@openma/cli 0.1.0-beta.0

package/dist/index.js

@@ -0,0 +1,1457 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { createServer } from "node:http";
+import { execSync } from "node:child_process";
+function loadConfig() {
+  const baseUrl = process.env.OMA_BASE_URL || "http://localhost:8787";
+  const apiKey = process.env.OMA_API_KEY || "";
+  if (!apiKey) {
+    console.error("Error: OMA_API_KEY environment variable is required");
+    console.error("  export OMA_API_KEY=your-api-key");
+    console.error("\n  Generate one at: " + baseUrl + " \u2192 API Keys");
+    process.exit(1);
+  }
+  return { baseUrl, apiKey, json: false };
+}
+async function apiFetch(config, path, init) {
+  const url = `${config.baseUrl}${path}`;
+  const res = await fetch(url, {
+    ...init,
+    headers: {
+      "x-api-key": config.apiKey,
+      "content-type": "application/json",
+      // Identify as a browser-compatible client. Node's default `node` UA
+      // gets rejected by Cloudflare's bot fight rules on api.openma.dev with
+      // a 1010 ban; a Mozilla-style UA passes the integrity check while
+      // still naming the actual client and product page for log readers.
+      "user-agent": "Mozilla/5.0 (compatible; OpenManagedAgents-CLI/0.1; +https://openma.dev)",
+      ...init?.headers
+    }
+  });
+  if (!res.ok) {
+    const body = await res.text();
+    throw new Error(`${res.status} ${res.statusText}: ${body}`);
+  }
+  return res.json();
+}
+function flag(args, name) {
+  const idx = args.indexOf(name);
+  return idx !== -1 ? args[idx + 1] : void 0;
+}
+function table(rows) {
+  if (!rows.length) return;
+  const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => (r[i] || "").length)));
+  for (const row of rows) {
+    console.log(row.map((c, i) => (c || "").padEnd(widths[i])).join("  "));
+  }
+}
+function capsPreview(caps) {
+  if (!caps.length) return "0";
+  if (caps.length <= 2) return caps.join(",");
+  return `${caps.slice(0, 2).join(",")}+${caps.length - 2}`;
+}
+function isPubliclyReachable(url) {
+  try {
+    const u = new URL(url);
+    if (u.hostname === "localhost" || u.hostname === "127.0.0.1") return false;
+    if (/^192\.168\./.test(u.hostname)) return false;
+    if (/^10\./.test(u.hostname)) return false;
+    return true;
+  } catch {
+    return true;
+  }
+}
+var commands = [
+  // Agents
+  {
+    group: "Agents",
+    match: ["agents", "list"],
+    usage: "oma agents list",
+    desc: "List agents",
+    http: "GET    /v1/agents?limit=N&order=asc|desc",
+    async run(config) {
+      const { data } = await apiFetch(config, "/v1/agents?limit=100");
+      if (!data.length) {
+        console.log("No agents. Create one with: oma agents create");
+        return;
+      }
+      table([["NAME", "ID", "MODEL", "CREATED"], ...data.map((a) => [a.name, a.id, typeof a.model === "string" ? a.model : a.model?.id || "", new Date(a.created_at).toLocaleDateString()])]);
+    }
+  },
+  {
+    group: "Agents",
+    match: ["agents", "create"],
+    usage: "oma agents create <name> [--model <id>]",
+    desc: "Create agent",
+    http: "POST   /v1/agents {name, model, system, tools, skills?, mcp_servers?, callable_agents?}",
+    async run(config, args) {
+      const name = flag(args, "--name") || args.find((a) => !a.startsWith("--"));
+      const model = flag(args, "--model") || "claude-sonnet-4-6";
+      const system = flag(args, "--system") || "";
+      if (!name) {
+        console.error("Usage: oma agents create <name> [--model <id>] [--system <prompt>]");
+        process.exit(1);
+      }
