@corenel/cli 0.3.0 → 0.3.2

package/dist/cli.js

@@ -324,13 +324,13 @@ var require_directives = __commonJS({
               onError(0, "%YAML directive should contain exactly one part");
               return false;
             }
-            const [version] = parts;
-            if (version === "1.1" || version === "1.2") {
-              this.yaml.version = version;
+            const [version2] = parts;
+            if (version2 === "1.1" || version2 === "1.2") {
+              this.yaml.version = version2;
               return true;
             } else {
-              const isValid = /^\d+\.\d+$/.test(version);
-              onError(6, `Unsupported YAML version ${version}`, isValid);
+              const isValid = /^\d+\.\d+$/.test(version2);
+              onError(6, `Unsupported YAML version ${version2}`, isValid);
               return false;
             }
           }
@@ -3430,14 +3430,14 @@ var require_Document = __commonJS({
           version: "1.2"
         }, options);
         this.options = opt;
-        let { version } = opt;
+        let { version: version2 } = opt;
         if (options?._directives) {
           this.directives = options._directives.atDocument();
           if (this.directives.yaml.explicit)
-            version = this.directives.yaml.version;
+            version2 = this.directives.yaml.version;
         } else
-          this.directives = new directives.Directives({ version });
-        this.setSchema(version, options);
+          this.directives = new directives.Directives({ version: version2 });
+        this.setSchema(version2, options);
         this.contents = value === void 0 ? null : this.createNode(value, _replacer, options);
       }
       /**
@@ -3617,11 +3617,11 @@ var require_Document = __commonJS({
        *
        * Overrides all previously set schema options.
        */
-      setSchema(version, options = {}) {
-        if (typeof version === "number")
-          version = String(version);
+      setSchema(version2, options = {}) {
+        if (typeof version2 === "number")
+          version2 = String(version2);
         let opt;
-        switch (version) {
+        switch (version2) {
           case "1.1":
             if (this.directives)
               this.directives.yaml.version = "1.1";
@@ -3632,9 +3632,9 @@ var require_Document = __commonJS({
           case "1.2":
           case "next":
             if (this.directives)
-              this.directives.yaml.version = version;
+              this.directives.yaml.version = version2;
             else
-              this.directives = new directives.Directives({ version });
+              this.directives = new directives.Directives({ version: version2 });
             opt = { resolveKnownTags: true, schema: "core" };
             break;
           case null:
@@ -3643,7 +3643,7 @@ var require_Document = __commonJS({
             opt = null;
             break;
           default: {
-            const sv = JSON.stringify(version);
+            const sv = JSON.stringify(version2);
             throw new Error(`Expected '1.1', '1.2' or null as first argument, but found: ${sv}`);
           }
         }
@@ -7541,31 +7541,31 @@ var require_semver = __commonJS({
       return true;
     };
     var SemVer = class _SemVer {
-      constructor(version, options) {
+      constructor(version2, options) {
         options = parseOptions(options);
-        if (version instanceof _SemVer) {
-          if (version.loose === !!options.loose && version.includePrerelease === !!options.includePrerelease) {
-            return version;
+        if (version2 instanceof _SemVer) {
+          if (version2.loose === !!options.loose && version2.includePrerelease === !!options.includePrerelease) {
+            return version2;
           } else {
-            version = version.version;
+            version2 = version2.version;
           }
-        } else if (typeof version !== "string") {
-          throw new TypeError(`Invalid version. Must be a string. Got type "${typeof version}".`);
+        } else if (typeof version2 !== "string") {
+          throw new TypeError(`Invalid version. Must be a string. Got type "${typeof version2}".`);
         }
-        if (version.length > MAX_LENGTH) {
+        if (version2.length > MAX_LENGTH) {
           throw new TypeError(
             `version is longer than ${MAX_LENGTH} characters`
           );
         }
-        debug("SemVer", version, options);
+        debug("SemVer", version2, options);
         this.options = options;
         this.loose = !!options.loose;
         this.includePrerelease = !!options.includePrerelease;
-        const m = version.trim().match(options.loose ? re[t.LOOSE] : re[t.FULL]);
+        const m = version2.trim().match(options.loose ? re[t.LOOSE] : re[t.FULL]);
         if (!m) {
-          throw new TypeError(`Invalid Version: ${version}`);
+          throw new TypeError(`Invalid Version: ${version2}`);
         }
-        this.raw = version;
+        this.raw = version2;
         this.major = +m[1];
         this.minor = +m[2];
         this.patch = +m[3];
@@ -7812,12 +7812,12 @@ var require_parse = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/parse.js"(exports, module) {
     "use strict";
     var SemVer = require_semver();
-    var parse3 = (version, options, throwErrors = false) => {
-      if (version instanceof SemVer) {
-        return version;
+    var parse3 = (version2, options, throwErrors = false) => {
+      if (version2 instanceof SemVer) {
+        return version2;
       }
       try {
-        return new SemVer(version, options);
+        return new SemVer(version2, options);
       } catch (er) {
         if (!throwErrors) {
           return null;
@@ -7834,8 +7834,8 @@ var require_valid = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/valid.js"(exports, module) {
     "use strict";
     var parse3 = require_parse();
-    var valid = (version, options) => {
-      const v = parse3(version, options);
+    var valid = (version2, options) => {
+      const v = parse3(version2, options);
       return v ? v.version : null;
     };
     module.exports = valid;
@@ -7847,8 +7847,8 @@ var require_clean = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/clean.js"(exports, module) {
     "use strict";
     var parse3 = require_parse();
-    var clean = (version, options) => {
-      const s = parse3(version.trim().replace(/^[=v]+/, ""), options);
+    var clean = (version2, options) => {
+      const s = parse3(version2.trim().replace(/^[=v]+/, ""), options);
       return s ? s.version : null;
     };
     module.exports = clean;
@@ -7860,7 +7860,7 @@ var require_inc = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/inc.js"(exports, module) {
     "use strict";
     var SemVer = require_semver();
-    var inc = (version, release, options, identifier, identifierBase) => {
+    var inc = (version2, release, options, identifier, identifierBase) => {
       if (typeof options === "string") {
         identifierBase = identifier;
         identifier = options;
@@ -7868,7 +7868,7 @@ var require_inc = __commonJS({
       }
       try {
         return new SemVer(
-          version instanceof SemVer ? version.version : version,
+          version2 instanceof SemVer ? version2.version : version2,
