@easybits.cloud/cli 0.18.0 → 0.19.0

package/README.md

@@ -123,10 +123,17 @@ easybits secrets set --dotenv .env.production   # KEY=VALUE lines; - reads stdin
 printf '%s' "$TOKEN" | easybits secrets set GITHUB_TOKEN   # one value from stdin
 easybits secrets rm GITHUB_TOKEN --yes
 
-# Your crons: call a public https URL or message one of your agents (at most every 5 min)
+# Your crons: call a public https URL or message one of your agents, repeating (at most every 5 min) or once
 easybits crons create "Study reminder" --cron "30 8 * * *" --url https://www.ghosty.studio/api/v2/me/push \
   --method POST --body '{"title":"Study time"}' --secret GHOSTY_PUSH_TOKEN
 easybits crons create "Weekly report" --cron "0 9 * * 1" --agent <agentId> --prompt "Send me the sales summary"
+easybits crons create "Heads-up" --at 23:00 --url https://my-app.com/api/notice --method POST --dry-run  # once, today 23:00 in --tz
+easybits crons create "Heads-up" --in 2h --url https://my-app.com/api/notice --method POST              # once; --until/--times end repeating ones
+easybits crons create "Review" --at 23:00 --run "python3 asc.py submit" --file scripts/asc.py \
+  --secret-file ASC_P8:~/.appstoreconnect/private_keys/AuthKey_X.p8     # a command in a throwaway box; the .p8 only this cron reads
+easybits crons runs "Review" --logs                                      # exit code + stdout/stderr
+easybits crons wait "Review" --timeout 2h                                # blocks until it runs; exits with its exit code
+easybits crons update "Review" --notify push,email --notify-on always    # push to the Ghosty app / email to you
 easybits crons ls
 easybits crons update "Study reminder" --cron "0 7 * * 1-5"
 easybits crons run "Study reminder"       # id or exact name
@@ -134,6 +141,13 @@ easybits crons runs "Study reminder"
 easybits crons pause "Study reminder"
 easybits crons rm "Study reminder" --yes
 
+# Event inboxes: your own webhook URL; events reach your terminal live or wait for you
+easybits inbox create builds              # prints the URL (anyone with it can write)
+easybits inbox ls
+easybits inbox listen builds              # one JSON line per event, live (Claude Code: run it with Monitor)
+easybits inbox read builds                # the unread ones, marked read
+easybits inbox rm builds --yes
+
 # Platform crons (platform admins only; key with the ADMIN scope)
 easybits crons ls --platform
 easybits crons runs backup-machines

package/dist/index.js

@@ -413,7 +413,7 @@ async function oauthLogin(ctx, opts = {}) {
   const challenge = b64url(createHash("sha256").update(verifier).digest());
   const state = b64url(randomBytes(16));
   const server = createServer();
-  await new Promise((resolve3) => server.listen(0, "127.0.0.1", resolve3));
+  await new Promise((resolve4) => server.listen(0, "127.0.0.1", resolve4));
   const port = server.address().port;
   const redirectUri = `http://127.0.0.1:${port}/cb`;
   try {
@@ -427,7 +427,7 @@ async function oauthLogin(ctx, opts = {}) {
       code_challenge: challenge,
       code_challenge_method: "S256"
     });
-    const code = await new Promise((resolve3, reject) => {
+    const code = await new Promise((resolve4, reject) => {
       const timer = setTimeout(
         () => reject(new CliError(t("Login timed out after 5 minutes.", "El login se venci\xF3 a los 5 minutos."), EXIT.AUTH, t("Run: easybits login", "Corre: easybits login"), "login_timeout")),
         LOGIN_TIMEOUT_MS
@@ -443,7 +443,7 @@ async function oauthLogin(ctx, opts = {}) {
         clearTimeout(timer);
         if (ok) {
           res.writeHead(302, { location: `${base}/oauth/listo` }).end();
-          resolve3(got);
+          resolve4(got);
         } else {
           res.writeHead(400, { "content-type": "text/html; charset=utf-8" }).end(FAIL_PAGE(base));
           reject(
@@ -804,9 +804,9 @@ var websites = {
       usage: "easybits websites slug <websiteId|slug> <new-slug>",
       examples: ["easybits websites slug rio-durmiente mi-tienda"],
       async run(ctx) {
-        const ref = need(ctx, 0, "website", this.usage);
+        const ref2 = need(ctx, 0, "website", this.usage);
         const slug = need(ctx, 1, "new-slug", this.usage);
-        const websiteId = await resolveWebsiteId(ctx, ref);
+        const websiteId = await resolveWebsiteId(ctx, ref2);
         const { website } = await api(ctx, "PATCH", `/websites/${websiteId}`, { slug });
         emit(ctx, website, () => console.log(t(`Slug changed \u2192 ${website.url}`, `Slug cambiado \u2192 ${website.url}`)));
       }
@@ -862,14 +862,14 @@ var websites = {
       options: { path: { type: "string", value: "path", description: "Path inside the site (default: the file name), e.g. img/hero.jpg" } },
       examples: ["easybits websites upload mi-tienda ./index.html", "easybits websites upload mi-tienda ./hero.jpg --path img/hero.jpg"],
       async run(ctx) {
-        const ref = need(ctx, 0, "website", this.usage);
+        const ref2 = need(ctx, 0, "website", this.usage);
         const local = need(ctx, 1, "local-file", this.usage);
         if (!existsSync2(local) || !statSync2(local).isFile()) throw usageError(t(`File not found: ${local}`, `No existe el archivo: ${local}`), this.usage);
         const path = sitePath(str(ctx, "path") ?? basename(local));
         if (!path) throw usageError(t("--path must be a relative path inside the site (no ..).", "--path debe ser una ruta relativa dentro del sitio (sin ..)."), this.usage);
         const size = statSync2(local).size;
         if (size === 0) throw usageError(t(`${local} is empty.`, `${local} est\xE1 vac\xEDo.`), this.usage);
-        const id = await resolveWebsiteId(ctx, ref);
+        const id = await resolveWebsiteId(ctx, ref2);
         const r = await putSiteFile(ctx, id, path, local, size);
         emit(ctx, r, () => console.log(t(`Uploaded ${path} (${fmtBytes(size)}) \u2192 ${r.url}`, `Subido ${path} (${fmtBytes(size)}) \u2192 ${r.url}`)));
       }
@@ -880,7 +880,7 @@ var websites = {
       options: { "dry-run": { type: "boolean", description: "List what would be uploaded; upload nothing" } },
       examples: ["easybits websites deploy mi-tienda ./dist", "easybits websites deploy mi-tienda ./dist --dry-run"],
       async run(ctx) {
-        const ref = need(ctx, 0, "website", this.usage);
+        const ref2 = need(ctx, 0, "website", this.usage);
         const dir = need(ctx, 1, "dir", this.usage);
         if (!existsSync2(dir) || !statSync2(dir).isDirectory()) throw usageError(t(`Not a folder: ${dir}`, `No es una carpeta: ${dir}`), this.usage);
         const all = walkSite(dir);
@@ -888,7 +888,7 @@ var websites = {
         const empty = all.filter((f) => f.size === 0).map((f) => f.path);
         if (!files3.length) throw usageError(t(`Nothing to upload in ${dir} (hidden files and node_modules are skipped).`, `Nada que subir en ${dir} (se saltan los ocultos y node_modules).`), this.usage);
         if (!files3.some((f) => f.path === "index.html")) console.error(t("Note: no index.html at the top of the folder; /s/<slug>/ will not have a home page.", "Ojo: no hay index.html en la ra\xEDz de la carpeta; /s/<slug>/ no tendr\xE1 p\xE1gina de inicio."));
-        const id = await resolveWebsiteId(ctx, ref);
+        const id = await resolveWebsiteId(ctx, ref2);
         if (bool(ctx, "dry-run")) {
           emit(ctx, { websiteId: id, files: files3.map(({ path, size }) => ({ path, size })), skippedEmpty: empty }, () => {
             for (const f of files3) console.log(`  ${f.path}  ${fmtBytes(f.size)}`);
@@ -921,9 +921,9 @@ var websites = {
       options: { ...YES_OPTION },
       examples: ["easybits websites rm mi-tienda", "easybits websites rm mi-tienda --yes"],
       async run(ctx) {
-        const ref = need(ctx, 0, "website", this.usage);
+        const ref2 = need(ctx, 0, "website", this.usage);
         requireYesIfHeadless(ctx);
-        const id = await resolveWebsiteId(ctx, ref);
+        const id = await resolveWebsiteId(ctx, ref2);
         const w = await api(ctx, "GET", `/websites/${id}`);
         await confirm(ctx, t(`Delete website ${w.slug} (${w.fileCount ?? 0} files) at ${w.url}?`, `\xBFBorrar el sitio ${w.slug} (${w.fileCount ?? 0} archivos) en ${w.url}?`), { typeName: w.slug });
         const r = await api(ctx, "DELETE", `/websites/${id}`);
@@ -940,21 +940,21 @@ async function putSiteFile(ctx, websiteId, path, local, size) {
   if (!res.ok) throw new CliError(t(`Upload of ${path} failed: storage answered ${res.status}`, `Fall\xF3 la subida de ${path}: el almacenamiento contest\xF3 ${res.status}`), EXIT.API, void 0, "upload_failed", res.status);
   return { path, fileId: r.file.id, url: r.file.url, size, contentType };
 }
-function matchWebsite(ref, items) {
-  if (/^[0-9a-f]{24}$/i.test(ref)) return ref;
-  const r = ref.trim().toLowerCase();
+function matchWebsite(ref2, items) {
+  if (/^[0-9a-f]{24}$/i.test(ref2)) return ref2;
+  const r = ref2.trim().toLowerCase();
   return items.find((w) => w.slug === r)?.id ?? null;
 }
-async function resolveWebsiteId(ctx, ref) {
-  if (/^[0-9a-f]{24}$/i.test(ref)) return ref;
+async function resolveWebsiteId(ctx, ref2) {
+  if (/^[0-9a-f]{24}$/i.test(ref2)) return ref2;
   for (let offset = 0; ; offset += 100) {
     const page = await api(ctx, "GET", `/websites?limit=100&offset=${offset}`);
-    const id = matchWebsite(ref, page.items);
+    const id = matchWebsite(ref2, page.items);
     if (id) return id;
     if (page.items.length < 100 || offset + 100 >= page.total) break;
   }
   throw new CliError(
-    t(`No website with id or slug "${ref}".`, `No hay sitio con id o slug "${ref}".`),
+    t(`No website with id or slug "${ref2}".`, `No hay sitio con id o slug "${ref2}".`),
     EXIT.API,
     `${t("List them with", "Enl\xEDstalos con")}: easybits websites ls`,
     "not_found",
@@ -1410,8 +1410,8 @@ var sshProxy = {
       const { url } = await sb.sshTicket();
       const ws = new WebSocket(url);
       ws.binaryType = "arraybuffer";
-      await new Promise((resolve3, reject) => {
-        ws.onopen = () => resolve3();
+      await new Promise((resolve4, reject) => {
