@arcadeai/hypotenuse 0.0.0-stage → 0.2.0

package/dist/hypotenuse.js

@@ -0,0 +1,1594 @@
+#!/usr/bin/env bun
+// @bun
+
+// src/output/early-env.ts
+function applyEarlyEnv(argv, env) {
+  const has = (flag) => argv.includes(flag);
+  const plain = has("--no-color") || has("--json") || has("-j");
+  if (plain) {
+    if (!env.NO_COLOR)
+      env.NO_COLOR = "1";
+    delete env.FORCE_COLOR;
+  }
+  if (has("--force-color") && !plain) {
+    env.FORCE_COLOR = "1";
+    delete env.NO_COLOR;
+  }
+  return env;
+}
+applyEarlyEnv(process.argv.slice(2), process.env);
+
+// src/output/logger.ts
+import { createSpinner } from "nanospinner";
+// ../design/tokens.json
+var tokens_default = {
+  $comment: "Generated by design/tokens.ts \u2014 do not edit. Change INPUTS there and run `bun run --cwd frontend theme:build`.",
+  light: {
+    "bg-app": "#f8f9fc",
+    "bg-panel": "#ffffff",
+    "bg-raised": "#ffffff",
+    "bg-sunken": "#eff1f3",
+    "bg-hover": "#eceef1",
+    "bg-selected": "#d7edec",
+    "border-subtle": "#e1e3e5",
+    "border-default": "#d0d2d4",
+    "border-strong": "#afb1b3",
+    "text-primary": "#27282a",
+    "text-secondary": "#545658",
+    "text-tertiary": "#707174",
+    "text-disabled": "#8f9194",
+    accent: "#007f7d",
+    "accent-hover": "#007271",
+    "accent-subtle": "#d8f4f2",
+    "text-on-accent": "#ffffff",
+    "focus-ring": "#009c9b",
+    "status-pending": "#707174",
+    "status-active": "#008ecc",
+    "status-waiting": "#ae7805",
+    "status-complete": "#38955a",
+    "status-error": "#dd5455",
+    "status-stale": "#8f9194",
+    "status-stopping": "#c16c35",
+    "runner-online": "#289655",
+    "runner-offline": "#8f9194",
+    "runner-draining": "#ae7805",
+    "role-manager": "#8f78c8",
+    "role-worker": "#009492",
+    "diff-add": "#208149",
+    "diff-remove": "#c94146"
+  },
+  dark: {
+    "bg-app": "#181a1c",
+    "bg-panel": "#1e2022",
+    "bg-raised": "#242628",
+    "bg-sunken": "#121316",
+    "bg-hover": "#292a2d",
+    "bg-selected": "#243635",
+    "border-subtle": "#313335",
+    "border-default": "#414245",
+    "border-strong": "#5f6164",
+    "text-primary": "#eceef1",
+    "text-secondary": "#a8aaad",
+    "text-tertiary": "#86888c",
+    "text-disabled": "#686a6d",
+    accent: "#39bebc",
+    "accent-hover": "#4ececb",
+    "accent-subtle": "#123635",
+    "text-on-accent": "#16181a",
+    "focus-ring": "#39bebc",
+    "status-pending": "#86888c",
+    "status-active": "#3fb6fd",
+    "status-waiting": "#da9f38",
+    "status-complete": "#62be80",
+    "status-error": "#ff8681",
+    "status-stale": "#686a6d",
+    "status-stopping": "#ee935a",
+    "runner-online": "#57bf7b",
+    "runner-offline": "#686a6d",
+    "runner-draining": "#da9f38",
+    "role-manager": "#b89ff3",
+    "role-worker": "#39bebc",
+    "diff-add": "#62be80",
+    "diff-remove": "#ff8681"
+  }
+};
+
+// src/output/tty.ts
+function isTruthyEnv(value) {
+  if (!value)
+    return false;
+  const lower = value.toLowerCase();
+  return lower !== "0" && lower !== "false";
+}
+function detectColorDepth(term) {
+  const { env } = term;
+  const argv = term.argv ?? [];
+  const flagPlain = argv.includes("--no-color") || argv.includes("--json") || argv.includes("-j");
+  if (flagPlain)
+    return "none";
+  const force = argv.includes("--force-color") || isTruthyEnv(env.FORCE_COLOR);
+  if (!force && (Boolean(env.NO_COLOR) || !term.isTTY))
+    return "none";
+  const colorterm = (env.COLORTERM ?? "").toLowerCase();
+  if (colorterm === "truecolor" || colorterm === "24bit")
+    return "truecolor";
+  return "256";
+}
+function detectUnicode(env) {
+  const locale = env.LC_ALL || env.LC_CTYPE || env.LANG;
+  if (!locale)
+    return true;
+  return /utf-?8/i.test(locale);
+}
+function detectLightBackground(env) {
+  const bg = env.COLORFGBG?.split(";").at(-1);
+  return bg === "7" || bg === "15";
+}
+function detectMode(term) {
+  const argv = term.argv ?? [];
+  const json = argv.includes("--json") || argv.includes("-j");
+  return {
+    interactive: term.isTTY && !json && !isTruthyEnv(term.env.CI),
+    depth: detectColorDepth(term),
+    json,
+    unicode: detectUnicode(term.env),
+    lightBackground: detectLightBackground(term.env)
+  };
+}
+var current = null;
+function getMode() {
+  current ??= detectMode({
+    env: process.env,
+    isTTY: Boolean(process.stdout.isTTY || process.stderr.isTTY),
+    argv: process.argv.slice(2)
+  });
+  return current;
+}
+function setMode(mode) {
+  current = mode;
+}
+
+// src/output/theme.ts
+var GLYPHS = {
+  pending: { unicode: "\u25CC", ascii: "o", token: "status-pending" },
+  active: { unicode: "\u25D4", ascii: "*", token: "status-active" },
+  awaitingInput: { unicode: "\u25C9", ascii: "?", token: "status-waiting" },
+  complete: { unicode: "\u2713", ascii: "v", token: "status-complete" },
+  error: { unicode: "\u2715", ascii: "x", token: "status-error" },
+  stale: { unicode: "\u25CC", ascii: "o", token: "status-stale", dim: true },
+  stopping: { unicode: "\u25D8", ascii: "#", token: "status-stopping" },
+  online: { unicode: "\u25CF", ascii: "+", token: "runner-online" },
+  offline: { unicode: "\u25CB", ascii: "-", token: "runner-offline" },
+  draining: { unicode: "\u25D0", ascii: "~", token: "runner-draining" }
+};
+var ESC = "\x1B[";
+var RESET = `${ESC}0m`;
+var ANSI = /\x1b\[[0-9;]*m/g;
+function rgb(hex) {
+  const n = Number.parseInt(hex.slice(1), 16);
+  return [n >> 16 & 255, n >> 8 & 255, n & 255];
+}
+function nearestXterm256(hex) {
+  const [r, g, b] = rgb(hex);
+  const steps = [0, 95, 135, 175, 215, 255];
+  const nearestStep = (v) => steps.reduce((best, s, i) => Math.abs(s - v) < Math.abs((steps[best] ?? 0) - v) ? i : best, 0);
+  const [ri, gi, bi] = [nearestStep(r), nearestStep(g), nearestStep(b)];
+  const cube = [
+    steps[ri] ?? 0,
+    steps[gi] ?? 0,
+    steps[bi] ?? 0
+  ];
+  const grayIndex = Math.max(0, Math.min(23, Math.round(((r + g + b) / 3 - 8) / 10)));
+  const gray = 8 + grayIndex * 10;
+  const dist = (c) => (c[0] - r) ** 2 + (c[1] - g) ** 2 + (c[2] - b) ** 2;
+  return dist(cube) <= dist([gray, gray, gray]) ? 16 + 36 * ri + 6 * gi + bi : 232 + grayIndex;
+}
+function visibleWidth(text) {
+  return [...text.replace(ANSI, "")].length;
+}
+function truncateMiddle(text, width, ellipsis = "\u2026") {
+  const chars = [...text];
+  if (chars.length <= width)
+    return text;
+  const mark = [...ellipsis].length;
+  if (width <= mark)
+    return chars.slice(0, width).join("");
+  const keep = width - mark;
+  const head = Math.ceil(keep / 2);
+  const tail = keep - head;
+  return chars.slice(0, head).join("") + ellipsis + (tail > 0 ? chars.slice(-tail).join("") : "");
+}
+function createTheme(mode) {
+  const palette = mode.lightBackground ? tokens_default.light : tokens_default.dark;
+  const color = (token, text) => {
+    if (mode.depth === "none")
+      return text;
+    const hex = palette[token];
+    if (!hex)
+      return text;
+    if (mode.depth === "truecolor") {
+      const [r, g, b] = rgb(hex);
+      return `${ESC}38;2;${r};${g};${b}m${text}${RESET}`;
+    }
+    return `${ESC}38;5;${nearestXterm256(hex)}m${text}${RESET}`;