           options
         ).inc(release, identifier, identifierBase).version;
       } catch (er) {
@@ -7958,8 +7958,8 @@ var require_prerelease = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/prerelease.js"(exports, module) {
     "use strict";
     var parse3 = require_parse();
-    var prerelease = (version, options) => {
-      const parsed = parse3(version, options);
+    var prerelease = (version2, options) => {
+      const parsed = parse3(version2, options);
       return parsed && parsed.prerelease.length ? parsed.prerelease : null;
     };
     module.exports = prerelease;
@@ -8147,24 +8147,24 @@ var require_coerce = __commonJS({
     var SemVer = require_semver();
     var parse3 = require_parse();
     var { safeRe: re, t } = require_re();
-    var coerce = (version, options) => {
-      if (version instanceof SemVer) {
-        return version;
+    var coerce = (version2, options) => {
+      if (version2 instanceof SemVer) {
+        return version2;
       }
-      if (typeof version === "number") {
-        version = String(version);
+      if (typeof version2 === "number") {
+        version2 = String(version2);
       }
-      if (typeof version !== "string") {
+      if (typeof version2 !== "string") {
         return null;
       }
       options = options || {};
       let match = null;
       if (!options.rtl) {
-        match = version.match(options.includePrerelease ? re[t.COERCEFULL] : re[t.COERCE]);
+        match = version2.match(options.includePrerelease ? re[t.COERCEFULL] : re[t.COERCE]);
       } else {
         const coerceRtlRegex = options.includePrerelease ? re[t.COERCERTLFULL] : re[t.COERCERTL];
         let next;
-        while ((next = coerceRtlRegex.exec(version)) && (!match || match.index + match[0].length !== version.length)) {
+        while ((next = coerceRtlRegex.exec(version2)) && (!match || match.index + match[0].length !== version2.length)) {
           if (!match || next.index + next[0].length !== match.index + match[0].length) {
             match = next;
           }
@@ -8193,37 +8193,37 @@ var require_truncate = __commonJS({
     var parse3 = require_parse();
     var constants = require_constants();
     var SemVer = require_semver();
-    var truncate = (version, truncation, options) => {
+    var truncate2 = (version2, truncation, options) => {
       if (!constants.RELEASE_TYPES.includes(truncation)) {
         return null;
       }
-      const clonedVersion = cloneInputVersion(version, options);
+      const clonedVersion = cloneInputVersion(version2, options);
       return clonedVersion && doTruncation(clonedVersion, truncation);
     };
-    var cloneInputVersion = (version, options) => {
-      const versionStringToParse = version instanceof SemVer ? version.version : version;
+    var cloneInputVersion = (version2, options) => {
+      const versionStringToParse = version2 instanceof SemVer ? version2.version : version2;
       return parse3(versionStringToParse, options);
     };
-    var doTruncation = (version, truncation) => {
+    var doTruncation = (version2, truncation) => {
       if (isPrerelease(truncation)) {
-        return version.version;
+        return version2.version;
       }
-      version.prerelease = [];
+      version2.prerelease = [];
       switch (truncation) {
         case "major":
-          version.minor = 0;
-          version.patch = 0;
+          version2.minor = 0;
+          version2.patch = 0;
           break;
         case "minor":
-          version.patch = 0;
+          version2.patch = 0;
           break;
       }
-      return version.format();
+      return version2.format();
     };
     var isPrerelease = (type) => {
       return type.startsWith("pre");
     };
-    module.exports = truncate;
+    module.exports = truncate2;
   }
 });
 
@@ -8390,19 +8390,19 @@ var require_range = __commonJS({
         });
       }
       // if ANY of the sets match ALL of its comparators, then pass
-      test(version) {
-        if (!version) {
+      test(version2) {
+        if (!version2) {
           return false;
         }
-        if (typeof version === "string") {
+        if (typeof version2 === "string") {
           try {
-            version = new SemVer(version, this.options);
+            version2 = new SemVer(version2, this.options);
           } catch (er) {
             return false;
           }
         }
         for (let i = 0; i < this.set.length; i++) {
-          if (testSet(this.set[i], version, this.options)) {
+          if (testSet(this.set[i], version2, this.options)) {
             return true;
           }
         }
@@ -8624,13 +8624,13 @@ var require_range = __commonJS({
       }
       return `${from} ${to}`.trim();
     };
-    var testSet = (set, version, options) => {
+    var testSet = (set, version2, options) => {
       for (let i = 0; i < set.length; i++) {
-        if (!set[i].test(version)) {
+        if (!set[i].test(version2)) {
           return false;
         }
       }
-      if (version.prerelease.length && !options.includePrerelease) {
+      if (version2.prerelease.length && !options.includePrerelease) {
         for (let i = 0; i < set.length; i++) {
           debug(set[i].semver);
           if (set[i].semver === Comparator.ANY) {
@@ -8638,7 +8638,7 @@ var require_range = __commonJS({
           }
           if (set[i].semver.prerelease.length > 0) {
             const allowed = set[i].semver;
-            if (allowed.major === version.major && allowed.minor === version.minor && allowed.patch === version.patch) {
+            if (allowed.major === version2.major && allowed.minor === version2.minor && allowed.patch === version2.patch) {
               return true;
             }
           }
@@ -8699,19 +8699,19 @@ var require_comparator = __commonJS({
       toString() {
         return this.value;
       }
-      test(version) {
-        debug("Comparator.test", version, this.options.loose);
-        if (this.semver === ANY || version === ANY) {
+      test(version2) {
+        debug("Comparator.test", version2, this.options.loose);
+        if (this.semver === ANY || version2 === ANY) {
           return true;
         }
-        if (typeof version === "string") {
+        if (typeof version2 === "string") {
           try {
-            version = new SemVer(version, this.options);
+            version2 = new SemVer(version2, this.options);
           } catch (er) {
             return false;
           }
         }
-        return cmp(version, this.operator, this.semver, this.options);
+        return cmp(version2, this.operator, this.semver, this.options);
       }
       intersects(comp, options) {
         if (!(comp instanceof _Comparator)) {
@@ -8768,13 +8768,13 @@ var require_satisfies = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/satisfies.js"(exports, module) {
     "use strict";
     var Range = require_range();
-    var satisfies = (version, range, options) => {
+    var satisfies = (version2, range, options) => {
       try {
         range = new Range(range, options);
       } catch (er) {
         return false;
       }
-      return range.test(version);
+      return range.test(version2);
     };
     module.exports = satisfies;
   }
@@ -8934,8 +8934,8 @@ var require_outside = __commonJS({
     var lt = require_lt();
