@evalops/maestro 0.10.18 → 0.10.20

package/dist/guardian/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/guardian/types.ts"],"names":[],"mappings":"AAwFA,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC/B,eAAe;IACf,OAAO;IACP,MAAM;IACN,OAAO;IACP,WAAW;IACX,QAAQ;IACR,MAAM;IACN,SAAS;CACT,CAAC","sourcesContent":["export type GuardianTarget = \"staged\" | \"all\";\n\nexport type GuardianStatus = \"passed\" | \"failed\" | \"skipped\" | \"error\";\n\nexport interface GuardianToolResult {\n\ttool: string;\n\texitCode: number;\n\tstdout: string;\n\tstderr: string;\n\tdurationMs: number;\n\tskipped?: boolean;\n\treason?: string;\n}\n\nexport interface GuardianRunResult {\n\tstatus: GuardianStatus;\n\texitCode: number;\n\tstartedAt: number;\n\tdurationMs: number;\n\ttarget: GuardianTarget;\n\ttrigger?: string;\n\tfilesScanned: number;\n\tfiles?: string[];\n\tsummary: string;\n\tskipReason?: string;\n\ttoolResults: GuardianToolResult[];\n}\n\nexport interface GuardianState {\n\tenabled: boolean;\n\tlastRun?: GuardianRunResult;\n}\n\nexport interface GuardianEnablement {\n\tenabled: boolean;\n\treason?: string;\n\tenvOverride?: \"disabled\" | \"enabled\";\n}\n\nexport interface GuardianRunOptions {\n\ttarget?: GuardianTarget;\n\ttrigger?: string;\n\troot?: string;\n\trespectEnv?: boolean;\n\tquiet?: boolean;\n\tconfig?: GuardianConfig;\n}\n\n/**\n * User-configurable Guardian settings\n * Can be specified in .maestro/guardian.json or ~/.maestro/guardian.json\n */\nexport interface GuardianConfig {\n\t/** Enable/disable Guardian globally (default: true) */\n\tenabled?: boolean;\n\n\t/** Enable scanning on git commit/push (default: true) */\n\tscanGitOperations?: boolean;\n\n\t/** Enable scanning on destructive bash commands like rm -rf (default: true) */\n\tscanDestructiveCommands?: boolean;\n\n\t/** Custom secret patterns to detect (in addition to built-in patterns) */\n\tcustomSecretPatterns?: string[];\n\n\t/** Files/directories to exclude from scanning (merged with DEFAULT_EXCLUDES) */\n\texcludePatterns?: string[];\n\n\t/** Specific tools to enable/disable */\n\ttools?: {\n\t\tsemgrep?: boolean;\n\t\tgitSecrets?: boolean;\n\t\ttrufflehog?: boolean;\n\t\theuristicScan?: boolean;\n\t};\n\n\t/** Timeout in milliseconds for individual tool execution (default: 120000) */\n\ttoolTimeoutMs?: number;\n\n\t/** Whether to block on findings or just warn (default: true = block) */\n\tblockOnFindings?: boolean;\n}\n\nexport interface GuardianFormatOptions {\n\tcompact?: boolean;\n\tincludeFiles?: boolean;\n}\n\nexport const DEFAULT_EXCLUDES = [\n\t\"node_modules/\",\n\t\"dist/\",\n\t\"tmp/\",\n\t\".git/\",\n\t\"coverage/\",\n\t\"build/\",\n\t\"out/\",\n\t\".turbo/\",\n];\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/guardian/types.ts"],"names":[],"mappings":"AAyFA,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC/B,eAAe;IACf,OAAO;IACP,MAAM;IACN,OAAO;IACP,WAAW;IACX,QAAQ;IACR,MAAM;IACN,SAAS;CACT,CAAC","sourcesContent":["export type GuardianTarget = \"staged\" | \"all\";\n\nexport type GuardianStatus = \"passed\" | \"failed\" | \"skipped\" | \"error\";\n\nexport interface GuardianToolResult {\n\ttool: string;\n\texitCode: number;\n\tstdout: string;\n\tstderr: string;\n\tdurationMs: number;\n\tskipped?: boolean;\n\treason?: string;\n}\n\nexport interface GuardianRunResult {\n\tstatus: GuardianStatus;\n\texitCode: number;\n\tstartedAt: number;\n\tdurationMs: number;\n\ttarget: GuardianTarget;\n\ttrigger?: string;\n\tfilesScanned: number;\n\tfiles?: string[];\n\tsummary: string;\n\tskipReason?: string;\n\ttoolResults: GuardianToolResult[];\n}\n\nexport interface GuardianState {\n\tenabled: boolean;\n\tlastRun?: GuardianRunResult;\n}\n\nexport interface GuardianEnablement {\n\tenabled: boolean;\n\treason?: string;\n\tenvOverride?: \"disabled\" | \"enabled\";\n}\n\nexport interface GuardianRunOptions {\n\ttarget?: GuardianTarget;\n\ttrigger?: string;\n\troot?: string;\n\trespectEnv?: boolean;\n\tquiet?: boolean;\n\tconfig?: GuardianConfig;\n}\n\n/**\n * User-configurable Guardian settings\n * Can be specified in .maestro/guardian.json or ~/.maestro/guardian.json\n */\nexport interface GuardianConfig {\n\t/** Enable/disable Guardian globally (default: true) */\n\tenabled?: boolean;\n\n\t/** Enable scanning on git