+  };
+  const dim = (text) => mode.depth === "none" ? text : `${ESC}2m${text}${RESET}`;
+  const glyph = (name) => {
+    const g = GLYPHS[name];
+    const painted = color(g.token, mode.unicode ? g.unicode : g.ascii);
+    return g.dim ? dim(painted) : painted;
+  };
+  const table = (rows, columns) => {
+    const ellipsis = mode.unicode ? "\u2026" : "...";
+    const cells = rows.map((row) => columns.map((col) => {
+      const raw = row[col.key];
+      const text = raw === undefined || raw === null ? "" : String(raw);
+      return col.maxWidth ? truncateMiddle(text, col.maxWidth, ellipsis) : text;
+    }));
+    const headers = columns.map((col) => col.header ?? col.key.toUpperCase());
+    const align = columns.map((col, i) => {
+      if (col.align)
+        return col.align;
+      const numeric = rows.length > 0 && cells.every((r) => /^-?\d+(\.\d+)?%?$/.test(r[i] ?? ""));
+      return numeric ? "right" : "left";
+    });
+    const widths = columns.map((_, i) => Math.max(visibleWidth(headers[i] ?? ""), ...cells.map((r) => visibleWidth(r[i] ?? ""))));
+    const pad = (text, i) => {
+      const gap = " ".repeat((widths[i] ?? 0) - visibleWidth(text));
+      return align[i] === "right" ? gap + text : text + gap;
+    };
+    const line = (values, paint = (s) => s) => values.map((v, i) => paint(pad(v, i))).join("  ").trimEnd();
+    return [line(headers, dim), ...cells.map((r) => line(r))].join(`
+`);
+  };
+  const banner = (version) => {
+    const name = `hypotenuse ${dim(version)}`;
+    return mode.unicode ? `${color("accent", "\u25E2")} ${name}` : name;
+  };
+  return { color, dim, glyph, table, banner };
+}
+function color(token, text) {
+  return createTheme(getMode()).color(token, text);
+}
+function dim(text) {
+  return createTheme(getMode()).dim(text);
+}
+function glyph(name) {
+  return createTheme(getMode()).glyph(name);
+}
+function table(rows, columns) {
+  return createTheme(getMode()).table(rows, columns);
+}
+function banner(version) {
+  return createTheme(getMode()).banner(version);
+}
+
+// src/output/logger.ts
+var verbose = false;
+var activeSpinner = null;
+function quiet() {
+  return getMode().json || !(process.stderr.isTTY ?? false);
+}
+function write(line) {
+  if (activeSpinner) {
+    activeSpinner.clear();
+    process.stderr.write(`${line}
+`);
+    activeSpinner.render();
+  } else {
+    process.stderr.write(`${line}
+`);
+  }
+}
+var logger = {
+  setVerbose(on) {
+    verbose = on;
+  },
+  info(msg) {
+    if (!quiet())
+      write(dim(msg));
+  },
+  success(msg) {
+    if (!quiet())
+      write(`${glyph("complete")} ${msg}`);
+  },
+  warn(msg) {
+    if (!quiet())
+      write(color("status-waiting", msg));
+  },
+  error(msg) {
+    write(`${glyph("error")} ${color("status-error", msg)}`);
+  },
+  tell(msg) {
+    write(msg);
+  },
+  debug(msg) {
+    if (verbose)
+      write(dim(msg));
+  },
+  writeRaw(text) {
+    process.stderr.write(text);
+  },
+  spinner(text) {
+    if (quiet() || !getMode().interactive) {
+      return { update() {}, success() {}, error() {}, stop() {} };
+    }
+    const spinner = createSpinner(text, { stream: process.stderr }).start();
+    activeSpinner = spinner;
+    const done = () => {
+      activeSpinner = null;
+    };
+    return {
+      update: (t) => {
+        spinner.update({ text: t });
+      },
+      success: (t) => {
+        spinner.success({ text: t });
+        done();
+      },
+      error: (t) => {
+        spinner.error({ text: t });
+        done();
+      },
+      stop: () => {
+        spinner.stop();
+        done();
+      }
+    };
+  }
+};
+
+// src/program.ts
+import { Command } from "commander";
+// package.json
+var package_default = {
+  name: "@arcadeai/hypotenuse",
+  version: "0.2.0",
+  description: "Hypotenuse \u2014 run coding agents on your machine for Linear agent sessions",
+  type: "module",
+  license: "Apache-2.0",
+  bin: {
+    hypotenuse: "./dist/hypotenuse.js"
+  },
+  files: [
+    "dist/hypotenuse.js",
+    "skills",
+    "README.md",
+    "LICENSE"
+  ],
+  repository: {
+    type: "git",
+    url: "https://github.com/arcadeai-labs/hypotenuse.git"
+  },
+  homepage: "https://github.com/arcadeai-labs/hypotenuse#readme",
+  bugs: {
+    url: "https://github.com/arcadeai-labs/hypotenuse/issues"
+  },
+  publishConfig: {
+    access: "public"
+  },
+  engines: {
+    bun: ">=1.2"
+  },
+  scripts: {
+    hypotenuse: "bun run src/cli.ts",
+    dev: "bun run src/cli.ts",
+    test: "bun test",
+    lint: "tsc && biome check .",
+    format: "tsc && biome check --write .",
+    bundle: "bun build ./src/cli.ts --target bun --packages external --outfile dist/hypotenuse.js",
+    build: "bun build --compile --minify --sourcemap ./src/cli.ts --outfile dist/hypotenuse",
+    prepack: "bun run bundle"
+  },
+  dependencies: {
+    commander: "^14.0.3",
+    nanospinner: "^1.2.2",
+    upgradr: "^0.4.0",
+    zod: "^4.3.6"
+  },
+  devDependencies: {
+    "@biomejs/biome": "^2.4.8",
+    "@types/bun": "latest",
+    typescript: "^7.0.2"
+  }
+};
+
+// src/api/client.ts
+class ApiError extends Error {
+  status;
+  type;
+  constructor(message, status, type) {
+    super(message);
+    this.status = status;
+    this.type = type;
+    this.name = "ApiError";
+  }
+}
+
+class ApiClient {
+  origin;
+  token;
+  debug;
+  constructor(origin, token, debug = () => {}) {
+    this.origin = origin;
+    this.token = token;
+    this.debug = debug;
+  }
+  async request(method, path, options = {}) {
+    const url = new URL(`${this.origin}/api${path}`);
+    for (const [key, value] of Object.entries(options.query ?? {})) {
+      if (value !== undefined)
+        url.searchParams.set(key, String(value));
+    }
+    const headers = { Accept: "application/json" };
+    if (this.token && !options.anonymous) {
+      headers.Authorization = `Bearer ${this.token}`;
+    }
+    if (options.body !== undefined) {
+      headers["Content-Type"] = "application/json";
+    }
+    this.debug(`${method} ${url.pathname}${url.search}`);
+    let response;
+    try {
+      response = await fetch(url, {
+        method,
+        headers,
+        body: options.body === undefined ? undefined : JSON.stringify(options.body)
+      });
+    } catch (error) {
+      throw new ApiError(`Could not reach ${this.origin}: ${error instanceof Error ? error.message : String(error)}`, 0);
+    }
+    this.debug(`\u2190 ${response.status}`);
+    const text = await response.text();
+    let payload = null;
+    if (text.length > 0) {
+      try {
+        payload = JSON.parse(text);
+      } catch {
+        payload = { error: { message: text.slice(0, 500) } };
+      }
+    }
+    const envelope = payload;
+    if (envelope?.error) {
+      const error = envelope.error;
+      throw typeof error === "string" ? new ApiError(error, response.status) : new ApiError(error.message || `HTTP ${response.status}`, response.status, error.type);
+    }
+    if (!response.ok) {
+      throw new ApiError(`HTTP ${response.status} ${response.statusText}`, response.status);
+    }
+    return payload;
+  }
+}
+
