@asteroidai/cli 1.9.4 → 1.9.12

package/dist/core.js

@@ -145,7 +145,8 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: false
+    destructive: false,
+    capability: "run_execution"
   },
   {
     command: "context",
@@ -1051,7 +1052,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "execution resume",
@@ -1071,7 +1073,8 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: false
+    destructive: false,
+    capability: "run_execution"
   },
   {
     command: "insight get",
@@ -1919,7 +1922,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "schedule delete",
@@ -1945,7 +1949,8 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: true
+    destructive: true,
+    capability: "run_execution"
   },
   {
     command: "schedule get",
@@ -2126,7 +2131,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "scheduled-execution cancel",
@@ -2146,7 +2152,8 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: false
+    destructive: false,
+    capability: "run_execution"
   },
   {
     command: "scheduled-execution create",
@@ -2214,7 +2221,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "scheduled-execution list",
@@ -2316,7 +2324,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "schema validate",
@@ -3456,7 +3465,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "workflow execute-sync",
@@ -3555,112 +3565,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
-  },
-  {
-    command: "workflow file list",
-    tool: "workflow_files_list",
-    title: "List workflow files",
-    description: "List the workflow's editable head as a directory of files: the graph rendered as structural files (settings.yaml, per-node instructions.md, scripts) alongside the workflow's own files. Those files are referenced by fileId unless contents=all is set. Pass paths to read named files only, or contents=none for a manifest with no bodies. The returned rev is what you pass as baseRev to write.",
-    method: "GET",
-    path: "/agents/v2/workflows/{workflowId}/head/files",
-    args: [
-      {
-        name: "workflowId",
-        flag: "workflow-id",
-        type: "string",
-        required: true
-      }
-    ],
-    query: [
-      {
-        name: "contents",
-        flag: "contents",
-        type: "string",
-        required: false,
-        description: "Which contents come inline: none (a pure manifest), structural (the default), or all (structural plus file bytes within the response budget).",
-        enum: ["none", "structural", "all"]
-      },
-      {
-        name: "paths",
-        flag: "paths",
-        type: "string[]",
-        required: false,
-        description: "Return only the files at these exact tree paths. A path that names nothing yields no entry. The inline budget applies to the filtered set, so a narrow read can inline files a whole-tree read would have to skip."
-      },
-      {
-        name: "variants",
-        flag: "variants",
-        type: "string",
-        required: false,
-        description: `Narrow which variants/<key>/ files the tree carries: "none" strips every variant, a comma-separated list keeps only those variant keys. Files outside variants/ are always kept, and the response's variantKeys still names every variant. Ignored unless the workflow has variant mode enabled; absent keeps every variant.`
-      },
-      {
-        name: "maxFileBytes",
-        flag: "max-file-bytes",
-        type: "integer",
-        required: false,
-        description: "Per-file ceiling, in bytes, for inlined file contents. Clamped to the server maximum. Files above the ceiling stay references."
-      },
-      {
-        name: "maxTotalBytes",
-        flag: "max-total-bytes",
-        type: "integer",
-        required: false,
-        description: "Ceiling, in bytes, on the total inlined file contents in one response. Clamped to the server maximum. Files are admitted in path order until the ceiling is reached; the rest stay references."
-      }
-    ],
-    binary: false,
-    readOnly: true,
-    destructive: false
-  },
-  {
-    command: "workflow file patch",
-    tool: "workflow_files_patch",
-    title: "Write workflow files",
-    description: "Write and delete files on the workflow's editable head in one patch. Structural files re-derive the graph; the workflow's own files go to its file store, you just write paths. Pass the rev from `workflow_files_list` as baseRev; a stale value is rejected with 409, so re-read and retry. Editing a published or already-executed version forks a new one instead of rewriting it. Each write carries `contentBase64`: base64-encode the file content, plain text is rejected with 400.",
-    method: "PATCH",
-    path: "/agents/v2/workflows/{workflowId}/head/files",
-    args: [
-      {
-        name: "workflowId",
-        flag: "workflow-id",
-        type: "string",
-        required: true
-      }
-    ],
-    query: [],
-    binary: false,
-    readOnly: false,
-    destructive: true,
-    body: {
-      required: true,
-      contentType: "application/json",
-      fields: [
-        {
-          name: "baseRev",
-          flag: "base-rev",
-          type: "integer",
-          required: true,
-          description: "The revision this edit is based on. Agent-file-only patches overlay the current head even when this is stale. A structural-file patch is rejected with 409 when it does not match the stored head revision."
-        },
-        {
-          name: "writes",
-          flag: "writes",
-          type: "json",
-          required: true,
-          description: "Files to upsert."
-        },
-        {
-          name: "deletes",
-          flag: "deletes",
-          type: "string[]",
-          required: true
-        }
-      ],
-      files: [],
-      credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "workflow get",
@@ -3708,7 +3614,8 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: false
+    destructive: false,
+    capability: "publish"
   },
   {
     command: "workflow head revert",
@@ -3834,6 +3741,113 @@ var COMMANDS = [
     readOnly: true,
     destructive: false
   },
+  {
+    command: "workflow pull",
+    tool: "workflow_files_list",
+    title: "List workflow files",
+    description: "List the workflow's editable head as a directory of files: the graph rendered as structural files (settings.yaml, per-node instructions.md, scripts) alongside the workflow's own files. Those files are referenced by fileId unless contents=all is set. Pass paths to read named files only, or contents=none for a manifest with no bodies. The returned rev is what you pass as baseRev to write.",
+    method: "GET",
+    path: "/agents/v2/workflows/{workflowId}/head/files",
+    args: [
+      {
+        name: "workflowId",
+        flag: "workflow-id",
+        type: "string",
+        required: true
+      }
+    ],
+    query: [
+      {
+        name: "contents",
+        flag: "contents",
+        type: "string",
+        required: false,
+        description: "Which contents come inline: none (a pure manifest), structural (the default), or all (structural plus file bytes within the response budget).",
+        enum: ["none", "structural", "all"]
+      },
+      {
+        name: "paths",
+        flag: "paths",
+        type: "string[]",
+        required: false,
+        description: "Return only the files at these exact tree paths. A path that names nothing yields no entry. The inline budget applies to the filtered set, so a narrow read can inline files a whole-tree read would have to skip."
+      },
+      {
+        name: "variants",
+        flag: "variants",
+        type: "string",
+        required: false,
+        description: `Narrow which variants/<key>/ files the tree carries: "none" strips every variant, a comma-separated list keeps only those variant keys. Files outside variants/ are always kept, and the response's variantKeys still names every variant. Ignored unless the workflow has variant mode enabled; absent keeps every variant.`
+      },
+      {
+        name: "maxFileBytes",
+        flag: "max-file-bytes",
+        type: "integer",
+        required: false,
+        description: "Per-file ceiling, in bytes, for inlined file contents. Clamped to the server maximum. Files above the ceiling stay references."
