@fml-inc/fml 0.0.22

package/dist/cli.js

@@ -0,0 +1,1720 @@
+#!/usr/bin/env node
+import {
+  createApiClient,
+  ensureNativeModules,
+  getAuthenticatedClient
+} from "./chunk-MYCITM37.js";
+import {
+  AUTH_STORE_PATH,
+  CONVEX_URL,
+  DEFAULT_PROD_URL,
+  DEFAULT_TARGET_NAME,
+  Sentry,
+  WORKOS_API_URL,
+  WORKOS_AUTH_URL,
+  getActiveEnv,
+  getSelectedOrg,
+  getValidToken,
+  initSentry,
+  readTokens,
+  setSelectedOrg,
+  writeEnvConfig,
+  writeTokens
+} from "./chunk-DP2ILCME.js";
+import {
+  handleStart,
+  handleStop,
+  panopticonExec,
+  parsePanopticonRunning
+} from "./chunk-EL2WSQBR.js";
+import {
+  FML_DATA_DIR,
+  FML_LOG_DIR
+} from "./chunk-4YEAQJPF.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/cli.ts
+import { Command } from "commander";
+
+// src/commands/doctor.ts
+import ora from "ora";
+import pc from "picocolors";
+import { loadSyncConfig } from "@fml-inc/panopticon/sync";
+import { syncPending } from "@fml-inc/panopticon/api";
+function reportResult(result, spinner) {
+  const text = `${result.label} \u2014 ${result.detail}`;
+  if (spinner) {
+    switch (result.status) {
+      case "ok":
+        spinner.succeed(text);
+        break;
+      case "warn":
+        spinner.warn(text);
+        break;
+      case "fail":
+        spinner.fail(text);
+        break;
+    }
+  } else {
+    const icon = result.status === "ok" ? pc.green("\u2713") : result.status === "warn" ? pc.yellow("!") : pc.red("\u2717");
+    console.log(`  ${icon}  ${result.label} \u2014 ${result.detail}`);
+  }
+}
+async function handleDoctor(opts) {
+  const isTTY = !opts.json && process.stdout.isTTY === true;
+  const checks = [];
+  function startSpinner(label) {
+    if (!isTTY) return null;
+    return ora({ text: `Checking ${label}...`, indent: 2 }).start();
+  }
+  function pushAndReport(result, spinner) {
+    checks.push(result);
+    if (!opts.json) {
+      reportResult(result, spinner);
+    }
+  }
+  if (!opts.json && !isTTY) {
+    console.log("");
+  }
+  let token = null;
+  {
+    const spinner = startSpinner("auth");
+    token = await getValidToken();
+    if (token) {
+      const stored = readTokens();
+      const detail = stored?.user?.email ? `Logged in as ${stored.user.email}` : "Token present";
+      pushAndReport({ label: "Auth", status: "ok", detail }, spinner);
+    } else {
+      pushAndReport(
+        {
+          label: "Auth",
+          status: "fail",
+          detail: "No token. Run `fml login`"
+        },
+        spinner
+      );
+    }
+  }
+  {
+    const spinner = startSpinner("panopticon");
+    try {
+      const { doctor } = await import("@fml-inc/panopticon/doctor");
+      const result = await doctor();
+      if (spinner) spinner.stop();
+      for (const check of result.checks) {
+        pushAndReport(check, null);
+      }
+    } catch {
+      const result = panopticonExec("status");
+      if (result.ok) {
+        pushAndReport(
+          { label: "Panopticon", status: "ok", detail: "Available" },
+          spinner
+        );
+      } else {
+        pushAndReport(
+          {
+            label: "Panopticon",
+            status: "fail",
+            detail: "Not found. Run `fml install`"
+          },
+          spinner
+        );
+      }
+    }
+  }
+  if (token) {
+    const spinner = startSpinner("sync");
+    try {
+      const syncConfig = loadSyncConfig();
+      const targets = syncConfig.targets;
+      if (targets.length === 0) {
+        pushAndReport(
+          {
+            label: "Sync",
+            status: "warn",
+            detail: "No sync targets configured"
+          },
+          spinner
+        );
+      } else {
+        if (spinner) spinner.stop();
+        for (const target of targets) {
+          try {
+            const result = await syncPending(target.name);
+            if (result.totalPending === 0) {
+              pushAndReport(
+                {
+                  label: `Sync \u2192 ${target.name}`,
+                  status: "ok",
+                  detail: "Up to date"
+                },
+                null
+              );
+            } else {
+              const parts2 = Object.entries(result.tables).sort(([, a], [, b]) => b.pending - a.pending).slice(0, 3).map(([t, v]) => `${v.pending} ${t}`);
+              const detail = parts2.length < Object.keys(result.tables).length ? `${result.totalPending} pending (${parts2.join(", ")}, ...)` : `${result.totalPending} pending (${parts2.join(", ")})`;
+              pushAndReport(
+                {
+                  label: `Sync \u2192 ${target.name}`,
+                  status: result.totalPending > 1e3 ? "warn" : "ok",
+                  detail
+                },
+                null
+              );
+            }
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            pushAndReport(
+              {
+                label: `Sync \u2192 ${target.name}`,
+                status: "warn",
+                detail: `Could not query watermarks (${msg})`
+              },
+              null
+            );
+          }
+        }
+      }
+    } catch (err) {
+      pushAndReport(
+        {
+          label: "Sync",
+          status: "warn",
+          detail: err instanceof Error ? err.message : "Check failed"
+        },
+        spinner
+      );
+    }
+  }
+  {
+    const spinner = startSpinner("panopticon daemon");
+    const isRunning = parsePanopticonRunning();
+    if (isRunning) {
+      pushAndReport(
+        {
+          label: "Panopticon daemon",
+          status: "ok",
+          detail: "running"
+        },
+        spinner
+      );
+    } else {
+      pushAndReport(
+        {
+          label: "Panopticon daemon",
+          status: "warn",
+          detail: "Not running. Run `fml start`"
+        },
+        spinner
+      );
+    }
+  }
+  {
+    const spinner = startSpinner("API");
+    if (token) {
+      try {
+        const result = await createApiClient(token).callBackend("ping", {});
+        if (result.ok) {
+          pushAndReport(
+            {
+              label: "API",
+              status: "ok",
+              detail: `Reachable at ${CONVEX_URL}`
+            },
+            spinner
+          );
+        } else {
+          pushAndReport(
+            {
+              label: "API",
+              status: "ok",
+              detail: `Reachable at ${CONVEX_URL}`
+            },