+// src/api/credentials.ts
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  writeFileSync
+} from "fs";
+import { dirname } from "path";
+import { z } from "zod";
+
+// src/paths.ts
+import { homedir } from "os";
+import { join } from "path";
+function configDir(env = process.env) {
+  const base = env.XDG_CONFIG_HOME || join(env.HOME || homedir(), ".config");
+  return join(base, "hypotenuse");
+}
+function credentialsPath(env = process.env) {
+  return join(configDir(env), "credentials.json");
+}
+function defaultConfigPath(env = process.env) {
+  return join(configDir(env), "config.toml");
+}
+
+// src/api/credentials.ts
+function credentialsPathFor(env) {
+  return credentialsPath(env);
+}
+var LoginSchema = z.object({
+  token: z.string(),
+  cliTokenId: z.number(),
+  device: z.string(),
+  email: z.string().optional(),
+  expiresAt: z.number().optional()
+});
+var ServerEntrySchema = z.object({
+  login: LoginSchema.nullable().default(null),
+  project: z.number().nullable().default(null),
+  runner: z.unknown().nullable().default(null)
+});
+var CredentialsSchema = z.object({
+  version: z.literal(1),
+  current: z.string().nullable().default(null),
+  servers: z.record(z.string(), ServerEntrySchema).default({})
+});
+function emptyCredentials() {
+  return { version: 1, current: null, servers: {} };
+}
+function loadCredentials(path = credentialsPath()) {
+  if (!existsSync(path))
+    return emptyCredentials();
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    throw new Error(`${path} is not valid JSON`);
+  }
+  const parsed = CredentialsSchema.safeParse(raw);
+  if (!parsed.success) {
+    throw new Error(`${path} is not a hypotenuse credentials file`);
+  }
+  return parsed.data;
+}
+function saveCredentials(credentials, path = credentialsPath()) {
+  const dir = dirname(path);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  chmodSync(dir, 448);
+  const temp = `${path}.${process.pid}.tmp`;
+  writeFileSync(temp, `${JSON.stringify(credentials, null, 2)}
+`, {
+    mode: 384
+  });
+  chmodSync(temp, 384);
+  renameSync(temp, path);
+}
+function originOf(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`Not a URL: ${url}`);
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new Error(`Not an http(s) URL: ${url}`);
+  }
+  return parsed.origin;
+}
+function serverEntry(credentials, origin) {
+  credentials.servers[origin] ??= { login: null, project: null, runner: null };
+  return credentials.servers[origin];
+}
+
+// src/api/resolve.ts
+async function resolveProjectId(client, selector) {
+  if (/^\d+$/.test(selector))
+    return Number(selector);
+  for (let page = 1;; page++) {
+    const { projects, pagination } = await client.request("GET", "/projects", { query: { page, limit: 100 } });
+    const match = projects.find((p) => p.slug === selector);
+    if (match)
+      return match.id;
+    if (page >= pagination.pages) {
+      throw new Error(`You have no project with the slug "${selector}"`);
+    }
+  }
+}
+
+// src/api/url.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+var DEFAULT_SERVER_URL = "https://api.hypotenuse.cloud";
+function configServerUrl(path) {
+  if (!existsSync2(path))
+    return;
+  let parsed;
+  try {
+    parsed = Bun.TOML.parse(readFileSync2(path, "utf8"));
+  } catch (error) {
+    throw new Error(`${path} is not valid TOML: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const url = parsed.server?.url;
+  return typeof url === "string" ? url : undefined;
+}
+function resolveServerUrl(sources) {
+  if (sources.flag)
+    return { origin: originOf(sources.flag), source: "flag" };
+  if (sources.env.HYPOTENUSE_URL) {
+    return { origin: originOf(sources.env.HYPOTENUSE_URL), source: "env" };
+  }
+  const { current, servers } = sources.credentials;
+  const known = Object.keys(servers);
+  if (current && servers[current]) {
+    return { origin: current, source: "credentials" };
+  }
+  if (known.length === 1 && known[0]) {
+    return { origin: known[0], source: "credentials" };
+  }
+  const configured = configServerUrl(sources.configPath);
+  if (configured)
+    return { origin: originOf(configured), source: "config" };
+  return { origin: DEFAULT_SERVER_URL, source: "default" };
+}
+
+// src/context.ts
+class CliContext {
+  options;
+  env;
+  cachedCredentials;
+  cachedServer;
+  constructor(options, env = process.env) {
+    this.options = options;
+    this.env = env;
+  }
+  get json() {
+    return Boolean(this.options.json) || getMode().json;
+  }
+  get credentialsPath() {
+    return credentialsPathFor(this.env);
+  }
+  get configPath() {
+    return this.options.config ?? defaultConfigPath(this.env);
+  }
+  get credentials() {
+    this.cachedCredentials ??= loadCredentials(this.credentialsPath);
+    return this.cachedCredentials;
+  }
+  get server() {
+    this.cachedServer ??= resolveServerUrl({
+      flag: this.options.url,
+      env: this.env,
+      credentials: this.credentials,
+      configPath: this.configPath
+    });
+    return this.cachedServer;
+  }
+  get entry() {
+    return serverEntry(this.credentials, this.server.origin);
+  }
+  get login() {
+    return this.credentials.servers[this.server.origin]?.login ?? null;
+  }
+  save() {
+    saveCredentials(this.credentials, this.credentialsPath);
+  }
+  client() {
+    return this.clientWith(this.login?.token);
+  }
+  clientWith(token) {
+    return new ApiClient(this.server.origin, token, (line) => logger.debug(line));
+  }
+  signedInClient() {
+    if (!this.login) {
+      throw new Error(`Not signed in to ${this.server.origin}. Run \`hypotenuse login\`.`);
+    }
+    return this.client();
+  }
+  async projectId() {
+    const selector = this.options.project ?? this.env.HYPOTENUSE_PROJECT ?? (this.credentials.servers[this.server.origin]?.project != null ? String(this.credentials.servers[this.server.origin]?.project) : undefined);
+    if (!selector) {
+      throw new Error("No project selected. Pass --project <id|slug> or run `hypotenuse project use <id|slug>`.");
+    }
+    return resolveProjectId(this.signedInClient(), selector);
+  }
+}
+function contextFor(command) {
+  const options = command.optsWithGlobals();
+  logger.setVerbose(Boolean(options.verbose));
+  return new CliContext(options);
+}
+async function runCommand(command, fn) {
+  let ctx;
+  try {
+    ctx = contextFor(command);
+    await fn(ctx);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    logger.error(message);
+    if (error instanceof ApiError && error.status === 401 && ctx && !/hypotenuse login/.test(message)) {
+      logger.error(`Run \`hypotenuse login\` to sign in to ${ctx.server.origin}.`);
+    }
+    process.exitCode = 1;
+  }
+}
+function emit(ctx, value, human) {
+  if (ctx.json) {
+    console.log(JSON.stringify(value, null, 2));
+  } else {
+    const text = human();
+    if (text)
+      console.log(text);
+  }
+}
+function when(ms) {
+  if (ms == null)
+    return "-";
+  const d = new Date(ms);
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ${pad(d.getHours())}:${pad(d.getMinutes())}`;
+}
+function withPaging(command) {
