@mutagent/cli 0.1.382 → 0.1.384

package/dist/bin/cli.js

@@ -16696,6 +16696,7 @@ __export(exports_organization_scope, {
   fetchOrganizations: () => fetchOrganizations,
   fetchKeySelf: () => fetchKeySelf,
   envKeyHasNoSelection: () => envKeyHasNoSelection,
+  endpointOf: () => endpointOf,
   deadKeyError: () => deadKeyError,
   configTenancyHeaders: () => configTenancyHeaders,
   TenancyError: () => TenancyError,
@@ -18324,7 +18325,7 @@ function handleAgentParseError(error3, json) {
 }
 
 // src/bin/cli.ts
-import chalk37 from "chalk";
+import chalk38 from "chalk";
 import { readFileSync as readFileSync14 } from "fs";
 import { join as join21, dirname as dirname7 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
@@ -25044,6 +25045,10 @@ async function sandboxFetch(path, init, deps = {}) {
     throw toNetworkError(error3, endpoint);
   }
 }
+var CLOUD_NOT_ENABLED = "CLOUD_NOT_ENABLED";
+function cloudNotEnabledError() {
+  return new MutagentError(CLOUD_NOT_ENABLED, "Cloud sandboxes are not enabled for your account yet.", undefined, 1);
+}
 async function toCliError(response, sandboxId) {
   const body = await response.text().catch(() => "");
   const message = extractMessage(body) || response.statusText || "Request failed";
@@ -25051,8 +25056,10 @@ async function toCliError(response, sandboxId) {
     return new AuthenticationError;
   if (response.status === 404 && sandboxId)
     return new NotFoundError("Sandbox", sandboxId);
-  const error3 = new ApiError(response.status, message);
   const code = parseRecord(body)?.code;
+  if (response.status === 403 && code === CLOUD_NOT_ENABLED)
+    return cloudNotEnabledError();
+  const error3 = new ApiError(response.status, message);
   if (typeof code === "string" && /^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(code))
     error3.code = code;
   return error3;
@@ -27788,7 +27795,7 @@ function createHelixCommand() {
 
 // src/commands/sandbox/index.ts
 import { Command as Command16 } from "commander";
-import chalk35 from "chalk";
+import chalk36 from "chalk";
 
 // src/commands/sandbox/spawn.ts
 import chalk30 from "chalk";
@@ -28173,15 +28180,82 @@ AI Agent Directive:
   });
 }
 
-// src/commands/sandbox/providers.ts
+// src/commands/sandbox/access.ts
 import chalk33 from "chalk";
+
+// src/lib/sandbox-access.ts
+init_errors();
+init_config();
+init_organization_scope();
+async function getCloudAccess() {
+  let body;
+  try {
+    body = await requestJson("/api/sandbox/access");
+  } catch (error3) {
+    if (error3 instanceof ApiError && error3.statusCode === 404)
+      return { cloudSandboxes: true };
+    if (error3 instanceof MutagentError && error3.code === "SANDBOX_UNREACHABLE") {
+      throw unreachableServerError(endpointOf(loadConfig().endpoint));
+    }
+    throw error3;
+  }
+  if (typeof body.cloudSandboxes !== "boolean") {
+    throw new MutagentError("INVALID_RESPONSE", "The server answered /api/sandbox/access without a cloudSandboxes flag.", 'Retry, and if it persists report it with: mutagent feedback send "<what happened>" --category cli');
+  }
+  return { cloudSandboxes: body.cloudSandboxes };
+}
+
+// src/commands/sandbox/access.ts
+init_errors();
+function registerAccessCommand(parent) {
+  parent.command("access").description("Check whether this account can create cloud sandboxes").addHelpText("after", `
+Examples:
+  ${chalk33.dim("$")} mutagent sandbox access
+  ${chalk33.dim("$")} mutagent sandbox access --json
+
+Asks the server once (GET /api/sandbox/access) for the current workspace and the
+signed-in account. Until the public launch, cloud sandboxes are limited to an
+allowlist; everyone else gets "Cloud sandboxes are not enabled for your account yet"
+from spawn, exec, and helix launches.
+
+Output:
+  Human: "Cloud sandboxes: enabled" or "Cloud sandboxes: not enabled for your account yet".
+  --json: {"cloudSandboxes": true|false}
+  Exit 0 in both cases. A rejected API key exits 2 (code AUTH_EXPIRED); a server
+  that cannot be reached exits 1 (code REQUEST_FAILED).
+  A server older than this check answers 404; that is reported as
+  {"cloudSandboxes": true}, because such a server has no allowlist.
+
+AI Agent Directive:
+  Run 'mutagent sandbox access --json' before offering a cloud launch. When
+  cloudSandboxes is false, tell the user cloud sandboxes are not enabled for their
+  account yet and do not attempt a launch; do not retry.
+
+Requires a workspace: mutagent workspaces use <name> (or --workspace for one command)
+      `).action(async () => {
+    const isJson = getJsonFlag(parent);
+    try {
+      const access = await getCloudAccess();
+      if (isJson) {
+        console.log(JSON.stringify(access));
+        return;
+      }
+      console.log(access.cloudSandboxes ? "Cloud sandboxes: enabled" : "Cloud sandboxes: not enabled for your account yet");
+    } catch (error3) {
+      handleError(error3, isJson);
+    }
+  });
+}
+
+// src/commands/sandbox/providers.ts
+import chalk34 from "chalk";
 init_errors();
 function registerProvidersCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("providers").description("List sandbox providers for mutagent helix --sandbox-provider").addHelpText("after", `
 Examples:
-  ${chalk33.dim("$")} mutagent sandbox providers
-  ${chalk33.dim("$")} mutagent sandbox providers --json
+  ${chalk34.dim("$")} mutagent sandbox providers
+  ${chalk34.dim("$")} mutagent sandbox providers --json
 