+        ws.onopen = () => resolve4();
         ws.onerror = () => reject(new CliError(t("easybits ssh-proxy: could not open the tunnel", "easybits ssh-proxy: no se pudo abrir el t\xFAnel")));
       });
       ws.onerror = () => {
@@ -1436,21 +1436,21 @@ import { existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync
 
 // src/commands/domains.ts
 import { EasybitsError as EasybitsError3 } from "@easybits.cloud/sdk";
-function matchDomain(ref, items) {
-  if (/^[0-9a-f]{24}$/i.test(ref)) return ref;
-  const r = ref.trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+function matchDomain(ref2, items) {
+  if (/^[0-9a-f]{24}$/i.test(ref2)) return ref2;
+  const r = ref2.trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
   return items.find((d) => d.domain === r)?.id ?? null;
 }
 async function listDomains(ctx) {
   return (await api(ctx, "GET", "/domains")).domains;
 }
-async function resolveDomain(ctx, ref) {
-  if (/^[0-9a-f]{24}$/i.test(ref)) return { id: ref };
+async function resolveDomain(ctx, ref2) {
+  if (/^[0-9a-f]{24}$/i.test(ref2)) return { id: ref2 };
   const items = await listDomains(ctx);
-  const id = matchDomain(ref, items);
+  const id = matchDomain(ref2, items);
   if (id) return { id, row: items.find((d) => d.id === id) };
   throw new CliError(
-    t(`No domain "${ref}" in your account.`, `No hay dominio "${ref}" en tu cuenta.`),
+    t(`No domain "${ref2}" in your account.`, `No hay dominio "${ref2}" en tu cuenta.`),
     EXIT.API,
     `${t("List them with", "Enl\xEDstalos con")}: easybits domains ls`,
     "not_found",
@@ -1573,11 +1573,11 @@ var domains = {
       options: { clear: { type: "boolean", description: "Stop serving a website at the root" } },
       examples: ["easybits domains apex example.com mi-tienda", "easybits domains apex example.com --clear"],
       async run(ctx) {
-        const ref = need(ctx, 0, "domain", this.usage);
+        const ref2 = need(ctx, 0, "domain", this.usage);
         const clear = bool(ctx, "clear");
         if (!clear && !ctx.args[1]) throw usageError(t("Missing <website> (or pass --clear).", "Falta <website> (o pasa --clear)."), this.usage);
         if (clear && ctx.args[1]) throw usageError(t("Pass a <website> or --clear, not both.", "Pasa un <website> o --clear, no ambos."), this.usage);
-        const { id } = await resolveDomain(ctx, ref);
+        const { id } = await resolveDomain(ctx, ref2);
         const websiteId = clear ? null : await resolveWebsiteId(ctx, ctx.args[1]);
         const { domain } = await api(ctx, "POST", `/domains/${id}/apex`, { websiteId });
         emit(
@@ -1596,10 +1596,10 @@ var domains = {
       options: { ...YES_OPTION },
       examples: ["easybits domains rm example.com", "easybits domains rm example.com --yes"],
       async run(ctx) {
-        const ref = need(ctx, 0, "domain", this.usage);
+        const ref2 = need(ctx, 0, "domain", this.usage);
         requireYesIfHeadless(ctx);
-        const { id, row } = await resolveDomain(ctx, ref);
-        const name = row?.domain ?? ref;
+        const { id, row } = await resolveDomain(ctx, ref2);
+        const name = row?.domain ?? ref2;
         await confirm(ctx, t(`Remove ${name}? Its websites stop answering on it right away.`, `\xBFQuitar ${name}? Sus sitios dejan de responder en \xE9l de inmediato.`));
         const r = await api(ctx, "DELETE", "/domains", { domainId: id });
         emit(ctx, { ...r, domainId: id, domain: name }, () => console.log(t(`Removed ${name}`, `Quitado ${name}`)));
@@ -2155,7 +2155,7 @@ var ID_FORMAT = {
   document: /^[0-9a-f]{24}$/i,
   video: /^[0-9a-f]{24}$/i
 };
-var looksLikeId = (kind, ref) => ID_FORMAT[kind].test(ref);
+var looksLikeId = (kind, ref2) => ID_FORMAT[kind].test(ref2);
 var REF_ARGS = {
   "agents get": { index: 0, kind: "agent" },
   "agents message": { index: 0, kind: "agent" },
@@ -2215,11 +2215,11 @@ var REF_ARGS = {
   "video music": { index: 1, kind: "video" },
   "video render": { index: 0, kind: "video" }
 };
-function matchRef(kind, ref, items) {
-  if (looksLikeId(kind, ref)) return { ok: true, id: ref };
+function matchRef(kind, ref2, items) {
+  if (looksLikeId(kind, ref2)) return { ok: true, id: ref2 };
   const list2 = items ?? [];
-  if (list2.some((x) => x.id === ref)) return { ok: true, id: ref };
-  const want = ref.trim().toLowerCase();
+  if (list2.some((x) => x.id === ref2)) return { ok: true, id: ref2 };
+  const want = ref2.trim().toLowerCase();
   const matches = list2.filter((x) => (x.name ?? "").trim().toLowerCase() === want);
   if (matches.length === 1) return { ok: true, id: matches[0].id };
   if (matches.length === 0) return { ok: false, reason: "not_found" };
@@ -2239,15 +2239,15 @@ var LS_HINT = {
 var NOUN = () => ({ agent: t("agent", "agente"), sandbox: t("sandbox or machine", "sandbox o m\xE1quina"), db: t("database", "base de datos"), site: t("site", "sitio"), fleet: t("fleet agent", "agente de flota"), document: t("document", "documento"), video: t("video project", "proyecto de video") });
 var NOUNS = () => ({ agent: t("agents", "agentes"), sandbox: t("sandboxes", "sandboxes"), db: t("databases", "bases de datos"), site: t("sites", "sitios"), fleet: t("fleet agents", "agentes de flota"), document: t("documents", "documentos"), video: t("video projects", "proyectos de video") });
 var cache = /* @__PURE__ */ new Map();
-function listRefs(ctx, kind, ref) {
-  const key = kind === "document" ? `document:${ref}` : kind;
+function listRefs(ctx, kind, ref2) {
+  const key = kind === "document" ? `document:${ref2}` : kind;
   let p = cache.get(key);
   if (!p) {
     p = (async () => {
       const eb = await getClient(ctx);
       if (kind === "agent") return (await eb.listAgents()).map((a) => ({ id: a.agentId, name: a.name, status: a.status }));
       if (kind === "fleet") return (await api(ctx, "GET", "/fleet-agents")).pools.map((p2) => ({ id: p2.id, name: p2.name }));
-      if (kind === "document") return (await api(ctx, "GET", `/documents?limit=100&search=${encodeURIComponent(ref ?? "")}`)).items.map((d) => ({ id: d.id, name: d.name }));
+      if (kind === "document") return (await api(ctx, "GET", `/documents?limit=100&search=${encodeURIComponent(ref2 ?? "")}`)).items.map((d) => ({ id: d.id, name: d.name }));
       if (kind === "video") return (await api(ctx, "GET", "/video-projects?limit=100")).items.map((v) => ({ id: v.id, name: v.name, status: v.status }));
       if (kind === "site") return (await api(ctx, "GET", "/sites")).items.map((s) => ({ id: s.id, name: s.name }));
       if (kind === "db") return (await eb.listDatabases()).items.map((d) => ({ id: d.id, name: d.name }));
@@ -2258,17 +2258,17 @@ function listRefs(ctx, kind, ref) {
   }
   return p;
 }
-async function resolveRef(ctx, kind, ref) {
-  if (looksLikeId(kind, ref)) return ref;
-  const r = matchRef(kind, ref, await listRefs(ctx, kind, ref));
+async function resolveRef(ctx, kind, ref2) {
+  if (looksLikeId(kind, ref2)) return ref2;
+  const r = matchRef(kind, ref2, await listRefs(ctx, kind, ref2));
   if (r.ok) return r.id;
   if (r.reason === "not_found") {
-    throw new CliError(t(`No ${NOUN()[kind]} with id or name "${ref}".`, `No hay ${NOUN()[kind]} con id o nombre "${ref}".`), EXIT.API, `${t("List them with", "Enl\xEDstalos con")}: ${LS_HINT[kind]}`, "not_found", 404);
+    throw new CliError(t(`No ${NOUN()[kind]} with id or name "${ref2}".`, `No hay ${NOUN()[kind]} con id o nombre "${ref2}".`), EXIT.API, `${t("List them with", "Enl\xEDstalos con")}: ${LS_HINT[kind]}`, "not_found", 404);
   }
   const shown = r.matches.slice(0, 10).map((m) => `  ${m.id}${m.status ? `  (${m.status})` : ""}`);
   if (r.matches.length > 10) shown.push(t(`  \u2026and ${r.matches.length - 10} more`, `  \u2026y ${r.matches.length - 10} m\xE1s`));
   throw new CliError(
-    t(`"${ref}" matches ${r.matches.length} ${NOUNS()[kind]}. Use the id:`, `"${ref}" coincide con ${r.matches.length} ${NOUNS()[kind]}. Usa el id:`),
+    t(`"${ref2}" matches ${r.matches.length} ${NOUNS()[kind]}. Use the id:`, `"${ref2}" coincide con ${r.matches.length} ${NOUNS()[kind]}. Usa el id:`),
     EXIT.USAGE,
     `${shown.join("\n")}
 ${t("List them with", "Enl\xEDstalos con")}: ${LS_HINT[kind]}`,
@@ -2277,9 +2277,9 @@ ${t("List them with", "Enl\xEDstalos con")}: ${LS_HINT[kind]}`,
 }
 async function resolveRefs(ctx, key) {
   const spec = REF_ARGS[key];
-  const ref = spec ? ctx.args[spec.index] : void 0;
-  if (!spec || !ref) return;
-  ctx.args[spec.index] = await resolveRef(ctx, spec.kind, ref);
+  const ref2 = spec ? ctx.args[spec.index] : void 0;
+  if (!spec || !ref2) return;
+  ctx.args[spec.index] = await resolveRef(ctx, spec.kind, ref2);
 }
 
 // src/commands/machines.ts
@@ -3808,9 +3808,9 @@ var db = {
         "easybits db rm leads --yes      # scripts and agents"
       ],
       async run(ctx) {
-        const ref = need(ctx, 0, "db-id|name", this.usage);
+        const ref2 = need(ctx, 0, "db-id|name", this.usage);
         if (bool(ctx, "dry-run")) {
-          const hit2 = await findDb(ctx, ref);
+          const hit2 = await findDb(ctx, ref2);
           const tables = await tableCounts(ctx, hit2.id);
           const rows = tables.reduce((n, x) => n + x.rows, 0);
           emit(ctx, { id: hit2.id, name: hit2.name, dryRun: true, tables }, () => {
@@ -3823,7 +3823,7 @@ var db = {
         }
         requireYesIfHeadless(ctx);
         const eb = await getClient(ctx);
-        const hit = await findDb(ctx, ref);
+        const hit = await findDb(ctx, ref2);
         await confirm(ctx, t(`Delete database ${hit.name} (${hit.id}) and all its data?`, `\xBFBorrar la base ${hit.name} (${hit.id}) con todos sus datos?`), { typeName: hit.name });
         const r = await eb.deleteDatabase(hit.id);
         emit(ctx, { ...r, id: hit.id, name: hit.name }, () => console.log(t(`Deleted ${hit.name} (${hit.id})`, `Borrada ${hit.name} (${hit.id})`)));
@@ -3845,10 +3845,10 @@ var db = {
       // El id no cambia (las tools db_* van por id). Se reescribe el nombre como palabra suelta:
       // `totequim.com`, `@totequim`, `totequim_prueba` y «TOTEQUIM» se quedan (db-name-refs.ts).
