')
-            a.dryRun = true;
-        else if (v === '--force' || v === '-f')
-            a.force = true;
-        else if (!v.startsWith('-'))
-            a.positional.push(v);
-    }
-    return a;
-}
-function printHelp() {
-    // eslint-disable-next-line no-console
-    console.log(`
-${bold('AnyForge Control')} — governed LLM proxy for any agent.
+var rt=Object.defineProperty;var it=(e,t)=>()=>(e&&(t=e(e=0)),t);var st=(e,t)=>{for(var o in t)rt(e,o,{get:t[o],enumerable:!0})};var Qe={};st(Qe,{default:()=>Ht});var Ht,Ze=it(()=>{Ht={name:"@anyforge/control",version:"0.3.0",description:"AnyForge Control CLI \u2014 governed LLM proxy for any agent, and a scriptable client for AnyForge approvals, crews, work items and workflows.",license:"Apache-2.0",homepage:"https://anyforge.ai",repository:{type:"git",url:"git+https://github.com/pootonline/sovereign-engineering.git",directory:"packages/control/cli"},publishConfig:{access:"public"},type:"module",main:"dist/cli.js",bin:{anyforge:"dist/cli.js",control:"dist/cli.js"},files:["dist","README.md"],scripts:{build:"esbuild src/cli.ts --bundle --minify --platform=node --format=esm --outfile=dist/cli.js --packages=external && chmod +x dist/cli.js","type-check":"tsc --noEmit",dev:"tsx src/cli.ts",prepublishOnly:"npm run build","publish:beta":"npm publish --access public --tag beta","publish:stable":"npm publish --access public"},engines:{node:">=22"},dependencies:{kleur:"^4.1.5",open:"^10.0.0",prompts:"^2.4.2"},devDependencies:{"@types/node":"^22.20.0","@types/prompts":"^2.4.9",esbuild:"^0.25.0",tsx:"^4.7.0",typescript:"^7.0.2"}}});import{red as et,yellow as Bt,dim as F,bold as P}from"kleur/colors";import{execFileSync as ne}from"child_process";import yt from"open";import oe from"prompts";import{green as $,dim as c,bold as E,yellow as I,cyan as M}from"kleur/colors";import{promises as U}from"fs";import{homedir as at}from"os";import{join as Ee,dirname as no}from"path";var Re=Ee(at(),".anyforge"),Z=Ee(Re,"credentials");async function ve(e){await U.mkdir(Re,{recursive:!0,mode:448}),await U.writeFile(Z,JSON.stringify(e,null,2),{mode:384})}async function b(){try{let e=await U.readFile(Z,"utf8");return JSON.parse(e)}catch(e){if(e.code==="ENOENT")return null;throw e}}async function Ae(){try{return await U.unlink(Z),!0}catch(e){if(e.code==="ENOENT")return!1;throw e}}import{promises as l}from"fs";import{execFileSync as lt}from"child_process";import{homedir as C}from"os";import{join as f}from"path";import D from"prompts";import{dim as w,green as te,yellow as K}from"kleur/colors";var T="# === AnyForge Control \u2014 added by `anyforge init` ===",S="# === end AnyForge Control ===",k=".anyforge-bak",ct=/claude_(max|pro|team|enterprise)/i,dt=["CLAUDE_CODE_ENABLE_TELEMETRY","OTEL_METRICS_EXPORTER","OTEL_EXPORTER_OTLP_PROTOCOL","OTEL_EXPORTER_OTLP_ENDPOINT","OTEL_EXPORTER_OTLP_HEADERS","OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE"];async function Te(e){let t=[],o=await ut(e);if(o&&t.push(o),e.scope==="repo"){let n=await pt(e);return n&&t.push(n),t}for(let n of gt){let r=await n.detect();if(!(!r||!(await D({type:"confirm",name:"go",message:`Patch ${n.label} via shell rc (${w(r.path)}) ?`,initial:!0})).go))try{await n.patch(r,e),t.push({label:n.label,path:r.path}),console.log(te("  \u2714")+" "+n.label)}catch(s){console.warn("  \u26A0 Skipped "+n.label+": "+s.message)}}return t}async function ut(e){let t=e.scope==="repo"&&e.repoRoot?{dir:f(e.repoRoot,".claude"),file:"settings.local.json"}:{dir:f(C(),".claude"),file:"settings.json"},o=f(t.dir,t.file);if(!(await D({type:"confirm",name:"go",message:`Patch Claude Code config at ${w(o)} ?`,initial:!0})).go)return null;await l.mkdir(t.dir,{recursive:!0});let r=await l.readFile(o,"utf8").catch(()=>"{}"),i;try{i=JSON.parse(r)}catch{i={}}let s=i.env??{},a=s.ANTHROPIC_BASE_URL;return a&&!a.includes(e.endpoint)&&(a.includes("localhost")||a.includes("127.0.0.1")||a.includes("0.0.0.0"))&&(console.log(),console.log(K("  \u26A0 Local LLM proxy detected: ")+w(a)),console.log(w("    AnyForge only routes Anthropic Claude models. Local models (Ollama,")),console.log(w("    LM Studio, etc.) will not work in Claude Code after this patch.")),console.log(w("    To restore: remove ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN")),console.log(w(`    from ${o}`)),console.log(),!(await D({type:"confirm",name:"go",message:"Overwrite existing local LLM proxy config?",initial:!1})).go)?null:(await R(o)&&!await R(o+k)&&await l.copyFile(o,o+k),s.ANTHROPIC_BASE_URL=`${e.endpoint}/v1/anthropic`,s.ANTHROPIC_AUTH_TOKEN=e.apiKey,delete s.ANTHROPIC_API_KEY,i.env=s,await l.writeFile(o,JSON.stringify(i,null,2)+`
+`),console.log(te("  \u2714")+" Claude Code"),{label:e.scope==="repo"?"Claude Code (repo)":"Claude Code (global)",path:o})}async function xe(e){let t=f(C(),".claude"),o=f(t,"settings.json");await l.mkdir(t,{recursive:!0});let n=await l.readFile(o,"utf8").catch(()=>"{}"),r;try{r=JSON.parse(n)}catch{r={}}let i=r.env??{},s=i.OTEL_EXPORTER_OTLP_ENDPOINT;return s&&!ee(s,_e(e.endpoint))?(console.log(K("  \u26A0 An OpenTelemetry endpoint is already configured: ")+w(s)),console.log(w("    Leaving it untouched. To send Claude Code usage to AnyForge, point")),console.log(w("    OTEL_EXPORTER_OTLP_ENDPOINT at "+e.endpoint+"/api/otel")),null):(await R(o)&&!await R(o+k)&&await l.copyFile(o,o+k),i.CLAUDE_CODE_ENABLE_TELEMETRY="1",i.OTEL_METRICS_EXPORTER="otlp",i.OTEL_EXPORTER_OTLP_PROTOCOL="http/json",i.OTEL_EXPORTER_OTLP_ENDPOINT=`${e.endpoint}/api/otel`,i.OTEL_EXPORTER_OTLP_HEADERS=`Authorization=Bearer ${e.apiKey}`,i.OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE="delta",r.env=i,await l.writeFile(o,JSON.stringify(r,null,2)+`
