@lunnoa/client 2.4.0 → 3.0.0

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/cli/index.ts
-import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
-import { resolve as resolve4 } from "path";
+import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
+import { resolve as resolve6 } from "path";
 
 // src/core/auth.ts
 var API_KEY_PREFIX = "lna_";
@@ -32,16 +32,21 @@ var LunnoaApiError = class extends Error {
   method;
   /** Path of the failed request (without the base URL). */
   path;
+  /** Present on definition-sync 409s when the server sends the current revision. */
+  currentRevision;
   constructor(args) {
     const detail = extractMessage(args.body);
+    const currentRevision = extractCurrentRevision(args.body);
+    const shown = [detail, currentRevision ? `currentRevision: ${currentRevision}` : void 0].filter(Boolean).join(" ");
     super(
-      `Lunnoa API request failed: ${args.method} ${args.path} \u2192 ${args.status}${detail ? ` (${detail})` : ""}`
+      `Lunnoa API request failed: ${args.method} ${args.path} \u2192 ${args.status}${shown ? ` (${shown})` : ""}`
     );
     this.name = "LunnoaApiError";
     this.status = args.status;
     this.body = args.body;
     this.method = args.method;
     this.path = args.path;
+    this.currentRevision = currentRevision;
   }
   /** True for 401 responses (missing, revoked, or expired credential). */
   get isUnauthorized() {
@@ -60,6 +65,15 @@ var LunnoaApiError = class extends Error {
     return this.status === 429;
   }
 };
+function publicApiMessage(error) {
+  const message = extractMessage(error.body) ?? error.message;
+  return error.currentRevision ? `${message} (currentRevision: ${error.currentRevision})` : message;
+}
+function extractCurrentRevision(body) {
+  if (!body || typeof body !== "object") return void 0;
+  const revision = body.currentRevision;
+  return typeof revision === "string" ? revision : void 0;
+}
 function extractMessage(body) {
   if (body && typeof body === "object") {
     const record = body;
@@ -536,6 +550,121 @@ var ActionsResource = class {
   }
 };
 
+// src/define/files.ts
+var STEP_KEY_PATTERN = /^[A-Za-z][A-Za-z0-9_-]*$/;
+function hasFileAgentSignals(record) {
+  if (record.instructions && typeof record.instructions === "object") return true;
+  if (record.settings && typeof record.settings === "object") return true;
+  if ("workflows" in record || "agents" in record || "knowledge" in record || "variables" in record || "objects" in record || "objectTypes" in record || "mcpServers" in record || "a2aAgents" in record) {
+    return true;
+  }
+  return Array.isArray(record.tools) && record.tools.some(
+    (tool) => tool && typeof tool === "object" && !("kind" in tool) && !("use" in tool)
+  );
+}
+function isAgentFileShape(config) {
+  if (!config || typeof config !== "object") return false;
+  return hasFileAgentSignals(config);
+}
+function acceptAgentFile(config) {
+  const slug = config.slug?.trim();
+  if (!slug) throw new Error("defineAgent requires slug");
+  const instructions = config.instructions;
+  const fileRef = instructions && typeof instructions === "object" && typeof instructions.file === "string" && instructions.file.trim().length > 0;
+  if (typeof instructions !== "string" && !fileRef) {
+    throw new Error("defineAgent requires instructions");
+  }
+  const copy = { ...config };
+  delete copy.$schema;
+  delete copy.kind;
+  return { ...copy, kind: "agent", slug, instructions };
+}
+function assertStepKeys(steps, seen) {
+  for (const step of steps ?? []) {
+    if (!step?.use?.id?.trim()) {
+      throw new Error("workflow step requires use.id");
+    }
+    if (step.key !== void 0) {
+      if (!STEP_KEY_PATTERN.test(step.key) || step.key === "trigger") {
+        throw new Error(
+          `Step key "${step.key}" must start with a letter, use letters, digits, - or _, and not be "trigger".`
+        );
+      }
+      if (seen.has(step.key)) {
+        throw new Error(`Step key "${step.key}" is used twice.`);
+      }
+      seen.add(step.key);
+    }
+    for (const path of step.paths ?? []) {
+      assertStepKeys(path.steps ?? [], seen);
+    }
+  }
+}
+function acceptWorkflowStepsFile(config) {
+  const slug = config.slug?.trim();
+  if (!slug) throw new Error("defineWorkflow requires slug");
+  if (!config.steps?.length) {
+    throw new Error("defineWorkflow requires at least one step");
+  }
+  if (config.trigger && !config.trigger.id?.trim()) {
+    throw new Error("defineWorkflow trigger requires id");
+  }
+  assertStepKeys(config.steps, /* @__PURE__ */ new Set());
+  const copy = { ...config };
+  delete copy.$schema;
+  delete copy.kind;
+  return {
+    ...copy,
+    kind: "workflow",
+    format: "steps",
+    slug
+  };
+}
+function acceptWorkflowGraphFile(config) {
+  const slug = config.slug?.trim();
+  if (!slug) throw new Error("defineWorkflow requires slug");
+  if (!Array.isArray(config.nodes) || config.nodes.length === 0) {
+    throw new Error("defineWorkflow graph requires nodes");
+  }
+  const keys = /* @__PURE__ */ new Set();
+  let triggers = 0;
+  for (const node of config.nodes) {
+    if (!node?.key || typeof node.key !== "string") {
+      throw new Error("graph node requires key");
+    }
+    if (!STEP_KEY_PATTERN.test(node.key)) {
+      throw new Error(
+        `Node key "${node.key}" must start with a letter, use letters, digits, - or _, and not be empty.`
+      );
+    }
+    if (keys.has(node.key)) {
+      throw new Error(`Node key "${node.key}" is used twice.`);
+    }
+    keys.add(node.key);
+    if (node.nodeType === "trigger") triggers += 1;
+  }
+  if (triggers !== 1) {
+    throw new Error("defineWorkflow graph requires exactly one trigger");
+  }
+  for (const edge of config.edges ?? []) {
+    if (!keys.has(edge?.source) || !keys.has(edge?.target)) {
+      throw new Error(
+        `Edge from "${edge?.source ?? ""}" to "${edge?.target ?? ""}" references an unknown key.`
+      );
+    }
+  }
+  const copy = { ...config };
+  delete copy.$schema;
+  delete copy.kind;
+  return {
+    ...copy,
+    kind: "workflow",
+    format: "graph",
+    slug,
+    edges: config.edges ?? []
+  };
+}
+
 // src/define/index.ts
 var DEFINE_KINDS = {
   connection: "connection",
@@ -546,6 +675,33 @@ var DEFINE_KINDS = {
   agent: "agent",
   entityType: "entityType"
 };
+var PATH_CONDITIONS = [
+  "contains",
+  "does_not_contain",
+  "equals",
+  "does_not_equal",
+  "exists",
+  "does_not_exist",
+  "starts_with",
+  "ends_with",
+  "is_empty",
+  "is_not_empty",
+  "comes_before",
+  "comes_after",
+  "is_in_the_past",
+  "is_in_the_future",
+  "is_true",
+  "is_false",
+  "is_truthy",
+  "is_falsey",
+  "is_greater_than",
+  "is_less_than",
+  "is_greater_than_or_equal_to",
+  "is_less_than_or_equal_to",
+  "matches_regex",
+  "does_not_match_regex"
+];
+var PATH_CONDITION_SET = new Set(PATH_CONDITIONS);
 function resolveActionAppId(action) {
   if (action.appId?.trim()) {
     return action.appId.trim();
@@ -646,10 +802,24 @@ function unwrapTool(tool) {
   }
   return tool;
 }
+function syncFields(options) {
+  return {
+    ...options?.baseRevision ? { baseRevision: options.baseRevision } : {},
+    ...options?.force ? { force: true } : {}
+  };
+}
+function idsOf(links) {
+  if (!links) return void 0;
+  return links.map((link) => link.id);
+}
 function agentDefinitionToUpsert(def, options) {
+  if (isAgentFileShape(def)) {
+    return fileAgentToUpsert(def, options);
+  }
   const tools = [];
   const workflowIds = [...options?.workflowIds ?? []];
-  for (const tool of def.tools ?? []) {
+  const authored = def;
+  for (const tool of authored.tools ?? []) {
     const unwrapped = unwrapTool(tool);
     if (unwrapped.kind === DEFINE_KINDS.workflow) {
       continue;
@@ -665,17 +835,65 @@ function agentDefinitionToUpsert(def, options) {
       });
     }
   }
+  return {
+    slug: authored.slug,
+    name: authored.name,
+    description: authored.description,
+    instructions: authored.instructions,
+    model: authored.model,
+    aiConnectionId: authored.aiConnection?.id,
+    connectionIds: authored.connections?.map((c) => c.id).filter((id) => Boolean(id)),
+    workflowIds: workflowIds.length ? workflowIds : void 0,
+    tools,
+    codeSource: options?.codeSource ?? "generated",
+    ...syncFields(options)
+  };
+}
+function fileAgentToUpsert(def, options) {
+  if (typeof def.instructions !== "string") {
+    throw new Error(
+      "Agent instructions are still a file reference. The CLI resolves these before push."
