@nodetool-ai/cli 0.8.1 → 0.8.3

package/dist/nodetool.js

@@ -1,1690 +1,24 @@
 #!/usr/bin/env node
 /**
- * nodetool — Top-level CLI mirroring the Python nodetool CLI.
+ * nodetool — CLI entry.
  *
- * Usage:
- *   nodetool info                          # system/env info
- *   nodetool serve [--host] [--port]       # start TS server
- *   nodetool chat [--url] [--provider]     # interactive chat
- *   nodetool workflows list/get/run
- *   nodetool jobs list/get
- *   nodetool assets list/get
- *   nodetool secrets list/store <key>
- *   nodetool settings show
+ * The full command tree lives in ./nodetool-main.ts and statically imports
+ * every workspace package, so it fails with ERR_MODULE_NOT_FOUND on a tree
+ * whose `dist/` has not been built. `harness` (list, audit, gate planning)
+ * is the tool that tells you what to build and check, so it must work first:
+ * it is routed to a program holding only that command, and its commands import
+ * built packages lazily (capabilities) or not at all. Every other command goes
+ * to the full tree unchanged.
  */
-import { program } from "commander";
-import { createRequire } from "node:module";
-import { fileURLToPath } from "node:url";
-import { dirname, resolve } from "node:path";
-import { spawnSync } from "node:child_process";
-import { createInterface } from "node:readline";
-import { workflowToDsl } from "@nodetool-ai/dsl";
-import { initDb, Workflow, Asset, Secret, getSecret } from "@nodetool-ai/models";
-import { readCachedHfModels, searchCachedHfModels } from "@nodetool-ai/huggingface";
-import { initMasterKey } from "@nodetool-ai/security";
-import { installLocalModelInterfaces } from "./local-model-interfaces.js";
-import { getDefaultDbPath, getDefaultAssetsPath } from "@nodetool-ai/config";
-import { ExecutionSession, isExecutionPreflightError } from "@nodetool-ai/execution";
-import { NodeRegistry, createGraphNodeTypeResolver } from "@nodetool-ai/node-sdk";
-import { registerBaseNodes } from "@nodetool-ai/base-nodes";
-import { registerElevenLabsNodes } from "@nodetool-ai/elevenlabs-nodes";
-import { registerMinimaxNodes } from "@nodetool-ai/minimax-nodes";
-import { registerTransformersJsNodes } from "@nodetool-ai/transformers-js-nodes";
-import { registerFalNodes } from "@nodetool-ai/fal-nodes";
-import { registerReplicateNodes } from "@nodetool-ai/replicate-nodes";
-import { registerReveNodes } from "@nodetool-ai/reve-nodes";
-import { registerHuggingFaceNodes } from "@nodetool-ai/huggingface-nodes";
-import { ProcessingContext, createLocalWorkspace, initTelemetry, onPythonBridgeCreated } from "@nodetool-ai/runtime";
-import { FileStorageAdapter } from "@nodetool-ai/storage";
-import { mkdirSync } from "node:fs";
-import { addSupervisorOptions, createSupervisorHandle, parseSupervisorFlags, printSupervisedSummary, recordSupervisorCost, streamInterventionLines } from "./supervisor.js";
-import { registerPackageCommands } from "./commands/package.js";
-import { registerPackCommands } from "./commands/packs.js";
-import { registerDeployCommands } from "./commands/deploy.js";
-import { registerHfCommands } from "./commands/models-hf.js";
-import { registerWorkerCommands } from "./commands/worker.js";
-import { installWorkerActivityHeartbeat } from "@nodetool-ai/compute";
-import { registerRecommendedCommand } from "./commands/models-recommended.js";
-import { registerAgentCommands } from "./commands/agent.js";
-import { registerDbCommands } from "./commands/db.js";
-import { registerDebugCommands } from "./commands/debug.js";
-import { registerAppCommands } from "./commands/app.js";
-import { registerAppsCommands } from "./commands/apps.js";
-import { registerValidateCommand } from "./commands/validate.js";
-import { registerTimelineCommands } from "./commands/timeline.js";
-import { registerSketchCommands } from "./commands/sketch.js";
-import { registerJsScriptCommands } from "./commands/js-script.js";
-import { registerReliabilityCommands } from "./commands/reliability.js";
-import { registerNodeCommands } from "./commands/node.js";
-import { registerGenerateCommand } from "./commands/generate.js";
-import { registerEvalCommand } from "./commands/eval.js";
-import { registerJtbdCommand } from "./commands/jtbd.js";
-import { registerAffectedCommand } from "./commands/affected.js";
-import { registerHarnessCommands } from "./commands/harness.js";
-import { registerCollectionCommands } from "./commands/collections.js";
-import { registerCostsCommands } from "./commands/costs.js";
-import { registerGenerationsCommands } from "./commands/generations.js";
-import { registerGameCommands } from "./commands/game.js";
-import { registerAuthCommands } from "./commands/auth.js";
-import { registerTelegramCommands } from "./commands/telegram.js";
-import { registerResourceReadCommands } from "./commands/resource-read.js";
-import { createApiClient } from "./api-client.js";
-import { listAllModels, listConfiguredProviderInfo, listOllamaModels, listProviderModels } from "./providers.js";
-import { isString } from "./predicates.js";
-import { printTable, asJson } from "./commands/output.js";
-import { printCommandError } from "./command-errors.js";
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-/**
- * The CLI's own version, read from its package.json rather than repeated here.
- * A literal drifts silently: it sat at "0.1.0" across every 0.7.0-rc release,
- * so `nodetool --version` told users nothing about what they had installed.
- */
-const CLI_VERSION = createRequire(import.meta.url)("../package.json").version;
-// ---------------------------------------------------------------------------
-// DB setup (for secrets commands)
-// ---------------------------------------------------------------------------
-// The local single-user id every direct-DB command runs as, matching the
-// `workflows run` / `secrets` commands and the stdio MCP server.
-import { resolveLocalSecret } from "./local-secrets.js";
-const LOCAL_USER_ID = "1";
-// Open the local SQLite database for a read-only command. Unlike setupDb() this
-// skips master-key unlocking (no secret decryption needed to list/read rows),
-// so it never emits a keychain warning. Idempotent — initDb() is a no-op once
-// a connection is open.
-function ensureDb() {
-    initDb(getDefaultDbPath());
-}
-async function setupDb() {
-    ensureDb();
-    // Resolve the master encryption key from keychain / env / AWS so that
-    // both encryption (Secret.upsert) and decryption (Secret.getDecryptedValue)
-    // use the same persistent key. Without this, a fresh process would
-    // auto-generate a one-shot key inside `getMasterKey()`, encrypt with it,
-    // then lose it on exit — and the next launch could not decrypt.
-    try {
-        await initMasterKey();
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        process.stderr.write(`Could not unlock the secret store: ${msg}\n` +
-            `Tip: set SECRETS_MASTER_KEY or grant keychain access.\n`);
-    }
-}
-// ---------------------------------------------------------------------------
-// API clients
-// ---------------------------------------------------------------------------
-// REST GET (text) — used for the DSL export endpoint which stays REST
-// because it returns a TypeScript source string rather than JSON.
-async function apiGetText(apiUrl, path) {
-    const res = await fetch(`${apiUrl}${path}`);
-    if (!res.ok)
-        throw new Error(`HTTP ${res.status}: ${await res.text()}`);
-    return res.text();
-}
-// This CLI's package version, stamped into exported bundle manifests.
-function cliVersion() {
-    try {
-        const req = createRequire(import.meta.url);
-        return req("../package.json").version;
-    }
-    catch {
-        // Version is best-effort metadata; omit it if the file can't be read.
-        return undefined;
-    }
-}
-// Download asset bytes from a running server, used by the export commands to
-// resolve `asset://` / `/api/storage/` (and optionally http) refs into bytes.
-function makeAssetFetcher(apiUrl) {
-    return async (ref) => {
-        let url = null;
-        if (ref.startsWith("asset://")) {
-            const id = ref.slice("asset://".length);
-            const bareId = id.replace(/\.[^.]+$/, "");
-            try {
-                const meta = await fetch(`${apiUrl}/api/assets/${encodeURIComponent(bareId)}`);
-                if (meta.ok) {
-                    const j = (await meta.json());
-                    if (j.get_url) {
-                        url = j.get_url.startsWith("/")
-                            ? `${apiUrl}${j.get_url}`
-                            : j.get_url;
-                    }
-                }
-            }
-            catch {
-                // Metadata lookup failed — fall back to the storage route below.