+`),{label:"Claude Code usage telemetry (global)",path:o})}async function pt(e){if(!e.repoRoot)return null;let t=f(e.repoRoot,".env");if(!(await D({type:"confirm",name:"go",message:`Write AnyForge env block to ${w(t)} ?`,initial:!0})).go)return null;let n=[T,`ANYFORGE_API_KEY=${e.apiKey}`,`ANTHROPIC_BASE_URL=${e.endpoint}/v1/anthropic`,`ANTHROPIC_AUTH_TOKEN=${e.apiKey}`,`OPENAI_BASE_URL=${e.endpoint}/v1/openai`,`OPENAI_API_KEY=${e.apiKey}`,S,""].join(`
+`),r="";try{r=await l.readFile(t,"utf8")}catch{}let i;return r.includes(T)?i=r.replace(new RegExp(`${T}[\\s\\S]*?${S}\\n?`),n):r.length===0?i=n:i=r.endsWith(`
+`)?`${r}${n}`:`${r}
+${n}`,i!==r&&await l.writeFile(t,i),await ft(e.repoRoot),console.log(te("  \u2714")+" .env"),{label:".env (repo)",path:t}}async function ft(e){let t=f(e,".gitignore");try{(await l.readFile(t,"utf8")).split(`
+`).map(i=>i.trim()).some(i=>i===".env"||i==="/.env"||i==="*.env")||console.log(K("  \u26A0 .env is not in .gitignore \u2014 add it before committing."))}catch{console.log(K("  \u26A0 No .gitignore found \u2014 make sure .env is excluded before committing."))}}var gt=[{label:"Cursor (shell hint)",async detect(){let e=f(C(),".cursor");return await R(e)?{path:".cursor (shell hint)"}:null},async patch(e,t){await Ce(t)}},{label:"Cline / Continue (shell hint)",async detect(){let e=await R(f(C(),".cline")),t=await R(f(C(),".continue"));return e||t?{path:"~/.cline or ~/.continue (shell hint)"}:null},async patch(e,t){await Ce(t)}}];async function Ce(e){let t=[T,`export ANYFORGE_API_KEY="${e.apiKey}"`,`export ANTHROPIC_BASE_URL="${e.endpoint}/v1/anthropic"`,`export ANTHROPIC_AUTH_TOKEN="${e.apiKey}"`,`export OPENAI_BASE_URL="${e.endpoint}/v1/openai"`,`export OPENAI_API_KEY="${e.apiKey}"`,"unset ANTHROPIC_API_KEY 2>/dev/null || true",S,""].join(`
+`);for(let o of[".zshrc",".bashrc"]){let n=f(C(),o);if(!await R(n))continue;let r=await l.readFile(n,"utf8"),i;r.includes(T)?i=r.replace(new RegExp(`${T}[\\s\\S]*?${S}\\n?`),t):i=r.endsWith(`
+`)?`${r}
+${t}`:`${r}
 
-${bold('USAGE')}
+${t}`,i!==r&&await l.writeFile(n,i)}}async function R(e){try{return await l.access(e),!0}catch{return!1}}async function ke(){try{let e=await l.readFile(f(C(),".claude.json"),"utf8"),o=JSON.parse(e).oauthAccount,n=o?.organizationType??"";if(o&&ct.test(n))return{isSubscription:!0,plan:/max/i.test(n)?"Max":/pro/i.test(n)?"Pro":/enterprise/i.test(n)?"Enterprise":/team/i.test(n)?"Team":n,email:o.emailAddress??null}}catch{}return{isSubscription:!1,plan:null,email:null}}async function Ie(e={}){let t=e.endpoint?_e(e.endpoint):null,o=[],n=f(C(),".claude","settings.json");await Oe(n,t)&&o.push(n);for(let i of[".zshrc",".bashrc"]){let s=f(C(),i);await Pe(s)&&o.push(s)}let r=e.repoRoot??mt(process.cwd());if(r){let i=f(r,".claude","settings.local.json");await Oe(i,t)&&o.push(i);let s=f(r,".env");await Pe(s)&&o.push(s)}return{reverted:o}}function ee(e,t){return e?e.includes("anyforge")?!0:t?e.includes(t):!1:!1}async function Oe(e,t){if(!await R(e))return!1;if(await R(e+k))return await l.copyFile(e+k,e),await l.unlink(e+k).catch(()=>{}),!0;let o;try{o=JSON.parse(await l.readFile(e,"utf8"))}catch{return!1}let n=o.env;if(!n)return!1;let r=!1,i=[["ANTHROPIC_BASE_URL","ANTHROPIC_AUTH_TOKEN"],["OPENAI_BASE_URL","OPENAI_API_KEY"]];for(let[s,a]of i)ee(n[s],t)&&(delete n[s],delete n[a],r=!0);if(n.ANYFORGE_API_KEY&&(delete n.ANYFORGE_API_KEY,r=!0),ee(n.OTEL_EXPORTER_OTLP_ENDPOINT,t))for(let s of dt)s in n&&(delete n[s],r=!0);return r?(Object.keys(n).length===0&&delete o.env,await l.writeFile(e,JSON.stringify(o,null,2)+`
+`),!0):!1}async function Pe(e){let t;try{t=await l.readFile(e,"utf8")}catch{return!1}if(!t.includes(T))return!1;let o=t.replace(new RegExp(`\\n?${be(T)}[\\s\\S]*?${be(S)}\\n?`),`
+`).replace(/\n{3,}/g,`
+
+`);return await l.writeFile(e,o),!0}function be(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function _e(e){try{return new URL(e).host}catch{return null}}function mt(e){try{return lt("git",["rev-parse","--show-toplevel"],{cwd:e,encoding:"utf8",stdio:["pipe","pipe","pipe"]}).trim()}catch{return null}}var ht=2e3,wt=900*1e3;async function $e(e){let{endpoint:t}=e;console.log(E("AnyForge Control \u2014 device authorisation")),console.log(c(`  endpoint: ${t}`));let o=process.cwd(),n=Se(o),r=n?Ct(n):null,s=await(await fetch(`${t}/api/cli/init`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({repo:r})})).json();if(!s.ok||!s.data)throw new Error(`Could not start the authorisation flow: ${s.error??"unknown error"}`);let{code:a,authUrl:m,pollUrl:me}=s.data;console.log(),console.log("Open this URL in your browser to authorise:"),console.log(`  ${M(m)}`),console.log(c(`  Code: ${a}`)),console.log();try{await yt(m)}catch{}let Q=await Et({pollUrl:me,endpoint:t});await ve(Q),console.log($("\u2714")+" API key saved to "+c("~/.anyforge/credentials"));let j=await ke();if(j.isSubscription&&!e.force){await Rt(j,t,Q.apiKey);return}let nt=process.cwd(),ye=Se(nt),he=await vt(ye),we=await Te({endpoint:t,apiKey:Q.apiKey,scope:he,repoRoot:ye});we.length===0?(console.log(I("No agent configs were patched.")),console.log(c("  Set ANTHROPIC_BASE_URL="+t+"/v1/anthropic and")),console.log(c("  ANTHROPIC_AUTH_TOKEN=<your AnyForge key> manually if needed."))):At(we),console.log(),j.isSubscription&&e.force&&(console.log(I(`  \u26A0 --force: your Claude ${j.plan??""} subscription login is now shadowed`)),console.log(I("    by the AnyForge token \u2014 Claude Code will use the BYOK proxy, which")),console.log(I("    needs an Anthropic API key on your company. Run ")+E("anyforge logout")),console.log(I("    to revert and restore your subscription."))),he==="repo"&&(console.log(c("  Re-run this command in another repo to patch it too,")),console.log(c('  or run from any directory and choose "global" to install system-wide.'))),console.log(E("Done.")+" Visit "+M(`${t}/usage`)+" to see your traffic.")}async function Et(e){let t=Date.now();process.stdout.write("Waiting for browser authorisation\u2026 ");let o=0;for(;Date.now()-t<wt;){await new Promise(i=>setTimeout(i,ht)),process.stdout.write("."),o+=1,o>40&&(process.stdout.write(`
