@odla-ai/cli 0.43.0 → 0.44.0

package/dist/{chunk-WDWJ7HC7.js → chunk-7MUWCSGP.js}

@@ -365,10 +365,10 @@ function isManagedDevVar(line2) {
   const match = line2.match(/^\s*(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=/);
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
-function writePrivateText(path, text3) {
+function writePrivateText(path, text4) {
   mkdirSync2(dirname3(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
-  writeFileSync(temporary, text3, { mode: 384 });
+  writeFileSync(temporary, text4, { mode: 384 });
   chmodSync2(temporary, 384);
   renameSync(temporary, path);
 }
@@ -808,12 +808,12 @@ async function readAdminAiAudit(request3) {
   }
 }
 async function responseBody(response2) {
-  const text3 = await response2.text();
-  if (!text3) return {};
+  const text4 = await response2.text();
+  if (!text4) return {};
   try {
-    return JSON.parse(text3);
+    return JSON.parse(text4);
   } catch {
-    return { message: text3.slice(0, 300) };
+    return { message: text4.slice(0, 300) };
   }
 }
 function apiError(status, body) {
@@ -915,12 +915,12 @@ function timestamp2(value2) {
   return Number.isFinite(date.valueOf()) ? date.toISOString() : "";
 }
 async function responseBody2(res) {
-  const text3 = await res.text();
-  if (!text3) return {};
+  const text4 = await res.text();
+  if (!text4) return {};
   try {
-    return JSON.parse(text3);
+    return JSON.parse(text4);
   } catch {
-    return { message: text3.slice(0, 300) };
+    return { message: text4.slice(0, 300) };
   }
 }
 function apiError2(action2, status, body) {
@@ -1096,12 +1096,12 @@ function catalogModels(body) {
   return body.catalog.models.filter((value2) => isRecord3(value2) && typeof value2.id === "string" && typeof value2.provider === "string");
 }
 async function responseBody3(res) {
-  const text3 = await res.text();
-  if (!text3) return {};
+  const text4 = await res.text();
+  if (!text4) return {};
   try {
-    return JSON.parse(text3);
+    return JSON.parse(text4);
   } catch {
-    return { message: text3.slice(0, 300) };
+    return { message: text4.slice(0, 300) };
   }
 }
 function apiError3(action2, status, body) {
@@ -1147,10 +1147,17 @@ function parseArgv(argv) {
 function assertArgs(parsed, allowedOptions2, maxPositionals) {
   const allowed = new Set(allowedOptions2);
   for (const name of Object.keys(parsed.options)) {
-    if (!allowed.has(name)) throw new Error(`unknown option "--${name}"; run "odla-ai help" for supported options`);
+    if (allowed.has(name)) continue;
+    const accepts = [...allowed].sort().map((option) => `--${option}`).join(" ");
+    throw new Error(
+      `unknown option "--${name}"` + (accepts ? ` \u2014 this command accepts: ${accepts}` : " \u2014 this command takes no options")
+    );
   }
   if (parsed.positionals.length > maxPositionals) {
-    throw new Error(`unexpected argument "${parsed.positionals[maxPositionals]}"; run "odla-ai help"`);
+    const taken = parsed.positionals.slice(0, maxPositionals).join(" ");
+    throw new Error(
+      `unexpected argument "${parsed.positionals[maxPositionals]}" \u2014 ` + (maxPositionals ? `"odla-ai ${taken}" takes no further arguments` : "this command takes no arguments")
+    );
   }
 }
 function requiredString(value2, name) {
@@ -1188,6 +1195,198 @@ function addOption(options, name, value2) {
   else options[name] = [String(current), String(value2)];
 }
 
+// src/surface.ts
+var PM_ACTIONS = {
+  list: {},
+  add: {},
+  create: {},
+  get: {},
+  set: {},
+  update: {},
+  status: {},
+  move: {},
+  done: {},
+  comment: {},
+  comments: {},
+  history: {},
+  link: {},
+  ref: {},
+  rm: {},
+  delete: {}
+};
+var PM_TASK_ACTIONS = {
+  ...PM_ACTIONS,
+  ready: {},
+  claim: {},
+  release: {}
+};
+var PM_ENTITIES = {
+  ...Object.fromEntries(
+    ["goal", "conformance", "decision", "bug"].map((entity) => [entity, PM_ACTIONS])
+  ),
+  task: PM_TASK_ACTIONS,
+  kanban: PM_TASK_ACTIONS
+};
+var COMMAND_SURFACE = {
+  agent: { jobs: {}, retry: {} },
+  ai: { models: {} },
+  admin: {
+    ai: {
+      show: {},
+      set: {},
+      credentials: {},
+      models: {},
+      usage: {},
+      audit: {},
+      credential: { set: {} }
+    },
+    spend: { show: {}, reset: {} }
+  },
+  app: {
+    archive: {},
+    restore: {},
+    export: {},
+    import: {},
+    rename: {},
+    "refresh-sandbox": {},
+    "go-live": {},
+    promote: {},
+    owners: { list: {}, add: {}, remove: {} }
+  },
+  auth: { login: {} },
+  brand: { design: { unpack: {} } },
+  bug: { create: {}, list: {}, report: {} },
+  calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
+  capabilities: {},
+  code: {
+    connect: {},
+    grant: { request: {}, list: {}, approve: {}, revoke: {} },
+    repository: { show: {}, list: {}, bind: {} }
+  },
+  config: { diff: {}, plan: {}, apply: {} },
+  context: { show: {}, list: {}, save: {}, remove: {} },
+  credentials: { list: {}, revoke: {} },
+  device: { enroll: {}, list: {}, revoke: {} },
+  // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
+  discuss: {
+    groups: {},
+    list: {},
+    topics: {},
+    read: {},
+    post: {},
+    reply: {},
+    resolve: {},
+    who: {},
+    watch: {}
+  },
+  doctor: {},
+  help: {},
+  init: {},
+  monitor: { plan: {}, apply: {}, run: {}, status: {}, incidents: {}, report: {} },
+  o11y: { status: {} },
+  operations: { get: {}, wait: {} },
+  platform: {
+    status: {}
+  },
+  pm: {
+    ...PM_ENTITIES,
+    project: { list: {}, add: {}, create: {}, use: {} },
+    handoff: {},
+    next: {},
+    start: {},
+    watch: {}
+  },
+  provision: {},
+  runbook: {
+    ask: {},
+    search: {},
+    impact: {},
+    list: {},
+    get: {},
+    cat: {},
+    new: {},
+    edit: {},
+    comment: {},
+    import: {},
+    visibility: {},
+    publish: {},
+    archive: {},
+    history: {},
+    revert: {},
+    rm: {},
+    lint: {}
+  },
+  secrets: { push: {}, status: {}, set: {}, "set-clerk-key": {} },
+  security: {
+    plan: {},
+    sources: {},
+    run: {},
+    status: {},
+    report: {},
+    github: { connect: {}, disconnect: {} }
+  },
+  setup: {},
+  skill: { install: {} },
+  smoke: {},
+  version: {},
+  whoami: {}
+};
+function acceptedAfter(path) {
+  let node = COMMAND_SURFACE;
+  for (const word of path) {
+    node = node?.[word];
+    if (!node) return [];
+  }
+  return Object.keys(node).sort();
+}
+function validateInvocation(words2) {
+  let node = COMMAND_SURFACE;
+  const walked = [];
+  for (const word of words2) {
+    if (Object.keys(node).length === 0) return null;
+    const next = node[word];
+    if (!next) return { validPrefix: walked.join(" "), word, accepted: Object.keys(node).sort() };
+    walked.push(word);
+    node = next;
+  }
+  return null;
+}
+function describeProblem(problem) {
+  const where = problem.validPrefix ? `after "${problem.validPrefix}"` : "as a command";
+  if (!problem.accepted.length) return `"${problem.word}" is not accepted ${where}. Run "odla-ai help"`;
+  if (!problem.word) return `"odla-ai ${problem.validPrefix}" needs one of: ${problem.accepted.join(", ")}`;
+  return `"${problem.word}" is not accepted ${where} \u2014 try: ${problem.accepted.join(", ")}`;
+}
+function rejectWord(path, word, note) {
+  const sentence = describeProblem({
+    validPrefix: path.join(" "),
+    word: word ?? "",
+    accepted: acceptedAfter(path)
+  });
+  throw new Error(note ? `${sentence}. ${note}` : sentence);
+}
+function invocationPath(words2) {
+  let node = COMMAND_SURFACE;
+  const path = [];
+  for (const word of words2) {
+    const next = node[word];
+    if (!next) break;
+    path.push(word);
+    node = next;
+    if (Object.keys(node).length === 0) break;
+  }
+  return path;
+}
+function surfacePaths(node = COMMAND_SURFACE, prefix = []) {
+  const paths2 = [];
+  for (const [word, child] of Object.entries(node)) {
+    const path = [...prefix, word];
+    paths2.push(path);
+    paths2.push(...surfacePaths(child, path));
+  }
+  return paths2;
+}
+
 // src/admin-spend.ts
 async function call(ctx, method, scope) {
   const url = `${ctx.platformUrl.replace(/\/$/, "")}/registry/platform/spend?scope=${encodeURIComponent(scope)}`;
@@ -1237,9 +1436,7 @@ async function spendReset(ctx, scope) {
 async function adminSpend(parsed, ctx) {
   const action2 = parsed.positionals[2];
   const scope = parsed.positionals[3] ?? stringOpt(parsed.options.scope);
-  if (action2 !== "show" && action2 !== "reset") {
-    throw new Error('unknown spend command. Try "odla-ai admin spend show <scope>".');
-  }
+  if (action2 !== "show" && action2 !== "reset") rejectWord(["admin", "spend"], action2);
   if (!scope) {
     throw new Error(
       `"admin spend ${action2}" needs a scope, e.g. odla-ai admin spend ${action2} app:my-app:<incarnation>`
@@ -2038,6 +2235,11 @@ var SET_OPTIONS = [
 async function adminCommand(parsed, deps = {}) {
   const area = parsed.positionals[1];
   const action2 = parsed.positionals[2];
