@evalops/maestro 0.10.15 → 0.10.17

package/dist/cli.js

@@ -37563,16 +37563,16 @@ import { WebSocketServer } from "ws";
 import { realpath as realpath3, stat as stat8 } from "node:fs/promises";
 import { resolve as resolve58 } from "node:path";
 import chalk60 from "chalk";
+import chalk61 from "chalk";
+import chalk62 from "chalk";
 import { existsSync as existsSync103, mkdirSync as mkdirSync40, readFileSync as readFileSync75, writeFileSync as writeFileSync41 } from "node:fs";
 import { join as join82 } from "node:path";
-import chalk61 from "chalk";
+import chalk63 from "chalk";
 import { timingSafeEqual as timingSafeEqual7 } from "node:crypto";
 import {
   createServer as createServer7
 } from "node:http";
 import { URL as URL2 } from "node:url";
-import chalk62 from "chalk";
-import chalk63 from "chalk";
 import chalk64 from "chalk";
 import chalk65 from "chalk";
 import { createInterface as createInterface2 } from "node:readline/promises";
@@ -38029,11 +38029,9 @@ var Logger = class {
     }
   }
   outputJson(entry2) {
-    const output = entry2.level === "error" ? console.error : console.log;
-    output(JSON.stringify(entry2));
+    console.error(JSON.stringify(entry2));
   }
   outputPretty(entry2) {
-    const output = entry2.level === "error" ? console.error : console.log;
     const parts = [];
     if (this.config.timestamps) {
       parts.push(`[${entry2.timestamp}]`);
@@ -38043,9 +38041,9 @@ var Logger = class {
     if (entry2.context && Object.keys(entry2.context).length > 0) {
       parts.push(JSON.stringify(entry2.context));
     }
-    output(parts.join(" "));
+    console.error(parts.join(" "));
     if (entry2.error?.stack) {
-      output(entry2.error.stack);
+      console.error(entry2.error.stack);
     }
   }
   debug(message, context2) {
@@ -38353,20 +38351,20 @@ function resolveManagedEvalOpsContext(env = process.env, loadCredentials) {
     evidencePublisher: managed ? "EvalOps" : "none",
     expiresAt: credentials?.expires,
     inference: managed ? "managed" : "local",
-    integrationProfile: agentMcp?.integrationProfile,
+    integrationProfile: readEnv2(env, INTEGRATION_PROFILE_ENV) ?? agentMcp?.integrationProfile,
     keyPrefix: agentMcp?.keyPrefix,
     managed,
-    memoryMode: agentMcp?.memoryMode,
+    memoryMode: readEnv2(env, MEMORY_MODE_ENV) ?? agentMcp?.memoryMode,
     mode,
     organizationId,
     providerRef,
     runId,
-    runtimeOwner: agentMcp?.runtimeOwner,
+    runtimeOwner: readEnv2(env, RUNTIME_OWNER_ENV) ?? agentMcp?.runtimeOwner,
     sessionExpiresAt: agentMcp?.sessionExpiresAt,
     sessionId: readEnv2(env, ["MAESTRO_SESSION_ID"]),
-    shimType: agentMcp?.shimType,
+    shimType: readEnv2(env, SHIM_TYPE_ENV) ?? agentMcp?.shimType,
     traceIngestion: managed && runId ? "live" : "not configured",
-    traceMode: agentMcp?.traceMode,
+    traceMode: readEnv2(env, TRACE_MODE_ENV) ?? agentMcp?.traceMode,
     userEmail: nonEmptyString(metadata?.email),
     userId: readEnv2(env, USER_ENV) ?? nonEmptyString(metadata?.userId),
     workspaceId
@@ -38397,6 +38395,8 @@ function formatManagedEvalOpsStatus(context2, options = {}) {
   if (context2.integrationProfile) {
     lines.push(`${dim("Integration profile")}: ${context2.integrationProfile}`);
   }
+  if (context2.runtimeOwner)
+    lines.push(`${dim("Runtime owner")}: ${context2.runtimeOwner}`);
   if (context2.shimType)
     lines.push(`${dim("Shim")}: ${context2.shimType}`);
   if (context2.traceMode)
@@ -38430,6 +38430,11 @@ var ORG_ENV;
 var WORKSPACE_ENV;
 var USER_ENV;
 var TOKEN_ENV;
+var INTEGRATION_PROFILE_ENV;
+var MEMORY_MODE_ENV;
+var RUNTIME_OWNER_ENV;
+var SHIM_TYPE_ENV;
+var TRACE_MODE_ENV;
 var init_managed_context = __esm2(() => {
   init_storage();
   ORG_ENV = [
@@ -38452,6 +38457,26 @@ var init_managed_context = __esm2(() => {
     "MAESTRO_USER_ID"
   ];
   TOKEN_ENV = ["MAESTRO_EVALOPS_ACCESS_TOKEN", "EVALOPS_TOKEN"];
+  INTEGRATION_PROFILE_ENV = [
+    "MAESTRO_EVALOPS_INTEGRATION_PROFILE",
+    "MAESTRO_INTEGRATION_PROFILE"
+  ];
+  MEMORY_MODE_ENV = [
+    "MAESTRO_EVALOPS_MEMORY_MODE",
+    "MAESTRO_MEMORY_MODE"
+  ];
+  RUNTIME_OWNER_ENV = [
+    "MAESTRO_EVALOPS_RUNTIME_OWNER",
+    "MAESTRO_RUNTIME_OWNER"
+  ];
+  SHIM_TYPE_ENV = [
+    "MAESTRO_EVALOPS_SHIM_TYPE",
+    "MAESTRO_SHIM_TYPE"
+  ];
+  TRACE_MODE_ENV = [
+    "MAESTRO_EVALOPS_TRACE_MODE",
+    "MAESTRO_TRACE_MODE"
+  ];
 });
 function entry(type, category, protoMessage, platformConsumers) {
   return {
@@ -87970,14 +87995,14 @@ function buildPlatformMcpHeaders() {
     "X-EvalOps-Session-Id": getEnvValue3(["MAESTRO_SESSION_ID"]),
     "X-EvalOps-Agent-Id": getEnvValue3(PLATFORM_MCP_AGENT_ID_ENV_VARS) ?? stored?.agentId,
     "X-EvalOps-Agent-Run-Id": getEnvValue3(["MAESTRO_AGENT_RUN_ID"]) ?? stored?.runId,
-    "X-EvalOps-Integration-Profile": stored?.integrationProfile,
-    "X-EvalOps-Memory-Mode": stored?.memoryMode,
-    "X-EvalOps-Runtime-Owner": stored?.runtimeOwner,
+    "X-EvalOps-Integration-Profile": getEnvValue3(PLATFORM_MCP_INTEGRATION_PROFILE_ENV_VARS) ?? stored?.integrationProfile,
+    "X-EvalOps-Memory-Mode": getEnvValue3(PLATFORM_MCP_MEMORY_MODE_ENV_VARS) ?? stored?.memoryMode,
+    "X-EvalOps-Runtime-Owner": getEnvValue3(PLATFORM_MCP_RUNTIME_OWNER_ENV_VARS) ?? stored?.runtimeOwner,
     "X-EvalOps-Scopes": getEnvValue3(PLATFORM_MCP_SCOPES_ENV_VARS),
-    "X-EvalOps-Shim-Type": stored?.shimType,
+    "X-EvalOps-Shim-Type": getEnvValue3(PLATFORM_MCP_SHIM_TYPE_ENV_VARS) ?? stored?.shimType,