+    );
+  }
+  const tools = [];
+  for (const tool of def.tools ?? []) {
+    const action = {
+      kind: DEFINE_KINDS.action,
+      id: tool.id,
+      appId: tool.appId,
+      connection: tool.connection?.id ? { kind: DEFINE_KINDS.connection, id: tool.connection.id } : void 0
+    };
+    tools.push({
+      key: tool.key,
+      appId: resolveActionAppId(action),
+      actionId: resolveActionId(action),
+      connectionId: tool.connection?.id,
+      name: tool.name,
+      description: tool.description,
+      input: tool.input
+    });
+  }
   return {
     slug: def.slug,
     name: def.name,
-    description: def.description,
+    // A file is the whole definition. Omitted description and model are empty.
+    description: def.description ?? null,
     instructions: def.instructions,
-    model: def.model,
+    model: def.model ?? null,
     aiConnectionId: def.aiConnection?.id,
-    connectionIds: def.connections?.map((c) => c.id).filter((id) => Boolean(id)),
-    workflowIds: workflowIds.length ? workflowIds : void 0,
-    tools,
-    managedByCode: true
+    ...def.settings ? { settings: def.settings } : {},
+    ...def.tools ? { tools } : {},
+    ...def.workflows ? { workflows: def.workflows } : {},
+    ...def.agents ? { agents: def.agents } : {},
+    ...def.connections ? { connectionIds: idsOf(def.connections) } : {},
+    ...def.knowledge ? { knowledgeIds: idsOf(def.knowledge) } : {},
+    ...def.variables ? { variableIds: idsOf(def.variables) } : {},
+    ...def.objects ? { objectIds: idsOf(def.objects) } : {},
+    ...def.objectTypes ? { objectTypeIds: idsOf(def.objectTypes) } : {},
+    ...def.mcpServers ? { mcpServers: def.mcpServers } : {},
+    ...def.a2aAgents ? { a2aAgentIds: idsOf(def.a2aAgents) } : {},
+    codeSource: "synced",
+    ...syncFields(options)
   };
 }
 var AgentsResource = class {
@@ -695,15 +913,22 @@ var AgentsResource = class {
       query: serializeListQuery(options)
     });
   }
+  /** Exported definition for `lunnoa/agents/<slug>.json`. */
+  getDefinition(slug) {
+    return this.http.get(
+      `/api/agents/slug/${encodeURIComponent(slug)}/definition`
+    );
+  }
   /**
    * Upsert an agent by slug inside the workspace on the API key.
    * Prefer the CLI (`npx @lunnoa/client agents deploy`) for happy-path deploy.
    */
   upsertBySlug(body, options) {
     const payload = "kind" in body && body.kind === "agent" ? agentDefinitionToUpsert(body, options) : body;
-    return this.http.post("/api/agents/upsert", {
-      body: payload
-    });
+    return this.http.post(
+      "/api/agents/upsert",
+      { body: payload }
+    );
   }
 };
 
@@ -1500,7 +1725,7 @@ function computeDurationMs(start, end) {
   return b - a;
 }
 function defaultSleep(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 
 // src/resources/knowledge.ts
@@ -1805,6 +2030,11 @@ function stepFromDefinition(step) {
       ...step.name ? { name: step.name } : {}
     };
   }
+  if (step.paths?.length) {
+    throw new Error(
+      "runs.start runs straight lines only. Deploy workflows with paths, then execute them."
+    );
+  }
   const use = step.use;
   const input = {
     ...use.input ?? {},
@@ -1822,6 +2052,11 @@ function stepFromDefinition(step) {
 }
 function normalizeStartRunInput(input) {
   if (isWorkflowDefinition(input)) {
+    if ("format" in input && input.format === "graph") {
+      throw new Error(
+        "runs.start runs straight lines only. Push the graph workflow, then execute it."
+      );
+    }
     return {
       steps: input.steps.map(stepFromDefinition),
       name: input.name ?? input.slug
@@ -2013,6 +2248,18 @@ var WorkflowAppsResource = class {
   }
 };
 
+// src/resources/code-sync.ts
+var CodeSyncResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /** Workspace id and whether synced resources are locked in the UI. */
+  context() {
+    return this.http.get("/api/code-sync/context");
+  }
+};
+
 // src/resources/workflows.ts
 function triggerToUpsertInput(trigger) {
   return {
@@ -2025,8 +2272,38 @@ function triggerToUpsertInput(trigger) {
     ...trigger.description ? { description: trigger.description } : {}
   };
 }
+function asAction(use) {
+  if (use && typeof use === "object" && "kind" in use && use.kind === DEFINE_KINDS.action) {
+    return use;
+  }
+  const fileUse = use;
+  return {
+    kind: DEFINE_KINDS.action,
+    id: fileUse.id,
+    appId: fileUse.appId,
+    connection: fileUse.connection?.id ? { kind: DEFINE_KINDS.connection, id: fileUse.connection.id } : void 0
+  };
+}
+function asTrigger(trigger) {
+  if ("kind" in trigger && trigger.kind === DEFINE_KINDS.trigger) {
+    return trigger;
+  }
+  const fileTrigger = trigger;
+  return {
+    kind: DEFINE_KINDS.trigger,
+    id: fileTrigger.id,
+    appId: fileTrigger.appId,
+    connection: fileTrigger.connection?.id ? { kind: DEFINE_KINDS.connection, id: fileTrigger.connection.id } : void 0,
+    input: fileTrigger.input,
+    inputs: fileTrigger.inputs,
+    name: fileTrigger.name,
+    description: fileTrigger.description
+  };
+}
 function stepToUpsertInput(step) {
-  const use = step.use;
+  const use = asAction(step.use);
+  const retry = "retrySettings" in step ? step.retrySettings : void 0;
+  const continueOnFailure = "continueOnFailure" in step ? step.continueOnFailure : void 0;
   return {
     ...step.key ? { key: step.key } : {},
     appId: resolveActionAppId(use),
@@ -2037,18 +2314,60 @@ function stepToUpsertInput(step) {
       ...step.input ?? {}
     },
     name: step.name ?? use.name,
-    description: use.description
+    description: step.description ?? use.description,
+    ...retry ? { retrySettings: retry } : {},
+    ...continueOnFailure ? { continueOnFailure } : {},
+    ...step.paths?.length ? {
+      paths: step.paths.map((path) => ({
+        label: path.label,
+        ...path.when ? { when: path.when } : {},
+        steps: path.steps.map(
+          (nested) => stepToUpsertInput(nested)
+        )
+      }))
+    } : {}
   };
 }
-function workflowDefinitionToUpsert(def) {
+function syncFields2(options) {
   return {
-    slug: def.slug,
-    name: def.name,
-    description: def.description,
-    isActive: def.isActive,
-    ...def.trigger ? { trigger: triggerToUpsertInput(def.trigger) } : {},
-    managedByCode: true,
-    steps: def.steps.map(stepToUpsertInput)
+    ...options?.baseRevision ? { baseRevision: options.baseRevision } : {},
+    ...options?.force ? { force: true } : {}
+  };
+}
+function workflowDefinitionToUpsert(def, options) {
+  if ("format" in def && def.format === "graph") {
+    return {
+      slug: def.slug,
+      name: def.name,
+      // A file is the whole definition: an omitted description is empty, not "leave it".