commit/push (default: true) */\n\tscanGitOperations?: boolean;\n\n\t/** Enable scanning on destructive bash commands like rm -rf (default: true) */\n\tscanDestructiveCommands?: boolean;\n\n\t/** Custom secret patterns to detect (in addition to built-in patterns) */\n\tcustomSecretPatterns?: string[];\n\n\t/** Files/directories to exclude from scanning (merged with DEFAULT_EXCLUDES) */\n\texcludePatterns?: string[];\n\n\t/** Specific tools to enable/disable */\n\ttools?: {\n\t\tevidenceIntegrity?: boolean;\n\t\tsemgrep?: boolean;\n\t\tgitSecrets?: boolean;\n\t\ttrufflehog?: boolean;\n\t\theuristicScan?: boolean;\n\t};\n\n\t/** Timeout in milliseconds for individual tool execution (default: 120000) */\n\ttoolTimeoutMs?: number;\n\n\t/** Whether to block on findings or just warn (default: true = block) */\n\tblockOnFindings?: boolean;\n}\n\nexport interface GuardianFormatOptions {\n\tcompact?: boolean;\n\tincludeFiles?: boolean;\n}\n\nexport const DEFAULT_EXCLUDES = [\n\t\"node_modules/\",\n\t\"dist/\",\n\t\"tmp/\",\n\t\".git/\",\n\t\"coverage/\",\n\t\"build/\",\n\t\"out/\",\n\t\".turbo/\",\n];\n"]}

package/dist/index.d.ts

@@ -1,8 +1,12 @@
 export { main } from "./main.js";
 export { SessionManager } from "./session/manager.js";
 export { askUserTool, bashTool, backgroundTasksTool, codingTools, editTool, notebookEditTool, readTool, todoTool, writeTool, ToolResultCache, createToolResultCache, getGlobalToolResultCache, } from "./tools/index.js";
-export { recordEvaluationResult, recordToolExecution, } from "./telemetry.js";
+export { recordEvaluationResult, recordSubagentDispatch, recordToolExecution, } from "./telemetry.js";
 export * from "./sdk-tools.js";
 export * from "./platform/a2a-client.js";
+export * from "./platform/a2a-peer-pairing.js";
+export * from "./platform/a2a-peer-registry.js";
+export * from "./platform/operating-plane-client.js";
+export * from "./platform/operating-plane-summary.js";
 export { DistributedLockManager, createLockManager, getGlobalLockManager, resetGlobalLockManager, withLock, type LockResult, type LockInfo, type LockOptions, type LockManagerConfig, } from "./db/distributed-lock-manager.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACN,WAAW,EACX,QAAQ,EACR,mBAAmB,EACnB,WAAW,EACX,QAAQ,EACR,gBAAgB,EAChB,QAAQ,EACR,QAAQ,EACR,SAAS,EAET,eAAe,EACf,qBAAqB,EACrB,wBAAwB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,gBAAgB,CAAC;AAGxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AAGzC,OAAO,EACN,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,QAAQ,EACR,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACtB,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACN,WAAW,EACX,QAAQ,EACR,mBAAmB,EACnB,WAAW,EACX,QAAQ,EACR,gBAAgB,EAChB,QAAQ,EACR,QAAQ,EACR,SAAS,EAET,eAAe,EACf,qBAAqB,EACrB,wBAAwB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,gBAAgB,CAAC;AAGxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAChD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AAGtD,OAAO,EACN,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,QAAQ,EACR,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACtB,MAAM,kCAAkC,CAAC"}

package/dist/index.js

@@ -3,10 +3,14 @@ export { SessionManager } from "./session/manager.js";
 export { askUserTool, bashTool, backgroundTasksTool, codingTools, editTool, notebookEditTool, readTool, todoTool, writeTool, 
 // Tool result caching
 ToolResultCache, createToolResultCache, getGlobalToolResultCache, } from "./tools/index.js";
-export { recordEvaluationResult, recordToolExecution, } from "./telemetry.js";
+export { recordEvaluationResult, recordSubagentDispatch, recordToolExecution, } from "./telemetry.js";
 // SDK tool types for external consumers
 export * from "./sdk-tools.js";
 export * from "./platform/a2a-client.js";
+export * from "./platform/a2a-peer-pairing.js";
+export * from "./platform/a2a-peer-registry.js";
+export * from "./platform/operating-plane-client.js";
+export * from "./platform/operating-plane-summary.js";
 // Distributed lock manager for concurrent operations