+`),o=0);let r=await(await fetch(e.pollUrl)).json();if(r.status==="authorized"&&r.data)return process.stdout.write(" "+$("done")+`
+`),{apiKey:r.data.apiKey,companyId:r.data.companyId,endpoint:e.endpoint,savedAt:new Date().toISOString()};if(r.status==="expired"||r.status==="not_found")throw process.stdout.write(`
+`),new Error(`Authorisation ${r.status}. Re-run \`anyforge init\`.`)}throw new Error("Authorisation timed out (15 min). Re-run `anyforge init`.")}async function Rt(e,t,o){let n=e.email?` (${e.email})`:"";console.log(),console.log(I(`  \u26A0 Claude ${e.plan??""} subscription login detected${n}.`)),console.log(),console.log("  AnyForge Control\u2019s inference proxy is "+E("BYOK-only")+" \u2014 it routes"),console.log("  Claude Code through your own Anthropic API key for metering and"),console.log("  governance. Pointing Claude Code at the proxy would "+E("override and")),console.log("  "+E("disable your subscription login")+", so we did NOT patch your config."),console.log(),console.log("  Instead, use your subscription for inference and add the "+E("AnyForge")),console.log("  "+E("MCP server")+" for control (HIL approvals, work items, crews):"),console.log();let r=`claude mcp add anyforge --env ANYFORGE_API_KEY=${o} -- npx -y @anyforge/mcp-server`;if((await oe({type:"confirm",name:"go",message:"Add the AnyForge MCP server to Claude Code now?",initial:!0})).go)try{ne("claude",["mcp","add","anyforge","--env",`ANYFORGE_API_KEY=${o}`,"--","npx","-y","@anyforge/mcp-server"],{stdio:"inherit"}),console.log($("  \u2714")+" AnyForge MCP server added to Claude Code.")}catch{console.log(I("  Could not run `claude mcp add` automatically (is the `claude` CLI on PATH?).")),console.log(c("  Add it manually:")),console.log("    "+r)}else console.log(c("  Add it later with:")),console.log("    "+r);if(console.log(),(await oe({type:"confirm",name:"go",message:"Send Claude Code usage to your AnyForge dashboard? (token counts only \u2014 no prompt content)",initial:!0})).go){let a=await xe({endpoint:t,apiKey:o});a&&(console.log($("  \u2714")+" Usage telemetry enabled \u2014 view it at "+M(`${t}/usage`)),console.log(c("    (written to "+a.path+"; `anyforge logout` removes it)")))}else console.log(c("  Skipped \u2014 your subscription usage stays local to Claude Code."));console.log(),console.log(c("  Want the metered BYOK proxy instead? Re-run with ")+E("--force")+c(" using an")),console.log(c("  Anthropic API key on your company (this disables your subscription in")),console.log(c("  Claude Code; ")+E("anyforge logout")+c(" reverts it).")),console.log(),console.log(E("Done.")+" Visit "+M(`${t}/usage`)+" to see your traffic.")}function Se(e){try{return ne("git",["rev-parse","--show-toplevel"],{cwd:e,encoding:"utf8",stdio:["pipe","pipe","pipe"]}).trim()}catch{return null}}async function vt(e){return e?(await oe({type:"select",name:"scope",message:"Where should AnyForge patch Claude Code?",choices:[{title:`This repo only (${e}/.claude/settings.local.json + .env)`,value:"repo"},{title:"Globally (~/.claude/settings.json)",value:"global"}],initial:0})).scope??"repo":(console.log(c("  Not a git repo root \u2014 installing globally.")),console.log(c("  Run this from a repo root if you want a per-repo install instead.")),"global")}function At(e){console.log($("\u2714")+" Patched "+e.length+" agent config"+(e.length===1?"":"s")+":");for(let t of e)console.log(`  ${c("\u2022")} ${t.label} ${c("("+t.path+")")}`)}function Ct(e){try{let t=ne("git",["remote","get-url","origin"],{cwd:e,encoding:"utf8",stdio:["pipe","pipe","pipe"]}).trim(),o=t.match(/^git@[\w.-]+:([\w.-]+\/[\w.-]+?)(?:\.git)?$/);if(o)return o[1];let n=t.match(/^https?:\/\/[\w.-]+\/([\w.-]+\/[\w.-]+?)(?:\.git)?$/);return n?n[1]:null}catch{return null}}import{dim as ae,yellow as Tt,bold as xt}from"kleur/colors";var O={OK:0,FAILURE:1,USAGE:2,NO_CREDENTIALS:3,API_ERROR:4},v=class extends Error{exitCode;hint;constructor(t,o=O.FAILURE,n){super(t),this.name="CliError",this.exitCode=o,this.hint=n}},d=class extends v{constructor(t,o){super(t,O.USAGE,o),this.name="UsageError"}},G=class extends v{constructor(){super("Not authenticated \u2014 no ANYFORGE_API_TOKEN and no saved credential.",O.NO_CREDENTIALS,"Run `npx @anyforge/control init`, or set ANYFORGE_API_TOKEN for unattended use."),this.name="NotAuthenticatedError"}},W=class extends v{code;status;constructor(t,o,n){super(n?`${t}: ${n}`:t,O.API_ERROR,Ot(t,o)),this.name="ControlApiError",this.code=t,this.status=o}};function Ot(e,t){if(e==="missing_api_key"||e==="invalid_api_key"||e==="invalid_token"||t===401)return"The key was rejected. Re-run `npx @anyforge/control init`.";if(e==="insufficient_scope"||t===403)return"This key lacks the scope for that command. Run `anyforge whoami` to see its scopes.";if(t===404)return"No such id in this company. Check it with the matching list command.";if(t===429)return"Rate limited. Retry after a short pause."