@monoes/monomindcli 2.7.15 → 2.7.17

package/dist/src/commands/org-observe.d.ts

@@ -3,9 +3,9 @@ import type { CommandContext, CommandResult } from '../types.js';
  * perform — plus the structural invariants the runtime assumes but the schema can't
  * express (single root role, resolvable reports_to, unique ids, parseable schedule). */
 export declare const validateAction: (ctx: CommandContext) => Promise<CommandResult>;
-/** `org logs <name> [--run id] [--role r] [--follow]` — formatted bus.jsonl tail. */
+/** `org logs <name> [--run id] [--role r] [--filter-tool t] [--filter-role r] [--tools-only] [--audit-filter allow|deny] [--follow]` — formatted bus.jsonl tail. */
 export declare const logsAction: (ctx: CommandContext, name: string) => Promise<CommandResult>;
-/** `org report <name> [--run id] [--all]` — summarize a run (or list run history). */
+/** `org report <name> [--run id] [--all] [--by-role] [--format mermaid]` — summarize a run (or list run history). */
 export declare const reportAction: (ctx: CommandContext, name: string) => Promise<CommandResult>;
 /** `org questions <name> [--all]` — list pending (or all) ask_human questions. */
 export declare const questionsAction: (ctx: CommandContext, name: string) => Promise<CommandResult>;
@@ -15,4 +15,20 @@ export declare const questionsAction: (ctx: CommandContext, name: string) => Pro
 export declare const answerAction: (ctx: CommandContext, name: string) => Promise<CommandResult>;
 /** `org create <name> --template <t> [--goal g] [--schedule s]` — scaffold a config from a template. */
 export declare const createAction: (ctx: CommandContext, name: string) => Promise<CommandResult>;
+/** `org costs <name> [--run id]` — show per-role cost tracking from runtime.json */
+export declare const costsAction: (ctx: CommandContext, name: string) => Promise<CommandResult>;
+/** `org flow <name> [--run id]` — export org flow as Mermaid diagram */
+export declare const flowAction: (ctx: CommandContext, name: string) => Promise<CommandResult>;
+/** `org approve <org> <role> <action>` — approve a pending tool/action approval */
+export declare const approveAction: (ctx: CommandContext, name: string) => Promise<CommandResult>;
+/** `org deny <org> <role> <action>` — deny a pending tool/action approval */
+export declare const denyAction: (ctx: CommandContext, name: string) => Promise<CommandResult>;
+/** `org replay <org> <run-id>` — time-travel debugging: resume from checkpoint */
+export declare const replayAction: (ctx: CommandContext, name: string) => Promise<CommandResult>;
+/** `org resume-from <org> <run-id>` — resume from checkpoint (alias for replay) */
+export declare const resumeFromAction: (ctx: CommandContext, name: string) => Promise<CommandResult>;
+/** `org branch <org> <run-id> <branch-name>` — create a branch from checkpoint for what-if experiments */
+export declare const branchAction: (ctx: CommandContext, name: string) => Promise<CommandResult>;
+/** `org decisions <org> [--run id]` — show Rifft-style decision traces */
+export declare const decisionsAction: (ctx: CommandContext, name: string) => Promise<CommandResult>;
 //# sourceMappingURL=org-observe.d.ts.map

package/dist/src/commands/org-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-observe.d.ts","sourceRoot":"","sources":["../../../src/commands/org-observe.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAUjE;;wFAEwF;AACxF,eAAO,MAAM,cAAc,QAAe,cAAc,KAAG,OAAO,CAAC,aAAa,CAyC/E,CAAC;AAWF,qFAAqF;AACrF,eAAO,MAAM,UAAU,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CAkCzF,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,YAAY,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CAkD3F,CAAC;AA4BF,kFAAkF;AAClF,eAAO,MAAM,eAAe,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CAqB9F,CAAC;AAEF;;oFAEoF;AACpF,eAAO,MAAM,YAAY,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CAoF3F,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,YAAY,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CAwB3F,CAAC"}