 export { DistributedLockManager, createLockManager, getGlobalLockManager, resetGlobalLockManager, withLock, } from "./db/distributed-lock-manager.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACN,WAAW,EACX,QAAQ,EACR,mBAAmB,EACnB,WAAW,EACX,QAAQ,EACR,gBAAgB,EAChB,QAAQ,EACR,QAAQ,EACR,SAAS;AACT,sBAAsB;AACtB,eAAe,EACf,qBAAqB,EACrB,wBAAwB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,gBAAgB,CAAC;AAExB,wCAAwC;AACxC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AAEzC,qDAAqD;AACrD,OAAO,EACN,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,QAAQ,GAKR,MAAM,kCAAkC,CAAC","sourcesContent":["export { main } from \"./main.js\";\nexport { SessionManager } from \"./session/manager.js\";\nexport {\n\taskUserTool,\n\tbashTool,\n\tbackgroundTasksTool,\n\tcodingTools,\n\teditTool,\n\tnotebookEditTool,\n\treadTool,\n\ttodoTool,\n\twriteTool,\n\t// Tool result caching\n\tToolResultCache,\n\tcreateToolResultCache,\n\tgetGlobalToolResultCache,\n} from \"./tools/index.js\";\nexport {\n\trecordEvaluationResult,\n\trecordToolExecution,\n} from \"./telemetry.js\";\n\n// SDK tool types for external consumers\nexport * from \"./sdk-tools.js\";\nexport * from \"./platform/a2a-client.js\";\n\n// Distributed lock manager for concurrent operations\nexport {\n\tDistributedLockManager,\n\tcreateLockManager,\n\tgetGlobalLockManager,\n\tresetGlobalLockManager,\n\twithLock,\n\ttype LockResult,\n\ttype LockInfo,\n\ttype LockOptions,\n\ttype LockManagerConfig,\n} from \"./db/distributed-lock-manager.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACN,WAAW,EACX,QAAQ,EACR,mBAAmB,EACnB,WAAW,EACX,QAAQ,EACR,gBAAgB,EAChB,QAAQ,EACR,QAAQ,EACR,SAAS;AACT,sBAAsB;AACtB,eAAe,EACf,qBAAqB,EACrB,wBAAwB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,gBAAgB,CAAC;AAExB,wCAAwC;AACxC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAChD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AAEtD,qDAAqD;AACrD,OAAO,EACN,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,QAAQ,GAKR,MAAM,kCAAkC,CAAC","sourcesContent":["export { main } from \"./main.js\";\nexport { SessionManager } from \"./session/manager.js\";\nexport {\n\taskUserTool,\n\tbashTool,\n\tbackgroundTasksTool,\n\tcodingTools,\n\teditTool,\n\tnotebookEditTool,\n\treadTool,\n\ttodoTool,\n\twriteTool,\n\t// Tool result caching\n\tToolResultCache,\n\tcreateToolResultCache,\n\tgetGlobalToolResultCache,\n} from \"./tools/index.js\";\nexport {\n\trecordEvaluationResult,\n\trecordSubagentDispatch,\n\trecordToolExecution,\n} from \"./telemetry.js\";\n\n// SDK tool types for external consumers\nexport * from \"./sdk-tools.js\";\nexport * from \"./platform/a2a-client.js\";\nexport * from \"./platform/a2a-peer-pairing.js\";\nexport * from \"./platform/a2a-peer-registry.js\";\nexport * from \"./platform/operating-plane-client.js\";\nexport * from \"./platform/operating-plane-summary.js\";\n\n// Distributed lock manager for concurrent operations\nexport {\n\tDistributedLockManager,\n\tcreateLockManager,\n\tgetGlobalLockManager,\n\tresetGlobalLockManager,\n\twithLock,\n\ttype LockResult,\n\ttype LockInfo,\n\ttype LockOptions,\n\ttype LockManagerConfig,\n} from \"./db/distributed-lock-manager.js\";\n"]}

package/dist/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AA4TH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,iBA+/BxC"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AA0XH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,iBAitCxC"}

package/dist/main.js

@@ -90,6 +90,9 @@ import { createRequire } from "node:module";
 import chalk from "chalk";
 import { createBackgroundTextAgent } from "./agent/background-agent.js";
 import { isAssistantMessage, } from "./agent/index.js";
+import { getAllModes, getModelForMode } from "./agent/modes.js";
+import { loadScriptedScenarioFromSource } from "./agent/providers/scripted.js";
+import { scenarioSourceLabel } from "./agent/scenario-source.js";
 import { applySessionEndHooks } from "./agent/session-lifecycle-hooks.js";
 import { ToolRetryService } from "./agent/tool-retry.js";
 import { applySessionStartHooks, runUserPromptWithRecovery, } from "./agent/user-prompt-runtime.js";
@@ -98,15 +101,18 @@ import { createAuthSetup, validateCodexFlags } from "./bootstrap/auth-setup.js";
 import { disposeCheckpointService, initCheckpointService, } from "./checkpoints/index.js";
 import { TuiClientToolService } from "./cli-tui/client-tools/local-client-tool-service.js";
 import { TuiRenderer } from "./cli-tui/tui-renderer.js";
+import { sanitizeTerminalPreview } from "./cli-tui/utils/text-formatting.js";
