@dharma-ai-labs/agent-fabric 0.1.0

package/dist/index.js

@@ -0,0 +1,1018 @@
+#!/usr/bin/env node
+import { execFile } from 'node:child_process';
+import { createHash, createPrivateKey, createPublicKey, randomUUID } from 'node:crypto';
+import { realpathSync } from 'node:fs';
+import { access, mkdir, readFile, realpath, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { basename, dirname, isAbsolute, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+import { canonicalize, sha256, validateContract, verifyCanonicalObject } from '@dharma-ai-labs/agent-fabric-contracts';
+import { buildTrajectoryCapsule, redactValue } from '@dharma-ai-labs/agent-fabric-evidence-reduction';
+import { LocalVault, loadOrCreateVaultMasterKey } from '@dharma-ai-labs/agent-fabric-local-vault';
+import { loadOrganizationPolicy } from '@dharma-ai-labs/agent-fabric-policy';
+import { agyAdapter, claudeAdapter, codexAdapter, providerAdapters } from '@dharma-ai-labs/agent-fabric-provider-adapters';
+import { AgentFabricClient, beginEnrollment, loadOrCreateDeviceIdentity, normalizeHqUrl, pollEnrollment, saveDeviceConfig, } from '@dharma-ai-labs/agent-fabric-relay-client';
+import { getActiveSkillBundleId, installSkillBundle, verifySkillBundle } from '@dharma-ai-labs/agent-fabric-skill-manager';
+import { executeTask, FileTaskReceiptStore } from '@dharma-ai-labs/agent-fabric-task-runner';
+const VERSION = '0.1.0';
+const execFileAsync = promisify(execFile);
+function options(args) {
+    const positional = [];
+    const flags = new Map();
+    for (let index = 0; index < args.length; index += 1) {
+        const value = args[index];
+        if (!value.startsWith('--')) {
+            positional.push(value);
+            continue;
+        }
+        const [rawKey, inline] = value.slice(2).split('=', 2);
+        if (inline !== undefined) {
+            flags.set(rawKey, inline);
+            continue;
+        }
+        const next = args[index + 1];
+        if (next && !next.startsWith('--')) {
+            flags.set(rawKey, next);
+            index += 1;
+        }
+        else
+            flags.set(rawKey, true);
+    }
+    return { positional, flags };
+}
+function required(flags, name) {
+    const value = flags.get(name);
+    if (typeof value !== 'string' || value.length === 0)
+        throw new Error(`Missing required option --${name}.`);
+    return value;
+}
+function print(value) { process.stdout.write(`${JSON.stringify(value, null, 2)}\n`); }
+export function isDirectExecution(argvPath, moduleUrl) {
+    if (!argvPath)
+        return false;
+    try {
+        return realpathSync(argvPath) === realpathSync(fileURLToPath(moduleUrl));
+    }
+    catch {
+        return false;
+    }
+}
+function dharmaHome() { return resolve(process.env.DHARMA_HOME || resolve(homedir(), '.dharma')); }
+function configPath() { return resolve(dharmaHome(), 'device.json'); }
+function pendingEnrollmentPath() { return resolve(dharmaHome(), 'pending-enrollment.json'); }
+function protocolStatePath() { return resolve(dharmaHome(), 'relay', 'protocol-state.json'); }
+function workspaceRegistryPath() { return resolve(dharmaHome(), 'registry', 'workspaces.json'); }
+async function pathExists(path) {
+    try {
+        await access(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function materializeWorkspacePolicy(input) {
+    const allowedCommands = {};
+    try {
+        const packageJson = JSON.parse(await readFile(resolve(input.workspace, 'package.json'), 'utf8'));
+        const scripts = packageJson.scripts || {};
+        for (const [script, commandId, timeoutSeconds] of [
+            ['test', 'repo.test', 1_200],
+            ['lint', 'repo.lint', 600],
+            ['typecheck', 'repo.typecheck', 600],
+            ['type-check', 'repo.typecheck', 600],
+            ['build', 'repo.build', 1_200],
+        ]) {
+            if (typeof scripts[script] === 'string' && !allowedCommands[commandId]) {
+                allowedCommands[commandId] = { argv: ['npm', 'run', script], timeoutSeconds };
+            }
+        }
+    }
+    catch { }
+    const writePaths = [];
+    for (const candidate of ['src', 'app', 'apps', 'lib', 'packages', 'test', 'tests', 'docs']) {
+        if (await pathExists(resolve(input.workspace, candidate)))
+            writePaths.push(`${candidate}/**`);
+    }
+    const policy = {
+        schema: 'dharma.organization-policy/v1',
+        organizationId: input.organizationId,
+        revision: input.revision,
+        evidence: {
+            defaultMode: 'deep',
+            registeredWorkspaceOnly: true,
+            excludePaths: ['.env', '.env.*', '.git/**', 'node_modules/**', 'dist/**', 'build/**', '**/*.pem', '**/*.key'],
+            maximumCapsuleBytes: 1_000_000,
+            maximumDailyUploadBytes: 50_000_000,
+            maximumExpansionBytes: 65_536,
+            pseudonymizeIdentity: true,
+        },
+        tasks: {
+            defaultNetwork: 'deny',
+            defaultGit: 'task_branch',
+            allowedCommands,
+            writePaths,
+            requireLocalConfirmationFor: ['network.allowlisted_domains', 'git.push', 'merge', 'deploy'],
+        },
+        skills: { automaticInstall: true, automaticPromotionMaxRisk: 'R2', canaryPercent: 10 },
+        retention: { rawLocalDays: 30, capsuleServerDays: 90 },
+        budgets: { dailyAnalysisCents: 1_000 },
+    };
+    const relativePath = '.dharma/approved-policy.json';
+    await mkdir(resolve(input.workspace, '.dharma'), { recursive: true, mode: 0o700 });
+    await writeFile(resolve(input.workspace, relativePath), `${JSON.stringify(policy, null, 2)}\n`, { mode: 0o600 });
+    return { relativePath, policy };
+}
+function providerAdapter(provider) {
+    if (provider === 'codex')
+        return codexAdapter;
+    if (provider === 'claude')
+        return claudeAdapter;
+    if (provider === 'agy')
+        return agyAdapter;
+    return null;
+}
+function deterministicUuid(value) {
+    const bytes = createHash('sha256').update(value).digest().subarray(0, 16);
+    bytes[6] = ((bytes[6] ?? 0) & 0x0f) | 0x50;
+    bytes[8] = ((bytes[8] ?? 0) & 0x3f) | 0x80;
+    const hex = bytes.toString('hex');
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function responseTextFromEvent(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const event = value;
