@fabric-harness/cli 0.1.0

package/dist/bin/fabric-harness.js

@@ -0,0 +1,1497 @@
+#!/usr/bin/env node
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { promises as fs, watch } from 'node:fs';
+import path from 'node:path';
+import { parseEnv } from 'node:util';
+import { applyEnvModelProvider, buildWorkspace, compactSessionInStore, createConfiguredSessionStore, findWorkspaceRoot, inspectReplayFromStore, inspectSessionFromStore, describeAgentFile, getRequiredAgentDefinition, listAgentSummaries, listBuilds, listSessionSummariesFromStore, listApprovalStatesFromStore, listApprovalsFromStore, listCheckpointsFromStore, listTasksFromStore, loadAgentModule, loadFabricHarnessConfig, resolveAgentPath, resolveApprovalInStore, resolveSessionApproval, runAgent, startDevServer, cancelTaskInStore, getMetricsFromStore, getTaskFromStore, verifyAttestation, verifyProvenance, } from '@fabric-harness/node';
+import { FileSessionStore } from '@fabric-harness/node';
+import { EmptySandboxEnv, SchemaValidationError, createBuiltinTools, resolveModelProvider, toolsToModelSchemas } from '@fabric-harness/sdk';
+const ORIGINAL_ENV = { ...process.env };
+import { createLocalTemporalActivities, createTemporalClient, startTemporalWorker } from '@fabric-harness/temporal';
+const HELP = `Fabric Harness
+
+Usage:
+  fabric-harness --help
+  fabric-harness run <agent> [--target node|temporal-worker] [--model provider/model] [--id <id>] [--env <file>] [--payload '<json>' | --payload-file <path>]
+  fabric-harness run <agent> [--target node|temporal-worker] [--env <file>] --question "What is Temporal?"
+  fabric-harness run <agent> [--target node|temporal-worker] question="What is Temporal?"
+  fabric-harness run <agent> [--target temporal-worker] [--model provider/model] [--id <id>] --prompt <text>
+  fabric-harness agents [--json]
+  fabric-harness describe <agent> [--json]
+  fabric-harness build [--target node|temporal-worker|docker|foundry-hosted-agent|cloudflare] [--out <dir>] [--sbom] [--sbom-required] [--provenance] [--attestation] [--sign-provenance] [--signing-key <path|env://VAR>] [--docker-build] [--docker-push] [--docker-tag <tag>] [--image-sbom] [--image-sbom-required]
+  fabric-harness sessions
+  fabric-harness builds
+  fabric-harness verify-attestation <build-dir-or-attestation>
+  fabric-harness verify-provenance <build-dir-or-provenance>
+  fabric-harness doctor [--target node|temporal-worker] [--model provider/model] [--tools] [--live] [--json]
+  fabric-harness add [connector] [--print]
+  fabric-harness inspect <session-id>
+  fabric-harness logs <session-id> [--events]
+  fabric-harness checkpoints <session-id>
+  fabric-harness artifacts <session-id> [--json]
+  fabric-harness artifact get <session-id> <artifact-id-or-name> [--out <path>]
+  fabric-harness metrics <session-id> [--json]
+  fabric-harness tasks <session-id> [--json]
+  fabric-harness task <session-id> <task-id> [--json]
+  fabric-harness cancel-task <session-id> <task-id> [--actor <id>] [--reason <text>]
+  fabric-harness compact <session-id> [--keep <n>] [--summary <text>]
+  fabric-harness replay <session-id>
+  fabric-harness approvals <session-id> [--pending] [--state]
+  fabric-harness approve <session-id> <approval-id> [--actor <id>] [--reason <text>]
+  fabric-harness reject <session-id> <approval-id> [--actor <id>] [--reason <text>]
+  fabric-harness dev [--target node|cloudflare] [--env <file>] [--host <host>] [--port <port>] [--auth-token-env <var>] [--max-body-bytes <n>] [--rate-limit-window-ms <n>] [--rate-limit-max <n>]
+  fabric-harness temporal-worker [--task-queue <name>] [--address <host:port>] [--env <file>]
+
+Commands:
+  run <agent>          Run a local .fabricharness agent handler
+  build                Compile workspace and emit a deployment manifest
+  agents               List workspace agents
+  describe <agent>     Show agent metadata, schemas, and examples
+  sessions             List persisted sessions
+  builds               List emitted build manifests
+  inspect <session-id> Inspect persisted session history
+  logs <session-id>    Print a readable session timeline
+  checkpoints <id>     List checkpoints in a persisted session
+  artifacts <id>       List artifacts in a persisted session
+  artifact get <id>    Download/print a session artifact
+  metrics <id>         Summarize token/tool/shell/artifact metrics
+  tasks <id>           List durable tasks in a persisted session
+  task <id> <task-id>  Show durable task status and checkpoints
+  cancel-task <id>     Append a cancellation marker for a running task
+  compact <id>         Add a compaction entry to a persisted session
+  replay <id>          Show read-only active path and model context
+  approvals <id>       List approval requests for a persisted session
+  approve <id> <app>   Mark an approval request approved
+  reject <id> <app>    Mark an approval request denied
+  dev                  Start local HTTP/SSE dev server
+  temporal-worker      Start a local Temporal worker with Fabric activities
+  add                  List or print connector implementation recipes
+
+Options:
+  --id <id>          Run or agent identifier. If omitted, a session id is generated.
+  --payload <json>   JSON payload passed to the agent
+  --payload-file <p> Read JSON payload from a file
+  --stdin            Read JSON payload from standard input
+  --set k=v          Set a payload field. May be repeated
+  --<field> <value>  Set a payload field shortcut, e.g. --question "..."
+  --runtime <mode>   inline or temporal for run
+  --target <target>  Run/build target. For run: node or temporal-worker
+  --prompt <text>    Prompt text for temporal run mode
+  --model <model>    Model as provider/model-id, e.g. openai/gpt-5.5
+  --env <file>       Load .env-style variables before run/dev/temporal-worker. Auto-loads .env/.env.local; shell env wins.
+
+Config defaults:
+  .fabricharness/config.ts may set run.target, run.model, run.idPrefix,
+  temporal.address, temporal.taskQueue, and agent.model. CLI flags win over config.