     var lte = require_lte();
     var gte = require_gte();
-    var outside = (version, range, hilo, options) => {
-      version = new SemVer(version, options);
+    var outside = (version2, range, hilo, options) => {
+      version2 = new SemVer(version2, options);
       range = new Range(range, options);
       let gtfn, ltefn, ltfn, comp, ecomp;
       switch (hilo) {
@@ -8956,7 +8956,7 @@ var require_outside = __commonJS({
         default:
           throw new TypeError('Must provide a hilo val of "<" or ">"');
       }
-      if (satisfies(version, range, options)) {
+      if (satisfies(version2, range, options)) {
         return false;
       }
       for (let i = 0; i < range.set.length; ++i) {
@@ -8978,9 +8978,9 @@ var require_outside = __commonJS({
         if (high.operator === comp || high.operator === ecomp) {
           return false;
         }
-        if ((!low.operator || low.operator === comp) && ltefn(version, low.semver)) {
+        if ((!low.operator || low.operator === comp) && ltefn(version2, low.semver)) {
           return false;
-        } else if (low.operator === ecomp && ltfn(version, low.semver)) {
+        } else if (low.operator === ecomp && ltfn(version2, low.semver)) {
           return false;
         }
       }
@@ -8995,7 +8995,7 @@ var require_gtr = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/ranges/gtr.js"(exports, module) {
     "use strict";
     var outside = require_outside();
-    var gtr = (version, range, options) => outside(version, range, ">", options);
+    var gtr = (version2, range, options) => outside(version2, range, ">", options);
     module.exports = gtr;
   }
 });
@@ -9005,7 +9005,7 @@ var require_ltr = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/ranges/ltr.js"(exports, module) {
     "use strict";
     var outside = require_outside();
-    var ltr = (version, range, options) => outside(version, range, "<", options);
+    var ltr = (version2, range, options) => outside(version2, range, "<", options);
     module.exports = ltr;
   }
 });
@@ -9035,12 +9035,12 @@ var require_simplify = __commonJS({
       let first = null;
       let prev = null;
       const v = versions.sort((a, b) => compare(a, b, options));
-      for (const version of v) {
-        const included = satisfies(version, range, options);
+      for (const version2 of v) {
+        const included = satisfies(version2, range, options);
         if (included) {
-          prev = version;
+          prev = version2;
           if (!first) {
-            first = version;
+            first = version2;
           }
         } else {
           if (prev) {
@@ -9267,7 +9267,7 @@ var require_semver2 = __commonJS({
     var lte = require_lte();
     var cmp = require_cmp();
     var coerce = require_coerce();
-    var truncate = require_truncate();
+    var truncate2 = require_truncate();
     var Comparator = require_comparator();
     var Range = require_range();
     var satisfies = require_satisfies();
@@ -9306,7 +9306,7 @@ var require_semver2 = __commonJS({
       lte,
       cmp,
       coerce,
-      truncate,
+      truncate: truncate2,
       Comparator,
       Range,
       satisfies,
@@ -13261,7 +13261,7 @@ var require_filters = __commonJS({
       return r.copySafeness(str5, res);
     }
     _exports.indent = indent;
-    function join5(arr, del, attr) {
+    function join6(arr, del, attr) {
       del = del || "";
       if (attr) {
         arr = lib.map(arr, function(v) {
@@ -13270,7 +13270,7 @@ var require_filters = __commonJS({
       }
       return arr.join(del);
     }
-    _exports.join = join5;
+    _exports.join = join6;
     function last(arr) {
       return arr[arr.length - 1];
     }
@@ -13511,7 +13511,7 @@ var require_filters = __commonJS({
       return r.copySafeness(str5, str5.replace(/^\s*|\s*$/g, ""));
     }
     _exports.trim = trim;
-    function truncate(input, length, killwords, end) {
+    function truncate2(input, length, killwords, end) {
       var orig = input;
       input = normalize(input, "");
       length = length || 255;
@@ -13530,7 +13530,7 @@ var require_filters = __commonJS({
       input += end !== void 0 && end !== null ? end : "...";
       return r.copySafeness(orig, input);
     }
-    _exports.truncate = truncate;
+    _exports.truncate = truncate2;
     function upper(str5) {
       str5 = normalize(str5, "");
       return str5.toUpperCase();
@@ -15039,7 +15039,7 @@ import OpenAI from "openai";
 var enabled = true;
 function setAgentLogging(on) {
   enabled = on;
-  console.log(`[agent] logging ${on ? "enabled" : "disabled"}`);
+  if (on) console.log("[agent] logging enabled");
 }
 function alog(...args) {
   if (enabled) console.debug("[agent]", ...args);
@@ -15708,7 +15708,7 @@ function reconcileDanglingToolCalls(messages) {
 }
 
 // src/cli.ts
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 
 // ../harness/tools/registry.ts
 var registry = /* @__PURE__ */ new Map();
@@ -16436,14 +16436,14 @@ var spawnAgentsTool = {
   },
   async run(args, ctx) {
     if (!ctx.spawn) return "Sub-agents are not available here (depth limit reached or unsupported context).";
-    const spawn2 = ctx.spawn;
+    const spawn3 = ctx.spawn;
     const raw = Array.isArray(args.tasks) ? args.tasks : [];
     const reqs = raw.map((t) => spawnReq(t && typeof t === "object" ? t : {})).filter((r) => r !== null);
     if (!reqs.length) return "Error: `tasks` must contain at least one task with a non-empty `task` string.";
     const results = await Promise.all(
       reqs.map(async (req, i) => {
         try {
-          const r = await spawn2(req);
+          const r = await spawn3(req);
           return `### Sub-agent ${i + 1}
 ${r.text}${spawnFooter(r)}`;
         } catch (e) {
@@ -17297,6 +17297,12 @@ async function readAuthToken() {
     return null;
   }
 }
+async function clearAuthToken() {
+  try {
+    await fs2.rm(authTokenPath(), { force: true });
+  } catch {
+  }
+}
 function nodeAuthToken() {
   return { getToken: async () => await readAuthToken() ?? process.env.CORENEL_TOKEN ?? null };
 }
@@ -17429,9 +17435,9 @@ var PrompdParser = class {
     }
     return issues;
   }
-  isValidSemver(version) {
+  isValidSemver(version2) {
     const semverRegex = /^(\d+)\.(\d+)\.(\d+)$/;
-    return semverRegex.test(version);
+    return semverRegex.test(version2);
   }
 };
 var PACKAGE_TYPE_DIRS = {
@@ -17613,17 +17619,17 @@ function parsePackageReference(packageRef) {
   }
   const name = match[1];
   const rawVersion = match[2] || "latest";
-  const version = import_semver.default.valid(rawVersion) || rawVersion;
+  const version2 = import_semver.default.valid(rawVersion) || rawVersion;
   const scopeMatch = name.match(/^(@[\w.-]+)\//);
   const scope = scopeMatch ? scopeMatch[1] : void 0;
-  return { name, version, scope };
+  return { name, version: version2, scope };
 }
 function parsePackageReferenceWithPath(packageRef) {
-  const { name, version, scope } = parsePackageReference(packageRef);
+  const { name, version: version2, scope } = parsePackageReference(packageRef);
   const stripped = stripFilePath(packageRef);
   const remainder = packageRef.slice(stripped.length);
   const filePath = remainder.length > 1 ? remainder.slice(1) : void 0;
-  return { name, version, scope, filePath };