+            spinner
+          );
+        }
+      } catch (err) {
+        pushAndReport(
+          {
+            label: "API",
+            status: "fail",
+            detail: err instanceof Error ? err.message : "Unreachable"
+          },
+          spinner
+        );
+      }
+    } else {
+      pushAndReport(
+        { label: "API", status: "fail", detail: "Auth required" },
+        spinner
+      );
+    }
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(checks, null, 2));
+    return;
+  }
+  console.log("");
+  const passed = checks.filter((c) => c.status === "ok").length;
+  const failed = checks.filter((c) => c.status === "fail").length;
+  const warned = checks.filter((c) => c.status === "warn").length;
+  const parts = [];
+  if (passed > 0) parts.push(pc.green(`${passed} passed`));
+  if (warned > 0)
+    parts.push(pc.yellow(`${warned} warning${warned > 1 ? "s" : ""}`));
+  if (failed > 0) parts.push(pc.red(`${failed} failed`));
+  console.log(`  ${parts.join(", ")}`);
+  console.log("");
+}
+
+// src/commands/install.ts
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { fileURLToPath } from "url";
+import { addTarget, listTargets } from "@fml-inc/panopticon/sync";
+
+// src/banner.ts
+import pc2 from "picocolors";
+var LOGO_LINES = [
+  " \u2584\u2588\u2588\u2580   \u2588\u2588\u2584\u2588\u2588\u2584\u2588\u2588  \u2588\u2588",
+  " \u2588\u2588     \u2588\u2588 \u2588\u2588 \u2588\u2588  \u2588\u2588",
+  "\u2588\u2588\u2588\u2588\u2588   \u2588\u2588    \u2588\u2588  \u2588\u2588",
+  " \u2588\u2588     \u2588\u2588    \u2588\u2588  \u2588\u2588\u2588\u2588",
+  " \u2580\u2580     \u2580\u2580    \u2580\u2580  \u2580\u2580\u2580\u2580"
+];
+function printBanner() {
+  console.log("");
+  for (let i = 0; i < LOGO_LINES.length; i++) {
+    const color = i < 3 ? pc2.blue : pc2.cyan;
+    console.log("  " + color(LOGO_LINES[i]));
+  }
+  console.log("");
+}
+
+// src/sync/client.ts
+import { execSync } from "child_process";
+var TOKEN_TTL_MS = 5 * 60 * 1e3;
+var cachedGitHubToken = null;
+function resolveGitHubToken() {
+  if (cachedGitHubToken && Date.now() < cachedGitHubToken.expiresAt) {
+    return cachedGitHubToken.value;
+  }
+  const envToken = process.env.PANOPTICON_GITHUB_TOKEN;
+  if (envToken) {
+    cachedGitHubToken = {
+      value: envToken,
+      expiresAt: Date.now() + TOKEN_TTL_MS
+    };
+    return envToken;
+  }
+  try {
+    const token = execSync("gh auth token", {
+      encoding: "utf-8",
+      timeout: 5e3
+    }).trim();
+    if (token) {
+      cachedGitHubToken = {
+        value: token,
+        expiresAt: Date.now() + TOKEN_TTL_MS
+      };
+    }
+    return token || null;
+  } catch {
+    return null;
+  }
+}
+
+// src/commands/install.ts
+var CLAUDE_DIR = path.join(os.homedir(), ".claude");
+var CLAUDE_SETTINGS_PATH = path.join(CLAUDE_DIR, "settings.json");
+var MARKETPLACE_DIR = path.join(
+  os.homedir(),
+  ".local",
+  "share",
+  "claude-plugins"
+);
+function getPluginRoot() {
+  let dir = path.dirname(fileURLToPath(import.meta.url));
+  dir = path.resolve(dir, "..");
+  return dir;
+}
+function readJsonFile(filePath) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function writeJsonFile(filePath, data) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${JSON.stringify(data, null, 2)}
+`);
+}
+async function handleInstall() {
+  const pluginRoot = getPluginRoot();
+  console.log("Installing fml...\n");
+  console.log("[1/4] Running panopticon install...");
+  const result = panopticonExec("install", { timeout: 6e4 });
+  if (result.ok) {
+    for (const line of result.stdout.trim().split("\n")) {
+      console.log(`      ${line}`);
+    }
+  } else {
+    console.error("      panopticon install failed:");
+    for (const line of result.stdout.trim().split("\n")) {
+      console.error(`      ${line}`);
+    }
+  }
+  console.log();
+  console.log("[2/4] Creating fml directories...");
+  for (const dir of [FML_DATA_DIR, FML_LOG_DIR]) {
+    fs.mkdirSync(dir, { recursive: true });
+  }
+  console.log(`      ${FML_DATA_DIR}`);
+  console.log(`      ${FML_LOG_DIR}
+`);
+  console.log("[3/4] Setting up fml plugin...");
+  fs.mkdirSync(path.join(MARKETPLACE_DIR, ".claude-plugin"), {
+    recursive: true
+  });
+  const manifestPath = path.join(
+    MARKETPLACE_DIR,
+    ".claude-plugin",
+    "marketplace.json"
+  );
+  const manifest = readJsonFile(manifestPath) ?? {
+    name: "local-plugins",
+    owner: { name: os.userInfo().username },
+    plugins: []
+  };
+  const plugins = manifest.plugins ?? [];
+  if (!plugins.some((p) => p.name === "fml")) {
+    plugins.push({
+      name: "fml",
+      source: "./fml",
+      description: "FML agent tools for Claude Code"
+    });
+    manifest.plugins = plugins;
+  }
+  writeJsonFile(manifestPath, manifest);
+  const marketplaceLink = path.join(MARKETPLACE_DIR, "fml");
+  try {
+    fs.unlinkSync(marketplaceLink);
+  } catch {
+  }
+  fs.rmSync(marketplaceLink, { recursive: true, force: true });
+  fs.symlinkSync(pluginRoot, marketplaceLink, "dir");
+  console.log(`      Marketplace: ${MARKETPLACE_DIR}`);
+  console.log(`      Plugin: ${pluginRoot}`);
+  const settings = readJsonFile(CLAUDE_SETTINGS_PATH) ?? {};
+  settings.extraKnownMarketplaces = settings.extraKnownMarketplaces ?? {};
+  settings.extraKnownMarketplaces["local-plugins"] = {
+    source: { source: "directory", path: MARKETPLACE_DIR }
+  };
+  settings.enabledPlugins = settings.enabledPlugins ?? {};
+  settings.enabledPlugins["fml@local-plugins"] = true;
+  writeJsonFile(CLAUDE_SETTINGS_PATH, settings);
+  console.log(`      Claude settings: ${CLAUDE_SETTINGS_PATH}
+`);
+  console.log("[4/4] Configuring sync target...");
+  const prodSyncUrl = DEFAULT_PROD_URL.replace(".cloud", ".site");
+  const existingTargets = listTargets();
+  const existingProd = existingTargets.find((t) => t.url === prodSyncUrl);
+  if (existingProd) {
+    console.log(`      Production target already configured`);
+  } else {
+    const ghToken = resolveGitHubToken();
+    if (ghToken) {
+      addTarget({
+        name: DEFAULT_TARGET_NAME,
+        url: prodSyncUrl,
+        tokenCommand: "gh auth token"
+      });
+      console.log(`      Target "${DEFAULT_TARGET_NAME}": ${prodSyncUrl}`);
+      console.log("      Auth: gh auth token");
+    } else {
+      console.log(
+        "      Skipped (no GitHub token). Run `fml sync setup` later."