+  return command.option("--page <n>", "page number, from 1").option("--limit <n>", "rows per page (default 25)");
+}
+function pageQuery(command) {
+  const o = command.opts();
+  return {
+    page: o.page ? Number(o.page) : undefined,
+    limit: o.limit ? Number(o.limit) : undefined
+  };
+}
+function pageFooter(pagination) {
+  return pagination.pages > 1 ? `
+page ${pagination.page} of ${pagination.pages} (${pagination.total} total)` : "";
+}
+
+// src/commands/audit.ts
+var DEFAULT_WINDOW_DAYS = 30;
+function parseTime(raw, now = Date.now()) {
+  if (/^\d+$/.test(raw))
+    return Number(raw);
+  const relative = /^(\d+)([dhm])$/.exec(raw);
+  if (relative) {
+    const unit = { d: 86400000, h: 3600000, m: 60000 }[relative[2]];
+    return now - Number(relative[1]) * unit;
+  }
+  const parsed = Date.parse(raw);
+  if (Number.isNaN(parsed)) {
+    throw new Error(`Not a time: ${raw} (use ISO-8601, epoch ms, or 7d / 12h / 30m)`);
+  }
+  return parsed;
+}
+function registerAuditCommands(program) {
+  const audit = program.command("audit").description("The selected project's audit log (admin)");
+  withPaging(audit.command("list").description("List who changed what, newest first").option("--since <time>", `start of the range: ISO-8601, epoch ms, or 7d / 12h / 30m (default ${DEFAULT_WINDOW_DAYS}d)`).option("--until <time>", "end of the range (default now)").option("--action <name>", "only this action, e.g. tag:edit")).action(async function() {
+    await runCommand(this, async (ctx) => {
+      const opts = this.opts();
+      const projectId = await ctx.projectId();
+      const result = await ctx.signedInClient().request("GET", "/audit-logs", {
+        query: {
+          projectId,
+          since: parseTime(opts.since ?? `${DEFAULT_WINDOW_DAYS}d`),
+          until: opts.until ? parseTime(opts.until) : undefined,
+          action: opts.action,
+          ...pageQuery(this)
+        }
+      });
+      emit(ctx, result, () => table(result.auditLogs.map((a) => ({
+        when: when(a.createdAt),
+        user: a.userId ?? "-",
+        action: a.action,
+        target: [a.targetType, a.targetPath].filter(Boolean).join(" ")
+      })), [
+        { key: "when" },
+        { key: "user" },
+        { key: "action" },
+        { key: "target", maxWidth: 50 }
+      ]) + pageFooter(result.pagination));
+    });
+  });
+}
+
+// src/commands/auth.ts
+import { hostname } from "os";
+
+// src/shutdown.ts
+class ExitError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "ExitError";
+  }
+}
+var registry = new Set;
+var shuttingDown = false;
+var installed = false;
+var HARD_TIMEOUT_MS = 8000;
+function register(c) {
+  registry.add(c);
+}
+function unregister(c) {
+  registry.delete(c);
+}
+async function runShutdown(exitCode) {
+  if (shuttingDown)
+    process.exit(exitCode);
+  shuttingDown = true;
+  const closeAll = Promise.allSettled([...registry].map((c) => c.close()));
+  await Promise.race([
+    closeAll,
+    new Promise((resolve) => setTimeout(resolve, HARD_TIMEOUT_MS).unref())
+  ]);
+  process.exit(exitCode);
+}
+function installSignalHandlers() {
+  if (installed)
+    return;
+  installed = true;
+  process.on("SIGINT", () => void runShutdown(130));
+  process.on("SIGTERM", () => void runShutdown(143));
+  process.on("SIGHUP", () => void runShutdown(129));
+  process.on("uncaughtException", (err) => {
+    logger.error(`uncaught exception: ${err?.stack ?? String(err)}`);
+    runShutdown(1);
+  });
+  process.on("unhandledRejection", (reason) => {
+    const detail = reason instanceof Error ? reason.stack ?? reason.message : String(reason);
+    logger.error(`unhandled rejection: ${detail}`);
+    runShutdown(1);
+  });
+}
+
+// src/api/oauth.ts
+var SIGN_IN_TIMEOUT_MS = 10 * 60 * 1000;
+function randomBase64Url(bytes) {
+  return Buffer.from(crypto.getRandomValues(new Uint8Array(bytes))).toString("base64url");
+}
+function s256(verifier) {
+  return new Bun.CryptoHasher("sha256").update(verifier).digest("base64url");
+}
+function openBrowser(url, env = process.env) {
+  if (env.BROWSER === "none")
+    return false;
+  const cmd = env.BROWSER ? [env.BROWSER, url] : process.platform === "darwin" ? ["open", url] : process.platform === "win32" ? ["cmd", "/c", "start", "", url] : ["xdg-open", url];
+  try {
+    const proc = Bun.spawn(cmd, {
+      stdin: "ignore",
+      stdout: "ignore",
+      stderr: "ignore"
+    });
+    proc.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function loopbackSignIn(options) {
+  const verifier = randomBase64Url(48);
+  const state = randomBase64Url(16);
+  const dashboard = options.dashboardUrl.replace(/\/$/, "");
+  let settle;
+  const codeArrived = new Promise((resolve, reject) => {
+    settle = { resolve, reject };
+  });
+  const doneUrl = (status) => `${dashboard}/cli/authorize?status=${status}`;
+  const server = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    fetch(req) {
+      const url = new URL(req.url);
+      if (url.pathname !== "/callback") {
+        return new Response("Not found", { status: 404 });
+      }
+      if (url.searchParams.get("state") !== state) {
+        settle.reject(new Error("The sign-in callback did not match this login; try again."));
+        return Response.redirect(doneUrl("error"), 302);
+      }
+      const error = url.searchParams.get("error");
+      const code = url.searchParams.get("code");
+      if (error || !code) {
+        settle.reject(new Error("Sign-in was cancelled in the browser."));
+        return Response.redirect(doneUrl("cancelled"), 302);
+      }
+      settle.resolve(code);
+      return Response.redirect(doneUrl("done"), 302);
+    }
+  });
+  const closeable = { close: async () => void server.stop(true) };
+  register(closeable);
+  const authorizeUrl = new URL(`${dashboard}/cli/authorize`);
+  authorizeUrl.searchParams.set("port", String(server.port));
+  authorizeUrl.searchParams.set("state", state);
+  authorizeUrl.searchParams.set("code_challenge", s256(verifier));
+  authorizeUrl.searchParams.set("device", options.device);
+  const opened = (options.open ?? openBrowser)(authorizeUrl.toString());
+  options.tell(opened ? "Opening your browser to approve this CLI. If it did not open, visit:" : "Open this URL in a browser to approve this CLI:");
+  options.tell(`  ${authorizeUrl.toString()}`);
+  const timeout = setTimeout(() => settle.reject(new Error("Timed out waiting for the browser.")), options.timeoutMs ?? SIGN_IN_TIMEOUT_MS);
+  try {
+    const code = await codeArrived;
+    const exchanged = await options.client.request("POST", "/cli-auth/exchange", { body: { code, codeVerifier: verifier }, anonymous: true });
+    return approved(exchanged);
+  } finally {
+    clearTimeout(timeout);
+    setTimeout(() => server.stop(true), 250).unref();
+    unregister(closeable);
+  }
+}
+async function deviceSignIn(options) {
+  const started = await options.client.request("PUT", "/cli-auth/device", {
+    body: { device: options.device },
+    anonymous: true
+  });
+  options.tell(`On any device, open ${started.verificationUrl}`);
+  options.tell(`and enter the code: ${started.userCode}`);
+  const sleep = options.sleep ?? Bun.sleep;