+      description: def.description ?? null,
+      codeSource: "synced",
+      graph: { nodes: def.nodes, edges: def.edges ?? [] },
+      ...syncFields2(options)
+    };
+  }
+  if ("format" in def && def.format === "steps") {
+    const file = def;
+    return {
+      slug: file.slug,
+      name: file.name,
+      description: file.description ?? null,
+      ...file.trigger ? { trigger: triggerToUpsertInput(asTrigger(file.trigger)) } : {},
+      codeSource: "synced",
+      steps: file.steps.map((step) => stepToUpsertInput(step)),
+      ...syncFields2(options)
+    };
+  }
+  const authored = def;
+  return {
+    slug: authored.slug,
+    name: authored.name,
+    description: authored.description,
+    isActive: authored.isActive,
+    ...authored.trigger ? { trigger: triggerToUpsertInput(authored.trigger) } : {},
+    codeSource: options?.codeSource ?? "generated",
+    ...syncFields2(options),
+    steps: authored.steps.map((step) => stepToUpsertInput(step))
   };
 }
 var WorkflowsResource = class {
@@ -2073,15 +2392,22 @@ var WorkflowsResource = class {
       query: serializeListQuery(options)
     });
   }
+  /** Exported definition for `lunnoa/workflows/<slug>.json`. */
+  getDefinition(slug) {
+    return this.http.get(
+      `/api/workflows/slug/${encodeURIComponent(slug)}/definition`
+    );
+  }
   /**
    * Upsert a workflow by slug inside the workspace on the API key.
    * Prefer the CLI (`npx @lunnoa/client workflows deploy`) for happy-path deploy.
    */
-  upsertBySlug(body) {
-    const payload = "kind" in body && body.kind === "workflow" ? workflowDefinitionToUpsert(body) : body;
-    return this.http.post("/api/workflows/upsert", {
-      body: payload
-    });
+  upsertBySlug(body, options) {
+    const payload = "kind" in body && body.kind === "workflow" ? workflowDefinitionToUpsert(body, options) : body;
+    return this.http.post(
+      "/api/workflows/upsert",
+      { body: payload }
+    );
   }
   /**
    * Starts a new execution of the workflow with the given trigger inputs.
@@ -2147,6 +2473,8 @@ var LunnoaClient = class {
   aiConnections;
   workflowApps;
   discovery;
+  /** Workspace id for the definitions lock, and the code-sync lock flag. */
+  codeSync;
   constructor(options) {
     this.http = new HttpClient(options);
     this.auth = new AuthResource(this.http, this.http.tokenStore);
@@ -2170,6 +2498,7 @@ var LunnoaClient = class {
     this.connections = new ConnectionsResource(this.http);
     this.aiConnections = new AiConnectionsResource(this.http);
     this.discovery = new DiscoveryResource(this.http);
+    this.codeSync = new CodeSyncResource(this.http);
   }
 };
 
@@ -2191,7 +2520,8 @@ var VALUE_FLAGS = /* @__PURE__ */ new Set([
   "--access-token",
   "--out",
   "--app",
-  "--template"
+  "--template",
+  "--dir"
 ]);
 function requireFlagValue(flag, value) {
   if (!value || value.startsWith("--")) {
@@ -2205,6 +2535,8 @@ function parseArgs(argv) {
     out: "./src/lunnoa",
     json: false,
     forAgent: false,
+    all: false,
+    force: false,
     help: false
   };
   let i = 1;
@@ -2233,6 +2565,14 @@ function parseArgs(argv) {
       args.forAgent = true;
       continue;
     }
+    if (flag === "--all") {
+      args.all = true;
+      continue;
+    }
+    if (flag === "--force") {
+      args.force = true;
+      continue;
+    }
     if (flag && VALUE_FLAGS.has(flag)) {
       const value = requireFlagValue(flag, argv[i + 1]);
       switch (flag) {
@@ -2254,6 +2594,9 @@ function parseArgs(argv) {
         case "--template":
           args.template = value;
           break;
+        case "--dir":
+          args.dir = value;
+          break;
         default:
           break;
       }
@@ -2292,6 +2635,12 @@ var USAGE = `Usage:
   npx @lunnoa/client workflows deploy <path> --url <url> --api-key <key>
   npx @lunnoa/client agents deploy <path> --url <url> --api-key <key>
   npx @lunnoa/client entity-types deploy <path> --url <url> --api-key <key>
+  .json is pushed (code synced). .ts / .js / .mjs is deployed from TypeScript (code generated).
+
+  Definitions folder (default ./lunnoa, or definitionsDir in lunnoa.config.*, or --dir):
+  npx @lunnoa/client pull [--all | <slug> | agents/<slug> | workflows/<slug>] [--force]
+  npx @lunnoa/client push [<path|slug>] [--force]
+  npx @lunnoa/client status [--json]
 
   Agent skills (copies this version's skills into .claude/skills and .cursor/skills):
   npx @lunnoa/client skills install [projectDir]
@@ -2305,6 +2654,9 @@ Options:
   --for-agent     Only catalogue entries with availableForAgent
   --template      init starter: GitHub owner/repo[#ref] or local folder (default: lunnoa-automate/lunnoa-starter)
   --json          Machine-readable JSON (preferred for coding agents)
+  --dir           Definitions folder (default: ./lunnoa or definitionsDir in lunnoa.config)
+  --all           pull every agent and workflow in the workspace
+  --force         pull: overwrite a local edit; push: skip the revision check
   --help          Show this help
 
 Environment: LUNNOA_URL, LUNNOA_API_KEY (also read from ./.env)
@@ -2321,6 +2673,682 @@ A slug already granted to other workspaces is not rewritten. Unknown instance at
 allowUnknownAttributes is true; use extensions.