+{"version":3,"file":"org-observe.d.ts","sourceRoot":"","sources":["../../../src/commands/org-observe.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAUjE;;wFAEwF;AACxF,eAAO,MAAM,cAAc,QAAe,cAAc,KAAG,OAAO,CAAC,aAAa,CAyC/E,CAAC;AAWF,oKAAoK;AACpK,eAAO,MAAM,UAAU,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CA0CzF,CAAC;AAEF,qHAAqH;AACrH,eAAO,MAAM,YAAY,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CAoJ3F,CAAC;AA4BF,kFAAkF;AAClF,eAAO,MAAM,eAAe,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CAqB9F,CAAC;AAEF;;oFAEoF;AACpF,eAAO,MAAM,YAAY,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CAoF3F,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,YAAY,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CAwB3F,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,WAAW,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CA+E1F,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,UAAU,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CAgDzF,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,aAAa,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CA6B5F,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,UAAU,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CA6BzF,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,YAAY,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CAgC3F,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,gBAAgB,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CAQ/F,CAAC;AAEF,0GAA0G;AAC1G,eAAO,MAAM,YAAY,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CAmC3F,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,eAAe,QAAe,cAAc,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CAuC9F,CAAC"}

package/dist/src/commands/org-observe.js

@@ -1,7 +1,7 @@
 // packages/@monomind/cli/src/commands/org-observe.ts
 // Read-side org subcommands (logs / report) + template scaffolding (create).
 // Kept out of org.ts to respect the 500-line file ceiling.
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { output } from '../output.js';
 import { ORG_DIR, OrgDefSchema } from '../orgrt/types.js';
@@ -73,19 +73,31 @@ const resolveRun = (cwd, name, runFlag) => {
         return RUN_ID_RE.test(runFlag) ? runFlag : null;
     return listRunDirs(cwd, name)[0] ?? null;
 };
-/** `org logs <name> [--run id] [--role r] [--follow]` — formatted bus.jsonl tail. */
+/** `org logs <name> [--run id] [--role r] [--filter-tool t] [--filter-role r] [--tools-only] [--audit-filter allow|deny] [--follow]` — formatted bus.jsonl tail. */
 export const logsAction = async (ctx, name) => {
     const run = resolveRun(ctx.cwd, name, ctx.flags['run']);
     if (!run)
         return { success: false, message: `no runs found for org ${name} — start one with: monomind org run ${name}` };
     const file = join(ctx.cwd, ORG_DIR, name, run, 'bus.jsonl');
     const roleFilter = typeof ctx.flags['role'] === 'string' ? ctx.flags['role'] : null;
+    const filterTool = typeof ctx.flags['filter-tool'] === 'string' ? ctx.flags['filter-tool'] : null;
+    const filterRole = typeof ctx.flags['filter-role'] === 'string' ? ctx.flags['filter-role'] : null;
+    const auditFilter = typeof ctx.flags['audit-filter'] === 'string' ? ctx.flags['audit-filter'] : null;
+    const toolsOnly = ctx.flags['tools-only'] === true;
     const show = (e) => {
+        if (toolsOnly && e.type !== 'tool')
+            return;
         if (roleFilter && e.from !== roleFilter && e.to !== roleFilter)
             return;
+        if (filterTool && e.tool !== filterTool)
+            return;
+        if (filterRole && e.from !== filterRole)
+            return;
+        if (auditFilter && e.type === 'tool' && e.decision !== auditFilter)
+            return;
         log(formatEvent(e));
     };
-    log(output.info(`org ${name} — ${run}${roleFilter ? ` (role: ${roleFilter})` : ''}`));
+    log(output.info(`org ${name} — ${run}${roleFilter ? ` (role: ${roleFilter})` : ''}${filterTool ? ` (tool: ${filterTool})` : ''}${filterRole ? ` (filter-role: ${filterRole})` : ''}${auditFilter ? ` (audit-filter: ${auditFilter})` : ''}`));