       async run(ctx) {
-        const ref = need(ctx, 0, "db-id|name", this.usage);
+        const ref2 = need(ctx, 0, "db-id|name", this.usage);
         const to = need(ctx, 1, "new-name", this.usage).trim();
         if (!/^[a-zA-Z0-9_-]{1,64}$/.test(to)) throw usageError(t("The name takes letters, digits, - and _ (max 64).", "El nombre lleva letras, d\xEDgitos, - y _ (m\xE1x 64)."), this.usage);
-        const hit = await findDb(ctx, ref);
+        const hit = await findDb(ctx, ref2);
         const from = hit.name;
         if (to === from) throw usageError(t(`${from} already has that name.`, `${from} ya se llama as\xED.`), this.usage);
         const taken = (await listRefs(ctx, "db")).find((d) => d.name === to);
@@ -3903,9 +3903,9 @@ var db = {
       examples: ["easybits db tables leads", "easybits db tables leads --json"],
       // Patrón de `turso db inspect` / `.tables` + `.schema` de sqlite3, en una sola vista.
       async run(ctx) {
-        const ref = need(ctx, 0, "db-id|name", this.usage);
+        const ref2 = need(ctx, 0, "db-id|name", this.usage);
         const eb = await getClient(ctx);
-        const hit = await findDb(ctx, ref);
+        const hit = await findDb(ctx, ref2);
         const q = (sql, args) => eb.queryDatabase(hit.id, sql, args);
         const names = (await q("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '_litestream_%' ORDER BY name")).rows.map((r) => String(r[0]));
         const tables = [];
@@ -3961,7 +3961,7 @@ var db = {
       async run(ctx) {
         const action = need(ctx, 0, "put", this.usage);
         if (action !== "put") throw usageError(t(`Unknown photos action "${action}".`, `Acci\xF3n de photos desconocida "${action}".`), this.usage);
-        const ref = need(ctx, 1, "db", this.usage);
+        const ref2 = need(ctx, 1, "db", this.usage);
         const tableName = str(ctx, "table");
         const keyCol = str(ctx, "key-column");
         const dir = str(ctx, "dir");
@@ -3969,7 +3969,7 @@ var db = {
         if (!existsSync10(dir) || !statSync7(dir).isDirectory()) throw usageError(t(`Not a folder: ${dir}`, `No es una carpeta: ${dir}`), this.usage);
         const { photos, rejected } = photoFiles(dir);
         const eb = await getClient(ctx);
-        const hit = await findDb(ctx, ref);
+        const hit = await findDb(ctx, ref2);
         const q = (sql, args) => eb.queryDatabase(hit.id, sql, args);
         const info2 = await q(`PRAGMA table_info(${ident2(tableName)})`);
         const cols = info2.rows.map((r) => String(r[info2.cols.indexOf("name")]));
@@ -4046,10 +4046,10 @@ var db = {
         "easybits db query leads 'SELECT count(*) AS n FROM leads' --json"
       ],
       async run(ctx) {
-        const ref = need(ctx, 0, "db-id|name", this.usage);
+        const ref2 = need(ctx, 0, "db-id|name", this.usage);
         const sql = need(ctx, 1, "sql", this.usage);
         const eb = await getClient(ctx);
-        const hit = await findDb(ctx, ref);
+        const hit = await findDb(ctx, ref2);
         const args = list(ctx, "arg");
         const r = await eb.queryDatabase(hit.id, sql, args.length ? args : void 0);
         emit(ctx, r, () => {
@@ -4239,9 +4239,9 @@ async function applyTarget(ctx, target, o) {
     if (res.failed) process.exitCode = EXIT.API;
     return;
   }
-  const ref = o.agent ?? specId(text);
-  if (!ref) throw usageError(t("The file has no agent id.", "El archivo no trae id de agente."), t("Point it at one with --agent <name|id>, or make a new one with --create.", "Ap\xFAntalo a uno con --agent <nombre|id>, o crea uno nuevo con --create."));
-  const id = await resolveRef(ctx, "agent", ref);
+  const ref2 = o.agent ?? specId(text);
+  if (!ref2) throw usageError(t("The file has no agent id.", "El archivo no trae id de agente."), t("Point it at one with --agent <name|id>, or make a new one with --create.", "Ap\xFAntalo a uno con --agent <nombre|id>, o crea uno nuevo con --create."));
+  const id = await resolveRef(ctx, "agent", ref2);
   if (missing.length && !ctx.json) process.stderr.write(t(`Not in your environment (keep their current value): ${missing.join(", ")}
 `, `No est\xE1n en tu entorno (conservan su valor de hoy): ${missing.join(", ")}
 `));
@@ -4918,7 +4918,7 @@ async function updateNotice(current2) {
 }
 
 // src/commands/doctor.ts
-var VERSION = true ? "0.18.0" : "dev";
+var VERSION = true ? "0.19.0" : "dev";
 var doctor2 = {
   name: "doctor",
   group: "Account",
@@ -5152,10 +5152,10 @@ function scopeList(value) {
   const out = [...new Set(value.split(",").map((s) => s.trim().toUpperCase()).filter(Boolean))];
   return out.length ? out : void 0;
 }
-function matchKey(ref, keys2) {
-  const byId = keys2.find((k) => k.id === ref);
+function matchKey(ref2, keys2) {
+  const byId = keys2.find((k) => k.id === ref2);
   if (byId) return { id: byId.id };
-  const r = ref.trim();
+  const r = ref2.trim();
   const found = keys2.filter((k) => k.status !== "REVOKED" && (k.prefix === r || k.name.toLowerCase() === r.toLowerCase()));
   return found.length === 1 ? { id: found[0].id } : { matches: found };
 }
@@ -5252,15 +5252,15 @@ var webhooks = {
     }
   }
 };
-async function resolveKey(ctx, ref) {
+async function resolveKey(ctx, ref2) {
   const { keys: keys2 } = await (await getClient(ctx)).listKeys();
-  const m = matchKey(ref, keys2);
+  const m = matchKey(ref2, keys2);
   if ("id" in m) return keys2.find((k) => k.id === m.id);
   if (!m.matches.length) {
-    throw new CliError(t(`No active key with id, name or prefix "${ref}".`, `No hay key activa con id, nombre o prefijo "${ref}".`), EXIT.API, `${t("List them with", "Enl\xEDstalas con")}: easybits keys ls`, "not_found", 404);
+    throw new CliError(t(`No active key with id, name or prefix "${ref2}".`, `No hay key activa con id, nombre o prefijo "${ref2}".`), EXIT.API, `${t("List them with", "Enl\xEDstalas con")}: easybits keys ls`, "not_found", 404);
   }
   throw new CliError(
-    t(`"${ref}" matches ${m.matches.length} keys. Use the id:`, `"${ref}" coincide con ${m.matches.length} keys. Usa el id:`),
+    t(`"${ref2}" matches ${m.matches.length} keys. Use the id:`, `"${ref2}" coincide con ${m.matches.length} keys. Usa el id:`),
     EXIT.USAGE,
     m.matches.map((k) => `  ${k.id}  ${k.prefix}\u2026  ${k.name}`).join("\n"),
     "ambiguous"
@@ -5322,9 +5322,9 @@ var keys = {
       options: { ...YES_OPTION },
       examples: ["easybits keys revoke ci-deploy", "easybits keys revoke eb_sk_live_abcd1234 --yes"],
       async run(ctx) {
-        const ref = need(ctx, 0, "key", this.usage);
+        const ref2 = need(ctx, 0, "key", this.usage);
         requireYesIfHeadless(ctx);
-        const k = await resolveKey(ctx, ref);
+        const k = await resolveKey(ctx, ref2);
         const self = (await resolveCredential(ctx)).startsWith(k.prefix);
         await confirm(
           ctx,
@@ -5425,35 +5425,85 @@ var secrets = {
 };
 
 // src/commands/crons.ts
+import { readFileSync as readFileSync18 } from "fs";
+import { homedir as homedir7 } from "os";
+import { basename as basename5, resolve as resolve3 } from "path";
 var HEX24 = /^[a-f0-9]{24}$/;
-var isUserCronId = (ref) => HEX24.test(ref);
+var isUserCronId = (ref2) => HEX24.test(ref2);
 function describeCronAction(a) {
   if (a.type === "http") return `${a.method} ${a.url}${a.secretName ? ` (+${a.secretName})` : ""}`;
+  if (a.type === "exec") {
+    const extra = [a.files?.length ? `${a.files.length} file(s)` : "", a.secrets?.length ? `+${a.secrets.map((x) => x.name).join(",")}` : ""].filter(Boolean).join(" ");
+    return `run: ${a.command.length > 40 ? a.command.slice(0, 39) + "\u2026" : a.command}${extra ? ` (${extra})` : ""}`;
+  }
   return `agent ${a.fleetAgentId}: ${a.prompt.length > 40 ? a.prompt.slice(0, 39) + "\u2026" : a.prompt}`;
 }
-async function resolveUserCron(ctx, ref) {
+async function resolveUserCron(ctx, ref2) {
   const { items } = await api(ctx, "GET", "/crons");
-  const byId = items.find((c) => c.id === ref);
+  const byId = items.find((c) => c.id === ref2);
   if (byId) return byId;
-  const byName = items.filter((c) => c.name.toLowerCase() === ref.trim().toLowerCase());
+  const byName = items.filter((c) => c.name.toLowerCase() === ref2.trim().toLowerCase());
   if (byName.length > 1) {
-    throw new CliError(t(`"${ref}" matches ${byName.length} crons. Use the id.`, `"${ref}" coincide con ${byName.length} crons. Usa el id.`), EXIT.USAGE);
+    throw new CliError(t(`"${ref2}" matches ${byName.length} crons. Use the id.`, `"${ref2}" coincide con ${byName.length} crons. Usa el id.`), EXIT.USAGE);
   }
   return byName[0] ?? null;
 }
-async function userCronOrNull(ctx, ref) {
-  if (isUserCronId(ref)) return await resolveUserCron(ctx, ref) ?? { id: ref };
-  return resolveUserCron(ctx, ref);
+async function userCronOrNull(ctx, ref2) {