+  return { name, version: version2, scope, filePath };
 }
 function resolvePackageFile(packagePath, filePath) {
   const normalized = posixNormalize(filePath.replace(/\\/g, "/"));
@@ -20123,8 +20129,8 @@ var MemoryFileSystem = class {
     return joinPosix2(...pathSegments);
   }
   /** Get the virtual file system path for a package. */
-  getPackagePath(packageName, version) {
-    return `/packages/${packageName}@${version}`;
+  getPackagePath(packageName, version2) {
+    return `/packages/${packageName}@${version2}`;
   }
   /** Get all files under an optional base path. */
   getAllFiles(basePath) {
@@ -20350,6 +20356,7 @@ function nodeToolCtx(signal, opts = {}) {
     kv: inMemoryKv(),
     search: nullSearch,
     confirm: async () => true,
+    ...opts.ask ? { ask: opts.ask } : {},
     ...opts.files ? { files: opts.files, fileMeta: { kind: opts.files.kind, label: opts.files.label, isLocalDisk: opts.files.isLocalDisk, writable: opts.files.writable } } : {}
   };
 }
@@ -20420,6 +20427,12 @@ async function deviceLogin(opts) {
   }
 }
 
+// src/apiBase.ts
+var DEFAULT_API_BASE = "https://api.corenel.ai/api";
+function apiBase2(explicit) {
+  return explicit || process.env.CORENEL_API_BASE || DEFAULT_API_BASE;
+}
+
 // ../crew/frontmatter.ts
 var import_yaml = __toESM(require_dist(), 1);
 var FRONTMATTER = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
@@ -20605,6 +20618,90 @@ async function loadCrewAgentAtIfExists(files, root, name, scope = "workspace") {
   }
 }
 
+// ../harness/guardrail/permission-service.ts
+var LEVEL_RANK = { allow: 0, ask: 1, deny: 2 };
+function subjectMatches(tool, glob) {
+  if (tool.address && matchesAnyGlob(tool.address, [glob])) return true;
+  return matchesAnyGlob(tool.name, [glob]);
+}
+function specificity(glob) {
+  const literal = glob.replace(/\*/g, "").length;
+  return (glob.includes("*") ? 0 : 1e4) + literal;
+}
+function matchLevel(tool, rules) {
+  let best;
+  let bestScore = -1;
+  for (const [glob, level] of Object.entries(rules)) {
+    if (!subjectMatches(tool, glob)) continue;
+    const score = specificity(glob);
+    if (score > bestScore) {
+      bestScore = score;
+      best = level;
+    }
+  }
+  return best;
+}
+function mostRestrictive(a, b) {
+  return LEVEL_RANK[a] >= LEVEL_RANK[b] ? a : b;
+}
+var PermissionService = class {
+  policy;
+  prompt;
+  defaultForReadOnly;
+  defaultForMutating;
+  ceiling;
+  sessionAllow = /* @__PURE__ */ new Set();
+  constructor(opts) {
+    this.policy = opts.policy;
+    if (opts.prompt) this.prompt = opts.prompt;
+    this.defaultForReadOnly = opts.defaultForReadOnly ?? "allow";
+    this.defaultForMutating = opts.defaultForMutating ?? "ask";
+    if (opts.ceiling) this.ceiling = opts.ceiling;
+  }
+  /** Pre-approve a tool-name glob for the rest of the session (an "ask" becomes "allow"). */
+  preApprove(toolGlob) {
+    this.sessionAllow.add(toolGlob);
+  }
+  reset() {
+    this.sessionAllow.clear();
+  }
+  async check(tool, input) {
+    const level = this.resolveLevel(tool);
+    return this.decide(level, tool.name, input);
+  }
+  /**
+   * Resolve the effective level. Base precedence (highest first):
+   *   policy.permissions glob > tool.permission > mutates heuristic > policy.defaultPermission.
+   * Then the ceiling clamps to the more restrictive of base and ceiling.
+   */
+  resolveLevel(tool) {
+    return mostRestrictive(this.resolveBaseLevel(tool), this.resolveCeilingLevel(tool));
+  }
+  resolveBaseLevel(tool) {
+    const matched = this.policy.permissions && matchLevel(tool, this.policy.permissions);
+    if (matched) return matched;
+    if (tool.mutates && this.policy.mutatingDefault) return this.policy.mutatingDefault;
+    if (tool.permission) return tool.permission;
+    if (this.policy.defaultPermission) return this.policy.defaultPermission;
+    if (tool.mutates) return this.defaultForMutating;
+    return this.defaultForReadOnly;
+  }
+  resolveCeilingLevel(tool) {
+    const c = this.ceiling;
+    if (!c) return "allow";
+    const matched = c.overrides && matchLevel(tool, c.overrides);
+    if (matched) return matched;
+    return c.defaultLevel ?? "allow";
+  }
+  async decide(level, name, input) {
+    if (level === "allow") return "allow";
+    if (level === "deny") return "deny";
+    if (this.sessionAllow.size && matchesAnyGlob(name, [...this.sessionAllow])) return "allow";
+    if (!this.prompt) return "deny";
+    return this.prompt.ask({ tool: name, input });
+  }
+};
+
 // ../harness/guardrail/serialize.ts
 var import_yaml4 = __toESM(require_dist(), 1);
 
@@ -20647,7 +20744,7 @@ async function runCrewAgentCli(opts) {
     opts.warn(`agent "${opts.agent}" is disabled; enable it before running`);
     return 2;
   }
-  setGatewayBase(opts.base ?? process.env.CORENEL_API_BASE ?? "https://api.corenel.ai/api");
+  setGatewayBase(apiBase2(opts.base));
   const token = await nodeAuthToken().getToken();
   if (!token) {
     opts.warn("not signed in: set CORENEL_TOKEN, or run `corenel login` on this machine");
@@ -20704,20 +20801,76 @@ import { createRequire } from "node:module";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname as dirname2, join as join3 } from "node:path";
 import { fileURLToPath } from "node:url";
-function sidecarArgs(rest) {
-  return rest[0] === "start" ? rest.slice(1) : rest;
+
+// src/extensions.ts
+var SIDECAR = { pkg: "@corenel/sidecar", entry: "dist/cli.js" };
+var EXTENSIONS = [
+  {
+    command: "sidecar",
+    ...SIDECAR,
+    summary: "run the sidecar on this machine",
+    // Everything after the verb is the sidecar's business -- no flag parsing
+    // here, so a flag added there needs no change in this package. A leading
+    // `start` is absorbed because it reads naturally and the sidecar has no
+    // such verb; its real subcommands must pass through untouched.
+    argv: (rest) => rest[0] === "start" ? rest.slice(1) : rest
+  },
+  {
+    command: "acp",
+    ...SIDECAR,
+    summary: "proxy an external coding agent under Corenel policy",
+    /* `corenel acp claude-code --acp-policy read-only` -> the sidecar's own flags.
+     *
+     * ONLY a bare first word is promoted to the target. Anything already spelled
+     * as a flag passes through untouched, because the sidecar is the authority
+     * on its own options -- and because injecting `--acp` in front of `--help`
+     * made the sidecar read "--help" as the name of an agent to proxy. With no
+     * arguments at all there is nothing to run, so show the flags instead of
+     * failing on a missing value. */
+    argv: (rest) => {
+      if (!rest.length) return ["--help"];
+      if (rest[0].startsWith("-")) return rest;
+      return ["--acp", rest[0], ...rest.slice(1)];
+    }
+  },
+  {
+    command: "sessions",
+    ...SIDECAR,
+    summary: "list and inspect local sandbox sessions",
+    argv: (rest) => ["sessions", ...rest]
+  }
+];
+function findExtension(command) {
+  return EXTENSIONS.find((e) => e.command === command);
+}
+var EXTENSION_COMMANDS = EXTENSIONS.map((e) => e.command);
+function missingMessage(e) {
+  return [
+    `${e.command} needs ${e.pkg}, which is not installed.`,
+    "",
+    `  npm  install -g ${e.pkg}`,
+    `  pnpm add     -g ${e.pkg}`,
+    "",
+    "It ships separately because it is a server with its own release line."