 A sandbox provider is where a sandbox runs (for example docker or agentcore). It is not an
 LLM provider (\`mutagent providers\`) and not an Environment (\`mutagent env\`).
@@ -28202,7 +28276,7 @@ AI Agent Directive:
         return;
       }
       if (list.names.length === 0) {
-        console.log(chalk33.gray("No sandbox providers configured on this backend."));
+        console.log(chalk34.gray("No sandbox providers configured on this backend."));
         return;
       }
       output.output(list.names.map((name) => ({ name, default: name === list.default ? "yes" : "" })));
@@ -28215,9 +28289,9 @@ function registerPreflightCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("preflight").description("Check whether a sandbox provider can run a definition, without creating anything").requiredOption("--image <ref>", "Image reference (repository:tag or @digest)").option("--arch <arch>", "Image architecture: x86_64 | arm64 (default: this host's)").option("--name <name>", "Definition name (default: derived from the image reference)").option("--provider <name>", "Sandbox provider to check against (default: the server's)").option("--env <name>", "Workspace Environment the definition would load").option("--egress <policy>", "Outbound network: deny | allowlist | allow (default: deny)").option("--egress-allow <rule>", "domain:, port: or cidr: rule for --egress allowlist (repeatable)", (value2, previous) => [...previous, value2], []).addHelpText("after", `
 Examples:
-  ${chalk33.dim("$")} mutagent sandbox preflight --image alpine:3.20
-  ${chalk33.dim("$")} mutagent sandbox preflight --image alpine:3.20 --provider agentcore --json
-  ${chalk33.dim("$")} mutagent sandbox preflight --image <ref> --egress allowlist --egress-allow domain:api.anthropic.com
+  ${chalk34.dim("$")} mutagent sandbox preflight --image alpine:3.20
+  ${chalk34.dim("$")} mutagent sandbox preflight --image alpine:3.20 --provider agentcore --json
+  ${chalk34.dim("$")} mutagent sandbox preflight --image <ref> --egress allowlist --egress-allow domain:api.anthropic.com
 
 Takes the same flags as spawn and checks the definition spawn would send. Every
 violation is listed. An incompatible definition exits 0 with compatible: false;
@@ -28246,7 +28320,7 @@ AI Agent Directive:
         output.success(`${definition.name} is compatible with ${verdict.provider}`);
         return;
       }
-      console.log(chalk33.yellow(`${definition.name} is NOT compatible with ${verdict.provider}:`));
+      console.log(chalk34.yellow(`${definition.name} is NOT compatible with ${verdict.provider}:`));
       for (const violation of verdict.violations)
         console.log(`  - ${violation}`);
     } catch (error3) {
@@ -28256,14 +28330,14 @@ AI Agent Directive:
 }
 