+    const item = event.item && typeof event.item === 'object' && !Array.isArray(event.item)
+        ? event.item
+        : {};
+    if (item.type === 'agent_message' && typeof item.text === 'string')
+        return item.text;
+    if (event.type === 'result' && typeof event.result === 'string')
+        return event.result;
+    const message = event.message && typeof event.message === 'object' && !Array.isArray(event.message)
+        ? event.message
+        : {};
+    const content = Array.isArray(message.content) ? message.content : [];
+    const parts = content.flatMap((part) => {
+        if (!part || typeof part !== 'object' || Array.isArray(part))
+            return [];
+        const text = part.text;
+        return typeof text === 'string' ? [text] : [];
+    });
+    return parts.length ? parts.join('\n') : null;
+}
+export function taskResponsePreview(receipt) {
+    const provider = receipt.commandResults.find((result) => result.commandId.startsWith('provider.'));
+    if (!provider?.stdout)
+        return null;
+    const candidates = [];
+    for (const line of provider.stdout.split(/\r?\n/)) {
+        if (!line.trim())
+            continue;
+        try {
+            const response = responseTextFromEvent(JSON.parse(line));
+            if (response?.trim())
+                candidates.push(response.trim());
+        }
+        catch { }
+    }
+    const selected = candidates.at(-1);
+    if (!selected)
+        return null;
+    const stats = { classes: new Set(), redactedValues: 0, excludedPaths: 0, inputBytes: 0, outputBytes: 0 };
+    const redacted = String(redactValue(selected, stats));
+    return {
+        text: redacted.slice(0, 8_000),
+        truncated: redacted.length > 8_000,
+        redactionClasses: [...stats.classes].sort(),
+        redactedValues: stats.redactedValues,
+    };
+}
+export function assertTaskSkillPin(pinned, activeBundleId) {
+    if (pinned === undefined)
+        throw new Error('Task is missing its signed skill bundle pin.');
+    if ((pinned?.bundleId || null) !== activeBundleId) {
+        throw new Error(`Task skill bundle does not match the active local bundle (task=${pinned?.bundleId || 'none'}, local=${activeBundleId || 'none'}).`);
+    }
+    if (pinned && !/^sha256:[a-f0-9]{64}$/.test(pinned.bundleHash)) {
+        throw new Error('Task skill bundle hash is invalid.');
+    }
+}
+export function taskSkillPinFailureCode(error) {
+    const message = error instanceof Error ? error.message : '';
+    if (message.includes('missing its signed skill bundle pin'))
+        return 'skill_bundle_pin_missing';
+    if (message.includes('does not match the active local bundle'))
+        return 'skill_bundle_mismatch';
+    if (message.includes('bundle hash is invalid'))
+        return 'skill_bundle_hash_invalid';
+    return 'skill_bundle_preflight_failed';
+}
+async function platform() {
+    if (process.platform === 'win32')
+        return 'windows';
+    if (process.platform === 'darwin')
+        return 'macos';
+    if (process.platform === 'linux') {
+        try {
+            if (/microsoft|wsl/i.test(await readFile('/proc/version', 'utf8')))
+                return 'wsl';
+        }
+        catch { }
+        return 'linux';
+    }
+    throw new Error(`Unsupported device platform: ${process.platform}`);
+}
+async function registry() {
+    try {
+        return JSON.parse(await readFile(workspaceRegistryPath(), 'utf8'));
+    }
+    catch {
+        return [];
+    }
+}
+async function gitValue(workspace, argv) {
+    try {
+        return (await execFileAsync('git', ['-C', workspace, ...argv], { timeout: 10_000 })).stdout.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+async function client() {
+    const instance = await AgentFabricClient.open({ configPath: configPath(), statePath: protocolStatePath() });
+    await instance.openSession(VERSION);
+    return instance;
+}
+async function login(flags) {
+    let pending;
+    if (flags.has('resume')) {
+        pending = JSON.parse(await readFile(pendingEnrollmentPath(), 'utf8'));
+    }
+    else {
+        const hqUrl = normalizeHqUrl(String(flags.get('hq-url') || 'https://www.dharma-ai.io'));
+        const organizationId = required(flags, 'organization-id');
+        const name = String(flags.get('device-name') || `${process.env.USER || process.env.USERNAME || 'developer'} device`);
+        const devicePlatform = await platform();
+        const identity = await loadOrCreateDeviceIdentity({ hqUrl, organizationId });
+        const enrollment = await beginEnrollment({ hqUrl, organizationId, name, platform: devicePlatform, publicKeyEd25519: identity.publicKeyEd25519 });
+        pending = {
+            hqUrl, organizationId, name, platform: devicePlatform, publicKeyEd25519: identity.publicKeyEd25519,
+            deviceCode: enrollment.deviceCode, verificationUri: enrollment.verificationUri,
+            browserCode: enrollment.browserCode,
+            expiresAt: new Date(Date.now() + enrollment.expiresInSeconds * 1_000).toISOString(),
+        };
+        await mkdir(dharmaHome(), { recursive: true, mode: 0o700 });
+        await writeFile(pendingEnrollmentPath(), `${JSON.stringify(pending, null, 2)}\n`, { mode: 0o600 });
+        if (flags.has('no-wait')) {
+            return { ok: true, status: 'pending', deviceCode: pending.deviceCode, verificationUri: pending.verificationUri, browserCode: pending.browserCode, expiresAt: pending.expiresAt };
+        }
+    }
+    const deadline = Date.parse(pending.expiresAt);
+    while (Date.now() < deadline) {
+        const result = await pollEnrollment({ hqUrl: pending.hqUrl, deviceCode: pending.deviceCode });
+        if (result.status === 'approved') {
+            if (typeof result.deviceId !== 'string' || typeof result.relayUrl !== 'string' || typeof result.serverPublicKeyEd25519 !== 'string') {
+                throw new Error('Enrollment was approved but the relay or server signing key is not configured.');
+            }
+            const config = {
+                schema: 'dharma.device-config/v1', hqUrl: pending.hqUrl, organizationId: pending.organizationId, deviceId: result.deviceId,
+                deviceName: pending.name, platform: pending.platform, publicKeyEd25519: pending.publicKeyEd25519,
+                serverPublicKeyEd25519: result.serverPublicKeyEd25519, relayUrl: result.relayUrl, enrolledAt: new Date().toISOString(),