+  ].join("\n");
 }
+
+// src/sidecar.ts
 function findSidecarEntry(look = {}) {
+  return findExtensionEntry("@corenel/sidecar", "dist/cli.js", look);
+}
+function findExtensionEntry(pkg, entry, look = {}) {
   const exists = look.exists ?? existsSync;
   const req = look.resolve ?? createRequire(import.meta.url).resolve;
   try {
-    const direct = req("@corenel/sidecar/dist/cli.js");
+    const direct = req(`${pkg}/${entry}`);
     if (exists(direct)) return direct;
   } catch {
   }
   let dir = look.fromDir ?? dirname2(fileURLToPath(import.meta.url));
+  const parts = [...pkg.split("/"), ...entry.split("/")];
   for (let up = 0; up < 8; up++) {
-    const candidate = join3(dir, "node_modules", "@corenel", "sidecar", "dist", "cli.js");
+    const candidate = join3(dir, "node_modules", ...parts);
     if (exists(candidate)) return candidate;
     const parent = dirname2(dir);
     if (parent === dir) break;
@@ -20746,20 +20899,20 @@ var SIDECAR_MISSING = [
   "It ships separately because it is a server with its own release line.",
   "Once installed, `corenel sidecar \u2026` and `corenel-sidecar \u2026` are the same thing."
 ].join("\n");
-async function proxyToSidecar(rest, look = {}) {
-  const entry = findSidecarEntry(look);
+async function runExtension(ext, rest, look = {}) {
+  const entry = findExtensionEntry(ext.pkg, ext.entry, look);
   if (!entry) {
-    process.stderr.write(`corenel: ${SIDECAR_MISSING}
+    process.stderr.write(`corenel: ${missingMessage(ext)}
 `);
     return 127;
   }
-  process.stderr.write(`corenel: sidecar ${versionAt(entry)} (${entry})
+  process.stderr.write(`corenel: ${ext.pkg.replace("@corenel/", "")} ${versionAt(entry)} (${entry})
 `);
-  const child = spawn(process.execPath, [entry, ...sidecarArgs(rest)], {
+  const child = spawn(process.execPath, [entry, ...ext.argv(rest)], {
     stdio: "inherit",
-    // So `corenel sidecar --help` prints `corenel sidecar …` in its usage rather
-    // than the standalone name the user did not type.
-    env: { ...process.env, CORENEL_ARGV0: "corenel sidecar" }
+    // So the extension's own --help prints the command the user actually typed
+    // rather than its standalone name.
+    env: { ...process.env, CORENEL_ARGV0: `corenel ${ext.command}` }
   });
   const forward = (sig) => () => {
     if (!child.killed) child.kill(sig);
@@ -20781,6 +20934,539 @@ async function proxyToSidecar(rest, look = {}) {
   }
 }
 
+// src/commands.ts
+var COMMANDS = [
+  { name: "", args: "", summary: "with no command: an interactive agent in this directory" },
+  { name: "run", args: '"<prompt>" [--session ID]', summary: "one-shot turn, then exit (--session runs it inside a sandbox)" },
+  { name: "run-agent", args: '<name> --input "<text>"', summary: "run a crew agent; events as JSON Lines on stdout" },
+  { name: "sidecar", args: "[start] [flags]", summary: "run the sidecar on this machine" },
+  { name: "acp", args: "<agent> [flags]", summary: "proxy an external coding agent under Corenel policy" },
+  { name: "sessions", args: "[list|show|create|run]", summary: "create, list and run in local sandbox sessions" },
+  { name: "login", args: "[--base URL]", summary: "sign in through your browser (device flow)" },
+  { name: "auth", summary: "show whether you are signed in, and as what" },
+  { name: "logout", summary: "forget the stored token" },
+  { name: "doctor", summary: "check the things that usually turn out to be wrong" }
+];
+var COMMAND_NAMES = COMMANDS.map((c) => c.name).filter(Boolean);
+function isCommand(name) {
+  return COMMAND_NAMES.includes(name);
+}
+function isHelpFlag(a) {
+  return a === "--help" || a === "-h" || a === "help";
+}
+function isVersionFlag(a) {
+  return a === "--version" || a === "-v" || a === "version";
+}
+function helpText(version2) {
+  const shown = COMMANDS.filter((c) => c.name);
+  const left = (c) => `corenel ${c.name}${c.args ? ` ${c.args}` : ""}`;
+  const width = Math.max(...shown.map((c) => left(c).length));
+  const bare = COMMANDS.find((c) => !c.name);
+  return [
+    `corenel ${version2} \u2014 the harness, in node.`,
+    "",
+    "Usage:",
+    `  corenel${" ".repeat(Math.max(1, width - 7))}  ${bare ? bare.summary : ""}`,
+    ...shown.map((c) => `  ${left(c).padEnd(width)}  ${c.summary}`),
+    "",
+    "Common flags:",
+    "  --model <id>     model for this turn (default gpt-4o-mini)",
+    "  --base <url>     API base (default https://api.corenel.ai/api, or CORENEL_API_BASE)",
+    "  --allow-shell    run commands without asking each time",
+    "  --no-tui         plain line-by-line mode (automatic when output is piped)",
+    "  --tui            force the full terminal face, and fail if it cannot start",
+    "  --resume [id]    reopen the last conversation, or the one named",
+    "  --debug          trace every agent step (also CORENEL_DEBUG=1)",
+    "  --version, -v    print the version",
+    "  --help, -h       print this",
+    "",
+    "--resume reopens a CONVERSATION (this face's own chat log, saved under",
+    ".corenel/sessions/) -- not the same thing as `run --session ID` or the",
+    "`sessions` command below, which forward into a sandbox on the sidecar.",
+    "Same word, two different nouns.",
+    "",
+    "sidecar, acp and sessions are provided by @corenel/sidecar, installed separately.",
+    "Each takes its own flags: `corenel sidecar --help`.",
+    ""
+  ].join("\n");
+}
+
+// src/version.ts
+import { createRequire as createRequire2 } from "node:module";
+import { readFileSync as readFileSync2 } from "node:fs";
+import { dirname as dirname3, join as join4 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+function selfPath() {
+  try {
+    return fileURLToPath2(import.meta.url);
+  } catch {
+    return process.argv[1] ?? "(unknown)";
+  }
+}
+function version(read = (p) => readFileSync2(p, "utf8")) {
+  let dir = dirname3(selfPath());
+  for (let up = 0; up < 4; up++) {
+    try {
+      const parsed = JSON.parse(read(join4(dir, "package.json")));
+      const v = parsed;
+      if (v.name === "@corenel/cli" && typeof v.version === "string") return v.version;
+    } catch {
+    }
+    const parent = dirname3(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  try {
+    const req = createRequire2(import.meta.url);
+    const parsed = JSON.parse(read(req.resolve("@corenel/cli/package.json")));
+    const v = parsed.version;
+    if (typeof v === "string") return v;
+  } catch {
+  }
+  return "(unknown)";
+}
+
+// src/auth.ts
+function hintOf(token) {
+  const t = token.trim();