+      },
+      {
+        name: "maxTotalBytes",
+        flag: "max-total-bytes",
+        type: "integer",
+        required: false,
+        description: "Ceiling, in bytes, on the total inlined file contents in one response. Clamped to the server maximum. Files are admitted in path order until the ceiling is reached; the rest stay references."
+      }
+    ],
+    binary: false,
+    readOnly: true,
+    destructive: false,
+    files: "pull"
+  },
+  {
+    command: "workflow push",
+    tool: "workflow_files_patch",
+    title: "Write workflow files",
+    description: "Write and delete files on the workflow's editable head in one patch. Structural files re-derive the graph; the workflow's own files go to its file store, you just write paths. Pass the rev from `workflow_files_list` as baseRev; a stale value is rejected with 409, so re-read and retry. Editing a published or already-executed version forks a new one instead of rewriting it. Each write carries `contentBase64`: base64-encode the file content, plain text is rejected with 400.",
+    method: "PATCH",
+    path: "/agents/v2/workflows/{workflowId}/head/files",
+    args: [
+      {
+        name: "workflowId",
+        flag: "workflow-id",
+        type: "string",
+        required: true
+      }
+    ],
+    query: [],
+    binary: false,
+    readOnly: false,
+    destructive: true,
+    body: {
+      required: true,
+      contentType: "application/json",
+      fields: [
+        {
+          name: "baseRev",
+          flag: "base-rev",
+          type: "integer",
+          required: true,
+          description: "The revision this edit is based on. Agent-file-only patches overlay the current head even when this is stale. A structural-file patch is rejected with 409 when it does not match the stored head revision."
+        },
+        {
+          name: "writes",
+          flag: "writes",
+          type: "json",
+          required: true,
+          description: "Files to upsert."
+        },
+        {
+          name: "deletes",
+          flag: "deletes",
+          type: "string[]",
+          required: true
+        }
+      ],
+      files: [],
+      credentialOrganization: false
+    },
+    files: "push"
+  },
   {
     command: "workflow rename",
     tool: "workflow_rename",
@@ -4236,15 +4250,16 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
-    command: "workflow version file list",
-    tool: "workflow_version_files_list",
-    title: "List workflow version files",
-    description: "List a version's files, like `workflow_files_list` does for the editable head. Versions are immutable, so this is read-only.",
+    command: "workflow version file url",
+    tool: "workflow_version_file_signed_url",
+    title: "Get workflow version file signed URL",
+    description: "Get a short-lived signed URL for downloading one of a workflow version's files directly from storage. Prefer this over a redirect-based download when reading a file's contents.",
     method: "GET",
-    path: "/agents/v2/workflows/{workflowId}/versions/{versionId}/files",
+    path: "/agents/v2/workflows/{workflowId}/versions/{versionId}/files/{fileId}/signed-url",
     args: [
       {
         name: "workflowId",
@@ -4257,93 +4272,30 @@ var COMMANDS = [
         flag: "version-id",
         type: "string",
         required: true
+      },
+      {
+        name: "fileId",
+        flag: "file-id",
+        type: "string",
+        required: true
       }
     ],
-    query: [
+    query: [],
+    binary: false,
+    readOnly: true,
+    destructive: false
+  },
+  {
+    command: "workflow version get",
+    tool: "workflow_version_get",
+    title: "Get workflow version",
+    description: "Get a full workflow version by `versionId`, including the complete node graph, rules, and settings.",
+    method: "GET",
+    path: "/agents/v2/workflows/{workflowId}/versions/{versionId}",
+    args: [
       {
-        name: "contents",
-        flag: "contents",
-        type: "string",
-        required: false,
-        description: "Which contents come inline: none (a pure manifest), structural (the default), or all (structural plus file bytes within the response budget).",
-        enum: ["none", "structural", "all"]
-      },
-      {
-        name: "paths",
-        flag: "paths",
-        type: "string[]",
-        required: false,
-        description: "Return only the files at these exact tree paths. A path that names nothing yields no entry. The inline budget applies to the filtered set, so a narrow read can inline files a whole-tree read would have to skip."
-      },
-      {
-        name: "variants",
-        flag: "variants",
-        type: "string",
-        required: false,
-        description: `Narrow which variants/<key>/ files the tree carries: "none" strips every variant, a comma-separated list keeps only those variant keys. Files outside variants/ are always kept, and the response's variantKeys still names every variant. Ignored unless the workflow has variant mode enabled; absent keeps every variant.`
-      },
-      {
-        name: "maxFileBytes",
-        flag: "max-file-bytes",
-        type: "integer",
-        required: false,
-        description: "Per-file ceiling, in bytes, for inlined file contents. Clamped to the server maximum. Files above the ceiling stay references."
-      },
-      {
-        name: "maxTotalBytes",
-        flag: "max-total-bytes",
-        type: "integer",
-        required: false,
-        description: "Ceiling, in bytes, on the total inlined file contents in one response. Clamped to the server maximum. Files are admitted in path order until the ceiling is reached; the rest stay references."
-      }
-    ],
-    binary: false,
-    readOnly: true,
-    destructive: false
-  },
-  {
-    command: "workflow version file url",
-    tool: "workflow_version_file_signed_url",
-    title: "Get workflow version file signed URL",
-    description: "Get a short-lived signed URL for downloading one of a workflow version's files directly from storage. Prefer this over a redirect-based download when reading a file's contents.",
-    method: "GET",
-    path: "/agents/v2/workflows/{workflowId}/versions/{versionId}/files/{fileId}/signed-url",
-    args: [
-      {
-        name: "workflowId",
-        flag: "workflow-id",
-        type: "string",
-        required: true
-      },
-      {
-        name: "versionId",
-        flag: "version-id",
-        type: "string",
-        required: true
-      },
-      {
-        name: "fileId",
-        flag: "file-id",
-        type: "string",
-        required: true
-      }
-    ],
-    query: [],
-    binary: false,
-    readOnly: true,
-    destructive: false
-  },
-  {
-    command: "workflow version get",
-    tool: "workflow_version_get",
-    title: "Get workflow version",
-    description: "Get a full workflow version by `versionId`, including the complete node graph, rules, and settings.",
-    method: "GET",
-    path: "/agents/v2/workflows/{workflowId}/versions/{versionId}",
-    args: [
-      {
-        name: "workflowId",
-        flag: "workflow-id",
+        name: "workflowId",
+        flag: "workflow-id",
         type: "string",
         required: true
       },
@@ -4455,7 +4407,72 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: false
+    destructive: false,
+    capability: "publish"
+  },
+  {
+    command: "workflow version pull",
+    tool: "workflow_version_files_list",
+    title: "List workflow version files",
+    description: "List a version's files, like `workflow_files_list` does for the editable head. Versions are immutable, so this is read-only.",
+    method: "GET",
+    path: "/agents/v2/workflows/{workflowId}/versions/{versionId}/files",
+    args: [
+      {
+        name: "workflowId",
+        flag: "workflow-id",
+        type: "string",
+        required: true
+      },
+      {
+        name: "versionId",
+        flag: "version-id",
+        type: "string",
+        required: true
+      }
+    ],
+    query: [
+      {
+        name: "contents",
+        flag: "contents",
+        type: "string",
+        required: false,
+        description: "Which contents come inline: none (a pure manifest), structural (the default), or all (structural plus file bytes within the response budget).",
+        enum: ["none", "structural", "all"]
+      },
+      {
+        name: "paths",
+        flag: "paths",
+        type: "string[]",
+        required: false,
+        description: "Return only the files at these exact tree paths. A path that names nothing yields no entry. The inline budget applies to the filtered set, so a narrow read can inline files a whole-tree read would have to skip."