+  const deadline = Date.now() + started.expiresIn * 1000;
+  while (Date.now() < deadline) {
+    await sleep(started.interval * 1000);
+    const polled = await options.client.request("POST", "/cli-auth/exchange", { body: { deviceCode: started.deviceCode }, anonymous: true });
+    if (polled.status === "approved")
+      return approved(polled);
+  }
+  throw new Error("The code expired before it was approved. Run login again.");
+}
+function approved(response) {
+  if (response.status !== "approved" || !response.token || !response.cliToken) {
+    throw new Error("The server did not issue a token.");
+  }
+  return { token: response.token, cliToken: response.cliToken };
+}
+
+// src/commands/auth.ts
+function registerAuthCommands(program) {
+  program.command("login").description("Sign this CLI in through the dashboard in your browser").option("--no-browser", "sign in with a code typed on any device (for SSH and headless machines)").option("--device <name>", "the name this machine shows in the dashboard").action(async function() {
+    await runCommand(this, async (ctx) => {
+      const opts = this.opts();
+      const anonymous = ctx.clientWith(undefined);
+      const device = opts.device ?? hostname();
+      logger.info(`Signing in to ${ctx.server.origin} as ${device}`);
+      let signedIn;
+      if (opts.browser) {
+        const status = await anonymous.request("GET", "/status", { anonymous: true });
+        if (!status.dashboardUrl) {
+          throw new Error(`${ctx.server.origin} did not say where its dashboard is; try \`hypotenuse login --no-browser\`.`);
+        }
+        const spinner = logger.spinner("Waiting for approval in the browser");
+        try {
+          signedIn = await loopbackSignIn({
+            client: anonymous,
+            dashboardUrl: status.dashboardUrl,
+            device,
+            tell: (line) => logger.tell(line)
+          });
+        } finally {
+          spinner.stop();
+        }
+      } else {
+        signedIn = await deviceSignIn({
+          client: anonymous,
+          device,
+          tell: (line) => logger.tell(line)
+        });
+      }
+      const previous = ctx.login;
+      if (previous && previous.token !== signedIn.token) {
+        await ctx.clientWith(previous.token).request("DELETE", "/cli-token", { body: {} }).catch(() => {});
+      }
+      const { user } = await ctx.clientWith(signedIn.token).request("GET", "/me");
+      ctx.entry.login = {
+        token: signedIn.token,
+        cliTokenId: signedIn.cliToken.id,
+        device: signedIn.cliToken.device,
+        email: user.email,
+        expiresAt: signedIn.cliToken.expiresAt
+      };
+      ctx.credentials.current = ctx.server.origin;
+      ctx.save();
+      emit(ctx, {
+        server: ctx.server.origin,
+        user,
+        cliToken: signedIn.cliToken
+      }, () => `Signed in to ${ctx.server.origin} as ${user.email}`);
+    });
+  });
+  program.command("logout").description("Revoke this CLI's sign-in and forget it").action(async function() {
+    await runCommand(this, async (ctx) => {
+      const login = ctx.login;
+      if (!login) {
+        emit(ctx, { server: ctx.server.origin, revoked: false }, () => `Not signed in to ${ctx.server.origin}`);
+        return;
+      }
+      let revoked = true;
+      try {
+        await ctx.client().request("DELETE", "/cli-token", { body: {} });
+      } catch (error) {
+        if (!(error instanceof ApiError && error.status === 401))
+          throw error;
+        revoked = false;
+      }
+      ctx.entry.login = null;
+      ctx.save();
+      emit(ctx, { server: ctx.server.origin, revoked }, () => `Signed out of ${ctx.server.origin}`);
+    });
+  });
+  program.command("whoami").description("Show who this CLI is signed in as, and where").action(async function() {
+    await runCommand(this, async (ctx) => {
+      const { user } = await ctx.signedInClient().request("GET", "/me");
+      emit(ctx, { server: ctx.server.origin, user, device: ctx.login?.device }, () => [
+        `${user.name} <${user.email}>`,
+        `server  ${ctx.server.origin}`,
+        `device  ${ctx.login?.device ?? "-"}`
+      ].join(`
+`));
+    });
+  });
+}
+
+// src/update/updater.ts
+import { createUpdater } from "upgradr";
+var GITHUB_REPO = package_default.repository.url.replace(/^https:\/\/github\.com\//, "").replace(/\.git$/, "");
+var BINARY_NAME = Object.keys(package_default.bin)[0];
+var NO_UPDATE_CHECK_ENV = "HYPOTENUSE_NO_UPDATE_CHECK";
+var BACKGROUND_SKIP_COMMANDS = [
+  "check-update",
+  "upgrade",
+  "daemon",
+  "mcp"
+];
+function updaterConfig(overrides = {}) {
+  return {
+    currentVersion: package_default.version,
+    packageName: package_default.name,
+    repo: GITHUB_REPO,
+    binaryName: BINARY_NAME,
+    cacheDir: configDir(),
+    cliName: BINARY_NAME,
+    noUpdateCheckEnv: NO_UPDATE_CHECK_ENV,
+    checkIntervalMs: 24 * 60 * 60 * 1000,
+    timeoutMs: 5000,
+    backgroundSkipCommands: BACKGROUND_SKIP_COMMANDS,
+    ...overrides
+  };
+}
+var updater = createUpdater(updaterConfig());
+
+// src/commands/check-update.ts
+function registerCheckUpdateCommand(program) {
+  program.command("check-update").description("Check for a newer release of hypotenuse").action(async function() {
+    await runCommand(this, async (ctx) => {
+      const spinner = logger.spinner("Checking for updates");
+      let info;
+      try {
+        info = await updater.checkForUpdate();
+      } finally {
+        spinner.stop();
+      }
+      if (!info.error) {
+        await updater.saveCache({
+          lastCheckAt: new Date().toISOString(),
+          latestVersion: info.latestVersion,
+          hasUpdate: info.hasUpdate,
+          changelog: info.changelog
+        });
+      }
+      emit(ctx, info, () => {
+        if (info.error)
+          return `Could not check for updates: ${info.error}`;
+        if (!info.hasUpdate) {
+          return info.aheadOfLatest ? `hypotenuse v${info.currentVersion} is ahead of the latest release (v${info.latestVersion})` : `hypotenuse is up to date (v${info.currentVersion})`;
+        }
+        return [
+          `Update available: ${info.currentVersion} \u2192 ${info.latestVersion}`,
+          ...info.changelog ? ["", dim(info.changelog)] : [],
+          "",
+          "Run `hypotenuse upgrade` to update"
+        ].join(`
+`);
+      });
+    });
+  });
+}
+
+// src/commands/invite.ts
+function inviteTable(invites) {
+  return table(invites.map((i) => ({
+    id: i.id,
+    project: i.projectName,
+    invitee: i.inviteeEmail,
+    from: i.inviterEmail,
+    status: i.status,
+    expires: when(i.expiresAt)
+  })), [
+    { key: "id" },
+    { key: "project", maxWidth: 30 },
+    { key: "invitee", maxWidth: 40 },
+    { key: "from", maxWidth: 40 },
+    { key: "status" },
+    { key: "expires" }
+  ]);
+}
+function tagIds(raw) {
+  return (raw ?? []).flatMap((v) => v.split(",")).map((v) => v.trim()).filter(Boolean).map((v) => {
+    if (!/^\d+$/.test(v))
+      throw new Error(`Not a tag id: ${v}`);
+    return Number(v);
+  });
+}
+function registerInviteCommands(program) {