+  if (t.length <= 8) return "****";
+  return `${t.slice(0, 4)}\u2026${t.slice(-2)} (${t.length} chars)`;
+}
+async function authState(read = readAuthToken, env = process.env) {
+  const path = authTokenPath();
+  const stored = await read();
+  if (stored) return { source: "file", path, hint: hintOf(stored) };
+  if (env.CORENEL_TOKEN) return { source: "env", path, hint: hintOf(env.CORENEL_TOKEN) };
+  return { source: "none", path };
+}
+function describeAuth(s, base) {
+  if (s.source === "none") {
+    return [
+      "Not signed in.",
+      `  Run \`corenel login\`, or set CORENEL_TOKEN=<token>.`,
+      `  Token would be stored at ${s.path}`
+    ].join("\n");
+  }
+  return [
+    `Signed in (${s.source === "env" ? "CORENEL_TOKEN environment variable" : s.path}).`,
+    `  token  ${s.hint}`,
+    `  api    ${base}`,
+    s.source === "env" ? "  NOTE: the environment wins over any stored token, so `corenel logout` will not change this." : null
+  ].filter(Boolean).join("\n");
+}
+async function runAuth(out = (s) => process.stdout.write(s)) {
+  out(`${describeAuth(await authState(), apiBase2())}
+`);
+}
+async function runLogout(out = (s) => process.stdout.write(s)) {
+  const before = await authState();
+  await clearAuthToken();
+  if (before.source === "file") out(`Signed out. Removed ${before.path}
+`);
+  else out("Nothing to forget \u2014 no stored token.\n");
+  if (process.env.CORENEL_TOKEN) {
+    out("  NOTE: CORENEL_TOKEN is still set in this environment, so you are still authenticated.\n");
+  }
+}
+
+// src/doctor.ts
+var MARK = { ok: "  ok  ", warn: " warn ", fail: " FAIL " };
+function formatChecks(checks) {
+  return checks.map((c) => `[${MARK[c.status]}] ${c.name.padEnd(12)} ${c.detail}`).join("\n");
+}
+async function checkToken(base, token, f = fetch) {
+  if (!token) return { name: "token", status: "warn", detail: "no credential \u2014 run `corenel login`" };
+  let res;
+  try {
+    res = await f(`${base}/v1/chat/completions`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+      body: JSON.stringify({ model: "gpt-4o-mini", messages: [] })
+    });
+  } catch (e) {
+    return { name: "token", status: "fail", detail: `could not reach ${base} (${e instanceof Error ? e.message : String(e)})` };
+  }
+  if (res.status === 401 || res.status === 403) {
+    return { name: "token", status: "fail", detail: `rejected by ${base} (${res.status}) \u2014 run \`corenel login\` again` };
+  }
+  if (res.status === 404) {
+    return { name: "token", status: "fail", detail: `${base}/v1/chat/completions is 404 \u2014 the base is wrong (it usually needs /api)` };
+  }
+  const ct = res.headers.get("content-type") ?? "";
+  if (!ct.includes("json")) {
+    return { name: "token", status: "fail", detail: `${base} answered ${res.status} ${ct || "no content-type"} \u2014 that is not the API` };
+  }
+  return { name: "token", status: "ok", detail: `accepted by ${base} (${res.status})` };
+}
+async function collectChecks(f = fetch) {
+  const base = apiBase2();
+  const checks = [
+    { name: "binary", status: "ok", detail: selfPath() },
+    { name: "version", status: "ok", detail: `@corenel/cli ${version()}` },
+    { name: "node", status: "ok", detail: process.version },
+    {
+      name: "api",
+      status: "ok",
+      detail: base === DEFAULT_API_BASE ? base : `${base}  (overridden; default is ${DEFAULT_API_BASE})`
+    }
+  ];
+  try {
+    const u = new URL(base);
+    if (u.pathname === "" || u.pathname === "/") {
+      checks.push({ name: "api path", status: "warn", detail: "base has no path \u2014 the API is mounted under /api" });
+    }
+  } catch {
+    checks.push({ name: "api", status: "fail", detail: `${base} is not a URL` });
+  }
+  const auth = await authState();
+  checks.push({
+    name: "signed in",
+    status: auth.source === "none" ? "warn" : "ok",
+    detail: auth.source === "none" ? "no" : `yes, from ${auth.source === "env" ? "CORENEL_TOKEN" : auth.path} (${auth.hint})`
+  });
+  checks.push(await checkToken(base, await readAuthToken() ?? process.env.CORENEL_TOKEN ?? null, f));
+  const sidecar = findSidecarEntry();
+  checks.push({
+    name: "sidecar",
+    status: sidecar ? "ok" : "warn",
+    detail: sidecar ? `${versionAt(sidecar)} at ${sidecar}` : "not installed \u2014 `npm i -g @corenel/sidecar`"
+  });
+  return checks;
+}
+async function runDoctor(out = (s) => process.stdout.write(s), f = fetch) {
+  const checks = await collectChecks(f);
+  out(`${formatChecks(checks)}
+`);
+  const failed = checks.filter((c) => c.status === "fail");
+  if (failed.length) {
+    out(`
+${failed.length} problem${failed.length > 1 ? "s" : ""} above.
+`);
+    return 1;
+  }
+  return 0;
+}
+
+// src/repl.ts
+import { createInterface } from "node:readline";
+import { TermSession } from "@corenel/term/session";
+import { describeToolCall } from "@corenel/term/describe";
+function isQuit(line) {
+  const t = line.trim().toLowerCase();
+  return t === "/exit" || t === "/quit" || t === "exit" || t === "quit";
+}
+function nextShownCursor(itemsLength, shown) {
+  return itemsLength < shown ? 0 : shown;
+}
+function formatQuestion(q) {
+  const lines = [`  ${q.header}  ${q.question}`];
+  q.options.forEach((o, i) => {
+    lines.push(`    ${i + 1}) ${o.label}`);
+  });
+  return `${lines.join("\n")}
+`;
+}
+function parseQuestionAnswer(q, line) {
+  if (line === null) return null;
+  const t = line.trim();
+  if (!t) return null;
+  if (/^\d+$/.test(t)) {
+    const n = Number(t);
+    if (n >= 1 && n <= q.options.length) return { [q.header]: [q.options[n - 1].label] };
+  }
+  return { [q.header]: [t] };
+}
+var REPL_BANNER = (model, cwd) => [
+  `corenel \u2014 ${model}, working in ${cwd}`,
+  "Type a request. /clear forgets the conversation, /exit leaves, Ctrl-C stops a turn.",
+  ""
+].join("\n");
+function makeEventRenderer(write) {
+  let streaming = false;
+  const endStream = () => {
+    if (streaming) {
+      write("\n");
+      streaming = false;
+    }
+  };
+  return (e) => {
+    switch (e.type) {
+      case "assistant-delta":
+        streaming = true;
+        write(e.delta);
+        break;
+      case "tool-call": {
+        endStream();
+        const subject = describeToolCall(e.name, e.args);
+        write(`  \xB7 ${e.name}${subject ? ` ${subject}` : ""}
+`);
+        break;
+      }
+      case "tool-result":
+        if (e.isError) write(`  ! ${e.name} failed
+`);
+        break;
+      case "done":
+        endStream();
+        break;
+      default:
+        break;
+    }
+  };
+}