+      },
+      {
+        name: "variants",
+        flag: "variants",
+        type: "string",
+        required: false,
+        description: `Narrow which variants/<key>/ files the tree carries: "none" strips every variant, a comma-separated list keeps only those variant keys. Files outside variants/ are always kept, and the response's variantKeys still names every variant. Ignored unless the workflow has variant mode enabled; absent keeps every variant.`
+      },
+      {
+        name: "maxFileBytes",
+        flag: "max-file-bytes",
+        type: "integer",
+        required: false,
+        description: "Per-file ceiling, in bytes, for inlined file contents. Clamped to the server maximum. Files above the ceiling stay references."
+      },
+      {
+        name: "maxTotalBytes",
+        flag: "max-total-bytes",
+        type: "integer",
+        required: false,
+        description: "Ceiling, in bytes, on the total inlined file contents in one response. Clamped to the server maximum. Files are admitted in path order until the ceiling is reached; the rest stay references."
+      }
+    ],
+    binary: false,
+    readOnly: true,
+    destructive: false,
+    files: "pull"
   },
   {
     command: "workflow version validate",
@@ -4555,16 +4572,16 @@ function isScalar(value2) {
   return value2 === null || ["string", "number", "boolean"].includes(typeof value2);
 }
 function indent(text2) {
-  return text2.split("\n").map((line) => `  ${line}`).join("\n");
+  return text2.split("\n").map((line2) => `  ${line2}`).join("\n");
 }
 function text(value2) {
   return clean(isScalar(value2) ? String(value2) : JSON.stringify(value2));
 }
 function cell(value2, options = {}) {
   if (value2 === null || value2 === void 0) return "";
-  const line = text(value2).replace(/\s+/g, " ");
-  if (options.full || line.length <= MAX_CELL) return line;
-  return `${line.slice(0, MAX_CELL - 1)}\u2026`;
+  const line2 = text(value2).replace(/\s+/g, " ");
+  if (options.full || line2.length <= MAX_CELL) return line2;
+  return `${line2.slice(0, MAX_CELL - 1)}\u2026`;
 }
 function columns(rows, options) {
   const scalarKeys = [];
@@ -4612,8 +4629,8 @@ function table(input, options = {}) {
   const widths = keys.map(
     (key, i) => Math.max(key.length, ...cells.map((r) => r[i].length))
   );
-  const line = (values) => values.map((v, i) => v.padEnd(widths[i])).join("  ").trimEnd();
-  return [line(keys.map((k) => k.toUpperCase())), ...cells.map(line)].join(
+  const line2 = (values) => values.map((v, i) => v.padEnd(widths[i])).join("  ").trimEnd();
+  return [line2(keys.map((k) => k.toUpperCase())), ...cells.map(line2)].join(
     "\n"
   );
 }
@@ -4727,12 +4744,12 @@ var DOTTED = /^--([a-z0-9-]+\.[a-z0-9.-]+)(?:=(.*))?$/;
 function collect(value2, previous) {
   return [...previous ?? [], value2];
 }
-function optionText(option) {
-  const text2 = option.description?.replace(/\s+/g, " ").trim() ?? "";
+function optionText(option2) {
+  const text2 = option2.description?.replace(/\s+/g, " ").trim() ?? "";
   const parts = [text2 && !/[.!?]$/.test(text2) ? `${text2}.` : text2];
-  if (option.enum) parts.push(`One of: ${option.enum.join(", ")}.`);
-  if (option.type.endsWith("[]")) parts.push("Repeatable.");
-  if (option.required) parts.push("Required.");
+  if (option2.enum) parts.push(`One of: ${option2.enum.join(", ")}.`);
+  if (option2.type.endsWith("[]")) parts.push("Repeatable.");
+  if (option2.required) parts.push("Required.");
   return parts.filter(Boolean).join(" ");
 }
 function splitDotted(argv) {
@@ -4759,32 +4776,44 @@ function group(parent, name, groups, path) {
   return created;
 }
 function leafOptions(leaf, command) {
-  for (const option of [...command.query, ...command.body?.fields ?? []]) {
-    if (option.type === "boolean") {
-      leaf.option(`--${option.flag}`, optionText(option));
-      leaf.option(`--no-${option.flag}`, `Set ${option.flag} to false.`);
+  for (const option2 of [...command.query, ...command.body?.fields ?? []]) {
+    if (option2.type === "boolean") {
+      leaf.option(`--${option2.flag}`, optionText(option2));
+      leaf.option(`--no-${option2.flag}`, `Set ${option2.flag} to false.`);
       continue;
     }
-    const placeholder = option.enum ? option.enum.join("|") : option.type.replace("[]", "");
+    const placeholder = option2.enum ? option2.enum.join("|") : option2.type.replace("[]", "");
     leaf.option(
-      `--${option.flag} <${placeholder}>`,
-      optionText(option),
+      `--${option2.flag} <${placeholder}>`,
+      optionText(option2),
       collect
     );
+    if (option2.negatable)
+      leaf.option(`--no-${option2.flag}`, `Skip ${option2.flag}.`);
   }
   for (const file of command.body?.files ?? []) {
     leaf.option(`--${file} <path>`, "File to upload. Repeatable.", collect);
   }
+  if (command.files === "pull")
+    leaf.option(
+      "--out <dir>",
+      "Write here instead of ./<workflow-name>/head (a version: ./<workflow-name>/.versions/...). --json prints the file listing instead."
+    );
+  if (command.files === "push")
+    leaf.option(
+      "--from <dir>",
+      "The pulled head folder to push. Defaults to the current folder."