 import { parseArgs } from "./cli/args.js";
 import { EXEC_SESSION_SUMMARY_PREFIX, runExecCommand, } from "./cli/commands/exec.js";
+import { isHeadlessModeRequested, recordHeadlessRuntimeSelection, selectHeadlessRuntime, willDispatchHeadlessRuntime, } from "./cli/headless-runtime-selection.js";
 import { runHeadlessMode } from "./cli/headless.js";
 import { printHelp } from "./cli/help.js";
 import { JsonlEventWriter, createAgentJsonlAdapter, emitThreadEnd, emitThreadStart, emitUserTurn as emitUserTurnEvent, } from "./cli/jsonl-writer.js";
 import { selectSession } from "./cli/session.js";
-import { resolveExplicitSystemPromptSourcePaths } from "./cli/system-prompt.js";
+import { detectRuntimeConstraintContext, resolveExplicitSystemPromptSourcePaths, } from "./cli/system-prompt.js";
 import { validateFrameworkPreference } from "./config/framework.js";
 import { loadRuntimeConfig } from "./config/runtime-config.js";
+import { loadUnifiedContextManifest } from "./context/manifest.js";
 import { loadEnv } from "./load-env.js";
 import { bootstrapLsp } from "./lsp/bootstrap.js";
 import { withMcpPostKeepMessages } from "./mcp/prompt-recovery.js";
@@ -119,10 +125,14 @@ import { resolveMaestroSystemPrompt } from "./prompts/system-prompt.js";
 import { AgentRuntimeController } from "./runtime/agent-runtime.js";
 import { registerBackgroundTaskShutdownHooks } from "./runtime/background-task-hooks.js";
 import { configureSafeMode } from "./safety/safe-mode.js";
+import { LocalSandbox } from "./sandbox/index.js";
+import { captureSentryException, flushSentry, initSentry } from "./sentry.js";
 import { ServerRequestActionApprovalService } from "./server/approval-service.js";
 import { clientToolService } from "./server/client-tools-service.js";
 import { ServerRequestToolRetryService } from "./server/tool-retry-service.js";
 import { SessionManager } from "./session/manager.js";
+import { recordStagedRolloutSurfaceUsage } from "./telemetry.js";
+import { beaconTimeoutMs } from "./telemetry/beacon.js";
 import { askUserClientTool } from "./tools/ask-user-client.js";
 import { createStartupProfilerFromEnv } from "./utils/checkpoint-profiler.js";
 import { isInsideGitRepository } from "./utils/git.js";
@@ -133,9 +143,20 @@ import { isInsideGitRepository } from "./utils/git.js";
  */
 const packageJson = createRequire(import.meta.url)("../package.json");
 const VERSION = packageJson.version ?? "unknown";
+const STARTUP_TELEMETRY_EXIT_WAIT_GRACE_MS = 25;
 let enterpriseCleanupRegistered = false;
 let checkpointCleanupRegistered = false;
 let sandboxCleanupRegistered = false;
+function printAllAgentModes() {
+    const lines = ["Agent modes:", ""];
+    for (const { mode, config } of getAllModes({ includeHidden: true })) {
+        const hiddenSuffix = config.visible === false ? " [hidden]" : "";
+        lines.push(`${mode}${hiddenSuffix}`);
+        lines.push(`  ${config.description}`);
+        lines.push(`  model: ${getModelForMode(mode)}`);
+    }
+    console.log(lines.join("\n"));
+}
 /**
  * Runs the full interactive Terminal UI (TUI) mode.
  *
@@ -200,6 +221,25 @@ async function runInteractiveMode(agent, sessionManager, version, approvalServic
         });
     }
 }
+async function waitForStartupTelemetryForImmediateExit(startupTelemetry) {
+    let timeout;
+    try {
+        await Promise.race([
+            startupTelemetry,
+            new Promise((resolve) => {
+                timeout = setTimeout(resolve, beaconTimeoutMs(process.env) + STARTUP_TELEMETRY_EXIT_WAIT_GRACE_MS);
+            }),
+        ]);
+    }
+    catch {
+        // Startup telemetry is best effort and must not affect explicit exits.
+    }
+    finally {
+        if (timeout) {
+            clearTimeout(timeout);
+        }
+    }
+}
 /**
  * Runs the CLI in single-shot (non-interactive) mode.
  *
@@ -308,6 +348,15 @@ function resolveSessionStartHookSource(params) {
     }
     return "cli";
 }
+async function readReplayScenarioId(source) {
+    try {
+        return (await loadScriptedScenarioFromSource(source)).id;
+    }
+    catch {
+        // The scripted provider surfaces schema and file errors during streaming.
+    }
+    return scenarioSourceLabel(source);
+}
 /**
  * Main entry point for the Composer CLI application.