-            }
-            url ??= `${apiUrl}/api/storage/${encodeURIComponent(id)}`;
-        }
-        else if (ref.includes("/api/storage/")) {
-            url = /^https?:\/\//.test(ref)
-                ? ref
-                : `${apiUrl}${ref.startsWith("/") ? ref : `/${ref}`}`;
-        }
-        else if (/^https?:\/\//.test(ref)) {
-            url = ref;
-        }
-        if (!url)
-            return null;
-        const res = await fetch(url);
-        if (!res.ok)
-            return null;
-        return new Uint8Array(await res.arrayBuffer());
-    };
-}
-// Resolve asset bytes from the local assets directory, so the export commands
-// work by id without a running server. `asset://<key>` is tried verbatim as a
-// storage key first (that's how import-bundle writes refs), then via the DB
-// record to derive `<id>.<ext>` from the content type. Remote http(s) refs
-// still fetch over the network.
-async function makeLocalAssetFetcher() {
-    const { getAssetFileName } = await import("@nodetool-ai/websocket");
-    const storage = new FileStorageAdapter(getDefaultAssetsPath());
-    return async (ref) => {
-        if (ref.startsWith("asset://")) {
-            const raw = ref.slice("asset://".length);
-            const direct = await storage.retrieve(`/api/storage/${raw}`);
-            if (direct)
-                return direct;
-            const bareId = raw.replace(/\.[^.]+$/, "");
-            const asset = await Asset.find(LOCAL_USER_ID, bareId);
-            if (!asset)
-                return null;
-            const key = getAssetFileName(asset.id, asset.content_type);
-            return storage.retrieve(`/api/storage/${key}`);
-        }
-        if (ref.includes("/api/storage/")) {
-            const local = await storage.retrieve(ref);
-            if (local)
-                return local;
-        }
-        if (/^https?:\/\//.test(ref)) {
-            const res = await fetch(ref);
-            if (!res.ok)
-                return null;
-            return new Uint8Array(await res.arrayBuffer());
-        }
-        return null;
-    };
-}
-// Asset and timeline persistence for every context any command builds, here
-// rather than per-entrance: `debug` wired none while `workflows run` wired
-// four, so one workflow saved an image under one command and threw under the
-// other. The interfaces touch the database only when a node calls them, so
-// installing them before `setupDb()` is safe.
-await installLocalModelInterfaces();
-/**
- * What to print when a run command fails. A preflight refusal already reads as
- * a complete explanation — printing the error class in front of it only buries
- * the secret name the user has to go set.
- */
-function describeRunFailure(error) {
-    return isExecutionPreflightError(error) ? error.message : String(error);
-}
-// ---------------------------------------------------------------------------
-// info
-// ---------------------------------------------------------------------------
-program
-    .name("nodetool")
-    .description("NodeTool CLI")
-    .version(CLI_VERSION)
-    .option("--trace-file <path>", "Append every LLM/agent/workflow span as JSONL to <path>")
-    .option("--trace-stdout [format]", "Stream spans to stdout: 'pretty' (default) or 'json' (JSONL)")
-    .option("--no-trace-stdout", "Disable stdout span output (overrides NODETOOL_TRACE_STDOUT)")
-    .hook("preAction", async (thisCommand, actionCommand) => {
-    // With `--trace`, the `debug` command owns telemetry: it routes spans into
-    // its bundle's trace.jsonl via its own initTelemetry call. Initializing here
-    // first would win the one-shot init and drop that file sink, so skip it.
-    // Without `--trace`, fall through so the global --trace-file/--trace-stdout
-    // flags still work for a debug run.
-    if (actionCommand?.name() === "debug" && actionCommand.opts()["trace"])
-        return;
-    const opts = thisCommand.opts();
-    await initTelemetry({
-        ...(opts.traceFile && { traceFile: opts.traceFile }),
-        ...(opts.traceStdout !== undefined && {
-            stdout: parseTraceStdout(opts.traceStdout)
-        })
-    });
-});
-function parseTraceStdout(v) {
-    if (v === false)
-        return false;
-    if (v === true)
-        return "pretty";
-    if (isString(v)) {
-        const lower = v.toLowerCase();
-        if (lower === "false" || lower === "0" || lower === "no")
-            return false;
-        if (lower === "json")
-            return "json";
-        if (lower === "pretty" || lower === "true" || lower === "1")
-            return "pretty";
-    }
-    throw new Error(`--trace-stdout must be 'pretty' or 'json' (got ${JSON.stringify(v)})`);
+if (process.argv[2] === "harness") {
+    const { program } = await import("commander");
+    const { registerHarnessCommands } = await import("./commands/harness.js");
+    program.name("nodetool").description("NodeTool CLI");
+    registerHarnessCommands(program);
+    await program.parseAsync();
 }
-// ---------------------------------------------------------------------------
-// run — execute a TypeScript/JavaScript DSL workflow file
-// ---------------------------------------------------------------------------
-addSupervisorOptions(program
-    .command("run <dsl-file>")
-    .description("Run a TypeScript/JavaScript DSL workflow file")
-    .option("--json", "Output results as JSON (default: pretty-print)")).action(async (dslFile, opts) => {
-    try {
-        const { resolve } = await import("node:path");
-        const { runDslFile } = await import("./run-dsl.js");
-        const { registerBaseNodes } = await import("@nodetool-ai/base-nodes");
-        const { NodeRegistry } = await import("@nodetool-ai/node-sdk");
-        registerBaseNodes(NodeRegistry.global);
-        const supervisorConfig = parseSupervisorFlags(opts);
-        const absolutePath = resolve(dslFile);
-        let results;
-        let interventions = [];
-        if (supervisorConfig) {
-            // The supervisor's provider key comes from the secret store, and its
-            // spend is written to the local ledger — both need the DB.
-            await setupDb();
-            const { runDslFileSupervised } = await import("./run-dsl-supervised.js");
-            const run = await runDslFileSupervised(absolutePath, supervisorConfig, opts.json === true);
-            results = run.results;
-            interventions = run.interventions;
-        }
-        else {
-            results = await runDslFile(absolutePath);
-        }
-        const { printRunJson, previewJson } = await import("./run-json.js");
-        if (opts.json) {
-            // A supervised run reports what the supervisor did alongside the
-            // outputs; an unsupervised one keeps the bare results shape.