 `;
 
+// src/cli/print.ts
+function printJson(value) {
+  console.log(JSON.stringify(value, null, 2));
+}
+function formatTable(rows, columns) {
+  if (rows.length === 0) {
+    return "No results.";
+  }
+  const widths = columns.map((col) => {
+    let width = col.header.length;
+    for (const row of rows) {
+      width = Math.max(width, stringifyCell(row[col.key]).length);
+    }
+    return width;
+  });
+  const header = columns.map((col, i) => pad(col.header, widths[i])).join("  ");
+  const divider = widths.map((w) => "-".repeat(w)).join("  ");
+  const body = rows.map(
+    (row) => columns.map((col, i) => pad(stringifyCell(row[col.key]), widths[i])).join("  ")
+  );
+  return [header, divider, ...body].join("\n");
+}
+function printTable(rows, columns) {
+  console.log(formatTable(rows, columns));
+}
+function stringifyCell(value) {
+  if (value === null || value === void 0) {
+    return "";
+  }
+  if (typeof value === "boolean") {
+    return value ? "yes" : "no";
+  }
+  return String(value);
+}
+function pad(value, width) {
+  return value.length >= width ? value : `${value}${" ".repeat(width - value.length)}`;
+}
+
+// src/cli/sync/engine.ts
+import { resolve as resolve2 } from "path";
+
+// src/cli/sync/diff.ts
+var SECRET_NAME = /authorization|token|secret|password|passwd|api[-_]?key|bearer|cookie|private[-_]?key/i;
+function findSecretFields(definition) {
+  if (!definition || typeof definition !== "object") return [];
+  const record = definition;
+  const hits = [];
+  if (Array.isArray(record.tools)) {
+    record.tools.forEach((tool, index) => {
+      walk(tool?.input, `tools[${index}].input`, hits);
+    });
+  }
+  if (record.trigger && typeof record.trigger === "object") {
+    walk(record.trigger.input, "trigger.input", hits);
+  }
+  if (Array.isArray(record.steps)) {
+    record.steps.forEach((step, index) => walkStep(step, `steps[${index}]`, hits));
+  }
+  if (Array.isArray(record.nodes)) {
+    record.nodes.forEach((node, index) => {
+      walk(node?.value, `nodes[${index}].value`, hits);
+    });
+  }
+  return hits;
+}
+function walkStep(step, path, hits) {
+  if (!step || typeof step !== "object") return;
+  const record = step;
+  walk(record.input, `${path}.input`, hits);
+  record.paths?.forEach((pathDef, index) => {
+    pathDef?.steps?.forEach((nested, stepIndex) => {
+      walkStep(nested, `${path}.paths[${index}].steps[${stepIndex}]`, hits);
+    });
+  });
+}
+function walk(value, path, hits) {
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => walk(item, `${path}[${index}]`, hits));
+    return;
+  }
+  if (!value || typeof value !== "object") return;
+  for (const [key, child] of Object.entries(value)) {
+    const childPath = `${path}.${key}`;
+    if (typeof child === "string" && child.trim() && SECRET_NAME.test(key) && !child.includes("={{")) {
+      hits.push(childPath);
+    } else {
+      walk(child, childPath, hits);
+    }
+  }
+}
+function redactSecrets(text) {
+  return text.replace(
+    /("(?:\\.|[^"\\])*(?:authorization|token|secret|password|passwd|api[-_]?key|bearer|cookie|private[-_]?key)(?:\\.|[^"\\])*")(\s*:\s*)"((?:\\.|[^"\\])*)"/gi,
+    (match, key, colon, value) => value.includes("={{") ? match : `${key}${colon}"***"`
+  );
+}
+function lineDiff(local, server) {
+  const a = local.split("\n");
+  const b = server.split("\n");
+  if (a.length * b.length > 1e6) {
+    const lines = a.map((line) => `-${line}`);
+    lines.push("---");
+    lines.push(...b.map((line) => `+${line}`));
+    return lines.join("\n");
+  }
+  const dp = Array.from(
+    { length: a.length + 1 },
+    () => new Array(b.length + 1).fill(0)
+  );
+  for (let i2 = a.length - 1; i2 >= 0; i2 -= 1) {
+    for (let j2 = b.length - 1; j2 >= 0; j2 -= 1) {
+      dp[i2][j2] = a[i2] === b[j2] ? dp[i2 + 1][j2 + 1] + 1 : Math.max(dp[i2 + 1][j2], dp[i2][j2 + 1]);
+    }
+  }
+  const out = [];
+  let i = 0;
+  let j = 0;
+  while (i < a.length && j < b.length) {
+    if (a[i] === b[j]) {
+      out.push(` ${a[i]}`);
+      i += 1;
+      j += 1;
+    } else if (dp[i + 1][j] >= dp[i][j + 1]) {
+      out.push(`-${a[i]}`);
+      i += 1;
+    } else {
+      out.push(`+${b[j]}`);
+      j += 1;
+    }
+  }
+  while (i < a.length) out.push(`-${a[i++]}`);
+  while (j < b.length) out.push(`+${b[j++]}`);
+  return out.join("\n");
+}
+function formatConflict(label, local, server) {
+  return `${label}
+--- local
++++ server
+${lineDiff(redactSecrets(local), redactSecrets(server))}`;
+}
+
+// src/cli/sync/store.ts
+import { createHash } from "crypto";
+import { lstat, mkdir, readFile, readdir, realpath, writeFile } from "fs/promises";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "path";
+var PathEscapeError = class extends Error {
+  constructor(target) {
+    super(`Refusing to write outside the definitions folder: ${target}`);
+    this.name = "PathEscapeError";
+  }
+};
+function isOutsideDefinitionsDir(root, target) {
+  const rootAbs = resolve(root);
+  const abs = resolve(rootAbs, target);
+  const rel = relative(rootAbs, abs);
+  return rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel);
+}
+async function assertInsideDefinitionsDir(root, target) {
+  const rootAbs = resolve(root);
+  const abs = resolve(rootAbs, target);
+  if (isOutsideDefinitionsDir(rootAbs, abs)) {
+    throw new PathEscapeError(target);
+  }
+  let rootReal = rootAbs;
+  try {
+    rootReal = await realpath(rootAbs);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const parts = relative(rootAbs, abs).split(sep).filter(Boolean);
+  let cursor = rootAbs;
+  for (const part of parts) {
+    if (part === ".." || part === ".") throw new PathEscapeError(target);
+    const next = resolve(cursor, part);
+    let stats;
+    try {
+      stats = await lstat(next);
+    } catch (error) {
+      if (error.code === "ENOENT") return abs;
+      throw error;
+    }
+    if (stats.isSymbolicLink()) {
+      const real = await realpath(next);
+      if (isOutsideDefinitionsDir(rootReal, real)) throw new PathEscapeError(target);
+      cursor = real;
+      continue;
+    }
+    cursor = next;
+  }
+  if (isOutsideDefinitionsDir(rootReal, cursor)) throw new PathEscapeError(target);
+  return cursor;
+}
+async function writeGuarded(root, target, contents) {
+  const abs = await assertInsideDefinitionsDir(root, target);
+  await mkdir(dirname(abs), { recursive: true });
+  await writeFile(abs, contents);
+}
+function hashDefinition(json, instructions) {
+  const hash = createHash("sha256");
+  hash.update(json);
+  if (instructions !== void 0) {
+    hash.update("\0");
+    hash.update(instructions);
+  }
+  return hash.digest("hex");
+}
+function deploymentKey(baseUrl, workspaceId) {
+  return `${baseUrl.replace(/\/+$/, "")}#${workspaceId}`;
+}
+function emptyLock() {
+  return { version: 1, deployments: {} };
+}
+async function readLock(root) {
+  try {
+    const text = await readFile(resolve(root, "lunnoa.lock.json"), "utf8");
+    const parsed = JSON.parse(text);
+    if (!parsed || parsed.version !== 1 || !parsed.deployments || typeof parsed.deployments !== "object") {
+      throw new Error("lunnoa.lock.json is not a version 1 lock file.");
+    }
+    return parsed;
+  } catch (error) {
+    if (error.code === "ENOENT") return emptyLock();
+    throw error;
+  }
+}
+async function writeLock(root, lock) {
+  await writeGuarded(root, "lunnoa.lock.json", `${JSON.stringify(lock, null, 2)}
+`);
+}
+function lockBucket(lock, key) {
+  const existing = lock.deployments[key] ?? { agents: {}, workflows: {} };
+  existing.agents ??= {};
+  existing.workflows ??= {};
+  lock.deployments[key] = existing;
+  return existing;
+}
+function schemaRelativePath(jsonAbsolutePath, kind, projectRoot) {
+  const target = resolve(
+    projectRoot,
+    "node_modules",
+    "@lunnoa",
+    "client",
+    "schemas",
+    `${kind}.schema.json`
+  );
+  let rel = relative(dirname(jsonAbsolutePath), target).split(sep).join("/");
+  if (!rel.startsWith(".")) rel = `./${rel}`;
+  return rel;
+}
+function serializeDefinition(definition, schema) {
+  const body = {};
+  for (const [key, value] of Object.entries(definition)) {
+    if (key === "$schema") continue;
+    body[key] = value;
+  }
+  return `${JSON.stringify({ $schema: schema, ...body }, null, 2)}
+`;
+}
+function renderAgentFiles(definition, schema) {
+  if (typeof definition.instructions !== "string") {
+    throw new Error(
+      "Cannot write an agent definition whose instructions are still a file reference."