 // src/commands/sandbox/inventory.ts
-import chalk34 from "chalk";
+import chalk35 from "chalk";
 init_errors();
 function registerLsCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("ls").description("List the workspace's live sandboxes").addHelpText("after", `
 Examples:
-  ${chalk34.dim("$")} mutagent sandbox ls
-  ${chalk34.dim("$")} mutagent sandbox ls --json
+  ${chalk35.dim("$")} mutagent sandbox ls
+  ${chalk35.dim("$")} mutagent sandbox ls --json
 
 Lists the sandboxes in the configured workspace
 (mutagent workspaces use <name>).
@@ -28285,7 +28359,7 @@ AI Agent Directive:
         return;
       }
       if (sandboxes.length === 0) {
-        console.log(chalk34.gray("No sandboxes running."));
+        console.log(chalk35.gray("No sandboxes running."));
         console.log("");
         console.log("  Start one: mutagent sandbox spawn --image <ref>");
         return;
@@ -28310,8 +28384,8 @@ function registerPresetsCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("presets").description("List presets for mutagent helix --preset").addHelpText("after", `
 Examples:
-  ${chalk34.dim("$")} mutagent sandbox presets
-  ${chalk34.dim("$")} mutagent sandbox presets --json
+  ${chalk35.dim("$")} mutagent sandbox presets
+  ${chalk35.dim("$")} mutagent sandbox presets --json
 
 A preset is a named sandbox definition kept on the server. \`mutagent helix --preset <name>\`
 and \`mutagent sandbox exec --preset <name>\` use it. Image references are not shown.
@@ -28331,7 +28405,7 @@ AI Agent Directive:
         return;
       }
       if (presets.length === 0) {
-        console.log(chalk34.gray("No presets configured on this backend."));
+        console.log(chalk35.gray("No presets configured on this backend."));
         console.log("");
         console.log("  Spawn with an explicit image: mutagent sandbox spawn --image <ref>");
         return;
@@ -28352,8 +28426,8 @@ function registerRmCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("rm").description("Destroy a sandbox now").argument("<id>", "Sandbox ID").option("-f, --force", "Confirm (required unless --json)").addHelpText("after", `
 Examples:
-  ${chalk34.dim("$")} mutagent sandbox rm sbx_123 --force
-  ${chalk34.dim("$")} mutagent sandbox rm sbx_123 --json
+  ${chalk35.dim("$")} mutagent sandbox rm sbx_123 --force
+  ${chalk35.dim("$")} mutagent sandbox rm sbx_123 --json
 
 Ends every session in the sandbox. The server first tries to capture a checkpoint,
 so a Helix session can be rebuilt with \`mutagent helix session restore <reference>\`.
@@ -28394,8 +28468,8 @@ function registerTracesCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("traces").description("Show the spans recorded for a sandbox").argument("<id>", "Sandbox ID").addHelpText("after", `
 Examples:
-  ${chalk34.dim("$")} mutagent sandbox traces sbx_123
-  ${chalk34.dim("$")} mutagent sandbox traces sbx_123 --json
+  ${chalk35.dim("$")} mutagent sandbox traces sbx_123
+  ${chalk35.dim("$")} mutagent sandbox traces sbx_123 --json
 
 An empty list means no spans were recorded; telemetry must be configured on the
 server for spans to exist.
@@ -28415,7 +28489,7 @@ AI Agent Directive:
         return;
       }
       if (spans.length === 0) {
-        console.log(chalk34.gray(`No spans captured for sandbox ${id}.`));
+        console.log(chalk35.gray(`No spans captured for sandbox ${id}.`));
         return;
       }
       output.output(spans.map((span) => {
@@ -28436,8 +28510,8 @@ function registerStatusCommand(parent, registration) {
   const jsonSource = registration?.jsonSource ?? parent;
   parent.command("status").description("Print one sandbox's state").argument("<id>", "Sandbox ID").addHelpText("after", `
 Examples:
-  ${chalk34.dim("$")} mutagent sandbox status sbx_123
-  ${chalk34.dim("$")} mutagent sandbox status sbx_123 --json
+  ${chalk35.dim("$")} mutagent sandbox status sbx_123
+  ${chalk35.dim("$")} mutagent sandbox status sbx_123 --json
 