+  if (isUserCronId(ref2)) return await resolveUserCron(ctx, ref2) ?? { id: ref2 };
+  return resolveUserCron(ctx, ref2);
 }
 var ACTION_OPTIONS = {
   url: { type: "string", value: "https-url", description: "Call this public https URL on each run" },
   method: { type: "string", value: "GET|POST|PUT|PATCH|DELETE", description: "HTTP method (default GET)" },
   body: { type: "string", value: "json|text", description: "Request body (not with GET)" },
-  secret: { type: "string", value: "NAME", description: "Vault secret sent as a header (default Authorization: Bearer)" },
+  secret: { type: "string", multiple: true, value: "NAME", description: "Vault secret: a header with --url (default Authorization: Bearer); an env var with --run (repeatable)" },
   "secret-header": { type: "string", value: "header", description: "Header for --secret" },
   agent: { type: "string", value: "id", description: "Send a turn to this fleet agent instead of calling a URL" },
-  prompt: { type: "string", value: "text", description: "What the agent is told on each run (with --agent)" }
+  prompt: { type: "string", value: "text", description: "What the agent is told on each run (with --agent)" },
+  run: { type: "string", value: "command", description: "Run this shell command in a throwaway box instead (python, files and secrets included; success = exit 0)" },
+  file: { type: "string", multiple: true, value: "local[=remote]", description: "File mounted for --run, next to the command by default (repeatable)" },
+  "secret-file": { type: "string", multiple: true, value: "NAME:local[=remote]", description: "Upload a local file as a secret only this cron can read, written at the same ~ path in the box (repeatable; e.g. a .p8)" },
+  template: { type: "string", value: "python|node|bun|ubuntu", description: "Box image for --run (default python)" },
+  timeout: { type: "string", value: "seconds", description: "Time limit for --run (default 300, max 600)" }
 };
+function remotePathFor(local, home = homedir7()) {
+  const abs = resolve3(local.replace(/^~(?=\/)/, home));
+  return abs.startsWith(home + "/") ? `~/${abs.slice(home.length + 1)}` : basename5(abs);
+}
+function execFromFlags(f, read, home = homedir7()) {
+  if (!f.run) return {};
+  const expand = (p) => resolve3(p.replace(/^~(?=\/)/, home));
+  const split = (spec) => {
+    const eq = spec.indexOf("=");
+    return eq < 0 ? [spec, void 0] : [spec.slice(0, eq), spec.slice(eq + 1)];
+  };
+  const files3 = f.files.map((spec) => {
+    const [local, remote] = split(spec);
+    return { path: remote || basename5(expand(local)), content: Buffer.from(read(expand(local)), "utf8").toString("base64"), encoding: "base64" };
+  });
+  const secretValues = {};
+  const secrets2 = f.secrets.map((name) => ({ name }));
+  for (const spec of f.secretFiles) {
+    const colon = spec.indexOf(":");
+    if (colon < 1) return { error: `--secret-file needs NAME:path, got "${spec}"` };
+    const name = spec.slice(0, colon);
+    const [local, remote] = split(spec.slice(colon + 1));
+    secretValues[name] = read(expand(local));
+    secrets2.push({ name, file: remote || remotePathFor(local, home) });
+  }
+  if (f.timeout != null && !/^\d+$/.test(f.timeout)) return { error: "--timeout must be whole seconds" };
+  return {
+    action: {
+      type: "exec",
+      command: f.run,
+      ...files3.length ? { files: files3 } : {},
+      ...secrets2.length ? { secrets: secrets2 } : {},
+      ...f.template ? { template: f.template } : {},
+      ...f.timeout ? { timeoutSeconds: Number(f.timeout) } : {}
+    },
+    ...Object.keys(secretValues).length ? { secretValues } : {}
+  };
+}
 function actionFromFlags(f) {
   if (f.url && f.agent) return { error: "--url and --agent are exclusive" };
   if (f.url) {
@@ -5473,15 +5523,90 @@ function actionFromFlags(f) {
   }
   return {};
 }
+var NOTIFY_OPTIONS = {
+  notify: { type: "string", value: "push,email,inbox:<name>|none", description: "Tell you after each run: push to the Ghosty app (vault secret GHOSTY_PUSH_TOKEN), email to your account and/or an event in one of your inboxes; none removes it" },
+  "notify-on": { type: "string", value: "failure|always", description: "When to notify (default failure)" }
+};
+function notifyFromFlags(f) {
+  if (f.notify == null) return f.notifyOn ? { error: "--notify-on needs --notify" } : {};
+  if (f.notify === "none") return { notify: null };
+  const chans = f.notify.split(",").map((x) => x.trim()).filter(Boolean);
+  const inboxChan = chans.find((x) => x.startsWith("inbox:"));
+  const bad = chans.find((x) => x !== "push" && x !== "email" && !x.startsWith("inbox:"));
+  if (bad || !chans.length || inboxChan === "inbox:") return { error: `--notify takes push, email, inbox:<name> or none (got "${f.notify}")` };
+  if (f.notifyOn && f.notifyOn !== "failure" && f.notifyOn !== "always") return { error: "--notify-on is failure or always" };
+  return {
+    notify: {
+      on: f.notifyOn ?? "failure",
+      ...chans.includes("push") ? { push: true } : {},
+      ...chans.includes("email") ? { email: true } : {},
+      ...inboxChan ? { inbox: inboxChan.slice("inbox:".length) } : {}
+    }
+  };
+}
+async function resolveNotifyInbox(ctx, nf) {
+  const name = nf.notify?.inbox;
+  if (!name || /^[a-f0-9]{24}$/.test(name)) return nf;
+  const b = await api(ctx, "GET", `/inboxes/${encodeURIComponent(name)}`);
+  return { ...nf, notify: { ...nf.notify, inbox: b.id } };
+}
+var WHEN_OPTIONS = {
+  at: { type: "string", value: "when", description: 'Run ONCE at this time: ISO ("2026-10-18T23:00", read in --tz) or "23:00" (today)' },
+  in: { type: "string", value: "duration", description: "Run ONCE after this long: 10m, 2h, 1h30m, 1d" },
+  until: { type: "string", value: "when", description: "A repeating cron stops after this date" },
+  times: { type: "string", value: "N", description: "A repeating cron stops after N more runs" }
+};
+function scheduleFromFlags(f) {
+  if (f.cron && (f.at || f.in)) return { error: "--cron repeats; --at/--in run once. Pick one." };
+  if (f.at && f.in) return { error: "--at and --in are exclusive" };
+  if (f.times != null && !/^\d+$/.test(f.times)) return { error: "--times must be a whole number" };
+  return {
+    fields: {
+      ...f.cron ? { cron: f.cron } : {},
+      ...f.at ? { at: f.at } : {},
+      ...f.in ? { in: f.in } : {},
+      ...f.until ? { until: f.until } : {},
+      ...f.times != null ? { times: Number(f.times) } : {},
+      ...f.tz ? { timezone: f.tz } : {}
+    }
+  };
+}
+var whenOf = (ctx) => ({
+  cron: str(ctx, "cron"),
+  at: str(ctx, "at"),
+  in: str(ctx, "in"),
+  until: str(ctx, "until"),
+  times: str(ctx, "times"),
+  tz: str(ctx, "tz")
+});
+var nextLine = (c) => c.nextRunLocal ? t(`next ${c.nextRunLocal} ${c.timezone} (in ${c.in})`, `pr\xF3xima ${c.nextRunLocal} ${c.timezone} (en ${c.in})`) : t("no next run", "sin pr\xF3xima corrida");
 var flagsOf = (ctx) => ({
   url: str(ctx, "url"),
   method: str(ctx, "method"),
   body: str(ctx, "body"),
-  secret: str(ctx, "secret"),
+  secret: list(ctx, "secret")[0],
   secretHeader: str(ctx, "secret-header"),
   agent: str(ctx, "agent"),
   prompt: str(ctx, "prompt")
 });
+function actionOf(ctx) {
+  const run = str(ctx, "run");
+  if (run && (str(ctx, "url") || str(ctx, "agent"))) return { error: "--run, --url and --agent are exclusive" };
+  if (run) {
+    return execFromFlags(
+      { run, files: list(ctx, "file"), secrets: list(ctx, "secret"), secretFiles: list(ctx, "secret-file"), template: str(ctx, "template"), timeout: str(ctx, "timeout") },
+      (p) => {
+        try {
+          return readFileSync18(p, "utf8");
+        } catch {
+          throw new CliError(t(`Can't read ${p}.`, `No se pudo leer ${p}.`), EXIT.USAGE);
+        }
+      }
+    );
+  }
+  if (list(ctx, "secret").length > 1) return { error: "--url takes one --secret" };
+  return actionFromFlags(flagsOf(ctx));
+}
 var STATUS = {
   "al-dia": ["up to date", "al d\xEDa"],
   tarde: ["late", "tarde"],
@@ -5494,6 +5619,14 @@ function cronStatus(c) {
   const s = STATUS[c.status];
   return s ? t(s[0], s[1]) : c.status;
 }
+var runExitCode = (r) => r.exitCode != null ? Math.min(Math.max(r.exitCode, 0), 255) : r.ok ? 0 : 1;
+function parseDurationMs(raw) {
+  const s = raw.trim().toLowerCase();
+  if (!/^(\d+(d|h|m|s))+$/.test(s)) return null;
+  let ms = 0;
+  for (const [, n, u] of s.matchAll(/(\d+)(d|h|m|s)/g)) ms += Number(n) * { d: 864e5, h: 36e5, m: 6e4, s: 1e3 }[u];
+  return ms;
+}
 function duration(ms) {
   if (ms == null) return "\u2014";
   return ms < 1e3 ? `${ms} ms` : `${(ms / 1e3).toFixed(1)} s`;
@@ -5502,8 +5635,8 @@ var crons = {
   name: "crons",
   aliases: ["cron"],
   group: "Account",
-  summary: "Your scheduled jobs (call a URL or message an agent) and, for admins, the platform's",