+    );
+  }
+  const instructionsFile = `${definition.slug}.instructions.md`;
+  const json = serializeDefinition(
+    { ...definition, instructions: { file: instructionsFile } },
+    schema
+  );
+  return { json, instructions: definition.instructions, instructionsFile };
+}
+function renderWorkflowFile(definition, schema) {
+  return serializeDefinition({ ...definition }, schema);
+}
+async function writeAgentDefinition(root, projectRoot, definition) {
+  const jsonRel = join("agents", `${definition.slug}.json`);
+  const schema = schemaRelativePath(resolve(root, jsonRel), "agent", projectRoot);
+  const rendered = renderAgentFiles(definition, schema);
+  await writeGuarded(root, jsonRel, rendered.json);
+  await writeGuarded(root, join("agents", rendered.instructionsFile), rendered.instructions);
+  return hashDefinition(rendered.json, rendered.instructions);
+}
+async function writeWorkflowDefinition(root, projectRoot, definition) {
+  const jsonRel = join("workflows", `${definition.slug}.json`);
+  const schema = schemaRelativePath(resolve(root, jsonRel), "workflow", projectRoot);
+  const json = renderWorkflowFile(definition, schema);
+  await writeGuarded(root, jsonRel, json);
+  return hashDefinition(json);
+}
+async function readInside(root, rel) {
+  const lexical = resolve(root, rel);
+  if (isOutsideDefinitionsDir(root, lexical)) throw new PathEscapeError(rel);
+  try {
+    const abs = await assertInsideDefinitionsDir(root, rel);
+    return await readFile(abs, "utf8");
+  } catch (error) {
+    if (error instanceof PathEscapeError) throw error;
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+async function hashOnDisk(root, kind, slug) {
+  if (kind === "workflow") {
+    const text = await readInside(root, join("workflows", `${slug}.json`));
+    return text === void 0 ? void 0 : hashDefinition(text);
+  }
+  const json = await readInside(root, join("agents", `${slug}.json`));
+  if (json === void 0) return void 0;
+  const parsed = JSON.parse(json);
+  if (parsed.instructions && typeof parsed.instructions === "object" && typeof parsed.instructions.file === "string") {
+    const instructions = await readInside(root, join("agents", parsed.instructions.file));
+    return hashDefinition(json, instructions ?? "");
+  }
+  return hashDefinition(json);
+}
+async function listDefinitionFiles(root) {
+  const out = [];
+  for (const kind of ["workflow", "agent"]) {
+    const folder = kind === "agent" ? "agents" : "workflows";
+    let names;
+    try {
+      names = await readdir(resolve(root, folder));
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      throw error;
+    }
+    for (const name of names.sort()) {
+      if (!name.endsWith(".json")) continue;
+      out.push({
+        kind,
+        slug: name.slice(0, -".json".length),
+        path: resolve(root, folder, name)
+      });
+    }
+  }
+  return out;
+}
+async function readLocalText(root, kind, slug) {
+  const folder = kind === "agent" ? "agents" : "workflows";
+  const json = await readInside(root, join(folder, `${slug}.json`));
+  if (json === void 0) return void 0;
+  if (kind === "workflow") return json;
+  const parsed = JSON.parse(json);
+  if (parsed.instructions && typeof parsed.instructions === "object" && typeof parsed.instructions.file === "string") {
+    const md = await readInside(root, join("agents", parsed.instructions.file));
+    return `${json}--- instructions ---
+${md ?? ""}`;
+  }
+  return json;
+}
+async function loadDefinitionForPush(root, filePath) {
+  let text;
+  try {
+    text = await readFile(filePath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      throw new Error(`Definition file not found: ${filePath}`);
+    }
+    throw error;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(`Invalid JSON in ${filePath}`);
+  }
+  if (parsed.kind === "agent") {
+    const agent = acceptAgentFile(parsed);
+    if (typeof agent.instructions === "object") {
+      const mdPath = resolve(dirname(resolve(filePath)), agent.instructions.file);
+      const boundary = isOutsideDefinitionsDir(root, resolve(filePath)) ? dirname(resolve(filePath)) : root;
+      await assertInsideDefinitionsDir(boundary, mdPath);
+      const instructions = await readFile(mdPath, "utf8");
+      return { kind: "agent", definition: { ...agent, instructions } };
+    }
+    return { kind: "agent", definition: agent };
+  }
+  if (parsed.kind === "workflow" || parsed.format === "steps" || parsed.format === "graph") {
+    if (parsed.format === "graph" || Array.isArray(parsed.nodes) && !parsed.steps) {
+      return {
+        kind: "workflow",
+        definition: acceptWorkflowGraphFile(parsed)
+      };
+    }
+    return {
+      kind: "workflow",
+      definition: acceptWorkflowStepsFile(parsed)
+    };
+  }
+  throw new Error(`Definition JSON needs kind "agent" or "workflow": ${filePath}`);
+}
+
+// src/cli/sync/engine.ts
+var SyncConflictError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SyncConflictError";
+  }
+};
+function folderOf(kind) {
+  return kind === "agent" ? "agents" : "workflows";
+}
+function labelOf(kind, slug) {
+  return `${folderOf(kind)}/${slug}.json`;
+}
+async function fetchDefinition(client, kind, slug) {
+  try {
+    const body = kind === "agent" ? await client.agents.getDefinition(slug) : await client.workflows.getDefinition(slug);
+    return {
+      kind,
+      id: body.id,
+      slug: body.definition?.slug || body.slug,
+      revision: body.revision,
+      definition: body.definition
+    };
+  } catch (error) {
+    if (error instanceof LunnoaApiError && error.isNotFound) return null;
+    throw error;
+  }
+}
+function warnSecrets(kind, slug, definition) {
+  for (const field of findSecretFields(definition)) {
+    console.error(
+      `Warning: ${labelOf(kind, slug)} field "${field}" looks like a secret. Definitions are committed; keep secrets in Lunnoa connections.`
+    );
+  }
+}
+function serverText(root, projectRoot, remote) {
+  const rel = labelOf(remote.kind, remote.slug);
+  if (remote.kind === "agent") {
+    const schema2 = schemaRelativePath(resolve2(root, rel), "agent", projectRoot);
+    const rendered = renderAgentFiles(remote.definition, schema2);
+    return `${rendered.json}--- instructions ---
+${rendered.instructions}`;
+  }
+  const schema = schemaRelativePath(resolve2(root, rel), "workflow", projectRoot);
+  return renderWorkflowFile(remote.definition, schema);
+}
+async function resolvePullTargets(client, lock, key, selector) {
+  if (selector.scope === "tracked") {
+    const dep = lock.deployments[key];
+    return [
+      ...Object.keys(dep?.workflows ?? {}).sort().map((slug) => ({ kind: "workflow", slug })),
+      ...Object.keys(dep?.agents ?? {}).sort().map((slug) => ({ kind: "agent", slug }))
+    ];
+  }
+  if (selector.scope === "all") {
+    const [workflows, agents] = await Promise.all([
+      client.workflows.list({ expansion: ["slug"] }),
+      client.agents.list({ expansion: ["slug"] })
+    ]);
+    return [
+      ...workflows.filter((workflow2) => workflow2.slug).map((workflow2) => ({ kind: "workflow", slug: workflow2.slug })),
+      ...agents.filter((agent2) => agent2.slug).map((agent2) => ({ kind: "agent", slug: agent2.slug }))
+    ];
+  }
+  if (selector.kind) return [{ kind: selector.kind, slug: selector.slug }];
+  const [agent, workflow] = await Promise.all([
+    fetchDefinition(client, "agent", selector.slug),
+    fetchDefinition(client, "workflow", selector.slug)
+  ]);
+  if (agent && workflow) {
+    throw new Error(
+      `Slug "${selector.slug}" matches an agent and a workflow. Use agents/${selector.slug} or workflows/${selector.slug}.`
+    );
+  }
+  if (agent) return [{ kind: "agent", slug: selector.slug }];
+  if (workflow) return [{ kind: "workflow", slug: selector.slug }];
+  throw new Error(`No agent or workflow with slug "${selector.slug}".`);
+}
+async function pullResources(request, selector) {
+  const context = await request.client.codeSync.context();
+  const key = deploymentKey(request.client.http.baseUrl, context.workspaceId);
+  const lock = await readLock(request.definitionsDir);
+  const targets = await resolvePullTargets(request.client, lock, key, selector);
+  const bucket = lockBucket(lock, key);
+  const writes = [];
+  const skipped = [];
+  const conflicts = [];
+  for (const target of targets) {
+    const remote = await fetchDefinition(request.client, target.kind, target.slug);
+    if (!remote) {
+      throw new Error(
+        `${target.kind === "agent" ? "Agent" : "Workflow"} "${target.slug}" is missing in Lunnoa.`
+      );
+    }
+    const entry = bucket[folderOf(target.kind)][remote.slug];
+    const hash = await hashOnDisk(request.definitionsDir, target.kind, remote.slug);
+    if (entry && entry.revision === remote.revision) {
+      skipped.push(labelOf(target.kind, remote.slug));
+      continue;
+    }
+    const localChanged = hash !== void 0 && (!entry || hash !== entry.fileHash);
+    const serverChanged = !entry || entry.revision !== remote.revision;
+    if (localChanged && serverChanged && !request.force) {
+      warnSecrets(target.kind, remote.slug, remote.definition);
+      const local = await readLocalText(request.definitionsDir, target.kind, remote.slug) ?? "";
+      conflicts.push(
+        formatConflict(
+          labelOf(target.kind, remote.slug),
+          local,
+          serverText(request.definitionsDir, request.projectRoot, remote)
+        )
+      );
+      continue;
+    }
+    writes.push(remote);
+  }
+  if (conflicts.length) {
+    throw new SyncConflictError(
+      `Local and server both changed. Run pull --force to overwrite.