-            await printRunJson(supervisorConfig ? { results, interventions } : results);
-        }
-        else {
-            for (const [workflowName, outputs] of Object.entries(results)) {
-                console.log(`\n${workflowName}:`);
-                for (const [key, value] of Object.entries(outputs)) {
-                    console.log(`  ${key}: ${previewJson(value)}`);
-                }
-            }
-        }
-    }
-    catch (e) {
-        console.error(describeRunFailure(e));
-        process.exit(1);
-    }
-});
-program
-    .command("info")
-    .description("Display system and environment information")
-    .option("--json", "Output as JSON")
-    .action((opts) => {
-    const apiKeys = [
-        "ANTHROPIC_API_KEY",
-        "OPENAI_API_KEY",
-        "GEMINI_API_KEY",
-        "MISTRAL_API_KEY",
-        "GROQ_API_KEY",
-        "OLLAMA_API_URL",
-        "SERPAPI_API_KEY",
-        "HF_TOKEN"
-    ];
-    const data = {
-        version: CLI_VERSION,
-        node_version: process.version,
-        platform: process.platform,
-        arch: process.arch,
-        api_keys: Object.fromEntries(apiKeys.map((k) => [k, process.env[k] ? "configured" : "not set"])),
-        environment: {
-            ENV: process.env["ENV"] ?? "development",
-            LOG_LEVEL: process.env["LOG_LEVEL"] ?? "INFO",
-            PORT: process.env["PORT"] ?? "7777"
-        }
-    };
-    if (opts.json) {
-        asJson(data);
-        return;
-    }
-    console.log("\nNodeTool System Information\n");
-    printTable([
-        { property: "Version", value: data.version },
-        { property: "Node.js", value: data.node_version },
-        { property: "Platform", value: `${data.platform}/${data.arch}` }
-    ]);
-    console.log("\nAPI Keys:");
-    printTable(Object.entries(data.api_keys).map(([k, v]) => ({ key: k, status: v })));
-    console.log("\nEnvironment:");
-    printTable(Object.entries(data.environment).map(([k, v]) => ({
-        variable: k,
-        value: v
-    })));
-    console.log();
-});
-// ---------------------------------------------------------------------------
-// serve
-// ---------------------------------------------------------------------------
-program
-    .command("serve")
-    .description("Start the NodeTool WebSocket + HTTP server")
-    .option("--host <host>", "Host to bind", "127.0.0.1")
-    .option("--port <port>", "Port to listen on", "7777")
-    .action((opts) => {
-    const serverPath = resolve(__dirname, "../../websocket/dist/server.js");
-    process.env["HOST"] = opts.host;
-    process.env["PORT"] = opts.port;
-    const result = spawnSync("node", [serverPath], {
-        stdio: "inherit",
-        env: { ...process.env }
-    });
-    process.exit(result.status ?? 0);
-});
-// ---------------------------------------------------------------------------
-// chat
-// ---------------------------------------------------------------------------
-program
-    .command("chat")
-    .description("Start fullscreen chat")
-    .helpOption(false)
-    .option("-p, --provider <provider>", "LLM provider")
-    .option("-m, --model <model>", "Model ID")
-    .option("-a, --agent", "Agent mode")
-    .option("-u, --url <url>", "WebSocket server URL")
-    .option("-w, --workspace <path>", "Workspace directory")
-    .option("--tools <tools>", "Comma-separated enabled tools")
-    .allowUnknownOption()
-    .action((_opts, cmd) => {
-    const chatPath = resolve(__dirname, import.meta.url.endsWith(".ts") ? "index.ts" : "index.js");
-    const args = cmd.args;
-    const rawArgs = process.argv;
-    // Re-run with the chat entry point, forwarding all flags after "chat"
-    const chatIdx = rawArgs.indexOf("chat");
-    const forwarded = chatIdx >= 0 ? rawArgs.slice(chatIdx + 1) : args;
-    const result = spawnSync(process.execPath, [...process.execArgv, chatPath, ...forwarded], {
-        stdio: "inherit",
-        env: { ...process.env }
-    });
-    process.exit(result.status ?? 1);
-});
-// ---------------------------------------------------------------------------
-// workflows
-// ---------------------------------------------------------------------------
-const workflows = program
-    .command("workflows")
-    .description("Workflow management");
-addSupervisorOptions(workflows
-    .command("run <workflow_id_or_file>")
-    .description("Run a workflow by ID, JSON file, or TypeScript DSL file")
-    .option("--params <json>", "JSON params string")
-    .option("--json", "Output as JSON")
-    .option("--asset-output-mode <mode>", "How media outputs are materialized: native | raw | data_uri | workspace | storage_url | temp_url", "native")
-    .option("--workspace <dir>", "Workspace directory for workspace-mode asset output (default: ./nodetool-output)")
-    .option("--trigger-event <json>", 'Wake a trigger node as the scheduler/webhook adapter would: \'{"node_id":"watch","payload":{"path":"/tmp/a.csv","event":"created"}}\'. ' +
-    "Without it a webhook, file-watch or manual trigger has no event to " +
-    "emit and the run stalls until its timeout — so this is the only way " +
-    "to exercise a trigger-driven workflow from the CLI.")).action(async (idOrFile, opts) => {
-    try {
-        const supervisorConfig = parseSupervisorFlags(opts);
-        await setupDb();
-        let graph;
-        let workflowId = null;
-        const params = opts.params
-            ? JSON.parse(opts.params)
-            : {};
-        // A trigger node emits from `emitTriggerEvent`, not `genProcess`, and
-        // only when the run carries an event addressed to it. The kernel has
-        // always accepted one (`RunJobRequest.trigger_event`); nothing on the
-        // CLI could supply it, so a webhook or file-watch workflow could be
-        // validated but never executed. `input_id` defaults because every
-        // caller would otherwise invent the same throwaway id.
-        const triggerEvent = opts.triggerEvent
-            ? (() => {
-                const parsed = JSON.parse(opts.triggerEvent);
-                if (!parsed.node_id) {
-                    throw new Error('--trigger-event needs a "node_id" naming the trigger node to wake.');
-                }
-                return {
-                    node_id: parsed.node_id,
-                    payload: parsed.payload ?? {},
-                    input_id: parsed.input_id ?? `cli-${Date.now()}`
-                };
-            })()
-            : null;
-        // Determine if argument is a file path or workflow ID
-        if (idOrFile.endsWith(".json") ||
-            idOrFile.endsWith(".ts") ||
-            idOrFile.endsWith(".tsx") ||
-            idOrFile.includes("/") ||
-            idOrFile.includes("\\")) {
-            /** A DSL/JSON workflow file: the graph, optionally wrapped. */
-            let raw;
-            if (idOrFile.endsWith(".ts") || idOrFile.endsWith(".tsx")) {
-                // Execute DSL file via tsx and capture JSON output
-                const { execFileSync } = await import("node:child_process");
-                const output = execFileSync("npx", ["tsx", resolve(idOrFile)], {
-                    encoding: "utf8",
-                    cwd: dirname(resolve(idOrFile)),
-                    timeout: 30000
-                });
-                raw = JSON.parse(output.trim());
-            }
-            else {
-                const { readFileSync } = await import("node:fs");
-                raw = JSON.parse(readFileSync(idOrFile, "utf8"));
-            }
-            graph = raw.graph ?? raw;
-            workflowId = raw.workflow_id ?? raw.id ?? null;
-            if (raw.params)
-                Object.assign(params, raw.params);
-        }
-        else {
-            const wf = await Workflow.get(idOrFile);
-            if (!wf)
-                throw new Error(`Workflow not found: ${idOrFile}`);
-            graph = wf.graph;
-            workflowId = idOrFile;
-        }
-        if (!graph?.nodes || !graph?.edges) {
-            throw new Error("Invalid workflow: missing nodes or edges");
-        }
-        // Editor-only nodes (Comment, Group, Reroute) and the data→properties
-        // rename are handled by `ExecutionSession.create` below, which runs
-        // the graph through `normalizeGraph` (@nodetool-ai/execution) — no
-        // need to duplicate that here.
-        const registry = new NodeRegistry();
-        registerBaseNodes(registry);
-        registerElevenLabsNodes(registry);
-        registerMinimaxNodes(registry);
-        registerTransformersJsNodes(registry);
-        registerFalNodes(registry);
-        registerReplicateNodes(registry);
-        registerReveNodes(registry);
-        registerHuggingFaceNodes(registry);
-        const jobId = `job-${Date.now()}`;
-        // Resolve asset URIs (e.g. /api/storage/<key>) against the local
-        // assets directory, so workflows referencing stored assets run the
-        // same decode path the server does.
-        // Apply the workflow's assigned workspace (if any) so file ops and
-        // workspace-driving nodes land in the same directory as a server run.
-        const { resolveWorkflowWorkspace } = await import("@nodetool-ai/websocket");
-        const assignedWorkspace = workflowId
-            ? await resolveWorkflowWorkspace(workflowId, "1")
-            : null;
-        const ASSET_OUTPUT_MODES = [
-            "native",
-            "raw",
-            "data_uri",
-            "workspace",
-            "storage_url",
-            "temp_url"
-        ];
-        const assetOutputMode = (opts.assetOutputMode ??
-            "native");
-        if (!ASSET_OUTPUT_MODES.includes(assetOutputMode)) {
-            throw new Error(`Unknown --asset-output-mode "${assetOutputMode}". ` +
-                `Expected one of: ${ASSET_OUTPUT_MODES.join(", ")}`);
-        }
-        // `--workspace <dir>` wins, then whatever the workflow is assigned.
-        // `workspace` asset mode writes each output into <workspace>/assets, so
-        // it needs somewhere to write even when the run has no saved workflow (a
-        // JSON or DSL file target). Fall back to ./nodetool-output so a bare
-        // `workflows run file.json --asset-output-mode workspace` produces files
-        // in the current directory rather than failing.
-        const overrideWorkspaceDir = opts.workspace ??