+  const invite = program.command("invite").description("Project invitations");
+  withPaging(invite.command("list").description("The selected project's invites (admin)")).action(async function() {
+    await runCommand(this, async (ctx) => {
+      const projectId = await ctx.projectId();
+      const result = await ctx.signedInClient().request("GET", "/invites", {
+        query: { projectId, ...pageQuery(this) }
+      });
+      emit(ctx, result, () => inviteTable(result.invites) + pageFooter(result.pagination));
+    });
+  });
+  withPaging(invite.command("pending").description("Invites addressed to you")).action(async function() {
+    await runCommand(this, async (ctx) => {
+      const result = await ctx.signedInClient().request("GET", "/invites/pending", {
+        query: pageQuery(this)
+      });
+      emit(ctx, result, () => inviteTable(result.invites) + pageFooter(result.pagination));
+    });
+  });
+  invite.command("create").description("Invite someone to the selected project by email (admin)").requiredOption("--email <email>", "who to invite").option("--tag <id>", "a tag id to grant on acceptance (repeatable, or comma-separated)", (value, previous = []) => [...previous, value]).action(async function() {
+    await runCommand(this, async (ctx) => {
+      const opts = this.opts();
+      const projectId = await ctx.projectId();
+      const result = await ctx.signedInClient().request("PUT", "/invite", {
+        body: {
+          projectId,
+          inviteeEmail: opts.email,
+          tagIds: tagIds(opts.tag)
+        }
+      });
+      emit(ctx, result, () => `Invited ${result.invite.inviteeEmail} (invite ${result.invite.id})`);
+    });
+  });
+  for (const verb of ["accept", "reject"]) {
+    invite.command(verb).description(`${verb === "accept" ? "Accept" : "Reject"} an invite addressed to you`).argument("<inviteId>", "the invite's id (see `invite pending`)").action(async function(inviteId) {
+      await runCommand(this, async (ctx) => {
+        const result = await ctx.signedInClient().request("POST", `/invite/${verb}`, {
+          body: { inviteId: Number(inviteId) }
+        });
+        emit(ctx, result, () => `${verb === "accept" ? "Accepted" : "Rejected"} invite ${inviteId}`);
+      });
+    });
+  }
+}
+
+// src/commands/linear.ts
+var POLL_INTERVAL_MS = 2000;
+var DEFAULT_TIMEOUT_SECONDS = 300;
+var STATUS_GLYPH = {
+  active: "online",
+  error: "error",
+  revoked: "offline"
+};
+function connectFinished(current, baseline) {
+  return current?.status === "active" && current.connectedAt !== baseline;
+}
+function describeInstallation(response) {
+  const i = response.installation;
+  if (!i || i.status === "revoked") {
+    const lines = [
+      `${glyph("offline")} Not connected to Linear. Run \`hypotenuse linear connect\` (admin).`
+    ];
+    if (!response.configured) {
+      lines.push(dim("This server has no Linear app configured."));
+    }
+    return lines.join(`
+`);
+  }
+  const limit = i.rateLimit;
+  const lines = [
+    `${glyph(STATUS_GLYPH[i.status])} ${i.organizationName} (${i.urlKey})  ${i.status}`,
+    `app user   ${i.appUserName} (${i.appUserId})`,
+    `scopes     ${i.scopes.join(", ")}`,
+    `teams      ${i.teamIds.length}`,
+    `token      \u2026${i.accessTokenLastFour || "----"}, expires ${when(i.accessTokenExpiresAt)}`,
+    `refreshed  ${when(i.lastRefreshedAt)}`
+  ];
+  if (limit?.requestsRemaining != null) {
+    lines.push(`rate limit ${limit.requestsRemaining}${limit.requestsLimit != null ? `/${limit.requestsLimit}` : ""} requests left`);
+  }
+  if (i.refreshError)
+    lines.push(`error      ${i.refreshError}`);
+  return lines.join(`
+`);
+}
+async function confirm(question) {
+  process.stderr.write(`${question} [y/N] `);
+  for await (const line of console) {
+    return /^y(es)?$/i.test(line.trim());
+  }
+  return false;
+}
+function registerLinearCommands(program) {
+  const linear = program.command("linear").description("The selected project's Linear workspace connection");
+  linear.command("status").description("Show which Linear workspace the project is connected to").action(async function() {
+    await runCommand(this, async (ctx) => {
+      const projectId = await ctx.projectId();
+      const result = await ctx.signedInClient().request("GET", "/linear/installation", {
+        query: { projectId }
+      });
+      emit(ctx, result, () => describeInstallation(result));
+    });
+  });
+  linear.command("connect").description("Connect the project to a Linear workspace (admin; a Linear admin approves in a browser)").option("--no-browser", "print the consent URL instead of opening it").option("--timeout <seconds>", "how long to wait for the approval", String(DEFAULT_TIMEOUT_SECONDS)).action(async function() {
+    await runCommand(this, async (ctx) => {
+      const { browser, timeout } = this.opts();
+      const client = ctx.signedInClient();
+      const projectId = await ctx.projectId();
+      const read = () => client.request("GET", "/linear/installation", {
+        query: { projectId }
+      });
+      const baseline = (await read()).installation?.connectedAt ?? null;
+      const { authorizeUrl } = await client.request("GET", "/linear/connect", { query: { projectId } });
+      logger.tell("Approve Hypotenuse on Linear's consent screen:");
+      logger.tell(authorizeUrl);
+      if (browser)
+        openBrowser(authorizeUrl);
+      const spinner = logger.spinner("Waiting for a Linear admin to approve");
+      const deadline = Date.now() + Number(timeout) * 1000;
+      try {
+        for (;; ) {
+          const now = await read();
+          if (connectFinished(now.installation, baseline)) {
+            spinner.success(`Connected to ${now.installation.organizationName}`);
+            emit(ctx, now, () => describeInstallation(now));
+            return;
+          }
+          if (Date.now() >= deadline) {
+            throw new Error("Timed out waiting for the approval. If Linear redirected to the dashboard with an error, it says why there.");
+          }
+          await Bun.sleep(POLL_INTERVAL_MS);
+        }
+      } catch (error) {
+        spinner.stop();
+        throw error;
+      }
+    });
+  });
+  linear.command("disconnect").description("Revoke the project's Linear tokens and disconnect the workspace (admin)").option("--yes", "do not ask for confirmation").action(async function() {
+    await runCommand(this, async (ctx) => {
+      const { yes } = this.opts();
+      const client = ctx.signedInClient();
+      const projectId = await ctx.projectId();
+      if (!yes) {
+        if (!process.stdin.isTTY || ctx.json) {
+          throw new Error("Disconnecting stops @hypotenuse in Linear at once. Re-run with --yes to disconnect.");
+        }
+        if (!await confirm("Disconnect Linear? @hypotenuse stops answering in that workspace at once.")) {
+          throw new Error("Not disconnected.");
+        }
+      }
+      const result = await client.request("DELETE", "/linear/installation", { body: { projectId } });
+      emit(ctx, result, () => `Disconnected ${result.installation.organizationName}`);
+    });
+  });
+}
+