+  if (area !== "ai" && area !== "spend") rejectWord(["admin"], area);
+  if (!acceptedAfter(["admin", area]).includes(action2 ?? "")) rejectWord(["admin", area], action2);
+  if (action2 === "credential" && !acceptedAfter(["admin", "ai", "credential"]).includes(parsed.positionals[3] ?? "")) {
+    rejectWord(["admin", "ai", "credential"], parsed.positionals[3]);
+  }
   if (area === "spend") {
     assertArgs(parsed, JSON_OPTIONS, 4);
     const context2 = await resolveOperatorContext(parsed, { allowMissingConfig: true });
@@ -2063,14 +2265,11 @@ async function adminCommand(parsed, deps = {}) {
       out
     });
   }
-  const credentialSet = action2 === "credential" && parsed.positionals[3] === "set";
+  const credentialSet = action2 === "credential";
   const credentials = action2 === "credentials";
   const models = action2 === "models";
   const usage = action2 === "usage";
   const audit = action2 === "audit";
-  if (area !== "ai" || action2 !== "show" && action2 !== "set" && !credentialSet && !credentials && !models && !usage && !audit) {
-    throw new Error('unknown admin command. Try "odla-ai admin ai show".');
-  }
   const allowed = credentialSet ? [...CONTEXT_OPTIONS, "from-env", "stdin"] : action2 === "set" ? SET_OPTIONS : models ? [...JSON_OPTIONS, "provider"] : usage ? [...JSON_OPTIONS, "app-id", "env", "run-id", "limit"] : audit ? [...JSON_OPTIONS, "limit"] : JSON_OPTIONS;
   assertArgs(parsed, allowed, credentialSet ? 5 : action2 === "set" ? 4 : 3);
   const context = await resolveOperatorContext(parsed, { allowMissingConfig: true });
@@ -2284,9 +2483,7 @@ async function authCommand(parsed, deps = {}) {
     "json"
   ], 2);
   const action2 = parsed.positionals[1] ?? "login";
-  if (action2 !== "login") {
-    throw new Error(`unknown auth action "${action2}". Try "odla-ai auth login --app <id> --email <odla-account>".`);
-  }
+  if (action2 !== "login") rejectWord(["auth"], action2);
   const context = await resolveOperatorContext(parsed, {
     allowMissingConfig: true,
     requireApp: true
@@ -2359,9 +2556,7 @@ function bothTenants(cfg) {
 // src/agent-command.ts
 async function agentCommand(parsed, deps = {}) {
   const action2 = parsed.positionals[1];
-  if (action2 !== "jobs" && action2 !== "retry") {
-    throw new Error(`unknown agent action "${action2 ?? ""}". Try "odla-ai agent jobs --json".`);
-  }
+  if (action2 !== "jobs" && action2 !== "retry") rejectWord(["agent"], action2);
   assertArgs(parsed, ["config", "env", "state", "limit", "json", "token"], action2 === "jobs" ? 2 : 3);
   if (action2 === "retry" && (parsed.options.state !== void 0 || parsed.options.limit !== void 0)) {
     throw new Error('--state and --limit are supported only by "agent jobs"');
@@ -2474,8 +2669,8 @@ async function appImport(options) {
   const out = options.stdout ?? console;
   const say = options.json ? (line2) => out.error(line2) : (line2) => out.log(line2);
   const { tenant } = resolveTenant(cfg, options.env);
-  const text3 = options.file === "-" ? (options.readStdin ?? (() => readFileSync5(0, "utf8")))() : readFileSync5(options.file, "utf8");
-  const { format, sources } = parseImport(text3, options.ns);
+  const text4 = options.file === "-" ? (options.readStdin ?? (() => readFileSync5(0, "utf8")))() : readFileSync5(options.file, "utf8");
+  const { format, sources } = parseImport(text4, options.ns);
   if (format === "namespace-map" && options.ns) {
     throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
   }
@@ -2536,9 +2731,7 @@ async function appOwnersCommand(parsed, dependencies = {}) {
     await (sub === "add" ? ownersAdd(email, options) : ownersRemove(email, options));
     return;
   }
-  throw new Error(
-    `unknown app owners subcommand "${sub}". Try "odla-ai app owners list", "odla-ai app owners add <email>", or "odla-ai app owners remove <email>".`
-  );
+  rejectWord(["app", "owners"], sub);
 }
 
 // src/app-rename.ts
@@ -2644,8 +2837,10 @@ async function appCommand(parsed, dependencies = {}) {
     return;
   }
   if (sub !== "archive" && sub !== "restore") {
-    throw new Error(
-      `unknown app subcommand "${sub ?? ""}". Try "odla-ai app archive --yes", "odla-ai app restore", "odla-ai app export", "odla-ai app import <file>", "odla-ai app refresh-sandbox", "odla-ai app go-live", "odla-ai app promote", "odla-ai app rename <name>", or "odla-ai app owners <list|add|remove>". (Permanent deletion has no CLI: it requires a signed-in owner in Studio.)`
+    rejectWord(
+      ["app"],
+      sub,
+      "Permanent deletion has no CLI: it requires a signed-in owner in Studio."
     );
   }
   assertArgs(parsed, ["config", "token", "email", "yes", "json"], 2);
@@ -2691,7 +2886,7 @@ var EXTENSIONS = {
   "text/html": "html",
   "application/json": "json"
 };
-var encode = (text3) => new TextEncoder().encode(text3);
+var encode = (text4) => new TextEncoder().encode(text4);
 function assetFileName(uuid, mime) {
   const ext = EXTENSIONS[mime.split(";")[0].trim().toLowerCase()] ?? "bin";
   return `${uuid.replace(/[^a-zA-Z0-9._-]/g, "_")}.${ext}`;
@@ -2811,7 +3006,8 @@ async function brandCommand(parsed, deps) {
     await designUnpack(parsed, deps);
     return;
   }
-  throw new Error(USAGE);
+  if (subject !== "design") rejectWord(["brand"], subject);
+  rejectWord(["brand", "design"], action2, USAGE);
 }
 
 // src/calendar-errors.ts
@@ -3549,9 +3745,9 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
   }
   throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText5(res)}`);
 }
-function errorCode(text3) {
+function errorCode(text4) {
   try {
-    const body = JSON.parse(text3);
+    const body = JSON.parse(text4);
     return typeof body.error?.code === "string" ? body.error.code : null;
   } catch {
     return null;
@@ -4286,15 +4482,15 @@ function readWranglerConfig(path) {
     return null;
   }
 }
-function stripJsonComments(text3) {
+function stripJsonComments(text4) {
   let result = "";
   let inString = false;
-  for (let i = 0; i < text3.length; i++) {
-    const ch = text3[i];
+  for (let i = 0; i < text4.length; i++) {
+    const ch = text4[i];
     if (inString) {
       result += ch;
       if (ch === "\\") {
-        result += text3[i + 1] ?? "";
+        result += text4[i + 1] ?? "";
         i++;
       } else if (ch === '"') {
         inString = false;
@@ -4306,14 +4502,14 @@ function stripJsonComments(text3) {
       result += ch;
       continue;
     }
-    if (ch === "/" && text3[i + 1] === "/") {
-      while (i < text3.length && text3[i] !== "\n") i++;
+    if (ch === "/" && text4[i + 1] === "/") {
+      while (i < text4.length && text4[i] !== "\n") i++;
       result += "\n";
       continue;
     }
-    if (ch === "/" && text3[i + 1] === "*") {
+    if (ch === "/" && text4[i + 1] === "*") {
       i += 2;
-      while (i < text3.length && !(text3[i] === "*" && text3[i + 1] === "/")) i++;
+      while (i < text4.length && !(text4[i] === "*" && text4[i + 1] === "/")) i++;
       i++;
       continue;
     }
@@ -4827,9 +5023,9 @@ function initProject(options) {
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
   out.log("updated .gitignore for local odla credentials");
 }
-function writeIfMissing(path, text3) {
+function writeIfMissing(path, text4) {
   if (existsSync9(path)) return;
-  writeFileSync2(path, text3);
+  writeFileSync2(path, text4);
 }
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
@@ -5041,13 +5237,13 @@ async function secretsSetClerkKey(options) {
     body: JSON.stringify({ value: value2 })
   });
   if (!res.ok) {
-    const text3 = scrubValue((await res.text().catch(() => "")).slice(0, 300), value2);
-    throw new Error(`store Clerk secret key failed (${res.status}): ${text3 || "request failed"}`);
+    const text4 = scrubValue((await res.text().catch(() => "")).slice(0, 300), value2);
+    throw new Error(`store Clerk secret key failed (${res.status}): ${text4 || "request failed"}`);
   }
   out.log(`Clerk secret key stored for ${tenantId} ($clerk_secret, reserved + write-only; the value was never echoed)`);
 }
-function scrubValue(text3, value2) {
-  return redactSecrets(text3).split(value2).join("[value redacted]");
+function scrubValue(text4, value2) {
+  return redactSecrets(text4).split(value2).join("[value redacted]");
 }
 async function resolveVaultWrite(options) {
   const out = options.stdout ?? console;
@@ -5339,8 +5535,8 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     harnesses: installations
   };
 }
-function pathsUnder(root, paths) {
-  return [...paths].map((path) => relative2(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute3(path)).sort();
+function pathsUnder(root, paths2) {
+  return [...paths2].map((path) => relative2(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute3(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -5620,9 +5816,7 @@ async function secretsCommand(parsed, deps) {
     return;
   }
   if (sub !== "push") {
-    throw new Error(