+      );
+    }
+  }
+  writeEnvConfig({ active: DEFAULT_TARGET_NAME });
+  console.log("");
+  printBanner();
+  console.log("Done! Start a new coding session to activate.\n");
+  console.log("\nNext steps:");
+  console.log("  fml login          Sign in to your FML account");
+  console.log("  fml org            Select organization");
+  console.log("  fml sync status    Check sync status");
+  console.log("  fml status         Verify setup");
+}
+
+// src/commands/uninstall.ts
+import fs2 from "fs";
+import os2 from "os";
+import path2 from "path";
+var CLAUDE_DIR2 = path2.join(os2.homedir(), ".claude");
+var CLAUDE_SETTINGS_PATH2 = path2.join(CLAUDE_DIR2, "settings.json");
+var MARKETPLACE_DIR2 = path2.join(
+  os2.homedir(),
+  ".local",
+  "share",
+  "claude-plugins"
+);
+function readJsonFile2(filePath) {
+  try {
+    return JSON.parse(fs2.readFileSync(filePath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function writeJsonFile2(filePath, data) {
+  fs2.writeFileSync(filePath, `${JSON.stringify(data, null, 2)}
+`);
+}
+function handleUninstall(opts) {
+  const targetSpecific = opts.target && opts.target !== "all";
+  console.log("Uninstalling fml...\n");
+  if (targetSpecific) {
+    console.log("[1/4] Skipping plugin settings (target-specific uninstall)");
+  } else {
+    console.log("[1/4] Removing plugin from Claude Code settings...");
+    const settings = readJsonFile2(CLAUDE_SETTINGS_PATH2);
+    if (settings) {
+      if (settings.enabledPlugins) {
+        delete settings.enabledPlugins["fml@local-plugins"];
+      }
+      if (settings.extraKnownMarketplaces) {
+        delete settings.extraKnownMarketplaces["local-plugins"];
+      }
+      writeJsonFile2(CLAUDE_SETTINGS_PATH2, settings);
+      console.log(`      Updated ${CLAUDE_SETTINGS_PATH2}`);
+    } else {
+      console.log("      No settings file found, skipping");
+    }
+  }
+  if (targetSpecific) {
+    console.log("[2/4] Skipping marketplace (target-specific uninstall)");
+  } else {
+    console.log("[2/4] Removing marketplace registration...");
+    const marketplaceLink = path2.join(MARKETPLACE_DIR2, "fml");
+    try {
+      fs2.rmSync(marketplaceLink, { recursive: true, force: true });
+      console.log(`      Removed ${marketplaceLink}`);
+    } catch {
+      console.log("      No marketplace link found, skipping");
+    }
+    const manifestPath = path2.join(
+      MARKETPLACE_DIR2,
+      ".claude-plugin",
+      "marketplace.json"
+    );
+    const manifest = readJsonFile2(manifestPath);
+    if (manifest && Array.isArray(manifest.plugins)) {
+      manifest.plugins = manifest.plugins.filter((p) => p.name !== "fml");
+      writeJsonFile2(manifestPath, manifest);
+      console.log(`      Updated ${manifestPath}`);
+    }
+  }
+  console.log("[3/4] Running panopticon uninstall...");
+  const panoArgs = ["uninstall"];
+  if (opts.target) panoArgs.push("--target", opts.target);
+  if (opts.purge) panoArgs.push("--purge");
+  const result = panopticonExec(...panoArgs, { timeout: 3e4 });
+  if (result.ok) {
+    for (const line of result.stdout.trim().split("\n")) {
+      console.log(`      ${line}`);
+    }
+  } else {
+    console.error("      panopticon uninstall failed:");
+    for (const line of result.stdout.trim().split("\n")) {
+      console.error(`      ${line}`);
+    }
+  }
+  if (targetSpecific) {
+    console.log("[4/4] Skipping data removal (target-specific uninstall)");
+  } else if (opts.purge) {
+    console.log("[4/4] Removing fml data and logs...");
+    for (const dir of [FML_DATA_DIR, FML_LOG_DIR]) {
+      try {
+        fs2.rmSync(dir, { recursive: true, force: true });
+        console.log(`      Removed ${dir}`);
+      } catch {
+        console.log(`      Could not remove ${dir}`);
+      }
+    }
+  } else {
+    console.log("[4/4] Keeping fml data (use --purge to remove)");
+  }
+  console.log("\nDone! FML has been uninstalled.");
+}
+
+// src/commands/update.ts
+import { execSync as execSync2 } from "child_process";
+async function handleUpdate() {
+  const currentVersion = true ? "0.0.0-dev+f2e63af1" : "unknown";
+  console.log(`Current: ${currentVersion}`);
+  console.log("Updating via npm...\n");
+  try {
+    const env = { ...process.env };
+    delete env.npm_config_registry;
+    execSync2("npm install -g @fml-inc/fml@latest", {
+      stdio: "inherit",
+      timeout: 12e4,
+      env
+    });
+    console.log("\nUpdated. Run `fml install --skip-build` to reconfigure.");
+  } catch (err) {
+    Sentry.captureException(err);
+    const msg = err instanceof Error ? err.stderr?.toString() ?? err.message : String(err);
+    console.error("Update failed:", msg);
+    process.exit(1);
+  }
+}
+
+// src/auth/oauth.ts
+import crypto from "crypto";
+import http from "http";
+async function fetchWorkosClientId() {
+  const { ConvexHttpClient } = await import("convex/browser");
+  const client = new ConvexHttpClient(CONVEX_URL);
+  const ref = "public_config:getAuthConfig";
+  const result = await client.query(ref, {});
+  return result.workosClientId;
+}
+async function login() {
+  const clientId = await fetchWorkosClientId();
+  const codeVerifier = crypto.randomBytes(32).toString("base64url");
+  const codeChallenge = crypto.createHash("sha256").update(codeVerifier).digest("base64url");
+  const state = crypto.randomBytes(16).toString("hex");
+  const { port, waitForCode, close } = await startCallbackServer(state);
+  const redirectUri = `http://localhost:${port}/callback`;
+  const authUrl = new URL(`${WORKOS_AUTH_URL}/user_management/authorize`);
+  authUrl.searchParams.set("client_id", clientId);
+  authUrl.searchParams.set("redirect_uri", redirectUri);
+  authUrl.searchParams.set("response_type", "code");
+  authUrl.searchParams.set("code_challenge", codeChallenge);
+  authUrl.searchParams.set("code_challenge_method", "S256");
+  authUrl.searchParams.set("provider", "authkit");
+  authUrl.searchParams.set("state", state);
+  const open = (await import("open")).default;
+  await open(authUrl.toString());
+  console.log("\nOpening browser for login...");
+  console.log(`If it doesn't open, visit: ${authUrl.toString()}
+`);
+  const code = await waitForCode();
+  close();
+  const tokenResponse = await fetch(
+    `${WORKOS_API_URL}/user_management/authenticate`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        grant_type: "authorization_code",
+        client_id: clientId,
+        code,
+        code_verifier: codeVerifier,
+        redirect_uri: redirectUri
+      })
+    }
+  );
+  if (!tokenResponse.ok) {
+    const error = await tokenResponse.text();
+    throw new Error(`Token exchange failed: ${error}`);
+  }
+  const data = await tokenResponse.json();
+  const userName = [data.user.first_name, data.user.last_name].filter(Boolean).join(" ");
+  writeTokens({
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresAt: Date.now() + (data.expires_in ?? 300) * 1e3,
+    user: {
+      id: data.user.id,
+      email: data.user.email,
+      name: userName
+    },
+    workosClientId: clientId
+  });
+  return { email: data.user.email, name: userName };
+}
+function startCallbackServer(expectedState) {
+  return new Promise((resolve, reject) => {
+    let resolveCode;
+    let rejectCode;
+    const codePromise = new Promise((res, rej) => {
+      resolveCode = res;
+      rejectCode = rej;
+    });
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url ?? "/", `http://localhost`);
+      if (url.pathname === "/callback") {
+        const code = url.searchParams.get("code");
+        const error = url.searchParams.get("error");
+        const returnedState = url.searchParams.get("state");
+        if (returnedState !== expectedState) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(