+  --target <target>  Build target: node, temporal-worker, docker, foundry-hosted-agent, or cloudflare
+  --out <dir>        Build output directory
+  --sbom             Emit CycloneDX SBOM with Syft when available
+  --sbom-required    Require SBOM generation and fail if Syft is missing
+  --provenance       Emit provenance.json for the build artifact
+  --attestation      Emit attestation.intoto.jsonl with manifest digest subject
+  --sign-provenance  Sign provenance.json with cosign sign-blob
+  --signing-key <k>  cosign key path or env://VAR, defaults to env://COSIGN_PRIVATE_KEY
+  --docker-build     Run docker build after emitting --target docker
+  --docker-push      Run docker push after --docker-build
+  --docker-tag <tag> Tag to use with --docker-build/--docker-push
+  --image-sbom       Emit CycloneDX SBOM for the built Docker image with Syft
+  --image-sbom-required Require image SBOM generation and fail if Syft is missing
+  -h, --help         Show help
+`;
+function parseJsonPayload(value) {
+    try {
+        return JSON.parse(value);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Invalid --payload JSON: ${message}`);
+    }
+}
+function parsePayloadValue(value) {
+    const trimmed = value.trim();
+    if (trimmed === 'true')
+        return true;
+    if (trimmed === 'false')
+        return false;
+    if (trimmed === 'null')
+        return null;
+    if (/^-?\d+(\.\d+)?$/.test(trimmed))
+        return Number(trimmed);
+    if ((trimmed.startsWith('{') && trimmed.endsWith('}')) || (trimmed.startsWith('[') && trimmed.endsWith(']')))
+        return parseJsonPayload(trimmed);
+    return value;
+}
+function applyPayloadField(fields, assignment) {
+    const equals = assignment.indexOf('=');
+    if (equals <= 0)
+        throw new Error(`Expected payload assignment key=value, got: ${assignment}`);
+    fields[assignment.slice(0, equals)] = parsePayloadValue(assignment.slice(equals + 1));
+}
+function parseRunArgs(args) {
+    const [agent, ...rest] = args;
+    if (!agent || agent.startsWith('-'))
+        throw new Error('Missing required <agent> argument for run.');
+    const parsed = { agent };
+    for (let index = 0; index < rest.length; index += 1) {
+        const arg = rest[index];
+        if (arg === undefined)
+            continue;
+        if (arg === '--id') {
+            const value = rest[++index];
+            if (!value)
+                throw new Error('Missing value for --id.');
+            parsed.id = value;
+            continue;
+        }
+        if (arg === '--payload') {
+            const value = rest[++index];
+            if (!value)
+                throw new Error('Missing value for --payload.');
+            parsed.payload = parseJsonPayload(value);
+            continue;
+        }
+        if (arg === '--payload-file') {
+            const value = rest[++index];
+            if (!value)
+                throw new Error('Missing value for --payload-file.');
+            parsed.payloadFile = value;
+            continue;
+        }
+        if (arg === '--stdin') {
+            parsed.stdin = true;
+            continue;
+        }
+        if (arg === '--set') {
+            const value = rest[++index];
+            if (!value)
+                throw new Error('Missing value for --set.');
+            parsed.payloadFields ??= {};
+            applyPayloadField(parsed.payloadFields, value);
+            continue;
+        }
+        if (arg === '--runtime') {
+            const value = rest[++index];
+            if (value !== 'inline' && value !== 'temporal')
+                throw new Error('--runtime must be inline or temporal.');
+            parsed.runtime = value;
+            continue;
+        }
+        if (arg === '--target') {
+            const value = rest[++index];
+            if (value !== 'node' && value !== 'temporal-worker')
+                throw new Error('--target for run must be node or temporal-worker.');
+            parsed.target = value;
+            parsed.runtime = value === 'temporal-worker' ? 'temporal' : 'inline';
+            continue;
+        }
+        if (arg === '--prompt') {
+            const value = rest[++index];
+            if (!value)
+                throw new Error('Missing value for --prompt.');
+            parsed.prompt = value;
+            continue;
+        }
+        if (arg === '--model') {
+            const value = rest[++index];
+            if (!value)
+                throw new Error('Missing value for --model.');
+            parsed.model = value;
+            continue;
+        }
+        if (arg === '--env') {
+            const value = rest[++index];
+            if (!value)
+                throw new Error('Missing value for --env.');
+            parsed.envFiles ??= [];
+            parsed.envFiles.push(value);
+            continue;
+        }
+        if (arg === '--help' || arg === '-h') {
+            console.log(HELP);
+            process.exit(0);
+        }
+        if (arg.startsWith('--')) {
+            const key = arg.slice(2);
+            if (!key)
+                throw new Error(`Unknown argument: ${arg}`);
+            const value = rest[++index];
+            if (value === undefined || value.startsWith('--'))
+                throw new Error(`Missing value for --${key}.`);
+            parsed.payloadFields ??= {};
+            parsed.payloadFields[key] = parsePayloadValue(value);
+            continue;
+        }
+        if (arg.includes('=')) {
+            parsed.payloadFields ??= {};
+            applyPayloadField(parsed.payloadFields, arg);
+            continue;
+        }
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+    return parsed;
+}
+function printResult(result) {
+    if (typeof result === 'string') {
+        console.log(result);
+        return;
+    }
+    if (result !== undefined)
+        console.log(JSON.stringify(result, null, 2));
+}
+async function loadEnvFiles(envFiles, options = {}) {
+    if (!envFiles || envFiles.length === 0)
+        return;
+    const merged = {};
+    for (const envFile of envFiles) {
+        const filePath = path.resolve(process.cwd(), envFile);
+        let contents;
+        try {
+            contents = await fs.readFile(filePath, 'utf8');
+        }
+        catch (error) {
+            if (options.ignoreMissing && error.code === 'ENOENT')
+                continue;
+            const message = error instanceof Error ? error.message : String(error);
+            throw new Error(`Failed to read --env file ${envFile}: ${message}`);
+        }
+        Object.assign(merged, parseEnv(contents));
+    }
+    for (const [key, value] of Object.entries(merged)) {
+        if (ORIGINAL_ENV[key] !== undefined)
+            continue;
+        if (options.explicit || process.env[key] === undefined)
+            process.env[key] = value;
+    }
+}
+async function loadAutoEnvFiles() {
+    const cwd = process.cwd();
+    const workspaceRoot = await findWorkspaceRoot(cwd).catch(() => undefined);
+    const repoRoot = await findRepoRoot(cwd).catch(() => undefined);
+    const roots = [...new Set([repoRoot, workspaceRoot].filter((value) => Boolean(value)))];
+    const files = [];
+    for (const root of roots) {
+        files.push(path.join(root, '.env'), path.join(root, '.env.local'));
+    }
+    if (workspaceRoot) {
+        files.push(path.join(workspaceRoot, '.fabricharness', '.env'), path.join(workspaceRoot, '.fabricharness', '.env.local'));
+    }
+    await loadEnvFiles(files, { ignoreMissing: true });
+}
+async function findRepoRoot(start) {
+    let current = path.resolve(start);
+    for (;;) {
+        try {
+            await fs.access(path.join(current, 'pnpm-workspace.yaml'));
+            return current;
+        }
+        catch {
+            // keep walking
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
+}
+async function runCommand(args) {
+    const parsedArgs = parseRunArgs(args);
+    await loadEnvFiles(parsedArgs.envFiles, { explicit: true });
+    const parsed = await resolvePayloadInputs(parsedArgs);
+    const resolved = await resolveRunDefaults(parsed);
+    if (resolved.runtime === 'temporal')
+        return runTemporalPromptCommand(resolved);
+    const { result } = await runAgent(resolved);
+    printResult(result);
+}
+async function resolvePayloadInputs(parsed) {
+    let payload = parsed.payload;
+    if (parsed.payloadFile) {
+        const filePath = path.resolve(process.cwd(), parsed.payloadFile);
+        payload = parseJsonPayload(await fs.readFile(filePath, 'utf8'));
+    }
+    if (parsed.stdin) {
+        payload = parseJsonPayload(await readStdin());
+    }
+    if (parsed.payloadFields && Object.keys(parsed.payloadFields).length > 0) {
+        const base = typeof payload === 'object' && payload !== null && !Array.isArray(payload) ? payload : {};
+        payload = { ...base, ...parsed.payloadFields };
+    }