-            (assignedWorkspace
-                ? null
-                : assetOutputMode === "workspace"
-                    ? resolve(process.cwd(), "nodetool-output")
-                    : null);
-        if (overrideWorkspaceDir) {
-            mkdirSync(overrideWorkspaceDir, { recursive: true });
-        }
-        const runWorkspace = overrideWorkspaceDir
-            ? createLocalWorkspace(overrideWorkspaceDir)
-            : assignedWorkspace;
-        const assetStorage = new FileStorageAdapter(getDefaultAssetsPath());
-        const context = new ProcessingContext({
-            jobId,
-            workflowId,
-            userId: "1",
-            secretResolver: resolveLocalSecret,
-            storage: assetStorage,
-            assetOutputMode,
-            workspace: runWorkspace
-        });
-        const supervisor = supervisorConfig
-            ? await createSupervisorHandle({
-                config: supervisorConfig,
-                context
-            })
-            : null;
-        console.error(`Running workflow${workflowId ? ` ${workflowId}` : ""}` +
-            (supervisor
-                ? ` supervised by ${supervisor.providerId}/${supervisor.model}`
-                : "") +
-            "...");
-        // ExecutionSession owns graph hydration, Python-bridge connection
-        // (NODETOOL_WORKER_URL/NODETOOL_WORKER_TOKEN → remote worker; unset →
-        // local stdio worker; pure-TS graphs get none), and executor
-        // resolution (registry → Python bridge → throw).
-        const sessionOptions = {
-            graph,
-            registry,
-            // Registry alone hydrates node flags but not `propertyTypes`, and
-            // correlation analysis reads list-ness only from that map — so a
-            // saved workflow (which never carries it) had every list handle
-            // read as non-list, and legal fan-in into one was rejected before
-            // any node ran. The resolver fills it from node metadata.
-            resolveNodeType: createGraphNodeTypeResolver(registry).resolveNodeType,
-            jobId,
-            workflowId,
-            params,
-            context
-        };
-        if (triggerEvent) {
-            sessionOptions.triggerEvent = triggerEvent;
-        }
-        // Message capture is retention, so it stays off unless a supervised
-        // run needs the stream to print its `⛨` lines as they happen.
-        if (supervisor) {
-            sessionOptions.supervisor = supervisor.handle;
-            sessionOptions.captureMessages = true;
-        }
-        const session = await ExecutionSession.create(sessionOptions);
-        const interventionLines = supervisor
-            ? streamInterventionLines(session.messages)
-            : Promise.resolve();
-        const result = await session.result;
-        await interventionLines;
-        supervisor?.handle.close();
-        const interventions = result.interventions ?? [];
-        if (supervisor && interventions.length > 0) {
-            await recordSupervisorCost({
-                interventions,
-                jobId,
-                workflowId,
-                userId: "1",
-                providerId: supervisor.providerId,
-                model: supervisor.model
-            });
-        }
-        const { printRunJson, previewJson } = await import("./run-json.js");
-        if (opts.json) {
-            await printRunJson(result, {
-                outputDir: resolve(process.cwd(), "nodetool-output", jobId)
-            });
-        }
-        else {
-            console.log(`Status: ${result.status}`);
-            if (result.error)
-                console.error(`Error: ${result.error}`);
-            for (const [nodeId, outputs] of Object.entries(result.outputs ?? {})) {
-                if (Array.isArray(outputs) && outputs.length > 0) {
-                    console.log(`\nNode ${nodeId}:`);
-                    for (const out of outputs) {
-                        console.log(`  ${previewJson(out, 200)}`);
-                    }
-                }
-            }
-            printSupervisedSummary(interventions);
-        }
-        process.exit(result.status === "completed" ? 0 : 1);
-    }
-    catch (e) {
-        console.error(describeRunFailure(e));
-        process.exit(1);
-    }
-});
-workflows
-    .command("export-dsl <workflow_id_or_file>")
-    .description("Export a workflow as TypeScript DSL code (local DB by id; --api-url for remote)")
-    .option("--api-url <url>", "Fetch the workflow from a remote server instead of the local database", process.env["NODETOOL_API_URL"])
-    .option("-o, --output <file>", "Write the exported DSL to a file")
-    .action(async (idOrFile, opts) => {
-    try {
-        let source;
-        if (idOrFile.endsWith(".json") ||
-            idOrFile.includes("/") ||
-            idOrFile.includes("\\")) {
-            const { readFileSync } = await import("node:fs");
-            const raw = JSON.parse(readFileSync(idOrFile, "utf8"));
-            const graph = (raw.graph ?? raw);
-            source = workflowToDsl(graph, {
-                workflowName: isString(raw.name) ? raw.name : null
-            });
-        }
-        else if (opts.apiUrl) {
-            source = await apiGetText(opts.apiUrl, `/api/workflows/${idOrFile}/dsl-export`);
-        }
-        else {
-            ensureDb();
-            const wf = await Workflow.find(LOCAL_USER_ID, idOrFile);
-            if (!wf)
-                throw new Error(`Workflow not found: ${idOrFile}`);
-            const graph = wf.getGraph();
-            source = workflowToDsl(graph, {
-                workflowName: isString(wf.name) ? wf.name : null
-            });
-        }
-        if (opts.output) {
-            const { writeFile } = await import("node:fs/promises");
-            await writeFile(opts.output, source, "utf8");
-            console.log(opts.output);
-            return;
-        }
-        console.log(source);
-    }
-    catch (e) {
-        printCommandError(e);
-        process.exit(1);
-    }
-});
-workflows
-    .command("export-example <workflow_id_or_file>")
-    .description("Export a workflow as a shipped template: materialize its assets into the " +
-    "package's constant asset dir (package:// refs) and write the example JSON")
-    .option("--api-url <url>", "Fetch the workflow and asset bytes from a remote server instead of the local DB/assets", process.env["NODETOOL_API_URL"])
-    .option("--package <name>", "Owning package", "nodetool-base")
-    .option("--assets-dir <dir>", "Root holding <package>/<file> constant assets (defaults to the monorepo base-nodes assets dir)")
-    .option("--examples-dir <dir>", "Directory the example JSON is written under, as <dir>/<package>/<name>.json")
-    .option("-o, --output <file>", "Write the example JSON to this exact path")
-    .option("--include-remote", "Also materialize http(s) and local-file refs (off by default)")
-    .action(async (idOrFile, opts) => {
-    try {
-        const { readFileSync } = await import("node:fs");
-        const { mkdir, writeFile } = await import("node:fs/promises");
-        const { join } = await import("node:path");
-        const { materializeWorkflowConstantAssets } = await import("@nodetool-ai/websocket");
-        let name = "";
-        let description = "";
-        let tags = [];
-        let graph;
-        const isFile = idOrFile.endsWith(".json") ||
-            idOrFile.includes("/") ||
-            idOrFile.includes("\\");
-        if (isFile) {
-            const raw = JSON.parse(readFileSync(idOrFile, "utf8"));
-            name = isString(raw.name) ? raw.name : "workflow";
-            description =
-                isString(raw.description) ? raw.description : "";
-            tags = Array.isArray(raw.tags)
-                ? raw.tags.filter((t) => typeof t === "string")
-                : [];
-            graph = (raw.graph ?? raw);
-        }
-        else if (opts.apiUrl) {
-            const client = createApiClient(opts.apiUrl);
-            const wf = (await client.workflows.get.query({
-                id: idOrFile
-            }));
-            name = isString(wf.name) ? wf.name : "workflow";
-            description =
-                isString(wf.description) ? wf.description : "";
-            tags = Array.isArray(wf.tags)
-                ? wf.tags.filter((t) => typeof t === "string")
-                : [];
-            graph = wf.graph;
-        }
-        else {
-            ensureDb();
-            const wf = await Workflow.find(LOCAL_USER_ID, idOrFile);
-            if (!wf)
-                throw new Error(`Workflow not found: ${idOrFile}`);
-            name = isString(wf.name) ? wf.name : "workflow";
-            description =
-                isString(wf.description) ? wf.description : "";
-            tags = Array.isArray(wf.tags)
-                ? wf.tags.filter((t) => typeof t === "string")
-                : [];
-            graph = wf.getGraph();
-        }
-        if (!graph?.nodes) {
-            throw new Error("Workflow has no graph to export");
-        }
-        const repoRoot = resolve(__dirname, "..", "..", "..");
-        const baseNodesDir = join(repoRoot, "packages", "base-nodes", "nodetool");
-        const assetsRoot = opts.assetsDir ?? join(baseNodesDir, "assets");
-        const examplesDir = opts.examplesDir ?? join(baseNodesDir, "examples");
-        const fetchAssetBytes = opts.apiUrl
-            ? makeAssetFetcher(opts.apiUrl.replace(/\/+$/, ""))
-            : await makeLocalAssetFetcher();
-        const materializeOptions = {
-            packageName: opts.package,
-            assetsRoot,
-            fetchAssetBytes
-        };
-        if (opts.includeRemote) {
-            materializeOptions.includeRemote = true;
-        }
-        const result = await materializeWorkflowConstantAssets(graph, materializeOptions);
-        const slug = name
-            .toLowerCase()
-            .replace(/[^a-z0-9]+/g, "-")
-            .replace(/^-+|-+$/g, "");
-        const example = {
-            id: slug || "workflow",
-            access: "public",
-            name,
-            description,
-            tags,
-            package_name: opts.package,
-            graph: result.graph
-        };
-        // Sanitize the on-disk filename separately from the display name so
-        // names with path separators can't escape the examples directory.