+            };
+            await saveDeviceConfig(configPath(), config);
+            await rm(pendingEnrollmentPath(), { force: true });
+            return { ok: true, status: 'approved', deviceId: config.deviceId, organizationId: pending.organizationId, relayUrl: config.relayUrl };
+        }
+        if (result.status === 'denied' || result.status === 'expired')
+            throw new Error(`Enrollment ${result.status}.`);
+        if (flags.has('no-wait'))
+            return { ok: true, status: 'pending', verificationUri: pending.verificationUri, expiresAt: pending.expiresAt };
+        await new Promise((accept) => setTimeout(accept, 2_000));
+    }
+    throw new Error(`Enrollment timed out. Approve it at ${pending.verificationUri}`);
+}
+async function capture(flags, batch = false) {
+    const workspace = await realpath(required(flags, 'workspace'));
+    const provider = required(flags, 'provider');
+    const policy = await loadOrganizationPolicy(required(flags, 'policy'));
+    const adapter = providerAdapter(provider);
+    if (!adapter)
+        throw new Error(`Unsupported capture provider: ${provider}`);
+    const root = flags.get('source-root');
+    let sessions = await adapter.discover({
+        workspace,
+        roots: typeof root === 'string' ? [root] : undefined,
+        maximumSessions: batch ? Math.min(Math.max(Number(flags.get('maximum-sessions') || 100), 1), 1_000) : 1,
+        maximumBytesPerSession: Math.min(Math.max(Number(flags.get('maximum-bytes-per-session') || 8_388_608), 65_536), 67_108_864),
+    });
+    const sessionIdsFile = flags.get('session-ids-file');
+    if (typeof sessionIdsFile === 'string') {
+        const values = JSON.parse(await readFile(resolve(sessionIdsFile), 'utf8'));
+        if (!Array.isArray(values) || values.length === 0 || values.length > 1_000
+            || values.some((value) => typeof value !== 'string' || value.length > 160)) {
+            throw new Error('Session ID allowlist must be a non-empty JSON string array with at most 1,000 entries.');
+        }
+        const allowed = new Set(values);
+        sessions = sessions.filter((candidate) => allowed.has(candidate.sessionId));
+    }
+    if (sessions.length === 0)
+        throw new Error('No workspace-qualified provider sessions were found.');
+    const session = sessions.at(-1);
+    const device = JSON.parse(await readFile(configPath(), 'utf8'));
+    const registered = (await registry()).find((item) => item.path === workspace);
+    if (!registered)
+        throw new Error('Workspace is not registered locally. Run dharma workspace add.');
+    const vault = await LocalVault.open({ root: resolve(dharmaHome(), 'vault'), masterKey: await loadOrCreateVaultMasterKey() });
+    try {
+        const capsules = [];
+        const syncResults = [];
+        const fabric = flags.has('sync') ? await client() : null;
+        for (const selected of batch ? sessions : [session]) {
+            const rawTurn = Buffer.from(`${selected.records.map((record) => JSON.stringify(record.native)).join('\n')}\n`);
+            const rawContentId = await vault.putBlob(rawTurn, 'raw-provider-turn');
+            vault.recordSession({ sessionId: selected.sessionId, provider: selected.provider, workspaceId: registered.workspaceId, sourceLocator: selected.sourcePath, status: selected.coverage, observedAt: selected.endedAt });
+            const capsule = buildTrajectoryCapsule({
+                organizationId: device.organizationId, deviceId: device.deviceId, workspaceId: registered.workspaceId,
+                session: selected, policy, rawContentId, rawBytes: rawTurn.byteLength, rawKind: 'raw-provider-turn',
+            });
+            const validation = await validateContract(resolve(import.meta.dirname, 'schemas'), 'https://schemas.dharma-ai.io/trajectory-capsule/v1', capsule);
+            if (!validation.ok)
+                throw new Error(`Trajectory capsule failed schema validation: ${JSON.stringify(validation.errors)}`);
+            const capsuleBlob = await vault.putBlob(Buffer.from(JSON.stringify(capsule)), 'trajectory-capsule');
+            vault.recordCapsule(capsule.trajectoryId, capsule.revision, capsule.capsuleHash, capsuleBlob);
+            capsules.push(capsule);
+            if (fabric)
+                syncResults.push(await fabric.syncTrajectory(capsule));
+        }
+        const output = flags.get('output');
+        if (!batch) {
+            const capsule = capsules[0];
+            if (typeof output === 'string')
+                await writeFile(resolve(output), `${JSON.stringify(capsule, null, 2)}\n`, { mode: 0o600 });
+            if (flags.has('sync'))
+                return { capsule, sync: syncResults[0] };
+            return capsule;
+        }
+        const manifest = {
+            ok: true,
+            captured: capsules.length,
+            synced: syncResults.length,
+            coverage: {
+                observed: capsules.filter((capsule) => capsule.coverage.state === 'observed').length,
+                partial: capsules.filter((capsule) => capsule.coverage.state === 'partial').length,
+            },
+            trajectories: capsules.map((capsule) => ({
+                trajectoryId: capsule.trajectoryId,
+                sessionId: capsule.sessionId,
+                capsuleHash: capsule.capsuleHash,
+                status: capsule.status,
+                eventCount: capsule.events.length,
+                timeRange: capsule.timeRange,
+            })),
+        };
+        if (typeof output === 'string')
+            await writeFile(resolve(output), `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o600 });
+        return manifest;
+    }
+    finally {
+        vault.close();
+    }
+}
+async function evidencePreview(flags) {
+    const workspace = await realpath(required(flags, 'workspace'));
+    const provider = required(flags, 'provider');
+    const adapter = providerAdapter(provider);
+    if (!adapter)
+        throw new Error(`Unsupported preview provider: ${provider}`);
+    const root = flags.get('source-root');
+    const maximumSessions = Math.min(Math.max(Number(flags.get('maximum-sessions') || 100), 1), 1_000);
+    const maximumBytesPerSession = Math.min(Math.max(Number(flags.get('maximum-bytes-per-session') || 8_388_608), 65_536), 67_108_864);