     "X-EvalOps-Request-Id": getEnvValue3(["MAESTRO_REQUEST_ID"]),
     "X-EvalOps-Trace-Id": getEnvValue3(["TRACE_ID", "OTEL_TRACE_ID"]),
-    "X-EvalOps-Trace-Mode": stored?.traceMode,
+    "X-EvalOps-Trace-Mode": getEnvValue3(PLATFORM_MCP_TRACE_MODE_ENV_VARS) ?? stored?.traceMode,
     "X-EvalOps-Maestro-Surface": getEnvValue3(["MAESTRO_SURFACE"]) ?? "maestro"
   }).filter((entry2) => typeof entry2[1] === "string" && entry2[1].trim().length > 0));
   return Object.keys(headers).length > 0 ? headers : void 0;
@@ -88026,6 +88051,11 @@ var PLATFORM_MCP_TOKEN_ENV_VARS;
 var PLATFORM_MCP_WORKSPACE_ENV_VARS;
 var PLATFORM_MCP_AGENT_ID_ENV_VARS;
 var PLATFORM_MCP_SCOPES_ENV_VARS;
+var PLATFORM_MCP_INTEGRATION_PROFILE_ENV_VARS;
+var PLATFORM_MCP_MEMORY_MODE_ENV_VARS;
+var PLATFORM_MCP_RUNTIME_OWNER_ENV_VARS;
+var PLATFORM_MCP_SHIM_TYPE_ENV_VARS;
+var PLATFORM_MCP_TRACE_MODE_ENV_VARS;
 var DEFAULT_PLATFORM_MCP_SERVER_NAME = "evalops";
 var AGENT_MCP_MANIFEST_PATH2 = "/.well-known/evalops/agent-mcp.json";
 var AGENT_MCP_PATH2 = "/mcp";
@@ -88074,6 +88104,26 @@ var init_platform_plugin = __esm2(() => {
     "MAESTRO_EVALOPS_AGENT_MCP_SCOPES",
     "MAESTRO_CEREBRO_MCP_SCOPES"
   ];
+  PLATFORM_MCP_INTEGRATION_PROFILE_ENV_VARS = [
+    "MAESTRO_EVALOPS_INTEGRATION_PROFILE",
+    "MAESTRO_INTEGRATION_PROFILE"
+  ];
+  PLATFORM_MCP_MEMORY_MODE_ENV_VARS = [
+    "MAESTRO_EVALOPS_MEMORY_MODE",
+    "MAESTRO_MEMORY_MODE"
+  ];
+  PLATFORM_MCP_RUNTIME_OWNER_ENV_VARS = [
+    "MAESTRO_EVALOPS_RUNTIME_OWNER",
+    "MAESTRO_RUNTIME_OWNER"
+  ];
+  PLATFORM_MCP_SHIM_TYPE_ENV_VARS = [
+    "MAESTRO_EVALOPS_SHIM_TYPE",
+    "MAESTRO_SHIM_TYPE"
+  ];
+  PLATFORM_MCP_TRACE_MODE_ENV_VARS = [
+    "MAESTRO_EVALOPS_TRACE_MODE",
+    "MAESTRO_TRACE_MODE"
+  ];
 });
 var mcpNameSchema;
 var mcpTransportSchema;
@@ -170388,6 +170438,223 @@ Environment:
   MAESTRO_ATTACH_AUDIENCE`;
 var init_hosted_runner = () => {
 };
+var exports_init = {};
+__export2(exports_init, {
+  parseInitArgs: () => parseInitArgs,
+  handleInitCommand: () => handleInitCommand2,
+  formatInitSuccess: () => formatInitSuccess,
+  formatInitHelp: () => formatInitHelp
+});
+function formatInitHelp() {
+  return `${sectionHeading("maestro init")}${muted(`  maestro init                         Login, create or reuse an API key, and register this agent
+  maestro init --rotate-key           Replace the stored agent MCP API key
+  maestro init --mcp-url <url>        Override the EvalOps agent MCP endpoint
+  maestro init --json                 Emit machine-readable bootstrap output
+
+Options
+  --agent-type <type>                 Agent type to register, defaults to maestro
+  --surface <surface>                 Surface to register, defaults to cli
+  --integration-profile <profile>     mcp_only, mcp_otlp, managed_runtime, sdk_integrated, or provider_proxy
+  --shim-type <type>                  native_mcp, command_wrapper, hook, provider_proxy, sdk, or mcp_firewall_proxy
+  --trace-mode <mode>                 none, mcp_events, or otlp
+  --memory-mode <mode>                none, read_only, durable, or cerebro
+  --runtime-owner <owner>             external or evalops
+  --workspace, --workspace-id <id>    Workspace to associate with the registration
+  --scope <scope[,scope...]>          Registration scopes to request
+  --key-scope <scope[,scope...]>      API key scopes to request
+  --expires-in-days <days>            API key TTL in days
+  --force-login                       Re-run EvalOps OAuth before bootstrapping
+  --manifest-url <url>                Override the agent MCP manifest URL
+  --ttl-seconds <seconds>             Registration TTL in seconds`)}`;
+}
+function readValue(args, index2, flag) {
+  const value = args[index2 + 1];
+  if (!value || value.startsWith("-")) {
+    throw new Error(`${flag} requires a value`);
+  }
+  return value;
+}
+function parsePositiveInteger(value, flag) {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new Error(`${flag} must be a positive integer`);
+  }
+  return parsed;
+}
+function appendScopes(existing, value) {
+  return [
+    ...existing ?? [],
+    ...value.split(",").map((entry2) => entry2.trim()).filter((entry2) => entry2.length > 0)
+  ];
+}
+function parseInitArgs(args) {
+  const options = {};
+  for (let i2 = 0; i2 < args.length; i2++) {
+    const arg = args[i2];
+    switch (arg) {
+      case "--agent-mcp-url":
+      case "--mcp-url":
+        options.mcpUrl = readValue(args, i2, arg);
+        i2++;
+        break;
+      case "--agent-type":
+        options.agentType = readValue(args, i2, arg);
+        i2++;
+        break;
+      case "--api-key-scope":
+      case "--key-scope":
+        options.apiKeyScopes = appendScopes(options.apiKeyScopes, readValue(args, i2, arg));
+        i2++;
+        break;
+      case "--expires-in-days":
+        options.expiresInDays = parsePositiveInteger(readValue(args, i2, arg), arg);
+        i2++;
+        break;
+      case "--force-login":
+        options.forceLogin = true;
+        break;
+      case "--integration-profile":
+        options.integrationProfile = readValue(args, i2, arg);
+        i2++;
+        break;
+      case "--json":
+        options.json = true;
+        break;
+      case "--key-name":
+        options.keyName = readValue(args, i2, arg);
+        i2++;
+        break;
+      case "--manifest-url":
+        options.manifestUrl = readValue(args, i2, arg);
+        i2++;