  *
@@ -339,25 +388,90 @@ export async function main(args) {
     // Parse arguments early to check for version/help flags before heavy initialization
     const parsed = parseArgs(args);
     startupProfiler.checkpoint("cli:parsed");
+    const startupTelemetry = import("./telemetry/cli-startup.js")
+        .then(({ recordCliStartupTelemetry }) => recordCliStartupTelemetry({
+        args: parsed,
+        clientVersion: VERSION,
+        commandCountLockTimeoutMs: 0,
+        rawArgs: args,
+    }))
+        .catch(() => undefined);
     // Handle --version early exit (before any async operations)
     if (parsed.version) {
         console.log(`Maestro v${VERSION}`);
+        await waitForStartupTelemetryForImmediateExit(startupTelemetry);
         process.exit(0);
     }
     // Handle --help early exit (before any logging redirection or heavy init)
     if (parsed.help) {
-        printHelp(VERSION);
+        const hiddenFlagTelemetry = parsed.helpHidden
+            ? recordStagedRolloutSurfaceUsage("hidden_flag_used", {
+                surfaceId: "cli:--help-hidden",
+                surfaceType: "cli_flag",
+                owner: "platform-cli",
+            })
+            : Promise.resolve();
+        printHelp(VERSION, { includeHidden: parsed.helpHidden });
+        await waitForStartupTelemetryForImmediateExit(Promise.all([startupTelemetry, hiddenFlagTelemetry]).then(() => undefined));
+        process.exit(0);
+    }
+    if (parsed.listModesAll) {
+        const hiddenFlagTelemetry = recordStagedRolloutSurfaceUsage("hidden_flag_used", {
+            surfaceId: "cli:--list-modes-all",
+            surfaceType: "cli_flag",
+            owner: "agent-runtime",
+        });
+        printAllAgentModes();
+        await waitForStartupTelemetryForImmediateExit(Promise.all([startupTelemetry, hiddenFlagTelemetry]).then(() => undefined));
         process.exit(0);
     }
     if (parsed.error) {
         console.error(chalk.red(parsed.error));
+        await waitForStartupTelemetryForImmediateExit(startupTelemetry);
         process.exit(1);
     }
+    if (parsed.command === "modes") {
+        const { handleModesCommand } = await import("./cli/commands/modes.js");
+        await handleModesCommand(parsed.subcommand, parsed.messages, {
+            provider: parsed.provider,
+            json: parsed.execJson,
+        });
+        await waitForStartupTelemetryForImmediateExit(startupTelemetry);
+        return;
+    }
+    const isHeadlessMode = isHeadlessModeRequested(parsed);
+    const willDispatchHeadlessMode = willDispatchHeadlessRuntime(parsed);
     const exitWithEarlyStartupError = (error) => {
         const message = error instanceof Error ? error.message : String(error);
-        console.error(chalk.red(message));
+        if (isHeadlessMode) {
+            process.stdout.write(`${JSON.stringify({
+                type: "error",
+                message: `Headless startup failed: ${message}`,
+                fatal: true,
+                error_type: "fatal",
+            })}\n`);
+        }
+        else {
+            console.error(chalk.red(message));
+        }
         process.exit(1);
     };
+    try {
+        validateCodexFlags(args, parsed.help ? "help" : parsed.command);
+    }
+    catch (error) {
+        exitWithEarlyStartupError(error);
+    }
+    const replayScenarioPath = parsed.replayScenarioPath ?? process.env.MAESTRO_SCENARIO_PATH;
+    if (replayScenarioPath) {
+        parsed.replayScenarioPath = replayScenarioPath;
+        process.env.MAESTRO_SCENARIO_PATH = replayScenarioPath;
+        process.env.MAESTRO_SCENARIO_ID =
+            await readReplayScenarioId(replayScenarioPath);
+        process.env.MAESTRO_MODE = "replay";
+        parsed.provider = "scripted-replay";
+        parsed.model = "maestro-replay-v1";
+    }
     // Handle `maestro hosted-runner` before importing web-server so hosted
     // defaults are visible to its module-level runtime profile.
     if (parsed.command === "hosted-runner") {
@@ -385,43 +499,55 @@ export async function main(args) {
     // progress or diagnostic output on stderr, so route it before config loading
     // can emit normal CLI startup logs.
     if (parsed.command === "init") {
-        try {
-            validateCodexFlags(args, parsed.command);
-        }
-        catch (error) {
-            exitWithEarlyStartupError(error);
-        }
         const { handleInitCommand } = await import("./cli/commands/init.js");
         await handleInitCommand(parsed.commandArgs ?? []);
         return;
     }
     if (parsed.command === "status") {
-        try {
-            validateCodexFlags(args, parsed.command);
-        }
-        catch (error) {
-            exitWithEarlyStartupError(error);
-        }
         const { handleStatusCommand } = await import("./cli/commands/status.js");
         await handleStatusCommand();
         return;
     }
+    if (parsed.command === "context") {
+        const { handleContextCommand } = await import("./cli/commands/context.js");
+        await handleContextCommand(parsed.subcommand, parsed.messages, {
+            json: parsed.execJson,
+            liveMcp: parsed.contextLiveMcp,
+        });
+        return;
+    }
+    if (parsed.command === "scenario") {
+        const { handleScenarioCommand } = await import("./cli/commands/scenario.js");
+        await handleScenarioCommand(parsed.subcommand, parsed.messages, {
+            json: parsed.execJson,
+            junitPath: parsed.junitPath,
+        });
+        return;
+    }
+    if (parsed.command === "skill") {
+        const { handleSkillCommand } = await import("./cli/commands/skill.js");
+        await handleSkillCommand(parsed.subcommand, parsed.commandArgs ?? []);
+        return;
+    }
     // If we're about to enter interactive TUI mode (no prompt messages and not RPC/exec),
     // or headless mode (stdout is JSON-only), redirect all logging/console output to a file.