+            "<html><body><h1>Login failed</h1><p>Invalid state parameter. You can close this tab.</p></body></html>"
+          );
+          rejectCode(new Error("OAuth state mismatch \u2014 possible CSRF attack"));
+          return;
+        }
+        if (error) {
+          res.writeHead(200, { "Content-Type": "text/html" });
+          res.end(
+            "<html><body><h1>Login failed</h1><p>You can close this tab.</p></body></html>"
+          );
+          rejectCode(new Error(`OAuth error: ${error}`));
+          return;
+        }
+        if (code) {
+          res.writeHead(200, { "Content-Type": "text/html" });
+          res.end(
+            "<html><body><h1>Login successful!</h1><p>You can close this tab and return to the terminal.</p></body></html>"
+          );
+          resolveCode(code);
+          return;
+        }
+        res.writeHead(400);
+        res.end("Missing code parameter");
+        return;
+      }
+      res.writeHead(404);
+      res.end("Not found");
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      if (!addr || typeof addr === "string") {
+        reject(new Error("Failed to start callback server"));
+        return;
+      }
+      resolve({
+        port: addr.port,
+        waitForCode: () => codePromise,
+        close: () => server.close()
+      });
+    });
+    server.on("error", reject);
+    setTimeout(
+      () => {
+        rejectCode(new Error("Login timed out (5 minutes)"));
+        server.close();
+      },
+      5 * 60 * 1e3
+    );
+  });
+}
+
+// src/commands/login.ts
+async function linkGitHubIdentity() {
+  const token = resolveGitHubToken();
+  if (!token) {
+    console.warn("[fml] No GitHub token available \u2014 skipping identity link");
+    return;
+  }
+  try {
+    const response = await fetch("https://api.github.com/user", {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/vnd.github+json"
+      }
+    });
+    if (!response.ok) {
+      console.warn(
+        `[fml] GitHub API returned ${response.status} \u2014 skipping identity link`
+      );
+      return;
+    }
+    const user = await response.json();
+    const fmlToken = await getValidToken();
+    if (!fmlToken) {
+      console.warn("[fml] No FML token available \u2014 skipping identity link");
+      return;
+    }
+    if (!CONVEX_URL) {
+      console.warn(
+        "[fml] No Convex URL configured \u2014 skipping identity link (run fml install first)"
+      );
+      return;
+    }
+    const { ConvexHttpClient } = await import("convex/browser");
+    const client = new ConvexHttpClient(CONVEX_URL);
+    client.setAuth(fmlToken);
+    const ref = "user/panopticon:linkGitHubIdentity";
+    await client.mutation(ref, {
+      githubUsername: user.login,
+      githubId: user.id,
+      githubEmail: user.email ?? void 0
+    });
+    console.log(`Linked GitHub account: ${user.login}`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.warn(`[fml] Failed to link GitHub identity: ${msg}`);
+  }
+}
+async function selectOrg() {
+  try {
+    const token = await getValidToken();
+    if (!token) return;
+    const api = createApiClient(token);
+    const orgs = await api.queryOrgs();
+    if (orgs.length === 0) return;
+    const org = orgs[0];
+    const slug = org.slug ?? org.name;
+    setSelectedOrg(slug);
+    console.log(`Selected org: ${org.name} (${slug})`);
+  } catch {
+  }
+}
+async function handleLogin() {
+  const { name: envName } = getActiveEnv();
+  const existingToken = await getValidToken();
+  if (existingToken) {
+    const { readTokens: readTokens2 } = await import("./token-store-67FJZTYS.js");
+    const stored = readTokens2();
+    console.log(
+      `Already logged in as ${stored?.user.name} (${stored?.user.email}) on ${envName}.`
+    );
+    await linkGitHubIdentity();
+    await selectOrg();
+    console.log("You're all set! Restart Claude Code to use FML tools.");
+    process.exit(0);
+  }
+  console.log(`Signing in to FML (${envName})...`);
+  try {
+    const { email, name } = await login();
+    console.log(`
+Logged in as ${name} (${email})`);
+    await linkGitHubIdentity();
+    await selectOrg();
+    console.log("You're all set! Restart Claude Code to use FML tools.");
+    process.exit(0);
+  } catch (err) {
+    Sentry.captureException(err);
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`Login failed: ${msg}`);
+    process.exit(1);
+  }
+}
+
+// src/commands/logout.ts
+import fs3 from "fs";
+function handleLogout() {
+  try {
+    fs3.unlinkSync(AUTH_STORE_PATH);
+  } catch {
+  }
+  console.log("Logged out. Stored credentials cleared.");
+}
+
+// src/commands/org.ts
+async function handleOrg(slug) {
+  const token = await getValidToken();
+  if (!token) {
+    console.error("Not logged in. Run `fml login` first.");
+    process.exit(1);
+  }
+  const api = createApiClient(token);
+  const orgs = await api.queryOrgs();
+  if (orgs.length === 0) {
+    console.error("No organizations found.");
+    process.exit(1);
+  }
+  const current = getSelectedOrg();
+  if (!slug) {
+    console.log("Organizations:\n");
+    for (const org of orgs) {
+      const orgSlug = org.slug ?? org.name;
+      const marker = orgSlug === current ? " (selected)" : "";
+      console.log(`  ${orgSlug}${marker}`);
+    }
+    if (!current) {
+      console.log("\nNo org selected. Run `fml org <slug>` to select one.");
+    }
+    return;
+  }
+  const match = orgs.find(
+    (o) => (o.slug ?? o.name) === slug || o.name === slug
+  );
+  if (!match) {
+    console.error(
+      `Organization "${slug}" not found. Available: ${orgs.map((o) => o.slug ?? o.name).join(", ")}`
+    );
+    process.exit(1);
+  }
+  const matchSlug = match.slug ?? match.name;
+  setSelectedOrg(matchSlug);
+  console.log(`Selected org: ${match.name} (${matchSlug})`);
+}
+
+// src/commands/open.ts
+var APP_BASE_URL = "https://app.fml.app";
+async function handleOpen(opts) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login` first.");
+    process.exit(1);
+  }
+  let slug;
+  try {
+    const orgs = await api.queryOrgs();
+    if (orgs.length === 0) {
+      console.error("No organizations found.");
+      process.exit(1);
+    }
+    slug = orgs[0].slug ?? orgs[0].name;
+  } catch {
+    console.error("Could not fetch organizations. Opening base URL.");
+    slug = "";
+  }
+  const url = slug ? `${APP_BASE_URL}/${slug}` : APP_BASE_URL;
+  if (opts.json) {
+    console.log(JSON.stringify({ url }));
+  } else {
+    const openBrowser = (await import("open")).default;
+    await openBrowser(url);
+  }
+}
+
+// src/commands/status.ts
+async function handleStatus() {
+  const { name, convexUrl } = getActiveEnv();
+  console.log(`Environment: ${name}`);
+  console.log(`  Convex: ${convexUrl}
+`);
+  const tokens = readTokens();
+  if (!tokens) {
+    console.log("Not authenticated. Run `fml login` to sign in.");
+    return;
+  }
+  const tokenValid = await getValidToken();
+  console.log("Authentication:");
+  console.log(`  User:  ${tokens.user.name} (${tokens.user.email})`);
+  console.log(
+    `  Token: ${tokenValid ? "valid" : "expired (needs refresh/re-login)"}`
+  );
+  console.log(`  Org:   ${tokens.orgSlug ?? "(none \u2014 run `fml org <slug>`)"}`);
+}
+
+// src/commands/sync.ts
+import {
+  addTarget as addTarget2,
+  removeTarget,
+  listTargets as listTargets2,
+  loadSyncConfig as loadSyncConfig2,
+  saveSyncConfig
+} from "@fml-inc/panopticon/sync";
+import { syncPending as syncPending2, syncReset } from "@fml-inc/panopticon/api";
+var FML_SYNC_URL = CONVEX_URL.replace(".cloud", ".site");
+async function handleSyncSetup() {
+  console.log("FML Sync Setup\n");
+  const token = resolveGitHubToken();
+  if (!token) {
+    console.error(
+      "No GitHub token found. Set PANOPTICON_GITHUB_TOKEN or install gh CLI."