}var Ne="https://crew.anyforge.ai";async function Y(e){let t=process.env.ANYFORGE_API_TOKEN,o=e||process.env.ANYFORGE_API_URL;if(t)return{apiKey:t,endpoint:o||Ne};let n=await b();if(n?.apiKey)return{apiKey:n.apiKey,endpoint:o||n.endpoint||Ne};throw new G}async function u(e,t,o,n){let r=`${e.endpoint.replace(/\/$/,"")}/api/v1/control${o}`,i;try{i=await fetch(r,{method:t,headers:{"Content-Type":"application/json",Authorization:`Bearer ${e.apiKey}`},...n!==void 0?{body:JSON.stringify(n)}:{}})}catch(a){throw new v(`Cannot reach ${e.endpoint}: ${a instanceof Error?a.message:String(a)}`,O.FAILURE,"Check your network, or pass --endpoint if this workspace is self-hosted.")}let s;try{s=await i.json()}catch{throw new v(`Non-JSON response from ${r} (HTTP ${i.status}).`,O.FAILURE)}if(!i.ok||s.ok===!1){let a=typeof s.error=="string"?s.error:`http_${i.status}`,m=typeof s.message=="string"?s.message:typeof s.detail=="string"?s.detail:void 0;throw new W(a,i.status,m)}return s.data}function _(e){let t=Object.entries(e).filter(([,o])=>o!==void 0&&o!=="").map(([o,n])=>`${encodeURIComponent(o)}=${encodeURIComponent(String(n))}`);return t.length?`?${t.join("&")}`:""}async function re(e){return u(e,"GET","/me")}function ie(e,t,o,n){let r=e?.entityLabels?.[t]?.[o];return typeof r=="string"&&r.trim()?r:n}async function Le(e){try{return await re(e)}catch{return null}}function Fe(e){return[...e].length}function se(e,t){if(t<=0)return"";let o=[...e];return o.length<=t?e:t===1?"\u2026":`${o.slice(0,t-1).join("")}\u2026`}function x(e,t){if(e.length===0)return"";let o=e.map(i=>t.map(s=>{let a=s.value(i)??"";return s.max?se(a,s.max):a})),n=t.map((i,s)=>Math.max(Fe(i.header),...o.map(a=>Fe(a[s])))),r=i=>i.map((s,a)=>a===i.length-1?s:s.padEnd(n[a]+2)).join("").replace(/\s+$/,"");return[r(t.map(i=>i.header)),...o.map(r)].join(`
+`)}function p(e){return JSON.stringify(e,null,2)}function H(e,t=Date.now()){let o=Pt(e);if(o===null)return"\u2014";let n=Math.max(0,Math.floor((t-o)/1e3));if(n<60)return`${n}s`;let r=Math.floor(n/60);if(r<60)return`${r}m`;let i=Math.floor(r/60);return i<48?`${i}h`:`${Math.floor(i/24)}d`}function Pt(e){if(typeof e=="number")return Number.isFinite(e)?e:null;if(typeof e=="string"){let t=Date.parse(e);return Number.isNaN(t)?null:t}return null}function g(e,t,o="\u2014"){let n=e[t];return typeof n=="string"&&n.trim()?n:typeof n=="number"&&Number.isFinite(n)?String(n):o}function y(e,t,o="\u2014"){for(let n of t){let r=e[n];if(typeof r=="string"&&r.trim())return r}return o}function A(e){let t=Array.isArray(e)?e:e&&typeof e=="object"?bt(e):null;return t?t.filter(o=>!!o&&typeof o=="object"&&!Array.isArray(o)):[]}function bt(e){for(let t of["items","results","rows","data"])if(Array.isArray(e[t]))return e[t];return null}async function je(e){let t=await Y(e.endpoint),o=await re(t);if(e.json){console.log(p(o));return}console.log(`Company:  ${xt(o.companyName??o.companyId)}${o.companyName?ae(` (${o.companyId})`):""}`),console.log(`Endpoint: ${t.endpoint}`),console.log(`Scopes:   ${o.scopes.length?o.scopes.join(", "):Tt("none")}`),o.userId&&console.log(`User:     ${o.userId}`);let n=await b();console.log(n?ae(`Key tail: \u2026${n.apiKey.slice(-4)}  \xB7  saved ${new Date(n.savedAt).toLocaleString()}`):ae("Key from: ANYFORGE_API_TOKEN (no saved credential file)"))}import{green as Ue,dim as B,yellow as kt}from"kleur/colors";async function De(){let e=await b(),t=await Ae(),{reverted:o}=await Ie({endpoint:e?.endpoint??null});if(console.log(t?Ue("\u2714")+" Local credentials cleared.":kt("No credentials were saved on this machine.")),o.length){console.log(Ue("\u2714")+" Reverted patched configs:");for(let n of o)console.log(`  ${B("\u2022")} ${n}`);console.log(B("  Your previous Claude Code login (if any) is restored."))}else console.log(B("  No AnyForge config patches found to revert."));console.log(B("  Revoke the key server-side at /settings \u2192 API keys."))}import{green as It,red as J,yellow as _t,dim as X}from"kleur/colors";async function Ke(e){let t=await b();if(!t){console.log(_t("Not logged in.")+" Run "+X("npx @anyforge/control init")+" first.");return}let o=e.endpoint||t.endpoint;console.log(`Endpoint:  ${o}`),console.log(`Company:   ${t.companyId}`);let n={model:"claude-3-5-haiku-20241022",max_tokens:1,messages:[{role:"user",content:"Hi"}]},r;try{r=await fetch(`${o}/v1/anthropic/v1/messages`,{method:"POST",headers:{"Content-Type":"application/json","anthropic-version":"2023-06-01",Authorization:`Bearer ${t.apiKey}`},body:JSON.stringify(n)})}catch(i){console.log(J("\u2717 Proxy unreachable: ")+i.message),process.exit(1)}r.status===401&&(console.log(J("\u2717 API key rejected.")+" Re-run "+X("npx @anyforge/control init")+"."),process.exit(1)),r.status===502&&(console.log(J("\u2717 No BYOK Anthropic key configured for your company.")),console.log(X("  Add one at ")+o+X("/settings \u2192 API keys.")),process.exit(1)),r.ok||(console.log(J(`\u2717 Proxy returned ${r.status}: `)+(await r.text()).slice(0,200)),process.exit(1)),console.log(It("\u2714 Proxy reachable, key valid, BYOK configured."))}import{spawn as St}from"node:child_process";import{readFile as $t}from"node:fs/promises";import{red as N,green as le,yellow as Nt,dim as L,bold as Me}from"kleur/colors";async function Ge(e){let t=await Lt(e.patchFile);t.trim()||(process.stderr.write(N(`Empty patch \u2014 nothing to apply.