     let seenLines = 0;
     const drain = () => {
         if (!existsSync(file))
@@ -117,7 +129,7 @@ export const logsAction = async (ctx, name) => {
     });
     return { success: true };
 };
-/** `org report <name> [--run id] [--all]` — summarize a run (or list run history). */
+/** `org report <name> [--run id] [--all] [--by-role] [--format mermaid]` — summarize a run (or list run history). */
 export const reportAction = async (ctx, name) => {
     if (ctx.flags['all'] === true) {
         const history = readHistory(ctx.cwd, name);
@@ -138,6 +150,90 @@ export const reportAction = async (ctx, name) => {
     if (!events.length)
         return { success: false, message: `run ${run} has no recorded events` };
     const s = summarizeRun(events);
+    // Mermaid flowchart (--format mermaid flag)
+    if (ctx.flags['format'] === 'mermaid') {
+        // Extract message flow from events
+        const messageEvents = events.filter(e => e.type === 'message' || e.type === 'xorg');
+        const roleSet = new Set();
+        const edges = new Set();
+        for (const e of messageEvents) {
+            if (e.from) {
+                const fromRole = e.from.includes(':') ? e.from.split(':')[1] : e.from;
+                roleSet.add(fromRole);
+                if (e.to) {
+                    const toRole = e.to.includes(':') ? e.to.split(':')[1] : e.to;
+                    roleSet.add(toRole);
+                    const edge = `${fromRole} -->|${e.subject || 'msg'}| ${toRole}`;
+                    edges.add(edge);
+                }
+            }
+        }
+        const roles = Array.from(roleSet).sort();
+        log(output.info(`flowchart TD`));
+        log(output.info(`  %% Org flow for ${name} / ${run}`));
+        log(output.info(`  %% ${messageEvents.length} messages exchanged`));
+        log(output.info(`  `));
+        // Define role nodes with styling
+        for (const role of roles) {
+            log(output.info(`  ${role}[${role}]`));
+        }
+        log(output.info(`  `));
+        // Add edges for messages
+        for (const edge of edges) {
+            log(output.info(`  ${edge}`));
+        }
+        log(output.info(`  `));
+        log(output.info(`classDef bossNode fill:#f9f,stroke:#333,stroke-width:2px`));
+        log(output.info(`classDef workerNode fill:#bbf,stroke:#333,stroke-width:1px`));
+        return { success: true, message: `Mermaid flowchart exported for ${name} / ${run}` };
+    }
+    // Tool audit filter (--audit flag) - show only tool decision events
+    if (ctx.flags['audit'] === true) {
+        let toolEvents = events.filter(e => e.type === 'tool');
+        // Optional --tool flag filters to a specific tool name
+        if (typeof ctx.flags['tool'] === 'string' && ctx.flags['tool']) {
+            const toolName = ctx.flags['tool'];
+            toolEvents = toolEvents.filter(e => e.tool === toolName);
+        }
+        if (!toolEvents.length) {
+            const toolFilter = typeof ctx.flags['tool'] === 'string' ? ` for tool "${ctx.flags['tool']}"` : '';
+            log(output.info(`No tool events found${toolFilter} in ${run}`));
+            return { success: true };
+        }
+        log(output.info(`Tool audit trail for ${name} / ${run} (${toolEvents.length} events):`));
+        log(output.info('┌──────────────────┬─────────────────────────┬──────────┬──────────────────────────────────────┐'));
+        log(output.info('│ Role             │ Tool                    │ Decision │ Reason                                │'));
+        log(output.info('├──────────────────┼─────────────────────────┼──────────┼──────────────────────────────────────┤'));
+        for (const e of toolEvents) {
+            const role = e.from ?? 'system';
+            const tool = e.tool ?? 'unknown';
+            const decision = e.decision === 'deny' ? 'DENY' : 'ALLOW';