     // This must run before config/model loading to catch any early warnings.
     const isLikelyInteractiveTui = !parsed.messages.length &&
         (parsed.mode === "text" || parsed.mode === undefined) &&
         parsed.command === undefined;
-    const isHeadlessMode = parsed.headless || parsed.mode === "headless";
-    if (isLikelyInteractiveTui || isHeadlessMode) {
+    if (isLikelyInteractiveTui || willDispatchHeadlessMode) {
         const { redirectLoggerToFile, redirectConsoleToLogger, redirectStderrToLogger, pipeProcessEventsToLogger, } = await import("./utils/logger.js");
         redirectLoggerToFile();
-        redirectConsoleToLogger({ preserveErrorStderr: isHeadlessMode });
-        if (!isHeadlessMode) {
+        redirectConsoleToLogger({ preserveErrorStderr: willDispatchHeadlessMode });
+        if (!willDispatchHeadlessMode) {
             redirectStderrToLogger();
         }
         pipeProcessEventsToLogger();
     }
+    const headlessRuntimeSelection = selectHeadlessRuntime(process.env, {
+        allowLegacy: willDispatchHeadlessMode,
+    });
+    recordHeadlessRuntimeSelection(headlessRuntimeSelection);
     const runtimeConfig = loadRuntimeConfig(parsed, process.cwd());
     startupProfiler.checkpoint("config:loaded");
     const reasoningSummary = runtimeConfig.config.model_supports_reasoning_summaries === false
@@ -429,7 +555,7 @@ export async function main(args) {
         : runtimeConfig.config.model_reasoning_summary === "none"
             ? null
             : runtimeConfig.config.model_reasoning_summary;
-    const exitWithStartupError = (error) => {
+    const exitWithStartupError = async (error) => {
         const message = error instanceof Error ? error.message : String(error);
         const stack = error instanceof Error ? error.stack : undefined;
         if (isHeadlessMode) {
@@ -444,6 +570,8 @@ export async function main(args) {
         else {
             console.error(chalk.red(message));
         }
+        captureSentryException(error);
+        await flushSentry();
         process.exit(1);
     };
     // ─────────────────────────────────────────────────────────────────────────────
@@ -452,6 +580,7 @@ export async function main(args) {
     // Initialize OpenTelemetry tracing for observability
     // This is non-blocking (void) to avoid startup latency
     void initOpenTelemetry("composer-cli");
+    initSentry("maestro-cli");
     const modelLoadPromise = (async () => {
         await ensureModelsLoaded();
         startupProfiler.checkpoint("models:loaded");
@@ -512,12 +641,6 @@ export async function main(args) {
     // - api-key: Require explicit API key from --api-key or env var
     // - claude: Force Anthropic OAuth (no API key fallback)
     const authMode = parsed.authMode ?? "auto";
-    try {
-        validateCodexFlags(args, parsed.command);
-    }
-    catch (error) {
-        exitWithStartupError(error);
-    }
     const { requireCredential } = createAuthSetup({
         authMode,
         explicitApiKey: parsed.apiKey,
@@ -525,13 +648,21 @@ export async function main(args) {
     startupProfiler.checkpoint("auth:configured");
     if (parsed.command === "exec") {
         if (parsed.execFullAuto && parsed.execReadOnly) {
-            exitWithStartupError("Cannot combine --full-auto with --read-only in maestro exec.");
+            await exitWithStartupError("Cannot combine --full-auto with --read-only in maestro exec.");
         }
     }
     // Validate sandbox mode (applies to both exec and interactive modes)
-    const validSandboxModes = ["docker", "local", "none"];
+    const validSandboxModes = [
+        "docker",
+        "local",
+        "native",
+        "none",
+        "read-only",
+        "workspace-write",
+        "danger-full-access",
+    ];
     if (parsed.sandbox && !validSandboxModes.includes(parsed.sandbox)) {
-        exitWithStartupError(`Unknown sandbox mode "${parsed.sandbox}". Supported: ${validSandboxModes.join(", ")}`);
+        await exitWithStartupError(`Unknown sandbox mode "${parsed.sandbox}". Supported: ${validSandboxModes.join(", ")}`);
     }
     // ─────────────────────────────────────────────────────────────────────────────
     // PHASE 5: Safety, LSP, and Checkpointing
@@ -609,7 +740,7 @@ export async function main(args) {
     }
     if (parsed.command === "codex") {
         const { handleCodexCommand } = await import("./cli/commands/codex.js");
-        await handleCodexCommand(parsed.subcommand, parsed.messages);
+        await handleCodexCommand(parsed.subcommand, parsed.commandArgs ?? []);
         return;
     }
     if (parsed.command === "hooks") {
@@ -617,6 +748,13 @@ export async function main(args) {
         await handleHooksCommand(parsed.subcommand);
         return;
     }
+    if (parsed.command === "run") {
+        const { handleRunCommand } = await import("./cli/commands/run.js");