 States: pending, starting, running, paused, stopping, stopped, failed.
 For sandbox provider, arch and creation time use \`mutagent sandbox ls --json\`.
@@ -28466,21 +28540,22 @@ AI Agent Directive:
 function createSandboxCommand() {
   const sandbox = new Command16("sandbox").description("Internal: sandbox management. Everyday use goes through `mutagent helix`.").addHelpText("after", `
 Examples:
-  ${chalk35.dim("$")} mutagent sandbox presets                        ${chalk35.dim("Presets `mutagent helix --preset` can name")}
-  ${chalk35.dim("$")} mutagent sandbox providers                      ${chalk35.dim("Sandbox providers `mutagent helix --sandbox-provider` can name")}
-  ${chalk35.dim("$")} mutagent sandbox preflight --image alpine:3.20  ${chalk35.dim("Would this definition run?")}
-  ${chalk35.dim("$")} mutagent sandbox spawn --image alpine:3.20 --detach
-  ${chalk35.dim("$")} mutagent sandbox ls
-  ${chalk35.dim("$")} mutagent sandbox status sbx_1
-  ${chalk35.dim("$")} mutagent sandbox exec --sandbox sbx_1 -- bun test
-  ${chalk35.dim("$")} mutagent sandbox attach sbx_1 --since 412
-  ${chalk35.dim("$")} mutagent sandbox traces sbx_1
-  ${chalk35.dim("$")} mutagent sandbox rm sbx_1 --force
+  ${chalk36.dim("$")} mutagent sandbox access --json                  ${chalk36.dim("Can this account create cloud sandboxes?")}
+  ${chalk36.dim("$")} mutagent sandbox presets                        ${chalk36.dim("Presets `mutagent helix --preset` can name")}
+  ${chalk36.dim("$")} mutagent sandbox providers                      ${chalk36.dim("Sandbox providers `mutagent helix --sandbox-provider` can name")}
+  ${chalk36.dim("$")} mutagent sandbox preflight --image alpine:3.20  ${chalk36.dim("Would this definition run?")}
+  ${chalk36.dim("$")} mutagent sandbox spawn --image alpine:3.20 --detach
+  ${chalk36.dim("$")} mutagent sandbox ls
+  ${chalk36.dim("$")} mutagent sandbox status sbx_1
+  ${chalk36.dim("$")} mutagent sandbox exec --sandbox sbx_1 -- bun test
+  ${chalk36.dim("$")} mutagent sandbox attach sbx_1 --since 412
+  ${chalk36.dim("$")} mutagent sandbox traces sbx_1
+  ${chalk36.dim("$")} mutagent sandbox rm sbx_1 --force
 
 Single command vs kept sandbox:
-  ${chalk35.bold("exec")} without --sandbox starts a fresh sandbox from a preset, runs one command
-  and removes the sandbox. ${chalk35.bold("spawn")} starts a sandbox from an image and leaves it running
-  for ${chalk35.bold("attach")} and ${chalk35.bold("exec --sandbox")}.
+  ${chalk36.bold("exec")} without --sandbox starts a fresh sandbox from a preset, runs one command
+  and removes the sandbox. ${chalk36.bold("spawn")} starts a sandbox from an image and leaves it running
+  for ${chalk36.bold("attach")} and ${chalk36.bold("exec --sandbox")}.
 
 Lifecycle:
   Ctrl-C, a dropped connection or a closed terminal detaches; the sandbox keeps running.
@@ -28510,12 +28585,13 @@ Requires a workspace: mutagent workspaces use <name> (or --workspace for one com
   registerExecCommand(sandbox);
   registerAttachCommand(sandbox);
   registerTracesCommand(sandbox);
+  registerAccessCommand(sandbox);
   return sandbox;
 }
 
 // src/commands/env/index.ts
 import { Command as Command17 } from "commander";
-import chalk36 from "chalk";
+import chalk37 from "chalk";
 import { readFileSync as readFileSync13 } from "fs";
 init_errors();
 