+            const reason = e.reason || '-';
+            log(output.info(`│ ${role.padEnd(16)} │ ${tool.padEnd(23)} │ ${decision.padEnd(8)} │ ${reason.padEnd(38)} │`));
+        }
+        log(output.info('└──────────────────┴─────────────────────────┴──────────┴──────────────────────────────────────┘'));
+        return { success: true };
+    }
+    // Per-role cost breakdown (--by-role flag)
+    if (ctx.flags['by-role'] === true) {
+        const byRole = new Map();
+        for (const [roleId, roleStats] of Object.entries(s.roles)) {
+            const acc = byRole.get(roleId) ?? { cost: 0, tokens: 0, messages: 0 };
+            acc.cost += roleStats.costUsd ?? 0;
+            acc.tokens += roleStats.tokens;
+            acc.messages += roleStats.messagesSent;
+            byRole.set(roleId, acc);
+        }
+        log(output.info(`Per-role cost breakdown for ${name} / ${run}:`));
+        log(output.info('┌──────────────────┬───────────┬────────────┬───────────┐'));
+        log(output.info('│ Role             │ Cost ($)  │ Tokens     │ Messages │'));
+        log(output.info('├──────────────────┼───────────┼────────────┼───────────┤'));
+        for (const [roleId, data] of byRole) {
+            log(output.info(`│ ${roleId.padEnd(16)} │ ${(data.cost.toFixed(4)).padStart(9)} │ ${String(data.tokens).padStart(10)} │ ${String(data.messages).padStart(9)} │`));
+        }
+        log(output.info('└──────────────────┴───────────┴────────────┴───────────┘'));
+        return { success: true };
+    }
     // Per-role budget ceiling: same split the daemon applies (budget ÷ role count),
     // with any explicit policy.maxTokens override. Missing/unreadable config → no ceilings.
     let perRoleBudget = null;
@@ -167,7 +263,10 @@ export const reportAction = async (ctx, name) => {
         log(output.warning('  Outcome: not recorded (coordinator never called org_complete)'));
     log(output.info('  Roles:'));
     for (const [id, r] of Object.entries(s.roles)) {
-        log(output.info(`    ${r.crashed ? '✗' : '•'} ${id}: ${r.messagesSent} msgs, ${r.toolsAllowed} tools${r.toolsDenied ? ` (${r.toolsDenied} denied)` : ''}, ${r.tokens} tokens${budgetNote(id, r.tokens)}${r.crashed ? ' — CRASHED' : ''}`));
+        const wasCutShort = s.cutShort.includes(id);
+        const icon = r.crashed ? '✗' : wasCutShort ? '⊘' : '•';
+        const suffix = r.crashed ? ' — CRASHED' : wasCutShort ? ' — cut short by stop' : '';
+        log(output.info(`    ${icon} ${id}: ${r.messagesSent} msgs, ${r.toolsAllowed} tools${r.toolsDenied ? ` (${r.toolsDenied} denied)` : ''}, ${r.tokens} tokens${budgetNote(id, r.tokens)}${suffix}`));
     }
     if (s.assets.length) {
         log(output.info(`  Assets (${s.assets.length}):`));
@@ -350,4 +449,270 @@ export const createAction = async (ctx, name) => {
     log(output.info(`  Edit the goal/roles in ${file}, then: monomind org run ${name}`));
     return { success: true };
 };
+/** `org costs <name> [--run id]` — show per-role cost tracking from runtime.json */
+export const costsAction = async (ctx, name) => {
+    const run = resolveRun(ctx.cwd, name, ctx.flags['run']);
+    if (!run)
+        return { success: false, message: `no runs found for org ${name} — start one with: monomind org run ${name}` };
+    // Read runtime.json for the per-role metrics
+    const rtPath = join(ctx.cwd, ORG_DIR, name, 'runtime.json');
+    if (!existsSync(rtPath)) {
+        return { success: false, message: `no runtime state found for org ${name}` };
+    }
+    let rt;
+    try {
+        rt = JSON.parse(readFileSync(rtPath, 'utf8'));
+    }
+    catch (err) {
+        log(output.error(`Cannot read runtime.json: ${err instanceof Error ? err.message : String(err)}`));
+        return { success: false, message: 'runtime.json unreadable' };
+    }
+    if (rt?.run !== run) {
+        log(output.warning(`Note: runtime.json shows run ${rt?.run ?? 'unknown'} — showing metrics for requested run ${run} from history`));