-        const safeFileName = name.replace(/[^A-Za-z0-9._-]+/g, "_").replace(/^[._]+/, "") ||
-            "workflow";
-        const outPath = opts.output ??
-            join(examplesDir, opts.package, `${safeFileName}.json`);
-        await mkdir(dirname(outPath), { recursive: true });
-        await writeFile(outPath, JSON.stringify(example, null, 2) + "\n", "utf8");
-        for (const a of result.exported) {
-            console.error(`  asset ${a.source} → ${a.packageUri} (${a.byteLength} bytes)`);
-        }
-        for (const s of result.skipped) {
-            console.error(`  warning: could not resolve asset ${s} (left as-is)`);
-        }
-        console.log(outPath);
-    }
-    catch (e) {
-        printCommandError(e);
-        process.exit(1);
-    }
-});
-workflows
-    .command("export-bundle <workflow_id_or_file...>")
-    .description("Export one or more workflows as a portable .nodetool bundle (zip): the " +
-    "graphs plus the bytes of every asset they reference, in a single file")
-    .option("--api-url <url>", "Fetch the workflow and asset bytes from a remote server instead of the local DB/assets", process.env["NODETOOL_API_URL"])
-    .option("-o, --output <file>", "Output path (default: <name>.nodetool)")
-    .option("--include-remote", "Also embed http(s) and local-file refs (off by default)")
-    .action(async (idsOrFiles, opts) => {
-    try {
-        const { readFileSync } = await import("node:fs");
-        const { writeFile } = await import("node:fs/promises");
-        const { packWorkflowsBundle } = await import("@nodetool-ai/websocket");
-        const toBundleWf = (raw) => ({
-            name: isString(raw.name) ? raw.name : "workflow",
-            description: isString(raw.description) ? raw.description : "",
-            tags: Array.isArray(raw.tags)
-                ? raw.tags.filter((t) => typeof t === "string")
-                : [],
-            run_mode: raw.run_mode ?? null,
-            settings: raw.settings ?? null,
-            graph: (raw.graph ?? raw)
-        });
-        const useServer = Boolean(opts.apiUrl);
-        const apiUrl = opts.apiUrl?.replace(/\/+$/, "") ?? "";
-        if (!useServer)
-            ensureDb();
-        const workflowsToPack = [];
-        for (const idOrFile of idsOrFiles) {
-            const isFile = idOrFile.endsWith(".json") ||
-                idOrFile.includes("/") ||
-                idOrFile.includes("\\");
-            let raw;
-            if (isFile) {
-                raw = JSON.parse(readFileSync(idOrFile, "utf8"));
-            }
-            else if (useServer) {
-                raw = (await createApiClient(apiUrl).workflows.get.query({
-                    id: idOrFile
-                }));
-            }
-            else {
-                const found = await Workflow.find(LOCAL_USER_ID, idOrFile);
-                if (!found)
-                    throw new Error(`Workflow not found: ${idOrFile}`);
-                raw = { ...found, graph: found.getGraph() };
-            }
-            const wf = toBundleWf(raw);
-            if (!wf.graph?.nodes) {
-                throw new Error(`Workflow '${idOrFile}' has no graph to export`);
-            }
-            workflowsToPack.push(wf);
-        }
-        const packOptions = {
-            workflows: workflowsToPack,
-            fetchAssetBytes: useServer
-                ? makeAssetFetcher(apiUrl)
-                : await makeLocalAssetFetcher(),
-            nodetoolVersion: cliVersion()
-        };
-        if (opts.includeRemote) {
-            packOptions.includeRemote = true;
-        }
-        const { bytes, manifest, skipped } = await packWorkflowsBundle(packOptions);
-        const defaultBase = workflowsToPack.length === 1
-            ? workflowsToPack[0].name.replace(/[^A-Za-z0-9._-]+/g, "_")
-            : `${workflowsToPack.length}-workflows`;
-        const outPath = opts.output ?? `${defaultBase}.nodetool`;
-        await writeFile(outPath, bytes);
-        for (const a of manifest.assets) {
-            console.error(`  embedded ${a.file} (${a.bytes} bytes)`);
-        }
-        for (const s of skipped) {
-            console.error(`  warning: could not resolve asset ${s} (left as-is)`);
-        }
-        console.error(`  bundled ${manifest.workflows.length} workflow(s), ${manifest.assets.length} asset(s)`);
-        console.log(outPath);
-    }
-    catch (e) {
-        printCommandError(e);
-        process.exit(1);
-    }
-});
-workflows
-    .command("import-bundle <bundle_file>")
-    .description("Import a .nodetool bundle into the local library: store its assets and " +
-    "create the workflows with refs rewritten to the imported assets")
-    .option("--json", "Output the created workflows as JSON")
-    .action(async (bundleFile, opts) => {
-    try {
-        const { readFileSync } = await import("node:fs");
-        const { randomUUID } = await import("node:crypto");
-        const { extname } = await import("node:path");
-        const { importWorkflowBundle } = await import("@nodetool-ai/websocket");
-        await setupDb();
-        const storage = new FileStorageAdapter(getDefaultAssetsPath());
-        const zip = new Uint8Array(readFileSync(bundleFile));
-        const result = await importWorkflowBundle(zip, {
-            storeAsset: async ({ bytes, fileName, contentType }) => {
-                const id = randomUUID();
-                const key = `${id}${extname(fileName)}`;
-                await storage.store(key, bytes, contentType);
-                return { uri: `asset://${key}`, assetId: id };
-            }
-        });
-        const created = [];
-        for (const wf of result.workflows) {
-            created.push(await Workflow.create({
-                user_id: "1",
-                name: wf.name,
-                description: wf.description ?? "",
-                tags: wf.tags ?? [],
-                access: "private",
-                graph: wf.graph,
-                run_mode: wf.run_mode ?? "workflow",
-                settings: wf.settings ?? null
-            }));
-        }
-        for (const s of result.missing) {
-            console.error(`  warning: bundle asset ${s} was missing from the archive`);
-        }
-        for (const m of result.checksumMismatches) {
-            console.error(`  warning: ${m}`);
-        }
-        console.error(`  imported ${created.length} workflow(s) and ${result.imported.length} asset(s) into local storage`);
-        if (opts.json) {
-            asJson(created);
-        }
-        else {
-            for (const c of created) {
-                console.log(String(c.id));
-            }
-        }
-    }
-    catch (e) {
-        printCommandError(e, opts.json);
-        process.exit(1);
-    }
-});
-// ---------------------------------------------------------------------------
-// jobs / assets — the read commands are registered from commands/resource-read.ts
-// ---------------------------------------------------------------------------
-const jobs = program.command("jobs").description("Job management");
-const assets = program.command("assets").description("Asset management");
-registerResourceReadCommands({ workflows, jobs, assets }, { ensureDb, localUserId: LOCAL_USER_ID });
-const models = program.command("models").description("Model management");
-const modelKinds = [
-    "llm",
-    "image",
-    "tts",
-    "asr",
-    "video",
-    "embedding"
-];
-function modelRow(m) {
-    return {
-        id: m["id"],
-        name: m["name"],
-        provider: m["provider"] ?? "",
-        type: m["type"] ?? "",
-        repo_id: m["repo_id"] ?? ""
-    };
+else {
+    await import("./nodetool-main.js");
 }
-models
-    .command("list")
-    .description("List all models (recommended + provider + HF cached); local by default, --api-url for remote")
-    .option("--api-url <url>", "Query a remote server instead of local providers/cache", process.env["NODETOOL_API_URL"])
-    .option("--json", "Output as JSON")
-    .action(async (opts) => {
-    try {
-        let rows;
-        if (opts.apiUrl) {
-            const client = createApiClient(opts.apiUrl);
-            rows = await client.models.all.query();
-        }
-        else {
-            await setupDb();
-            rows = await listAllModels();
-        }
-        if (opts.json) {
-            asJson(rows);
-            return;
-        }
-        printTable(rows.map(modelRow));
-    }
-    catch (e) {
-        printCommandError(e, opts.json);
-        process.exit(1);
-    }
-});
-models
-    .command("providers")
-    .description("List configured providers and their capabilities")
-    .option("--json", "Output as JSON")
-    .action(async (opts) => {