+// src/commands/member.ts
+function registerMemberCommands(program) {
+  const member = program.command("member").description("The selected project's members");
+  withPaging(member.command("list").description("List members")).action(async function() {
+    await runCommand(this, async (ctx) => {
+      const projectId = await ctx.projectId();
+      const result = await ctx.signedInClient().request("GET", "/memberships", {
+        query: { projectId, ...pageQuery(this) }
+      });
+      emit(ctx, result, () => table(result.memberships.map((m) => ({
+        user: m.userId,
+        name: m.user.name,
+        email: m.user.email,
+        tags: m.tags.map((t) => t.name).join(", "),
+        joined: when(m.createdAt)
+      })), [
+        { key: "user" },
+        { key: "name", maxWidth: 30 },
+        { key: "email", maxWidth: 40 },
+        { key: "tags", maxWidth: 40 },
+        { key: "joined" }
+      ]) + pageFooter(result.pagination));
+    });
+  });
+  member.command("add").description("Add an existing user by email (admin)").requiredOption("--email <email>", "the user's email").action(async function() {
+    await runCommand(this, async (ctx) => {
+      const { email } = this.opts();
+      const projectId = await ctx.projectId();
+      const result = await ctx.signedInClient().request("PUT", "/membership", { body: { projectId, email } });
+      emit(ctx, result, () => `Added ${email}`);
+    });
+  });
+  member.command("remove").description("Remove a member by user id (admin); revokes their runners too").argument("<userId>", "the member's user id").action(async function(userId) {
+    await runCommand(this, async (ctx) => {
+      const projectId = await ctx.projectId();
+      const result = await ctx.signedInClient().request("DELETE", "/membership", {
+        body: { projectId, userId: Number(userId) }
+      });
+      emit(ctx, result, () => `Removed user ${userId}`);
+    });
+  });
+}
+
+// src/commands/project.ts
+function projectTable(projects, selected) {
+  return table(projects.map((p) => ({
+    " ": p.id === selected ? "*" : "",
+    id: p.id,
+    slug: p.slug,
+    name: p.name,
+    created: when(p.createdAt)
+  })), [
+    { key: " " },
+    { key: "id" },
+    { key: "slug" },
+    { key: "name", maxWidth: 40 },
+    { key: "created" }
+  ]);
+}
+function registerProjectCommands(program) {
+  const project = program.command("project").description("Your projects, and which one commands act on");
+  withPaging(project.command("list").description("List the projects you belong to")).action(async function() {
+    await runCommand(this, async (ctx) => {
+      const result = await ctx.signedInClient().request("GET", "/projects", { query: pageQuery(this) });
+      emit(ctx, result, () => projectTable(result.projects, ctx.entry.project) + pageFooter(result.pagination));
+    });
+  });
+  project.command("view").description("Show a project and your standing in it").argument("[project]", "id or slug (default: the selected project)").action(async function(selector) {
+    await runCommand(this, async (ctx) => {
+      const client = ctx.signedInClient();
+      const projectId = selector ? await resolveProjectId(client, selector) : await ctx.projectId();
+      const result = await client.request("GET", "/project", { query: { projectId } });
+      emit(ctx, result, () => [
+        `${result.project.name} (${result.project.slug}, id ${result.project.id})`,
+        `standing  ${result.standing.isAdmin ? "admin" : "member"}`,
+        `tags      ${result.callerTags.map((t) => t.name).join(", ") || "-"}`,
+        `created   ${when(result.project.createdAt)}`
+      ].join(`
+`));
+    });
+  });
+  project.command("create").description("Create a project; you become its admin").requiredOption("--name <name>", "the project's display name").action(async function() {
+    await runCommand(this, async (ctx) => {
+      const { name } = this.opts();
+      const result = await ctx.signedInClient().request("PUT", "/project", {
+        body: { name }
+      });
+      emit(ctx, result, () => `Created ${result.project.name} (${result.project.slug}, id ${result.project.id})`);
+    });
+  });
+  project.command("edit").description("Rename a project (admin)").argument("<project>", "id or slug").requiredOption("--name <name>", "the new display name").action(async function(selector) {
+    await runCommand(this, async (ctx) => {
+      const { name } = this.opts();
+      const client = ctx.signedInClient();
+      const projectId = await resolveProjectId(client, selector);
+      const result = await client.request("POST", "/project", { body: { projectId, name } });
+      emit(ctx, result, () => `Renamed project ${projectId} to ${name}`);
+    });
+  });
+  project.command("delete").description("Delete a project and everything in it (admin)").argument("<project>", "id or slug").option("--yes", "confirm; required, because this cannot be undone").action(async function(selector) {
+    await runCommand(this, async (ctx) => {
+      const { yes } = this.opts();
+      if (!yes) {
+        throw new Error(`Deleting a project cannot be undone. Re-run with --yes to delete ${selector}.`);
+      }
+      const client = ctx.signedInClient();
+      const projectId = await resolveProjectId(client, selector);
+      const result = await client.request("DELETE", "/project", {
+        body: { projectId }
+      });
+      if (ctx.entry.project === projectId) {
+        ctx.entry.project = null;
+        ctx.save();
+      }
+      emit(ctx, result, () => `Deleted project ${selector}`);
+    });
+  });
+  project.command("use").description("Select the project later commands act on").argument("<project>", "id or slug").action(async function(selector) {
+    await runCommand(this, async (ctx) => {
+      const client = ctx.signedInClient();
+      const projectId = await resolveProjectId(client, selector);
+      const { project: selected } = await client.request("GET", "/project", { query: { projectId } });
+      ctx.entry.project = selected.id;
+      ctx.save();
+      emit(ctx, { project: selected }, () => `Using ${selected.name} (${selected.slug}, id ${selected.id})`);
+    });
+  });
+}
+
+// src/commands/tag.ts
+function registerTagCommands(program) {
+  const tag = program.command("tag").description("The selected project's permission tags");
+  withPaging(tag.command("list").description("List tags")).action(async function() {
+    await runCommand(this, async (ctx) => {
+      const projectId = await ctx.projectId();
+      const result = await ctx.signedInClient().request("GET", "/tags", { query: { projectId, ...pageQuery(this) } });
+      emit(ctx, result, () => table(result.tags.map((t) => ({
+        id: t.id,
+        name: t.name,
+        reserved: t.reserved ? "yes" : "",
+        created: when(t.createdAt)
+      })), [
+        { key: "id" },
+        { key: "name", maxWidth: 40 },
+        { key: "reserved" },
+        { key: "created" }
+      ]) + pageFooter(result.pagination));
+    });
+  });
+  tag.command("create").description("Create a tag (admin)").argument("<name>", "the tag's name").action(async function(name) {