+      const agent = await apiFetch(config, "/v1/agents", { method: "POST", body: JSON.stringify({ name, model, system, tools: [{ type: "agent_toolset_20260401" }] }) });
+      console.log(`Agent created: ${agent.name} (${agent.id})`);
+    }
+  },
+  {
+    group: "Agents",
+    match: ["agents", "get"],
+    needsArg: true,
+    usage: "oma agents get <id>",
+    desc: "Get agent details",
+    http: "GET    /v1/agents/:id",
+    async run(config, args) {
+      const a = await apiFetch(config, `/v1/agents/${args[0]}`);
+      console.log(`Name:    ${a.name}
+ID:      ${a.id}
+Model:   ${typeof a.model === "string" ? a.model : a.model?.id}
+Version: v${a.version}`);
+      if (a.description) console.log(`Desc:    ${a.description}`);
+      if (a.system) console.log(`System:  ${a.system.slice(0, 100)}${a.system.length > 100 ? "..." : ""}`);
+    }
+  },
+  {
+    group: "Agents",
+    match: ["agents", "delete"],
+    needsArg: true,
+    usage: "oma agents delete <id>",
+    desc: "Delete agent",
+    http: "DELETE /v1/agents/:id",
+    async run(config, args) {
+      await apiFetch(config, `/v1/agents/${args[0]}`, { method: "DELETE" });
+      console.log(`Agent deleted: ${args[0]}`);
+    }
+  },
+  // Sessions
+  {
+    group: "Sessions",
+    match: ["sessions", "list"],
+    usage: "oma sessions list",
+    desc: "List sessions",
+    http: "GET    /v1/sessions?agent_id=X&limit=N",
+    async run(config) {
+      const { data } = await apiFetch(config, "/v1/sessions?limit=20");
+      if (!data.length) {
+        console.log("No sessions.");
+        return;
+      }
+      table([["TITLE", "ID", "STATUS", "AGENT", "CREATED"], ...data.map((s) => [s.title || "Untitled", s.id, s.status || "idle", s.agent_id, new Date(s.created_at).toLocaleDateString()])]);
+    }
+  },
+  {
+    group: "Sessions",
+    match: ["sessions", "create"],
+    usage: "oma sessions create --agent <id> --env <id> [--title <t>]",
+    desc: "Create session",
+    http: "POST   /v1/sessions {agent, environment_id, title?, vault_ids?, resources?}",
+    async run(config, args) {
+      const agentId = flag(args, "--agent");
+      const envId = flag(args, "--env");
+      const title = flag(args, "--title") || "";
+      if (!agentId || !envId) {
+        console.error("Usage: oma sessions create --agent <id> --env <id> [--title <text>]");
+        process.exit(1);
+      }
+      const session = await apiFetch(config, "/v1/sessions", { method: "POST", body: JSON.stringify({ agent: agentId, environment_id: envId, title }) });
+      console.log(`Session created: ${session.id}`);
+    }
+  },
+  {
+    group: "Sessions",
+    match: ["sessions", "message"],
+    needsArg: true,
+    usage: "oma sessions message <id> <text>",
+    desc: "Send message to session",
+    http: 'POST   /v1/sessions/:id/events {events:[{type:"user.message",content:[{type:"text",text:"..."}]}]}',
+    async run(config, args) {
+      const text = args.slice(1).join(" ");
+      await apiFetch(config, `/v1/sessions/${args[0]}/events`, { method: "POST", body: JSON.stringify({ events: [{ type: "user.message", content: [{ type: "text", text }] }] }) });
+      console.log("Message sent.");
+    }
+  },
+  // Environments
+  {
+    group: "Environments",
+    match: ["envs", "list"],
+    usage: "oma envs list",
+    desc: "List environments",
+    http: "GET    /v1/environments",
+    async run(config) {
+      const { data } = await apiFetch(config, "/v1/environments");
+      if (!data.length) {
+        console.log("No environments. Create one with: oma envs create <name>");
+        return;
+      }