+    );
+    process.exit(1);
+  }
+  console.log("GitHub token: found");
+  addTarget2({
+    name: DEFAULT_TARGET_NAME,
+    url: FML_SYNC_URL,
+    tokenCommand: "gh auth token"
+  });
+  console.log(`
+Sync target "${DEFAULT_TARGET_NAME}" configured:`);
+  console.log(`  URL:  ${FML_SYNC_URL}`);
+  console.log(`  Auth: gh auth token (refreshed every 5 min)`);
+  console.log(`
+Restart panopticon to activate: fml stop && fml start`);
+}
+async function handleSyncList() {
+  const targets = listTargets2();
+  if (targets.length === 0) {
+    console.log(
+      "No sync targets configured. Run `fml sync setup` or `fml sync add`."
+    );
+    return;
+  }
+  console.log("Sync targets:\n");
+  for (const t of targets) {
+    const auth = t.token ? "static token" : t.tokenCommand ? `command: ${t.tokenCommand}` : "none";
+    console.log(`  ${t.name}`);
+    console.log(`    URL:  ${t.url}`);
+    console.log(`    Auth: ${auth}`);
+  }
+}
+async function handleSyncAdd(name, url, opts) {
+  const existing = listTargets2();
+  if (existing.some((t) => t.name === name)) {
+    console.error(
+      `Target "${name}" already exists. Use \`fml sync edit\` to modify it.`
+    );
+    process.exit(1);
+  }
+  addTarget2({
+    name,
+    url,
+    tokenCommand: opts.tokenCmd,
+    token: opts.token
+  });
+  console.log(`Sync target "${name}" added:`);
+  console.log(`  URL:  ${url}`);
+  if (opts.tokenCmd) console.log(`  Auth: command: ${opts.tokenCmd}`);
+  else if (opts.token) console.log("  Auth: static token");
+  else console.log("  Auth: none");
+  console.log("\nRestart panopticon to activate: fml stop && fml start");
+}
+async function handleSyncRemove(name) {
+  const removed = removeTarget(name);
+  if (removed) {
+    console.log(`Sync target "${name}" removed.`);
+    console.log("Restart panopticon to apply: fml stop && fml start");
+  } else {
+    console.error(`Target "${name}" not found.`);
+    process.exit(1);
+  }
+}
+async function handleSyncEdit(name, opts) {
+  const config2 = loadSyncConfig2();
+  const target = config2.targets.find((t) => t.name === name);
+  if (!target) {
+    console.error(`Target "${name}" not found.`);
+    process.exit(1);
+  }
+  if (opts.url) target.url = opts.url;
+  if (opts.tokenCmd) {
+    target.tokenCommand = opts.tokenCmd;
+    delete target.token;
+  }
+  if (opts.token) {
+    target.token = opts.token;
+    delete target.tokenCommand;
+  }
+  saveSyncConfig(config2);
+  console.log(`Sync target "${name}" updated:`);
+  console.log(`  URL:  ${target.url}`);
+  const auth = target.token ? "static token" : target.tokenCommand ? `command: ${target.tokenCommand}` : "none";
+  console.log(`  Auth: ${auth}`);
+  console.log("\nRestart panopticon to apply: fml stop && fml start");
+}
+async function handleSyncStatus() {
+  const targets = listTargets2();
+  if (targets.length === 0) {
+    console.log("No sync targets configured. Run `fml sync setup` first.");
+    return;
+  }
+  for (const target of targets) {
+    const auth = target.token ? "static token" : target.tokenCommand ? `command: ${target.tokenCommand}` : "none";
+    console.log(`${target.name}:`);
+    console.log(`  URL:  ${target.url}`);
+    console.log(`  Auth: ${auth}`);
+    try {
+      const result = await syncPending2(target.name);
+      if (result.totalPending === 0) {
+        console.log("  Status: up to date");
+      } else {
+        console.log(`  Pending: ${result.totalPending} total`);
+        for (const [table, info] of Object.entries(result.tables)) {
+          console.log(
+            `    ${table}: ${info.pending} pending (${info.synced} / ${info.total})`
+          );
+        }
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.log(`  Status: unavailable (${msg})`);
+    }
+    console.log();
+  }
+}
+async function handleSyncReset(targetName) {
+  await syncReset(targetName ?? DEFAULT_TARGET_NAME);
+  console.log(
+    `Sync watermarks for "${targetName ?? DEFAULT_TARGET_NAME}" reset to 0.`
+  );
+}
+
+// src/commands/env.ts
+import { listTargets as listTargets3 } from "@fml-inc/panopticon/sync";
+function handleEnvShow() {
+  const { name, convexUrl } = getActiveEnv();
+  console.log(`Environment: ${name}`);
+  console.log(`  Convex URL: ${convexUrl}`);
+}
+async function handleEnvSwitch(target) {
+  const targets = listTargets3();
+  const match = targets.find((t) => t.name === target);
+  if (!match) {
+    console.error(`Sync target "${target}" not found. Available targets:`);
+    for (const t of targets) {
+      console.error(`  ${t.name}  ${t.url}`);
+    }
+    console.error("\nAdd a target with `fml sync add`.");
+    process.exit(1);
+  }
+  writeEnvConfig({ active: target });
+  const convexUrl = match.url.replace(".convex.site", ".convex.cloud");
+  console.log(`Switched to ${target}: ${convexUrl}`);
+  console.log("\nRestarting daemons...");
+  handleStop();
+  await handleStart();
+  console.log(
+    "MCP server will pick up the change on next Claude Code session."