+
+${conflicts.join("\n\n")}`
+    );
+  }
+  const written = [];
+  for (const remote of writes) {
+    warnSecrets(remote.kind, remote.slug, remote.definition);
+    const fileHash = remote.kind === "agent" ? await writeAgentDefinition(
+      request.definitionsDir,
+      request.projectRoot,
+      remote.definition
+    ) : await writeWorkflowDefinition(
+      request.definitionsDir,
+      request.projectRoot,
+      remote.definition
+    );
+    bucket[folderOf(remote.kind)][remote.slug] = {
+      id: remote.id,
+      revision: remote.revision,
+      fileHash
+    };
+    written.push(labelOf(remote.kind, remote.slug));
+  }
+  if (written.length) await writeLock(request.definitionsDir, lock);
+  return { written, skipped };
+}
+async function resolvePushFiles(root, selector) {
+  if (selector.scope === "all") {
+    return (await listDefinitionFiles(root)).map((file) => ({
+      kind: file.kind,
+      path: file.path
+    }));
+  }
+  if (selector.file) return [{ kind: selector.kind, path: resolve2(selector.file) }];
+  if (selector.kind && selector.slug) {
+    return [
+      {
+        kind: selector.kind,
+        path: resolve2(root, folderOf(selector.kind), `${selector.slug}.json`)
+      }
+    ];
+  }
+  if (!selector.slug) throw new Error("Missing definition to push.");
+  const found = (await listDefinitionFiles(root)).filter((file) => file.slug === selector.slug);
+  if (found.length === 0) throw new Error(`No definition file for "${selector.slug}".`);
+  if (found.length > 1) {
+    throw new Error(
+      `Slug "${selector.slug}" matches an agent and a workflow. Use agents/${selector.slug} or workflows/${selector.slug}.`
+    );
+  }
+  return [{ kind: found[0].kind, path: found[0].path }];
+}
+async function pushResources(request, selector) {
+  const context = await request.client.codeSync.context();
+  const key = deploymentKey(request.client.http.baseUrl, context.workspaceId);
+  const lock = await readLock(request.definitionsDir);
+  const bucket = lockBucket(lock, key);
+  const files = await resolvePushFiles(request.definitionsDir, selector);
+  const pushed = [];
+  for (const file of files) {
+    const loaded = await loadDefinitionForPush(request.definitionsDir, file.path);
+    if (file.kind && loaded.kind !== file.kind) {
+      throw new Error(`Expected a ${file.kind} definition, found ${loaded.kind}.`);
+    }
+    const slug = loaded.definition.slug;
+    const entry = bucket[folderOf(loaded.kind)][slug];
+    const options = {
+      codeSource: "synced",
+      ...entry ? { baseRevision: entry.revision } : {},
+      ...request.force ? { force: true } : {}
+    };
+    let id = "";
+    let revision = "";
+    let definition;
+    try {
+      if (loaded.kind === "workflow") {
+        const result = await request.client.workflows.upsertBySlug(
+          loaded.definition,
+          options
+        );
+        id = result.id;
+        revision = result.revision;
+        definition = result.definition;
+      } else {
+        const result = await request.client.agents.upsertBySlug(
+          loaded.definition,
+          options
+        );
+        id = result.id;
+        revision = result.revision;
+        definition = result.definition;
+      }
+    } catch (error) {
+      if (error instanceof LunnoaApiError && error.status === 409) {
+        throw new Error(publicApiMessage(error));
+      }
+      throw error;
+    }
+    const fileHash = loaded.kind === "agent" ? await writeAgentDefinition(
+      request.definitionsDir,
+      request.projectRoot,
+      definition
+    ) : await writeWorkflowDefinition(
+      request.definitionsDir,
+      request.projectRoot,
+      definition
+    );
+    bucket[folderOf(loaded.kind)][definition.slug || slug] = { id, revision, fileHash };
+    await writeLock(request.definitionsDir, lock);
+    pushed.push(labelOf(loaded.kind, definition.slug || slug));
+  }
+  return { pushed };
+}
+function localState(exists, hash, entry) {
+  if (!exists) return "missing";
+  if (!entry) return "new";
+  return hash === entry.fileHash ? "unchanged" : "modified";
+}
+function remoteState(remote, entry) {
+  if (!remote) return "missing in Lunnoa";
+  if (entry && entry.revision === remote.revision) return "unchanged";
+  return "changed in UI";
+}
+function isConflict(local, remote) {
+  if (local === "new" && remote === "missing in Lunnoa") return false;
+  if (local === "missing" && remote === "missing in Lunnoa") return false;
+  return local !== "unchanged" && remote !== "unchanged";
+}
+async function statusResources(request) {
+  const context = await request.client.codeSync.context();
+  const key = deploymentKey(request.client.http.baseUrl, context.workspaceId);
+  const lock = await readLock(request.definitionsDir);
+  const dep = lock.deployments[key];
+  const items = /* @__PURE__ */ new Map();
+  for (const slug of Object.keys(dep?.workflows ?? {})) {
+    items.set(`workflow:${slug}`, { kind: "workflow", slug });
+  }
+  for (const slug of Object.keys(dep?.agents ?? {})) {
+    items.set(`agent:${slug}`, { kind: "agent", slug });
+  }
+  for (const file of await listDefinitionFiles(request.definitionsDir)) {
+    items.set(`${file.kind}:${file.slug}`, { kind: file.kind, slug: file.slug });
+  }
+  const ordered = [...items.values()].sort((a, b) => {
+    if (a.kind !== b.kind) return a.kind === "workflow" ? -1 : 1;
+    return a.slug.localeCompare(b.slug);
+  });
+  const rows = [];
+  for (const item of ordered) {
+    const remote = await fetchDefinition(request.client, item.kind, item.slug);
+    const hash = await hashOnDisk(request.definitionsDir, item.kind, item.slug);
+    const entry = dep?.[folderOf(item.kind)]?.[item.slug];
+    const local = localState(hash !== void 0, hash, entry);
+    const remoteLabel = remoteState(remote, entry);
+    rows.push({
+      kind: item.kind,
+      slug: item.slug,
+      local,
+      remote: remoteLabel,
+      conflict: isConflict(local, remoteLabel)
+    });
+  }
+  return rows;
+}
+
 // src/cli/catalog.ts
 function asRecord(value) {
   if (value && typeof value === "object" && !Array.isArray(value)) {
@@ -2567,44 +3595,6 @@ function actionDetail(action) {
   };
 }
 
-// src/cli/print.ts
-function printJson(value) {
-  console.log(JSON.stringify(value, null, 2));
-}
-function formatTable(rows, columns) {
-  if (rows.length === 0) {
-    return "No results.";
-  }
-  const widths = columns.map((col) => {
-    let width = col.header.length;
-    for (const row of rows) {
-      width = Math.max(width, stringifyCell(row[col.key]).length);
-    }
-    return width;
-  });
-  const header = columns.map((col, i) => pad(col.header, widths[i])).join("  ");
-  const divider = widths.map((w) => "-".repeat(w)).join("  ");
-  const body = rows.map(
-    (row) => columns.map((col, i) => pad(stringifyCell(row[col.key]), widths[i])).join("  ")
-  );
-  return [header, divider, ...body].join("\n");
-}
-function printTable(rows, columns) {
-  console.log(formatTable(rows, columns));
-}