+    return { ...parsed, ...(payload !== undefined ? { payload } : {}) };
+}
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    return Buffer.concat(chunks).toString('utf8');
+}
+async function resolveRunDefaults(parsed) {
+    const workspaceRoot = await findWorkspaceRoot();
+    const config = await loadFabricHarnessConfig({ workspaceRoot });
+    const envTarget = process.env.FABRIC_TARGET ?? process.env.FABRIC_HARNESS_TARGET;
+    if (envTarget !== undefined && envTarget !== 'node' && envTarget !== 'temporal-worker')
+        throw new Error('FABRIC_TARGET/FABRIC_HARNESS_TARGET must be node or temporal-worker.');
+    const agentDefaults = await readAgentRunDefaults(workspaceRoot, parsed.agent);
+    const target = parsed.target ?? envTarget ?? config.run?.target ?? agentDefaults.target;
+    if (target !== undefined && target !== 'node' && target !== 'temporal-worker')
+        throw new Error('Configured run.target must be node or temporal-worker.');
+    const runtime = parsed.runtime ?? (target === 'temporal-worker' ? 'temporal' : 'inline');
+    const model = parsed.model ?? process.env.FABRIC_MODEL ?? config.run?.model ?? agentDefaults.model ?? (typeof config.agent?.model === 'string' ? config.agent.model : undefined);
+    const id = parsed.id ?? `${config.run?.idPrefix ?? parsed.agent}-${randomUUID()}`;
+    return {
+        ...parsed,
+        id,
+        runtime,
+        ...(target ? { target } : {}),
+        ...(model ? { model } : {}),
+    };
+}
+async function readAgentRunDefaults(workspaceRoot, agentName) {
+    try {
+        const agentPath = await resolveAgentPath(workspaceRoot, agentName);
+        const description = await describeAgentFile({ workspaceRoot, agentPath });
+        return {
+            ...(description.model ? { model: description.model } : {}),
+            ...(description.target ? { target: description.target } : {}),
+        };
+    }
+    catch {
+        return {};
+    }
+}
+async function runTemporalPromptCommand(parsed) {
+    if (!parsed.id)
+        throw new Error('--id is required with --runtime temporal.');
+    const workspaceRoot = await findWorkspaceRoot();
+    const config = await loadFabricHarnessConfig({ workspaceRoot });
+    const taskQueue = process.env.FABRIC_TEMPORAL_TASK_QUEUE ?? config.temporal?.taskQueue ?? 'fabric-harness';
+    const address = process.env.FABRIC_TEMPORAL_ADDRESS ?? config.temporal?.address ?? 'localhost:7233';
+    const namespace = process.env.FABRIC_TEMPORAL_NAMESPACE ?? config.temporal?.namespace;
+    const client = await createTemporalClient({
+        mode: 'temporal',
+        address,
+        taskQueue,
+        ...(namespace ? { namespace } : {}),
+        ...(config.temporal?.apiKey ? { apiKey: config.temporal.apiKey } : {}),
+        ...(config.temporal?.apiKeyEnv ? { apiKeyEnv: config.temporal.apiKeyEnv } : {}),
+        ...(config.temporal?.tls ? { tls: config.temporal.tls } : {}),
+        workflowIdPrefix: config.temporal?.workflowIdPrefix ?? 'fabric-cli',
+        promptWorkflowMode: config.temporal?.promptWorkflowMode ?? 'hybrid',
+    });
+    try {
+        if (parsed.prompt) {
+            const runtime = client.createSessionRuntime(parsed.id);
+            printResult(await runtime.prompt({ text: parsed.prompt, ...(parsed.model ? { options: { model: parsed.model } } : {}) }));
+            return;
+        }
+        const agentPath = await resolveAgentPath(workspaceRoot, parsed.agent);
+        const module = await loadAgentModule({ workspaceRoot, agentPath });
+        getRequiredAgentDefinition(module.default, agentPath);
+        const handler = module.default;
+        if (typeof handler !== 'function')
+            throw new Error(`Agent module must default-export agent({...}) from @fabric-harness/sdk: ${agentPath}`);
+        const context = createTemporalFabricContext(parsed, client.createSessionRuntime.bind(client));
+        printResult(await handler(context));
+    }
+    finally {
+        await client.close();
+    }
+}
+function createTemporalFabricContext(parsed, runtimeForSession) {
+    const payload = (typeof parsed.payload === 'object' && parsed.payload !== null && !Array.isArray(parsed.payload) ? parsed.payload : {});
+    return {
+        payload,
+        init: async (initOptions = {}) => {
+            const agentId = initOptions.id ?? parsed.id ?? 'temporal-agent';
+            const model = parsed.model ?? (typeof initOptions.model === 'string' ? initOptions.model : undefined);
+            return {
+                id: agentId,
+                ...(model ? { model } : {}),
+                ...(initOptions.role ? { role: initOptions.role } : {}),
+                session: async (id, _options) => createTemporalSession(id ?? parsed.id ?? agentId, runtimeForSession, model),
+            };
+        },
+    };
+}
+function createTemporalSession(sessionId, runtimeForSession, model) {
+    const runtime = runtimeForSession(sessionId);
+    return {
+        id: sessionId,
+        agent: { id: sessionId, ...(model ? { model } : {}), session: async () => createTemporalSession(sessionId, runtimeForSession, model) },
+        // Do not create a rejected promise here: many agents never access session.sandbox,
+        // but Node treats an eagerly rejected promise as unhandled. Direct sandbox effects
+        // in Temporal CLI mode should go through session.shell()/tools, which are routed
+        // to workflow activities. This placeholder prevents accidental unhandled rejection.
+        sandbox: Promise.resolve(new EmptySandboxEnv()),
+        prompt: (text, options) => runtime.prompt({ text, ...(options || model ? { options: { ...(options ?? {}), ...(model && options?.model === undefined ? { model } : {}) } } : {}) }),
+        stream: async function* (text, options) { for (const event of [])
+            yield event; return await runtime.prompt({ text, ...(options || model ? { options: { ...(options ?? {}), ...(model && options?.model === undefined ? { model } : {}) } } : {}) }); },
+        skill: (name, options) => runtime.prompt({ text: `Run skill ${name}${options?.args ? ` with args ${JSON.stringify(options.args)}` : ''}`, ...(options || model ? { options: { ...(options ?? {}), ...(model && options?.model === undefined ? { model } : {}) } } : {}) }),
+        task: (text, options) => runtime.task({ text, ...(options?.id ? { taskId: options.id } : {}), ...(options || model ? { options: { ...(options ?? {}), ...(model && options?.model === undefined ? { model } : {}) } } : {}) }),
+        shell: (command, options) => runtime.shell({ command, ...(options ? { options } : {}) }),
+        history: async () => ({ id: sessionId, createdAt: new Date().toISOString(), updatedAt: new Date().toISOString(), entries: [], events: [] }),
+        checkpoint: {
+            create: (options) => runtime.checkpointCreate({ options }),
+            restore: (options) => runtime.checkpointRestore({ options }),
+        },
+        artifact: async () => { throw new Error('session.artifact() is not available in Temporal CLI shim yet. Use worker activities or a node target.'); },
+        compact: async () => ({ entryId: '', summary: 'Compaction is executed by Temporal worker activities.', compactedEntries: 0 }),
+    };
+}
+async function temporalWorkerCommand(args) {
+    const envFiles = [];
+    let taskQueueFlag;
+    let addressFlag;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === '--env') {
+            const value = args[++index];
+            if (!value)
+                throw new Error('Missing value for --env.');
+            envFiles.push(value);
+            continue;
+        }
+        if (arg === '--task-queue') {
+            const value = args[++index];
+            if (!value)
+                throw new Error('Missing value for --task-queue.');
+            taskQueueFlag = value;
+            continue;
+        }
+        if (arg === '--address') {
+            const value = args[++index];
+            if (!value)
+                throw new Error('Missing value for --address.');
+            addressFlag = value;
+            continue;
+        }
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+    await loadEnvFiles(envFiles, { explicit: true });
+    const workspaceRoot = await findWorkspaceRoot();
+    const config = await loadFabricHarnessConfig({ workspaceRoot });
+    const taskQueue = taskQueueFlag ?? process.env.FABRIC_TEMPORAL_TASK_QUEUE ?? config.temporal?.taskQueue ?? 'fabric-harness';
+    const address = addressFlag ?? process.env.FABRIC_TEMPORAL_ADDRESS ?? config.temporal?.address ?? 'localhost:7233';
+    const namespace = process.env.FABRIC_TEMPORAL_NAMESPACE ?? config.temporal?.namespace;
+    const sandbox = new EmptySandboxEnv();
+    const store = new FileSessionStore({ workspaceRoot });
+    const modelOptions = applyEnvModelProvider(config.agent ?? {});
+    const activities = createLocalTemporalActivities({
+        store,
+        sandbox,