+    }
+    // Also check the run summary for cost data
+    const events = readRunEvents(ctx.cwd, name, run);
+    const summary = events.length ? summarizeRun(events) : null;
+    log(output.info(`Per-role cost breakdown for ${name} / ${run}:`));
+    // Combine data from runtime.json (live metrics) and summary (historical)
+    const roleData = new Map();
+    // Add live metrics from runtime.json
+    if (rt?.roleMetrics) {
+        for (const [roleId, metrics] of Object.entries(rt.roleMetrics)) {
+            roleData.set(roleId, {
+                tokens: metrics.tokens,
+                costUsd: metrics.costUsd,
+                messages: 0
+            });
+        }
+    }
+    // Add historical data from summary if available
+    if (summary?.roles) {
+        for (const [roleId, roleStats] of Object.entries(summary.roles)) {
+            const existing = roleData.get(roleId) ?? { tokens: 0, costUsd: 0, messages: 0 };
+            roleData.set(roleId, {
+                tokens: existing.tokens || roleStats.tokens,
+                costUsd: existing.costUsd || roleStats.costUsd,
+                messages: roleStats.messagesSent
+            });
+        }
+    }
+    if (roleData.size === 0) {
+        log(output.info(`No role metrics available yet — metrics populate as agents use tokens.`));
+        return { success: true };
+    }
+    log(output.info('┌──────────────────┬───────────┬────────────┬───────────┐'));
+    log(output.info('│ Role             │ Cost ($)  │ Tokens     │ Messages │'));
+    log(output.info('├──────────────────┼───────────┼────────────┼───────────┤'));
+    let totalCost = 0;
+    let totalTokens = 0;
+    let totalMessages = 0;
+    for (const [roleId, data] of roleData) {
+        log(output.info(`│ ${roleId.padEnd(16)} │ ${(data.costUsd.toFixed(4)).padStart(9)} │ ${String(data.tokens).padStart(10)} │ ${String(data.messages).padStart(9)} │`));
+        totalCost += data.costUsd;
+        totalTokens += data.tokens;
+        totalMessages += data.messages;
+    }
+    log(output.info('├──────────────────┼───────────┼────────────┼───────────┤'));
+    log(output.info(`│ ${('TOTAL').padEnd(16)} │ ${(totalCost.toFixed(4)).padStart(9)} │ ${String(totalTokens).padStart(10)} │ ${String(totalMessages).padStart(9)} │`));
+    log(output.info('└──────────────────┴───────────┴────────────┴───────────┘'));
+    return { success: true };
+};
+/** `org flow <name> [--run id]` — export org flow as Mermaid diagram */
+export const flowAction = async (ctx, name) => {
+    const run = resolveRun(ctx.cwd, name, ctx.flags['run']);
+    if (!run)
+        return { success: false, message: `no runs found for org ${name} — start one with: monomind org run ${name}` };
+    const events = readRunEvents(ctx.cwd, name, run);
+    if (!events.length)
+        return { success: false, message: `run ${run} has no recorded events` };
+    // Extract message flow from events
+    const messageEvents = events.filter(e => e.type === 'message' || e.type === 'xorg');
+    const roleSet = new Set();
+    const edges = new Set();
+    for (const e of messageEvents) {
+        if (e.from) {
+            const fromRole = e.from.includes(':') ? e.from.split(':')[1] : e.from;
+            roleSet.add(fromRole);
+            if (e.to) {
+                const toRole = e.to.includes(':') ? e.to.split(':')[1] : e.to;
+                roleSet.add(toRole);
+                const edge = `${fromRole} -->|${e.subject || 'msg'}| ${toRole}`;
+                edges.add(edge);
+            }
+        }
+    }
+    const roles = Array.from(roleSet).sort();
+    log(output.info(`flowchart TD`));
+    log(output.info(`  %% Org flow for ${name} / ${run}`));
+    log(output.info(`  %% ${messageEvents.length} messages exchanged`));
+    log(output.info(`  `));
+    // Define role nodes with styling
+    for (const role of roles) {
+        log(output.info(`  ${role}[${role}]`));
+    }
+    log(output.info(`  `));
+    // Add edges for messages