+        await handleRunCommand(parsed.subcommand, parsed.messages, {
+            json: parsed.execJson,
+        });
+        return;
+    }
     if (parsed.command === "export") {
         const { handleExportCommand } = await import("./cli/commands/session-transfer.js");
         await handleExportCommand(parsed.messages[0], parsed.messages[1], parsed.exportFormat, { redactSecrets: parsed.redactSecrets });
@@ -637,6 +775,16 @@ export async function main(args) {
         await handleRemoteCommand(parsed.subcommand, parsed.commandArgs ?? []);
         return;
     }
+    if (parsed.command === "a2a") {
+        const { handleA2ACommand } = await import("./cli/commands/a2a.js");
+        await handleA2ACommand(parsed.commandArgs ?? []);
+        return;
+    }
+    if (parsed.command === "operating-plane") {
+        const { handleOperatingPlaneCommand } = await import("./cli/commands/operating-plane.js");
+        await handleOperatingPlaneCommand(parsed.commandArgs ?? []);
+        return;
+    }
     if (parsed.command === "anthropic") {
         const { handleAnthropicCommand } = await import("./cli/commands/anthropic.js");
         await handleAnthropicCommand(parsed.subcommand, parsed.messages);
@@ -730,6 +878,21 @@ export async function main(args) {
     // Track agents init state for deferred execution
     let agentsInitPrompt = null;
     let agentsInitPath = null;
+    const quoteShellArg = (value) => {
+        if (/^[A-Za-z0-9_./:=@+-]+$/.test(value)) {
+            return value;
+        }
+        if (process.platform === "win32") {
+            const escaped = value
+                .replace(/(\\*)"/g, (_match, slashes) => `${slashes}${slashes}\\"`)
+                .replace(/\\+$/g, (slashes) => `${slashes}${slashes}`);
+            return `"${escaped}"`;
+        }
+        return `'${value.replaceAll("'", "'\\''")}'`;
+    };
+    const buildAgentsInitRerunCommand = (targetArg) => targetArg
+        ? `maestro agents init ${quoteShellArg(targetArg)} --force`
+        : "maestro agents init --force";
     // Handle "maestro agents init" command to generate AGENTS.md
     if (parsed.command === "agents") {
         const { buildAgentsInitPrompt, handleAgentsInit } = await import("./cli/commands/agents.js");
@@ -739,9 +902,23 @@ export async function main(args) {
         }
         try {
             const targetArg = parsed.messages[0];
-            const filePath = handleAgentsInit(targetArg, { force: parsed.force });
-            agentsInitPath = filePath;
-            agentsInitPrompt = buildAgentsInitPrompt(filePath);
+            const result = handleAgentsInit(targetArg, { force: parsed.force });
+            if (result.action === "preview") {
+                const rerunCommand = buildAgentsInitRerunCommand(targetArg);
+                console.log([
+                    `AGENTS instructions already exist at ${result.path}.`,
+                    `Preview the proposed update below, then re-run with \`${rerunCommand}\` to apply it.`,
+                    "",
+                    sanitizeTerminalPreview(result.diff ?? ""),
+                ].join("\n"));
+                return;
+            }
+            if (result.action === "updated") {
+                console.log(`Updated AGENTS instructions at ${result.path}.`);
+                return;
+            }
+            agentsInitPath = result.path;
+            agentsInitPrompt = buildAgentsInitPrompt(result.path, result.sources);
             if (parsed.messages.length === 0) {
                 parsed.messages = [agentsInitPrompt];
             }
@@ -765,6 +942,14 @@ export async function main(args) {
     // - Model/thinking level tracking across restarts
     const sessionManager = new SessionManager(parsed.continue && !parsed.resume, // continueSession: auto-load most recent
     parsed.session);
+    let scenarioRecorder;
+    if (parsed.recordScenarioPath) {
+        const { ScriptedScenarioRecorder } = await import("./server/scenario-recorder.js");
+        scenarioRecorder = new ScriptedScenarioRecorder({
+            outPath: parsed.recordScenarioPath,
+            recordedFrom: () => sessionManager.getSessionId(),
+        });
+    }
     startupProfiler.checkpoint("session:created");
     let execResumeApplied = false;
     if (parsed.command === "exec") {
@@ -818,26 +1003,8 @@ export async function main(args) {
         model = resolved.model;
     }
     catch (error) {
-        exitWithStartupError(error);
+        await exitWithStartupError(error);
     }
-    // ─────────────────────────────────────────────────────────────────────────────
-    // PHASE 9: System Prompt and Tool Configuration
-    // ─────────────────────────────────────────────────────────────────────────────
-    // Build the system prompt with project context
-    // The system prompt includes:
-    // - Base instructions for the agent
-    // - Project context files (COMPOSER.md, AGENTS.md, etc.)