+        tools: createBuiltinTools(sandbox),
+        ...(typeof modelOptions.model === 'string' ? { model: modelOptions.model } : {}),
+        ...(modelOptions.modelProvider ? { modelProvider: modelOptions.modelProvider } : {}),
+        ...(modelOptions.policy ? { policy: modelOptions.policy } : {}),
+        ...(modelOptions.resolveSecret ? { resolveSecret: modelOptions.resolveSecret } : {}),
+    });
+    const worker = await startTemporalWorker({
+        mode: 'temporal',
+        address,
+        taskQueue,
+        ...(namespace ? { namespace } : {}),
+        ...(config.temporal?.apiKey ? { apiKey: config.temporal.apiKey } : {}),
+        ...(config.temporal?.apiKeyEnv ? { apiKeyEnv: config.temporal.apiKeyEnv } : {}),
+        ...(config.temporal?.tls ? { tls: config.temporal.tls } : {}),
+        activities,
+    });
+    console.log(`Fabric Harness Temporal worker listening at ${address}, taskQueue=${taskQueue}`);
+    const shutdown = async () => {
+        await worker.close();
+        process.exit(0);
+    };
+    process.on('SIGINT', () => void shutdown());
+    process.on('SIGTERM', () => void shutdown());
+    await worker.runPromise;
+}
+async function buildCommand(args) {
+    let outDir;
+    let target;
+    let clean = true;
+    let sbom = false;
+    let sbomRequired = false;
+    let provenance = false;
+    let attestation = false;
+    let dockerBuild = false;
+    let dockerPush = false;
+    let dockerTag;
+    let imageSbom = false;
+    let imageSbomRequired = false;
+    let signProvenance = false;
+    let signingKey;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === '--out') {
+            outDir = args[++index];
+            continue;
+        }
+        if (arg === '--target') {
+            const value = args[++index];
+            if (value !== 'node' && value !== 'temporal-worker' && value !== 'docker' && value !== 'foundry-hosted-agent' && value !== 'cloudflare')
+                throw new Error('--target must be node, temporal-worker, docker, foundry-hosted-agent, or cloudflare.');
+            target = value;
+            continue;
+        }
+        if (arg === '--no-clean') {
+            clean = false;
+            continue;
+        }
+        if (arg === '--sbom') {
+            sbom = true;
+            continue;
+        }
+        if (arg === '--sbom-required') {
+            sbom = true;
+            sbomRequired = true;
+            continue;
+        }
+        if (arg === '--provenance') {
+            provenance = true;
+            continue;
+        }
+        if (arg === '--attestation') {
+            attestation = true;
+            continue;
+        }
+        if (arg === '--sign-provenance') {
+            signProvenance = true;
+            provenance = true;
+            continue;
+        }
+        if (arg === '--signing-key') {
+            signingKey = args[++index];
+            if (!signingKey)
+                throw new Error('Missing value for --signing-key.');
+            continue;
+        }
+        if (arg === '--docker-build') {
+            dockerBuild = true;
+            continue;
+        }
+        if (arg === '--docker-push') {
+            dockerPush = true;
+            continue;
+        }
+        if (arg === '--docker-tag') {
+            dockerTag = args[++index];
+            if (!dockerTag)
+                throw new Error('Missing value for --docker-tag.');
+            continue;
+        }
+        if (arg === '--image-sbom') {
+            imageSbom = true;
+            continue;
+        }
+        if (arg === '--image-sbom-required') {
+            imageSbom = true;
+            imageSbomRequired = true;
+            continue;
+        }
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+    const result = await buildWorkspace({ ...(outDir ? { outDir } : {}), ...(target ? { target } : {}), clean, sbom, sbomRequired, provenance, attestation, signProvenance, ...(signingKey ? { signingKey } : {}), dockerBuild, dockerPush, ...(dockerTag ? { dockerTag } : {}), imageSbom, imageSbomRequired });
+    console.log(`Built Fabric Harness workspace: ${result.outDir}`);
+    console.log(`Manifest: ${result.manifestPath}`);
+    if (result.provenancePath)
+        console.log(`Provenance: ${result.provenancePath}`);
+    if (result.provenanceSignaturePath)
+        console.log(`Provenance signature: ${result.provenanceSignaturePath}`);
+    if (result.attestationPath)
+        console.log(`Attestation: ${result.attestationPath}`);
+    if (result.sbomPath)
+        console.log(`SBOM: ${result.sbomPath}`);
+    if (result.dockerImage)
+        console.log(`Docker image: ${result.dockerImage}`);
+    if (result.imageSbomPath)
+        console.log(`Image SBOM: ${result.imageSbomPath}`);
+    for (const warning of result.warnings)
+        console.warn(`Warning: ${warning}`);
+    console.log(`Agents: ${result.manifest.agents.map((agent) => agent.name).join(', ') || 'none'}`);
+}
+async function devCommand(args) {
+    let host;
+    let port;
+    let target = 'node';
+    let authTokenEnv;
+    let maxBodyBytes;
+    let rateLimitWindowMs;
+    let rateLimitMax;
+    const envFiles = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === '--host') {
+            host = args[++index];
+            continue;
+        }
+        if (arg === '--port') {
+            const value = args[++index];
+            port = value ? Number(value) : undefined;
+            continue;
+        }
+        if (arg === '--target') {
+            const value = args[++index];
+            if (value !== 'node' && value !== 'cloudflare')
+                throw new Error('--target for dev must be node or cloudflare.');
+            target = value;
+            continue;
+        }
+        if (arg === '--env') {
+            const value = args[++index];
+            if (!value)
+                throw new Error('Missing value for --env.');
+            envFiles.push(value);
+            continue;
+        }
+        if (arg === '--auth-token-env') {
+            const value = args[++index];
+            if (!value)
+                throw new Error('Missing value for --auth-token-env.');
+            authTokenEnv = value;
+            continue;
+        }
+        if (arg === '--max-body-bytes') {
+            const value = args[++index];
+            if (!value)
+                throw new Error('Missing value for --max-body-bytes.');
+            maxBodyBytes = Number(value);
+            if (!Number.isFinite(maxBodyBytes) || maxBodyBytes <= 0)
+                throw new Error('--max-body-bytes must be a positive number.');
+            continue;
+        }
+        if (arg === '--rate-limit-window-ms') {
+            const value = args[++index];
+            if (!value)
+                throw new Error('Missing value for --rate-limit-window-ms.');
+            rateLimitWindowMs = Number(value);
+            if (!Number.isFinite(rateLimitWindowMs) || rateLimitWindowMs <= 0)
+                throw new Error('--rate-limit-window-ms must be a positive number.');
+            continue;
+        }
+        if (arg === '--rate-limit-max') {
+            const value = args[++index];
+            if (!value)
+                throw new Error('Missing value for --rate-limit-max.');
+            rateLimitMax = Number(value);
+            if (!Number.isFinite(rateLimitMax) || rateLimitMax <= 0)
+                throw new Error('--rate-limit-max must be a positive number.');
+            continue;
+        }
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+    await loadEnvFiles(envFiles, { explicit: true });
+    if (target === 'cloudflare') {
+        const cloudflareOptions = {};
+        if (host !== undefined)
+            cloudflareOptions.host = host;
+        if (port !== undefined)
+            cloudflareOptions.port = port;
+        await cloudflareDevCommand(cloudflareOptions);
+        return;
+    }
+    const options = {};
+    if (host !== undefined)
+        options.host = host;
+    if (port !== undefined)
+        options.port = port;
+    if (authTokenEnv !== undefined)
+        options.authTokenEnv = authTokenEnv;
+    if (maxBodyBytes !== undefined)
+        options.maxBodyBytes = maxBodyBytes;
+    if (rateLimitWindowMs !== undefined || rateLimitMax !== undefined) {
+        options.rateLimit = { windowMs: rateLimitWindowMs ?? 60_000, maxRequests: rateLimitMax ?? 60 };
+    }
+    const workspaceRoot = await findWorkspaceRoot();
+    const server = await startDevServer({ ...options, cwd: workspaceRoot });
+    const watcher = startNodeDevWatcher(workspaceRoot, envFiles);
+    const shutdown = async () => {
+        watcher?.close();
+        await server.close();
+        process.exit(0);
+    };
+    process.on('SIGINT', () => void shutdown());
+    process.on('SIGTERM', () => void shutdown());
+    console.log(`Fabric Harness dev server listening at ${server.url}`);