-      `unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev", "odla-ai secrets status --env dev", "odla-ai secrets set <name> --env dev --stdin", or "odla-ai secrets set-clerk-key --env dev --stdin".`
-    );
+    rejectWord(["secrets"], sub);
   }
   assertArgs(parsed, ["config", "env", "dry-run", "yes"], 2);
   await secretsPush({
@@ -5635,7 +5829,7 @@ async function secretsCommand(parsed, deps) {
 async function projectCommand(command, parsed, deps) {
   if (command === "ai") {
     const sub = parsed.positionals[1];
-    if (sub !== "models") throw new Error(`unknown ai subcommand "${sub ?? ""}". Try "odla-ai ai models --env dev".`);
+    if (sub !== "models") rejectWord(["ai"], sub);
     assertArgs(parsed, ["config", "env", "provider", "json"], 2);
     await aiModels({
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
@@ -5649,9 +5843,7 @@ async function projectCommand(command, parsed, deps) {
   }
   if (command === "config") {
     const sub = parsed.positionals[1];
-    if (sub !== "diff" && sub !== "plan" && sub !== "apply") {
-      throw new Error(`unknown config subcommand "${sub ?? ""}". Try "odla-ai config diff --json".`);
-    }
+    if (sub !== "diff" && sub !== "plan" && sub !== "apply") rejectWord(["config"], sub);
     assertArgs(
       parsed,
       sub === "apply" ? ["config", "plan", "idempotency-key", "token", "email", "open", "json"] : ["config", "token", "email", "open", "json"],
@@ -5679,7 +5871,7 @@ async function projectCommand(command, parsed, deps) {
   if (command === "operations") {
     const sub = parsed.positionals[1];
     if (sub !== "get" && sub !== "wait") {
-      throw new Error(`unknown operations subcommand "${sub ?? ""}". Try "odla-ai operations get <operation-id> --json".`);
+      rejectWord(["operations"], sub);
     }
     assertArgs(
       parsed,
@@ -5753,7 +5945,7 @@ async function projectCommand(command, parsed, deps) {
   }
   if (command === "skill") {
     const sub = parsed.positionals[1];
-    if (sub !== "install") throw new Error(`unknown skill subcommand "${sub ?? ""}". Try "odla-ai skill install".`);
+    if (sub !== "install") rejectWord(["skill"], sub);
     install(parsed, 2, deps);
     return true;
   }
@@ -5769,10 +5961,10 @@ import { existsSync as existsSync11 } from "fs";
 import { cpus, hostname, totalmem } from "os";
 import { resolve as resolve11 } from "path";
 
-// ../harness/dist/chunk-LNQNFGQC.js
+// ../harness/dist/chunk-RXNHCGWE.js
 var HARNESS_PROTOCOL_VERSION = 1;
 
-// ../harness/dist/chunk-K76I2TCQ.js
+// ../harness/dist/chunk-CR6RE3A2.js
 import { execFile, spawn as spawn3 } from "child_process";
 import { constants } from "fs";
 import { access } from "fs/promises";
@@ -6024,12 +6216,12 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
   });
   if (outputBytes > 8 * 1024 * 1024) throw new Error("git file inventory exceeds 8 MiB");
   if (code !== 0) throw new Error(`git file inventory failed: ${Buffer.concat(stderr2).toString("utf8").slice(0, 1e3)}`);
-  const paths = Buffer.concat(stdout).toString("utf8").split("\0").filter(Boolean).sort();
-  if (paths.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
+  const paths2 = Buffer.concat(stdout).toString("utf8").split("\0").filter(Boolean).sort();
+  if (paths2.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
   const root = resolve22(sourceDir);
   const files = [];
   let bytes = 0;
-  for (const relativePath of paths) {
+  for (const relativePath of paths2) {
     if (!allowedWorkspacePath(relativePath)) continue;
     const source = resolve22(root, relativePath);
     if (!source.startsWith(`${root}${sep22}`)) throw new TypeError("git file path escapes workspace");
@@ -6145,7 +6337,7 @@ async function stageWorkspacePair(baselineSource, workspaceSource, options = {})
   }
 }
 
-// ../harness/dist/chunk-GYWQM76X.js
+// ../harness/dist/chunk-ISR434K7.js
 import { createHash as createHash3 } from "crypto";
 import { readFile as readFile2, readdir as readdir2 } from "fs/promises";
 import { relative as relative4, resolve as resolve10 } from "path";
@@ -6468,13 +6660,13 @@ function validateSnapshot(snapshot, limits) {
   if (!Number.isSafeInteger(limits.maximumFiles) || limits.maximumFiles < 1 || !Number.isSafeInteger(limits.maximumBytes) || limits.maximumBytes < 1 || snapshot.files.length > limits.maximumFiles) {
     throw new CamelError("limit_exceeded", "Code snapshot exceeds its registered limits.");
   }
-  const paths = /* @__PURE__ */ new Set();
+  const paths2 = /* @__PURE__ */ new Set();
   let bytes = 0;
   for (const file of snapshot.files) {
-    if (!file.path || file.path.startsWith("/") || file.path.includes("\\") || file.path.split("/").some((part) => !part || part === "." || part === "..") || paths.has(file.path) || typeof file.content !== "string") {
+    if (!file.path || file.path.startsWith("/") || file.path.includes("\\") || file.path.split("/").some((part) => !part || part === "." || part === "..") || paths2.has(file.path) || typeof file.content !== "string") {
       throw new CamelError("state_conflict", "Code snapshot contains an invalid or duplicate path.");
     }
-    paths.add(file.path);
+    paths2.add(file.path);
     bytes += utf8Length(file.path) + utf8Length(file.content);
   }
   if (bytes > limits.maximumBytes) {
@@ -6482,7 +6674,7 @@ function validateSnapshot(snapshot, limits) {
   }
 }
 
-// ../harness/dist/chunk-GYWQM76X.js
+// ../harness/dist/chunk-ISR434K7.js
 import { spawn as spawn4 } from "child_process";
 import { lstat as lstat2 } from "fs/promises";
 import { resolve as resolve23, sep as sep3 } from "path";
@@ -6628,8 +6820,8 @@ function boundedInteger(value2, spec) {
 }
 function boundedNumber(value2, spec) {
   if (spec.kind !== "finite_number" || typeof value2 !== "number" || !Number.isFinite(value2) || value2 < spec.minimum || value2 > spec.maximum) throw new CamelError("conversion_rejected", "Finite-number conversion rejected the structured value.");
-  const text3 = String(value2);
-  if (/e/i.test(text3) || (text3.split(".")[1]?.length ?? 0) > spec.maximumDecimalPlaces) throw new CamelError("conversion_rejected", "Finite-number conversion rejected a non-canonical decimal.");
+  const text4 = String(value2);
+  if (/e/i.test(text4) || (text4.split(".")[1]?.length ?? 0) > spec.maximumDecimalPlaces) throw new CamelError("conversion_rejected", "Finite-number conversion rejected a non-canonical decimal.");
   return value2;
 }
 function enumMember(value2, spec) {
@@ -6785,11 +6977,11 @@ function validateUnsafeSelector(path, value2, tool) {
   return void 0;
 }
 function looksLikeDestination(value2) {
-  const text3 = value2.trim();
-  return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text3) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text3);
+  const text4 = value2.trim();
+  return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text4) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text4);
 }
 
-// ../harness/dist/chunk-GYWQM76X.js
+// ../harness/dist/chunk-ISR434K7.js
 import { readFile as readFile4, stat as stat2 } from "fs/promises";
 import { readFile as readFile3 } from "fs/promises";
 import { join as join33 } from "path";
@@ -6954,9 +7146,9 @@ async function extractImports(builder, input) {
   const sources = input.paths.filter(isSourcePath);
   const known = new Set(sources);
   for (const path of sources) {
-    let text3;
+    let text4;
     try {
-      text3 = await input.read(path);
+      text4 = await input.read(path);
     } catch {
       continue;
     }
@@ -6964,13 +7156,13 @@ async function extractImports(builder, input) {
     const file = builder.node(FILE, path, pkg ? { pkg } : void 0);
     if (pkg) builder.edge(builder.node(PACKAGE, pkg), CONTAINS, file);
     const specifiers = /* @__PURE__ */ new Set();
-    for (const match of text3.matchAll(IMPORT_FROM)) specifiers.add(match[1]);
-    for (const match of text3.matchAll(BARE_IMPORT)) specifiers.add(match[1]);
+    for (const match of text4.matchAll(IMPORT_FROM)) specifiers.add(match[1]);
+    for (const match of text4.matchAll(BARE_IMPORT)) specifiers.add(match[1]);
     for (const specifier of specifiers) {
       const resolved = resolveImport(path, specifier, known);
       if (resolved) builder.edge(file, IMPORTS, nodeId(FILE, resolved));
     }
-    for (const name of exportedNames(text3)) {
+    for (const name of exportedNames(text4)) {
       builder.edge(file, EXPORTS, builder.node(SYMBOL, name));
     }
   }
@@ -7011,16 +7203,16 @@ async function extractData(builder, input) {
   };
   for (const path of input.paths) {
     if (!SOURCE_FILE.test(path) || input.ignore?.(path)) continue;
-    let text3;
+    let text4;
     try {
-      text3 = await input.read(path);
+      text4 = await input.read(path);
     } catch {
       continue;
     }
-    for (const statement of text3.matchAll(STATEMENT)) {
+    for (const statement of text4.matchAll(STATEMENT)) {
       const verb = statement[1].toUpperCase().replace(/\s+/g, " ");