+  );
+}
+
+// src/commands/data.ts
+async function queryBackend(toolName, args) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login` to sign in.");
+    process.exit(1);
+  }
+  const result = await api.callBackend(toolName, args);
+  if (!result.ok) {
+    console.error(result.error ?? "Unknown error");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+async function handleActivity(opts) {
+  await queryBackend("get-engineering-activity", {
+    timeRange: opts.since ?? "24h"
+  });
+}
+async function handleSessions(opts) {
+  await queryBackend("list-engineering-sessions", {
+    timeRange: opts.since ?? "24h",
+    limit: opts.limit ? parseInt(opts.limit, 10) : void 0
+  });
+}
+async function handleTimeline(sessionId, opts) {
+  await queryBackend("get-session-timeline", {
+    sessionId,
+    limit: opts.limit ? parseInt(opts.limit, 10) : void 0,
+    offset: opts.offset ? parseInt(opts.offset, 10) : void 0
+  });
+}
+async function handleSpending(opts) {
+  await queryBackend("get-ai-spending", {
+    timeRange: opts.since ?? "7d",
+    groupBy: opts.groupBy
+  });
+}
+async function handleSearch(query, opts) {
+  await queryBackend("search-engineering-sessions", {
+    query,
+    timeRange: opts.since ?? "7d",
+    limit: opts.limit ? parseInt(opts.limit, 10) : void 0
+  });
+}
+
+// src/commands/query.ts
+var GENERIC_PROVIDERS = [
+  "sentry",
+  "slack",
+  "github",
+  "linear",
+  "notion",
+  "freshdesk"
+];
+var POSTHOG_ENDPOINTS = {
+  insights: "query-posthog-insights",
+  events: "query-posthog-events",
+  recordings: "query-posthog-recordings",
+  "feature-flags": "query-posthog-feature-flags",
+  experiments: "query-posthog-experiments",
+  surveys: "query-posthog-surveys",
+  hogql: "run-posthog-hogql",
+  cohorts: "query-posthog-cohorts"
+};
+var AMPLITUDE_ENDPOINTS = {
+  events: "query-amplitude-events",
+  funnel: "query-amplitude-funnel",
+  retention: "query-amplitude-retention",
+  chart: "get-amplitude-chart",
+  "list-events": "list-amplitude-events"
+};
+var META_ADS_ENDPOINTS = {
+  accounts: "list-meta-ad-accounts",
+  campaigns: "list-meta-campaigns",
+  insights: "get-meta-ad-insights",
+  "ad-sets": "list-meta-ad-sets"
+};
+function parseBody(body) {
+  if (!body) return {};
+  try {
+    return JSON.parse(body);
+  } catch {
+    console.error("Invalid JSON in --body argument.");
+    process.exit(1);
+  }
+}
+async function handleQuery(provider, endpoint, opts) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const parsedBody = parseBody(opts.body);
+  let toolName;
+  let args;
+  if (GENERIC_PROVIDERS.includes(provider)) {
+    toolName = `integration-${provider}`;
+    args = {
+      endpoint,
+      method: opts.method || "GET",
+      body: parsedBody,
+      projectId: opts.projectId
+    };
+  } else if (provider === "posthog") {
+    toolName = POSTHOG_ENDPOINTS[endpoint];
+    if (!toolName) {
+      console.error(
+        `Unknown posthog endpoint: ${endpoint}. Valid: ${Object.keys(POSTHOG_ENDPOINTS).join(", ")}`
+      );
+      process.exit(1);
+    }
+    args = { ...parsedBody };
+  } else if (provider === "amplitude") {
+    toolName = AMPLITUDE_ENDPOINTS[endpoint];
+    if (!toolName) {
+      console.error(
+        `Unknown amplitude endpoint: ${endpoint}. Valid: ${Object.keys(AMPLITUDE_ENDPOINTS).join(", ")}`
+      );
+      process.exit(1);
+    }
+    args = endpoint === "list-events" ? {} : { ...parsedBody };
+  } else if (provider === "meta-ads") {
+    toolName = META_ADS_ENDPOINTS[endpoint];
+    if (!toolName) {
+      console.error(
+        `Unknown meta-ads endpoint: ${endpoint}. Valid: ${Object.keys(META_ADS_ENDPOINTS).join(", ")}`
+      );
+      process.exit(1);
+    }
+    args = endpoint === "accounts" ? {} : { ...parsedBody };
+  } else {
+    console.error(
+      `Unknown provider: ${provider}. Valid: ${[...GENERIC_PROVIDERS, "posthog", "amplitude", "meta-ads"].join(", ")}`
+    );
+    process.exit(1);
+  }
+  const result = await api.callBackend(toolName, args);
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+
+// src/commands/automation.ts
+async function handleAutomationList() {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("list-automations", {});
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+async function handleAutomationCreate(opts) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("create-automation", {
+    name: opts.name,
+    prompt: opts.prompt,
+    frequency: opts.frequency,
+    hour: parseInt(opts.hour, 10),
+    minute: parseInt(opts.minute, 10),
+    timezone: opts.timezone,
+    dayOfWeek: opts.dayOfWeek ? parseInt(opts.dayOfWeek, 10) : void 0,
+    dayOfMonth: opts.dayOfMonth ? parseInt(opts.dayOfMonth, 10) : void 0,
+    maxRuns: opts.maxRuns ? parseInt(opts.maxRuns, 10) : void 0
+  });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+async function handleAutomationCreatePattern(opts) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("create-pattern-automation", {
+    name: opts.name,
+    prompt: opts.prompt
+  });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+async function handleAutomationUpdate(id, opts) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("update-automation", {
+    automationId: id,
+    name: opts.name,
+    prompt: opts.prompt,
+    enabled: opts.enabled !== void 0 ? (() => {
+      if (opts.enabled !== "true" && opts.enabled !== "false") {
+        console.error(
+          `Invalid --enabled value: "${opts.enabled}". Use "true" or "false".`
+        );
+        process.exit(1);
+      }
+      return opts.enabled === "true";
+    })() : void 0,
+    frequency: opts.frequency,
+    hour: opts.hour ? parseInt(opts.hour, 10) : void 0,
+    minute: opts.minute ? parseInt(opts.minute, 10) : void 0,
+    timezone: opts.timezone,
+    dayOfWeek: opts.dayOfWeek ? parseInt(opts.dayOfWeek, 10) : void 0,
+    dayOfMonth: opts.dayOfMonth ? parseInt(opts.dayOfMonth, 10) : void 0
+  });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+async function handleAutomationDelete(id) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("delete-automation", {
+    automationId: id
+  });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+async function handleAutomationTest(id) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("test-automation", {
+    automationId: id
+  });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+
+// src/commands/memory.ts
+async function handleMemoryList(opts) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("list-memory-files", {
+    scope: opts.scope
+  });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+async function handleMemoryRead(fileId) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("read-memory-file", { fileId });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+async function handleMemoryWrite(opts) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("write-memory-file", {
+    title: opts.title,
+    content: opts.content,
+    scope: opts.scope
+  });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+async function handleMemoryDelete(fileId) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("delete-memory-file", { fileId });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+
+// src/commands/analysis.ts
+async function handleSearchAnalysis(query, opts) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("search-analysis", {
+    query,
+    status: opts.status,
+    limit: opts.limit ? parseInt(opts.limit, 10) : void 0
+  });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+async function handleRunAnalysis(opts) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("run-analysis-workflow", {
+    selectedPromptKeys: opts.prompts?.split(",")
+  });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+
+// src/commands/integrations.ts
+async function handleIntegrations() {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("list-integrations", {});
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+async function handleEvents(opts) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("get-integration-events", {