+`)),process.exit(1));let o=Ft(t);process.stderr.write(L(`Patch: ${o.files} ${o.files===1?"file":"files"}, `)+le(`+${o.added}`)+" "+N(`-${o.removed}`)+`
+`);let n=await ce(["apply","--check"],t);if(n.code!==0){if(e.threeWay){let i=await ce(["apply","--3way"],t);i.code!==0&&(process.stderr.write(N(`3-way apply failed:
+`)+i.stderr+`
+`),process.exit(1)),process.stderr.write(Nt(`\u2713 Applied via 3-way merge \u2014 review conflicts before committing.
+`));return}process.stderr.write(N(`Patch does not apply cleanly:
+`)+n.stderr+`
+`),process.stderr.write(L("Try ")+Me("--3way")+L(` to attempt a 3-way merge against the index.
+`)),process.exit(1)}if(e.dryRun){process.stderr.write(le(`\u2713 Patch would apply cleanly.
+`));return}let r=await ce(["apply"],t);r.code!==0&&(process.stderr.write(N(`git apply failed:
+`)+r.stderr+`
+`),process.exit(1)),process.stderr.write(le(`\u2713 Applied.
+`)),o.files>0&&process.stderr.write(L("  Run ")+Me("git diff --stat")+L(` to review.
+`))}async function Lt(e){if(e)return await $t(e,"utf8");let t=[];for await(let o of process.stdin)t.push(o);return Buffer.concat(t).toString("utf8")}function ce(e,t){return new Promise((o,n)=>{let r=St("git",e,{stdio:["pipe","pipe","pipe"]}),i="",s="";r.stdout.on("data",a=>{i+=a.toString()}),r.stderr.on("data",a=>{s+=a.toString()}),r.on("error",n),r.on("close",a=>o({code:a??0,stdout:i,stderr:s})),r.stdin.write(t),r.stdin.end()})}function Ft(e){let t=0,o=0,n=0;for(let r of e.split(`
+`))if(r.startsWith("diff --git"))t+=1;else{if(r.startsWith("+++")||r.startsWith("---"))continue;r.startsWith("+")?o+=1:r.startsWith("-")&&(n+=1)}return t===0&&(o>0||n>0)&&(t=(e.match(/^\+\+\+ /gm)??[]).length),{files:t,added:o,removed:n}}import{bold as jt,dim as de,green as Ut,red as Dt}from"kleur/colors";async function We(e){let t=await u(e.creds,"GET",`/hil${_({limit:e.limit})}`);if(e.json){console.log(p(t));return}let o=A(t);if(o.length===0){console.log(de("No approvals pending."));return}console.log(x(o,[{header:"ID",value:n=>g(n,"id")},{header:"CREW",value:n=>g(n,"crewId"),max:24},{header:"AGE",value:n=>H(n.requestedAt)},{header:"SUMMARY",value:n=>y(n,["planSummary","summary","title","description"]),max:60}])),console.log(de(`
+${o.length} pending \xB7 approve with `)+jt("anyforge approve <id>"))}async function ue(e){if(!e.approvalId)throw new d(`${e.decision==="APPROVED"?"approve":"reject"} requires an approval id.`,"List them with `anyforge approvals`.");let t=await u(e.creds,"POST",`/hil/${encodeURIComponent(e.approvalId)}`,{decision:e.decision,...e.notes?{notes:e.notes}:{}});if(e.json){console.log(p(t));return}let o=e.decision==="APPROVED"?Ut("Approved"):Dt("Rejected");console.log(`${o} ${e.approvalId}`);let n=t&&typeof t=="object"?t.signature:void 0;typeof n=="string"&&n&&console.log(de(`Audit signature: ${n}`))}import{bold as Kt,dim as pe}from"kleur/colors";async function Ye(e){let t=await u(e.creds,"GET",`/crews${_({status:e.status,activeOnly:e.activeOnly,limit:e.limit})}`);if(e.json){console.log(p(t));return}let o=A(t);if(o.length===0){console.log(pe(e.activeOnly?"No active crews.":"No crews."));return}console.log(x(o,[{header:"ID",value:n=>g(n,"id")},{header:"STATUS",value:n=>g(n,"status")},{header:"AGE",value:n=>H(n.createdAt??n.startedAt)},{header:"NAME",value:n=>y(n,["name","title","taskTitle","workItemTitle"]),max:52}]))}async function He(e){if(!e.crewId)throw new d("crew requires a crew id.","List them with `anyforge crews`.");let t=await u(e.creds,"GET",`/crews/${encodeURIComponent(e.crewId)}${_({messages:e.messages})}`);if(e.json){console.log(p(t));return}let o=t?.crew&&typeof t.crew=="object"?t.crew:t;console.log(`${Kt(y(o,["name","title","taskTitle"],g(o,"id")))}`),console.log(`Status:  ${g(o,"status")}`),console.log(`Repo:    ${y(o,["targetGithubRepo","repoFullName","repo"])}`);let n=g(o,"url","");n&&console.log(`Console: ${n}`);let r=A(t?.messages);if(r.length>0){console.log(pe(`