       const start = statement.index ?? 0;
-      const rest = text3.slice(start + statement[0].length, start + STATEMENT_WINDOW);
+      const rest = text4.slice(start + statement[0].length, start + STATEMENT_WINDOW);
       if (verb === "SELECT") {
         for (const read3 of rest.matchAll(READ_TABLES)) touch(path, read3[1].toLowerCase(), TABLE, READS);
         continue;
@@ -7036,16 +7228,16 @@ async function extractData(builder, input) {
         for (const read3 of rest.matchAll(READ_TABLES)) touch(path, read3[1].toLowerCase(), TABLE, READS);
       }
     }
-    for (const match of text3.matchAll(NS_CONST)) {
-      touch(path, `${match[1]}.${match[2]}`, NAMESPACE, accessFor(text3, match.index ?? 0));
+    for (const match of text4.matchAll(NS_CONST)) {
+      touch(path, `${match[1]}.${match[2]}`, NAMESPACE, accessFor(text4, match.index ?? 0));
     }
-    for (const match of text3.matchAll(NS_LITERAL)) {
-      touch(path, match[1], NAMESPACE, accessFor(text3, match.index ?? 0));
+    for (const match of text4.matchAll(NS_LITERAL)) {
+      touch(path, match[1], NAMESPACE, accessFor(text4, match.index ?? 0));
     }
   }
 }
-function accessFor(text3, index) {
-  const window = text3.slice(Math.max(0, index - 160), index + 40);
+function accessFor(text4, index) {
+  const window = text4.slice(Math.max(0, index - 160), index + 40);
   return /\b(?:transact|update|delete|create|insert|Ops)\b/.test(window) ? WRITES : READS;
 }
 async function buildCodeGraph(input) {
@@ -7057,7 +7249,7 @@ async function buildCodeGraph(input) {
   return builder.build();
 }
 
-// ../harness/dist/chunk-GYWQM76X.js
+// ../harness/dist/chunk-ISR434K7.js
 import { createHash as createHash32 } from "crypto";
 async function digestStagedWorkspace(root, limits) {
   const files = [];
@@ -7385,7 +7577,7 @@ function validateCodePatch(rawPatch, maxBytes) {
   if (FORBIDDEN.test(patch2) || /(?:old|new)(?: file)? mode 120000/.test(patch2)) {
     throw new TypeError("patch uses a forbidden binary, link, mode, rename, or copy operation");
   }
-  const paths = [];
+  const paths2 = [];
   const lines = patch2.split("\n");
   for (let index = 0; index < lines.length; index += 1) {
     const line2 = lines[index];
@@ -7401,10 +7593,10 @@ function validateCodePatch(rawPatch, maxBytes) {
     if (!validHeaderPath(oldPath, path, "a") || !validHeaderPath(newPath, path, "b")) {
       throw new TypeError("patch file headers do not match the declared path");
     }
-    paths.push(path);
+    paths2.push(path);
   }
-  if (!paths.length || new Set(paths).size !== paths.length) throw new TypeError("patch has no diffs or repeats a path");
-  return paths;
+  if (!paths2.length || new Set(paths2).size !== paths2.length) throw new TypeError("patch has no diffs or repeats a path");
+  return paths2;
 }
 function validHeaderPath(value2, path, prefix) {
   return value2 === "/dev/null" || value2 === `${prefix}/${path}`;
@@ -7429,11 +7621,11 @@ function describePatchFailure(patch2, detail) {
   const hint = hunks.length > 0 && contextless ? " A hunk has no context lines; include at least one unchanged line above or below each change." : "";
   return `patch did not apply: ${detail}${hint}`;
 }
-async function applyCodePatch(workspaceDir, rawPatch, paths) {
+async function applyCodePatch(workspaceDir, rawPatch, paths2) {
   const patch2 = stripPatchEnvelope(rawPatch);
   await gitApply(workspaceDir, patch2, true);
   await gitApply(workspaceDir, patch2, false);
-  for (const path of paths) {
+  for (const path of paths2) {
     try {
       const info = await lstat2(resolveCodePath(workspaceDir, path));
       if (info.isSymbolicLink() || !info.isFile() && !info.isDirectory()) {
@@ -7455,8 +7647,8 @@ function gitApply(cwd, patch2, check) {
     });
     let stderr2 = "";
     child.stderr.setEncoding("utf8");
-    child.stderr.on("data", (text3) => {
-      if (stderr2.length < 4e3) stderr2 += text3.slice(0, 4e3);
+    child.stderr.on("data", (text22) => {
+      if (stderr2.length < 4e3) stderr2 += text22.slice(0, 4e3);
     });
     child.once("error", reject);
     child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(describePatchFailure(patch2, stderr2.trim().slice(0, 500)))));
@@ -7480,8 +7672,8 @@ async function restoreCodeWorkspaceCheckpoint(input) {
   const workspace = await stageWorkspace(input.trustedBaseDir, input.stage);
   try {
     if (checkpoint.patch) {
-      const paths = validateCodePatch(checkpoint.patch, 256 * 1024);
-      await applyCodePatch(workspace.workspaceDir, checkpoint.patch, paths);
+      const paths2 = validateCodePatch(checkpoint.patch, 256 * 1024);
+      await applyCodePatch(workspace.workspaceDir, checkpoint.patch, paths2);
     }
     return { workspace, checkpoint };
   } catch (error) {
@@ -7630,8 +7822,8 @@ async function verifyCodeCandidate(input) {
   try {
     const baseDigest = await digestStagedWorkspace(staged.workspaceDir, limits);
     if (baseDigest !== input.trustedBaseDigest) throw new TypeError("trusted base does not match its registered digest");
-    const paths = validateCodePatch(input.candidatePatch, policy.maximumPatchBytes);
-    await applyCodePatch(staged.workspaceDir, input.candidatePatch, paths);
+    const paths2 = validateCodePatch(input.candidatePatch, policy.maximumPatchBytes);
+    await applyCodePatch(staged.workspaceDir, input.candidatePatch, paths2);
     const sourceDigest = await digestStagedWorkspace(staged.workspaceDir, limits);
     const policyDigest = digestPolicy(policy);
     const patchDigest = digestBytes(input.candidatePatch);
@@ -7640,7 +7832,7 @@ async function verifyCodeCandidate(input) {
       trustedBaseDigest: input.trustedBaseDigest,
       patchDigest
     });
-    const changedTests = changedTestPaths(paths, policy);
+    const changedTests = changedTestPaths(paths2, policy);
     if (changedTests.length > policy.maximumChangedTests) throw new TypeError("candidate changes too many test files");
     const recipes = [];
     const logs = [];
@@ -7707,8 +7899,8 @@ function validate2(input) {
   }
   return result;
 }
-function changedTestPaths(paths, policy) {
-  return paths.filter((path) => policy.testPathSuffixes.some((suffix) => path.endsWith(suffix)) || policy.testPathPrefixes.some((prefix) => path.startsWith(prefix) || path.includes(`/${prefix}`))).sort();
+function changedTestPaths(paths2, policy) {
+  return paths2.filter((path) => policy.testPathSuffixes.some((suffix) => path.endsWith(suffix)) || policy.testPathPrefixes.some((prefix) => path.startsWith(prefix) || path.includes(`/${prefix}`))).sort();
 }
 function recipeReceipt(recipe2, result, artifacts) {
   const status = result.timedOut ? "timed_out" : result.outputLimitExceeded ? "output_limited" : result.exitCode === 0 && artifacts.every((item) => item.status === "verified") ? "passed" : "failed";
@@ -8439,7 +8631,7 @@ function createWorkspaceFileRegistry(limit = DEFAULT_MAX_FILES, enumerate = regi
     files(root) {
       const existing = cache2.get(root);
       if (existing) return existing;
-      const pending = enumerate(root, limit).then((paths) => Object.freeze(paths));
+      const pending = enumerate(root, limit).then((paths2) => Object.freeze(paths2));
       cache2.set(root, pending);
       void pending.catch(() => {
         if (cache2.get(root) === pending) cache2.delete(root);
@@ -8452,7 +8644,7 @@ function createWorkspaceFileRegistry(limit = DEFAULT_MAX_FILES, enumerate = regi
   };
 }
 async function registeredFiles(root, limit = DEFAULT_MAX_FILES) {
-  const paths = [];
+  const paths2 = [];
   const walk = async (directory) => {
     for (const entry of await readdir22(directory, { withFileTypes: true })) {
       if (SKIP_WORKSPACE_DIRS.has(entry.name)) continue;
@@ -8466,26 +8658,26 @@ async function registeredFiles(root, limit = DEFAULT_MAX_FILES) {
         } catch {
           continue;
         }
-        paths.push(path);
-        if (paths.length > limit) throw new TypeError("workspace file registry exceeds its bound");
+        paths2.push(path);
+        if (paths2.length > limit) throw new TypeError("workspace file registry exceeds its bound");
       }
     }
   };
   await walk(resolve42(root));
-  return paths.sort();
+  return paths2.sort();
 }
-function listWorkspace(paths, options = {}) {
+function listWorkspace(paths2, options = {}) {
   const max = options.maxEntries ?? 1e3;
   const prefix = options.prefix?.replace(/\/+$/, "");
-  const scoped = prefix ? paths.filter((path) => path === prefix || path.startsWith(`${prefix}/`)) : [...paths];
+  const scoped = prefix ? paths2.filter((path) => path === prefix || path.startsWith(`${prefix}/`)) : [...paths2];
   return scoped.slice(0, max);
 }
-async function searchWorkspace(root, paths, options) {
+async function searchWorkspace(root, paths2, options) {
   options.signal?.throwIfAborted();
   if (!options.query) throw new TypeError("search query must be a non-empty string");
   const maxResults = options.maxResults ?? DEFAULT_MAX_RESULTS;