+        break;
+      case "--memory-mode":
+        options.memoryMode = readValue(args, i2, arg);
+        i2++;
+        break;
+      case "--register-scope":
+      case "--scope":
+        options.registerScopes = appendScopes(options.registerScopes, readValue(args, i2, arg));
+        i2++;
+        break;
+      case "--rotate-key":
+        options.rotateKey = true;
+        break;
+      case "--runtime-owner":
+        options.runtimeOwner = readValue(args, i2, arg);
+        i2++;
+        break;
+      case "--shim-type":
+        options.shimType = readValue(args, i2, arg);
+        i2++;
+        break;
+      case "--surface":
+        options.surface = readValue(args, i2, arg);
+        i2++;
+        break;
+      case "--trace-mode":
+        options.traceMode = readValue(args, i2, arg);
+        i2++;
+        break;
+      case "--ttl-seconds":
+        options.ttlSeconds = parsePositiveInteger(readValue(args, i2, arg), arg);
+        i2++;
+        break;
+      case "--workspace":
+      case "--workspace-id":
+        options.workspaceId = readValue(args, i2, arg);
+        i2++;
+        break;
+      default:
+        if (arg?.startsWith("-")) {
+          throw new Error(`Unknown maestro init option: ${arg}`);
+        }
+        throw new Error(`Unexpected maestro init argument: ${arg}`);
+    }
+  }
+  return options;
+}
+function checkLine(text2) {
+  return `${chalk61.green("\u2713")} ${text2}`;
+}
+function formatInitSuccess(result) {
+  const keyMode = result.apiKeyCreated ? "Created" : "Reused";
+  const authenticatedAs = result.authenticatedAs ?? "EvalOps";
+  const governedActions = result.governedActionsLoaded ?? 0;
+  const lines = [
+    chalk61.bold("EvalOps Maestro bootstrap"),
+    "",
+    checkLine(`Authenticated as ${authenticatedAs}`),
+    checkLine(`${keyMode} managed inference key`),
+    checkLine("Registered local agent runtime"),
+    checkLine(`Integration profile ${result.integrationProfile ?? "managed_runtime"} via ${result.shimType ?? "sdk"}`),
+    checkLine(`Loaded ${governedActions} governed actions`),
+    checkLine(result.approvalPolicyAttached ? "Attached default approval policy" : "Queued approval policy review"),
+    checkLine(result.traceIngestionStarted ? "Started trace ingestion" : "Requested trace ingestion"),
+    checkLine(result.governedInferenceCheckRan ? "Ran first governed inference check" : "Queued first governed inference check"),
+    checkLine(result.evidenceEventPublished ? "Published evidence event" : "Queued evidence event"),
+    "",
+    "Open console:",
+    result.consoleUrl ?? "https://app.evalops.dev/overview?env=production"
+  ];
+  return lines.join(`
+`);
+}
+async function handleInitCommand2(args = []) {
+  if (args.includes("--help") || args.includes("-h")) {
+    console.log(formatInitHelp());
+    return;
+  }
+  let options;
+  try {
+    options = parseInitArgs(args);
+  } catch (error) {
+    console.error(chalk61.red(error instanceof Error ? error.message : String(error)));
+    process.exit(1);
+  }
+  const result = await bootstrapEvalOpsAgent(options, {
+    onAuthUrl: (url) => {
+      if (options.json) {
+        console.error("Open this URL in your browser to authenticate with EvalOps:");
+        console.error(url);
+        return;
+      }
+      console.log(chalk61.yellow("Open this URL in your browser to authenticate with EvalOps:"));
+      console.log(chalk61.underline(url));
+    },
+    onStatus: (status) => {
+      if (options.json) {
+        console.error(status.message);
+        return;
+      }
+      console.log(chalk61.dim(status.message));
+    }
+  });
+  if (options.json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  console.log(formatInitSuccess(result));
+}
+var init_init = __esm2(() => {
+  init_agent_bootstrap();
+  init_theme2();
+});
+var exports_status = {};
+__export2(exports_status, {
+  handleStatusCommand: () => handleStatusCommand
+});
+async function handleStatusCommand() {
+  const context2 = resolveManagedEvalOpsContext();
+  console.log(chalk62.bold("Maestro status"));
+  console.log(formatManagedEvalOpsStatus(context2));
+  if (!context2.authenticated) {
+    console.log(chalk62.dim('Run "maestro init" to bring EvalOps managed mode online.'));
+  }
+}
+var init_status4 = __esm2(() => {
+  init_managed_context();
+});
 var exports_config = {};
 __export2(exports_config, {
   handleConfigValidate: () => handleConfigValidate,
@@ -170557,7 +170824,7 @@ function buildConfigShowSections(inspection, options) {
     output.push(badge(`Providers (${inspection.providers.length})`, void 0, "info"));
     for (const provider of inspection.providers) {
       const isOverrideOnly = provider.modelCount === 0;
-      const heading2 = `${chalk61.cyan(provider.id)} ${muted(`(${provider.modelCount} models)`)}`;
+      const heading2 = `${chalk63.cyan(provider.id)} ${muted(`(${provider.modelCount} models)`)}`;
       const enabledBadge = provider.enabled ? badge("enabled", void 0, "success") : badge("disabled", void 0, "warn");
       const metaBadges = [];
       if (isOverrideOnly) {
@@ -170612,7 +170879,7 @@ function buildConfigShowSections(inspection, options) {
     for (const envVar of inspection.envVars) {
       const status = envVar.set ? badge("set", void 0, "success") : badge("missing", void 0, "warn");
       const value = envVar.maskedValue ? envVar.maskedValue : "(not set)";
-      output.push(`  ${status} ${chalk61.cyan(envVar.name)}: ${muted(value)}`);