+Last ${r.length} messages:`));for(let i of r){let s=y(i,["role","author","agent","kind"],"?"),a=y(i,["content","body","text","message"],"");console.log(`${pe(`[${s}]`)} ${se(a.replace(/\s+/g," "),160)}`)}}}async function fe(e){if(!e.crewId)throw new d(`${e.action} requires a crew id.`,"List them with `anyforge crews`.");let t=await u(e.creds,"POST",`/crews/${encodeURIComponent(e.crewId)}/${e.action}`);if(e.json){console.log(p(t));return}console.log(`${e.action==="halt"?"Halted":"Resumed"} ${e.crewId}`)}import{dim as q}from"kleur/colors";var Je=100;function Be(e){let t=e&&typeof e=="object"?e:{};return{total:typeof t.total=="number"?t.total:null,hasMore:t.hasMore===!0,cursor:typeof t.nextCursor=="string"?t.nextCursor:null}}async function Mt(e){let t=s=>`/work${_({status:e.status,type:e.type,priority:e.priority,initiative:e.initiative,program:e.program,search:e.search,assignee:e.assignee,includeArchived:e.includeArchived,limit:e.limit,cursor:s})}`,o=await u(e.creds,"GET",t()),n=A(o),r=Be(o),i=1;if(!e.all)return{rows:n,total:r.total,hasMore:r.hasMore,raw:o,pagesFetched:i};for(;r.hasMore&&r.cursor&&i<Je;){let s=await u(e.creds,"GET",t(r.cursor));n.push(...A(s)),r=Be(s),i+=1}return{rows:n,total:r.total,hasMore:r.hasMore,raw:o,pagesFetched:i}}async function Xe(e){let t=await Mt(e);if(e.json){console.log(p(e.all?{items:t.rows,total:t.total,hasMore:t.hasMore,nextCursor:null}:t.raw));return}let o=t.rows,n=await Le(e.creds),r=ie(n,"work_item","plural","Work items");if(o.length===0){console.log(q(`No ${r.toLowerCase()} match that filter.`));return}console.log(x(o,[{header:"ID",value:m=>g(m,"id")},{header:"PRI",value:m=>g(m,"priority","")},{header:"TYPE",value:m=>g(m,"type","")},{header:"STATUS",value:m=>g(m,"status")},{header:"TITLE",value:m=>y(m,["title","name","summary"]),max:58}]));let i=(o.length===1?ie(n,"work_item","singular","work item"):r).toLowerCase(),s=t.total!==null&&t.total!==o.length?`${o.length} of ${t.total} ${r.toLowerCase()}`:`${o.length} ${i}`,a=t.hasMore?e.all?q(` \u2014 stopped after ${Je} pages; narrow the filter`):q(" \u2014 pass --all for the rest"):"";console.log(`${q(`
+${s}`)}${a}`)}import{bold as Gt,dim as V}from"kleur/colors";async function qe(e){let t=await u(e.creds,"GET","/workflows");if(e.json){console.log(p(t));return}let o=A(t);if(o.length===0){console.log(V("No workflows defined."));return}console.log(x(o,[{header:"ID",value:n=>g(n,"id")},{header:"STATUS",value:n=>y(n,["status","state"],"")},{header:"NAME",value:n=>y(n,["name","title"]),max:58}])),console.log(V(`
+Dispatch with `)+Gt("anyforge run <id>"))}async function Ve(e){if(!e.workflowId)throw new d("run requires a workflow id.","List them with `anyforge workflows`.");let t;if(e.input!==void 0){try{t=JSON.parse(e.input)}catch(r){throw new d(`--input is not valid JSON: ${r instanceof Error?r.message:String(r)}`,`Example: --input '{"repo":"acme/web"}'`)}if(!t||typeof t!="object"||Array.isArray(t))throw new d("--input must be a JSON object.",`Example: --input '{"repo":"acme/web"}'`)}let o=await u(e.creds,"POST",`/workflows/${encodeURIComponent(e.workflowId)}/run`,t===void 0?void 0:{inputs:t});if(e.json){console.log(p(o));return}let n=y(o??{},["id","runId"],"");console.log(`Queued run ${n||V("(id not returned)")}`),console.log(V("Runs pause at gate steps for an operator decision."))}import{dim as Wt}from"kleur/colors";async function ze(e){let t=e.question?.trim();if(!t)throw new d("ask requires a question.",'Example: anyforge ask "which initiatives slipped this cycle?"');!e.json&&process.stderr.isTTY&&process.stderr.write(Wt(`Asking the Oracle (this can take a few minutes)\u2026
+`));let o=await u(e.creds,"POST","/oracle",{question:t,...e.context?{context:e.context}:{}});if(e.json){console.log(p(o));return}let n=o&&typeof o=="object"?["answer","text","content","response"].map(r=>o[r]).find(r=>typeof r=="string"&&r.trim()):void 0;console.log(typeof n=="string"?n:p(o))}var ot="https://crew.anyforge.ai",Jt=new Set(["endpoint","limit","status","type","priority","initiative","program","search","assignee","notes","input","context","messages"]),Xt=new Set(["help","version","json","active","archived","3way","dry-run","force"]);function qt(e){let t={positional:[],flags:{}};for(let o=0;o<e.length;o+=1){let n=e[o];if(!n.startsWith("-")){t.command?t.positional.push(n):t.command=n;continue}let r=n==="-h"?"help":n==="-V"?"version":n==="-f"?"force":n.replace(/^--?/,""),[i,s]=r.includes("=")?[r.slice(0,r.indexOf("=")),r.slice(r.indexOf("=")+1)]:[r,void 0];if(Jt.has(i)){let a=s??e[++o];if(a===void 0)throw new d(`--${i} needs a value.`);t.flags[i]=a;continue}if(Xt.has(i)){t.flags[i]=s===void 0?!0:s!=="false";continue}throw new d(`Unknown option: ${n}`,"Run `anyforge --help` for the command list.")}return t}function z(e,t){if(e===void 0||typeof e=="boolean")return;let o=Number(e);if(!Number.isFinite(o)||o<=0)throw new d(`--${t} must be a positive number, got "${e}".`);return o}function h(e){return typeof e=="string"?e:void 0}function ge(e){return e===!0?!0:void 0}function Vt(){console.log(`
+${P("AnyForge Control")} \u2014 governed LLM proxy, and a scriptable AnyForge client.