   const maxFileBytes = options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES;
-  const scoped = listWorkspace(paths, { ...options.prefix ? { prefix: options.prefix } : {}, maxEntries: paths.length });
+  const scoped = listWorkspace(paths2, { ...options.prefix ? { prefix: options.prefix } : {}, maxEntries: paths2.length });
   if (scoped.length === 0) return [];
   try {
     return await nativeSearch(root, scoped, { ...options, maxResults, maxFileBytes });
@@ -8495,11 +8687,11 @@ async function searchWorkspace(root, paths, options) {
   }
 }
 var MAX_NATIVE_ARG_BYTES = 96 * 1024;
-async function nativeSearch(root, paths, options) {
+async function nativeSearch(root, paths2, options) {
   const batches = [];
   let batch = [];
   let bytes = 0;
-  for (const path of paths) {
+  for (const path of paths2) {
     const size = Buffer.byteLength(path) + 1;
     if (batch.length > 0 && bytes + size > MAX_NATIVE_ARG_BYTES) {
       batches.push(batch);
@@ -8518,7 +8710,7 @@ async function nativeSearch(root, paths, options) {
   }
   return matches;
 }
-function nativeSearchBatch(root, paths, options, remaining) {
+function nativeSearchBatch(root, paths2, options, remaining) {
   return new Promise((resolveMatches, reject) => {
     const args = [
       "--fixed-strings",
@@ -8531,7 +8723,7 @@ function nativeSearchBatch(root, paths, options, remaining) {
       options.caseSensitive === false ? "--ignore-case" : "--case-sensitive",
       "--",
       options.query,
-      ...paths
+      ...paths2
     ];
     const child = spawn33("rg", args, {
       cwd: root,
@@ -8717,16 +8909,16 @@ function createCodePolicyGate(options) {
     }
   };
 }
-function directoryPrefixes(paths) {
+function directoryPrefixes(paths2) {
   const prefixes = /* @__PURE__ */ new Set(["."]);
-  for (const path of paths) {
+  for (const path of paths2) {
     const parts = path.split("/");
     for (let index = 1; index < parts.length; index += 1) prefixes.add(parts.slice(0, index).join("/"));
   }
   return [...prefixes].sort();
 }
-async function safePrefix(base, paths, prefix) {
-  const prefixes = directoryPrefixes(paths);
+async function safePrefix(base, paths2, prefix) {
+  const prefixes = directoryPrefixes(paths2);
   const conversions = await conversionRegistry(
     [await registeredPolicy("code.prefix.v1", "code.prefixes.v1", prefixes)],
     { "code.prefixes.v1": prefixes }
@@ -8838,7 +9030,7 @@ function response(request3, ok, content2, details) {
   return { requestId: request3.requestId, ok, content: content2, ...details ? { details } : {} };
 }
 var cache = /* @__PURE__ */ new Map();
-function workspaceGraphs(workspaceDir, paths) {
+function workspaceGraphs(workspaceDir, paths2) {
   const existing = cache.get(workspaceDir);
   if (existing) return existing;
   const read22 = (path) => readFile3(join33(workspaceDir, path), "utf8");
@@ -8846,7 +9038,7 @@ function workspaceGraphs(workspaceDir, paths) {
     // No knownTables: a staged workspace may not carry migrations, and a filter
     // that silently drops every table is worse than an unfiltered one. Callers
     // with ground truth should build the graph themselves.
-    graph: await buildCodeGraph({ paths, read: read22, data: { ignore: (path) => path.includes(".generated.") } })
+    graph: await buildCodeGraph({ paths: paths2, read: read22, data: { ignore: (path) => path.includes(".generated.") } })
   }))();
   cache.set(workspaceDir, built);
   return built;
@@ -8906,11 +9098,11 @@ async function read(context, request3, options, policy, registry) {
   if (endLine < startLine || endLine - startLine + 1 > (options.maxReadLines ?? 2e3)) {
     throw new TypeError("requested line range exceeds its bound");
   }
-  const paths = await registry.files(context.workspaceDir);
-  if (!paths.includes(path)) {
+  const paths2 = await registry.files(context.workspaceDir);
+  if (!paths2.includes(path)) {
     throw new TypeError(`no such file in the staged workspace: "${path}". Use sandbox.overview, sandbox.where_is or sandbox.search to find the correct path.`);
   }
-  const allowed = await policy.read(policyContext(context, request3, options, { paths, path, startLine, endLine }));
+  const allowed = await policy.read(policyContext(context, request3, options, { paths: paths2, path, startLine, endLine }));
   if (!allowed) return response(request3, false, "tool denied by CaMeL policy");
   const target = resolveCodePath(context.workspaceDir, path);
   const info = await stat2(target);
@@ -8932,16 +9124,16 @@ async function list(context, request3, options, policy, registry) {
   const prefix = typeof raw === "string" && raw.length > 0 ? raw : void 0;
   const maxEntries = optionalInteger(request3.input.maxEntries) ?? 1e3;
   if (maxEntries > 5e3) throw new TypeError("maxEntries exceeds its bound");
-  const paths = await registry.files(context.workspaceDir);
-  const allowed = await policy.list(policyContext(context, request3, options, { paths, ...prefix ? { prefix } : {} }));
+  const paths2 = await registry.files(context.workspaceDir);
+  const allowed = await policy.list(policyContext(context, request3, options, { paths: paths2, ...prefix ? { prefix } : {} }));
   if (!allowed) return response(request3, false, "tool denied by CaMeL policy");
-  const entries = listWorkspace(paths, { ...prefix ? { prefix } : {}, maxEntries });
+  const entries = listWorkspace(paths2, { ...prefix ? { prefix } : {}, maxEntries });
   if (!entries.length) {
     return response(request3, true, prefix ? `No files under "${prefix}".` : "Workspace is empty.", { count: 0 });
   }
-  const truncated = entries.length < paths.length && entries.length === maxEntries;
-  const hint = !prefix && paths.length > 500 ? `
-\u2026 ${paths.length} files total. sandbox.overview is far cheaper for orientation; use a prefix here once you know the area.` : "";
+  const truncated = entries.length < paths2.length && entries.length === maxEntries;
+  const hint = !prefix && paths2.length > 500 ? `
+\u2026 ${paths2.length} files total. sandbox.overview is far cheaper for orientation; use a prefix here once you know the area.` : "";
   return response(
     request3,
     true,
@@ -8959,10 +9151,10 @@ async function search(context, request3, options, policy, registry) {
   const maxResults = optionalInteger(request3.input.maxResults) ?? 100;
   if (maxResults > 500) throw new TypeError("maxResults exceeds its bound");
   const caseSensitive = request3.input.caseSensitive === void 0 ? true : request3.input.caseSensitive === true;
-  const paths = await registry.files(context.workspaceDir);
-  const allowed = await policy.search(policyContext(context, request3, options, { paths, query, ...prefix ? { prefix } : {} }));
+  const paths2 = await registry.files(context.workspaceDir);
+  const allowed = await policy.search(policyContext(context, request3, options, { paths: paths2, query, ...prefix ? { prefix } : {} }));
   if (!allowed) return response(request3, false, "tool denied by CaMeL policy");
-  const matches = await searchWorkspace(context.workspaceDir, paths, {
+  const matches = await searchWorkspace(context.workspaceDir, paths2, {
     query,
     maxResults,
     caseSensitive,
@@ -8984,8 +9176,8 @@ async function graphQuery(context, request3, options, policy, registry) {
     selector: query
   }));
   if (!allowed) return response(request3, false, "tool denied by CaMeL policy");
-  const paths = await registry.files(context.workspaceDir);
-  const graphs = await workspaceGraphs(context.workspaceDir, paths);
+  const paths2 = await registry.files(context.workspaceDir);
+  const graphs = await workspaceGraphs(context.workspaceDir, paths2);
   if (request3.tool === "sandbox.overview") {
     return response(request3, true, renderOverview(graphs, query || void 0));
   }
@@ -9047,16 +9239,16 @@ function toolFailureMessage(reason) {
 async function patch(context, request3, options, policy, registry) {
   exactKeys(request3.input, ["patch"]);
   const value2 = stringField(request3.input, "patch");
-  const paths = validateCodePatch(value2, options.maxPatchBytes ?? 256 * 1024);
-  if (paths.some((path) => options.readOnlyPrefixes?.some((prefix) => path === prefix || path.startsWith(`${prefix}/`)))) {
+  const paths2 = validateCodePatch(value2, options.maxPatchBytes ?? 256 * 1024);
+  if (paths2.some((path) => options.readOnlyPrefixes?.some((prefix) => path === prefix || path.startsWith(`${prefix}/`)))) {
     throw new TypeError("patch targets a read-only reference source");
   }
   const allowed = await policy.patch(policyContext(context, request3, options, { patch: value2 }));
   if (!allowed) return response(request3, false, "tool denied by CaMeL policy");
-  await applyCodePatch(context.workspaceDir, value2, paths);
+  await applyCodePatch(context.workspaceDir, value2, paths2);
   registry.invalidate(context.workspaceDir);
   forgetWorkspaceGraphs(context.workspaceDir);
-  return response(request3, true, `Applied patch to ${paths.length} file(s).`, { paths });