+    console.log('POST /agents/:agent/:id, GET /sessions/:id, GET /sessions/:id/events');
+    console.log('Watching .fabricharness for changes; agents/config reload on the next request.');
+}
+async function cloudflareDevCommand(options) {
+    const workspaceRoot = await findWorkspaceRoot();
+    console.error('[fabric-harness] Building Cloudflare Worker artifact...');
+    const result = await buildWorkspace({ cwd: workspaceRoot, target: 'cloudflare' });
+    console.error(`[fabric-harness] Cloudflare artifact: ${result.outDir}`);
+    console.error('[fabric-harness] Starting Wrangler dev. Install wrangler/@cloudflare dependencies in the artifact if prompted.');
+    const args = ['wrangler', 'dev'];
+    if (options.port !== undefined)
+        args.push('--port', String(options.port));
+    if (options.host !== undefined)
+        args.push('--ip', options.host);
+    const npx = process.platform === 'win32' ? 'npx.cmd' : 'npx';
+    const child = spawn(npx, args, {
+        cwd: result.outDir,
+        stdio: 'inherit',
+        shell: false,
+        env: process.env,
+    });
+    const shutdown = () => {
+        child.kill('SIGTERM');
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+    const code = await new Promise((resolve, reject) => {
+        child.on('error', reject);
+        child.on('close', resolve);
+    });
+    if (code && code !== 0)
+        throw new Error(`Wrangler dev exited with code ${code}.`);
+}
+function startNodeDevWatcher(workspaceRoot, envFiles) {
+    const watchRoot = path.join(workspaceRoot, '.fabricharness');
+    try {
+        const envFileSet = new Set(envFiles.map((file) => path.resolve(process.cwd(), file)));
+        let timer;
+        return watch(watchRoot, { recursive: true }, (_eventType, filename) => {
+            if (timer)
+                clearTimeout(timer);
+            timer = setTimeout(() => {
+                const changed = filename ? path.join('.fabricharness', String(filename)) : '.fabricharness';
+                console.error(`[fabric-harness] Change detected: ${changed}. Reload will apply on next request.`);
+                for (const envFile of envFileSet) {
+                    if (path.resolve(workspaceRoot, changed) === envFile)
+                        console.error(`[fabric-harness] Env file changed: ${envFile}. Restart dev server to reload shell environment values.`);
+                }
+            }, 100);
+        });
+    }
+    catch {
+        return undefined;
+    }
+}
+const CONNECTOR_RECIPES = {
+    daytona: 'sandbox--daytona.md',
+    e2b: 'sandbox--e2b.md',
+    modal: 'sandbox--modal.md',
+    'github-mcp': 'mcp--github.md',
+    postgres: 'data--postgres.md',
+};
+async function addCommand(args) {
+    let connector;
+    let print = false;
+    for (const arg of args) {
+        if (arg === '--print') {
+            print = true;
+            continue;
+        }
+        if (!connector && !arg.startsWith('-')) {
+            connector = arg;
+            continue;
+        }
+        throw new Error(`Unknown argument for add: ${arg}`);
+    }
+    if (!connector) {
+        console.log('Available connector recipes:');
+        for (const [name, file] of Object.entries(CONNECTOR_RECIPES))
+            console.log(`  ${name.padEnd(12)} ${file}`);
+        console.log('\nUse `fabric-harness add <name> --print` to print a recipe.');
+        return;
+    }
+    const recipeFile = CONNECTOR_RECIPES[connector];
+    if (!recipeFile)
+        throw new Error(`Unknown connector recipe: ${connector}. Run \`fabric-harness add\` to list recipes.`);
+    const recipePath = await findConnectorRecipe(recipeFile);
+    if (!print) {
+        console.log(`Connector recipe: ${connector}`);
+        console.log(recipePath);
+        console.log(`\nRun \`fabric-harness add ${connector} --print\` to print the implementation guide.`);
+        return;
+    }
+    console.log(await fs.readFile(recipePath, 'utf8'));
+}
+async function findConnectorRecipe(file) {
+    let current = process.cwd();
+    while (true) {
+        const candidate = path.join(current, 'connectors', file);
+        try {
+            await fs.access(candidate);
+            return candidate;
+        }
+        catch {
+            // keep walking up
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            break;
+        current = parent;
+    }
+    const fromCli = path.resolve(path.dirname(new URL(import.meta.url).pathname), '..', '..', '..', 'connectors', file);
+    try {
+        await fs.access(fromCli);
+        return fromCli;
+    }
+    catch {
+        throw new Error(`Connector recipe file not found: ${file}`);
+    }
+}
+async function verifyCommand(args, kind) {
+    const [target, ...rest] = args;
+    if (!target || target.startsWith('-'))
+        throw new Error(`Missing required <build-dir-or-${kind}> argument.`);
+    if (rest.length > 0)
+        throw new Error(`Unknown argument: ${rest[0]}`);
+    const result = kind === 'attestation' ? await verifyAttestation(target) : await verifyProvenance(target);
+    printResult(result);
+}
+async function inspectCommand(args) {
+    const [sessionId, ...rest] = args;
+    if (!sessionId || sessionId.startsWith('-'))
+        throw new Error('Missing required <session-id> argument for inspect.');
+    if (rest.length > 0)
+        throw new Error(`Unknown argument: ${rest[0]}`);
+    const { store } = await loadConfiguredStoreForWorkspace();
+    const data = await inspectSessionFromStore(store, sessionId);
+    if (!data)
+        throw new Error(`Session not found: ${sessionId}`);
+    printResult(data);
+}
+async function replayCommand(args) {
+    const [sessionId, ...rest] = args;
+    if (!sessionId || sessionId.startsWith('-'))
+        throw new Error('Missing required <session-id> argument for replay.');
+    if (rest.length > 0)
+        throw new Error(`Unknown argument: ${rest[0]}`);
+    const { store } = await loadConfiguredStoreForWorkspace();
+    const replay = await inspectReplayFromStore(store, sessionId);
+    if (!replay)
+        throw new Error(`Session not found: ${sessionId}`);
+    console.log(`Replay inspection for session ${replay.sessionId}`);
+    console.log('');
+    console.log(`Active path entries: ${replay.activePath.length}`);
+    for (const entry of replay.activePath) {
+        console.log(`${entry.timestamp}  ${entry.type}  ${entry.id}${entry.parentId ? ` <- ${entry.parentId}` : ''}`);
+    }
+    console.log('');
+    if (replay.latestCompaction) {
+        console.log(`Latest compaction: ${replay.latestCompaction.id}`);
+        console.log(formatInline(replay.latestCompaction.data ?? {}));
+    }
+    else {
+        console.log('Latest compaction: none');
+    }
+    console.log('');
+    console.log(`Model context messages: ${replay.modelMessages.length}`);
+    for (const message of replay.modelMessages) {
+        const name = message.name ? ` name=${message.name}` : '';
+        console.log(`${message.role}${name}: ${message.content.replace(/\s+/g, ' ').slice(0, 240)}`);
+    }
+}
+async function doctorCommand(args) {
+    let target;
+    let model;
+    let checkTools = false;
+    let live = false;
+    let jsonOutput = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === '--target') {
+            const value = args[++index];
+            if (value !== 'node' && value !== 'temporal-worker')
+                throw new Error('--target for doctor must be node or temporal-worker.');
+            target = value;
+            continue;
+        }
+        if (arg === '--model') {
+            model = args[++index];
+            if (!model)
+                throw new Error('Missing value for --model.');
+            continue;
+        }
+        if (arg === '--tools') {
+            checkTools = true;
+            continue;
+        }
+        if (arg === '--live') {
+            live = true;
+            continue;
+        }
+        if (arg === '--json') {
+            jsonOutput = true;
+            continue;
+        }
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+    const workspaceRoot = await findWorkspaceRoot();
+    const checks = [];
+    checks.push({ name: 'workspace', ok: true, message: workspaceRoot });
+    let config = {};
+    try {
+        config = await loadFabricHarnessConfig({ workspaceRoot });
+        const configuredTarget = target ?? config.run?.target ?? 'node';
+        checks.push({ name: 'run-target', ok: true, message: configuredTarget });
+        const doctorModel = model ?? process.env.FABRIC_MODEL ?? config.run?.model ?? config.agent?.model;
+        const resolved = resolveModelProvider({ ...(doctorModel !== undefined ? { model: doctorModel } : {}), ...(config.agent?.providers !== undefined ? { providers: config.agent.providers } : {}) });
+        checks.push({ name: 'model', ok: Boolean(resolved.provider), message: resolved.provider ? `${resolved.providerName}/${resolved.modelId}` : 'model disabled' });