@@ -28617,13 +28693,13 @@ function describeWithoutValue(arg) {
 function createEnvCommand() {
   const env = new Command17("env").description("Workspace Environments: the variables and secrets an agent’s tools need").addHelpText("after", `
 Examples:
-  ${chalk36.dim("$")} mutagent env ls
-  ${chalk36.dim("$")} mutagent env set demo GREETING=hello --secret GITHUB_TOKEN=ghp_…
-  ${chalk36.dim("$")} mutagent env set staging --from-file .env.staging --secrets-from-file .env.staging.secrets
-  ${chalk36.dim("$")} mutagent env show demo
-  ${chalk36.dim("$")} mutagent env unset demo GREETING
-  ${chalk36.dim("$")} mutagent env rm demo --force
-  ${chalk36.dim("$")} mutagent helix --env demo -p "check the deploy"    ${chalk36.dim("Load it into a Helix cloud run")}
+  ${chalk37.dim("$")} mutagent env ls
+  ${chalk37.dim("$")} mutagent env set demo GREETING=hello --secret GITHUB_TOKEN=ghp_…
+  ${chalk37.dim("$")} mutagent env set staging --from-file .env.staging --secrets-from-file .env.staging.secrets
+  ${chalk37.dim("$")} mutagent env show demo
+  ${chalk37.dim("$")} mutagent env unset demo GREETING
+  ${chalk37.dim("$")} mutagent env rm demo --force
+  ${chalk37.dim("$")} mutagent helix --env demo -p "check the deploy"    ${chalk37.dim("Load it into a Helix cloud run")}
 
 An Environment holds the variables and secrets an agent's tools need: a GitHub token,
 a Langfuse key, a database URL. LLM provider keys belong in \`mutagent providers\`; a
@@ -28653,8 +28729,8 @@ AI Agent Directive:
 function registerLs(parent) {
   parent.command("ls").description("List the workspace’s Environments").addHelpText("after", `
 Examples:
-  ${chalk36.dim("$")} mutagent env ls
-  ${chalk36.dim("$")} mutagent env ls --json
+  ${chalk37.dim("$")} mutagent env ls
+  ${chalk37.dim("$")} mutagent env ls --json
 
 An empty list means the workspace has no Environments yet.
 
@@ -28671,7 +28747,7 @@ AI Agent Directive:
         return;
       }
       if (environments.length === 0) {
-        console.log(chalk36.gray("No Environments in this workspace. Create one: mutagent env set <name> KEY=VALUE"));
+        console.log(chalk37.gray("No Environments in this workspace. Create one: mutagent env set <name> KEY=VALUE"));
         return;
       }
       output.output(environments.map((e) => ({
@@ -28688,8 +28764,8 @@ AI Agent Directive:
 function registerShow(parent) {
   parent.command("show").description("Entry names and fingerprints of one Environment — never a value").argument("<name>", "Environment name").addHelpText("after", `
 Examples:
-  ${chalk36.dim("$")} mutagent env show demo
-  ${chalk36.dim("$")} mutagent env show demo --json
+  ${chalk37.dim("$")} mutagent env show demo
+  ${chalk37.dim("$")} mutagent env show demo --json
 
 Each line is NAME  KIND  FINGERPRINT. The fingerprint is sha256(value)[:8]; compare
 it with your own (printf %s "$VALUE" | shasum -a 256 | cut -c1-8) to check what is
@@ -28714,10 +28790,10 @@ AI Agent Directive:
 function registerSet(parent) {
   parent.command("set").description("Set variables (and --secret secrets) on an Environment; creates it when absent").argument("<name>", "Environment name").argument("[assignments...]", "KEY=VALUE variables (non-secret)").option("-s, --secret <KEY=VALUE...>", "Secret entries — encrypted at rest, never returned").option("--from-file <path>", "Read variables from a .env file (KEY=VALUE lines); argv wins on the same name").option("--secrets-from-file <path>", "Read secrets from a .env file").option("--replace", "Replace the whole Environment instead of merging into it").option("--allow-provider-key", "Permit a variable named like an LLM provider key").addHelpText("after", `
 Examples:
-  ${chalk36.dim("$")} mutagent env set demo GREETING=hello
-  ${chalk36.dim("$")} mutagent env set demo GREETING=hello --secret TOKEN=abc123
-  ${chalk36.dim("$")} mutagent env set staging --from-file .env.staging
-  ${chalk36.dim("$")} mutagent env set staging --replace --from-file .env.staging   ${chalk36.dim("Drop everything not in the file")}
+  ${chalk37.dim("$")} mutagent env set demo GREETING=hello
+  ${chalk37.dim("$")} mutagent env set demo GREETING=hello --secret TOKEN=abc123
+  ${chalk37.dim("$")} mutagent env set staging --from-file .env.staging
+  ${chalk37.dim("$")} mutagent env set staging --replace --from-file .env.staging   ${chalk37.dim("Drop everything not in the file")}
 