+    );
 }
 function toParsed(leaf, positionals, dotted) {
   const globals = leaf.optsWithGlobals();
   const own = leaf.opts();
   const flags = new Map(dotted);
-  for (const option of leaf.options) {
-    const flag = option.long?.replace(/^--(no-)?/, "");
-    const value2 = own[option.attributeName()];
-    if (!flag || value2 === void 0 || flags.has(flag)) continue;
-    flags.set(flag, Array.isArray(value2) ? value2.map(String) : [String(value2)]);
+  for (const option2 of leaf.options) {
+    const flag2 = option2.long?.replace(/^--(no-)?/, "");
+    const value2 = own[option2.attributeName()];
+    if (!flag2 || value2 === void 0 || flags.has(flag2)) continue;
+    flags.set(flag2, Array.isArray(value2) ? value2.map(String) : [String(value2)]);
   }
   return {
     positionals,
@@ -4797,7 +4826,11 @@ function toParsed(leaf, positionals, dotted) {
 }
 function defineCommands(root, options, dotted = /* @__PURE__ */ new Map(), onInvocation = () => void 0) {
   if (options.description) root.description(options.description);
-  if (options.version) root.version(options.version, "-v, --version");
+  if (options.version)
+    root.addHelpText(
+      "after",
+      "\nRun `asteroid --version` to print the CLI version."
+    );
   for (const [flags, text2] of GLOBAL_FLAGS) {
     if (!flags.startsWith("-h")) root.option(flags, text2);
   }
@@ -4859,8 +4892,8 @@ ${notes.join("\n")}`);
         );
       }
       const unknownDotted = [...dotted.keys()].filter(
-        (flag) => !(command.body?.fields ?? []).some(
-          (f) => flag.startsWith(`${f.flag}.`)
+        (flag2) => !(command.body?.fields ?? []).some(
+          (f) => flag2.startsWith(`${f.flag}.`)
         )
       );
       if (unknownDotted.length > 0) {
@@ -4881,6 +4914,15 @@ async function parseInvocation(argv, options) {
   let stdout = "";
   let stderr = "";
   let result;
+  if (options.version && (argv[0] === "-v" || argv[0] === "--version")) {
+    return {
+      kind: "exit",
+      code: 0,
+      stdout: `${options.version}
+`,
+      stderr: ""
+    };
+  }
   const { argv: rest, dotted } = splitDotted(argv);
   const root = new Command("asteroid").exitOverride().helpCommand(false).configureOutput({
     writeOut: (text2) => stdout += text2,
@@ -4915,34 +4957,34 @@ import { basename } from "node:path";
 function camel(segment) {
   return segment.replace(/-([a-z0-9])/g, (_, c) => c.toUpperCase());
 }
-function scalar(option, raw) {
-  const type = option.type.replace("[]", "");
-  if (option.enum && !option.enum.includes(raw)) {
+function scalar(option2, raw) {
+  const type = option2.type.replace("[]", "");
+  if (option2.enum && !option2.enum.includes(raw)) {
     throw new UsageError(
-      `--${option.flag} must be one of ${option.enum.join(", ")}`
+      `--${option2.flag} must be one of ${option2.enum.join(", ")}`
     );
   }
   if (type === "integer" || type === "number") {
     const value2 = Number(raw);
     if (raw.trim() === "" || Number.isNaN(value2) || type === "integer" && !Number.isInteger(value2)) {
       throw new UsageError(
-        `--${option.flag} must be ${type === "integer" ? "an integer" : "a number"}`
+        `--${option2.flag} must be ${type === "integer" ? "an integer" : "a number"}`
       );
     }
     return value2;
   }
   if (type === "boolean") {
     if (raw !== "true" && raw !== "false") {
-      throw new UsageError(`--${option.flag} must be true or false`);
+      throw new UsageError(`--${option2.flag} must be true or false`);
     }
     return raw === "true";
   }
-  if (type === "json") return parseJson(raw, `--${option.flag}`);
+  if (type === "json") return parseJson(raw, `--${option2.flag}`);
   return raw;
 }
-function value(option, raws) {
-  if (option.type.endsWith("[]")) return raws.map((raw) => scalar(option, raw));
-  return scalar(option, raws.at(-1));
+function value(option2, raws) {
+  if (option2.type.endsWith("[]")) return raws.map((raw) => scalar(option2, raw));
+  return scalar(option2, raws.at(-1));
 }
 var nodeReader = {
   text: async (path) => readFileSync(path, "utf8"),
@@ -4954,12 +4996,12 @@ async function readInput(raw, io) {
   return raw;
 }
 async function resolveInputs(command, parsed, io) {
-  const jsonFlags = [...command.query, ...command.body?.fields ?? []].filter((option) => option.type === "json").map((option) => option.flag);
+  const jsonFlags = [...command.query, ...command.body?.fields ?? []].filter((option2) => option2.type === "json").map((option2) => option2.flag);
   const flags = new Map(parsed.flags);
-  for (const flag of jsonFlags) {
-    const raws = flags.get(flag);
+  for (const flag2 of jsonFlags) {
+    const raws = flags.get(flag2);
     if (raws)
-      flags.set(flag, await Promise.all(raws.map((raw) => readInput(raw, io))));
+      flags.set(flag2, await Promise.all(raws.map((raw) => readInput(raw, io))));
   }
   const body = parsed.body === void 0 ? void 0 : await readInput(parsed.body, io);
   return { ...parsed, flags, body };
@@ -5009,18 +5051,18 @@ async function buildRequest(command, input, context = {}) {
   });
   const flags = new Map(parsed.flags);
   const query = new URLSearchParams();
-  for (const option of command.query) {
-    const raws = flags.get(option.flag);
-    flags.delete(option.flag);
+  for (const option2 of command.query) {
+    const raws = flags.get(option2.flag);
+    flags.delete(option2.flag);
     if (!raws) {
-      if (option.required) throw new UsageError(`--${option.flag} is required`);
+      if (option2.required) throw new UsageError(`--${option2.flag} is required`);
       continue;
     }
-    const parsedValue = value(option, raws);
+    const parsedValue = value(option2, raws);
     const values = Array.isArray(parsedValue) ? parsedValue : [parsedValue];
-    if (option.explode === false)
-      query.append(option.name, values.map(String).join(","));
-    else for (const v of values) query.append(option.name, String(v));
+    if (option2.explode === false)
+      query.append(option2.name, values.map(String).join(","));
+    else for (const v of values) query.append(option2.name, String(v));
   }
   const built = { method: command.method, path, query };
   const body = command.body;
@@ -5070,11 +5112,11 @@ async function buildRequest(command, input, context = {}) {
     flags.delete(field.flag);
     json[field.name] = value(field, raws);
   }
-  for (const [flag, raws] of [...flags]) {
-    const [head, ...rest] = flag.split(".");
+  for (const [flag2, raws] of [...flags]) {
+    const [head, ...rest] = flag2.split(".");
     const field = body.fields.find((f) => f.flag === head);
     if (!field || rest.length === 0) continue;
-    flags.delete(flag);
+    flags.delete(flag2);
     const current = json[field.name];
     json[field.name] = typeof current === "object" && current !== null ? current : {};
     setPath(json, [field.name, ...rest.map(camel)], loose(raws.at(-1)));
@@ -5105,12 +5147,784 @@ function rejectUnknown(flags) {
     );
   }
 }
+
+// src/sync/commands.ts
+function option(name, type, description, extra = {}) {
+  return { name, flag: name, type, required: false, description, ...extra };
+}
+var local = {
+  method: "GET",
+  path: "",
+  binary: false,
+  destructive: false,
+  local: true
+};
+var SYNC_COMMANDS = [
+  {
+    ...local,
+    command: "execution pull",
+    tool: "execution_pull",
+    title: "Pull an execution to disk",
+    description: "Write an execution to `<workflow-name>/executions/<id>/`: summary.json, activities.md (the step-by-step log), and the files the run produced.",
+    readOnly: true,
+    args: [
+      {
+        name: "executionId",
+        flag: "execution-id",
+        type: "string",
+        required: true
+      }
+    ],
+    query: [
+      option(
+        "files",
+        "string",
+        "Only download files whose path matches this glob. --no-files skips downloads.",
+        {
+          negatable: true
+        }
+      ),
+      option(
+        "summary-only",
+        "boolean",
+        "Write summary.json only: no activities, no files."