+        for (const warning of resolved.warnings)
+            checks.push({ name: 'model-warning', ok: true, message: warning });
+        if (live && resolved.provider) {
+            const response = await resolved.provider.generate({ ...(resolved.model !== undefined ? { model: resolved.model } : {}), messages: [{ role: 'user', content: 'Say exactly: fabric harness doctor ok' }] });
+            checks.push({ name: 'model-live', ok: Boolean(response.message?.content || response.toolCalls?.length), message: response.message?.content?.slice(0, 120) ?? `${response.toolCalls?.length ?? 0} tool calls` });
+        }
+    }
+    catch (error) {
+        checks.push({ name: 'model', ok: false, message: error instanceof Error ? error.message : String(error) });
+    }
+    try {
+        const store = await createConfiguredSessionStore({ workspaceRoot, ...(config.store ? { config: config.store } : {}), env: process.env });
+        await store.save({ id: 'doctor-write-test', createdAt: new Date().toISOString(), updatedAt: new Date().toISOString(), entries: [], events: [] });
+        const message = config.store?.backend ? config.store.backend : store instanceof FileSessionStore ? store.sessionsDir : 'default';
+        checks.push({ name: 'session-store', ok: true, message });
+    }
+    catch (error) {
+        checks.push({ name: 'session-store', ok: false, message: error instanceof Error ? error.message : String(error) });
+    }
+    if (checkTools) {
+        try {
+            const sandbox = new EmptySandboxEnv();
+            const schemas = toolsToModelSchemas(createBuiltinTools(sandbox));
+            for (const schema of schemas) {
+                const input = schema.inputSchema;
+                if (input?.type !== 'object' || typeof input.properties !== 'object' || input.properties === null)
+                    throw new Error(`Invalid schema for tool ${schema.name}`);
+            }
+            checks.push({ name: 'tools', ok: true, message: `${schemas.length} tool schemas valid` });
+        }
+        catch (error) {
+            checks.push({ name: 'tools', ok: false, message: error instanceof Error ? error.message : String(error) });
+        }
+    }
+    if ((target ?? config.run?.target) === 'temporal-worker') {
+        const address = process.env.FABRIC_TEMPORAL_ADDRESS ?? config.temporal?.address ?? 'localhost:7233';
+        const taskQueue = process.env.FABRIC_TEMPORAL_TASK_QUEUE ?? config.temporal?.taskQueue ?? 'fabric-harness';
+        checks.push({ name: 'temporal', ok: true, message: `configured address ${address}, taskQueue ${taskQueue}; start a worker/server for live validation` });
+    }
+    if (jsonOutput) {
+        printResult({ ok: checks.every((check) => check.ok), checks });
+        return;
+    }
+    for (const check of checks)
+        console.log(`${check.ok ? '✓' : '✗'} ${check.name}: ${check.message}`);
+    if (!checks.every((check) => check.ok))
+        process.exitCode = 1;
+}
+async function agentsCommand(args) {
+    const jsonOutput = args.includes('--json');
+    const unknown = args.find((arg) => arg !== '--json');
+    if (unknown)
+        throw new Error(`Unknown argument: ${unknown}`);
+    const workspaceRoot = await findWorkspaceRoot();
+    const agents = await listAgentSummaries(workspaceRoot);
+    if (jsonOutput) {
+        printResult({ agents });
+        return;
+    }
+    if (agents.length === 0) {
+        console.log('No agents found.');
+        return;
+    }
+    for (const item of agents)
+        console.log(`${item.name.padEnd(20)} ${item.description ?? ''}`.trimEnd());
+}
+async function describeCommand(args) {
+    const [agentName, ...rest] = args;
+    if (!agentName || agentName.startsWith('-'))
+        throw new Error('Missing required <agent> argument for describe.');
+    const jsonOutput = rest.includes('--json');
+    const unknown = rest.find((arg) => arg !== '--json');
+    if (unknown)
+        throw new Error(`Unknown argument: ${unknown}`);
+    const workspaceRoot = await findWorkspaceRoot();
+    const agentPath = await resolveAgentPath(workspaceRoot, agentName);
+    const description = await describeAgentFile({ workspaceRoot, agentPath });
+    if (jsonOutput) {
+        printResult(description);
+        return;
+    }
+    console.log(`Agent: ${description.name}`);
+    console.log(`Path:  ${path.relative(workspaceRoot, description.path)}`);
+    if (description.description)
+        console.log(`Description: ${description.description}`);
+    if (description.model)
+        console.log(`Default model: ${description.model}`);
+    if (description.target)
+        console.log(`Default target: ${description.target}`);
+    console.log('');
+    console.log('Input:');
+    printSchema(description.inputSchema, '  ');
+    console.log('');
+    console.log('Output:');
+    printSchema(description.outputSchema, '  ');
+    console.log('');
+    console.log('Examples:');
+    const input = description.inputSchema;
+    const firstField = input?.type === 'object' ? Object.keys(input.properties ?? {})[0] : undefined;
+    if (firstField)
+        console.log(`  fabric-harness run ${agentName} --${firstField} "..."`);
+    console.log(`  fabric-harness run ${agentName} --payload '{"${firstField ?? 'input'}":"..."}'`);
+}
+function printSchema(value, indent) {
+    if (!value) {
+        console.log(`${indent}unknown`);
+        return;
+    }
+    const schema = value;
+    if (schema.type === 'object') {
+        const required = new Set(schema.required ?? []);
+        const properties = schema.properties ?? {};
+        if (Object.keys(properties).length === 0) {
+            console.log(`${indent}object`);
+            return;
+        }
+        for (const [key, property] of Object.entries(properties)) {
+            const field = property;
+            const req = required.has(key) ? 'required' : 'optional';
+            const enumText = field.enum ? ` enum=${field.enum.join('|')}` : '';
+            const desc = field.description ? ` - ${field.description}` : '';
+            console.log(`${indent}${key.padEnd(16)} ${(field.type ?? 'unknown').padEnd(8)} ${req}${enumText}${desc}`);
+        }
+        return;
+    }
+    const enumText = schema.enum ? ` enum=${schema.enum.join('|')}` : '';
+    const desc = schema.description ? ` - ${schema.description}` : '';
+    console.log(`${indent}${schema.type ?? 'unknown'}${enumText}${desc}`);
+}
+async function sessionsCommand(args) {
+    if (args.length > 0)
+        throw new Error(`Unknown argument: ${args[0]}`);
+    const workspaceRoot = await findWorkspaceRoot();
+    const config = await loadFabricHarnessConfig({ workspaceRoot });
+    const store = await createConfiguredSessionStore({ workspaceRoot, ...(config.store ? { config: config.store } : {}), env: process.env });
+    const sessions = await listSessionSummariesFromStore(store);
+    if (sessions.length === 0) {
+        console.log('No sessions found.');
+        return;
+    }
+    for (const session of sessions) {
+        const agent = session.agentId ? ` agent=${session.agentId}` : '';
+        const error = session.latestError ? ` error=${session.latestError}` : '';
+        console.log(`${session.updatedAt}  ${session.id}${agent} entries=${session.entries} events=${session.events} approvals=${session.pendingApprovals}/${session.terminalApprovals}${error}`);
+    }
+}
+async function loadConfiguredStoreForWorkspace() {
+    const workspaceRoot = await findWorkspaceRoot();
+    const config = await loadFabricHarnessConfig({ workspaceRoot });
+    const store = await createConfiguredSessionStore({ workspaceRoot, ...(config.store ? { config: config.store } : {}), env: process.env });
+    return { workspaceRoot, config, store };
+}
+async function buildsCommand(args) {
+    if (args.length > 0)
+        throw new Error(`Unknown argument: ${args[0]}`);
+    const workspaceRoot = await findWorkspaceRoot();
+    const builds = await listBuilds(workspaceRoot);
+    if (builds.length === 0) {
+        console.log('No builds found.');
+        return;
+    }
+    for (const build of builds) {
+        const entrypoint = build.entrypoint ? ` entry=${build.entrypoint}` : '';
+        console.log(`${build.createdAt}  ${build.target}${entrypoint} agents=${build.agents} roles=${build.roles} skills=${build.skills} files=${build.files}`);
+    }
+}
+async function approvalsCommand(args) {
+    const [sessionId, ...rest] = args;
+    if (!sessionId || sessionId.startsWith('-'))
+        throw new Error('Missing required <session-id> argument for approvals.');
+    const pendingOnly = rest.includes('--pending');
+    const stateView = rest.includes('--state');
+    const unknown = rest.find((arg) => arg !== '--pending' && arg !== '--state');
+    if (unknown)
+        throw new Error(`Unknown argument: ${unknown}`);
+    const { store } = await loadConfiguredStoreForWorkspace();