+    source: opts.source,
+    eventType: opts.eventType,
+    projectId: opts.projectId,
+    timeRange: opts.since
+  });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+async function handleResolveIdentity(opts) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("resolve-identities", {
+    provider: opts.provider,
+    externalUsername: opts.username,
+    normalizedEmail: opts.email,
+    externalId: opts.externalId,
+    externalUserId: opts.externalUserId
+  });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+
+// src/commands/slack.ts
+async function handleSlackHistory(opts) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("get-slack-channel-history", {
+    channelId: opts.channel,
+    limit: opts.limit ? parseInt(opts.limit, 10) : void 0
+  });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+async function handleSlackMessage(opts) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("get-slack-message", {
+    permalink: opts.permalink,
+    channelId: opts.channel,
+    messageTs: opts.ts,
+    includeThreadContext: opts.includeThread
+  });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+
+// src/commands/messages.ts
+async function handleMessagesList(opts) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("list-messages", {
+    startTime: opts.start ? parseInt(opts.start, 10) : void 0,
+    endTime: opts.end ? parseInt(opts.end, 10) : void 0,
+    limit: opts.limit ? parseInt(opts.limit, 10) : void 0,
+    cursor: opts.cursor
+  });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+async function handleMessagesContext(messageId, opts) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("list-messages-with-context", {
+    messageId,
+    before: opts.before ? parseInt(opts.before, 10) : void 0,
+    after: opts.after ? parseInt(opts.after, 10) : void 0
+  });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+
+// src/commands/skills.ts
+async function handleSkillsList() {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("list-skills", {});
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+async function handleSkillsLoad(skillId) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  const result = await api.callBackend("load-skill", { skillId });
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+
+// src/commands/config-snapshots.ts
+async function handleConfigList(opts) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  try {
+    const result = opts.repo ? await api.listRepoConfigSnapshots(opts.org, opts.repo) : await api.listUserConfigSnapshots(opts.org);
+    console.log(JSON.stringify(result, null, 2));
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+}
+async function handleConfigDetail(opts) {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  try {
+    const result = opts.repo ? await api.getRepoConfigDetail(opts.org, opts.repo) : opts.user ? await api.getUserConfigDetail(opts.org, opts.user) : null;
+    if (!result) {
+      console.error("Provide --user or --repo");
+      process.exit(1);
+    }
+    console.log(JSON.stringify(result, null, 2));
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+}
+
+// src/cli.ts
+ensureNativeModules();
+await initSentry();
+if (process.argv.length <= 2 || process.argv.includes("--help") || process.argv.includes("-h")) {
+  printBanner();
+}
+var program = new Command().name("fml").description("FML agent tools for Claude Code").version(
+  true ? "0.0.0-dev+f2e63af1" : "dev"
+);
+program.command("tools", { hidden: true }).description("List all available CLI commands (including hidden agent tools)").action(() => {
+  function formatCmd(cmd, prefix = "") {
+    const name = prefix ? `${prefix} ${cmd.name()}` : cmd.name();
+    const args = cmd.registeredArguments.map((a) => a.required ? `<${a.name()}>` : `[${a.name()}]`).join(" ");
+    const opts = cmd.options.filter(
+      (o) => !o.hidden && o.long !== "--help" && o.long !== "--version"
+    ).map((o) => o.mandatory ? o.flags : `[${o.flags}]`).join(" ");
+    const usage = [name, args, opts].filter(Boolean).join(" ");
+    return `${usage}
+  ${cmd.description()}`;
+  }
+  const lines = program.commands.filter((c) => c.name() !== "tools" && c.name() !== "help").flatMap((c) => {
+    if (c.commands.length > 0) {
+      return c.commands.map((s) => formatCmd(s, c.name()));
+    }
+    return [formatCmd(c)];
+  });
+  console.log(lines.join("\n\n"));
+});
+program.command("install").description("Register plugin, hooks, and daemons").action(() => handleInstall());
+program.command("uninstall").description("Remove fml plugin, hooks, and optionally all data").option(
+  "--target <target>",
+  "Target CLI: claude, gemini, codex, claude-desktop, all"
+).option("--purge", "Also remove all data, logs, and auth tokens").action((opts) => handleUninstall(opts));
+program.command("update").description("Update fml to the latest version").action(() => handleUpdate());
+program.command("login").description("Sign in to your FML account").action(() => handleLogin());
+program.command("logout").description("Sign out and clear stored credentials").action(() => handleLogout());
+program.command("org").description("Show or select organization").argument("[slug]", "Org slug to select").action((slug) => handleOrg(slug));
+program.command("status").description("Show current auth and daemon status").action(() => handleStatus());
+program.command("doctor").description("Check FML and panopticon configuration and connectivity").option("--json", "Output as JSON").action((opts) => handleDoctor(opts));
+program.command("open").description("Open FML dashboard in browser").option("--json", "Output URL as JSON instead of opening browser").action((opts) => handleOpen(opts));
+program.command("env").description("Show or switch environment (dev/prod)").argument("[target]", 'Environment name ("dev", "prod") or custom Convex URL').action((target) => {
+  if (target) handleEnvSwitch(target);
+  else handleEnvShow();
+});
+program.command("start").description("Start panopticon server and sync").action(() => handleStart());
+program.command("stop").description("Stop panopticon server and sync").action(() => handleStop());
+var sync = program.command("sync").description("Manage sync configuration");
+sync.command("setup").description("Configure sync targets (convenience shortcut)").action(() => handleSyncSetup());
+sync.command("list").description("List all sync targets").action(() => handleSyncList());
+sync.command("add").description("Add a sync target").argument("<name>", "Unique target name").argument("<url>", "OTLP HTTP endpoint URL").option("--token-cmd <cmd>", "Shell command that returns a bearer token").option("--token <token>", "Static bearer token").action(
+  (name, url, opts) => handleSyncAdd(name, url, opts)
+);
+sync.command("remove").description("Remove a sync target").argument("<name>", "Target name to remove").action((name) => handleSyncRemove(name));
+sync.command("edit").description("Edit a sync target").argument("<name>", "Target name to edit").option("--url <url>", "New OTLP HTTP endpoint URL").option("--token-cmd <cmd>", "New shell command for bearer token").option("--token <token>", "New static bearer token").action(
+  (name, opts) => handleSyncEdit(name, opts)
+);
+sync.command("status").description("Show sync config and watermarks").action(() => handleSyncStatus());
+sync.command("reset").description("Reset sync watermarks").argument("[name]", "Target name (resets all if omitted)").action((name) => handleSyncReset(name));
+program.command("activity").description("Activity summary \u2014 sessions, prompts, tools, costs").option("--since <duration>", 'Time window, e.g. "24h", "7d"').action((opts) => handleActivity(opts));
+program.command("sessions").description("List recent sessions").option("--since <duration>", 'Time filter, e.g. "24h", "7d"').option("--limit <n>", "Max sessions to return").action((opts) => handleSessions(opts));