+  return response(request3, true, `Applied patch to ${paths2.length} file(s).`, { paths: paths2 });
 }
 async function recipe(context, request3, options, recipes, policy) {
   exactKeys(request3.input, ["recipeId"]);
@@ -9405,11 +9597,126 @@ async function startGoalPursuit(input) {
 async function appendCodeRuntimeEvent(control, command, event, refs) {
   const eventId = `${command.commandId.slice(0, 45)}:${refs.length + 1}`;
   refs.push(eventId);
-  const bounded = event.type === "message" ? { ...event, body: event.body.trim().slice(0, 2e4) || `${event.actor} event` } : event;
+  const attributed = { ...event, interactionId: command.commandId };
+  const bounded = attributed.type === "message" ? { ...attributed, body: attributed.body.trim().slice(0, 2e4) || `${attributed.actor} event` } : attributed;
   await control.appendSessionEvent(command.sessionId, eventId, bounded);
 }
 var digestRuntimeValue = (value2) => `sha256:${createHash32("sha256").update(value2).digest("hex")}`;
 var runtimeErrorMessage = (value2) => value2 instanceof Error ? value2.message : String(value2);
+var text3 = (value2, maximum) => {
+  if (typeof value2 !== "string") return void 0;
+  const bounded = value2.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, " ").trim();
+  return bounded ? bounded.slice(0, maximum) : void 0;
+};
+var integer2 = (value2) => Number.isSafeInteger(value2) && Number(value2) >= 0 ? Number(value2) : void 0;
+var record32 = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : void 0;
+var excerpt = (value2, tail = false) => {
+  if (typeof value2 !== "string") return void 0;
+  const safe = value2.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, " ");
+  const source = (tail ? safe.slice(-1e4) : safe.slice(0, 1e4)).trim();
+  if (!source) return void 0;
+  const lines = source.split("\n").filter((line2) => line2.trim()).map((line2) => line2.slice(0, 240));
+  const selected = tail ? lines.slice(-10) : lines.slice(0, 10);
+  return text3(selected.join("\n"), 2400);
+};
+var paths = (value2) => {
+  if (!Array.isArray(value2)) return void 0;
+  const items = value2.flatMap((item) => {
+    const path = text3(item, 1024);
+    return path ? [path] : [];
+  }).slice(0, 12);
+  return items.length ? items : void 0;
+};
+function patchStats(value2) {
+  if (typeof value2 !== "string") return {};
+  let additions = 0;
+  let deletions = 0;
+  for (const line2 of value2.slice(0, 262144).split("\n")) {
+    if (line2.startsWith("+++") || line2.startsWith("---")) continue;
+    if (line2.startsWith("+")) additions += 1;
+    else if (line2.startsWith("-")) deletions += 1;
+  }
+  return { ...additions ? { additions } : {}, ...deletions ? { deletions } : {} };
+}
+function searchResults(value2) {
+  if (typeof value2 !== "string") return void 0;
+  const results = value2.split("\n").flatMap((line2) => {
+    const match = /^([^:\n]{1,1024}):(\d+):\s?(.*)$/.exec(line2);
+    if (!match) return [];
+    const lineNumber = Number(match[2]);
+    const itemText = text3(match[3], 240);
+    if (!Number.isSafeInteger(lineNumber) || lineNumber < 1) return [];
+    return [{ path: match[1], line: lineNumber, ...itemText ? { text: itemText } : {} }];
+  }).slice(0, 5);
+  return results.length ? results : void 0;
+}
+function codeToolRequestPresentation(request3) {
+  const input = request3.input;
+  if (request3.tool === "sandbox.read") {
+    const path = text3(input.path, 1024);
+    if (!path) return void 0;
+    const startLine = integer2(input.startLine);
+    const endLine = integer2(input.endLine);
+    return { kind: "read", path, ...startLine ? { startLine } : {}, ...endLine ? { endLine } : {} };
+  }
+  if (request3.tool === "sandbox.list") {
+    const scope = text3(input.prefix, 1024);
+    return { kind: "list", ...scope ? { scope } : {} };
+  }
+  if (request3.tool === "sandbox.search" || request3.tool === "sandbox.overview" || request3.tool === "sandbox.where_is" || request3.tool === "sandbox.who_imports" || request3.tool === "sandbox.who_touches") {
+    const query = text3(input.query, 512);
+    const scope = request3.tool === "sandbox.search" ? text3(input.prefix, 1024) : void 0;
+    if (request3.tool === "sandbox.search" && !query) return void 0;
+    return { kind: "query", ...query ? { query } : {}, ...scope ? { scope } : {} };
+  }
+  if (request3.tool === "sandbox.apply_patch") {
+    return { kind: "patch", ...patchStats(input.patch) };
+  }
+  const recipeId = text3(input.recipeId, 120);
+  return recipeId ? { kind: "recipe", recipeId } : void 0;
+}
+function codeToolResultPresentation(request3, response2) {
+  const started = codeToolRequestPresentation(request3);
+  if (!started || !response2.ok) return started;
+  const details = record32(response2.details);
+  if (started.kind === "read") {
+    return {
+      ...started,
+      ...integer2(details?.startLine) ? { startLine: integer2(details?.startLine) } : {},
+      ...integer2(details?.endLine) ? { endLine: integer2(details?.endLine) } : {},
+      ...excerpt(response2.content) ? { excerpt: excerpt(response2.content) } : {}
+    };
+  }
+  if (started.kind === "list") {
+    const listed = response2.content.split("\n").filter((line2) => line2 && !line2.startsWith("\u2026") && !line2.startsWith("Workspace ")).map((line2) => text3(line2, 1024)).filter((line2) => Boolean(line2)).slice(0, 8);
+    return {
+      ...started,
+      ...integer2(details?.count) !== void 0 ? { count: integer2(details?.count) } : {},
+      ...listed.length ? { paths: listed } : {}
+    };
+  }
+  if (started.kind === "query") {
+    const results = request3.tool === "sandbox.search" ? searchResults(response2.content) : void 0;
+    const resultExcerpt = request3.tool === "sandbox.search" ? void 0 : excerpt(response2.content);
+    return {
+      ...started,
+      ...integer2(details?.count) !== void 0 ? { count: integer2(details?.count) } : {},
+      ...results ? { results } : {},
+      ...resultExcerpt ? { excerpt: resultExcerpt } : {}
+    };
+  }
+  if (started.kind === "patch") {
+    return { ...started, ...paths(details?.paths) ? { paths: paths(details?.paths) } : {} };
+  }
+  const output = response2.content.replace(/^Recipe [^\n]*\.?\s*/u, "");
+  return {
+    ...started,
+    ...integer2(details?.exitCode) !== void 0 ? { exitCode: integer2(details?.exitCode) } : {},
+    ...typeof details?.timedOut === "boolean" ? { timedOut: details.timedOut } : {},
+    ...typeof details?.outputLimitExceeded === "boolean" ? { outputLimitExceeded: details.outputLimitExceeded } : {},
+    ...excerpt(output, true) ? { excerpt: excerpt(output, true) } : {}
+  };
+}
 var TheseusRuntimeEngine = class {
   constructor(options) {
     this.options = options;
@@ -9643,18 +9950,29 @@ var TheseusRuntimeEngine = class {
     return {
       execute: async (context, request3) => {
         const startedAt = Date.now();
+        const operationId = digestRuntimeValue(`${command.commandId}:${request3.requestId}`);
+        const startedPresentation = codeToolRequestPresentation(request3);
         await this.#event(
           command,
-          { type: "tool", phase: "started", tool: request3.tool },
+          {
+            type: "tool",
+            phase: "started",
+            tool: request3.tool,
+            operationId,
+            ...startedPresentation ? { presentation: startedPresentation } : {}
+          },
           active.conversationRefs
         ).catch(() => void 0);
         const response2 = await broker.execute(context, request3);
+        const completedPresentation = codeToolResultPresentation(request3, response2);
         await this.#event(command, {
           type: "tool",
           phase: "completed",
           tool: request3.tool,
           ok: response2.ok,
-          durationMs: Date.now() - startedAt
+          durationMs: Date.now() - startedAt,
+          operationId,
+          ...completedPresentation ? { presentation: completedPresentation } : {}
         }, active.conversationRefs).catch(() => void 0);
         return response2;
       }
@@ -10188,9 +10506,7 @@ function grantsUrl(cfg, suffix = "") {
 async function codeGrantCommand(parsed, deps = {}) {
   const action2 = parsed.positionals[2];
   if (!isAction(action2)) {
-    throw new Error(
-      `unknown code grant action "${action2 ?? ""}". Try "odla-ai code grant list --env dev".`
-    );
+    rejectWord(["code", "grant"], action2);
   }
   const decides = action2 === "approve" || action2 === "revoke";
   assertArgs(parsed, ["config", "env", "json", "token", "email", "open"], decides ? 4 : 3);
@@ -10310,9 +10626,7 @@ function repositoryUrl(cfg, suffix = "") {
 async function codeRepositoryCommand(parsed, deps = {}) {
   const action2 = parsed.positionals[2];
   if (!isAction2(action2)) {
-    throw new Error(
-      `unknown code repository action "${action2 ?? ""}". Try "odla-ai code repository show --env dev".`
-    );
+    rejectWord(["code", "repository"], action2);