+    const sessions = await adapter.discover({
+        workspace,
+        roots: typeof root === 'string' ? [root] : undefined,
+        maximumSessions,
+        maximumBytesPerSession,
+    });
+    const eventKinds = {};
+    let records = 0;
+    for (const session of sessions) {
+        records += session.records.length;
+        for (const record of session.records)
+            eventKinds[record.kind] = (eventKinds[record.kind] || 0) + 1;
+    }
+    return {
+        ok: true,
+        provider,
+        workspaceQualified: true,
+        trajectoryCount: sessions.length,
+        recordCount: records,
+        coverage: {
+            observed: sessions.filter((session) => session.coverage === 'observed').length,
+            partial: sessions.filter((session) => session.coverage === 'partial').length,
+        },
+        timeRange: sessions.length > 0
+            ? { start: sessions[0].startedAt, end: sessions.at(-1).endedAt }
+            : null,
+        eventKinds: Object.fromEntries(Object.entries(eventKinds).sort(([left], [right]) => left.localeCompare(right))),
+        sessions: sessions.map((session) => ({
+            sessionId: session.sessionId,
+            startedAt: session.startedAt,
+            endedAt: session.endedAt,
+            coverage: session.coverage,
+            records: session.records.length,
+        })),
+    };
+}
+async function workspaceAdd(flags, positional) {
+    const path = await realpath(positional[0] || required(flags, 'path'));
+    const device = JSON.parse(await readFile(configPath(), 'utf8'));
+    const organizationId = String(flags.get('organization-id') || device.organizationId);
+    if (organizationId !== device.organizationId)
+        throw new Error('Workspace organization must match the enrolled device.');
+    await mkdir(resolve(dharmaHome(), 'registry'), { recursive: true, mode: 0o700 });
+    const workspaceId = deterministicUuid(`${organizationId}:${device.deviceId}:${path}`);
+    const remote = await gitValue(path, ['config', '--get', 'remote.origin.url']);
+    const entry = {
+        workspaceId, organizationId, name: String(flags.get('name') || basename(path)), path,
+        routeHash: `sha256:${createHash('sha256').update(path).digest('hex')}`,
+        repositoryRemoteHash: remote ? `sha256:${createHash('sha256').update(remote).digest('hex')}` : null,
+        defaultBranch: await gitValue(path, ['branch', '--show-current']), status: 'active',
+    };
+    const without = (await registry()).filter((item) => item.workspaceId !== workspaceId);
+    without.push(entry);
+    await writeFile(workspaceRegistryPath(), `${JSON.stringify(without, null, 2)}\n`, { mode: 0o600 });
+    return { ok: true, workspaceId, organizationId, pathStoredLocally: true, pathDisclosedToServer: false };
+}
+async function workspaceSync(flags, positional) {
+    const workspaceId = positional[0] || required(flags, 'workspace-id');
+    const item = (await registry()).find((candidate) => candidate.workspaceId === workspaceId);
+    if (!item)
+        throw new Error('Workspace is not registered locally.');
+    const providers = await Promise.all(providerAdapters.map((adapter) => adapter.capability()));
+    return (await client()).registerWorkspace({
+        workspaceId: item.workspaceId, name: item.name, routeHash: item.routeHash,
+        repositoryRemoteHash: item.repositoryRemoteHash, defaultBranch: item.defaultBranch,
+        policyRevision: required(flags, 'policy-revision'), providers,
+    });
+}
+async function readDeviceConfig() {
+    try {
+        return JSON.parse(await readFile(configPath(), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+export async function installRepositoryAgentFabricSkill(input) {
+    const skillRoot = resolve(input.workspace, '.agents', 'skills', 'dharma-agent-fabric');
+    const marker = resolve(skillRoot, '.dharma-agent-fabric.json');
+    let skillRootExists = true;
+    try {
+        await access(skillRoot);
+    }
+    catch {
+        skillRootExists = false;
+    }
+    if (skillRootExists) {
+        try {
+            await access(marker);
+        }
+        catch {
+            throw new Error('Refusing to replace an unmanaged repository skill at .agents/skills/dharma-agent-fabric.');
+        }
+    }
+    await mkdir(resolve(skillRoot, 'references'), { recursive: true, mode: 0o700 });
+    await mkdir(resolve(input.workspace, '.dharma'), { recursive: true, mode: 0o700 });
+    const skill = `---
+name: dharma-agent-fabric
+description: Connect this repository's coding agents to the organization's Dharma Agent Fabric control plane.
+---
+
+# Dharma Agent Fabric
+
+Use the installed \`dharma\` CLI for organization-scoped agent work. Never print, commit, or transmit provider credentials, developer tokens, local paths, or raw private trajectories.
+
+## Required flow
+
+1. Run \`dharma status\` and \`dharma providers list\` before accepting a remote task.
+2. Keep \`dharma relay start --policy .dharma/approved-policy.json\` running for signed task, evidence, and skill delivery.
+3. Capture reduced evidence with \`dharma evidence capture-batch --workspace . --provider <provider> --policy .dharma/approved-policy.json --sync\`.
+4. Use only signed tasks whose organization, device, workspace, authority, budget, and skill pin pass local validation.
+5. For cross-agent help, ask the control plane for a structured, task-bound handoff. Do not open arbitrary chat, shell, file, merge, deploy, or secret authority.
+6. Install only signed skill bundles. Preserve the active bundle receipt and automatic rollback result.
+
+The organization contract and API origin are recorded in \`.dharma/agent-fabric.json\`. API calls must use the published SDK and a scoped organization token supplied at runtime, never a credential committed to this repository.
+`;
+    const reference = `# Organization connection
+
+- HQ API: ${input.hqUrl}
+- Organization: ${input.organizationId}
+- Workspace: ${input.workspaceId}
+- Policy revision: ${input.policyRevision}
+- OpenAPI: ${input.hqUrl}/api/v1/agent-fabric/openapi.json
+
+The CLI enrolls this device through browser-confirmed Clerk organization consent. Local provider credentials remain on this device. Managed and cloud BYOK execution are brokered by Dharma HQ and expose neither private runtime URLs nor cloud credentials.