+      output.push(`  ${status} ${chalk63.cyan(envVar.name)}: ${muted(value)}`);
     }
     output.push("");
   }
@@ -170636,14 +170903,14 @@ async function handleConfigValidate() {
   if (result.errors.length > 0) {
     console.log(badge("[ERROR] Errors", void 0, "danger"));
     for (const error of result.errors) {
-      console.log(chalk61.red(`  \u2022 ${error}`));
+      console.log(chalk63.red(`  \u2022 ${error}`));
     }
     console.log();
   }
   if (result.warnings.length > 0) {
     console.log(badge("[WARN] Warnings", void 0, "warn"));
     for (const warning of result.warnings) {
-      console.log(chalk61.yellow(`  \u2022 ${warning}`));
+      console.log(chalk63.yellow(`  \u2022 ${warning}`));
     }
     console.log();
   }
@@ -170677,7 +170944,7 @@ function renderConfigShowLegacy(inspection, hierarchy, homeDir) {
     console.log(badge(`Providers (${inspection.providers.length})`, void 0, "info"));
     for (const provider of inspection.providers) {
       const isOverrideOnly = provider.modelCount === 0;
-      const heading2 = `${chalk61.cyan(provider.id)} ${muted(`(${provider.modelCount} models)`)}`;
+      const heading2 = `${chalk63.cyan(provider.id)} ${muted(`(${provider.modelCount} models)`)}`;
       const enabledBadge = provider.enabled ? badge("enabled", void 0, "success") : badge("disabled", void 0, "warn");
       const metaBadges = [];
       if (isOverrideOnly) {
@@ -170733,7 +171000,7 @@ function renderConfigShowLegacy(inspection, hierarchy, homeDir) {
     for (const envVar of inspection.envVars) {
       const status = envVar.set ? badge("set", void 0, "success") : badge("missing", void 0, "warn");
       const value = envVar.maskedValue ? envVar.maskedValue : "(not set)";
-      console.log(`  ${status} ${chalk61.cyan(envVar.name)}: ${muted(value)}`);
+      console.log(`  ${status} ${chalk63.cyan(envVar.name)}: ${muted(value)}`);
     }
     console.log();
   }
@@ -170770,7 +171037,7 @@ async function handleConfigInit() {
     const configPath2 = join82(configDir, "config.json");
     const promptsDir = join82(configDir, "prompts");
     if (existsSync103(configPath2)) {
-      const overwrite = await rl.question(chalk61.yellow(`Config already exists at ${configPath2}. Overwrite? (y/N): `));
+      const overwrite = await rl.question(chalk63.yellow(`Config already exists at ${configPath2}. Overwrite? (y/N): `));
       if (overwrite.toLowerCase() !== "y") {
         console.log(muted(`
 Cancelled.`));
@@ -170784,23 +171051,23 @@ Cancelled.`));
     console.log(`
 ${badge("1. Choose your provider", void 0, "info")}`);
     providerPresets.forEach((preset2, idx) => {
-      const note = preset2.note ? chalk61.dim(` \u2014 ${preset2.note}`) : "";
+      const note = preset2.note ? chalk63.dim(` \u2014 ${preset2.note}`) : "";
       console.log(`  ${idx + 1}) ${preset2.name}${note}`);
     });
     let preset;
     if (presetId) {
       const found = providerPresets.find((p) => p.id.toLowerCase() === presetId.toLowerCase());
       if (!found) {
-        console.log(chalk61.yellow(`
+        console.log(chalk63.yellow(`
 Unknown preset "${presetId}", falling back to menu selection.`));
       } else {
         preset = found;
-        console.log(chalk61.green(`
+        console.log(chalk63.green(`
 Using preset: ${preset.name}`));
       }
     }
     if (!preset) {
-      const providerChoice = await rl.question(chalk61.cyan(`
+      const providerChoice = await rl.question(chalk63.cyan(`
 Provider (1-${providerPresets.length}): `));
       const presetIndex = Number.parseInt(providerChoice.trim(), 10) - 1 >= 0 && Number.parseInt(providerChoice.trim(), 10) - 1 < providerPresets.length ? Number.parseInt(providerChoice.trim(), 10) - 1 : 0;
       preset = providerPresets[presetIndex] ?? providerPresets[0];
@@ -170823,17 +171090,17 @@ Provider (1-${providerPresets.length}): `));
 ${badge("2. How would you like to provide your API key?", void 0, "info")}`);
       console.log("  1) Environment variable (recommended)");
       console.log("  2) Direct in config (not recommended)");
-      const keyChoice = await rl.question(chalk61.cyan(`
+      const keyChoice = await rl.question(chalk63.cyan(`
 Choice (1-2): `));
       useEnv = keyChoice.trim() !== "2";
       if (useEnv) {
         const fallbackEnv = getEnvVarsForProvider(providerId)[0] ?? `${providerId.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_API_KEY`;
         const envVarName = preset.apiKeyEnv ?? fallbackEnv;
         apiKeyField = { apiKeyEnv: envVarName };
-        console.log(chalk61.dim(`
+        console.log(chalk63.dim(`
 Using environment variable: ${envVarName}`));
       } else {
-        const apiKey = await rl.question(chalk61.cyan(`
+        const apiKey = await rl.question(chalk63.cyan(`
 Enter API key: `));
         apiKeyField = { apiKey: apiKey.trim() };
       }
@@ -170842,12 +171109,12 @@ Enter API key: `));
       const noKeyMessage = isEvalOpsManagedProvider(providerId) ? `
 Managed gateway preset does not use a local API key. Run maestro evalops login after setup.` : `
 Local providers do not require API keys. Skipping step.`;
-      console.log(chalk61.dim(noKeyMessage));
+      console.log(chalk63.dim(noKeyMessage));
     }
     console.log(`
 ${badge("3. Would you like to use file references for prompts?", void 0, "info")}`);
     console.log("  This creates a prompts/ folder for better organization.");