 Entries you name are set and the rest stay; the Environment is created if missing.
 --replace removes every entry you do not name, secrets included.
@@ -28725,7 +28801,7 @@ Positional KEY=VALUE and --from-file are variables; --secret and --secrets-from-
 secrets (encrypted at rest, never returned). Both are set as environment variables in
 the sandbox. A name cannot be both.
 --secret takes every KEY=VALUE after it, so put variables first:
-  ${chalk36.dim("$")} mutagent env set demo A=1 --secret TOKEN=x
+  ${chalk37.dim("$")} mutagent env set demo A=1 --secret TOKEN=x
 A value may contain '=': TOKEN=a=b stores "a=b".
 Names: A-Z, 0-9 and _, not starting with a digit. An invalid name exits 2. A name that
 looks like an LLM provider key is refused by the server (exit 1) unless
@@ -28764,8 +28840,8 @@ AI Agent Directive:
 function registerUnset(parent) {
   parent.command("unset").description("Remove entries from an Environment").argument("<name>", "Environment name").argument("<keys...>", "Entry names to remove").option("-s, --secret", "The names are secrets (default: try both variables and secrets)").addHelpText("after", `
 Examples:
-  ${chalk36.dim("$")} mutagent env unset demo GREETING
-  ${chalk36.dim("$")} mutagent env unset demo TOKEN OTHER_TOKEN
+  ${chalk37.dim("$")} mutagent env unset demo GREETING
+  ${chalk37.dim("$")} mutagent env unset demo TOKEN OTHER_TOKEN
 
 A name is removed wherever it is, variable or secret. Unsetting a name that is not
 there succeeds.
@@ -28795,8 +28871,8 @@ AI Agent Directive:
 function registerRm(parent) {
   parent.command("rm").description("Delete an Environment and its secrets").argument("<name>", "Environment name").option("-f, --force", "Confirm (required unless --json)").addHelpText("after", `
 Examples:
-  ${chalk36.dim("$")} mutagent env rm demo --force
-  ${chalk36.dim("$")} mutagent env rm demo --json
+  ${chalk37.dim("$")} mutagent env rm demo --force
+  ${chalk37.dim("$")} mutagent env rm demo --json
 
 Deletes the Environment and its encrypted secrets. Sandboxes already running keep the
 values they were given; the next run naming this Environment fails.
@@ -28849,7 +28925,7 @@ function printEnvironment(environment, output, isJson) {
     output.output({ success: true, environment });
     return;
   }
-  console.log(`${chalk36.bold(environment.name)}  ${chalk36.dim(environment.updatedAt ?? "")}`);
+  console.log(`${chalk37.bold(environment.name)}  ${chalk37.dim(environment.updatedAt ?? "")}`);
   printEntries(environment);
 }
 function printEntries(environment) {
@@ -28858,12 +28934,12 @@ function printEntries(environment) {
     ...environment.secrets.map((s) => ({ name: s.name, kind: "secret", fingerprint: s.fingerprint }))
   ];
   if (rows.length === 0) {
-    console.log(chalk36.gray("  (no entries)"));
+    console.log(chalk37.gray("  (no entries)"));
     return;
   }
   const width = Math.max(...rows.map((r) => r.name.length));
   for (const row of rows) {
-    console.log(`  ${row.name.padEnd(width)}  ${row.kind === "secret" ? chalk36.yellow("secret") : chalk36.dim("var   ")}  ${chalk36.dim(row.fingerprint)}`);
+    console.log(`  ${row.name.padEnd(width)}  ${row.kind === "secret" ? chalk37.yellow("secret") : chalk37.dim("var   ")}  ${chalk37.dim(row.fingerprint)}`);
   }
 }
 