+`;
+    const connection = {
+        schema: 'dharma.repository-connection/v1',
+        hqUrl: input.hqUrl,
+        organizationId: input.organizationId,
+        workspaceId: input.workspaceId,
+        policyRevision: input.policyRevision,
+        openapiUrl: `${input.hqUrl}/api/v1/agent-fabric/openapi.json`,
+    };
+    await writeFile(resolve(skillRoot, 'SKILL.md'), skill, { mode: 0o600 });
+    await writeFile(resolve(skillRoot, 'references', 'organization.md'), reference, { mode: 0o600 });
+    await writeFile(marker, `${JSON.stringify({ managedBy: 'dharma-agent-fabric', workspaceId: input.workspaceId }, null, 2)}\n`, { mode: 0o600 });
+    await writeFile(resolve(input.workspace, '.dharma', 'agent-fabric.json'), `${JSON.stringify(connection, null, 2)}\n`, { mode: 0o600 });
+    return {
+        skillPath: '.agents/skills/dharma-agent-fabric/SKILL.md',
+        connectionPath: '.dharma/agent-fabric.json',
+    };
+}
+async function onboard(flags) {
+    const workspace = await realpath(String(flags.get('workspace') || flags.get('path') || '.'));
+    const organizationId = required(flags, 'organization-id');
+    const policyRevision = required(flags, 'policy-revision');
+    const requestedHqUrl = normalizeHqUrl(String(flags.get('hq-url') || 'https://www.dharma-ai.io'));
+    let config = await readDeviceConfig();
+    if (!config) {
+        const loginFlags = new Map(flags);
+        loginFlags.set('hq-url', requestedHqUrl);
+        loginFlags.set('organization-id', organizationId);
+        if (!flags.has('resume'))
+            loginFlags.set('no-wait', true);
+        const enrollment = await login(loginFlags);
+        if (enrollment.status !== 'approved') {
+            return {
+                ok: true,
+                stage: 'approve_device',
+                enrollment,
+                nextCommand: `dharma onboard --resume --organization-id ${organizationId} --workspace . --policy-revision ${policyRevision}`,
+            };
+        }
+        config = await readDeviceConfig();
+    }
+    if (!config)
+        throw new Error('Device enrollment did not produce a local device configuration.');
+    if (config.organizationId !== organizationId) {
+        throw new Error('This DHARMA_HOME is enrolled to a different organization. Use a separate DHARMA_HOME for each organization.');
+    }
+    if (flags.has('hq-url') && config.hqUrl !== requestedHqUrl) {
+        throw new Error('This device is enrolled to a different Dharma HQ origin. Use a separate DHARMA_HOME for each HQ origin.');
+    }
+    const hqUrl = config.hqUrl;
+    let registered = (await registry()).find((item) => item.path === workspace);
+    if (!registered) {
+        await workspaceAdd(new Map([
+            ['organization-id', organizationId],
+            ['path', workspace],
+            ['name', String(flags.get('name') || basename(workspace))],
+        ]), [workspace]);
+        registered = (await registry()).find((item) => item.path === workspace);
+    }
+    if (!registered)
+        throw new Error('Workspace registration failed.');
+    const generatedPolicy = await materializeWorkspacePolicy({
+        workspace,
+        organizationId,
+        revision: policyRevision,
+    });
+    const installed = await installRepositoryAgentFabricSkill({
+        workspace,
+        hqUrl,
+        organizationId,
+        workspaceId: registered.workspaceId,
+        policyRevision,
+    });
+    const synced = await workspaceSync(new Map([['policy-revision', policyRevision]]), [registered.workspaceId]);
+    const providers = await Promise.all(providerAdapters.map((adapter) => adapter.capability()));
+    return {
+        ok: true,
+        stage: 'ready',
+        organizationId,
+        workspaceId: registered.workspaceId,
+        deviceId: config.deviceId,
+        providers,
+        organizationPolicy: {
+            path: generatedPolicy.relativePath,
+            revision: generatedPolicy.policy.revision,
+            commandIds: Object.keys(generatedPolicy.policy.tasks.allowedCommands).sort(),
+            writePaths: generatedPolicy.policy.tasks.writePaths,
+        },
+        repositorySkill: installed,
+        workspaceSync: synced,
+        next: {
+            preview: 'dharma evidence preview --workspace . --provider codex',
+            sync: 'dharma evidence capture-batch --workspace . --provider codex --policy .dharma/approved-policy.json --sync',
+            relay: 'dharma relay start --policy .dharma/approved-policy.json',
+        },
+    };
+}
+async function evidenceSync(flags) {
+    const capsule = JSON.parse(await readFile(resolve(required(flags, 'file')), 'utf8'));
+    return (await client()).syncTrajectory(capsule);
+}
+async function processEvidenceRequest(fabric, policy, workspaceId) {
+    const config = JSON.parse(await readFile(configPath(), 'utf8'));
+    const workspaces = (await registry()).filter((item) => !workspaceId || item.workspaceId === workspaceId);
+    if (workspaces.length === 0)
+        throw new Error('Evidence workspace is not registered locally.');
+    let request = null;
+    let workspace = null;
+    for (const item of workspaces) {
+        const polled = await fabric.pollEvidence({ workspaceId: item.workspaceId });
+        if (polled.request && typeof polled.request === 'object') {
+            request = polled.request;
+            workspace = item;
+            break;
+        }
+    }
+    if (!request || !workspace)
+        return { ok: true, request: null };
+    const contract = await validateContract(resolve(import.meta.dirname, 'schemas'), 'https://schemas.dharma-ai.io/evidence-request/v1', request);
+    if (!contract.ok)
+        throw new Error(`Evidence request failed schema validation: ${JSON.stringify(contract.errors)}`);
+    const { signature, ...unsignedRequest } = request;
+    const serverPublicKey = createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: config.serverPublicKeyEd25519 }, format: 'jwk' });
+    if (!verifyCanonicalObject(unsignedRequest, signature, serverPublicKey))
+        throw new Error('Evidence request signature is invalid.');
+    if (request.organizationId !== config.organizationId || request.deviceId !== config.deviceId
+        || request.workspaceId !== workspace.workspaceId || policy.organizationId !== config.organizationId) {
+        throw new Error('Evidence request does not match the enrolled organization, device, workspace, or policy.');
+    }
+    if (Date.parse(request.expiresAt) <= Date.now())
+        throw new Error('Evidence request has expired.');
+    const vault = await LocalVault.open({ root: resolve(dharmaHome(), 'vault'), masterKey: await loadOrCreateVaultMasterKey() });
+    try {
+        const capsule = await vault.getLatestCapsule(request.trajectoryId);
+        const contentIndex = Array.isArray(capsule.contentIndex) ? capsule.contentIndex : [];
+        const available = new Set(contentIndex.flatMap((item) => {
+            if (!item || typeof item !== 'object' || Array.isArray(item))
+                return [];
+            const record = item;
+            return record.availableLocally === true && record.uploaded !== true && typeof record.contentId === 'string'
+                ? [record.contentId] : [];
+        }));
+        const stats = { classes: new Set(), redactedValues: 0, excludedPaths: 0, inputBytes: 0, outputBytes: 0 };
+        const approved = [];
+        const excluded = [];
+        const authorizedBytes = Math.min(request.maximumBytes, policy.evidence.maximumExpansionBytes);
+        let bytesPrepared = 0;
+        for (const selector of request.selectors) {
+            if (!available.has(selector.contentId)) {
+                excluded.push({ contentId: selector.contentId, reasonCode: 'not_available_in_capsule' });
+                continue;
+            }
+            try {