-    const useFiles = await rl.question(chalk61.cyan(`
+    const useFiles = await rl.question(chalk63.cyan(`
 Use file references? (Y/n): `));
     const createPrompts = useFiles.toLowerCase() !== "n";
     mkdirSync40(configDir, { recursive: true });
@@ -170990,11 +171257,11 @@ async function checkLocalEndpoint(name, baseUrl) {
     url.pathname = "/models";
     const response = await fetch(url.toString(), { method: "GET" });
     if (response.ok) {
-      return `${badge(name, void 0, "success")} ${chalk61.dim(`responded with ${response.status}`)}`;
+      return `${badge(name, void 0, "success")} ${chalk63.dim(`responded with ${response.status}`)}`;
     }
-    return `${badge(name, void 0, "warn")} ${chalk61.dim(`HTTP ${response.status}`)}`;
+    return `${badge(name, void 0, "warn")} ${chalk63.dim(`HTTP ${response.status}`)}`;
   } catch (error) {
-    return `${badge(name, void 0, "danger")} ${chalk61.dim(error instanceof Error ? error.message : String(error))}`;
+    return `${badge(name, void 0, "danger")} ${chalk63.dim(error instanceof Error ? error.message : String(error))}`;
   }
 }
 async function handleConfigLocal() {
@@ -171009,7 +171276,7 @@ async function handleConfigLocal() {
     console.log("  2) Add Ollama provider");
     console.log("  3) Check local endpoints");
     console.log("  4) Cancel");
-    const choice = (await rl.question(chalk61.cyan(`
+    const choice = (await rl.question(chalk63.cyan(`
 Choice (1-4): `))).trim();
     if (choice === "4") {
       console.log(muted(`
@@ -171033,12 +171300,12 @@ Cancelled.`));
     const templateKey = choice === "2" ? "ollama" : "lmstudio";
     const template = LOCAL_PROVIDER_TEMPLATES[templateKey];
     if (!template) {
-      console.log(chalk61.red(`
+      console.log(chalk63.red(`
 Unknown template: ${templateKey}`));
       rl.close();
       return;
     }
-    const scope = (await rl.question(chalk61.cyan(`
+    const scope = (await rl.question(chalk63.cyan(`
 Save provider to:
   1) Project (.maestro/local.json)
   2) Home (~/.maestro/local.json)
@@ -171048,14 +171315,14 @@ Choice (1-2): `))).trim();
     mkdirSync40(targetDir, { recursive: true });
     const localPath = join82(targetDir, "local.json");
     const config2 = loadLocalConfig(localPath);
-    const providerId = (await rl.question(chalk61.cyan(`
+    const providerId = (await rl.question(chalk63.cyan(`
 Provider id (${template.id}): `))).trim() || template.id;
-    const providerName = (await rl.question(chalk61.cyan(`Provider name (${template.name}): `))).trim() || template.name;
-    const baseUrl = (await rl.question(chalk61.cyan(`Base URL (${template.baseUrl}): `))).trim() || template.baseUrl;
-    const modelId = (await rl.question(chalk61.cyan(`Model id (${template.model.id}): `))).trim() || template.model.id;
-    const modelName = (await rl.question(chalk61.cyan(`Model name (${template.model.name}): `))).trim() || template.model.name;
-    const contextWindowAnswer = (await rl.question(chalk61.cyan(`Context window (${template.model.contextWindow}): `))).trim();
-    const maxTokensAnswer = (await rl.question(chalk61.cyan(`Max output tokens (${template.model.maxTokens}): `))).trim();
+    const providerName = (await rl.question(chalk63.cyan(`Provider name (${template.name}): `))).trim() || template.name;
+    const baseUrl = (await rl.question(chalk63.cyan(`Base URL (${template.baseUrl}): `))).trim() || template.baseUrl;
+    const modelId = (await rl.question(chalk63.cyan(`Model id (${template.model.id}): `))).trim() || template.model.id;
+    const modelName = (await rl.question(chalk63.cyan(`Model name (${template.model.name}): `))).trim() || template.model.name;
+    const contextWindowAnswer = (await rl.question(chalk63.cyan(`Context window (${template.model.contextWindow}): `))).trim();
+    const maxTokensAnswer = (await rl.question(chalk63.cyan(`Max output tokens (${template.model.maxTokens}): `))).trim();
     const contextWindow = Number.parseInt(contextWindowAnswer, 10) || template.model.contextWindow;
     const maxTokens = Number.parseInt(maxTokensAnswer, 10) || template.model.maxTokens;
     upsertLocalProvider(config2, template, {
@@ -171099,7 +171366,7 @@ function formatModelLabel2(model) {
   if (model.input?.includes("image")) {
     caps.push("vision");
   }
-  const suffix = caps.length ? ` ${chalk61.dim(`[${caps.join(", ")}]`)}` : "";
+  const suffix = caps.length ? ` ${chalk63.dim(`[${caps.join(", ")}]`)}` : "";
   return `${model.id}${suffix}`;
 }
 var ANSI_STRING_TERMINATORS3 = "(?:\\u0007|\\u001B\\u005C|\\u009C)";
@@ -171161,15 +171428,15 @@ async function handleOpenAICommand(subcommand, _params = []) {
       await handleStatus2();
       return;
     default:
-      console.error(chalk62.red('Unknown openai subcommand. Try "maestro openai login", "logout", or "status".'));
+      console.error(chalk64.red('Unknown openai subcommand. Try "maestro openai login", "logout", or "status".'));
       process.exit(1);
   }
 }
 async function handleLogin2() {
-  console.log(chalk62.bold("Maestro OpenAI Login"));
+  console.log(chalk64.bold("Maestro OpenAI Login"));
   const { url, verifier, state: state2 } = await generateOpenAILoginUrl();
-  console.log(chalk62.yellow("Please open the following URL in your browser to authenticate:"));
-  console.log(chalk62.underline(url));
+  console.log(chalk64.yellow("Please open the following URL in your browser to authenticate:"));
+  console.log(chalk64.underline(url));