   }
   assertArgs(parsed, ["config", "env", "repo", "json", "token", "email", "open"], 3);
   const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
@@ -10387,9 +10701,7 @@ async function codeCommand(parsed, dependencies) {
     });
   }
   if (sub !== "connect") {
-    throw new Error(
-      `unknown code subcommand "${sub ?? ""}". Try "odla-ai code connect --env dev" or "odla-ai code grant list --env dev".`
-    );
+    rejectWord(["code"], sub);
   }
   assertArgs(parsed, [
     "config",
@@ -10526,9 +10838,7 @@ async function contextCommand(parsed, deps = {}) {
     return;
   }
   if (action2 !== "show") {
-    throw new Error(
-      `unknown context action "${action2 ?? ""}". Try show|list|save|remove.`
-    );
+    rejectWord(["context"], action2);
   }
   const context = await resolveOperatorContext(parsed, {
     allowMissingConfig: true,
@@ -10584,9 +10894,7 @@ async function responseError(response2) {
 }
 async function credentialCommand(parsed, deps = {}) {
   const action2 = parsed.positionals[1] ?? "list";
-  if (action2 !== "list" && action2 !== "revoke") {
-    throw new Error(`unknown credentials action "${action2}". Try "odla-ai credentials list".`);
-  }
+  if (action2 !== "list" && action2 !== "revoke") rejectWord(["credentials"], action2);
   assertArgs(parsed, ["config", "env", "all", "json", "token", "email", "open"], action2 === "revoke" ? 3 : 2);
   const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
   const doFetch = deps.fetch ?? fetch;
@@ -11588,7 +11896,7 @@ async function discussCommand(parsed, deps = {}) {
   assertArgs(parsed, ALLOWED, 3);
   const action2 = parsed.positionals[1];
   const id2 = parsed.positionals[2];
-  if (!action2) throw new Error('"discuss" needs an action. Run "odla-ai help".');
+  if (!acceptedAfter(["discuss"]).includes(action2 ?? "")) rejectWord(["discuss"], action2);
   const ctx = await buildContext(parsed, deps);
   switch (action2) {
     case "groups":
@@ -11612,7 +11920,7 @@ async function discussCommand(parsed, deps = {}) {
       return;
     }
     default:
-      throw new Error(`unknown discuss action "${action2}". Run "odla-ai help".`);
+      rejectWord(["discuss"], action2);
   }
 }
 
@@ -11688,8 +11996,8 @@ function collectFields(parsed, allowClear) {
       if (allowClear) out[spec.key] = null;
       continue;
     }
-    const text3 = stringOpt(value2);
-    out[spec.key] = spec.num ? Number(text3) : text3;
+    const text4 = stringOpt(value2);
+    out[spec.key] = spec.num ? Number(text4) : text4;
   }
   return out;
 }
@@ -12522,7 +12830,7 @@ async function pmCommand(parsed, deps = {}) {
       assertArgs(parsed, COMMON_OPTIONS, 4);
       return pmProjectUse(await buildContext2(parsed, deps), requireId2(parsed.positionals[3], action3));
     }
-    throw new Error(`unknown pm project action "${action3}". Try list|add|use.`);
+    rejectWord(["pm", "project"], action3);
   }
   if (word === "next") {
     assertArgs(parsed, [...COMMON_OPTIONS, "app", "project", "verbose"], 2);
@@ -12553,10 +12861,10 @@ async function pmCommand(parsed, deps = {}) {
     return pmHandoff(await buildContext2(parsed, deps), parsed);
   }
   const entity = ALIASES[word];
-  if (!entity) throw new Error(`unknown pm entity "${word}". Try "odla-ai pm start" to claim Ready work, or "odla-ai pm bug list" (goal|task|decision|bug).`);
+  if (!entity) rejectWord(["pm"], word);
   const requestedAction = parsed.positionals[2] ?? "list";
   const action2 = canonicalAction(requestedAction);
-  if (!action2) throw new Error(`unknown pm action "${requestedAction}". Try list|add|get|set|done|link|ref|comment|comments|history|rm.`);
+  if (!action2) rejectWord(["pm", word], requestedAction);
   assertArgs(parsed, allowedOptions(entity, action2), 4);
   if ((action2 === "ready" || action2 === "claim" || action2 === "release") && entity !== "task") {
     throw new Error(`pm ${action2} is only valid for tasks`);
@@ -12642,12 +12950,7 @@ async function platformCommand(parsed, deps = {}) {
   if (action2 === "status") {
     return platformStatus(parsed, deps);
   }
-  throw new Error(
-    `unknown platform action "${[
-      action2,
-      parsed.positionals[2]
-    ].filter(Boolean).join(" ")}". Try "odla-ai platform status --json".`
-  );
+  rejectWord(["platform"], action2);
 }
 async function platformStatus(parsed, deps) {
   assertArgs(
@@ -12984,9 +13287,7 @@ async function o11yCommand(parsed, deps = {}) {
   );
   const action2 = parsed.positionals[1];
   if (action2 !== "status") {
-    throw new Error(
-      `unknown o11y action "${action2 ?? ""}". Try "odla-ai o11y status --json".`
-    );
+    rejectWord(["o11y"], action2);
   }
   const minutes = statusMinutes(
     numberOpt(parsed.options.minutes, "--minutes") ?? 60
@@ -13101,14 +13402,14 @@ function statusMinutes(value2) {
 }
 async function read2(url, headers, doFetch) {
   const response2 = await doFetch(url, { headers });
-  const text3 = await response2.text();
+  const text4 = await response2.text();
   let body = {};
-  if (text3) {
+  if (text4) {
     try {
-      const value2 = JSON.parse(text3);
+      const value2 = JSON.parse(text4);
       body = value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : { value: value2 };
     } catch {
-      body = { message: text3.slice(0, 300) };
+      body = { message: text4.slice(0, 300) };
     }
   }
   return { httpStatus: response2.status, body };
@@ -13239,9 +13540,7 @@ var OPTIONS = [
 async function monitorCommand(parsed, deps = {}) {
   assertArgs(parsed, OPTIONS, 3);
   const action2 = parsed.positionals[1] ?? "status";
-  if (!["plan", "apply", "run", "status", "incidents", "report"].includes(action2)) {
-    throw new Error(`unknown monitor action "${action2}". Try "odla-ai monitor status --json".`);
-  }
+  if (!acceptedAfter(["monitor"]).includes(action2)) rejectWord(["monitor"], action2);
   const context = await resolveOperatorContext(parsed, {
     allowMissingConfig: action2 !== "plan" && action2 !== "apply",
     requireApp: true
@@ -13338,13 +13637,13 @@ async function monitorCommand(parsed, deps = {}) {
 }
 async function request2(url, init, doFetch) {
   const response2 = await doFetch(url, init);
-  const text3 = await response2.text();
+  const text4 = await response2.text();
   let body = {};
   try {
-    const parsed = text3 ? JSON.parse(text3) : {};
+    const parsed = text4 ? JSON.parse(text4) : {};
     body = record10(parsed) ? parsed : { value: parsed };
   } catch {
-    body = { message: text3.slice(0, 500) };
+    body = { message: text4.slice(0, 500) };
   }
   if (!response2.ok) {
     const error = record10(body.error) ? body.error : body;
@@ -13547,8 +13846,8 @@ function runtimeUrl(cfg, suffix = "") {
   return `${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/runtime-credentials${suffix}`;
 }
 async function safeError(response2) {
-  const text3 = await response2.text();
-  return redactSecrets(text3.slice(0, 1e3));
+  const text4 = await response2.text();
+  return redactSecrets(text4.slice(0, 1e3));
 }
 async function finish(doFetch, cfg, token, sessionId, method) {
   return doFetch(runtimeUrl(cfg, `/${encodeURIComponent(sessionId)}`), {
@@ -13871,186 +14170,6 @@ async function provision(options) {
 // src/record.ts
 import { appendFileSync } from "fs";
 import process19 from "process";
-
-// src/surface.ts
-var PM_ACTIONS = {
-  list: {},
-  add: {},
-  create: {},
-  get: {},
-  set: {},
-  update: {},
-  status: {},
-  move: {},
-  done: {},
-  comment: {},
-  comments: {},
-  ref: {},
-  rm: {},
-  delete: {}
-};
-var PM_TASK_ACTIONS = {
-  ...PM_ACTIONS,
-  ready: {},
-  claim: {},
-  release: {}
-};
-var PM_ENTITIES = {
-  ...Object.fromEntries(
-    ["goal", "conformance", "decision", "bug"].map((entity) => [entity, PM_ACTIONS])
-  ),
-  task: PM_TASK_ACTIONS,
-  kanban: PM_TASK_ACTIONS
-};
-var COMMAND_SURFACE = {
-  agent: { jobs: {}, retry: {} },
-  ai: { models: {} },
-  admin: {
-    ai: {
-      show: {},
-      set: {},
-      credentials: {},
-      models: {},
-      usage: {},
-      audit: {},
-      credential: { set: {} }
-    }
-  },
-  app: {
-    archive: {},
-    restore: {},
-    export: {},
-    import: {},
-    rename: {},
-    "refresh-sandbox": {},
-    "go-live": {},
-    promote: {},
-    owners: { list: {}, add: {}, remove: {} }
-  },
-  auth: { login: {} },
-  brand: { design: { unpack: {} } },
-  bug: { create: {}, list: {}, report: {} },
-  calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
-  capabilities: {},
-  code: {
-    connect: {},
-    grant: { request: {}, list: {}, approve: {}, revoke: {} },
-    repository: { show: {}, list: {}, bind: {} }
-  },
-  config: { diff: {}, plan: {}, apply: {} },
-  context: { show: {}, list: {}, save: {}, remove: {} },
-  credentials: { list: {}, revoke: {} },
-  device: { enroll: {}, list: {}, revoke: {} },
-  // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
-  discuss: {
-    groups: {},
-    list: {},