-  synopsis: "crons <ls|create|update|rm|run|runs|pause|resume>",
+  summary: "Your scheduled jobs (call a URL, message an agent or run a command; repeating or once) and, for admins, the platform's",
+  synopsis: "crons <ls|create|update|rm|run|runs|wait|pause|resume>",
   subs: {
     ls: {
       aliases: ["list"],
@@ -5521,10 +5654,10 @@ var crons = {
               items2.map((c) => ({
                 id: c.id,
                 name: c.name,
-                schedule: c.enabled ? c.schedule : `${c.schedule} (${t("paused", "en pausa")})`,
+                schedule: c.enabled ? c.schedule : `${c.schedule} (${c.done ? t("done", "terminado") : t("paused", "en pausa")})`,
                 does: describeCronAction(c.action),
                 last: c.lastRunAt ? `${fmtDate(c.lastRunAt)} ${c.lastOk === false ? t("failed", "fall\xF3") : "ok"}` : "\u2014",
-                next: c.enabled ? fmtDate(c.nextRunAt) : "\u2014"
+                next: c.enabled && c.nextRunLocal ? `${c.nextRunLocal} (${c.in})` : "\u2014"
               })),
               [["id", "ID"], ["name", "NAME"], ["schedule", "SCHEDULE"], ["does", "DOES"], ["last", "LAST RUN"], ["next", "NEXT RUN"]],
               t(
@@ -5554,19 +5687,21 @@ var crons = {
     },
     runs: {
       summary: "Show the last runs of one of your crons (id or name) or of a platform job, with the full error",
-      usage: "easybits crons runs <id|name|job>",
-      examples: ["easybits crons runs 66f0c2a1b2c3d4e5f6a7b8c9", "easybits crons runs backup-machines --json"],
+      usage: "easybits crons runs <id|name|job> [--logs]",
+      options: { logs: { type: "boolean", description: "Also print stdout/stderr of --run crons (last 64 KB per run)" } },
+      examples: ["easybits crons runs 66f0c2a1b2c3d4e5f6a7b8c9", 'easybits crons runs "Review 1.0.10" --logs', "easybits crons runs backup-machines --json"],
       async run(ctx) {
         const key = need(ctx, 0, "id|name|job", this.usage);
         const mine = await userCronOrNull(ctx, key);
-        const path = mine ? `/crons/${mine.id}/runs?limit=50` : `/admin/crons/${encodeURIComponent(key)}/runs`;
+        const withLogs = bool(ctx, "logs");
+        const path = mine ? `/crons/${mine.id}/runs?limit=50${withLogs ? "&logs=1" : ""}` : `/admin/crons/${encodeURIComponent(key)}/runs`;
         const { items } = await api(ctx, "GET", path);
         emit(ctx, { items }, () => {
           table(
             items.map((r) => ({
               at: fmtDate(r.startedAt),
               ok: r.ok == null ? t("running", "corriendo") : r.ok ? "ok" : t("failed", "fall\xF3"),
-              status: r.status ?? "\u2014",
+              status: r.exitCode != null ? `exit ${r.exitCode}` : r.status ?? "\u2014",
               took: duration(r.durationMs),
               trigger: r.trigger,
               summary: (r.error ?? r.summary ?? "").slice(0, 80)
@@ -5574,13 +5709,60 @@ var crons = {
             [["at", "STARTED"], ["ok", "RESULT"], ["status", "HTTP"], ["took", "TOOK"], ["trigger", "TRIGGER"], ["summary", "SUMMARY"]],
             t("No runs yet.", "Todav\xEDa no hay corridas.")
           );
+          if (withLogs) {
+            const last = items.find((r) => r.logs);
+            if (last) console.log(`
+${t("Output", "Salida")} (${fmtDate(last.startedAt)}):
+${last.logs}`);
+          }
           const failed = items.find((r) => r.ok === false && r.error);
-          if (failed) console.log(`
+          if (failed && !withLogs) console.log(`
 ${t("Last error", "\xDAltimo error")} (${fmtDate(failed.startedAt)}):
 ${failed.error}`);
         });
       }
     },
+    wait: {
+      summary: "Wait for the next run of one of your crons to finish and exit with its result (exec: its exit code)",
+      usage: "easybits crons wait <id|name> [--timeout 30m] [--json]",
+      options: { timeout: { type: "string", value: "duration", description: "Give up after this long (default 30m; 10m, 2h\u2026)" } },
+      examples: ['easybits crons wait "Review 1.0.10"', "easybits crons wait 66f0c2a1b2c3d4e5f6a7b8c9 --timeout 2h --json"],
+      async run(ctx) {
+        const ref2 = need(ctx, 0, "id|name", this.usage);
+        const mine = await resolveUserCron(ctx, ref2);
+        if (!mine) throw new CliError(t(`You have no cron "${ref2}".`, `No tienes un cron "${ref2}".`), EXIT.API, "easybits crons ls", "not_found", 404);
+        const limitMs = parseDurationMs(str(ctx, "timeout") ?? "30m");
+        if (limitMs == null) throw usageError(t("--timeout like 10m, 2h or 1d.", "--timeout como 10m, 2h o 1d."), this.usage);
+        const deadline = Date.now() + limitMs;
+        let after;
+        for (; ; ) {
+          const left = Math.ceil((deadline - Date.now()) / 1e3);
+          const q = new URLSearchParams({ wait: String(Math.max(1, Math.min(50, left))) });
+          if (after) q.set("after", after);
+          const r = await api(ctx, "GET", `/crons/${mine.id}/runs/next?${q}`);
+          after = r.after;
+          if (r.run) {
+            const code = runExitCode(r.run);
+            emit(ctx, r, () => {
+              console.log(`${r.run.ok ? "\u2713" : "\u2717"} \xAB${mine.name}\xBB ${r.run.exitCode != null ? `exit ${r.run.exitCode}` : r.run.ok ? "ok" : t("failed", "fall\xF3")} (${duration(r.run.durationMs)})`);
+              if (r.run.logs) console.log(r.run.logs);
+              else if (r.run.error) console.log(r.run.error);
+              else if (r.run.summary) console.log(r.run.summary);
+            });
+            process.exitCode = code;
+            return;
+          }
+          if (Date.now() >= deadline) {
+            throw new CliError(
+              t(`Gave up waiting for \xAB${mine.name}\xBB${r.nextRunLocal ? ` (next run ${r.nextRunLocal})` : ""}.`, `Me cans\xE9 de esperar \xAB${mine.name}\xBB${r.nextRunLocal ? ` (pr\xF3xima corrida ${r.nextRunLocal})` : ""}.`),
+              EXIT.API,
+              `easybits crons wait ${mine.id} --timeout 2h`,
+              "timeout"
+            );
+          }
+        }
+      }
+    },
     run: {
       summary: "Run one of your crons or a platform job now, in the background (trigger manual)",
       usage: "easybits crons run <id|name|job>",
@@ -5620,54 +5802,81 @@ ${failed.error}`);
     },
     create: {
       aliases: ["add"],
-      summary: "Create a cron: call a public https URL or send a turn to one of your agents (at most every 5 min)",
-      usage: 'easybits crons create <name> --cron "<5 fields>" [--tz <IANA>] (--url <https-url> [--method] [--body] [--secret NAME] | --agent <id> --prompt <text>)',
+      summary: "Create a cron: call a public https URL, send a turn to one of your agents or run a command in a throwaway box, repeating (at most every 5 min) or once",
+      usage: 'easybits crons create <name> (--cron "<5 fields>" [--until <when>] [--times N] | --at <when> | --in <duration>) [--tz <IANA>] (--url <https-url> [--method] [--body] [--secret NAME] | --agent <id> --prompt <text> | --run <cmd> [--file f]\u2026 [--secret NAME]\u2026 [--secret-file NAME:path]\u2026 [--template] [--timeout]) [--dry-run]',
       options: {
         cron: { type: "string", value: "expr", description: 'Cron of 5 fields, e.g. "30 8 * * *" = daily 8:30' },
+        ...WHEN_OPTIONS,
         tz: { type: "string", value: "zone", description: "IANA time zone (default America/Mexico_City)" },
-        ...ACTION_OPTIONS
+        ...ACTION_OPTIONS,
+        ...NOTIFY_OPTIONS,
+        "dry-run": { type: "boolean", description: "Validate and show the next 3 runs without creating anything" }
       },
       examples: [
         `easybits crons create "Study reminder" --cron "30 8 * * *" --url https://www.ghosty.studio/api/v2/me/push --method POST --body '{"title":"Study time"}' --secret GHOSTY_PUSH_TOKEN`,
-        'easybits crons create "Weekly report" --cron "0 9 * * 1" --agent 6a3c046d2cf7d7f4163f739d --prompt "Send me the weekly sales summary"'
+        'easybits crons create "Ping once" --at 23:00 --url https://example.com/ping --dry-run',
+        'easybits crons create "Review 1.0.10" --at 23:00 --run "pip install -q cryptography && python3 asc.py enviar-tienda" --file scripts/asc.py --secret-file ASC_P8:~/.appstoreconnect/private_keys/AuthKey_X.p8 --notify push --notify-on always',
+        'easybits crons create "Weekly report" --cron "0 9 * * 1" --times 4 --agent 6a3c046d2cf7d7f4163f739d --prompt "Send me the weekly sales summary"'
       ],
       async run(ctx) {
         const name = need(ctx, 0, "name", this.usage);
-        const cron = str(ctx, "cron");
-        if (!cron) throw usageError(t("Missing --cron.", "Falta --cron."), this.usage);
-        const a = actionFromFlags(flagsOf(ctx));
+        const w = scheduleFromFlags(whenOf(ctx));
+        if ("error" in w) throw usageError(w.error, this.usage);