+                const source = await vault.getBlob(selector.contentId);
+                const start = selector.range?.start ?? 0;
+                const end = selector.range?.end ?? source.byteLength;
+                if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 0 || end <= start || end > source.byteLength) {
+                    excluded.push({ contentId: selector.contentId, reasonCode: 'invalid_range' });
+                    continue;
+                }
+                const redacted = Buffer.from(String(redactValue(source.subarray(start, end).toString('utf8'), stats, '', { pseudonymizeIdentity: policy.evidence.pseudonymizeIdentity })), 'utf8');
+                if (redacted.byteLength === 0) {
+                    excluded.push({ contentId: selector.contentId, reasonCode: 'redacted_empty' });
+                    continue;
+                }
+                if (bytesPrepared + redacted.byteLength > authorizedBytes) {
+                    excluded.push({ contentId: selector.contentId, reasonCode: 'byte_limit_exceeded' });
+                    continue;
+                }
+                approved.push({
+                    contentId: selector.contentId, bytes: redacted.byteLength,
+                    chunkHash: sha256(redacted), contentBase64: redacted.toString('base64'),
+                });
+                bytesPrepared += redacted.byteLength;
+            }
+            catch {
+                excluded.push({ contentId: selector.contentId, reasonCode: 'vault_content_unavailable' });
+            }
+        }
+        const unsignedResponse = {
+            schema: 'dharma.evidence-response/v1', responseId: randomUUID(), requestId: request.requestId,
+            organizationId: config.organizationId, deviceId: config.deviceId, workspaceId: workspace.workspaceId,
+            trajectoryId: request.trajectoryId, approved, excluded,
+            redactionReceipt: { policyRevision: policy.revision, classes: [...stats.classes].sort(), redactedValues: stats.redactedValues },
+            bytesPrepared, createdAt: new Date().toISOString(),
+        };
+        const response = { ...unsignedResponse, responseHash: sha256(canonicalize(unsignedResponse)), signature: null };
+        const responseContract = await validateContract(resolve(import.meta.dirname, 'schemas'), 'https://schemas.dharma-ai.io/evidence-response/v1', response);
+        if (!responseContract.ok)
+            throw new Error(`Evidence response failed schema validation: ${JSON.stringify(responseContract.errors)}`);
+        const accepted = await fabric.postEvidenceResponse(request.requestId, response);
+        const receipt = accepted.receipt && typeof accepted.receipt === 'object' ? accepted.receipt : {};
+        const receiptHash = typeof receipt.hash === 'string' && /^sha256:[a-f0-9]{64}$/.test(receipt.hash)
+            ? receipt.hash : response.responseHash;
+        vault.recordDisclosure(unsignedResponse.responseId, receiptHash, bytesPrepared);
+        return {
+            ok: true, requestId: request.requestId, responseId: unsignedResponse.responseId,
+            approved: approved.length, excluded: excluded.length, bytesPrepared, receipt,
+        };
+    }
+    finally {
+        vault.close();
+    }
+}
+async function runOneEvidenceRequest(flags) {
+    const policy = await loadOrganizationPolicy(required(flags, 'policy'));
+    return processEvidenceRequest(await client(), policy, typeof flags.get('workspace-id') === 'string' ? String(flags.get('workspace-id')) : undefined);
+}
+async function executeOneTask(fabric, policy, leaseSeconds) {
+    const polled = await fabric.pollTask(leaseSeconds);
+    const taskRow = polled.task;
+    if (!taskRow?.envelope)
+        return { ok: true, task: null };
+    const task = taskRow.envelope;
+    const workspace = (await registry()).find((item) => item.workspaceId === task.workspaceId);
+    if (!workspace)
+        throw new Error('Task workspace is not registered on this device.');
+    const config = JSON.parse(await readFile(configPath(), 'utf8'));
+    if (task.target.deviceId !== config.deviceId)
+        throw new Error('Task target does not match this enrolled device.');
+    const serverPublicKey = createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: config.serverPublicKeyEd25519 }, format: 'jwk' });
+    const activeBundleId = await getActiveSkillBundleId(nativeSkillDirectory(task.target.provider));
+    try {
+        assertTaskSkillPin(task.skillBundle, activeBundleId);
+    }
+    catch (error) {
+        await fabric.postTaskEvent(task.taskId, 'failed', {
+            phase: 'preflight',
+            code: taskSkillPinFailureCode(error),
+            taskBundleId: task.skillBundle?.bundleId || null,
+            localBundleId: activeBundleId,
+        }).catch(() => undefined);
+        throw error;
+    }
+    await fabric.postTaskEvent(task.taskId, 'started', {
+        bundleId: task.skillBundle?.bundleId || null,
+        bundleHash: task.skillBundle?.bundleHash || null,
+    });
+    const heartbeats = [];
+    const heartbeat = setInterval(() => {
+        heartbeats.push(fabric.postTaskEvent(task.taskId, 'lease_extended', { taskId: task.taskId }).catch(() => undefined));
+    }, Math.max(15_000, Math.floor(leaseSeconds * 500)));
+    let receipt;
+    try {
+        receipt = await executeTask({
+            task, policy, workspace: workspace.path, relayStateDirectory: resolve(dharmaHome(), 'relay'), serverPublicKey,
+            receiptStore: new FileTaskReceiptStore(resolve(dharmaHome(), 'relay', 'receipts')),
+        });
+    }
+    finally {
+        clearInterval(heartbeat);
+        await Promise.allSettled(heartbeats);
+    }
+    const summary = {
+        status: receipt.status, branch: receipt.branch,
+        response: taskResponsePreview(receipt),
+        commandResults: receipt.commandResults.map(({ commandId, exitCode, signal, timedOut, stdoutSha256, stderrSha256 }) => ({ commandId, exitCode, signal, timedOut, stdoutSha256, stderrSha256 })),
+        startedAt: receipt.startedAt, completedAt: receipt.completedAt,
+    };
+    await fabric.postTaskEvent(task.taskId, receipt.status, summary);
+    return { ok: true, taskId: task.taskId, receipt: summary };
+}
+async function runOneTask(flags) {
+    const policy = await loadOrganizationPolicy(required(flags, 'policy'));
+    return executeOneTask(await client(), policy, Number(flags.get('lease-seconds') || 120));
+}
+export function nativeSkillDirectory(provider, env = process.env, home = homedir()) {
+    if (provider === 'codex')
+        return resolve(env.CODEX_HOME || resolve(home, '.codex'), 'skills');
+    if (provider === 'claude')
+        return resolve(env.CLAUDE_CONFIG_DIR || resolve(home, '.claude'), 'skills');
+    return resolve(env.AGY_CONFIG_DIR || resolve(home, '.gemini', 'antigravity-cli'), 'plugins', 'dharma-agent-fabric', 'skills');
+}
+export async function activateAgyPlugin(input = {}) {
+    const root = resolve(nativeSkillDirectory('agy', input.env, input.home), '..');
+    const execute = input.execute || ((executable, argv, options) => execFileAsync(executable, argv, options));
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    const manifest = resolve(root, 'plugin.json');
+    try {
+        await access(manifest);
+    }
+    catch {
+        await writeFile(manifest, `${JSON.stringify({ name: 'dharma-agent-fabric' }, null, 2)}\n`, { mode: 0o600 });
+    }
+    await execute('agy', ['plugin', 'validate', root], { timeout: 30_000 });
+    await execute('agy', ['plugin', 'enable', 'dharma-agent-fabric'], { timeout: 30_000 });
+}
+function containedInlinePath(root, value) {
+    if (!value || value.includes('\\') || isAbsolute(value))
+        throw new Error('Inline skill file path is invalid.');
+    const segments = value.split('/');
+    if (segments.some((segment) => !segment || segment === '.' || segment === '..'))