+    for (const edge of edges) {
+        log(output.info(`  ${edge}`));
+    }
+    log(output.info(`  `));
+    log(output.info(`classDef bossNode fill:#f9f,stroke:#333,stroke-width:2px`));
+    log(output.info(`classDef workerNode fill:#bbf,stroke:#333,stroke-width:1px`));
+    return { success: true, message: `Mermaid flowchart exported for ${name} / ${run}` };
+};
+/** `org approve <org> <role> <action>` — approve a pending tool/action approval */
+export const approveAction = async (ctx, name) => {
+    const role = ctx.args[1];
+    const action = ctx.args[2];
+    if (!role || !action) {
+        return { success: false, message: 'usage: org approve <org> <role> <action>' };
+    }
+    // Check if approvals.json exists
+    const approvalsPath = join(ctx.cwd, ORG_DIR, name, 'approvals.json');
+    if (!existsSync(approvalsPath)) {
+        return { success: false, message: `no pending approvals for org ${name}` };
+    }
+    // Load approvals
+    const data = JSON.parse(readFileSync(approvalsPath, 'utf8'));
+    const pending = data.approvals ?? [];
+    const item = pending.find((a) => a.roleId === role && a.question === action);
+    if (!item) {
+        return { success: false, message: `no pending approval found for role ${role} action ${action}` };
+    }
+    // Update approval state
+    item.approved = true;
+    item.ts = Date.now();
+    writeFileSync(approvalsPath, JSON.stringify({ approvals: pending }, null, 2));
+    log(output.success(`Approved: ${role} may execute ${action}`));
+    return { success: true, message: `approved ${action} for ${role}` };
+};
+/** `org deny <org> <role> <action>` — deny a pending tool/action approval */
+export const denyAction = async (ctx, name) => {
+    const role = ctx.args[1];
+    const action = ctx.args[2];
+    if (!role || !action) {
+        return { success: false, message: 'usage: org deny <org> <role> <action>' };
+    }
+    // Check if approvals.json exists
+    const approvalsPath = join(ctx.cwd, ORG_DIR, name, 'approvals.json');
+    if (!existsSync(approvalsPath)) {
+        return { success: false, message: `no pending approvals for org ${name}` };
+    }
+    // Load approvals
+    const data = JSON.parse(readFileSync(approvalsPath, 'utf8'));
+    const pending = data.approvals ?? [];
+    const item = pending.find((a) => a.roleId === role && a.question === action);
+    if (!item) {
+        return { success: false, message: `no pending approval found for role ${role} action ${action}` };
+    }
+    // Update approval state
+    item.approved = false;
+    item.ts = Date.now();
+    writeFileSync(approvalsPath, JSON.stringify({ approvals: pending }, null, 2));
+    log(output.info(`Denied: ${role} may NOT execute ${action}`));
+    return { success: true, message: `denied ${action} for ${role}` };
+};
+/** `org replay <org> <run-id>` — time-travel debugging: resume from checkpoint */
+export const replayAction = async (ctx, name) => {
+    const run = ctx.args[1];
+    if (!run) {
+        return { success: false, message: 'usage: org replay <org> <run-id>' };
+    }
+    const runDir = join(ctx.cwd, ORG_DIR, name, run);
+    if (!existsSync(runDir)) {
+        return { success: false, message: `run ${run} not found for org ${name}` };
+    }
+    const busFile = join(runDir, 'bus.jsonl');
+    if (!existsSync(busFile)) {
+        return { success: false, message: `no bus events found for run ${run}` };
+    }
+    log(output.info(`Resuming org ${name} from checkpoint ${run}...`));
+    // Create daemon and resume from checkpoint
+    const { OrgDaemon } = await import('../orgrt/daemon.js');
+    const daemon = new OrgDaemon(ctx.cwd, { forward: false });
+    const resumed = await daemon.resumeOrg(name);
+    if (!resumed) {
+        return { success: false, message: `resume failed - check runtime.json for ${name} is valid` };
+    }
+    log(output.success(`Org ${name} resumed from ${run} - ${resumed.agents.size} role(s) restored`));