@@ -29436,50 +29512,50 @@ program.name("mutagent").description(`Mutagent CLI - command-line client for the
 });
 program.addHelpText("beforeAll", () => renderBanner());
 program.addHelpText("after", `
-${chalk37.yellow("Get started:")}
-  mutagent login                          ${chalk37.dim("Sign in (browser or API key)")}
-  mutagent providers mirror               ${chalk37.dim("Copy local Helix LLM provider keys into the workspace")}
-  mutagent helix -p "<task>"              ${chalk37.dim("Run Helix in the cloud")}
-  mutagent install helix                  ${chalk37.dim("Install the standalone Helix binary on this machine")}
-
-${chalk37.yellow("Managed agents:")}
-  mutagent agent deploy <agent.md>        ${chalk37.dim("Check, upload and activate an agent.md folder (--env names the slot)")}
-  mutagent helix agent @<slug> -p "<task>" ${chalk37.dim("Run a managed agent in the cloud")}
-  mutagent agent --help                   ${chalk37.dim("check, pack, run, deploy, activate, list, inspect, retire")}
-
-${chalk37.yellow("Workspace:")}
-  mutagent workspaces use <name>          ${chalk37.dim("Choose the workspace every later command works in")}
-  mutagent workspaces current             ${chalk37.dim("The key's scope, organization and the verified workspace")}
-  mutagent workspaces list                ${chalk37.dim("Your workspaces in the key's organization")}
-  --workspace <name|id>                   ${chalk37.dim("One command in another workspace (then MUTAGENT_WORKSPACE_ID, then the selection)")}
-  mutagent login --org <slug>             ${chalk37.dim("Sign in for another organization")}
-  mutagent providers list                 ${chalk37.dim("LLM providers in the workspace")}
-  mutagent helix models                   ${chalk37.dim("Models Helix can use in the cloud, and the workspace default model")}
-  mutagent env ls                         ${chalk37.dim("Environments: variables and secrets for tools")}
-  mutagent usage                          ${chalk37.dim("Count the workspace's LLM providers and your workspaces")}
-
-${chalk37.yellow("Automation:")}
-  MUTAGENT_API_KEY=mt_...                 ${chalk37.dim("Sign in without a browser (or --api-key <key>)")}
-  --json                                  ${chalk37.dim("Structured output")}
-  --non-interactive                       ${chalk37.dim("No sign-in method or consent prompts (also when CI=true or stdin is not a terminal); a first sign-in in a terminal ends with a menu unless --json")}
-  -v, --version                           ${chalk37.dim("CLI version (only before a subcommand)")}
-
-${chalk37.yellow("Report a problem:")}
+${chalk38.yellow("Get started:")}
+  mutagent login                          ${chalk38.dim("Sign in (browser or API key)")}
+  mutagent providers mirror               ${chalk38.dim("Copy local Helix LLM provider keys into the workspace")}
+  mutagent helix -p "<task>"              ${chalk38.dim("Run Helix in the cloud")}
+  mutagent install helix                  ${chalk38.dim("Install the standalone Helix binary on this machine")}
+
+${chalk38.yellow("Managed agents:")}
+  mutagent agent deploy <agent.md>        ${chalk38.dim("Check, upload and activate an agent.md folder (--env names the slot)")}
+  mutagent helix agent @<slug> -p "<task>" ${chalk38.dim("Run a managed agent in the cloud")}
+  mutagent agent --help                   ${chalk38.dim("check, pack, run, deploy, activate, list, inspect, retire")}
+
+${chalk38.yellow("Workspace:")}
+  mutagent workspaces use <name>          ${chalk38.dim("Choose the workspace every later command works in")}
+  mutagent workspaces current             ${chalk38.dim("The key's scope, organization and the verified workspace")}
+  mutagent workspaces list                ${chalk38.dim("Your workspaces in the key's organization")}
+  --workspace <name|id>                   ${chalk38.dim("One command in another workspace (then MUTAGENT_WORKSPACE_ID, then the selection)")}
+  mutagent login --org <slug>             ${chalk38.dim("Sign in for another organization")}
+  mutagent providers list                 ${chalk38.dim("LLM providers in the workspace")}
+  mutagent helix models                   ${chalk38.dim("Models Helix can use in the cloud, and the workspace default model")}
+  mutagent env ls                         ${chalk38.dim("Environments: variables and secrets for tools")}
+  mutagent usage                          ${chalk38.dim("Count the workspace's LLM providers and your workspaces")}
+
+${chalk38.yellow("Automation:")}
+  MUTAGENT_API_KEY=mt_...                 ${chalk38.dim("Sign in without a browser (or --api-key <key>)")}
+  --json                                  ${chalk38.dim("Structured output")}
+  --non-interactive                       ${chalk38.dim("No sign-in method or consent prompts (also when CI=true or stdin is not a terminal); a first sign-in in a terminal ends with a menu unless --json")}
+  -v, --version                           ${chalk38.dim("CLI version (only before a subcommand)")}
+
+${chalk38.yellow("Report a problem:")}
   mutagent feedback send "<what happened>" --category cli
-  ${chalk37.dim("--category accepts: cli | helix | stage:<spec|build|evaluate|diagnose|optimize>")}
+  ${chalk38.dim("--category accepts: cli | helix | stage:<spec|build|evaluate|diagnose|optimize>")}
 