+
+${P("USAGE")}
   npx @anyforge/control <command> [options]
 
-${bold('COMMANDS')}
-  init           Authorise this device and patch local agent configs
-  whoami         Show the company tied to the saved API key
-  status         Check connectivity to the AnyForge proxy
-  logout         Clear the saved API key and patched configs
-  apply-patch    Apply a unified diff (file path or stdin) via git apply
+${P("SETUP")}
+  init                 Authorise this device and patch local agent configs
+  whoami               Show the company, scopes and endpoint this key acts as
+  status               Check connectivity to the AnyForge proxy
+  logout               Clear the saved API key and revert patched configs
+  apply-patch [file]   Apply a unified diff (file or stdin) via git apply
+
+${P("APPROVALS")}  ${F("(the gate that blocks a human)")}
+  approvals            List HIL approvals awaiting a decision
+  approve <id>         Approve one, optionally with --notes
+  reject <id>          Reject one, optionally with --notes
+
+${P("CREWS")}
+  crews                List crews (--active for running/paused only)
+  crew <id>            Show one crew, its status and recent output
+  halt <id>            Stop a crew
+  resume <id>          Resume a paused or halted crew
+
+${P("WORK & WORKFLOWS")}
+  work                 List work items (--status, --type, --priority, --search).
+                       Paged: one page by default, --all walks every page
+  workflows            List operator workflows
+  run <id>             Dispatch a workflow run, with optional --input JSON
+  ask <question>       Ask the Oracle one question
+
+${P("OPTIONS")}
+  --json               Print the raw API payload instead of a table
+  --endpoint <url>     Override the base URL (default: ${F(ot)})
+  --limit <n>          Page size on list commands (work: 1-200, default 50)
+  --all                work: follow the cursor until the backlog is exhausted
+  --notes <text>       approve/reject: reviewer notes, recorded in the audit trail
+  --input <json>       run: workflow inputs, e.g. '{"repo":"acme/web"}'
+  --context <text>     ask: background for the Oracle
+  --help, -h           Show this message
+  --version, -V        Print CLI version
 
-${bold('OPTIONS')}
-  --endpoint <url>   Override the proxy base URL (default: ${dim('https://crew.anyforge.ai')})
-  --force, -f        init: patch the BYOK proxy even if a Claude subscription
-                     login is present (this disables that subscription in Claude Code)
-  --3way             apply-patch: try 3-way merge if the patch doesn't apply cleanly
-  --dry-run          apply-patch: only check applicability, don't write
-  --help, -h         Show this message
-  --version, -V      Print CLI version
+${P("EXIT CODES")}
+  0 ok   1 failure   2 usage   3 not authenticated   4 API error
 
-${bold('EXAMPLES')}
-  npx @anyforge/control init
-  npx @anyforge/control status
-  npx @anyforge/control apply-patch ./agent-suggestion.diff
-  pbpaste | npx @anyforge/control apply-patch
-  npx @anyforge/control apply-patch ./conflict.diff --3way
-`);
-}
-async function main() {
-    const args = parseArgs(process.argv.slice(2));
-    if (args.version) {
-        const pkg = await import('../package.json', { assert: { type: 'json' } });
-        // eslint-disable-next-line no-console
-        console.log(pkg.default.version);
-        return;
-    }
-    if (args.help || !args.command) {
-        printHelp();
-        return;
-    }
-    // The proxy lives at ${endpoint} — same host as Code Studio, Crew,
-    // and the operator console. Override via --endpoint or
-    // ANYFORGE_ENDPOINT for staging.
-    const endpoint = args.endpoint
-        ?? process.env.ANYFORGE_ENDPOINT
-        ?? 'https://crew.anyforge.ai';
-    try {
-        switch (args.command) {
-            case 'init':
-                await runInit({ endpoint, force: args.force });
-                break;
-            case 'whoami':
-                await runWhoami();
-                break;
-            case 'status':
-                await runStatus({ endpoint });
-                break;
-            case 'logout':
-                await runLogout();
-                break;
-            case 'apply-patch':
-                await runApplyPatch({
-                    patchFile: args.positional[0],
-                    threeWay: args.threeWay,
-                    dryRun: args.dryRun,
-                });
-                break;
-            case 'proxy':
-                // eslint-disable-next-line no-console
-                console.log(yellow('Local proxy mode is coming in a future release.'));
-                // eslint-disable-next-line no-console
-                console.log(dim('  Until then, your agents talk directly to the AnyForge proxy.'));
-                break;
-            default:
-                // eslint-disable-next-line no-console
-                console.error(red(`Unknown command: ${args.command}`));
-                printHelp();
-                process.exit(1);
-        }
-    }
-    catch (err) {
-        // eslint-disable-next-line no-console
-        console.error(red('Error: ') + (err instanceof Error ? err.message : String(err)));
-        process.exit(1);
-    }
-}
-void main();
+${P("EXAMPLES")}
+  anyforge approvals
+  anyforge approve hil_123 --notes "ship it"
+  anyforge crews --active --json | jq -r '.[].id'
+  anyforge work --status IN_PROGRESS --priority P0
+  anyforge work --program prog_123 --all --json | jq -r '.items[].id'
+  anyforge run wf_nightly --input '{"repo":"acme/web"}'
+  anyforge ask "which initiatives slipped this cycle?"