-function stringifyCell(value) {
-  if (value === null || value === void 0) {
-    return "";
-  }
-  if (typeof value === "boolean") {
-    return value ? "yes" : "no";
-  }
-  return String(value);
-}
-function pad(value, width) {
-  return value.length >= width ? value : `${value}${" ".repeat(width - value.length)}`;
-}
-
 // src/cli/discover.ts
 function requireTarget(args, label) {
   const value = args.path?.trim();
@@ -2845,13 +3835,13 @@ async function runConnectionsGet(client, args) {
 }
 async function runAgentsList(client, args) {
   const agents = await client.agents.list({
-    expansion: ["description", "slug", "managedByCode"]
+    expansion: ["description", "slug", "codeSource"]
   });
   const rows = agents.map((agent) => ({
     id: agent.id,
     name: agent.name,
     slug: agent.slug ?? "",
-    managedByCode: Boolean(agent.managedByCode),
+    codeSource: agent.codeSource ?? "none",
     description: agent.description ?? ""
   }));
   if (args.json) {
@@ -2862,19 +3852,19 @@ async function runAgentsList(client, args) {
     { key: "id", header: "ID" },
     { key: "slug", header: "SLUG" },
     { key: "name", header: "NAME" },
-    { key: "managedByCode", header: "CODE" }
+    { key: "codeSource", header: "SOURCE" }
   ]);
 }
 async function runWorkflowsList(client, args) {
   const workflows = await client.workflows.list({
-    expansion: ["description", "isActive", "slug", "managedByCode"]
+    expansion: ["description", "isActive", "slug", "codeSource"]
   });
   const rows = workflows.map((workflow) => ({
     id: workflow.id,
     name: workflow.name,
     slug: workflow.slug ?? "",
     isActive: Boolean(workflow.isActive),
-    managedByCode: Boolean(workflow.managedByCode)
+    codeSource: workflow.codeSource ?? "none"
   }));
   if (args.json) {
     printJson(rows);
@@ -2885,7 +3875,7 @@ async function runWorkflowsList(client, args) {
     { key: "slug", header: "SLUG" },
     { key: "name", header: "NAME" },
     { key: "isActive", header: "ACTIVE" },
-    { key: "managedByCode", header: "CODE" }
+    { key: "codeSource", header: "SOURCE" }
   ]);
 }
 async function runEntityTypesList(client, args) {
@@ -3361,7 +4351,7 @@ function typedAgentAccessor(client: LunnoaClient, agentId: string) {
 
 // src/cli/load-definition.ts
 import { pathToFileURL } from "url";
-import { resolve } from "path";
+import { resolve as resolve3 } from "path";
 import { access } from "fs/promises";
 import { constants as fsConstants } from "fs";
 async function fileExists(path) {
@@ -3373,7 +4363,7 @@ async function fileExists(path) {
   }
 }
 async function loadDefinitionModule(pathArg) {
-  const absolute = resolve(process.cwd(), pathArg);
+  const absolute = resolve3(process.cwd(), pathArg);
   if (!await fileExists(absolute)) {
     throw new Error(`Definition file not found: ${absolute}`);
   }
@@ -3429,21 +4419,22 @@ async function loadOptionalConfig() {
     "lunnoa.config.json"
   ];
   for (const name of candidates) {
-    const absolute = resolve(process.cwd(), name);
+    const absolute = resolve3(process.cwd(), name);
     if (!await fileExists(absolute)) {
       continue;
     }
     if (name.endsWith(".json")) {
-      const { readFile: readFile2 } = await import("fs/promises");
-      const raw = await readFile2(absolute, "utf8");
+      const { readFile: readFile3 } = await import("fs/promises");
+      const raw = await readFile3(absolute, "utf8");
       const cfg2 = JSON.parse(raw);
-      return { url: cfg2.url, apiKey: cfg2.apiKey };
+      return { url: cfg2.url, apiKey: cfg2.apiKey, definitionsDir: cfg2.definitionsDir };
     }
     const mod = await import(pathToFileURL(absolute).href);
     const cfg = mod.default ?? mod;
     return {
       url: cfg.url,
-      apiKey: cfg.apiKey
+      apiKey: cfg.apiKey,
+      definitionsDir: cfg.definitionsDir
     };
   }
   return {};
@@ -3451,8 +4442,8 @@ async function loadOptionalConfig() {
 
 // src/cli/init.ts
 import { spawn } from "child_process";
-import { cp, mkdir, readdir, readFile, stat, writeFile } from "fs/promises";
-import { basename, join, resolve as resolve2 } from "path";
+import { cp, mkdir as mkdir2, readdir as readdir2, readFile as readFile2, stat, writeFile as writeFile2 } from "fs/promises";
+import { basename, join as join2, resolve as resolve4 } from "path";
 import { createInterface } from "readline/promises";
 var DEFAULT_TEMPLATE = "lunnoa-automate/lunnoa-starter";
 var SKIP_LOCAL = /* @__PURE__ */ new Set(["node_modules", ".next", ".git", ".env", ".claude", ".cursor"]);
@@ -3505,14 +4496,14 @@ async function runInit(args) {
   if (!args.path) {
     throw new Error("Missing project directory. Example: init my-app --url https://lunnoa.example");
   }
-  const dest = resolve2(process.cwd(), args.path);
-  if ((await readdir(dest).catch(() => [])).length > 0) {
+  const dest = resolve4(process.cwd(), args.path);
+  if ((await readdir2(dest).catch(() => [])).length > 0) {
     throw new Error(`${dest} already exists and is not empty.`);
   }
-  await mkdir(dest, { recursive: true });
+  await mkdir2(dest, { recursive: true });
   const template = args.template ?? DEFAULT_TEMPLATE;
-  if (await isDirectory(resolve2(template))) {
-    await cp(resolve2(template), dest, {
+  if (await isDirectory(resolve4(template))) {
+    await cp(resolve4(template), dest, {
       recursive: true,
       filter: (src) => !SKIP_LOCAL.has(basename(src))
     });
@@ -3527,9 +4518,9 @@ async function runInit(args) {
     apiKey ||= (await rl.question("API key lna_... (CLI only: discovery, codegen, deploy. Enter to skip): ")).trim();
     rl.close();
   }
-  const example = await readFile(join(dest, ".env.example"), "utf8").catch(() => "");
-  await writeFile(
-    join(dest, ".env"),
+  const example = await readFile2(join2(dest, ".env.example"), "utf8").catch(() => "");
+  await writeFile2(
+    join2(dest, ".env"),
     setEnvValues(dropRetiredProjectEnv(example), {
       LUNNOA_URL: url,
       LUNNOA_API_KEY: apiKey
@@ -3551,18 +4542,18 @@ Next steps:`);
 
 // src/cli/skills.ts
 import { cp as cp2 } from "fs/promises";
-import { dirname, resolve as resolve3 } from "path";
+import { dirname as dirname2, resolve as resolve5 } from "path";
 import { fileURLToPath } from "url";
 var SKILL_TARGETS = [".claude/skills", ".cursor/skills"];
-var BUNDLED_SKILLS_DIR = resolve3(
-  dirname(fileURLToPath(import.meta.url)),
+var BUNDLED_SKILLS_DIR = resolve5(
+  dirname2(fileURLToPath(import.meta.url)),
   "..",
   "skills"
 );
 async function installSkills(projectDir, sourceDir = BUNDLED_SKILLS_DIR) {
   const written = [];
   for (const target of SKILL_TARGETS) {
-    const dest = resolve3(projectDir, target);
+    const dest = resolve5(projectDir, target);
     await cp2(sourceDir, dest, { recursive: true, force: true });
     written.push(dest);
   }
@@ -3572,6 +4563,11 @@ async function installSkills(projectDir, sourceDir = BUNDLED_SKILLS_DIR) {
 // src/cli/index.ts
 async function bindClient(args) {
   const fileConfig = await loadOptionalConfig();