+    if (stateView) {
+        const states = (await listApprovalStatesFromStore(store, sessionId)).filter((approval) => !pendingOnly || approval.status === 'pending');
+        if (states.length === 0) {
+            console.log(`No approvals found for session ${sessionId}.`);
+            return;
+        }
+        for (const state of states) {
+            const actors = state.votes.map((vote) => `${typeof vote.actor === 'string' ? vote.actor : vote.actor.id}:${vote.decision}`).join(',') || 'none';
+            const resolved = state.resolvedAt ? ` resolved=${state.resolvedAt}` : '';
+            console.log(`${state.status}  ${state.id}  approvals=${state.approvedCount}/${state.requiredApprovals} denials=${state.deniedCount} votes=${actors}${resolved} subject=${state.request.subject}`);
+        }
+        return;
+    }
+    const approvals = (await listApprovalsFromStore(store, sessionId)).filter((approval) => !pendingOnly || approval.status === 'pending');
+    if (approvals.length === 0) {
+        console.log(`No approvals found for session ${sessionId}.`);
+        return;
+    }
+    for (const approval of approvals) {
+        const resolved = approval.resolvedAt ? ` resolved=${approval.resolvedAt}` : '';
+        const risk = approval.risk ? ` risk=${approval.risk}` : '';
+        const pattern = approval.matchedPattern ? ` pattern=${approval.matchedPattern}` : '';
+        const env = approval.envKeys?.length ? ` env=${approval.envKeys.join(',')}` : '';
+        const paths = approval.affectedPaths?.length ? ` paths=${approval.affectedPaths.join(',')}` : '';
+        console.log(`${approval.requestedAt}  ${approval.status}  ${approval.id}  ${approval.kind}:${approval.subject}${risk}${pattern}${env}${paths}${resolved} reason=${approval.reason}`);
+    }
+}
+async function resolveApprovalCommand(args, decision) {
+    const [sessionId, approvalId, ...rest] = args;
+    if (!sessionId || sessionId.startsWith('-'))
+        throw new Error(`Missing required <session-id> argument for ${decision}.`);
+    if (!approvalId || approvalId.startsWith('-'))
+        throw new Error(`Missing required <approval-id> argument for ${decision}.`);
+    let reason;
+    let actor = 'cli';
+    for (let index = 0; index < rest.length; index += 1) {
+        const arg = rest[index];
+        if (arg === '--reason') {
+            reason = rest[++index];
+            continue;
+        }
+        if (arg === '--actor') {
+            actor = rest[++index] ?? actor;
+            continue;
+        }
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+    const { workspaceRoot, store } = await loadConfiguredStoreForWorkspace();
+    const resolved = await resolveApprovalInStore(store, sessionId, approvalId, decision, reason, actor);
+    await signalTemporalApprovalIfNeeded(workspaceRoot, sessionId, resolved, decision, reason);
+    printResult(resolved);
+}
+async function signalTemporalApprovalIfNeeded(workspaceRoot, sessionId, approval, decision, reason) {
+    if (!approval.workflowId || (approval.status !== 'approved' && approval.status !== 'denied'))
+        return;
+    const config = await loadFabricHarnessConfig({ workspaceRoot });
+    try {
+        const namespace = process.env.FABRIC_TEMPORAL_NAMESPACE ?? config.temporal?.namespace;
+        const client = await createTemporalClient({
+            mode: 'temporal',
+            address: process.env.FABRIC_TEMPORAL_ADDRESS ?? config.temporal?.address ?? 'localhost:7233',
+            taskQueue: process.env.FABRIC_TEMPORAL_TASK_QUEUE ?? config.temporal?.taskQueue ?? 'fabric-harness',
+            ...(namespace ? { namespace } : {}),
+            ...(config.temporal?.apiKey ? { apiKey: config.temporal.apiKey } : {}),
+            ...(config.temporal?.apiKeyEnv ? { apiKeyEnv: config.temporal.apiKeyEnv } : {}),
+            ...(config.temporal?.tls ? { tls: config.temporal.tls } : {}),
+        });
+        try {
+            await client.signalWorkflowApproval(approval.workflowId, { approvalId: approval.id, decision, ...(reason ?? approval.resolutionReason ? { reason: reason ?? approval.resolutionReason } : {}) });
+            console.error(`Signaled Temporal workflow ${approval.workflowId} for approval ${approval.id}.`);
+        }
+        finally {
+            await client.close();
+        }
+    }
+    catch (error) {
+        console.warn(`Warning: approval ${approval.id} was recorded but Temporal workflow ${approval.workflowId} was not signaled: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+async function checkpointsCommand(args) {
+    const [sessionId, ...rest] = args;
+    if (!sessionId || sessionId.startsWith('-'))
+        throw new Error('Missing required <session-id> argument for checkpoints.');
+    if (rest.length > 0)
+        throw new Error(`Unknown argument: ${rest[0]}`);
+    const { store } = await loadConfiguredStoreForWorkspace();
+    const checkpoints = await listCheckpointsFromStore(store, sessionId);
+    if (checkpoints.length === 0) {
+        console.log(`No checkpoints found for session ${sessionId}.`);
+        return;
+    }
+    for (const checkpoint of checkpoints) {
+        const snapshot = checkpoint.snapshotId ? ` snapshot=${checkpoint.snapshotId}` : '';
+        console.log(`${checkpoint.timestamp}  ${checkpoint.label}  entry=${checkpoint.entryId}${snapshot} restored=${checkpoint.restoredCount}`);
+    }
+}
+async function compactCommand(args) {
+    const [sessionId, ...rest] = args;
+    if (!sessionId || sessionId.startsWith('-'))
+        throw new Error('Missing required <session-id> argument for compact.');
+    let keepRecentEntries;
+    let summary;
+    for (let index = 0; index < rest.length; index += 1) {
+        const arg = rest[index];
+        if (arg === '--keep') {
+            const value = rest[++index];
+            keepRecentEntries = value ? Number(value) : undefined;
+            continue;
+        }
+        if (arg === '--summary') {
+            summary = rest[++index];
+            continue;
+        }
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+    const { store } = await loadConfiguredStoreForWorkspace();
+    const options = {};
+    if (keepRecentEntries !== undefined)
+        options.keepRecentEntries = keepRecentEntries;
+    if (summary !== undefined)
+        options.summary = summary;
+    printResult(await compactSessionInStore(store, sessionId, options));
+}
+async function logsCommand(args) {
+    const [sessionId, ...rest] = args;
+    if (!sessionId || sessionId.startsWith('-'))
+        throw new Error('Missing required <session-id> argument for logs.');
+    const showEvents = rest.includes('--events');
+    const unknown = rest.find((arg) => arg !== '--events');
+    if (unknown)
+        throw new Error(`Unknown argument: ${unknown}`);
+    const { store } = await loadConfiguredStoreForWorkspace();
+    const data = await inspectSessionFromStore(store, sessionId);
+    if (!data)
+        throw new Error(`Session not found: ${sessionId}`);
+    console.log(`Session ${data.id}`);
+    console.log(`Created: ${data.createdAt}`);
+    console.log(`Updated: ${data.updatedAt}`);
+    if (data.agentId)
+        console.log(`Agent:   ${data.agentId}`);
+    console.log('');
+    const entries = showEvents ? data.events ?? [] : data.entries ?? [];
+    if (entries.length === 0) {
+        console.log(showEvents ? 'No events.' : 'No structured entries.');
+        return;
+    }
+    for (const item of entries) {
+        const timestamp = 'timestamp' in item ? item.timestamp : '';
+        const type = 'type' in item ? item.type : 'unknown';
+        const dataText = 'data' in item && item.data !== undefined ? ` ${formatInline(item.data)}` : '';
+        console.log(`${timestamp}  ${type}${dataText}`);
+    }
+}
+async function artifactsCommand(args) {
+    const [sessionId, ...rest] = args;
+    if (!sessionId || sessionId.startsWith('-'))
+        throw new Error('Missing required <session-id> argument for artifacts.');
+    const json = rest.includes('--json');
+    const unknown = rest.find((arg) => arg !== '--json');
+    if (unknown)
+        throw new Error(`Unknown argument: ${unknown}`);
+    const { store } = await loadConfiguredStoreForWorkspace();
+    const artifacts = await (store.listArtifacts?.(sessionId) ?? Promise.resolve([]));
+    if (json)
+        return printResult(artifacts);
+    if (artifacts.length === 0) {
+        console.log(`No artifacts found for session ${sessionId}.`);
+        return;
+    }
+    for (const artifact of artifacts)
+        console.log(`${artifact.id}  ${artifact.name}  ${artifact.size} bytes  ${artifact.contentType ?? 'application/octet-stream'}`);
+}
+async function artifactCommand(args) {
+    const [subcommand, sessionId, artifactIdOrName, ...rest] = args;
+    if (subcommand !== 'get')
+        throw new Error('Usage: fabric-harness artifact get <session-id> <artifact-id-or-name> [--out <path>]');