+`)}async function zt(e,t,o,n){let r=t.flags.json===!0,[i]=t.positional;switch(e){case"init":return $e({endpoint:o,force:t.flags.force===!0});case"logout":return De();case"status":return Ke({endpoint:o});case"whoami":return je({endpoint:n,json:r});case"apply-patch":return Ge({patchFile:i,threeWay:t.flags["3way"]===!0,dryRun:t.flags["dry-run"]===!0});case"proxy":console.log(Bt("Local proxy mode is coming in a future release.")),console.log(F("  Until then, your agents talk directly to the AnyForge proxy."));return}let s=await Y(n);switch(e){case"approvals":return We({creds:s,json:r,limit:z(t.flags.limit,"limit")});case"approve":return ue({creds:s,json:r,approvalId:i,decision:"APPROVED",notes:h(t.flags.notes)});case"reject":return ue({creds:s,json:r,approvalId:i,decision:"REJECTED",notes:h(t.flags.notes)});case"crews":return Ye({creds:s,json:r,status:h(t.flags.status),activeOnly:ge(t.flags.active),limit:z(t.flags.limit,"limit")});case"crew":return He({creds:s,json:r,crewId:i,messages:z(t.flags.messages,"messages")});case"halt":return fe({creds:s,json:r,crewId:i,action:"halt"});case"resume":return fe({creds:s,json:r,crewId:i,action:"resume"});case"work":return Xe({creds:s,json:r,status:h(t.flags.status),type:h(t.flags.type),priority:h(t.flags.priority),initiative:h(t.flags.initiative),program:h(t.flags.program),search:h(t.flags.search),assignee:h(t.flags.assignee),includeArchived:ge(t.flags.archived),limit:z(t.flags.limit,"limit"),all:ge(t.flags.all)});case"workflows":return qe({creds:s,json:r});case"run":return Ve({creds:s,json:r,workflowId:i,input:h(t.flags.input)});case"ask":return ze({creds:s,json:r,question:t.positional.join(" "),context:h(t.flags.context)});default:throw new d(`Unknown command: ${e}`,"Run `anyforge --help` for the command list.")}}async function Qt(){let e;try{e=qt(process.argv.slice(2))}catch(n){tt(n);return}if(e.flags.version===!0){let n=await Promise.resolve().then(()=>(Ze(),Qe));console.log(n.default.version);return}if(e.flags.help===!0||!e.command){Vt();return}let t=h(e.flags.endpoint)??process.env.ANYFORGE_ENDPOINT,o=t??ot;try{await zt(e.command,e,o,t)}catch(n){tt(n)}}function tt(e){e instanceof v&&(process.stderr.write(et("Error: ")+e.message+`
+`),e.hint?process.stderr.write(F(e.hint)+`
+`):e instanceof d&&process.stderr.write(F("Run `anyforge --help`.")+`
+`),process.exit(e.exitCode)),process.stderr.write(et("Error: ")+(e instanceof Error?e.message:String(e))+`
+`),process.exit(O.FAILURE)}Qt();

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@anyforge/control",
-  "version": "0.2.4",
-  "description": "AnyForge Control CLI — governed LLM proxy for Claude Code, Cursor, Cline, and any agent that talks to OpenAI- or Anthropic-shape APIs.",
+  "version": "0.3.0",
+  "description": "AnyForge Control CLI \u2014 governed LLM proxy for any agent, and a scriptable client for AnyForge approvals, crews, work items and workflows.",
   "license": "Apache-2.0",
   "homepage": "https://anyforge.ai",
   "repository": {
@@ -23,14 +23,15 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsc && chmod +x dist/cli.js",
+    "build": "esbuild src/cli.ts --bundle --minify --platform=node --format=esm --outfile=dist/cli.js --packages=external && chmod +x dist/cli.js",
+    "type-check": "tsc --noEmit",
     "dev": "tsx src/cli.ts",
     "prepublishOnly": "npm run build",
     "publish:beta": "npm publish --access public --tag beta",
     "publish:stable": "npm publish --access public"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "dependencies": {
     "kleur": "^4.1.5",
@@ -38,9 +39,10 @@
     "prompts": "^2.4.2"
   },
   "devDependencies": {
-    "@types/node": "^20.11.0",
+    "@types/node": "^22.20.0",
     "@types/prompts": "^2.4.9",
+    "esbuild": "^0.25.0",
     "tsx": "^4.7.0",
-    "typescript": "^5.5.3"
+    "typescript": "^7.0.2"
   }
 }

package/dist/commands/applyPatch.js

@@ -1,92 +0,0 @@
-import { spawn } from 'node:child_process';
-import { readFile } from 'node:fs/promises';
-import { red, green, yellow, dim, bold } from 'kleur/colors';
-export async function runApplyPatch(opts) {
-    const patchContent = await loadPatch(opts.patchFile);
-    if (!patchContent.trim()) {
-        process.stderr.write(red('Empty patch — nothing to apply.\n'));
-        process.exit(1);
-    }
-    const stats = parseDiffStats(patchContent);
-    process.stderr.write(dim(`Patch: ${stats.files} ${stats.files === 1 ? 'file' : 'files'}, `) +
-        green(`+${stats.added}`) + ' ' + red(`-${stats.removed}`) + '\n');
-    // git apply --check first — never make a partial mess
-    const check = await runGit(['apply', '--check'], patchContent);
-    if (check.code !== 0) {
-        if (opts.threeWay) {
-            const three = await runGit(['apply', '--3way'], patchContent);
-            if (three.code !== 0) {
-                process.stderr.write(red('3-way apply failed:\n') + three.stderr + '\n');
-                process.exit(1);
-            }
-            process.stderr.write(yellow('✓ Applied via 3-way merge — review conflicts before committing.\n'));
-            return;
-        }
-        process.stderr.write(red('Patch does not apply cleanly:\n') + check.stderr + '\n');
-        process.stderr.write(dim('Try ') + bold('--3way') + dim(' to attempt a 3-way merge against the index.\n'));
-        process.exit(1);
-    }
-    if (opts.dryRun) {
-        process.stderr.write(green('✓ Patch would apply cleanly.\n'));
-        return;
-    }
-    const apply = await runGit(['apply'], patchContent);
-    if (apply.code !== 0) {
-        process.stderr.write(red('git apply failed:\n') + apply.stderr + '\n');
-        process.exit(1);
-    }
-    process.stderr.write(green('✓ Applied.\n'));
-    if (stats.files > 0) {
-        process.stderr.write(dim('  Run ') + bold('git diff --stat') + dim(' to review.\n'));
-    }
-}
-async function loadPatch(filePath) {
-    if (filePath) {
-        return await readFile(filePath, 'utf8');
-    }
-    // Read stdin to a single string
-    const chunks = [];
-    for await (const chunk of process.stdin) {
-        chunks.push(chunk);
-    }
-    return Buffer.concat(chunks).toString('utf8');
-}
-/** Spawn `git <args>`, pipe `stdinData` to its stdin, return code +
- *  captured streams. No shell — args are passed as a list to spawn. */
-function runGit(args, stdinData) {
-    return new Promise((resolve, reject) => {
-        const child = spawn('git', args, { stdio: ['pipe', 'pipe', 'pipe'] });
-        let stdout = '';
-        let stderr = '';
-        child.stdout.on('data', d => { stdout += d.toString(); });
-        child.stderr.on('data', d => { stderr += d.toString(); });
-        child.on('error', reject);
-        child.on('close', code => resolve({ code: code ?? 0, stdout, stderr }));
-        child.stdin.write(stdinData);
-        child.stdin.end();
-    });
-}
-/** Quick stats parse off a unified diff — counts file headers and
- *  +/- lines. Skips diff metadata lines (+++, ---) so the report
- *  matches `git apply --stat` shape close enough for an inline note. */
-function parseDiffStats(patch) {
-    let files = 0;
-    let added = 0;
-    let removed = 0;
-    for (const line of patch.split('\n')) {
-        if (line.startsWith('diff --git'))
-            files += 1;
-        else if (line.startsWith('+++') || line.startsWith('---'))
-            continue;
-        else if (line.startsWith('+'))
-            added += 1;
-        else if (line.startsWith('-'))
-            removed += 1;
-    }
-    if (files === 0 && (added > 0 || removed > 0)) {
-        // Patch had no `diff --git` headers (a hand-rolled fragment);
-        // count filename headers instead.
-        files = (patch.match(/^\+\+\+ /gm) ?? []).length;
-    }
-    return { files, added, removed };
-}