+      ),
+      option(
+        "max-file-size",
+        "integer",
+        "Skip files larger than this many bytes."
+      ),
+      option(
+        "dir",
+        "string",
+        "Write here instead of `<workflow-name>/executions/<id>/` under the current directory."
+      )
+    ]
+  }
+];
+
+// src/commands.ts
+function withSyncCommands(commands) {
+  return [...commands, ...SYNC_COMMANDS].sort(
+    (a, b) => a.command.localeCompare(b.command)
+  );
+}
+var ALL_COMMANDS = withSyncCommands(COMMANDS);
+
+// src/sync/activities.ts
+function indentJson(data) {
+  return JSON.stringify(data, null, 2).split("\n").map((line2) => `  ${line2}`).join("\n");
+}
+function action(label, payload) {
+  const info = payload.info;
+  const detail = info && Object.keys(info).length > 0 ? `
+info:
+${indentJson(info)}` : "";
+  return `[${label}: ${payload.actionName}]:${detail}
+`;
+}
+function line(payload) {
+  switch (payload.activityType) {
+    case "reasoning":
+      return `[reasoning]:
+${payload.reasoning}
+`;
+    case "generic":
+      return `[message]:
+${payload.message}
+`;
+    case "user_message_received":
+      return `[user_message]:
+${payload.message}
+`;
+    case "action_started":
+      return action("action_started", payload);
+    case "action_completed":
+      return action("action_completed", payload);
+    case "action_failed":
+      return `[action_failed: ${payload.actionName}]:
+failure: ${payload.message}
+`;
+    case "compaction_performed":
+      return `[compaction]: summary_tokens: ${payload.summaryTokens}, duration_ms: ${payload.durationMs}
+`;
+    case "compaction_started":
+      return "[compaction_started]\n";
+    default: {
+      const summary2 = payload.display?.summaryText;
+      return summary2 ? `[${payload.activityType}]: ${summary2}
+` : `[${payload.activityType}]
+`;
+    }
+  }
+}
+function formatActivitiesMarkdown(activities, status, createdAt) {
+  const lines = [
+    "# Execution Activities\n",
+    `Status: ${status}`,
+    `Started: ${createdAt}`
+  ];
+  let currentTurn = "";
+  for (const { payload } of activities) {
+    const turnId = payload.display?.turnId ?? "";
+    if (turnId && turnId !== currentTurn) {
+      currentTurn = turnId;
+      lines.push(`
+---
+
+## ${turnId}
+`);
+    } else if (!currentTurn && !turnId) {
+      currentTurn = "_started";
+      lines.push("\n---\n");
+    }
+    lines.push(line(payload));
+  }
+  return lines.join("\n");
+}
+
+// ../workflow-files/src/representation/name-charset.ts
+var NAME_CHARSET_RE = /^[A-Za-z0-9 !#$%&'()+,.;=@^`{}[\]~-]+$/;
+var WINDOWS_RESERVED = /* @__PURE__ */ new Set([
+  "con",
+  "prn",
+  "aux",
+  "nul",
+  ...Array.from({ length: 9 }, (_, i) => `com${i + 1}`),
+  ...Array.from({ length: 9 }, (_, i) => `lpt${i + 1}`)
+]);
+function isNameCharsetConforming(name) {
+  return NAME_CHARSET_RE.test(name);
+}
+
+// ../workflow-files/src/representation/types.ts
+function normalizeNodeName(name) {
+  let result = name.toLowerCase();
+  result = result.replace(/[^a-z0-9]+/g, "_");
+  result = result.replace(/^_+|_+$/g, "");
+  if (result.length > 80) {
+    result = result.slice(0, 80).replace(/_+$/, "");
+  }
+  if (result === "") {
+    throw new Error(
+      `representation: node name "${name}" produces an empty directory name after normalization`
+    );
+  }
+  return result;
+}
+function nodeDirName(name) {
+  if (isNameCharsetConforming(name)) {
+    return name.replaceAll(" ", "_");
+  }
+  return normalizeNodeName(name);
+}
+function agentDirName(name) {
+  try {
+    return nodeDirName(name);
+  } catch {
+    return "agent";
+  }
+}
+function executionDirName(executionId) {
+  return executionId.slice(0, 8);
+}
+function workflowDirName(workflowId, version, parentId, parentVersion) {
+  const short = workflowId.slice(0, 8);
+  if (version !== void 0 && version !== null) {
+    return `v${version}_${short}`;
+  }
+  if (parentId) {
+    if (parentVersion !== void 0 && parentVersion !== null) {
+      return `draft_${short}_from_v${parentVersion}`;
+    }
+    return `draft_${short}_from_draft_${parentId.slice(0, 8)}`;
+  }
+  return `draft_${short}`;
+}
+
+// src/sync/paths.ts
+import { createHash } from "node:crypto";
+function join(...parts) {
+  return parts.filter((part) => part !== "").join("/").replace(/\/{2,}/g, "/");
+}
+function workflowRoot(root, workflowName) {
+  return join(root, agentDirName(workflowName));
+}
+function isContained(path) {
+  if (path === "" || path.startsWith("/") || path.includes("\\")) return false;
+  return path.split("/").every((segment) => segment !== ".." && segment !== "");
+}
+function sha256(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function matchesGlob(path, pattern) {
+  let source = "";
+  for (let i = 0; i < pattern.length; i++) {
+    const ch = pattern[i];
+    if (ch === "*" && pattern[i + 1] === "*" && pattern[i + 2] === "/") {
+      source += "(?:.*/)?";
+      i += 2;
+    } else if (ch === "*" && pattern[i + 1] === "*") {
+      source += ".*";
+      i += 1;
+    } else if (ch === "*") source += "[^/]*";
+    else if (ch === "?") source += "[^/]";
+    else source += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${source}$`).test(path);
+}
+
+// src/sync/types.ts
+var MANIFEST = ".asteroid.json";
+function get(path, query = {}) {
+  return { method: "GET", path, query: new URLSearchParams(query) };
+}
+function statusOf(error) {
+  const status = error?.status;
+  return typeof status === "number" ? status : void 0;
+}
+
+// src/sync/execution-pull.ts
+var DIRECTORIES = ["workspace", "downloads", "shared"];
+function relativeFilePath(file) {