+  const projectRoot = process.cwd();
+  const definitionsDir = resolve6(
+    projectRoot,
+    args.dir ?? fileConfig.definitionsDir ?? "lunnoa"
+  );
   const url = args.url ?? process.env.LUNNOA_URL ?? fileConfig.url;
   const apiKey = args.apiKey ?? process.env.LUNNOA_API_KEY ?? fileConfig.apiKey;
   const accessToken = args.accessToken;
@@ -3585,9 +4581,114 @@ async function bindClient(args) {
   }
   return {
     client: new LunnoaClient({ baseUrl: url, apiKey, accessToken }),
-    url
+    url,
+    definitionsDir,
+    projectRoot
   };
 }
+function resourceSelector(path) {
+  const normalized = path.replace(/\\/g, "/");
+  const file = /^(?:.*\/)?(agents|workflows)\/([^/]+)\.json$/.exec(normalized);
+  if (file) {
+    return {
+      kind: file[1] === "agents" ? "agent" : "workflow",
+      slug: file[2],
+      file: path
+    };
+  }
+  const prefixed = /^(agents|workflows)\/([^/]+)$/.exec(normalized);
+  if (prefixed) {
+    return {
+      kind: prefixed[1] === "agents" ? "agent" : "workflow",
+      slug: prefixed[2]
+    };
+  }
+  if (normalized.endsWith(".json") || normalized.includes("/")) {
+    return { slug: "", file: path };
+  }
+  return { slug: normalized };
+}
+function pullSelector(args) {
+  if (args.all && args.path) {
+    throw new Error("pull --all does not take a slug.");
+  }
+  if (args.all || !args.path) {
+    return args.all ? { scope: "all" } : { scope: "tracked" };
+  }
+  const parsed = resourceSelector(args.path);
+  if (parsed.file && !parsed.kind) {
+    throw new Error("Pass a slug, agents/<slug>, or workflows/<slug>.");
+  }
+  return { scope: "one", kind: parsed.kind, slug: parsed.slug };
+}
+function pushSelector(args, deploy) {
+  if (deploy) return { scope: "one", kind: deploy.kind, file: deploy.file };
+  if (args.all && args.path) {
+    throw new Error("push --all does not take a path.");
+  }
+  if (!args.path) return { scope: "all" };
+  const parsed = resourceSelector(args.path);
+  if (parsed.file) return { scope: "one", kind: parsed.kind, file: parsed.file };
+  return { scope: "one", kind: parsed.kind, slug: parsed.slug };
+}
+async function runPull(args) {
+  const bound = await bindClient(args);
+  const report = await pullResources(
+    {
+      client: bound.client,
+      definitionsDir: bound.definitionsDir,
+      projectRoot: bound.projectRoot,
+      force: args.force
+    },
+    pullSelector(args)
+  );
+  if (report.written.length === 0) {
+    console.log("Nothing to pull.");
+    return;
+  }
+  for (const file of report.written) console.log(`Pulled ${file}`);
+}
+async function runPush(args, deploy) {
+  const bound = await bindClient(args);
+  const report = await pushResources(
+    {
+      client: bound.client,
+      definitionsDir: bound.definitionsDir,
+      projectRoot: bound.projectRoot,
+      force: args.force
+    },
+    pushSelector(args, deploy)
+  );
+  for (const file of report.pushed) console.log(`Pushed ${file}`);
+}
+async function runStatus(args) {
+  const bound = await bindClient(args);
+  const rows = await statusResources({
+    client: bound.client,
+    definitionsDir: bound.definitionsDir,
+    projectRoot: bound.projectRoot
+  });
+  if (args.json) {
+    printJson(rows);
+    return;
+  }
+  printTable(
+    rows.map((row) => ({
+      kind: row.kind,
+      slug: row.slug,
+      local: row.local,
+      remote: row.remote,
+      conflict: row.conflict
+    })),
+    [
+      { key: "kind", header: "KIND" },
+      { key: "slug", header: "SLUG" },
+      { key: "local", header: "LOCAL" },
+      { key: "remote", header: "REMOTE" },
+      { key: "conflict", header: "CONFLICT" }
+    ]
+  );
+}
 async function fetchDefinitions(client, baseUrl) {
   const entityTypes = await client.entityTypes.list({
     expansion: ["attributeSchema", "stateSchema", "description"]
@@ -3622,16 +4723,20 @@ async function runCodegen(args) {
     `Found ${definitions.entityTypes.length} entity type(s), ${definitions.workflows.length} workflow(s), ${definitions.agents.length} agent(s).`
   );
   const moduleSource = generateDeploymentModule(definitions);
-  const outDir = resolve4(process.cwd(), args.out);
-  await mkdir2(outDir, { recursive: true });
-  const outFile = resolve4(outDir, "lunnoa.generated.ts");
-  await writeFile2(outFile, moduleSource, "utf8");
+  const outDir = resolve6(process.cwd(), args.out);
+  await mkdir3(outDir, { recursive: true });
+  const outFile = resolve6(outDir, "lunnoa.generated.ts");
+  await writeFile3(outFile, moduleSource, "utf8");
   console.log(`Wrote ${outFile}`);
 }
 async function deployWorkflow(args) {
   if (!args.path) {
     throw new Error("Missing definition path. Example: workflows deploy ./workflow.ts");
   }
+  if (args.path.endsWith(".json")) {
+    await runPush(args, { kind: "workflow", file: args.path });
+    return;
+  }
   const { client } = await bindClient(args);
   const mod = await loadDefinitionModule(args.path);
   const def = pickWorkflowDefinition(mod);
@@ -3644,6 +4749,10 @@ async function deployAgent(args) {
   if (!args.path) {
     throw new Error("Missing definition path. Example: agents deploy ./agent.ts");
   }
+  if (args.path.endsWith(".json")) {
+    await runPush(args, { kind: "agent", file: args.path });
+    return;
+  }
   const { client } = await bindClient(args);
   const mod = await loadDefinitionModule(args.path);
   const def = pickAgentDefinition(mod);
@@ -3785,8 +4894,12 @@ async function runDiscovery(args) {
   }
   return false;
 }
-async function main() {
-  const args = parseArgs(process.argv.slice(2));
+function reportCliError(error) {
+  console.error(error instanceof Error ? error.message : error);
+  process.exitCode = 1;
+}
+async function run(argv) {
+  const args = parseArgs(argv);
   try {
     process.loadEnvFile();
   } catch {
@@ -3800,7 +4913,7 @@ async function main() {
     return;
   }
   if (args.command === "skills" && args.subcommand === "install") {
-    const written = await installSkills(resolve4(process.cwd(), args.path ?? "."));
+    const written = await installSkills(resolve6(process.cwd(), args.path ?? "."));
     for (const dest of written) {
       console.log(`Installed Lunnoa skills into ${dest}`);
     }
@@ -3810,6 +4923,18 @@ async function main() {
     await runCodegen(args);
     return;
   }
+  if (args.command === "pull") {
+    await runPull(args);
+    return;
+  }
+  if (args.command === "push") {
+    await runPush(args);
+    return;
+  }
+  if (args.command === "status") {
+    await runStatus(args);
+    return;
+  }
   if (await runDiscovery(args)) {
     return;
   }
@@ -3830,7 +4955,17 @@ async function main() {
   console.log(USAGE);
   process.exitCode = 1;
 }
-main().catch((error) => {
-  console.error(error instanceof Error ? error.message : error);
-  process.exitCode = 1;
-});
+async function main() {
+  try {
+    await run(process.argv.slice(2));
+  } catch (error) {
+    reportCliError(error);
+  }
+}
+if (process.env.VITEST !== "true") {
+  void main();
+}
+export {
+  reportCliError,
+  run
+};