+        if (!w.fields.cron && !w.fields.at && !w.fields.in) throw usageError(t("Missing --cron, --at or --in.", "Falta --cron, --at o --in."), this.usage);
+        const a = actionOf(ctx);
         if ("error" in a) throw usageError(a.error, this.usage);
-        if (!a.action) throw usageError(t("Missing --url or --agent.", "Falta --url o --agent."), this.usage);
-        const c = await api(ctx, "POST", "/crons", { name, cron, ...str(ctx, "tz") ? { timezone: str(ctx, "tz") } : {}, action: a.action });
-        emit(ctx, c, () => console.log(t(`Created ${c.id} \xAB${c.name}\xBB \u2014 ${c.schedule}; next ${fmtDate(c.nextRunAt)}`, `Creado ${c.id} \xAB${c.name}\xBB \u2014 ${c.schedule}; pr\xF3xima ${fmtDate(c.nextRunAt)}`)));
+        if (!a.action) throw usageError(t("Missing --url, --agent or --run.", "Falta --url, --agent o --run."), this.usage);
+        const nf0 = notifyFromFlags({ notify: str(ctx, "notify"), notifyOn: str(ctx, "notify-on") });
+        if ("error" in nf0) throw usageError(nf0.error, this.usage);
+        const nf = await resolveNotifyInbox(ctx, nf0);
+        const body = { name, ...w.fields, action: a.action, ...a.secretValues ? { secretValues: a.secretValues } : {}, ...nf };
+        if (bool(ctx, "dry-run")) {
+          const p = await api(ctx, "POST", "/crons", { ...body, dryRun: true });
+          emit(ctx, p, () => {
+            console.log(t(`OK, nothing created. \xAB${name}\xBB \u2014 ${p.schedule}`, `V\xE1lido, no se cre\xF3 nada. \xAB${name}\xBB \u2014 ${p.schedule}`));
+            for (const r of p.nextRuns) console.log(`  ${r.local} ${p.timezone}  (${r.at})`);
+            if (p.in) console.log(t(`First run in ${p.in}.`, `La primera corre en ${p.in}.`));
+          });
+          return;
+        }
+        const c = await api(ctx, "POST", "/crons", body);
+        emit(ctx, c, () => console.log(t(`Created ${c.id} \xAB${c.name}\xBB \u2014 ${c.schedule}; `, `Creado ${c.id} \xAB${c.name}\xBB \u2014 ${c.schedule}; `) + nextLine(c)));
       }
     },
     update: {
       aliases: ["edit", "set"],
       summary: "Change one of your crons (only what you pass)",
-      usage: 'easybits crons update <id|name> [--name <n>] [--cron "<expr>"] [--tz <IANA>] [--url \u2026 | --agent \u2026 --prompt \u2026]',
+      usage: 'easybits crons update <id|name> [--name <n>] [--cron "<expr>" | --at <when> | --in <duration>] [--until <when>] [--times N] [--tz <IANA>] [--url \u2026 | --agent \u2026 --prompt \u2026]',
       options: {
         name: { type: "string", value: "name", description: "New name" },
         cron: { type: "string", value: "expr", description: "New schedule" },
+        ...WHEN_OPTIONS,
+        ...NOTIFY_OPTIONS,
         tz: { type: "string", value: "zone", description: "New IANA time zone" },
         ...ACTION_OPTIONS
       },
       examples: ['easybits crons update 66f0c2a1b2c3d4e5f6a7b8c9 --cron "0 7 * * 1-5"'],
       async run(ctx) {
-        const ref = need(ctx, 0, "id|name", this.usage);
-        const mine = await resolveUserCron(ctx, ref);
-        if (!mine) throw new CliError(t(`You have no cron "${ref}".`, `No tienes un cron "${ref}".`), EXIT.API, "easybits crons ls", "not_found", 404);
-        const a = actionFromFlags(flagsOf(ctx));
+        const ref2 = need(ctx, 0, "id|name", this.usage);
+        const mine = await resolveUserCron(ctx, ref2);
+        if (!mine) throw new CliError(t(`You have no cron "${ref2}".`, `No tienes un cron "${ref2}".`), EXIT.API, "easybits crons ls", "not_found", 404);
+        const a = actionOf(ctx);
         if ("error" in a) throw usageError(a.error, this.usage);
+        const w = scheduleFromFlags(whenOf(ctx));
+        if ("error" in w) throw usageError(w.error, this.usage);
+        const nf0 = notifyFromFlags({ notify: str(ctx, "notify"), notifyOn: str(ctx, "notify-on") });
+        if ("error" in nf0) throw usageError(nf0.error, this.usage);
+        const nf = await resolveNotifyInbox(ctx, nf0);
         const patch = {
+          ...nf,
           ...str(ctx, "name") ? { name: str(ctx, "name") } : {},
-          ...str(ctx, "cron") ? { cron: str(ctx, "cron") } : {},
-          ...str(ctx, "tz") ? { timezone: str(ctx, "tz") } : {},
-          ...a.action ? { action: a.action } : {}
+          ...w.fields,
+          ...a.action ? { action: a.action } : {},
+          ...a.secretValues ? { secretValues: a.secretValues } : {}
         };
         if (!Object.keys(patch).length) throw usageError(t("Nothing to change.", "No hay nada que cambiar."), this.usage);
         const c = await api(ctx, "PATCH", `/crons/${mine.id}`, patch);
-        emit(ctx, c, () => console.log(t(`Updated \xAB${c.name}\xBB \u2014 ${c.schedule}`, `Actualizado \xAB${c.name}\xBB \u2014 ${c.schedule}`)));
+        emit(ctx, c, () => console.log(t(`Updated \xAB${c.name}\xBB \u2014 ${c.schedule}; `, `Actualizado \xAB${c.name}\xBB \u2014 ${c.schedule}; `) + nextLine(c)));
       }
     },
     rm: {
@@ -5677,9 +5886,9 @@ ${failed.error}`);
       options: { ...YES_OPTION },
       examples: ["easybits crons rm 66f0c2a1b2c3d4e5f6a7b8c9 --yes"],
       async run(ctx) {
-        const ref = need(ctx, 0, "id|name", this.usage);
-        const mine = await resolveUserCron(ctx, ref);
-        if (!mine) throw new CliError(t(`You have no cron "${ref}".`, `No tienes un cron "${ref}".`), EXIT.API, "easybits crons ls", "not_found", 404);
+        const ref2 = need(ctx, 0, "id|name", this.usage);
+        const mine = await resolveUserCron(ctx, ref2);
+        if (!mine) throw new CliError(t(`You have no cron "${ref2}".`, `No tienes un cron "${ref2}".`), EXIT.API, "easybits crons ls", "not_found", 404);
         requireYesIfHeadless(ctx);
         await confirm(ctx, t(`Delete cron \xAB${mine.name}\xBB? It stops running right away.`, `\xBFBorrar el cron \xAB${mine.name}\xBB? Deja de correr de inmediato.`));
         const r = await api(ctx, "DELETE", `/crons/${mine.id}`);
@@ -5690,10 +5899,192 @@ ${failed.error}`);
   defaultSub: "ls"
 };
 
+// src/commands/inbox.ts
+import { resolveBaseUrl as resolveBaseUrl8 } from "@easybits.cloud/sdk";
+var ref = (r) => encodeURIComponent(r);
+function eventLine(e, width = 100) {
+  const body = (e.json !== void 0 ? JSON.stringify(e.json) : e.body).replace(/\s+/g, " ");
+  const head = `#${e.seq} ${fmtDate(e.receivedAt)} ${e.source}`;
+  const room = Math.max(width - head.length - 1, 10);
+  return `${head} ${body.length > room ? body.slice(0, room - 1) + "\u2026" : body}`;
+}
+function parseSse(buffer) {
+  const blocks = buffer.split(/\r?\n\r?\n/);
+  const rest = blocks.pop() ?? "";
+  const events = [];
+  for (const block of blocks) {
+    let event = "message";
+    let id;
+    const data = [];
+    for (const line2 of block.split(/\r?\n/)) {
+      if (line2.startsWith(":")) continue;
+      const i = line2.indexOf(":");
+      const k = i < 0 ? line2 : line2.slice(0, i);
+      const v = i < 0 ? "" : line2.slice(i + 1).replace(/^ /, "");
+      if (k === "event") event = v;
+      else if (k === "data") data.push(v);
+      else if (k === "id") id = v;
+    }
+    if (data.length) events.push({ event, data: data.join("\n"), id });
+  }
+  return { events, rest };
+}
+async function listen(ctx, name, since) {
+  const base = (await resolveBaseUrl8()).replace(/\/$/, "");
+  let last = since;
+  let backoff = 1e3;
+  for (; ; ) {
+    const token = await resolveCredential(ctx);
+    const q = last != null ? `?since=${last}` : "";
+    let res;
+    try {
+      res = await fetch(`${base}/api/v2/inboxes/${ref(name)}/events/stream${q}`, { headers: { Authorization: `Bearer ${token}`, Accept: "text/event-stream" } });
+    } catch {
+      await new Promise((r) => setTimeout(r, backoff));
+      backoff = Math.min(backoff * 2, 3e4);
+      continue;
+    }
+    if (res.status === 401 || res.status === 403 || res.status === 404) {
+      throw new CliError(t(`Can't listen to "${name}" (HTTP ${res.status}).`, `No se puede escuchar \xAB${name}\xBB (HTTP ${res.status}).`), res.status === 404 ? EXIT.API : EXIT.AUTH, "easybits inbox ls");
+    }
+    if (!res.ok || !res.body) {
+      await new Promise((r) => setTimeout(r, backoff));
+      backoff = Math.min(backoff * 2, 3e4);
+      continue;
+    }
+    backoff = 1e3;
+    const reader = res.body.getReader();
+    const dec = new TextDecoder();
+    let buf = "";
+    try {
+      for (; ; ) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        buf += dec.decode(value, { stream: true });
+        const { events, rest } = parseSse(buf);
+        buf = rest;
+        for (const ev of events) {
+          if (ev.event === "ready") {
+            const r = JSON.parse(ev.data);
+            if (last == null) last = r.since;
+            process.stderr.write(t(`Listening to \xAB${r.name}\xBB from #${r.since}. One JSON line per event.
+`, `Escuchando \xAB${r.name}\xBB desde #${r.since}. Una l\xEDnea JSON por evento.