+  const at = file.filePath.indexOf(`/${file.directory}/`);
+  if (at === -1)
+    return `${file.directory}/${file.filePath.split("/").pop() ?? "unknown"}`;
+  return file.filePath.slice(at + 1).replace(/^workspace\/\.execution-context\//, "");
+}
+function executionDir(options, execution) {
+  const chosen = options.dir?.(execution);
+  if (chosen) return chosen;
+  const root = workflowRoot(
+    options.root,
+    execution.workflowName ?? execution.workflowId
+  );
+  return join(root, "executions", executionDirName(execution.id));
+}
+async function writeText(sync, path, text2) {
+  await sync.files.write(path, Buffer.from(text2, "utf8"));
+}
+async function writeActivities(sync, dir, execution) {
+  try {
+    const activities = await sync.remote.json(
+      get(`/agents/v2/executions/${execution.id}/activities`, { order: "asc" })
+    );
+    if (activities.length === 0) return false;
+    const markdown = formatActivitiesMarkdown(
+      activities,
+      execution.status,
+      execution.createdAt
+    );
+    await writeText(sync, join(dir, "activities.md"), markdown);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function listFiles(sync, executionId) {
+  const listing = await sync.remote.json(
+    get(`/agents/v2/executions/${executionId}/files`)
+  );
+  return DIRECTORIES.flatMap((name) => listing.directories[name] ?? []);
+}
+async function download(sync, executionId, file) {
+  const path = `/agents/v2/executions/${executionId}/files/${file.id}/signed-url`;
+  const { url } = await sync.remote.json(get(path));
+  return sync.remote.download(url);
+}
+function selectFiles(files, options, skipped) {
+  return files.filter((file) => {
+    const path = relativeFilePath(file);
+    if (!isContained(path)) skipped.push(`${path} (unsafe path)`);
+    else if (options.glob !== void 0 && !matchesGlob(path, options.glob))
+      skipped.push(`${path} (excluded by --files)`);
+    else if (options.maxFileBytes !== void 0 && file.fileSize > options.maxFileBytes)
+      skipped.push(`${path} (${file.fileSize} bytes, over the size limit)`);
+    else return true;
+    return false;
+  });
+}
+async function pullFiles(sync, dir, options) {
+  const skipped = [];
+  const failed = [];
+  let files;
+  try {
+    files = await listFiles(sync, options.executionId);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return {
+      downloaded: 0,
+      candidates: 0,
+      skipped,
+      failed: [`file listing (${reason})`]
+    };
+  }
+  let downloaded = 0;
+  await Promise.all(
+    selectFiles(files, options, skipped).map(async (file) => {
+      try {
+        const bytes = await download(sync, options.executionId, file);
+        await sync.files.write(join(dir, relativeFilePath(file)), bytes);
+        downloaded++;
+      } catch (error) {
+        failed.push(
+          `${file.fileName} (${error instanceof Error ? error.message : String(error)})`
+        );
+      }
+    })
+  );
+  return { downloaded, candidates: files.length, skipped, failed };
+}
+async function pullExecution(sync, options) {
+  const execution = await sync.remote.json(
+    get(`/agents/v2/executions/${options.executionId}`)
+  );
+  const dir = executionDir(options, execution);
+  await writeText(
+    sync,
+    join(dir, "summary.json"),
+    JSON.stringify(execution, null, 2)
+  );
+  const result = {
+    execution,
+    dir,
+    written: ["summary.json"],
+    downloaded: 0,
+    candidates: 0,
+    skipped: [],
+    failed: []
+  };
+  if (execution.purgedAt) return result;
+  if (options.activities !== false && await writeActivities(sync, dir, execution))
+    result.written.push("activities.md");
+  if (options.files === false) {
+    return {
+      ...result,
+      skippedBy: options.activities === false ? "--summary-only" : "--no-files"
+    };
+  }
+  return { ...result, ...await pullFiles(sync, dir, options) };
+}
+function filesLine(result) {
+  const parts = [...result.written];
+  if (result.downloaded > 0) parts.push(`${result.downloaded} downloaded`);
+  const counted = `Files: ${result.written.length + result.downloaded} written (${parts.join(", ")})`;
+  if (result.skippedBy)
+    return `${counted}; downloads skipped (${result.skippedBy})`;
+  if (result.candidates === 0) return `${counted}; no execution files matched`;
+  return counted;
+}
+function failures(execution) {
+  const list = execution.scriptFailures ?? [];
+  if (list.length === 0) return null;
+  const lines = list.map(
+    (f) => `  - ${f.nodeName ?? "(unknown node)"}: ${(f.error ?? "").split("\n")[0]}`
+  );
+  return `Script failures: ${list.length}
+${lines.join("\n")}`;
+}
+function purged(result) {
+  const { execution } = result;
+  return [
+    `Execution: ${execution.id}`,
+    `Status: ${execution.status}`,
+    `Purged: ${execution.purgedAt}`,
+    "This run was retention-purged. Activities, files, inputs and result are gone. Do not diagnose it.",
+    `Written to: ${result.dir}/`
+  ].join("\n");
+}
+function formatExecutionPull(result) {
+  const { execution } = result;
+  if (execution.purgedAt) return purged(result);
+  const outcome = execution.executionResult;
+  return [
+    `Execution: ${execution.id}`,
+    `Status: ${execution.status}`,
+    `Workflow: ${execution.workflowName ?? execution.workflowId}`,
+    execution.workflowVersionId ? `Workflow version: ${execution.workflowVersionId}` : null,
+    execution.inputs ? `Inputs: ${JSON.stringify(execution.inputs)}` : null,
+    outcome ? `Result: ${outcome.outcome}: ${outcome.reasoning}` : null,
+    `Created: ${execution.createdAt}`,
+    execution.terminalAt ? `Completed: ${execution.terminalAt}` : null,