-    await setupDb();
-    try {
-        const data = await listConfiguredProviderInfo();
-        if (opts.json) {
-            asJson(data);
-            return;
-        }
-        printTable(data.map((p) => ({
-            provider: p.provider,
-            capabilities: p.capabilities.join(", ")
-        })));
-    }
-    catch (e) {
-        printCommandError(e, opts.json);
-        process.exit(1);
-    }
-});
-registerRecommendedCommand(models);
-registerHfCommands(models);
-models
-    .command("ollama")
-    .description("List Ollama models (queries the local daemon; --api-url for remote)")
-    .option("--api-url <url>", "Query a remote server instead of the local Ollama daemon", process.env["NODETOOL_API_URL"])
-    .option("--json", "Output as JSON")
-    .action(async (opts) => {
-    try {
-        let rows;
-        if (opts.apiUrl) {
-            const client = createApiClient(opts.apiUrl);
-            rows = await client.models.ollama.query();
-        }
-        else {
-            await setupDb();
-            rows = await listOllamaModels();
-        }
-        if (opts.json) {
-            asJson(rows);
-            return;
-        }
-        printTable(rows.map(modelRow));
-    }
-    catch (e) {
-        printCommandError(e, opts.json);
-        process.exit(1);
-    }
-});
-models
-    .command("huggingface")
-    .description("List HuggingFace cached models (scans the local cache; --api-url for remote)")
-    .option("--api-url <url>", "Query a remote server instead of the local HuggingFace cache", process.env["NODETOOL_API_URL"])
-    .option("--query <q>", "Search query")
-    .option("--type <t>", "Filter by HF model type")
-    .option("--json", "Output as JSON")
-    .action(async (opts) => {
-    try {
-        let rows;
-        if (opts.apiUrl) {
-            const client = createApiClient(opts.apiUrl);
-            if (opts.query || opts.type) {
-                const search = {};
-                if (opts.query) {
-                    search.query = String(opts.query);
-                }
-                if (opts.type) {
-                    search.type = String(opts.type);
-                }
-                rows = await client.models.huggingfaceSearch.query(search);
-            }
-            else {
-                rows = await client.models.huggingfaceList.query();
-            }
-        }
-        else if (opts.query || opts.type) {
-            // Wrap a bare query in wildcards so it matches as a substring, the same
-            // normalization the server's huggingfaceSearch applies.
-            const rawQuery = opts.query ? String(opts.query) : undefined;
-            const query = rawQuery && !rawQuery.includes("*") ? `*${rawQuery}*` : rawQuery;
-            rows = await searchCachedHfModels(query ? [query] : undefined, opts.type ? [String(opts.type)] : undefined);
-        }
-        else {
-            rows = await readCachedHfModels();
-        }
-        if (opts.json) {
-            asJson(rows);
-            return;
-        }
-        printTable(rows.map(modelRow));
-    }
-    catch (e) {
-        printCommandError(e, opts.json);
-        process.exit(1);
-    }
-});
-models
-    .command("by-provider <provider>")
-    .description(`List models for a provider. --kind one of: ${modelKinds.join(", ")}`)
-    .option("--kind <kind>", "Model kind", "llm")
-    .option("--json", "Output as JSON")
-    .action(async (provider, opts) => {
-    const kind = opts.kind;
-    if (!modelKinds.includes(kind)) {
-        console.error(`Invalid --kind '${opts.kind}'. Must be one of: ${modelKinds.join(", ")}`);
-        process.exit(1);
-    }
-    await setupDb();
-    try {
-        const rows = await listProviderModels(provider, kind);
-        if (opts.json) {
-            asJson(rows);
-            return;
-        }
-        printTable(rows.map(modelRow));
-    }
-    catch (e) {
-        printCommandError(e, opts.json);
-        process.exit(1);
-    }
-});
-// ---------------------------------------------------------------------------
-// storage
-// ---------------------------------------------------------------------------
-const storage = program
-    .command("storage")
-    .description("Maintain the asset storage backend");
-storage
-    .command("migrate-keys")
-    .description("Move asset objects under their owner's prefix (<userId>/<assetId>.<ext>)")
-    .option("--dry-run", "Report what would move without writing anything")
-    .option("--user-id <id>", "Migrate only this user's objects")
-    .option("--json", "Output the report as JSON")
-    .action(async (opts) => {
-    await setupDb();
-    const { migrateStorageKeys, formatMigrateKeysReport } = await import("./commands/storage.js");
-    try {
-        const migrateOptions = {
-            dryRun: Boolean(opts.dryRun)
-        };
-        if (opts.userId) {
-            migrateOptions.userId = opts.userId;
-        }
-        const report = await migrateStorageKeys(migrateOptions);
-        if (opts.json) {
-            console.log(JSON.stringify(report, null, 2));
-        }
-        else {
-            console.log(formatMigrateKeysReport(report, Boolean(opts.dryRun)));
-        }
-        if (report.failed > 0)
-            process.exit(1);
-    }
-    catch (e) {
-        printCommandError(e, opts.json);
-        process.exit(1);
-    }
-});
-workflows
-    .command("migrate-code-inputs")
-    .description("Rewrite saved Code node bodies to read declared inputs off `inputs`")
-    .option("--dry-run", "Report what would change without writing anything")
-    .option("--user-id <id>", "Migrate only this user's workflows")
-    .option("--json", "Output the report as JSON")
-    .action(async (opts) => {
-    await setupDb();
-    const { migrateCodeInputs, formatMigrateCodeInputsReport } = await import("./commands/migrate-code-inputs.js");
-    try {
-        const migrateOptions = {
-            dryRun: Boolean(opts.dryRun)
-        };
-        if (opts.userId) {
-            migrateOptions.userId = opts.userId;
-        }
-        const report = await migrateCodeInputs(migrateOptions);
-        if (opts.json) {
-            console.log(JSON.stringify(report, null, 2));
-        }
-        else {
-            console.log(formatMigrateCodeInputsReport(report, Boolean(opts.dryRun)));
-        }
-        if (report.failed > 0)
-            process.exit(1);
-    }
-    catch (e) {
-        printCommandError(e, opts.json);
-        process.exit(1);
-    }
-});
-// ---------------------------------------------------------------------------
-// secrets
-// ---------------------------------------------------------------------------
-const secrets = program
-    .command("secrets")
-    .description("Manage encrypted secrets");
-secrets
-    .command("list")
-    .description("List stored secret keys (values are never shown)")
-    .option("--user-id <id>", "User ID", "1")
-    .action(async (opts) => {
-    await setupDb();
-    try {
-        const [items] = await Secret.listForUser(opts.userId, 100);
-        if (items.length === 0) {
-            console.log("No secrets stored.");
-            return;
-        }
-        printTable(items.map((s) => ({ key: s.key, updated_at: s.updated_at ?? "" })));
-    }
-    catch (e) {
-        printCommandError(e);
-        process.exit(1);
-    }
-});
-secrets
-    .command("store <key>")
-    .description("Store or update a secret (prompts for value)")
-    .option("--user-id <id>", "User ID", "1")
-    .option("--description <desc>", "Optional description")
-    .action(async (key, opts) => {
-    await setupDb();
-    const rl = createInterface({
-        input: process.stdin,
-        output: process.stderr
-    });
-    const value = await new Promise((resolve) => {
-        process.stderr.write(`Enter value for '${key}': `);
-        rl.question("", (ans) => {
-            rl.close();
-            resolve(ans);
-        });
-    });
-    try {
-        await Secret.upsert({
-            userId: opts.userId,
-            key,
-            value,
-            description: opts.description
-        });
-        console.log(`Secret '${key}' stored.`);
-    }
-    catch (e) {
-        printCommandError(e);
-        process.exit(1);
-    }
-});
-secrets
-    .command("get <key>")
-    .description("Retrieve and print a secret value")
-    .option("--user-id <id>", "User ID", "1")
-    .action(async (key, opts) => {
-    await setupDb();
-    try {
-        const value = await getSecret(key, opts.userId);
-        if (value == null) {
-            console.error(`Secret '${key}' not found.`);
-            process.exit(1);
-        }
-        console.log(value);
-    }
-    catch (e) {
-        printCommandError(e);
-        process.exit(1);