-${chalk37.dim("For CLI usage guidance for AI agents, see the Skill at")}
-${chalk37.cyan(".claude/skills/mutagent-cli/SKILL.md")}
+${chalk38.dim("For CLI usage guidance for AI agents, see the Skill at")}
+${chalk38.cyan(".claude/skills/mutagent-cli/SKILL.md")}
 
-${chalk37.yellow("Directive System:")}
+${chalk38.yellow("Directive System:")}
   A --json response may include:
-  ${chalk37.bold("_directive.renderedCard")}  A status card: copy it into your chat reply verbatim before running another command
-  ${chalk37.bold("_directive.instruction")}   What to do next
-  ${chalk37.bold("_directive.next")}          Suggested follow-up commands
-  ${chalk37.bold("_links")}                   Dashboard and API URLs
-  ${chalk37.bold("_compat")}                  cliVersion, skillVersion, skillMinCliVersion
+  ${chalk38.bold("_directive.renderedCard")}  A status card: copy it into your chat reply verbatim before running another command
+  ${chalk38.bold("_directive.instruction")}   What to do next
+  ${chalk38.bold("_directive.next")}          Suggested follow-up commands
+  ${chalk38.bold("_links")}                   Dashboard and API URLs
+  ${chalk38.bold("_compat")}                  cliVersion, skillVersion, skillMinCliVersion
 
-${chalk37.yellow("AI Agent Rules (MANDATORY for coding agents):")}
+${chalk38.yellow("AI Agent Rules (MANDATORY for coding agents):")}
   1. Sign in: with MUTAGENT_API_KEY set, run mutagent login --json. To help a user sign in,
      run mutagent login --browser --json, show the printed URL to the user verbatim, and
      wait: the CLI polls for up to 5 minutes.
@@ -29490,9 +29566,9 @@ ${chalk37.yellow("AI Agent Rules (MANDATORY for coding agents):")}
   5. After mutagent init, check the workspace: mutagent workspaces list --json
   6. Ask the user through your own question tool. With --json only mutagent login can prompt, in a terminal; pass --browser or set MUTAGENT_API_KEY.
 ${!hasCredentials() ? `
-` + chalk37.yellow("  Warning: Not authenticated. Run: mutagent login") + `
+` + chalk38.yellow("  Warning: Not authenticated. Run: mutagent login") + `
 ` : ""}${!hasRcConfig() ? `
-` + chalk37.green("  Get started: mutagent init") + `
+` + chalk38.green("  Get started: mutagent init") + `
 ` : ""}`);
 var rawArgs = process.argv.slice(2);
 if (isGlobalVersionFlag(rawArgs)) {
@@ -29573,4 +29649,4 @@ if (isAgentInvocation(rawArgs)) {
   program.parse(argvForCommander, { from: "user" });
 }
 
-//# debugId=22EA0CB4BCE602F064756E2164756E21
+//# debugId=6107DF45DB32A14A64756E2164756E21

package/dist/index.js

@@ -621,6 +621,7 @@ __export(exports_organization_scope, {
   fetchOrganizations: () => fetchOrganizations,
   fetchKeySelf: () => fetchKeySelf,
   envKeyHasNoSelection: () => envKeyHasNoSelection,
+  endpointOf: () => endpointOf,
   deadKeyError: () => deadKeyError,
   configTenancyHeaders: () => configTenancyHeaders,
   TenancyError: () => TenancyError,
@@ -1691,4 +1692,4 @@ export {
   ApiError
 };
 
-//# debugId=6C0EFE359421B56964756E2164756E21
+//# debugId=73D846829EED9BB964756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutagent/cli",
-  "version": "0.1.382",
+  "version": "0.1.384",
   "description": "Bun-native CLI for the MutagenT AI platform - auth, provider config, and lifecycle-tool installer for AI-native workflows",
   "type": "module",
   "bin": {
@@ -42,7 +42,7 @@
   },
   "dependencies": {
     "@inquirer/prompts": "^8.7.2",
-    "@mutagent/sdk": "0.6.15",
+    "@mutagent/sdk": "0.6.16",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "cosmiconfig": "^9.0.0",