+    await runCommand(this, async (ctx) => {
+      const projectId = await ctx.projectId();
+      const result = await ctx.signedInClient().request("PUT", "/tag", { body: { projectId, name } });
+      emit(ctx, result, () => `Created tag ${result.tag.name} (id ${result.tag.id})`);
+    });
+  });
+  tag.command("edit").description("Rename a tag (admin)").argument("<tagId>", "the tag's id").requiredOption("--name <name>", "the new name").action(async function(tagId) {
+    await runCommand(this, async (ctx) => {
+      const { name } = this.opts();
+      const projectId = await ctx.projectId();
+      const result = await ctx.signedInClient().request("POST", "/tag", {
+        body: { projectId, tagId: Number(tagId), name }
+      });
+      emit(ctx, result, () => `Renamed tag ${tagId} to ${name}`);
+    });
+  });
+  tag.command("delete").description("Delete a tag (admin)").argument("<tagId>", "the tag's id").action(async function(tagId) {
+    await runCommand(this, async (ctx) => {
+      const projectId = await ctx.projectId();
+      const result = await ctx.signedInClient().request("DELETE", "/tag", {
+        body: { projectId, tagId: Number(tagId) }
+      });
+      emit(ctx, result, () => `Deleted tag ${tagId}`);
+    });
+  });
+  for (const [verb, method, done] of [
+    ["assign", "PUT", "Granted"],
+    ["unassign", "DELETE", "Revoked"]
+  ]) {
+    tag.command(verb).description(verb === "assign" ? "Grant a tag to a member (admin)" : "Revoke a tag from a member (admin)").argument("<tagId>", "the tag's id").requiredOption("--user <userId>", "the member's user id").action(async function(tagId) {
+      await runCommand(this, async (ctx) => {
+        const { user } = this.opts();
+        const projectId = await ctx.projectId();
+        const result = await ctx.signedInClient().request(method, "/user-tag", {
+          body: { projectId, userId: Number(user), tagId: Number(tagId) }
+        });
+        emit(ctx, result, () => `${done} tag ${tagId} for user ${user}`);
+      });
+    });
+  }
+}
+
+// src/commands/upgrade.ts
+var WINDOWS_REINSTALL = "irm https://raw.githubusercontent.com/arcadeai-labs/hypotenuse/main/install.ps1 | iex";
+async function performUpgrade(up, platform = process.platform) {
+  const method = up.detectInstallMethod();
+  let result;
+  if (platform === "win32" && method === "binary") {
+    const info = await up.checkForUpdate();
+    result = {
+      method,
+      from: info.currentVersion,
+      to: info.latestVersion,
+      hasUpdate: info.hasUpdate,
+      performed: false,
+      success: !info.error && !info.hasUpdate,
+      ...info.error ? { error: info.error } : {},
+      ...info.hasUpdate ? { reinstall: WINDOWS_REINSTALL } : {}
+    };
+    if (info.hasUpdate) {
+      return {
+        result,
+        message: `hypotenuse v${result.to} is available. Windows cannot replace a running hypotenuse.exe; reinstall with:
+  ${WINDOWS_REINSTALL}`,
+        failed: false,
+        exitCode: 0
+      };
+    }
+  } else {
+    result = await up.upgrade();
+  }
+  const exitCode = result.performed && !result.success ? 1 : 0;
+  if (result.error && !result.performed) {
+    return {
+      result,
+      message: `Could not check for updates: ${result.error}`,
+      failed: true,
+      exitCode
+    };
+  }
+  if (!result.hasUpdate) {
+    return {
+      result,
+      message: `hypotenuse is already up to date (v${result.from})`,
+      failed: false,
+      exitCode
+    };
+  }
+  if (result.method === "local-dev") {
+    return {
+      result,
+      message: "Running from source. Use `git pull && bun install` to update.",
+      failed: false,
+      exitCode
+    };
+  }
+  if (result.success) {
+    return {
+      result,
+      message: `Upgraded hypotenuse v${result.from} \u2192 v${result.to}`,
+      failed: false,
+      exitCode
+    };
+  }
+  return {
+    result,
+    message: `Upgrade failed${result.error ? `: ${result.error}` : "."}`,
+    failed: true,
+    exitCode
+  };
+}
+function registerUpgradeCommand(program) {
+  program.command("upgrade").description("Upgrade hypotenuse to the latest release").action(async function() {
+    await runCommand(this, async (ctx) => {
+      const spinner = logger.spinner("Checking for updates");
+      let outcome;
+      try {
+        outcome = await performUpgrade(updater);
+      } finally {
+        spinner.stop();
+      }
+      if (ctx.json) {
+        emit(ctx, outcome.result, () => "");
+      } else if (outcome.failed) {
+        logger.error(outcome.message);
+      } else {
+        console.log(outcome.message);
+      }
+      if (outcome.exitCode !== 0)
+        process.exitCode = outcome.exitCode;
+    });
+  });
+}
+
+// src/program.ts
+var VALUE_OPTIONS = ["-c", "--config", "--url", "--project"];
+function buildProgram() {
+  const program = new Command().name("hypotenuse").description(package_default.description).version(package_default.version, "-V, --version", "print the version").option("-c, --config <path>", "the daemon config file").option("--url <origin>", "the Hypotenuse server (default: where you last logged in)").option("--project <id|slug>", "the project to act on (default: `project use`)").option("-j, --json", "print machine-readable JSON on stdout").option("-v, --verbose", "print each request on stderr").option("--no-color", "disable colored output").option("--force-color", "color output even when it is piped").showHelpAfterError().action(() => {
+    console.log(banner(package_default.version));
+    console.log("");
+    program.outputHelp();
+  });
+  registerAuthCommands(program);
+  registerProjectCommands(program);
+  registerMemberCommands(program);
+  registerInviteCommands(program);
+  registerTagCommands(program);
+  registerAuditCommands(program);
+  registerLinearCommands(program);
+  registerCheckUpdateCommand(program);
+  registerUpgradeCommand(program);
+  return program;
+}
+function firstCommandWord(argv) {
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i];
+    if (VALUE_OPTIONS.includes(arg)) {
+      i++;
+      continue;
+    }
+    if (arg.startsWith("-"))
+      continue;
+    return arg;
+  }
+  return;
+}
+
+// src/cli.ts
+installSignalHandlers();
+var argv = process.argv.slice(2);
+setMode(detectMode({
+  env: process.env,
+  isTTY: Boolean(process.stdout.isTTY || process.stderr.isTTY),
+  argv
+}));
+var program = buildProgram();
+var command = firstCommandWord(argv);
+var known = new Set(program.commands.map((c) => c.name()));
+if (command && command !== "help" && !known.has(command)) {
+  logger.error(`unknown command '${command}'. See 'hypotenuse --help'.`);
+  process.exit(1);
+}
+var json = argv.includes("--json") || argv.includes("-j");
+var updateNotice = updater.maybeBackgroundNotice(json ? { isTTY: false } : undefined);
+try {
+  await program.parseAsync(process.argv);
+} catch (error) {
+  if (error instanceof ExitError)
+    process.exit(error.code);
+  logger.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+}
+process.once("beforeExit", async () => {
+  const notice = await updateNotice;
+  if (notice)
+    logger.writeRaw(notice);
+});