-    topics: {},
-    read: {},
-    post: {},
-    reply: {},
-    resolve: {},
-    who: {},
-    watch: {}
-  },
-  doctor: {},
-  help: {},
-  init: {},
-  monitor: { plan: {}, apply: {}, run: {}, status: {}, incidents: {}, report: {} },
-  o11y: { status: {} },
-  operations: { get: {}, wait: {} },
-  platform: {
-    status: {}
-  },
-  pm: {
-    ...PM_ENTITIES,
-    project: { list: {}, add: {}, create: {}, use: {} },
-    handoff: {},
-    next: {},
-    watch: {}
-  },
-  provision: {},
-  runbook: {
-    ask: {},
-    search: {},
-    impact: {},
-    list: {},
-    get: {},
-    cat: {},
-    new: {},
-    edit: {},
-    comment: {},
-    import: {},
-    visibility: {},
-    publish: {},
-    archive: {},
-    history: {},
-    revert: {},
-    rm: {},
-    lint: {}
-  },
-  secrets: { push: {}, status: {}, set: {}, "set-clerk-key": {} },
-  security: {
-    plan: {},
-    sources: {},
-    run: {},
-    status: {},
-    report: {},
-    github: { connect: {}, disconnect: {} }
-  },
-  setup: {},
-  skill: { install: {} },
-  smoke: {},
-  version: {},
-  whoami: {}
-};
-function acceptedAfter(path) {
-  let node = COMMAND_SURFACE;
-  for (const word of path) {
-    node = node?.[word];
-    if (!node) return [];
-  }
-  return Object.keys(node).sort();
-}
-function validateInvocation(words2) {
-  let node = COMMAND_SURFACE;
-  const walked = [];
-  for (const word of words2) {
-    if (Object.keys(node).length === 0) return null;
-    const next = node[word];
-    if (!next) return { validPrefix: walked.join(" "), word, accepted: Object.keys(node).sort() };
-    walked.push(word);
-    node = next;
-  }
-  return null;
-}
-function describeProblem(problem) {
-  const where = problem.validPrefix ? `after "${problem.validPrefix}"` : "as a command";
-  return `"${problem.word}" is not accepted ${where} \u2014 try: ${problem.accepted.join(", ")}`;
-}
-function invocationPath(words2) {
-  let node = COMMAND_SURFACE;
-  const path = [];
-  for (const word of words2) {
-    const next = node[word];
-    if (!next) break;
-    path.push(word);
-    node = next;
-    if (Object.keys(node).length === 0) break;
-  }
-  return path;
-}
-function surfacePaths(node = COMMAND_SURFACE, prefix = []) {
-  const paths = [];
-  for (const [word, child] of Object.entries(node)) {
-    const path = [...prefix, word];
-    paths.push(path);
-    paths.push(...surfacePaths(child, path));
-  }
-  return paths;
-}
-
-// src/record.ts
 function recordInvocation(parsed) {
   const file = process19.env.ODLA_CLI_RECORD;
   if (!file) return;
@@ -14110,10 +14229,10 @@ var DAY_MS = 24 * 60 * 60 * 1e3;
 var UNITS = { d: DAY_MS, w: 7 * DAY_MS, y: 365 * DAY_MS };
 function parseDeviceTtl(raw) {
   if (raw === void 0 || raw === true) return void 0;
-  const text3 = String(raw).trim().toLowerCase();
-  if (!text3) return void 0;
-  if (text3 === "forever" || text3 === "never") return 100 * 365 * DAY_MS;
-  const match = /^(\d+)\s*([dwy])$/.exec(text3);
+  const text4 = String(raw).trim().toLowerCase();
+  if (!text4) return void 0;
+  if (text4 === "forever" || text4 === "never") return 100 * 365 * DAY_MS;
+  const match = /^(\d+)\s*([dwy])$/.exec(text4);
   if (!match) {
     throw new Error(
       `--device-ttl expects a duration like 30d, 6w, 2y, or "forever" (got "${raw}")`
@@ -14144,6 +14263,7 @@ async function deviceCommand(parsed, deps) {
     "wait"
   ], 3);
   const action2 = parsed.positionals[1] ?? "";
+  if (!acceptedAfter(["device"]).includes(action2)) rejectWord(["device"], action2);
   const out = deps.stdout ?? console;
   const doFetch = deps.fetch ?? fetch;
   const cfg = await loadProjectConfig(stringOpt(parsed.options.config));
@@ -14151,7 +14271,7 @@ async function deviceCommand(parsed, deps) {
   if (action2 === "enroll") return enroll(parsed, deps, cfg, doFetch, out, json);
   if (action2 === "list") return list2(parsed, deps, cfg, doFetch, out, json);
   if (action2 === "revoke") return revoke(parsed, deps, cfg, doFetch, out, json);
-  throw new Error('odla-ai device expects "enroll", "list", or "revoke"');
+  rejectWord(["device"], action2);
 }
 async function enroll(parsed, deps, cfg, doFetch, out, json) {
   const name = stringOpt(parsed.options.name) ?? defaultDeviceName();
@@ -14446,12 +14566,12 @@ async function runbookRemove(ctx, slug) {
 // src/runbook-import.ts
 import { readFileSync as readFileSync11, readdirSync as readdirSync2, statSync } from "fs";
 import { basename as basename2, join as join15 } from "path";
-function parseRunbook(text3, slug) {
-  let rest = text3;
+function parseRunbook(text4, slug) {
+  let rest = text4;
   const meta = {};
-  const fm = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text3);
+  const fm = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text4);
   if (fm) {
-    rest = text3.slice(fm[0].length);
+    rest = text4.slice(fm[0].length);
     for (const line2 of fm[1].split(/\r?\n/)) {
       const pair = /^(\w+)\s*:\s*(.+)$/.exec(line2.trim());
       if (!pair) continue;
@@ -15049,6 +15169,7 @@ async function buildContext3(parsed, deps, action2) {
 async function runbookCommand(parsed, deps = {}) {
   const action2 = parsed.positionals[1] ?? "list";
   assertArgs(parsed, ALLOWED2, action2 === "ask" || action2 === "search" ? 64 : 4);
+  if (!acceptedAfter(["runbook"]).includes(action2)) rejectWord(["runbook"], action2);
   const ctx = await buildContext3(parsed, deps, action2);
   const slug = parsed.positionals[2];
   switch (action2) {
@@ -15138,7 +15259,7 @@ async function runbookCommand(parsed, deps = {}) {
     case "rm":
       return runbookRemove(ctx, requireSlug(slug, "rm"));
     default:
-      throw new Error(`unknown runbook action "${action2}". Try ${acceptedAfter(["runbook"]).join(", ")}.`);
+      rejectWord(["runbook"], action2);
   }
 }
 
@@ -15759,9 +15880,7 @@ async function securityCommand(parsed, dependencies) {
     else printHostedReport(context.stdout, report5);
     return;
   }
-  if (sub !== "run") {
-    throw new Error('unknown security command. Try "odla-ai security plan", "security sources", or "security run".');
-  }
+  if (sub !== "run") rejectWord(["security"], sub);
   const sourceId = stringOpt(parsed.options.source);
   if (sourceId) await runSourceSecurityCommand(parsed, dependencies, sourceId);
   else await runLocalSecurityCommand(parsed, dependencies);
@@ -15778,9 +15897,7 @@ async function githubSecurityCommand(parsed, dependencies) {
       stringOpt(parsed.options.env)
     );
   }
-  if (action2 !== "connect") {
-    throw new Error('unknown security github command. Try "odla-ai security github connect".');
-  }
+  if (action2 !== "connect") rejectWord(["security", "github"], action2);
   assertArgs(parsed, ["config", "env", "platform", "repo", "email", "open"], 3);
   await requireStudioHuman(
     stringOpt(parsed.options.config) ?? "odla.config.mjs",
@@ -15923,6 +16040,7 @@ async function dispatchCli(argv, dependencies) {
   }
   if (command === "bug") {
     const action2 = parsed.positionals[1] ?? "list";
+    if (!acceptedAfter(["bug"]).includes(action2)) rejectWord(["bug"], action2);
     const canonical2 = action2 === "report" || action2 === "create" ? "add" : action2;
     await pmCommand({
       ...parsed,
@@ -15951,7 +16069,7 @@ async function dispatchCli(argv, dependencies) {
     return;
   }
   if (await projectCommand(command, parsed, runtime)) return;
-  throw new Error(`unknown command "${command}". Run "odla-ai help".`);
+  rejectWord([], command);
 }
 async function provisionCommand(parsed, dependencies) {
   assertArgs(parsed, [
@@ -15995,7 +16113,7 @@ async function provisionCommand(parsed, dependencies) {
 async function calendarCommand(parsed, dependencies) {
   const sub = parsed.positionals[1];
   if (sub !== "status" && sub !== "calendars" && sub !== "connect" && sub !== "disconnect") {
-    throw new Error(`unknown calendar subcommand "${sub ?? ""}". Try "odla-ai calendar status --env dev".`);
+    rejectWord(["calendar"], sub);
   }
   assertArgs(parsed, ["config", "env", "json", "token", "email", "open", "yes"], 2);
   if (sub !== "status" && sub !== "calendars" && parsed.options.json !== void 0) throw new Error(`--json is supported only by calendar status/calendars`);
@@ -16022,6 +16140,12 @@ export {
   getScopedPlatformToken,
   SYSTEM_AI_PURPOSES,
   adminAi,
+  COMMAND_SURFACE,
+  acceptedAfter,
+  validateInvocation,
+  describeProblem,
+  invocationPath,
+  surfacePaths,
   calendarServiceConfig,
   calendarBookingPageUrl,
   GOOGLE_CALENDAR_EVENTS_SCOPE,
@@ -16059,12 +16183,6 @@ export {
   monitoringWireConfig,
   monitorCommand,
   provision,
-  COMMAND_SURFACE,
-  acceptedAfter,
-  validateInvocation,
-  describeProblem,
-  invocationPath,
-  surfacePaths,
   runHostedSecurity,
   getHostedSecurityIntent,
   getHostedSecurityPlan,
@@ -16076,4 +16194,4 @@ export {
   isTerminalHostedSecurityStatus,
   runCli
 };
-//# sourceMappingURL=chunk-WDWJ7HC7.js.map
+//# sourceMappingURL=chunk-7MUWCSGP.js.map