+program.command("timeline").description("Get events for a session").argument("<session-id>", "Session ID").option("--limit <n>", "Max events to return").option("--offset <n>", "Events to skip").action((sessionId, opts) => handleTimeline(sessionId, opts));
+program.command("spending").description("AI token usage and cost breakdown").option("--since <duration>", 'Time filter, e.g. "24h", "7d"').option("--group-by <key>", "Group by: session, model, or day").action((opts) => handleSpending(opts));
+program.command("search").description("Search across all sessions").argument("<query>", "Text to search for").option("--since <duration>", 'Time filter, e.g. "24h", "7d"').option("--limit <n>", "Max results").action((query, opts) => handleSearch(query, opts));
+program.command("query", { hidden: true }).description("Query a connected integration").argument(
+  "<provider>",
+  "Provider name (sentry, slack, github, linear, notion, freshdesk, posthog, amplitude, meta-ads)"
+).argument("<endpoint>", "API endpoint or subcommand").option("--method <method>", "HTTP method", "GET").option("--body <json>", "Request body as JSON string").option("--project-id <id>", "Project ID override").action((provider, endpoint, opts) => handleQuery(provider, endpoint, opts));
+var automation = program.command("automation", { hidden: true }).description("Manage automations");
+automation.command("list").description("List all automations").action(() => handleAutomationList());
+automation.command("create-scheduled").description("Create a scheduled automation").requiredOption("--name <name>", "Automation name").requiredOption("--prompt <prompt>", "What to run").requiredOption("--frequency <freq>", "hourly, daily, weekly, or monthly").requiredOption("--hour <hour>", "Hour (0-23)").requiredOption("--minute <minute>", "Minute (0-59)").requiredOption("--timezone <tz>", "IANA timezone, e.g. America/Chicago").option("--day-of-week <day>", "Day of week (0=Sun..6=Sat) for weekly").option("--day-of-month <day>", "Day of month (1-31) for monthly").option("--max-runs <n>", "Max runs (1 for one-time)").action((opts) => handleAutomationCreate(opts));
+automation.command("create-pattern").description("Create an event-triggered automation").requiredOption("--name <name>", "Automation name").requiredOption("--prompt <prompt>", "What to watch for and do").action((opts) => handleAutomationCreatePattern(opts));
+automation.command("update").description("Update an automation").argument("<id>", "Automation ID").option("--name <name>", "New name").option("--prompt <prompt>", "New prompt").option("--enabled <bool>", "Enable or disable (true/false)").option("--frequency <freq>", "New frequency").option("--hour <hour>", "New hour").option("--minute <minute>", "New minute").option("--timezone <tz>", "New timezone").option("--day-of-week <day>", "New day of week").option("--day-of-month <day>", "New day of month").action((id, opts) => handleAutomationUpdate(id, opts));
+automation.command("delete").description("Delete an automation").argument("<id>", "Automation ID").action((id) => handleAutomationDelete(id));
+automation.command("test").description("Preview/test an automation").argument("<id>", "Automation ID").action((id) => handleAutomationTest(id));
+var memory = program.command("memory", { hidden: true }).description("Manage memory files");
+memory.command("list").description("List memory files").option("--scope <scope>", "Scope: project, org, or user").action((opts) => handleMemoryList(opts));
+memory.command("read").description("Read a memory file").argument("<file-id>", "Memory file ID").action((fileId) => handleMemoryRead(fileId));
+memory.command("write").description("Create or update a memory file").requiredOption("--title <title>", "File title").requiredOption("--content <content>", "File content").option("--scope <scope>", "Scope: project, org, or user").action((opts) => handleMemoryWrite(opts));
+memory.command("delete").description("Delete a memory file").argument("<file-id>", "Memory file ID").action((fileId) => handleMemoryDelete(fileId));
+program.command("search-analysis", { hidden: true }).description("Search codebase analysis results").argument("<query>", "Search query").option("--status <status>", "Filter by status").option("--limit <n>", "Max results").action((query, opts) => handleSearchAnalysis(query, opts));
+program.command("run-analysis", { hidden: true }).description("Run deep codebase analysis workflows").option(
+  "--prompts <list>",
+  "Comma-separated: security,architecture,code-quality,performance,ux,dependencies,cost,ai-architecture,ai-security"
+).action((opts) => handleRunAnalysis(opts));
+program.command("integrations", { hidden: true }).description("List connected integrations").action(() => handleIntegrations());
+program.command("events", { hidden: true }).description("Recent integration events (deploys, releases, errors)").option(
+  "--source <source>",
+  "Filter: github, sentry, linear, amplitude, stripe"
+).option("--event-type <type>", "Filter by event type").option("--project-id <id>", "Filter by project").option("--since <duration>", "Time range: 1h, 6h, 24h, 7d, 30d").action((opts) => handleEvents(opts));
+program.command("resolve-identity", { hidden: true }).description("Resolve external identity to FML user").argument("[username]", "External username (shorthand for --username)").option("--provider <p>", "Provider: github, linear, slack").option("--username <u>", "External username").option("--email <e>", "Email address").option("--external-id <id>", "External ID").option("--external-user-id <id>", "External user ID").action(
+  (username, opts) => handleResolveIdentity(username ? { ...opts, username } : opts)
+);
+var slack = program.command("slack", { hidden: true }).description("Slack shortcuts");
+slack.command("history").description("Recent messages from a channel").option("--channel <id>", "Channel ID").option("--limit <n>", "Max messages").action((opts) => handleSlackHistory(opts));
+slack.command("message").description("Fetch a specific message").option("--permalink <url>", "Message permalink").option("--channel <id>", "Channel ID").option("--ts <timestamp>", "Message timestamp").option("--include-thread", "Include thread context").action((opts) => handleSlackMessage(opts));
+var messages = program.command("messages", { hidden: true }).description("Conversation messages");
+messages.command("list").description("List messages from a conversation").option("--start <timestamp>", "Start time (ms epoch)").option("--end <timestamp>", "End time (ms epoch)").option("--limit <n>", "Max messages").option("--cursor <cursor>", "Pagination cursor").action((opts) => handleMessagesList(opts));
+messages.command("context").description("Get messages around a specific message").argument("<message-id>", "Message ID").option("--before <n>", "Messages before").option("--after <n>", "Messages after").action((messageId, opts) => handleMessagesContext(messageId, opts));
+var skills = program.command("skills", { hidden: true }).description("Browse and load skills");
+skills.command("list").description("List available skills").action(() => handleSkillsList());
+skills.command("load").description("Load a skill by ID").argument("<skill-id>", "Skill ID").action((skillId) => handleSkillsLoad(skillId));
+var config = program.command("config", { hidden: true }).description("View team config snapshots");
+config.command("list").description("List config snapshots for an org").requiredOption("--org <slug>", "Organization slug").option("--repo <full-name>", "Filter by repo (owner/name)").action((opts) => handleConfigList(opts));
+config.command("detail").description("Get config snapshot detail").requiredOption("--org <slug>", "Organization slug").option("--user <username>", "GitHub username").option("--repo <full-name>", "Repository (owner/name)").action((opts) => handleConfigDetail(opts));
+program.parseAsync(process.argv).catch((err) => {
+  Sentry.captureException(err);
+  console.error(err);
+  process.exit(1);
+});
+//# sourceMappingURL=cli.js.map