+    execution.duration != null ? `Duration: ${execution.duration.toFixed(1)}s` : null,
+    failures(execution),
+    filesLine(result),
+    result.skipped.length > 0 ? `Skipped:
+${result.skipped.map((s) => `  - ${s}`).join("\n")}` : null,
+    result.failed.length > 0 ? `Failed: ${result.failed.join(", ")}` : null,
+    `Written to: ${result.dir}/`
+  ].filter(Boolean).join("\n");
+}
+
+// src/sync/node-files.ts
+import { mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises";
+import { dirname, relative, resolve, sep } from "node:path";
+function missing(error) {
+  return error.code === "ENOENT";
+}
+async function walk(root, dir, out) {
+  for (const entry of await readdir(dir, { withFileTypes: true })) {
+    const path = resolve(dir, entry.name);
+    if (entry.isDirectory()) await walk(root, path, out);
+    else if (entry.isFile())
+      out.push(relative(root, path).split(sep).join("/"));
+  }
+}
+function nodeFiles(cwd) {
+  const at = (path) => resolve(cwd, path);
+  return {
+    async read(path) {
+      try {
+        return new Uint8Array(await readFile(at(path)));
+      } catch (error) {
+        if (missing(error)) return void 0;
+        throw error;
+      }
+    },
+    async write(path, bytes) {
+      await mkdir(dirname(at(path)), { recursive: true });
+      await writeFile(at(path), bytes);
+    },
+    async remove(path) {
+      await rm(at(path), { force: true });
+    },
+    async list(dir) {
+      const out = [];
+      try {
+        await walk(at(dir), at(dir), out);
+      } catch (error) {
+        if (!missing(error)) throw error;
+      }
+      return out.sort();
+    }
+  };
+}
+
+// src/sync/workflow-pull.ts
+var CONCURRENCY = 16;
+function pullDir(root, tree, head) {
+  const base = workflowRoot(root, tree.workflowName);
+  if (head) return join(base, "head");
+  return join(base, ".versions", workflowDirName(tree.versionId, tree.version));
+}
+async function agentFileBytes(sync, workflowId, tree, entry) {
+  const path = `/agents/v2/workflows/${workflowId}/versions/${tree.versionId}/files/${entry.fileId}/signed-url`;
+  const { url } = await sync.remote.json(get(path));
+  return sync.remote.download(url);
+}
+async function entryBytes(sync, workflowId, tree, entry) {
+  if (entry.contentBase64 !== void 0)
+    return Buffer.from(entry.contentBase64, "base64");
+  if (entry.content !== void 0) return Buffer.from(entry.content, "utf8");
+  if (!entry.fileId) return void 0;
+  return agentFileBytes(sync, workflowId, tree, entry);
+}
+async function writeEntries(sync, options, tree, dir) {
+  const hashes = {};
+  const skipped = [];
+  let shared = 0;
+  const wanted = tree.files.filter((entry) => {
+    if (!isContained(entry.path)) skipped.push(`${entry.path} (unsafe path)`);
+    else if (options.maxFileBytes !== void 0 && entry.size > options.maxFileBytes)
+      skipped.push(`${entry.path} (${entry.size} bytes, over the size limit)`);
+    else return true;
+    return false;
+  });
+  for (let i = 0; i < wanted.length; i += CONCURRENCY) {
+    await Promise.all(
+      wanted.slice(i, i + CONCURRENCY).map(async (entry) => {
+        const bytes = await entryBytes(sync, options.workflowId, tree, entry);
+        if (!bytes) return void skipped.push(`${entry.path} (no content)`);
+        await sync.files.write(join(dir, entry.path), bytes);
+        hashes[entry.path] = sha256(bytes);
+        if (entry.kind === "agent_file") shared++;
+      })
+    );
+  }
+  return { hashes, skipped, shared };
+}
+async function removeStale(sync, dir, keep) {
+  for (const path of await sync.files.list(dir)) {
+    if (!keep.has(path) && path !== MANIFEST)
+      await sync.files.remove(join(dir, path));
+  }
+}
+async function writeManifest(sync, dir, manifest) {
+  const text2 = `${JSON.stringify(manifest, null, 2)}
+`;
+  await sync.files.write(join(dir, MANIFEST), Buffer.from(text2, "utf8"));
+}
+async function pullWorkflow(sync, options) {
+  const request = {
+    ...options.request,
+    query: new URLSearchParams(options.request.query)
+  };
+  request.query.set("contents", "all");
+  const tree = await sync.remote.json(request);
+  const head = request.path.endsWith("/head/files");
+  const dir = options.dir ?? pullDir(options.root ?? "", tree, head);
+  const { hashes, skipped, shared } = await writeEntries(
+    sync,
+    options,
+    tree,
+    dir
+  );
+  await removeStale(sync, dir, new Set(Object.keys(hashes)));
+  if (options.manifest !== false) {
+    await writeManifest(sync, dir, {
+      workflowId: options.workflowId,
+      versionId: tree.versionId,
+      head,
+      rev: tree.rev,
+      files: hashes
+    });
+  }
+  return {
+    workflowId: options.workflowId,
+    workflowName: tree.workflowName,
+    versionId: tree.versionId,
+    version: tree.version,
+    rev: tree.rev,
+    dir,
+    head,
+    written: Object.keys(hashes).length,
+    shared,
+    skipped
+  };
+}
+function formatWorkflowPull(result) {
+  const definition = result.written - result.shared;
+  const files = result.written === 0 ? "Files: none written" : result.shared === 0 ? `Files: ${result.written} written` : `Files: ${result.written} written (${definition} workflow definition, ${result.shared} shared)`;
+  return [
+    `Workflow: ${result.workflowName} (${result.workflowId})`,
+    `Workflow version: ${result.versionId}${result.version ? ` (v${result.version})` : " (draft)"}`,
+    `Written to: ${result.dir}/`,
+    files,
+    result.skipped.length > 0 ? `Skipped:
+${result.skipped.map((s) => `  - ${s}`).join("\n")}` : null,
+    result.head ? `Edit the files, then run \`asteroid workflow push\` from ${result.dir}/.` : "This is a pinned version. It is read-only."