+`));
+          } else if (ev.event === "inbox") {
+            const e = JSON.parse(ev.data);
+            last = e.seq;
+            process.stdout.write(JSON.stringify(e) + "\n");
+          }
+        }
+      }
+    } catch {
+    }
+    process.stderr.write(t("Connection dropped; reconnecting\u2026\n", "Se cort\xF3 la conexi\xF3n; reconectando\u2026\n"));
+  }
+}
+var inbox = {
+  name: "inbox",
+  aliases: ["inboxes"],
+  group: "Account",
+  summary: "Event inboxes: your own webhook URL whose events reach your terminal live or wait for you to read them",
+  synopsis: "inbox <ls|create|listen|read|rm>",
+  subs: {
+    ls: {
+      aliases: ["list"],
+      summary: "List your inboxes with their URL and unread events",
+      usage: "easybits inbox ls",
+      examples: ["easybits inbox ls", "easybits inbox ls --json"],
+      async run(ctx) {
+        const { items } = await api(ctx, "GET", "/inboxes");
+        emit(
+          ctx,
+          { items },
+          () => table(
+            items.map((b) => ({ name: b.name, unread: b.unread, last: b.lastEventAt ? fmtDate(b.lastEventAt) : "\u2014", url: b.url })),
+            [["name", "NAME"], ["unread", "UNREAD"], ["last", "LAST EVENT"], ["url", "URL"]],
+            t("No inboxes. Create one: easybits inbox create builds", "Sin buzones. Crea uno: easybits inbox create builds")
+          )
+        );
+      }
+    },
+    create: {
+      aliases: ["add"],
+      summary: "Create an inbox and print its webhook URL (anyone with it can write: keep it private)",
+      usage: "easybits inbox create <name> [--retention <days>]",
+      options: { retention: { type: "string", value: "days", description: "Days events are kept (1-30, default 7)" } },
+      examples: ["easybits inbox create builds", "easybits inbox create stripe --retention 30 --json"],
+      async run(ctx) {
+        const name = need(ctx, 0, "name", this.usage);
+        const days = str(ctx, "retention");
+        if (days != null && !/^\d+$/.test(days)) throw usageError(t("--retention is whole days.", "--retention son d\xEDas enteros."), this.usage);
+        const b = await api(ctx, "POST", "/inboxes", { name, ...days ? { retentionDays: Number(days) } : {} });
+        emit(ctx, b, () => {
+          console.log(t(`Inbox \xAB${b.name}\xBB ready. POST anything to:`, `Buz\xF3n \xAB${b.name}\xBB listo. Manda cualquier cosa con POST a:`));
+          console.log(`  ${b.url}`);
+          console.log(t(`Listen live: easybits inbox listen ${b.name}   \xB7   Read later: easybits inbox read ${b.name}`, `En vivo: easybits inbox listen ${b.name}   \xB7   Despu\xE9s: easybits inbox read ${b.name}`));
+        });
+      }
+    },
+    listen: {
+      aliases: ["tail", "follow"],
+      summary: "Stream an inbox: one JSON line per event as it arrives (reconnects on its own)",
+      usage: "easybits inbox listen <id|name> [--since <seq>]",
+      options: { since: { type: "string", value: "seq", description: "Start after this event (0 = everything kept; default: unread)" } },
+      examples: ["easybits inbox listen builds", "easybits inbox listen builds --since 0 | jq .json"],
+      async run(ctx) {
+        const name = need(ctx, 0, "id|name", this.usage);
+        const since = str(ctx, "since");
+        if (since != null && !/^\d+$/.test(since)) throw usageError(t("--since is an event number.", "--since es un n\xFAmero de evento."), this.usage);
+        await listen(ctx, name, since != null ? Number(since) : void 0);
+      }
+    },
+    read: {
+      summary: "Show the events you haven't read yet and mark them read (the next read brings only new ones)",
+      usage: "easybits inbox read <id|name> [--all] [--no-ack] [--limit N]",
+      options: {
+        all: { type: "boolean", description: "Everything still kept, read or not" },
+        "no-ack": { type: "boolean", description: "Just look; don't mark them read" },
+        limit: { type: "string", value: "N", description: "At most N events (default 50, max 200)" }
+      },
+      examples: ["easybits inbox read builds", "easybits inbox read builds --all --no-ack --json"],
+      async run(ctx) {
+        const name = need(ctx, 0, "id|name", this.usage);
+        const q = new URLSearchParams();
+        if (bool(ctx, "all")) q.set("since", "0");
+        if (bool(ctx, "no-ack")) q.set("ack", "0");
+        if (str(ctx, "limit")) q.set("limit", str(ctx, "limit"));
+        const r = await api(ctx, "GET", `/inboxes/${ref(name)}/events${q.size ? `?${q}` : ""}`);
+        emit(ctx, r, () => {
+          if (!r.items.length) return console.log(t("Nothing new.", "Nada nuevo."));
+          for (const e of r.items) console.log(eventLine(e, process.stdout.columns || 100));
+          if (r.unread) console.log(t(`
+${r.unread} more unread: easybits inbox read ${name}`, `
+Quedan ${r.unread} sin leer: easybits inbox read ${name}`));
+        });
+      }
+    },
+    rm: {
+      aliases: ["remove", "delete"],
+      summary: "Delete an inbox and its events; its URL stops accepting writes",
+      usage: "easybits inbox rm <id|name> [--yes]",
+      options: { ...YES_OPTION },
+      examples: ["easybits inbox rm builds --yes"],
+      async run(ctx) {
+        const name = need(ctx, 0, "id|name", this.usage);
+        requireYesIfHeadless(ctx);
+        await confirm(ctx, t(`Delete inbox \xAB${name}\xBB and its events?`, `\xBFBorrar el buz\xF3n \xAB${name}\xBB y sus eventos?`));
+        const r = await api(ctx, "DELETE", `/inboxes/${ref(name)}`);
+        emit(ctx, r, () => console.log(t(`Deleted \xAB${name}\xBB`, `Borrado \xAB${name}\xBB`)));
+      }
+    }
+  },
+  defaultSub: "ls"
+};
+
 // src/commands/documents.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync7, readFileSync as readFileSync18, statSync as statSync11, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync7, readFileSync as readFileSync19, statSync as statSync11, writeFileSync as writeFileSync10 } from "fs";
 import { join as join11 } from "path";
-import { EasybitsError as EasybitsError5, resolveBaseUrl as resolveBaseUrl8 } from "@easybits.cloud/sdk";
+import { EasybitsError as EasybitsError5, resolveBaseUrl as resolveBaseUrl9 } from "@easybits.cloud/sdk";
 
 // src/progress.ts
 import { writeFileSync as writeFileSync9 } from "fs";
@@ -5786,15 +6177,15 @@ function blankPageHtml(dims) {
   return `<section class="w-[${dims.width}px] h-[${dims.height}px] flex flex-col relative overflow-hidden bg-surface"></section>`;
 }
 var pagesOf = (doc) => [...doc.sections ?? []].sort((a, b) => a.order - b.order);
-function pageRef(pages, ref, usage2) {
-  const byId = pages.find((p) => p.id === ref);
+function pageRef(pages, ref2, usage2) {
+  const byId = pages.find((p) => p.id === ref2);
   if (byId) return byId;
-  if (/^\d+$/.test(ref)) {
-    const n = Number(ref);
+  if (/^\d+$/.test(ref2)) {
+    const n = Number(ref2);
     if (n >= 1 && n <= pages.length) return pages[n - 1];
   }
   throw usageError(
-    t(`No page "${ref}" in this document (${pages.length} pages: use 1-${pages.length} or a page id).`, `No hay p\xE1gina "${ref}" en este documento (${pages.length} p\xE1ginas: usa 1-${pages.length} o el id de la p\xE1gina).`),
+    t(`No page "${ref2}" in this document (${pages.length} pages: use 1-${pages.length} or a page id).`, `No hay p\xE1gina "${ref2}" en este documento (${pages.length} p\xE1ginas: usa 1-${pages.length} o el id de la p\xE1gina).`),
     usage2
   );
 }
@@ -5816,16 +6207,16 @@ function readHtml(path, usage2) {
     return readStdin().then((b) => b.toString("utf8"));
   }
   if (!existsSync16(path)) throw usageError(t(`File not found: ${path}`, `No existe el archivo: ${path}`), usage2);
-  return readFileSync18(path, "utf8");
+  return readFileSync19(path, "utf8");
 }
 var getDoc = (ctx, id) => api(ctx, "GET", `/documents/${encodeURIComponent(id)}`);
 var docPath = (id) => `/documents/${encodeURIComponent(id)}`;
 async function editorUrl(id) {
-  return `${(await resolveBaseUrl8()).replace(/\/$/, "")}/dash/documents/${id}`;
+  return `${(await resolveBaseUrl9()).replace(/\/$/, "")}/dash/documents/${id}`;
 }
 async function getBytes(ctx, path) {
   const token = await resolveCredential(ctx);
-  const base = (await resolveBaseUrl8()).replace(/\/$/, "");
+  const base = (await resolveBaseUrl9()).replace(/\/$/, "");
   const res = await fetch(`${base}/api/v2${path}`, { headers: { Authorization: `Bearer ${token}` } });
   if (!res.ok) throw new EasybitsError5(res.status, await res.text());
   return Buffer.from(await res.arrayBuffer());
@@ -6000,10 +6391,10 @@ var documents = {
       examples: ["easybits documents rm-page 'Cotizaci\xF3n ACME' 3 --yes"],
       async run(ctx) {
         const id = need(ctx, 0, "document", this.usage);
-        const ref = need(ctx, 1, "page", this.usage);
+        const ref2 = need(ctx, 1, "page", this.usage);
         requireYesIfHeadless(ctx);
         const pages = pagesOf(await getDoc(ctx, id));
-        const page = pageRef(pages, ref, this.usage);
+        const page = pageRef(pages, ref2, this.usage);
         await confirm(ctx, t(`Delete page ${pages.indexOf(page) + 1} (${page.label || page.id})?`, `\xBFBorrar la p\xE1gina ${pages.indexOf(page) + 1} (${page.label || page.id})?`));
         const r = await api(ctx, "DELETE", `${docPath(id)}/pages/${encodeURIComponent(page.id)}`);
         emit(ctx, r, () => console.log(t(`Deleted. ${r.remainingPages} page(s) left.`, `Borrada. Quedan ${r.remainingPages} p\xE1gina(s).`)));
@@ -6105,8 +6496,8 @@ var documents = {
 };
 
 // src/commands/video.ts
-import { existsSync as existsSync17, readFileSync as readFileSync19 } from "fs";
-import { EasybitsError as EasybitsError6, resolveBaseUrl as resolveBaseUrl9 } from "@easybits.cloud/sdk";
+import { existsSync as existsSync17, readFileSync as readFileSync20 } from "fs";
+import { EasybitsError as EasybitsError6, resolveBaseUrl as resolveBaseUrl10 } from "@easybits.cloud/sdk";
 var VIDEO_PRESETS = {
   portrait: [1080, 1920],
   story: [1080, 1920],
@@ -6145,22 +6536,22 @@ function projectBody(o, usage2) {
   return body;
 }
 var scenesOf = (p) => [...p.scenes ?? []].sort((a, b) => a.order - b.order);
-function sceneRef(scenes, ref, usage2) {