+async function runRepl(deps) {
+  const input = deps.input ?? process.stdin;
+  const output = deps.output ?? process.stdout;
+  let atLineStart = true;
+  const write = (s) => {
+    output.write(s);
+    if (s.length > 0) atLineStart = s.endsWith("\n");
+  };
+  const writeLine = (s) => {
+    if (!atLineStart) write("\n");
+    write(s);
+  };
+  write(REPL_BANNER(deps.model, deps.cwd));
+  const render = makeEventRenderer(write);
+  const session = new TermSession({
+    cwd: deps.cwd,
+    model: deps.model,
+    system: deps.system,
+    client: deps.client,
+    tools: deps.tools,
+    toolCtx: (signal, askUser) => deps.toolCtx(signal, askUser),
+    onEvent: render,
+    ...deps.runner ? { runner: deps.runner } : {},
+    ...deps.approveAll ? { approveAll: true } : {},
+    ...deps.persistence ? { persistence: deps.persistence } : {}
+  });
+  let shown = 0;
+  session.subscribe(() => {
+    const items = session.getSnapshot().committed;
+    shown = nextShownCursor(items.length, shown);
+    for (; shown < items.length; shown++) {
+      const it = items[shown];
+      if (it.kind !== "note") continue;
+      writeLine(`  ${it.level === "info" ? "" : "! "}${it.text}
+`);
+      if (it.detail) write(`${it.detail}
+`);
+    }
+  });
+  if (deps.resume) {
+    await session.resume(deps.resume.id);
+    const restored = session.getSnapshot();
+    if (restored.session) {
+      writeLine(`  resumed ${restored.session.id} - ${restored.committed.length} messages
+`);
+    }
+  }
+  const rl = createInterface({ input, output });
+  let closed = false;
+  rl.on("close", () => {
+    closed = true;
+  });
+  const ask = (q) => closed ? Promise.resolve(null) : new Promise((resolve2) => {
+    const onClose = () => resolve2(null);
+    rl.once("close", onClose);
+    rl.question(q, (answer) => {
+      rl.off("close", onClose);
+      resolve2(answer);
+    });
+  });
+  let turnActive = false;
+  const onSigint = () => {
+    if (turnActive) session.abort();
+    else {
+      write("\n");
+      rl.close();
+    }
+  };
+  rl.on("SIGINT", onSigint);
+  const permission = new PermissionService({
+    policy: STANDARD_POLICY,
+    prompt: {
+      ask: async (req) => {
+        if (deps.approveAll) return "allow";
+        const detail = req.input?.command;
+        write(`
+  ${req.tool}${typeof detail === "string" ? `: ${detail}` : ""}
+`);
+        const answer = await ask("  run it? [y/N] ");
+        return answer !== null && /^y(es)?$/i.test(answer.trim()) ? "allow" : "deny";
+      }
+    }
+  });
+  session.attachPermission(permission);
+  let questionOpen = false;
+  session.subscribe(() => {
+    const modal = session.getSnapshot().modal;
+    if (!modal || modal.kind !== "user") {
+      questionOpen = false;
+      return;
+    }
+    if (questionOpen) return;
+    questionOpen = true;
+    const q = modal.questions[0];
+    if (!q) {
+      session.answer(null);
+      return;
+    }
+    writeLine(formatQuestion(q));
+    void ask("  answer (number, text, or empty to skip): ").then((line) => {
+      if (session.getSnapshot().modal?.kind !== "user") return;
+      session.answer(parseQuestionAnswer(q, line));
+    });
+  });
+  for (; ; ) {
+    const line = await ask("\u203A ");
+    if (line === null) break;
+    const text = line.trim();
+    if (!text) continue;
+    if (isQuit(text)) break;
+    turnActive = true;
+    await session.submit(text);
+    turnActive = false;
+    if (session.wantsExit) break;
+  }
+  rl.off("SIGINT", onSigint);
+  rl.close();
+  return 0;
+}
+
+// src/cli.ts
+import { createSessionPersistence } from "@corenel/term/persist";
+
+// src/shellTool.ts
+import { spawn as spawn2 } from "node:child_process";
+var MAX_OUTPUT = 3e4;
+var DEFAULT_TIMEOUT_MS = 12e4;
+function truncate(s, max = MAX_OUTPUT) {
+  if (s.length <= max) return s;
+  const kept = s.slice(0, max);
+  return `${kept}
+\u2026 [${s.length - max} more characters truncated]`;
+}
+function formatResult(r) {
+  const parts = [r.timedOut ? "timed out" : `exit ${r.code ?? "unknown"}`];
+  if (r.stdout.trim()) parts.push(`stdout:
+${truncate(r.stdout)}`);
+  if (r.stderr.trim()) parts.push(`stderr:
+${truncate(r.stderr)}`);
+  if (!r.stdout.trim() && !r.stderr.trim()) parts.push("(no output)");
+  return parts.join("\n");
+}
+function killTree(child) {
+  const pid = child.pid;
+  if (pid === void 0) {
+    child.kill("SIGKILL");
+    return;
+  }
+  if (process.platform === "win32") {
+    spawn2("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" }).on("error", () => {
+      child.kill("SIGKILL");
+    });
+    return;
+  }
+  try {
+    process.kill(-pid, "SIGKILL");
+  } catch {
+    child.kill("SIGKILL");
+  }
+}
+function execute(command, opts) {
+  return new Promise((resolve2) => {
+    const child = spawn2(command, {
+      cwd: opts.cwd,
+      shell: true,
+      // Its own process group on POSIX, so killTree can signal the group rather
+      // than the shell alone. On Windows this is a no-op; taskkill /T does it.
+      detached: process.platform !== "win32",
+      // A child inheriting this process's stdin would compete with the REPL's
+      // readline for keystrokes; an interactive command gets EOF instead of
+      // silently eating the next thing typed.
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    child.stdout?.on("data", (d) => {
+      stdout += d.toString();
+    });
+    child.stderr?.on("data", (d) => {
+      stderr += d.toString();
+    });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      killTree(child);
+    }, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    const onAbort = () => {
+      killTree(child);
+    };
+    opts.signal?.addEventListener("abort", onAbort, { once: true });
+    const finish = (code) => {
+      clearTimeout(timer);
+      opts.signal?.removeEventListener("abort", onAbort);
+      resolve2({ code, stdout, stderr, timedOut });
+    };
+    child.on("error", (e) => {
+      stderr += String(e);
+      finish(null);
+    });
+    child.on("close", (code) => finish(code));
+  });
+}
+function shellTool(cwd) {
+  return {
+    name: "shell",
+    description: "Run a shell command in the working directory and return its exit code and output. Use for build, test, install, git and any other command the user asks you to run. Commands run one at a time; chain with && if order matters.",
+    namespace: "shell",
+    mutates: true,
+    // Shown beside the permission prompt: a rule named `shell` only answers
+    // "what can it do to me" if you already know the catalogue.