+  ].filter(Boolean).join("\n");
+}
+
+// src/sync/workflow-push.ts
+async function readManifest(sync, dir) {
+  const bytes = await sync.files.read(join(dir, MANIFEST));
+  if (!bytes) {
+    throw new UsageError(
+      `no pulled workflow in ${dir}. Run \`asteroid workflow pull <workflow-id>\`, then push from the head folder it writes.`
+    );
+  }
+  const manifest = JSON.parse(Buffer.from(bytes).toString("utf8"));
+  if (!manifest.head) {
+    throw new UsageError(
+      `${dir} holds a pinned workflow version, which is read-only. Push from a pulled head.`
+    );
+  }
+  return manifest;
+}
+async function localChanges(sync, dir, manifest) {
+  const local2 = (await sync.files.list(dir)).filter(
+    (path) => path !== MANIFEST
+  );
+  const writes = [];
+  for (const path of local2) {
+    const bytes = await sync.files.read(join(dir, path));
+    if (!bytes) continue;
+    const hash = sha256(bytes);
+    if (manifest.files[path] === hash) continue;
+    writes.push({
+      path,
+      contentBase64: Buffer.from(bytes).toString("base64"),
+      hash
+    });
+  }
+  const present = new Set(local2);
+  const deletes = Object.keys(manifest.files).filter(
+    (path) => !present.has(path)
+  );
+  return { writes, deletes };
+}
+async function patch(sync, manifest, writes, deletes) {
+  try {
+    await sync.remote.json({
+      method: "PATCH",
+      path: `/agents/v2/workflows/${manifest.workflowId}/head/files`,
+      query: new URLSearchParams(),
+      json: { baseRev: manifest.rev, writes, deletes }
+    });
+  } catch (error) {
+    if (statusOf(error) !== 409) throw error;
+    throw new UsageError(
+      `the workflow head changed since your pull (rev ${manifest.rev}). Copy your edits aside, run \`asteroid workflow pull ${manifest.workflowId}\`, reapply them, then push again.`
+    );
+  }
+}
+async function refresh(sync, dir, manifest, pushed) {
+  const tree = await sync.remote.json(
+    get(`/agents/v2/workflows/${manifest.workflowId}/head/files`)
+  );
+  const files = {};
+  for (const entry of tree.files) {
+    if (entry.content !== void 0) {
+      const bytes = Buffer.from(entry.content, "utf8");
+      files[entry.path] = sha256(bytes);
+      if (pushed.get(entry.path) !== files[entry.path])
+        await sync.files.write(join(dir, entry.path), bytes);
+    } else {
+      const local2 = await sync.files.read(join(dir, entry.path));
+      const hash = local2 ? sha256(local2) : pushed.get(entry.path) ?? entry.checksum;
+      if (hash) files[entry.path] = hash;
+    }
+  }
+  for (const path of await sync.files.list(dir)) {
+    if (path !== MANIFEST && !(path in files))
+      await sync.files.remove(join(dir, path));
+  }
+  const next = { ...manifest, versionId: tree.versionId, rev: tree.rev, files };
+  await writeManifest(sync, dir, next);
+  return next;
+}
+async function pushWorkflow(sync, dir, workflowId) {
+  const manifest = await readManifest(sync, dir);
+  if (workflowId !== void 0 && manifest.workflowId !== workflowId) {
+    throw new UsageError(
+      `${dir} holds workflow ${manifest.workflowId}, not ${workflowId}.`
+    );
+  }
+  const { writes, deletes } = await localChanges(sync, dir, manifest);
+  const result = {
+    workflowId: manifest.workflowId,
+    dir,
+    written: writes.map((w) => w.path),
+    deleted: deletes
+  };
+  if (writes.length === 0 && deletes.length === 0) {
+    return { ...result, rev: manifest.rev, versionId: manifest.versionId };
+  }
+  await patch(
+    sync,
+    manifest,
+    writes.map(({ path, contentBase64 }) => ({ path, contentBase64 })),
+    deletes
+  );
+  const next = await refresh(
+    sync,
+    dir,
+    manifest,
+    new Map(writes.map((w) => [w.path, w.hash]))
+  );
+  return { ...result, rev: next.rev, versionId: next.versionId };
+}
+function formatWorkflowPush(result) {
+  if (result.written.length === 0 && result.deleted.length === 0) {
+    return `Nothing to push: ${result.dir}/ matches the head you pulled (rev ${result.rev}).`;
+  }
+  return [
+    `Pushed to workflow ${result.workflowId}: ${result.written.length} written, ${result.deleted.length} deleted.`,
+    ...result.written.map((path) => `  + ${path}`),
+    ...result.deleted.map((path) => `  - ${path}`),
+    `Head is now rev ${result.rev} (version ${result.versionId}).`
+  ].join("\n");
+}
+
+// src/sync/run.ts
+function flag(parsed, name) {
+  return parsed.flags.get(name)?.at(-1);
+}
+function integer(parsed, name) {
+  const raw = flag(parsed, name);
+  if (raw === void 0) return void 0;
+  if (!/^\d+$/.test(raw))
+    throw new UsageError(`--${name} must be a whole number`);
+  return Number(raw);
+}
+function executionOptions(parsed) {
+  const summaryOnly = flag(parsed, "summary-only") === "true";
+  const glob = flag(parsed, "files");
+  const dir = flag(parsed, "dir");
+  return {
+    executionId: parsed.positionals[0],
+    activities: !summaryOnly,
+    files: !summaryOnly && glob !== "false",
+    glob: glob === "false" ? void 0 : glob,
+    maxFileBytes: integer(parsed, "max-file-size"),
+    dir: dir ? () => dir : void 0
+  };
+}
+function withoutFlag(parsed, name) {
+  const flags = new Map(parsed.flags);
+  flags.delete(name);
+  return { ...parsed, flags };
+}
+var PARTIAL = ["paths", "variants"];
+function rejectPartial(parsed) {
+  const used = PARTIAL.filter((name) => parsed.flags.has(name));
+  if (used.length === 0) return;
+  throw new UsageError(
+    `pull writes the whole tree, so it cannot take ${used.map((name) => `--${name}`).join(" or ")}. Add --json to list those files instead.`
+  );
+}
+async function pull(command, parsed, sync, deps) {
+  rejectPartial(parsed);
+  const result = await pullWorkflow(sync, {
+    workflowId: parsed.positionals[0],
+    request: await buildRequest(command, withoutFlag(parsed, "out"), {
+      io: deps.io
+    }),
+    dir: flag(parsed, "out"),
+    root: deps.root ?? "",
+    ...deps.workflowPull
+  });
+  return { result, text: formatWorkflowPull(result) };
+}
+async function execute(command, parsed, sync, deps) {
+  if (command.files === "pull") return pull(command, parsed, sync, deps);
+  if (command.files === "push") {
+    const result2 = await pushWorkflow(
+      sync,
+      flag(parsed, "from") ?? ".",
+      parsed.positionals[0] || void 0
+    );
+    return { result: result2, text: formatWorkflowPush(result2) };
+  }
+  if (command.command !== "execution pull")
+    throw new UsageError(`unknown command ${command.command}`);
+  const result = await pullExecution(sync, {
+    ...executionOptions(parsed),
+    root: deps.root ?? "",
+    ...deps.executionPull
+  });
+  return { result, text: formatExecutionPull(result) };
+}
+async function runSync(command, parsed, deps) {
+  const sync = {
+    remote: deps.remote,
+    files: deps.files ?? nodeFiles(deps.cwd)
+  };
+  const { result, text: text2 } = await execute(command, parsed, sync, deps);
+  deps.stdout(`${parsed.json ? JSON.stringify(result, null, 2) : text2}
+`);
+  return 0;
+}
 export {
+  ALL_COMMANDS,
   COMMANDS,
+  MANIFEST,
+  SYNC_COMMANDS,
   UsageError,
   buildRequest,
+  formatActivitiesMarkdown,
+  formatExecutionPull,
+  formatWorkflowPull,
+  formatWorkflowPush,
   leadingWords,
   matchCommand,
+  matchesGlob,
   parseInvocation,
-  render
+  pullExecution,
+  pullWorkflow,
+  pushWorkflow,
+  render,
+  runSync,
+  withSyncCommands
 };