-  const byId = scenes.find((s) => s.id === ref);
+function sceneRef(scenes, ref2, usage2) {
+  const byId = scenes.find((s) => s.id === ref2);
   if (byId) return byId;
-  if (/^\d+$/.test(ref)) {
-    const n = Number(ref);
+  if (/^\d+$/.test(ref2)) {
+    const n = Number(ref2);
     if (n >= 1 && n <= scenes.length) return scenes[n - 1];
   }
   throw usageError(
-    t(`No scene "${ref}" in this project (${scenes.length} scenes: use 1-${scenes.length} or a scene id).`, `No hay escena "${ref}" en este proyecto (${scenes.length} escenas: usa 1-${scenes.length} o el id de la escena).`),
+    t(`No scene "${ref2}" in this project (${scenes.length} scenes: use 1-${scenes.length} or a scene id).`, `No hay escena "${ref2}" en este proyecto (${scenes.length} escenas: usa 1-${scenes.length} o el id de la escena).`),
     usage2
   );
 }
 function sceneRows(scenes) {
   return scenes.map((s, i) => ({ n: i + 1, id: s.id, label: s.label ?? "-", durationSec: s.durationSec, narration: s.narration ? s.narration.slice(0, 40) : "-" }));
 }
-function sceneBody(o, usage2, readFile = (p) => existsSync17(p) ? readFileSync19(p, "utf8") : null) {
+function sceneBody(o, usage2, readFile = (p) => existsSync17(p) ? readFileSync20(p, "utf8") : null) {
   const body = {};
   if (o.timeline != null) body.timeline = readFile(o.timeline) ?? o.timeline;
   if (o.duration != null) {
@@ -6194,11 +6585,11 @@ function readHtml2(path, usage2) {
     return readStdin().then((b) => b.toString("utf8"));
   }
   if (!existsSync17(path)) throw usageError(t(`File not found: ${path}`, `No existe el archivo: ${path}`), usage2);
-  return readFileSync19(path, "utf8");
+  return readFileSync20(path, "utf8");
 }
 async function postRender(ctx, id, signal) {
   const token = await resolveCredential(ctx);
-  const base = (await resolveBaseUrl9()).replace(/\/$/, "");
+  const base = (await resolveBaseUrl10()).replace(/\/$/, "");
   const res = await fetch(`${base}/api/v2${projectPath(id)}/render`, { method: "POST", headers: { Authorization: `Bearer ${token}` }, signal });
   const text = await res.text();
   if (!res.ok) throw new EasybitsError6(res.status, text);
@@ -6478,6 +6869,7 @@ var COMMANDS = [
   usage,
   secrets,
   crons,
+  inbox,
   sandboxes,
   agents,
   fleet,
@@ -6819,20 +7211,47 @@ var HELP_ES = {
   "Release a machine: stops billing, takes a last backup and destroys it": "Libera una m\xE1quina: deja de cobrarse, toma un \xFAltimo respaldo y la destruye",
   "The hosting catalog: sizes and monthly prices in MXN": "El cat\xE1logo de hosting: tama\xF1os y precio mensual en MXN",
   // crons (tuyos y de la plataforma)
-  "Your scheduled jobs (call a URL or message an agent) and, for admins, the platform's": "Tus tareas programadas (pegarle a una URL o escribirle a un agente) y, para admins, las de la plataforma",
+  "Your scheduled jobs (call a URL, message an agent or run a command; repeating or once) and, for admins, the platform's": "Tus tareas programadas (pegarle a una URL, escribirle a un agente o correr un comando; repetidas o de una sola vez) y, para admins, las de la plataforma",
   "List your crons (or, with --platform, the platform's scheduled jobs)": "Enlista tus crons (o, con --platform, las tareas de la plataforma)",
   "Platform jobs (backups, purges\u2026; platform admins only)": "Tareas de la plataforma (respaldos, purgas\u2026; s\xF3lo admins)",
   "Show the last runs of one of your crons (id or name) or of a platform job, with the full error": "Muestra las \xFAltimas corridas de un cron tuyo (id o nombre) o de una tarea de la plataforma, con el error completo",
   "Run one of your crons or a platform job now, in the background (trigger manual)": "Corre ya un cron tuyo o una tarea de la plataforma, en segundo plano (manual)",
   "Pause one of your crons or a platform job until you resume it": "Pausa un cron tuyo o una tarea de la plataforma hasta que lo reanudes",
   "Resume one of your crons or a platform job": "Reanuda un cron tuyo o una tarea de la plataforma",
-  "Create a cron: call a public https URL or send a turn to one of your agents (at most every 5 min)": "Crea un cron: pegarle a una URL https p\xFAblica o mandarle un turno a uno de tus agentes (como mucho cada 5 min)",
+  "Create a cron: call a public https URL, send a turn to one of your agents or run a command in a throwaway box, repeating (at most every 5 min) or once": "Crea un cron: pegarle a una URL https p\xFAblica, mandarle un turno a uno de tus agentes o correr un comando en una caja desechable, repetido (como mucho cada 5 min) o de una sola vez",
+  "Vault secret: a header with --url (default Authorization: Bearer); an env var with --run (repeatable)": "Secreto de la b\xF3veda: header con --url (default Authorization: Bearer); variable de entorno con --run (repetible)",
+  "Run this shell command in a throwaway box instead (python, files and secrets included; success = exit 0)": "Correr este comando de shell en una caja desechable (con python, tus archivos y secretos; \xE9xito = exit 0)",
+  "File mounted for --run, next to the command by default (repeatable)": "Archivo que se monta para --run, junto al comando por default (repetible)",
+  "Upload a local file as a secret only this cron can read, written at the same ~ path in the box (repeatable; e.g. a .p8)": "Sube un archivo local como secreto que s\xF3lo este cron puede leer; se escribe en la misma ruta ~ dentro de la caja (repetible; p. ej. un .p8)",
+  "Box image for --run (default python)": "Imagen de la caja para --run (default python)",
+  "Time limit for --run (default 300, max 600)": "Tiempo l\xEDmite de --run (default 300, m\xE1ximo 600)",
+  "Also print stdout/stderr of --run crons (last 64 KB per run)": "Muestra tambi\xE9n stdout/stderr de los crons --run (\xFAltimos 64 KB por corrida)",
+  "Wait for the next run of one of your crons to finish and exit with its result (exec: its exit code)": "Espera a que termine la siguiente corrida de un cron tuyo y sale con su resultado (exec: su c\xF3digo de salida)",
+  "Give up after this long (default 30m; 10m, 2h\u2026)": "Se rinde despu\xE9s de este tiempo (default 30m; 10m, 2h\u2026)",
+  "Tell you after each run: push to the Ghosty app (vault secret GHOSTY_PUSH_TOKEN), email to your account and/or an event in one of your inboxes; none removes it": "Te avisa tras cada corrida: push a la app de Ghosty (secreto GHOSTY_PUSH_TOKEN de la b\xF3veda), correo a tu cuenta y/o un evento en uno de tus buzones; none lo quita",
+  // inbox (buzones de eventos)
+  "Event inboxes: your own webhook URL whose events reach your terminal live or wait for you to read them": "Buzones de eventos: tu propia URL de webhook; lo que llega te alcanza en la terminal en vivo o te espera para que lo leas",
+  "List your inboxes with their URL and unread events": "Enlista tus buzones con su URL y los eventos sin leer",
+  "Create an inbox and print its webhook URL (anyone with it can write: keep it private)": "Crea un buz\xF3n e imprime su URL de webhook (quien la tenga puede escribir: no la publiques)",
+  "Days events are kept (1-30, default 7)": "D\xEDas que se guardan los eventos (1-30, default 7)",
+  "Stream an inbox: one JSON line per event as it arrives (reconnects on its own)": "Escucha un buz\xF3n: una l\xEDnea JSON por evento en cuanto llega (se reconecta solo)",
+  "Start after this event (0 = everything kept; default: unread)": "Empieza despu\xE9s de este evento (0 = todo lo guardado; default: lo no le\xEDdo)",
+  "Show the events you haven't read yet and mark them read (the next read brings only new ones)": "Muestra los eventos que no has le\xEDdo y los marca como le\xEDdos (la siguiente lectura trae s\xF3lo lo nuevo)",
+  "Everything still kept, read or not": "Todo lo guardado, le\xEDdo o no",
+  "Just look; don't mark them read": "S\xF3lo mirar; no marcarlos como le\xEDdos",
+  "At most N events (default 50, max 200)": "Como m\xE1ximo N eventos (default 50, tope 200)",
+  "Delete an inbox and its events; its URL stops accepting writes": "Borra un buz\xF3n y sus eventos; su URL deja de aceptar escrituras",
+  "When to notify (default failure)": "Cu\xE1ndo avisar (default failure: s\xF3lo si falla)",
+  'Run ONCE at this time: ISO ("2026-10-18T23:00", read in --tz) or "23:00" (today)': 'Correr UNA SOLA VEZ a esta hora: ISO ("2026-10-18T23:00", en la zona de --tz) o "23:00" (hoy)',
+  "Run ONCE after this long: 10m, 2h, 1h30m, 1d": "Correr UNA SOLA VEZ dentro de: 10m, 2h, 1h30m, 1d",
+  "A repeating cron stops after this date": "Un cron que se repite se detiene despu\xE9s de esta fecha",
+  "A repeating cron stops after N more runs": "Un cron que se repite se detiene tras N corridas m\xE1s",
+  "Validate and show the next 3 runs without creating anything": "Valida y muestra las pr\xF3ximas 3 corridas sin crear nada",
   'Cron of 5 fields, e.g. "30 8 * * *" = daily 8:30': 'Cron de 5 campos, p. ej. "30 8 * * *" = diario 8:30',
   "IANA time zone (default America/Mexico_City)": "Zona horaria IANA (default America/Mexico_City)",
   "Call this public https URL on each run": "Pegarle a esta URL https p\xFAblica en cada corrida",
   "HTTP method (default GET)": "M\xE9todo HTTP (default GET)",
   "Request body (not with GET)": "Cuerpo de la petici\xF3n (no con GET)",
-  "Vault secret sent as a header (default Authorization: Bearer)": "Secreto de la b\xF3veda que viaja como header (default Authorization: Bearer)",
   "Header for --secret": "Header para --secret",
   "Send a turn to this fleet agent instead of calling a URL": "Mandarle un turno a este agente de la flota en vez de pegarle a una URL",
   "What the agent is told on each run (with --agent)": "Lo que se le dice al agente en cada corrida (con --agent)",
@@ -7155,7 +7574,7 @@ function normalizeArgs(input) {
 }
 
 // src/index.ts
-var VERSION2 = true ? "0.18.0" : "dev";
+var VERSION2 = true ? "0.19.0" : "dev";
 var GLOBAL_OPTIONS = {
   json: { type: "boolean" },
   token: { type: "string" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easybits.cloud/cli",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Official CLI for EasyBits, the cloud for AI agents — sandboxes, hosting, domains, databases, agents and files from your terminal",
   "type": "module",
   "bin": {