+        throw new Error('Inline skill file path is invalid.');
+    const candidate = resolve(root, ...segments);
+    const route = relative(resolve(root), candidate);
+    if (route === '..' || route.startsWith('../') || route.startsWith('..\\') || isAbsolute(route)) {
+        throw new Error('Inline skill file path escapes its skill root.');
+    }
+    return candidate;
+}
+export async function materializeInlineSkillFiles(bundle, sourceRoot) {
+    if (bundle.operation === 'clear')
+        return false;
+    const inline = bundle.skills.map((skill) => skill.files);
+    if (inline.every((files) => files === undefined))
+        return false;
+    if (!inline.every((files) => Array.isArray(files) && files.length > 0 && files.length <= 32)) {
+        throw new Error('Every skill in an inline bundle must contain 1-32 signed files.');
+    }
+    let totalBytes = 0;
+    for (const skill of bundle.skills) {
+        const skillRoot = containedInlinePath(sourceRoot, skill.path);
+        const seen = new Set();
+        for (const file of skill.files || []) {
+            if (!file || typeof file.path !== 'string' || typeof file.contentBase64 !== 'string' || typeof file.sha256 !== 'string') {
+                throw new Error('Inline skill file metadata is invalid.');
+            }
+            if (seen.has(file.path))
+                throw new Error('Inline skill bundle contains duplicate file paths.');
+            seen.add(file.path);
+            if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(file.contentBase64)) {
+                throw new Error('Inline skill file encoding is invalid.');
+            }
+            const content = Buffer.from(file.contentBase64, 'base64');
+            totalBytes += content.length;
+            if (totalBytes > 1_048_576)
+                throw new Error('Inline skill bundle exceeds the 1 MiB limit.');
+            const digest = `sha256:${createHash('sha256').update(content).digest('hex')}`;
+            if (digest !== file.sha256)
+                throw new Error(`Inline skill file hash mismatch: ${file.path}`);
+            const destination = containedInlinePath(skillRoot, file.path);
+            await mkdir(dirname(destination), { recursive: true, mode: 0o700 });
+            await writeFile(destination, content, { mode: 0o600 });
+        }
+    }
+    return true;
+}
+async function skillSync(flags) {
+    const workspaceId = required(flags, 'workspace-id');
+    const providerValue = required(flags, 'provider');
+    if (!['codex', 'claude', 'agy'].includes(providerValue))
+        throw new Error('Skill provider must be codex, claude, or agy.');
+    const provider = providerValue;
+    const workspace = (await registry()).find((item) => item.workspaceId === workspaceId);
+    if (!workspace)
+        throw new Error('Skill workspace is not registered locally.');
+    const policy = await loadOrganizationPolicy(required(flags, 'policy'));
+    const destination = nativeSkillDirectory(provider);
+    const fabric = await client();
+    const response = await fabric.pollSkill({ workspaceId, provider, installedBundleId: await getActiveSkillBundleId(destination) });
+    const rollout = response.rollout;
+    if (!rollout)
+        return { ok: true, rollout: null, changed: false };
+    if (typeof rollout.id !== 'string' || !rollout.bundle || typeof rollout.bundle !== 'object')
+        throw new Error('Skill rollout response is invalid.');
+    const bundle = rollout.bundle;
+    if (bundle.organizationId !== policy.organizationId || !Array.isArray(bundle.skills)
+        || (bundle.operation === 'install' && bundle.skills.length === 0)
+        || (bundle.operation === 'clear' && bundle.skills.length !== 0)) {
+        throw new Error('Skill bundle does not match local organization policy.');
+    }
+    const commits = [...new Set(bundle.skills.map((skill) => skill.commit))];
+    const repositories = [...new Set(bundle.skills.map((skill) => skill.repository))];
+    if (bundle.operation === 'install') {
+        if (commits.length !== 1 || !/^[a-f0-9]{40,64}$/i.test(commits[0]))
+            throw new Error('Skill bundle must pin one full Git commit.');
+        if (repositories.length !== 1 || !/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\.git)?$/.test(repositories[0])) {
+            throw new Error('Skill bundle must pin one credential-free GitHub repository.');
+        }
+    }
+    const sourceRoot = resolve(dharmaHome(), 'relay', 'skill-sources', bundle.bundleId);
+    const config = JSON.parse(await readFile(configPath(), 'utf8'));
+    verifySkillBundle(bundle, createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: config.serverPublicKeyEd25519 }, format: 'jwk' }));
+    await mkdir(resolve(dharmaHome(), 'relay', 'skill-sources'), { recursive: true, mode: 0o700 });
+    await rm(sourceRoot, { recursive: true, force: true });
+    await mkdir(sourceRoot, { recursive: true, mode: 0o700 });
+    const materializedInline = await materializeInlineSkillFiles(bundle, sourceRoot);
+    if (bundle.operation === 'install' && !materializedInline) {
+        await rm(sourceRoot, { recursive: true, force: true });
+        await execFileAsync('git', ['clone', '--filter=blob:none', '--no-checkout', repositories[0], sourceRoot], { timeout: 120_000 });
+        await execFileAsync('git', ['-C', sourceRoot, 'fetch', '--no-tags', '--depth=1', 'origin', commits[0]], { timeout: 120_000 });
+        await execFileAsync('git', ['-C', sourceRoot, 'checkout', '--detach', commits[0]], { timeout: 30_000 });
+    }
+    try {
+        const identity = await loadOrCreateDeviceIdentity({ hqUrl: config.hqUrl, organizationId: config.organizationId });
+        const receipt = await installSkillBundle({
+            bundle,