+      table([["NAME", "ID", "STATUS"], ...data.map((e) => [e.name, e.id, e.status || "ready"])]);
+    }
+  },
+  {
+    group: "Environments",
+    match: ["envs", "create"],
+    needsArg: true,
+    usage: "oma envs create <name>",
+    desc: "Create environment",
+    http: 'POST   /v1/environments {name, config:{type:"cloud"}}',
+    async run(config, args) {
+      const env = await apiFetch(config, "/v1/environments", { method: "POST", body: JSON.stringify({ name: args.join(" "), config: { type: "cloud" } }) });
+      console.log(`Environment created: ${env.name} (${env.id})`);
+    }
+  },
+  // Model Cards
+  {
+    group: "Model Cards",
+    match: ["models", "list"],
+    usage: "oma models list",
+    desc: "List model cards",
+    http: "GET    /v1/model_cards",
+    async run(config) {
+      const { data } = await apiFetch(config, "/v1/model_cards");
+      if (!data.length) {
+        console.log("No model cards. Create one with: oma models create");
+        return;
+      }
+      table([["NAME", "PROVIDER", "MODEL", "KEY", "DEFAULT"], ...data.map((c) => [c.name, c.provider, c.model_id, `****${c.api_key_preview || ""}`, c.is_default ? "yes" : ""])]);
+    }
+  },
+  {
+    group: "Model Cards",
+    match: ["models", "create"],
+    usage: "oma models create --name <n> --model-id <id> --api-key <key> [--provider <p>]",
+    desc: "Create model card",
+    http: "POST   /v1/model_cards {name, provider, model_id, api_key, base_url?, is_default?}",
+    async run(config, args) {
+      const name = flag(args, "--name");
+      const provider = flag(args, "--provider") || "ant";
+      const modelId = flag(args, "--model-id");
+      const apiKey = flag(args, "--api-key");
+      const baseUrl = flag(args, "--base-url");
+      if (!name || !modelId || !apiKey) {
+        console.error("Usage: oma models create --name <name> --model-id <id> --api-key <key> [--provider ant|oai|ant-compatible|oai-compatible] [--base-url <url>]");
+        process.exit(1);
+      }
+      const card = await apiFetch(config, "/v1/model_cards", { method: "POST", body: JSON.stringify({ name, provider, model_id: modelId, api_key: apiKey, base_url: baseUrl }) });
+      console.log(`Model card created: ${card.name} (${card.id})`);
+    }
+  },
+  // API Keys
+  {
+    group: "API Keys",
+    match: ["keys", "list"],
+    usage: "oma keys list",
+    desc: "List API keys",
+    http: "GET    /v1/api_keys",
+    async run(config) {
+      const { data } = await apiFetch(config, "/v1/api_keys");
+      if (!data.length) {
+        console.log("No API keys. Create one with: oma keys create");
+        return;
+      }
+      table([["NAME", "ID", "PREFIX", "CREATED"], ...data.map((k) => [k.name, k.id, k.prefix + "...", new Date(k.created_at).toLocaleDateString()])]);
+    }
+  },
+  {
+    group: "API Keys",
+    match: ["keys", "create"],
+    usage: "oma keys create [name]",
+    desc: "Create API key",
+    http: "POST   /v1/api_keys {name?} \u2014 raw key returned once",
+    async run(config, args) {
+      const key = await apiFetch(config, "/v1/api_keys", { method: "POST", body: JSON.stringify({ name: args.join(" ") || "CLI key" }) });
+      console.log(`API key created: ${key.name}
+
+  ${key.key}
+
+Save this key \u2014 it won't be shown again.`);
+    }
+  },
+  {
+    group: "API Keys",
+    match: ["keys", "revoke"],
+    needsArg: true,
+    usage: "oma keys revoke <id>",
+    desc: "Revoke API key",
+    http: "DELETE /v1/api_keys/:id",
+    async run(config, args) {
+      await apiFetch(config, `/v1/api_keys/${args[0]}`, { method: "DELETE" });
+      console.log(`API key revoked: ${args[0]}`);