   const server = createServer7(async (req, res) => {
     const reqUrl = new URL2(req.url ?? "", CALLBACK_ORIGIN4);
     if (reqUrl.pathname === "/auth/callback") {
@@ -171206,12 +171473,12 @@ async function handleLogin2() {
         });
         res.writeHead(200, { "Content-Type": "text/html" });
         res.end("<html><body><h1>Login Successful</h1><p>You can close this tab and return to the terminal.</p></body></html>");
-        console.log(chalk62.green(`
+        console.log(chalk64.green(`
 OpenAI credentials saved successfully.`));
-        console.log(chalk62.dim("Future runs can use --auth auto (default) or provide an OpenAI API key."));
+        console.log(chalk64.dim("Future runs can use --auth auto (default) or provide an OpenAI API key."));
       } catch (error) {
         const errorMsg = error instanceof Error ? error.message : "Unknown error";
-        console.error(chalk62.red(`
+        console.error(chalk64.red(`
 Login failed: ${errorMsg}`));
         res.writeHead(500, { "Content-Type": "text/plain" });
         res.end("Login failed. Check terminal for details.");
@@ -171225,32 +171492,32 @@ Login failed: ${errorMsg}`));
   });
   server.on("error", (e2) => {
     if (e2.code === "EADDRINUSE") {
-      console.error(chalk62.red(`Port ${DEFAULT_PORT} is already in use. Please close the other process and try again.`));
+      console.error(chalk64.red(`Port ${DEFAULT_PORT} is already in use. Please close the other process and try again.`));
       process.exit(1);
     }
-    console.error(chalk62.red(`Server error: ${e2.message}`));
+    console.error(chalk64.red(`Server error: ${e2.message}`));
     process.exit(1);
   });
   server.listen(DEFAULT_PORT, "127.0.0.1");
 }
 async function handleLogout() {
   await deleteOpenAIOAuthCredential();
-  console.log(chalk62.green("Removed stored OpenAI credentials."));
+  console.log(chalk64.green("Removed stored OpenAI credentials."));
 }
 async function handleStatus2() {
   const stored = await getStoredOpenAIOAuthCredential();
   if (!stored) {
-    console.log(chalk62.yellow("No stored OpenAI credentials."));
-    console.log(chalk62.dim('Run "maestro openai login" to authenticate with OpenAI.'));
+    console.log(chalk64.yellow("No stored OpenAI credentials."));
+    console.log(chalk64.dim('Run "maestro openai login" to authenticate with OpenAI.'));
     return;
   }
   const remainingMs = Math.max(0, stored.expiresAt - Date.now());
   const minutes = Math.round(remainingMs / 6e4);
-  console.log(chalk62.green("Stored OpenAI credentials detected."));
-  console.log(chalk62.dim(`Access token expires in ~${minutes} minute${minutes === 1 ? "" : "s"} (auto-refresh enabled).`));
+  console.log(chalk64.green("Stored OpenAI credentials detected."));
+  console.log(chalk64.dim(`Access token expires in ~${minutes} minute${minutes === 1 ? "" : "s"} (auto-refresh enabled).`));
   const fresh = await getFreshOpenAIOAuthCredential();
   if (fresh) {
-    console.log(chalk62.dim("Credentials refreshed."));
+    console.log(chalk64.dim("Credentials refreshed."));
   }
 }
 var CALLBACK_ORIGIN4;
@@ -171258,208 +171525,6 @@ var init_openai3 = __esm2(() => {
   init_openai_auth();
   CALLBACK_ORIGIN4 = `http://127.0.0.1:${DEFAULT_PORT}`;
 });
-var exports_init = {};
-__export2(exports_init, {
-  parseInitArgs: () => parseInitArgs,
-  handleInitCommand: () => handleInitCommand2,
-  formatInitSuccess: () => formatInitSuccess,
-  formatInitHelp: () => formatInitHelp
-});
-function formatInitHelp() {
-  return `${sectionHeading("maestro init")}${muted(`  maestro init                         Login, create or reuse an API key, and register this agent
-  maestro init --rotate-key           Replace the stored agent MCP API key
-  maestro init --mcp-url <url>        Override the EvalOps agent MCP endpoint
-  maestro init --json                 Emit machine-readable bootstrap output
-
-Options
-  --agent-type <type>                 Agent type to register, defaults to maestro
-  --surface <surface>                 Surface to register, defaults to cli
-  --integration-profile <profile>     mcp_only, mcp_otlp, managed_runtime, sdk_integrated, or provider_proxy
-  --shim-type <type>                  native_mcp, command_wrapper, hook, provider_proxy, sdk, or mcp_firewall_proxy
-  --trace-mode <mode>                 none, mcp_events, or otlp
-  --memory-mode <mode>                none, read_only, durable, or cerebro
-  --runtime-owner <owner>             external or evalops
-  --workspace, --workspace-id <id>    Workspace to associate with the registration
-  --scope <scope[,scope...]>          Registration scopes to request
-  --key-scope <scope[,scope...]>      API key scopes to request
-  --expires-in-days <days>            API key TTL in days
-  --force-login                       Re-run EvalOps OAuth before bootstrapping
-  --manifest-url <url>                Override the agent MCP manifest URL
-  --ttl-seconds <seconds>             Registration TTL in seconds`)}`;
-}
-function readValue(args, index2, flag) {
-  const value = args[index2 + 1];
-  if (!value || value.startsWith("-")) {
-    throw new Error(`${flag} requires a value`);
-  }
-  return value;
-}
-function parsePositiveInteger(value, flag) {
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    throw new Error(`${flag} must be a positive integer`);
-  }
-  return parsed;
-}
-function appendScopes(existing, value) {
-  return [
-    ...existing ?? [],