+    means: "run any command on this machine, as you",
+    parameters: {
+      type: "object",
+      properties: {
+        command: { type: "string", description: "The command line to run, exactly as typed in a terminal." }
+      },
+      required: ["command"]
+    },
+    async run(args, ctx) {
+      const command = args.command;
+      if (typeof command !== "string" || !command.trim()) return "error: no command given";
+      const opts = { cwd };
+      if (ctx.signal) opts.signal = ctx.signal;
+      return formatResult(await execute(command, opts));
+    }
+  };
+}
+
+// src/tuiChoice.ts
+function chooseFace(env) {
+  if (env.argv.includes("--no-tui")) return "readline";
+  if (env.argv.includes("--tui")) return "tui";
+  if (!env.stdinTty || !env.stdoutTty) return "readline";
+  if (env.term === "dumb") return "readline";
+  if (env.ci) return "readline";
+  return "tui";
+}
+var TuiUnavailableError = class extends Error {
+  constructor(cause) {
+    super(`the terminal face could not start: ${cause instanceof Error ? cause.message : String(cause)}`);
+    this.name = "TuiUnavailableError";
+  }
+};
+function currentFaceEnv(argv) {
+  return {
+    stdinTty: process.stdin.isTTY === true,
+    stdoutTty: process.stdout.isTTY === true,
+    term: process.env.TERM,
+    ci: Boolean(process.env.CI),
+    argv
+  };
+}
+
 // src/cli.ts
 function flag(argv, name, fallback) {
   const i = argv.indexOf(`--${name}`);
@@ -20808,31 +21494,45 @@ function promptOf(argv) {
   }
   return parts.join(" ").trim();
 }
-async function run(argv) {
-  const prompt = promptOf(argv);
-  if (!prompt) {
-    process.stderr.write('usage: corenel run "<prompt>" [--model M] [--base URL]\n');
-    process.exit(2);
-  }
-  setGatewayBase(flag(argv, "base", process.env.CORENEL_API_BASE || "https://api.prompd.app/api"));
+async function agentSetup(argv) {
+  setGatewayBase(apiBase2(flag(argv, "base", "")));
   const token = await nodeAuthToken().getToken();
   if (!token) {
     process.stderr.write("corenel: not signed in.\n  Run `corenel login`, or set CORENEL_TOKEN=<token> (a gateway bearer token), then try again.\n");
     process.exit(2);
   }
   registerGuard(tokenGuard(() => token));
-  const client = createChatClient({ getToken: async () => token });
-  const tools = allTools();
-  setPromptHost(nodePromptHost(new NodeFileService(join4(corenelDir(), "config"))));
+  const tools = [...allTools(), shellTool(process.cwd())];
+  setPromptHost(nodePromptHost(new NodeFileService(join5(corenelDir(), "config"))));
   let system = "You are corenel, a concise CLI assistant.";
   try {
     system = await composeAgentSystem({ mode: "auto", tools: tools.map((t) => ({ name: t.name, description: t.description })) });
   } catch {
   }
+  return {
+    client: createChatClient({ getToken: async () => token }),
+    model: flag(argv, "model", "gpt-4o-mini"),
+    system,
+    tools
+  };
+}
+async function run(argv) {
+  const prompt = promptOf(argv);
+  if (!prompt) {
+    process.stderr.write('usage: corenel run "<prompt>" [--model M] [--base URL] [--session ID]\n');
+    process.exit(2);
+  }
+  const session = flag(argv, "session", "");
+  if (session) {
+    const ext = findExtension("sessions");
+    process.exitCode = ext ? await runExtension(ext, ["run", session, prompt]) : 2;
+    return;
+  }
+  const { client, model, system, tools } = await agentSetup(argv);
   const ac = new AbortController();
   const result = await runAgent({
     client,
-    model: flag(argv, "model", "gpt-4o-mini"),
+    model,
     system,
     messages: [{ role: "user", content: prompt }],
     tools,
@@ -20841,8 +21541,71 @@ async function run(argv) {
   });
   process.stdout.write(result.text + "\n");
 }
+async function interactive(argv) {
+  const { client, model, system, tools } = await agentSetup(argv);
+  const approveAll = argv.includes("--allow-shell");
+  const cwd = process.cwd();
+  const files = new NodeFileService(cwd);
+  const persistence = createSessionPersistence(files);
+  const resumeAt = argv.indexOf("--resume");
+  const resumeId = resumeAt >= 0 && argv[resumeAt + 1] && !argv[resumeAt + 1].startsWith("--") ? argv[resumeAt + 1] : void 0;
+  const resume = resumeAt >= 0 ? { id: resumeId } : void 0;
+  if (chooseFace(currentFaceEnv(argv)) === "tui") {
+    try {
+      const { runTui } = await import("@corenel/term/ink");
+      process.exitCode = await runTui({
+        cwd,
+        model,
+        system,
+        client,
+        tools,
+        version: version(),
+        toolCtx: (signal, ask) => nodeToolCtx(signal, { files, ask }),
+        ...approveAll ? { approveAll: true } : {},
+        persistence,
+        ...resume ? { resume } : {}
+      });
+      return;
+    } catch (e) {
+      if (argv.includes("--tui")) throw new TuiUnavailableError(e);
+      process.stderr.write(`corenel: terminal face unavailable, falling back (${e instanceof Error ? e.message : String(e)})
+`);
+    }
+  }
+  process.exitCode = await runRepl({
+    client,
+    model,
+    system,
+    tools,
+    toolCtx: (signal, ask) => nodeToolCtx(signal, { files, ...ask ? { ask } : {} }),
+    cwd,
+    // --allow-shell skips the per-command prompt. Named after the sidecar's
+    // flag, which grants the same thing.
+    approveAll,
+    persistence,
+    ...resume ? { resume } : {}
+  });
+}
 async function main() {
   const [cmd, ...rest] = process.argv.slice(2);
+  setAgentLogging(process.argv.includes("--debug") || process.env.CORENEL_DEBUG === "1");
+  if (cmd !== void 0 && isVersionFlag(cmd)) {
+    process.stdout.write(`${version()}
+`);
+    return;
+  }
+  if (cmd !== void 0 && isHelpFlag(cmd)) {
+    process.stdout.write(helpText(version()));
+    return;
+  }
+  if (cmd === void 0) {
+    await interactive([]);
+    return;
+  }
+  if (!isCommand(cmd) && cmd.startsWith("-")) {
+    await interactive([cmd, ...rest]);
+    return;
+  }
   switch (cmd) {
     case "run":
       await run(rest);
@@ -20867,33 +21630,36 @@ async function main() {
       process.exitCode = code;
       break;
     }
-    case "sidecar": {
-      process.exitCode = await proxyToSidecar(rest);
+    case "sidecar":
+    case "acp":
+    case "sessions": {
+      const ext = findExtension(cmd);
+      process.exitCode = ext ? await runExtension(ext, rest) : 2;
       break;
     }
     case "login": {
-      const base = flag(rest, "base", process.env.CORENEL_API_BASE || "https://api.corenel.ai/api");
+      const base = apiBase2(flag(rest, "base", ""));
       await deviceLogin({ base, store: writeAuthToken });
       process.stdout.write(`
 Logged in. Token saved to ${authTokenPath()}
 `);
       break;
     }
+    case "auth":
+      await runAuth();
+      break;
+    case "logout":
+      await runLogout();
+      break;
+    case "doctor":
+      process.exitCode = await runDoctor();
+      break;
     default:
-      process.stdout.write([
-        "corenel \u2014 the harness, in node.",
-        "",
-        "  corenel login [--base URL]                        OAuth device flow -> ~/.corenel/token",
-        '  corenel run "<prompt>" [--model M] [--base URL]   one-shot turn (needs a login or CORENEL_TOKEN)',
-        '  corenel run-agent <name> --input "<text>"         run a crew agent; events as JSON Lines on stdout',
-        "  corenel sidecar [start] [flags]                   run the sidecar on this machine (needs @corenel/sidecar)",
-        "",
-        "  `corenel sidecar --help` lists its flags. It is also installed standalone",
-        "  as `corenel-sidecar`, for machines that run only the sidecar.",
-        "",
-        "  (ask/chat to follow.)",
-        ""
-      ].join("\n"));
+      process.stderr.write(`corenel: unknown command "${cmd}"
+
+`);
+      process.stderr.write(helpText(version()));
+      process.exitCode = 2;
   }
 }
 function friendlyError(msg) {