-    // - Tool-specific instructions based on available tools
-    const systemPromptToolNames = parsed.tools;
-    const { systemPrompt, promptMetadata } = await resolveMaestroSystemPrompt({
-        customPrompt: parsed.systemPrompt,
-        toolNames: systemPromptToolNames,
-        appendPrompt: parsed.appendSystemPrompt,
-    });
-    startupProfiler.checkpoint("prompt:assembled", {
-        system_bytes: systemPrompt.length,
-    });
-    const systemPromptSourcePaths = resolveExplicitSystemPromptSourcePaths(parsed.systemPrompt, parsed.appendSystemPrompt);
     // Determine approval mode for tool execution:
     // - "prompt": Ask user before each tool execution (default for interactive)
     // - "auto": Automatically approve all tools (default for non-interactive)
@@ -881,11 +1048,12 @@ export async function main(args) {
         toolsResult = await createToolsAndSandbox({
             parsedTools: parsed.tools,
             parsedSandbox: parsed.sandbox,
+            modelApi: model.api,
             cwd: process.cwd(),
         });
     }
     catch (error) {
-        exitWithStartupError(error);
+        await exitWithStartupError(error);
     }
     const { allTools, sandbox, sandboxMode } = toolsResult;
     startupProfiler.checkpoint("tools:prepared", { tools: allTools.length });
@@ -894,6 +1062,41 @@ export async function main(args) {
     const configuredAllTools = useInteractiveClientTools
         ? replaceAskUserTool(allTools)
         : allTools;
+    // ─────────────────────────────────────────────────────────────────────────────
+    // PHASE 11: System Prompt Assembly
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Build the system prompt with project context after sandbox setup so runtime
+    // constraint fragments reflect the resolved sandbox state, not just the
+    // requested CLI mode.
+    const resolvedConstraintSandboxMode = sandbox
+        ? sandbox instanceof LocalSandbox
+            ? "local"
+            : (sandboxMode ?? null)
+        : "none";
+    const systemPromptToolNames = parsed.tools ??
+        (model.api === "openai-codex-app-server"
+            ? toolsResult.baseTools.map((tool) => tool.name)
+            : undefined);
+    const runtimeConstraints = detectRuntimeConstraintContext({
+        cwd: process.cwd(),
+        sandboxMode: resolvedConstraintSandboxMode,
+        sandboxEnabled: Boolean(sandbox) && resolvedConstraintSandboxMode !== "local",
+        readOnly: parsed.execReadOnly || parsed.readonly ? true : undefined,
+    });
+    const { systemPrompt, promptMetadata, promptContextManifest } = await resolveMaestroSystemPrompt({
+        customPrompt: parsed.systemPrompt,
+        toolNames: systemPromptToolNames,
+        appendPrompt: parsed.appendSystemPrompt,
+        runtimeConstraints,
+        cwd: process.cwd(),
+    });
+    const unifiedContextManifest = loadUnifiedContextManifest(process.cwd(), {
+        projectDocs: promptContextManifest,
+    });
+    startupProfiler.checkpoint("prompt:assembled", {
+        system_bytes: systemPrompt.length,
+    });
+    const systemPromptSourcePaths = resolveExplicitSystemPromptSourcePaths(parsed.systemPrompt, parsed.appendSystemPrompt);
     // Register sandbox cleanup on exit (only if sandbox is active)
     if (sandbox && toolsResult.disposeSandbox) {
         const cleanupSandbox = toolsResult.disposeSandbox;
@@ -911,7 +1114,7 @@ export async function main(args) {
         }
     }
     // ─────────────────────────────────────────────────────────────────────────────
-    // PHASE 11: Agent Creation
+    // PHASE 12: Agent Creation
     // ─────────────────────────────────────────────────────────────────────────────
     const { createAgentInstance } = await import("./bootstrap/agent-creation-setup.js");
     const { setTaskBudgetTotal } = await import("./agent/task-budget-access.js");
@@ -923,6 +1126,8 @@ export async function main(args) {
         systemPrompt,
         promptMetadata,
         systemPromptSourcePaths,
+        promptContextManifest,
+        unifiedContextManifest,
         model,
         reasoningSummary,
         allTools: configuredAllTools,
@@ -1037,6 +1242,13 @@ export async function main(args) {
         cwd: process.cwd(),
         enterpriseContext,
         automaticMemoryExtraction,
+        scenarioReplay: parsed.replayScenarioPath && process.env.MAESTRO_SCENARIO_ID
+            ? {
+                path: scenarioSourceLabel(parsed.replayScenarioPath),
+                scenarioId: process.env.MAESTRO_SCENARIO_ID,
+            }
+            : undefined,
+        scenarioRecorder,
     });
     // ─────────────────────────────────────────────────────────────────────────────
     // PHASE 14: Runtime Mode Dispatch
@@ -1063,7 +1275,7 @@ export async function main(args) {
         else if (mode === "headless" || parsed.headless) {
             // Headless mode - for native TUI communication
             startupProfiler.terminal("headless:ready");
-            await runHeadlessMode(agent, sessionManager, approvalService, toolRetryService);
+            await runHeadlessMode(agent, sessionManager, approvalService, toolRetryService, { runtimeSelection: headlessRuntimeSelection });
         }
         else if (mode === "rpc") {
             // RPC mode - headless operation