-    ...value.split(",").map((entry2) => entry2.trim()).filter((entry2) => entry2.length > 0)
-  ];
-}
-function parseInitArgs(args) {
-  const options = {};
-  for (let i2 = 0; i2 < args.length; i2++) {
-    const arg = args[i2];
-    switch (arg) {
-      case "--agent-mcp-url":
-      case "--mcp-url":
-        options.mcpUrl = readValue(args, i2, arg);
-        i2++;
-        break;
-      case "--agent-type":
-        options.agentType = readValue(args, i2, arg);
-        i2++;
-        break;
-      case "--api-key-scope":
-      case "--key-scope":
-        options.apiKeyScopes = appendScopes(options.apiKeyScopes, readValue(args, i2, arg));
-        i2++;
-        break;
-      case "--expires-in-days":
-        options.expiresInDays = parsePositiveInteger(readValue(args, i2, arg), arg);
-        i2++;
-        break;
-      case "--force-login":
-        options.forceLogin = true;
-        break;
-      case "--integration-profile":
-        options.integrationProfile = readValue(args, i2, arg);
-        i2++;
-        break;
-      case "--json":
-        options.json = true;
-        break;
-      case "--key-name":
-        options.keyName = readValue(args, i2, arg);
-        i2++;
-        break;
-      case "--manifest-url":
-        options.manifestUrl = readValue(args, i2, arg);
-        i2++;
-        break;
-      case "--memory-mode":
-        options.memoryMode = readValue(args, i2, arg);
-        i2++;
-        break;
-      case "--register-scope":
-      case "--scope":
-        options.registerScopes = appendScopes(options.registerScopes, readValue(args, i2, arg));
-        i2++;
-        break;
-      case "--rotate-key":
-        options.rotateKey = true;
-        break;
-      case "--runtime-owner":
-        options.runtimeOwner = readValue(args, i2, arg);
-        i2++;
-        break;
-      case "--shim-type":
-        options.shimType = readValue(args, i2, arg);
-        i2++;
-        break;
-      case "--surface":
-        options.surface = readValue(args, i2, arg);
-        i2++;
-        break;
-      case "--trace-mode":
-        options.traceMode = readValue(args, i2, arg);
-        i2++;
-        break;
-      case "--ttl-seconds":
-        options.ttlSeconds = parsePositiveInteger(readValue(args, i2, arg), arg);
-        i2++;
-        break;
-      case "--workspace":
-      case "--workspace-id":
-        options.workspaceId = readValue(args, i2, arg);
-        i2++;
-        break;
-      default:
-        if (arg?.startsWith("-")) {
-          throw new Error(`Unknown maestro init option: ${arg}`);
-        }
-        throw new Error(`Unexpected maestro init argument: ${arg}`);
-    }
-  }
-  return options;
-}
-function checkLine(text2) {
-  return `${chalk63.green("\u2713")} ${text2}`;
-}
-function formatInitSuccess(result) {
-  const keyMode = result.apiKeyCreated ? "Created" : "Reused";
-  const authenticatedAs = result.authenticatedAs ?? "EvalOps";
-  const governedActions = result.governedActionsLoaded ?? 0;
-  const lines = [
-    chalk63.bold("EvalOps Maestro bootstrap"),
-    "",
-    checkLine(`Authenticated as ${authenticatedAs}`),
-    checkLine(`${keyMode} managed inference key`),
-    checkLine("Registered local agent runtime"),
-    checkLine(`Integration profile ${result.integrationProfile ?? "managed_runtime"} via ${result.shimType ?? "sdk"}`),
-    checkLine(`Loaded ${governedActions} governed actions`),
-    checkLine(result.approvalPolicyAttached ? "Attached default approval policy" : "Queued approval policy review"),
-    checkLine(result.traceIngestionStarted ? "Started trace ingestion" : "Requested trace ingestion"),
-    checkLine(result.governedInferenceCheckRan ? "Ran first governed inference check" : "Queued first governed inference check"),
-    checkLine(result.evidenceEventPublished ? "Published evidence event" : "Queued evidence event"),
-    "",
-    "Open console:",
-    result.consoleUrl ?? "https://app.evalops.dev/overview?env=production"
-  ];
-  return lines.join(`
-`);
-}
-async function handleInitCommand2(args = []) {
-  if (args.includes("--help") || args.includes("-h")) {
-    console.log(formatInitHelp());
-    return;
-  }
-  let options;
-  try {
-    options = parseInitArgs(args);
-  } catch (error) {
-    console.error(chalk63.red(error instanceof Error ? error.message : String(error)));
-    process.exit(1);
-  }
-  const result = await bootstrapEvalOpsAgent(options, {
-    onAuthUrl: (url) => {
-      if (options.json) {
-        console.error("Open this URL in your browser to authenticate with EvalOps:");
-        console.error(url);
-        return;
-      }
-      console.log(chalk63.yellow("Open this URL in your browser to authenticate with EvalOps:"));
-      console.log(chalk63.underline(url));
-    },
-    onStatus: (status) => {
-      if (options.json) {
-        console.error(status.message);
-        return;
-      }
-      console.log(chalk63.dim(status.message));
-    }
-  });
-  if (options.json) {
-    console.log(JSON.stringify(result, null, 2));
-    return;
-  }
-  console.log(formatInitSuccess(result));
-}
-var init_init = __esm2(() => {
-  init_agent_bootstrap();
-  init_theme2();
-});
 var exports_evalops = {};
 __export2(exports_evalops, {
   handleEvalOpsStatus: () => handleEvalOpsStatus,
@@ -171482,58 +171547,43 @@ async function handleEvalOpsCommand(subcommand, args = []) {
       await handleEvalOpsStatus();
       return;
     default:
-      console.error(chalk64.red('Unknown evalops subcommand. Try "maestro init" for setup, or "maestro evalops login", "logout", or "status".'));
+      console.error(chalk65.red('Unknown evalops subcommand. Try "maestro init" for setup, or "maestro evalops login", "logout", or "status".'));
       process.exit(1);
   }
 }
 async function handleLogin3() {
-  console.log(chalk64.bold("Maestro EvalOps Login"));
+  console.log(chalk65.bold("Maestro EvalOps Login"));
   await login("evalops", {
     onAuthUrl: (url) => {
-      console.log(chalk64.yellow("Open this URL in your browser to authenticate with EvalOps:"));
-      console.log(chalk64.underline(url));
+      console.log(chalk65.yellow("Open this URL in your browser to authenticate with EvalOps:"));
+      console.log(chalk65.underline(url));
     },
-    onStatus: (status) => console.log(chalk64.dim(status))
+    onStatus: (status) => console.log(chalk65.dim(status))
   });
-  console.log(chalk64.green("EvalOps credentials saved successfully."));
-  console.log(chalk64.dim('Try "maestro --provider evalops --model gpt-4o-mini".'));
+  console.log(chalk65.green("EvalOps credentials saved successfully."));
+  console.log(chalk65.dim('Try "maestro --provider evalops --model gpt-4o-mini".'));
 }
 async function handleLogout2() {
   await logout("evalops");
-  console.log(chalk64.green("Removed stored EvalOps credentials."));
+  console.log(chalk65.green("Removed stored EvalOps credentials."));
 }
 async function handleEvalOpsStatus() {
   if (!hasOAuthCredentials("evalops")) {
-    console.log(chalk64.yellow("No stored EvalOps credentials."));
-    console.log(chalk64.dim('Run "maestro evalops login" to authenticate with EvalOps.'));
+    console.log(chalk65.yellow("No stored EvalOps credentials."));
+    console.log(chalk65.dim('Run "maestro evalops login" to authenticate with EvalOps.'));
     return;
   }
-  console.log(chalk64.green("Stored EvalOps credentials detected."));
+  console.log(chalk65.green("Stored EvalOps credentials detected."));
   const context2 = resolveManagedEvalOpsContext();
   console.log(formatManagedEvalOpsStatus(context2));
   if (!context2.managed) {
-    console.log(chalk64.yellow('No EvalOps agent session yet. Run "maestro init".'));
+    console.log(chalk65.yellow('No EvalOps agent session yet. Run "maestro init".'));
   }
 }
 var init_evalops2 = __esm2(() => {
   init_managed_context();
   init_oauth();
 });
-var exports_status = {};
-__export2(exports_status, {
-  handleStatusCommand: () => handleStatusCommand
-});
-async function handleStatusCommand() {
-  const context2 = resolveManagedEvalOpsContext();
-  console.log(chalk65.bold("Maestro status"));
-  console.log(formatManagedEvalOpsStatus(context2));
-  if (!context2.authenticated) {
-    console.log(chalk65.dim('Run "maestro init" to bring EvalOps managed mode online.'));
-  }
-}
-var init_status4 = __esm2(() => {
-  init_managed_context();
-});
 var exports_codex = {};
 __export2(exports_codex, {
   handleCodexCommand: () => handleCodexCommand
@@ -176372,6 +176422,11 @@ async function main(args) {
     console.error(chalk81.red(parsed.error));
     process.exit(1);
   }
+  const exitWithEarlyStartupError = (error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(chalk81.red(message));
+    process.exit(1);
+  };
   if (parsed.command === "hosted-runner") {
     const { handleHostedRunnerCommand: handleHostedRunnerCommand2 } = await Promise.resolve().then(() => (init_hosted_runner(), exports_hosted_runner));
     await handleHostedRunnerCommand2(parsed.commandArgs ?? [], {
@@ -176391,6 +176446,26 @@ async function main(args) {
     await startWebServer2(port, { skipStartupMigration: true });
     return;
   }
+  if (parsed.command === "init") {
+    try {
+      validateCodexFlags(args, parsed.command);
+    } catch (error) {
+      exitWithEarlyStartupError(error);
+    }
+    const { handleInitCommand: handleInitCommand3 } = await Promise.resolve().then(() => (init_init(), exports_init));
+    await handleInitCommand3(parsed.commandArgs ?? []);
+    return;
+  }
+  if (parsed.command === "status") {
+    try {
+      validateCodexFlags(args, parsed.command);
+    } catch (error) {
+      exitWithEarlyStartupError(error);
+    }
+    const { handleStatusCommand: handleStatusCommand2 } = await Promise.resolve().then(() => (init_status4(), exports_status));
+    await handleStatusCommand2();
+    return;
+  }
   const isLikelyInteractiveTui = !parsed.messages.length && (parsed.mode === "text" || parsed.mode === void 0) && parsed.command === void 0;
   const isHeadlessMode = parsed.headless || parsed.mode === "headless";
   if (isLikelyInteractiveTui || isHeadlessMode) {
@@ -176550,16 +176625,6 @@ Available commands:`));
     await handleEvalOpsCommand2(parsed.subcommand, parsed.commandArgs ?? []);
     return;
   }
-  if (parsed.command === "status") {
-    const { handleStatusCommand: handleStatusCommand2 } = await Promise.resolve().then(() => (init_status4(), exports_status));
-    await handleStatusCommand2();
-    return;
-  }
-  if (parsed.command === "init") {
-    const { handleInitCommand: handleInitCommand3 } = await Promise.resolve().then(() => (init_init(), exports_init));
-    await handleInitCommand3(parsed.commandArgs ?? []);
-    return;
-  }
   if (parsed.command === "codex") {
     const { handleCodexCommand: handleCodexCommand2 } = await Promise.resolve().then(() => (init_codex(), exports_codex));
     await handleCodexCommand2(parsed.subcommand, parsed.messages);