-    }
-});
-// ---------------------------------------------------------------------------
-// settings
-// ---------------------------------------------------------------------------
-const settings = program
-    .command("settings")
-    .description("View configuration settings");
-settings
-    .command("show")
-    .description("Show current settings from environment")
-    .option("--json", "Output as JSON")
-    .action((opts) => {
-    const vars = [
-        "ENV",
-        "LOG_LEVEL",
-        "PORT",
-        "HOST",
-        "DB_PATH",
-        "NODETOOL_API_URL",
-        "ANTHROPIC_API_KEY",
-        "OPENAI_API_KEY",
-        "GEMINI_API_KEY",
-        "MISTRAL_API_KEY",
-        "GROQ_API_KEY",
-        "OLLAMA_API_URL",
-        "SERPAPI_API_KEY",
-        "HF_TOKEN",
-        "VECTORSTORE_DB_PATH",
-        "ASSET_BUCKET",
-        "S3_ENDPOINT_URL"
-    ];
-    const data = Object.fromEntries(vars.map((k) => [
-        k,
-        process.env[k]
-            ? k.endsWith("KEY") || k.endsWith("TOKEN")
-                ? "***"
-                : process.env[k]
-            : ""
-    ]));
-    if (opts.json) {
-        asJson(data);
-        return;
-    }
-    printTable(Object.entries(data).map(([variable, value]) => ({ variable, value })));
-});
-// ---------------------------------------------------------------------------
-// mcp
-// ---------------------------------------------------------------------------
-const mcp = program
-    .command("mcp")
-    .description("MCP server integration for AI coding assistants");
-mcp
-    .command("install")
-    .description("Install NodeTool MCP server config for Claude Code, Codex, and/or OpenCode")
-    .option("--url <url>", "MCP server URL", "http://127.0.0.1:7777/mcp")
-    .option("--claude", "Install for Claude Code only")
-    .option("--codex", "Install for Codex only")
-    .option("--opencode", "Install for OpenCode only")
-    .action(async (opts) => {
-    const { readFileSync, writeFileSync, existsSync, mkdirSync } = await import("node:fs");
-    const { join } = await import("node:path");
-    const { homedir } = await import("node:os");
-    const home = homedir();
-    const mcpUrl = opts.url;
-    const installAll = !opts.claude && !opts.codex && !opts.opencode;
-    const results = [];
-    // ── Claude Code ──────────────────────────────────────────────
-    if (installAll || opts.claude) {
-        try {
-            const claudeConfigPath = join(home, ".claude.json");
-            let config = {};
-            if (existsSync(claudeConfigPath)) {
-                config = JSON.parse(readFileSync(claudeConfigPath, "utf8"));
-            }
-            // Install globally under projects."~" which applies to all projects
-            const projects = (config["projects"] ?? {});
-            const globalProject = projects[home] ?? {};
-            const mcpServers = (globalProject["mcpServers"] ?? {});
-            mcpServers["nodetool"] = {
-                type: "http",
-                url: mcpUrl
-            };
-            globalProject["mcpServers"] = mcpServers;
-            projects[home] = globalProject;
-            config["projects"] = projects;
-            writeFileSync(claudeConfigPath, JSON.stringify(config, null, 2) + "\n");
-            results.push({
-                target: "Claude Code",
-                status: `Installed → ${claudeConfigPath}`
-            });
-        }
-        catch (e) {
-            results.push({ target: "Claude Code", status: `Error: ${e}` });
-        }
-    }
-    // ── Codex ────────────────────────────────────────────────────
-    if (installAll || opts.codex) {
-        try {
-            const codexDir = join(home, ".codex");
-            const codexConfigPath = join(codexDir, "config.toml");
-            mkdirSync(codexDir, { recursive: true });
-            const NODETOOL_MCP_BEGIN = "# BEGIN NODETOOL MCP";
-            const NODETOOL_MCP_END = "# END NODETOOL MCP";
-            const mcpBlock = [
-                NODETOOL_MCP_BEGIN,
-                "[mcp_servers.nodetool]",
-                `url = "${mcpUrl}"`,
-                "startup_timeout_sec = 20",
-                "tool_timeout_sec = 60",
-                "enabled = true",
-                "required = true",
-                NODETOOL_MCP_END
-            ].join("\n");
-            let content = "";
-            if (existsSync(codexConfigPath)) {
-                content = readFileSync(codexConfigPath, "utf8");
-                const re = new RegExp(`${NODETOOL_MCP_BEGIN}[\\s\\S]*?${NODETOOL_MCP_END}\\n?`);
-                if (re.test(content)) {
-                    content = content.replace(re, mcpBlock + "\n");
-                }
-                else {
-                    content = content.trimEnd() + "\n\n" + mcpBlock + "\n";
-                }
-            }
-            else {
-                content = mcpBlock + "\n";
-            }
-            writeFileSync(codexConfigPath, content);
-            results.push({
-                target: "Codex",
-                status: `Installed → ${codexConfigPath}`
-            });
-        }
-        catch (e) {
-            results.push({ target: "Codex", status: `Error: ${e}` });
-        }
-    }
-    // ── OpenCode ─────────────────────────────────────────────────
-    if (installAll || opts.opencode) {
-        try {
-            const opencodeDir = join(home, ".config", "opencode");
-            const opencodeConfigPath = join(opencodeDir, "opencode.json");
-            mkdirSync(opencodeDir, { recursive: true });
-            let config = {};
-            if (existsSync(opencodeConfigPath)) {
-                config = JSON.parse(readFileSync(opencodeConfigPath, "utf8"));
-            }
-            const mcpConfig = (config["mcp"] ?? {});
-            mcpConfig["nodetool"] = {
-                type: "remote",
-                url: mcpUrl
-            };
-            config["mcp"] = mcpConfig;
-            writeFileSync(opencodeConfigPath, JSON.stringify(config, null, 2) + "\n");
-            results.push({
-                target: "OpenCode",
-                status: `Installed → ${opencodeConfigPath}`
-            });
-        }
-        catch (e) {
-            results.push({ target: "OpenCode", status: `Error: ${e}` });
-        }
-    }
-    console.log(`\nNodeTool MCP Server: ${mcpUrl}\n`);
-    printTable(results);
-    console.log("\nMake sure the NodeTool server is running (nodetool serve) for MCP to work.\n");
-});
-mcp
-    .command("uninstall")
-    .description("Remove NodeTool MCP server config from all AI coding assistants")
-    .option("--claude", "Uninstall from Claude Code only")
-    .option("--codex", "Uninstall from Codex only")
-    .option("--opencode", "Uninstall from OpenCode only")
-    .action(async (opts) => {
-    const { readFileSync, writeFileSync, existsSync } = await import("node:fs");
-    const { join } = await import("node:path");
-    const { homedir } = await import("node:os");
-    const home = homedir();
-    const uninstallAll = !opts.claude && !opts.codex && !opts.opencode;
-    const results = [];
-    // ── Claude Code ──────────────────────────────────────────────
-    if (uninstallAll || opts.claude) {
-        try {
-            const claudeConfigPath = join(home, ".claude.json");
-            if (existsSync(claudeConfigPath)) {
-                const config = JSON.parse(readFileSync(claudeConfigPath, "utf8"));
-                const projects = config["projects"] ?? {};
-                const globalProject = projects[home] ?? {};
-                const mcpServers = globalProject["mcpServers"] ?? {};
-                if ("nodetool" in mcpServers) {
-                    delete mcpServers["nodetool"];
-                    globalProject["mcpServers"] = mcpServers;
-                    projects[home] = globalProject;
-                    config["projects"] = projects;
-                    writeFileSync(claudeConfigPath, JSON.stringify(config, null, 2) + "\n");
-                    results.push({ target: "Claude Code", status: "Removed" });
-                }
-                else {
-                    results.push({ target: "Claude Code", status: "Not installed" });
-                }
-            }
-            else {
-                results.push({ target: "Claude Code", status: "Config not found" });
-            }
-        }
-        catch (e) {
-            results.push({ target: "Claude Code", status: `Error: ${e}` });
-        }
-    }
-    // ── Codex ────────────────────────────────────────────────────
-    if (uninstallAll || opts.codex) {
-        try {
-            const codexConfigPath = join(home, ".codex", "config.toml");
-            if (existsSync(codexConfigPath)) {