+            sourceDirectory: sourceRoot,
+            nativeSkillDirectory: destination,
+            policy,
+            serverPublicKey: createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: config.serverPublicKeyEd25519 }, format: 'jwk' }),
+            devicePrivateKey: createPrivateKey({ key: identity.privateJwk, format: 'jwk' }),
+            deviceId: config.deviceId,
+            workspaceId,
+            provider,
+            smokeCommandId: typeof flags.get('smoke-command') === 'string' ? String(flags.get('smoke-command')) : undefined,
+            organizationApprovalId: typeof flags.get('approval-id') === 'string' ? String(flags.get('approval-id')) : undefined,
+        });
+        if (provider === 'agy' && receipt.status === 'active')
+            await activateAgyPlugin();
+        await fabric.postInstallReceipt(bundle.bundleId, rollout.id, receipt);
+        return { ok: true, rolloutId: rollout.id, bundleId: bundle.bundleId, status: receipt.status, changed: true };
+    }
+    finally {
+        await rm(sourceRoot, { recursive: true, force: true });
+    }
+}
+async function relayStart(flags) {
+    const policy = await loadOrganizationPolicy(required(flags, 'policy'));
+    const fabric = await client();
+    const leaseSeconds = Number(flags.get('lease-seconds') || 120);
+    const pollMs = Math.min(Math.max(Number(flags.get('poll-seconds') || 3), 1), 60) * 1_000;
+    const pidPath = resolve(dharmaHome(), 'relay', 'relay.pid');
+    await mkdir(resolve(dharmaHome(), 'relay'), { recursive: true, mode: 0o700 });
+    await writeFile(pidPath, `${process.pid}\n`, { mode: 0o600 });
+    let stopping = false;
+    const stop = () => { stopping = true; };
+    process.once('SIGINT', stop);
+    process.once('SIGTERM', stop);
+    let tasksCompleted = 0;
+    let evidenceResponsesCompleted = 0;
+    try {
+        do {
+            const evidence = await processEvidenceRequest(fabric, policy);
+            if (evidence.requestId)
+                evidenceResponsesCompleted += 1;
+            const result = await executeOneTask(fabric, policy, leaseSeconds);
+            if (result.taskId)
+                tasksCompleted += 1;
+            if (flags.has('once'))
+                break;
+            if (!result.taskId && !evidence.requestId)
+                await new Promise((accept) => setTimeout(accept, pollMs));
+        } while (!stopping);
+    }
+    finally {
+        process.removeListener('SIGINT', stop);
+        process.removeListener('SIGTERM', stop);
+        await rm(pidPath, { force: true });
+    }
+    return { ok: true, stopped: true, tasksCompleted, evidenceResponsesCompleted };
+}
+export async function run(argv) {
+    const { positional, flags } = options(argv);
+    const [command, subcommand] = positional;
+    if (flags.has('version') || command === 'version')
+        return { version: VERSION };
+    if (command === 'onboard')
+        return onboard(flags);
+    if (command === 'login')
+        return login(flags);
+    if (command === 'providers' && subcommand === 'list')
+        return { providers: await Promise.all(providerAdapters.map((adapter) => adapter.capability())) };
+    if (command === 'workspace' && subcommand === 'add')
+        return workspaceAdd(flags, positional.slice(2));
+    if (command === 'workspace' && subcommand === 'sync')
+        return workspaceSync(flags, positional.slice(2));
+    if (command === 'capture' || (command === 'evidence' && subcommand === 'capture'))
+        return capture(flags);
+    if (command === 'evidence' && subcommand === 'capture-batch')
+        return capture(flags, true);
+    if (command === 'evidence' && subcommand === 'preview')
+        return evidencePreview(flags);
+    if (command === 'evidence' && subcommand === 'sync')
+        return evidenceSync(flags);
+    if (command === 'evidence' && subcommand === 'run-request')
+        return runOneEvidenceRequest(flags);
+    if (command === 'status') {
+        try {
+            const config = JSON.parse(await readFile(configPath(), 'utf8'));
+            return { version: VERSION, home: dharmaHome(), enrolled: true, organizationId: config.organizationId, deviceId: config.deviceId, relay: 'on_demand' };
+        }
+        catch {
+            return { version: VERSION, home: dharmaHome(), enrolled: false, relay: 'stopped' };
+        }
+    }
+    if (command === 'tasks' && subcommand === 'run-once')
+        return runOneTask(flags);
+    if (command === 'relay' && subcommand === 'start')
+        return relayStart(flags);
+    if (command === 'tasks' && subcommand === 'list')
+        return { tasks: [], coverage: 'server_poll_requires_relay' };
+    if (command === 'skills' && subcommand === 'sync')
+        return skillSync(flags);
+    if (command === 'skills' && subcommand === 'status') {
+        const providerValue = required(flags, 'provider');
+        if (!['codex', 'claude', 'agy'].includes(providerValue))
+            throw new Error('Skill provider must be codex, claude, or agy.');
+        const root = nativeSkillDirectory(providerValue);
+        return { provider: providerValue, activeBundleId: await getActiveSkillBundleId(root), nativeSkillDirectory: root };
+    }
+    throw new Error('Usage: dharma <onboard|login|status|providers list|workspace add|workspace sync|evidence preview|evidence capture|evidence capture-batch|evidence sync|evidence run-request|relay start|tasks run-once|skills sync|skills status> [options]');
+}
+if (isDirectExecution(process.argv[1], import.meta.url)) {
+    run(process.argv.slice(2)).then(print).catch((error) => {
+        const message = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`${message}\n`);
+        process.exitCode = 2;
+    });
+}
+//# sourceMappingURL=index.js.map