+    if (!sessionId || !artifactIdOrName)
+        throw new Error('Usage: fabric-harness artifact get <session-id> <artifact-id-or-name> [--out <path>]');
+    let out;
+    for (let index = 0; index < rest.length; index += 1) {
+        const arg = rest[index];
+        if (arg === '--out') {
+            out = rest[++index];
+            continue;
+        }
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+    const { store } = await loadConfiguredStoreForWorkspace();
+    const artifact = await store.getArtifact?.(sessionId, artifactIdOrName);
+    if (!artifact)
+        throw new Error(`Artifact not found: ${artifactIdOrName}`);
+    if (out) {
+        const outPath = path.resolve(process.cwd(), out);
+        await fs.mkdir(path.dirname(outPath), { recursive: true });
+        await fs.writeFile(outPath, artifact.content);
+        console.log(outPath);
+        return;
+    }
+    process.stdout.write(Buffer.from(artifact.content));
+}
+async function metricsCommand(args) {
+    const [sessionId, ...rest] = args;
+    if (!sessionId || sessionId.startsWith('-'))
+        throw new Error('Missing required <session-id> argument for metrics.');
+    const json = rest.includes('--json');
+    const unknown = rest.find((arg) => arg !== '--json');
+    if (unknown)
+        throw new Error(`Unknown argument: ${unknown}`);
+    const { store } = await loadConfiguredStoreForWorkspace();
+    const metrics = await getMetricsFromStore(store, sessionId);
+    if (!metrics)
+        throw new Error(`Session not found: ${sessionId}`);
+    if (json)
+        return printResult(metrics);
+    console.log(`Session ${metrics.sessionId}`);
+    console.log(`Model attempts: ${metrics.modelAttempts}`);
+    console.log(`Tokens: input=${metrics.inputTokens} output=${metrics.outputTokens} total=${metrics.totalTokens}`);
+    if (metrics.costUsd !== undefined)
+        console.log(`Cost: $${metrics.costUsd.toFixed(6)}`);
+    console.log(`Tools: calls=${metrics.toolCalls} durationMs=${metrics.toolDurationMs}`);
+    console.log(`Shell: commands=${metrics.shellCommands} durationMs=${metrics.shellDurationMs}`);
+    console.log(`Artifacts: ${metrics.artifacts}`);
+}
+async function tasksCommand(args) {
+    const [sessionId, ...rest] = args;
+    if (!sessionId || sessionId.startsWith('-'))
+        throw new Error('Missing required <session-id> argument for tasks.');
+    const json = rest.includes('--json');
+    const unknown = rest.find((arg) => arg !== '--json');
+    if (unknown)
+        throw new Error(`Unknown argument: ${unknown}`);
+    const { store } = await loadConfiguredStoreForWorkspace();
+    const tasks = await listTasksFromStore(store, sessionId);
+    if (json)
+        return printResult(tasks);
+    if (tasks.length === 0) {
+        console.log(`No tasks found for session ${sessionId}.`);
+        return;
+    }
+    for (const task of tasks) {
+        const checkpointText = task.checkpoints.length ? ` checkpoints=${task.checkpoints.length}` : '';
+        const errorText = task.error ? ` error=${truncateInline(task.error)}` : '';
+        console.log(`${task.id}  ${task.status}  started=${task.startedAt} updated=${task.updatedAt}${checkpointText}${errorText}`);
+        if (task.text)
+            console.log(`  ${truncateInline(task.text)}`);
+    }
+}
+async function taskCommand(args) {
+    const [sessionId, taskId, ...rest] = args;
+    if (!sessionId || sessionId.startsWith('-'))
+        throw new Error('Missing required <session-id> argument for task.');
+    if (!taskId || taskId.startsWith('-'))
+        throw new Error('Missing required <task-id> argument for task.');
+    const json = rest.includes('--json');
+    const unknown = rest.find((arg) => arg !== '--json');
+    if (unknown)
+        throw new Error(`Unknown argument: ${unknown}`);
+    const { store } = await loadConfiguredStoreForWorkspace();
+    const task = await getTaskFromStore(store, sessionId, taskId);
+    if (!task)
+        throw new Error(`Task not found: ${taskId}`);
+    if (json)
+        return printResult(task);
+    console.log(`Task ${task.id}`);
+    console.log(`Session: ${task.sessionId}`);
+    console.log(`Status:  ${task.status}`);
+    console.log(`Started: ${task.startedAt}`);
+    console.log(`Updated: ${task.updatedAt}`);
+    if (task.completedAt)
+        console.log(`Done:    ${task.completedAt}`);
+    if (task.failedAt)
+        console.log(`Failed:  ${task.failedAt}`);
+    if (task.cancelledAt)
+        console.log(`Cancel:  ${task.cancelledAt}`);
+    if (task.agent)
+        console.log(`Agent:   ${task.agent}`);
+    if (task.error)
+        console.log(`Error:   ${task.error}`);
+    if (task.text)
+        console.log(`Text:    ${task.text}`);
+    if (task.checkpoints.length) {
+        console.log('Checkpoints:');
+        for (const checkpoint of task.checkpoints)
+            console.log(`  ${checkpoint.timestamp} ${checkpoint.phase ?? 'checkpoint'} ${checkpoint.checkpointId ?? checkpoint.entryId}`);
+    }
+}
+async function cancelTaskCommand(args) {
+    const [sessionId, taskId, ...rest] = args;
+    if (!sessionId || sessionId.startsWith('-'))
+        throw new Error('Missing required <session-id> argument for cancel-task.');
+    if (!taskId || taskId.startsWith('-'))
+        throw new Error('Missing required <task-id> argument for cancel-task.');
+    let actor = 'cli';
+    let reason;
+    for (let index = 0; index < rest.length; index += 1) {
+        const arg = rest[index];
+        if (arg === '--actor') {
+            actor = rest[++index] ?? actor;
+            continue;
+        }
+        if (arg === '--reason') {
+            reason = rest[++index];
+            continue;
+        }
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+    const { store } = await loadConfiguredStoreForWorkspace();
+    const task = await cancelTaskInStore(store, sessionId, taskId, reason, actor);
+    console.log(`Task ${task.id} cancelled.`);
+}
+function truncateInline(text) {
+    return text.length > 160 ? `${text.slice(0, 157)}...` : text;
+}
+function formatInline(value) {
+    const text = JSON.stringify(value);
+    if (!text)
+        return '';
+    return text.length > 240 ? `${text.slice(0, 237)}...` : text;
+}
+async function main(argv) {
+    const [command, ...args] = argv;
+    if (!command || command === '--help' || command === '-h') {
+        console.log(HELP);
+        return;
+    }
+    await loadAutoEnvFiles();
+    if (command === 'run')
+        return runCommand(args);
+    if (command === 'agents')
+        return agentsCommand(args);
+    if (command === 'describe')
+        return describeCommand(args);
+    if (command === 'build')
+        return buildCommand(args);
+    if (command === 'sessions')
+        return sessionsCommand(args);
+    if (command === 'builds')
+        return buildsCommand(args);
+    if (command === 'verify-attestation')
+        return verifyCommand(args, 'attestation');
+    if (command === 'verify-provenance')
+        return verifyCommand(args, 'provenance');
+    if (command === 'doctor')
+        return doctorCommand(args);
+    if (command === 'add')
+        return addCommand(args);
+    if (command === 'inspect')
+        return inspectCommand(args);
+    if (command === 'logs')
+        return logsCommand(args);
+    if (command === 'checkpoints')
+        return checkpointsCommand(args);
+    if (command === 'artifacts')
+        return artifactsCommand(args);
+    if (command === 'artifact')
+        return artifactCommand(args);
+    if (command === 'metrics')
+        return metricsCommand(args);
+    if (command === 'tasks')
+        return tasksCommand(args);
+    if (command === 'task')
+        return taskCommand(args);
+    if (command === 'cancel-task')
+        return cancelTaskCommand(args);
+    if (command === 'compact')
+        return compactCommand(args);
+    if (command === 'replay')
+        return replayCommand(args);
+    if (command === 'approvals')
+        return approvalsCommand(args);
+    if (command === 'approve')
+        return resolveApprovalCommand(args, 'approved');
+    if (command === 'reject')
+        return resolveApprovalCommand(args, 'denied');
+    if (command === 'dev')
+        return devCommand(args);
+    if (command === 'temporal-worker')
+        return temporalWorkerCommand(args);
+    throw new Error(`Unknown command: ${command}`);
+}
+try {
+    await main(process.argv.slice(2));
+}
+catch (error) {
+    const message = error instanceof SchemaValidationError ? `Invalid payload or result:\n${error.issues.map((issue) => `- ${issue.path}: ${issue.message}`).join('\n')}` : error instanceof Error ? error.message : String(error);
+    console.error(`fabric-harness: ${message}`);
+    console.error('Run fabric-harness --help for usage.');
+    process.exit(1);
+}
+//# sourceMappingURL=fabric-harness.js.map