+    log(output.info(`Use: monomind org logs ${name} --run ${resumed.run} to inspect events.`));
+    log(output.info(`Stop with: monomind org stop ${name}`));
+    return { success: true, message: `resumed from checkpoint ${run} as ${resumed.run}` };
+};
+/** `org resume-from <org> <run-id>` — resume from checkpoint (alias for replay) */
+export const resumeFromAction = async (ctx, name) => {
+    const run = ctx.args[1];
+    if (!run) {
+        return { success: false, message: 'usage: org resume-from <org> <run-id>' };
+    }
+    // Reuse replay logic
+    return replayAction(ctx, name);
+};
+/** `org branch <org> <run-id> <branch-name>` — create a branch from checkpoint for what-if experiments */
+export const branchAction = async (ctx, name) => {
+    const run = ctx.args[1];
+    const branchName = ctx.args[2];
+    if (!run || !branchName) {
+        return { success: false, message: 'usage: org branch <org> <run-id> <branch-name>' };
+    }
+    const runDir = join(ctx.cwd, ORG_DIR, name, run);
+    if (!existsSync(runDir)) {
+        return { success: false, message: `run ${run} not found for org ${name}` };
+    }
+    const branchRun = `branch-${new Date().toISOString().replace(/[-:T]/g, '').slice(0, 14)}-${Math.random().toString(36).slice(2, 6)}`;
+    const branchDir = join(ctx.cwd, ORG_DIR, name, branchRun);
+    try {
+        mkdirSync(branchDir, { recursive: true });
+        // Copy bus.jsonl to branch
+        const busFile = join(runDir, 'bus.jsonl');
+        if (existsSync(busFile)) {
+            const busContent = readFileSync(busFile, 'utf8');
+            writeFileSync(join(branchDir, 'bus.jsonl'), busContent);
+        }
+        // Create branch marker file
+        writeFileSync(join(branchDir, '.branch-source'), JSON.stringify({
+            from: run,
+            branchedAt: new Date().toISOString(),
+            name: branchName
+        }, null, 2));
+        log(output.success(`Created branch "${branchName}" from ${run} as ${branchRun}`));
+        return { success: true, message: `branch ${branchName} created as ${branchRun}` };
+    }
+    catch (err) {
+        return { success: false, message: `failed to create branch: ${err instanceof Error ? err.message : String(err)}` };
+    }
+};
+/** `org decisions <org> [--run id]` — show Rifft-style decision traces */
+export const decisionsAction = async (ctx, name) => {
+    const run = resolveRun(ctx.cwd, name, ctx.flags['run']);
+    if (!run) {
+        return { success: false, message: `no runs found for org ${name}` };
+    }
+    const events = readRunEvents(ctx.cwd, name, run);
+    if (!events.length) {
+        return { success: false, message: `run ${run} has no recorded events` };
+    }
+    // Filter decision trace events
+    const decisionEvents = events.filter(e => e.type === 'audit' &&
+        e.reason === 'decision-trace' &&
+        e.data &&
+        typeof e.data === 'object');
+    if (!decisionEvents.length) {
+        log(output.info(`No decision traces found in ${run}`));
+        return { success: true };
+    }
+    log(output.info(`Decision traces for ${name} / ${run} (${decisionEvents.length} decisions):`));
+    log(output.info('┌──────────────────┬─────────────┬────────────────────────────────────────┐'));
+    log(output.info('│ Role             │ Type        │ Context                                │'));
+    log(output.info('├──────────────────┼─────────────┼────────────────────────────────────────┤'));
+    for (const e of decisionEvents) {
+        const role = e.from ?? 'system';
+        const type = e.data.decisionType ?? 'unknown';
+        const context = e.data.context ?? '-';
+        log(output.info(`│ ${role.padEnd(16)} │ ${type.padEnd(11)} │ ${context.padEnd(38)} │`));
+    }
+    log(output.info('└──────────────────┴─────────────┴────────────────────────────────────────┘'));
+    return { success: true, message: `${decisionEvents.length} decision traces` };
+};
 //# sourceMappingURL=org-observe.js.map