-                let content = readFileSync(codexConfigPath, "utf8");
-                const re = /# BEGIN NODETOOL MCP[\s\S]*?# END NODETOOL MCP\n?/;
-                if (re.test(content)) {
-                    content = content.replace(re, "").trimEnd() + "\n";
-                    writeFileSync(codexConfigPath, content);
-                    results.push({ target: "Codex", status: "Removed" });
-                }
-                else {
-                    results.push({ target: "Codex", status: "Not installed" });
-                }
-            }
-            else {
-                results.push({ target: "Codex", status: "Config not found" });
-            }
-        }
-        catch (e) {
-            results.push({ target: "Codex", status: `Error: ${e}` });
-        }
-    }
-    // ── OpenCode ─────────────────────────────────────────────────
-    if (uninstallAll || opts.opencode) {
-        try {
-            const opencodeConfigPath = join(home, ".config", "opencode", "opencode.json");
-            if (existsSync(opencodeConfigPath)) {
-                const config = JSON.parse(readFileSync(opencodeConfigPath, "utf8"));
-                const mcpConfig = config["mcp"] ?? {};
-                if ("nodetool" in mcpConfig) {
-                    delete mcpConfig["nodetool"];
-                    config["mcp"] = mcpConfig;
-                    writeFileSync(opencodeConfigPath, JSON.stringify(config, null, 2) + "\n");
-                    results.push({ target: "OpenCode", status: "Removed" });
-                }
-                else {
-                    results.push({ target: "OpenCode", status: "Not installed" });
-                }
-            }
-            else {
-                results.push({ target: "OpenCode", status: "Config not found" });
-            }
-        }
-        catch (e) {
-            results.push({ target: "OpenCode", status: `Error: ${e}` });
-        }
-    }
-    console.log();
-    printTable(results);
-    console.log();
-});
-mcp
-    .command("status")
-    .description("Show NodeTool MCP installation status for all AI coding assistants")
-    .action(async () => {
-    const { readFileSync, existsSync } = await import("node:fs");
-    const { join } = await import("node:path");
-    const { homedir } = await import("node:os");
-    const home = homedir();
-    const results = [];
-    // Claude Code
-    try {
-        const claudeConfigPath = join(home, ".claude.json");
-        if (existsSync(claudeConfigPath)) {
-            const config = JSON.parse(readFileSync(claudeConfigPath, "utf8"));
-            const mcpServers = config?.projects?.[home]?.mcpServers ?? {};
-            if (mcpServers["nodetool"]) {
-                results.push({
-                    target: "Claude Code",
-                    status: "Installed",
-                    url: mcpServers["nodetool"].url ?? ""
-                });
-            }
-            else {
-                results.push({
-                    target: "Claude Code",
-                    status: "Not installed",
-                    url: ""
-                });
-            }
-        }
-        else {
-            results.push({ target: "Claude Code", status: "No config", url: "" });
-        }
-    }
-    catch {
-        results.push({
-            target: "Claude Code",
-            status: "Error reading config",
-            url: ""
-        });
-    }
-    // Codex
-    try {
-        const codexConfigPath = join(home, ".codex", "config.toml");
-        if (existsSync(codexConfigPath)) {
-            const content = readFileSync(codexConfigPath, "utf8");
-            const urlMatch = /# BEGIN NODETOOL MCP[\s\S]*?url\s*=\s*"([^"]*)"/.exec(content);
-            if (urlMatch) {
-                results.push({
-                    target: "Codex",
-                    status: "Installed",
-                    url: urlMatch[1] ?? ""
-                });
-            }
-            else {
-                results.push({ target: "Codex", status: "Not installed", url: "" });
-            }
-        }
-        else {
-            results.push({ target: "Codex", status: "No config", url: "" });
-        }
-    }
-    catch {
-        results.push({
-            target: "Codex",
-            status: "Error reading config",
-            url: ""
-        });
-    }
-    // OpenCode
-    try {
-        const opencodeConfigPath = join(home, ".config", "opencode", "opencode.json");
-        if (existsSync(opencodeConfigPath)) {
-            const config = JSON.parse(readFileSync(opencodeConfigPath, "utf8"));
-            if (config?.mcp?.nodetool) {
-                results.push({
-                    target: "OpenCode",
-                    status: "Installed",
-                    url: config.mcp.nodetool.url ?? ""
-                });
-            }
-            else {
-                results.push({
-                    target: "OpenCode",
-                    status: "Not installed",
-                    url: ""
-                });
-            }
-        }
-        else {
-            results.push({ target: "OpenCode", status: "No config", url: "" });
-        }
-    }
-    catch {
-        results.push({
-            target: "OpenCode",
-            status: "Error reading config",
-            url: ""
-        });
-    }
-    console.log("\nNodeTool MCP Integration Status\n");
-    printTable(results);
-    console.log();
-});
-mcp
-    .command("serve")
-    .description("Run the NodeTool MCP server over stdio for an external agent " +
-    "(Claude Code, Codex, …). All logging goes to stderr; stdout is the " +
-    "MCP protocol channel.")
-    .action(async () => {
-    try {
-        const { createMcpServer, createMcpStdioTransport, forwardMcpStdioToLocalServer } = await import("@nodetool-ai/websocket");
-        if (await forwardMcpStdioToLocalServer()) {
-            process.stderr.write("NodeTool MCP forwarding to the local API server.\n");
-            return;
-        }
-        await setupDb();
-        // A local TS-node registry powers list_nodes / search_nodes /
-        // validate_workflow without spinning up a Python worker.
-        const registry = new NodeRegistry();
-        registerBaseNodes(registry);
-        registerElevenLabsNodes(registry);
-        registerMinimaxNodes(registry);
-        registerTransformersJsNodes(registry);
-        registerFalNodes(registry);
-        registerReplicateNodes(registry);
-        registerReveNodes(registry);
-        registerHuggingFaceNodes(registry);
-        // stdio serves exactly one local user; "1" is the local single-user id.
-        const server = createMcpServer({
-            registry,
-            agentToolsScope: { userId: "1", source: "stdio-local" }
-        });
-        const transport = createMcpStdioTransport();
-        await server.connect(transport);
-        process.stderr.write("NodeTool MCP server ready on stdio.\n");
-        // The stdio transport keeps the event loop alive until the client
-        // closes the connection.
-    }
-    catch (e) {
-        printCommandError(e);
-        process.exit(1);
-    }
-});
-// ---------------------------------------------------------------------------
-// package
-// ---------------------------------------------------------------------------
-registerPackageCommands(program);
-registerPackCommands(program);
-registerWorkerCommands(program);
-// Any command that opens a remote Python bridge keeps the attached worker's
-// idle clock fresh, so the reaper doesn't pause a GPU that is mid-job.
-installWorkerActivityHeartbeat(onPythonBridgeCreated);
-// ---------------------------------------------------------------------------
-// deploy — registered from commands/deploy.ts
-// ---------------------------------------------------------------------------
-registerDeployCommands(program);
-registerAgentCommands(program);
-registerDbCommands(program);
-registerDebugCommands(program);
-registerAppCommands(program);
-registerAppsCommands(program);
-registerValidateCommand(program);
-registerTimelineCommands(program);
-registerSketchCommands(program);
-registerGameCommands(program);
-registerJsScriptCommands(program);
-registerReliabilityCommands(program);
-registerNodeCommands(program);
-registerGenerateCommand(program);
-registerEvalCommand(program);
-registerJtbdCommand(program, setupDb);
-registerAffectedCommand(program);
-registerHarnessCommands(program);
-registerCollectionCommands(program);
-registerCostsCommands(program);
-registerGenerationsCommands(program);
-registerAuthCommands(program);
-registerTelegramCommands(program);
-// ---------------------------------------------------------------------------
-program.parse();
+export {};
 //# sourceMappingURL=nodetool.js.map