+    }
+  },
+  // Vaults & Credentials
+  {
+    group: "Vaults",
+    match: ["vaults", "list"],
+    usage: "oma vaults list",
+    desc: "List vaults",
+    http: "GET    /v1/vaults",
+    async run(config) {
+      const { data } = await apiFetch(config, "/v1/vaults");
+      if (!data.length) {
+        console.log("No vaults. Create one with: oma vaults create <name>");
+        return;
+      }
+      table([["NAME", "ID", "CREATED"], ...data.map((v) => [v.name, v.id, new Date(v.created_at).toLocaleDateString()])]);
+    }
+  },
+  {
+    group: "Vaults",
+    match: ["vaults", "create"],
+    needsArg: true,
+    usage: "oma vaults create <name>",
+    desc: "Create vault",
+    http: "POST   /v1/vaults {name}",
+    async run(config, args) {
+      const vault = await apiFetch(config, "/v1/vaults", { method: "POST", body: JSON.stringify({ name: args.join(" ") }) });
+      console.log(`Vault created: ${vault.name} (${vault.id})`);
+    }
+  },
+  {
+    group: "Vaults",
+    match: ["creds", "list"],
+    needsArg: true,
+    usage: "oma creds list <vault-id>",
+    desc: "List credentials",
+    http: "GET    /v1/vaults/:id/credentials",
+    async run(config, args) {
+      const { data } = await apiFetch(config, `/v1/vaults/${args[0]}/credentials`);
+      if (!data.length) {
+        console.log("No credentials in this vault.");
+        return;
+      }
+      table([["NAME", "TYPE", "DETAIL"], ...data.map((c) => [c.display_name, c.auth.type, c.auth.mcp_server_url || c.auth.command_prefixes?.join(", ") || ""])]);
+    }
+  },
+  {
+    group: "Vaults",
+    match: ["secret", "add"],
+    usage: "oma secret add --vault <id> --name <n> --cmd <pfx> --env <var> --token <t>",
+    desc: "Add secret credential",
+    http: "POST   /v1/vaults/:id/credentials {display_name, auth:{type, command_prefixes, env_var, token}}",
+    async run(config, args) {
+      const vaultId = flag(args, "--vault");
+      const name = flag(args, "--name");
+      const cmd = flag(args, "--cmd");
+      const envVar = flag(args, "--env");
+      const token = flag(args, "--token");
+      if (!vaultId || !name || !cmd || !envVar || !token) {
+        console.error("Usage: oma secret add --vault <id> --name <name> --cmd <prefixes> --env <var> --token <token>");
+        process.exit(1);
+      }
+      const cred = await apiFetch(config, `/v1/vaults/${vaultId}/credentials`, { method: "POST", body: JSON.stringify({ display_name: name, auth: { type: "command_secret", command_prefixes: cmd.split(",").map((s) => s.trim()), env_var: envVar, token } }) });
+      console.log(`Secret added: ${name} (${cred.id})`);
+    }
+  },
+  // Skills
+  {
+    group: "Skills",
+    match: ["skills", "list"],
+    usage: "oma skills list",
+    desc: "List skills",
+    http: "GET    /v1/skills?source=custom|builtin",
+    async run(config) {
+      const { data } = await apiFetch(config, "/v1/skills");
+      if (!data.length) {
+        console.log("No skills.");
+        return;
+      }
+      table([["NAME", "ID", "SOURCE"], ...data.map((s) => [s.display_title || s.name, s.id, s.source])]);
+    }
+  },
+  {
+    group: "Skills",
+    match: ["skills", "install"],
+    needsArg: true,
+    usage: "oma skills install <slug>",
+    desc: "Install from ClawHub",
+    http: "POST   /v1/clawhub/install {slug}",
+    async run(config, args) {
+      console.log(`Installing ${args[0]} from ClawHub...`);
+      const skill = await apiFetch(config, "/v1/clawhub/install", { method: "POST", body: JSON.stringify({ slug: args[0] }) });
+      console.log(`Installed: ${skill.display_title} (${skill.id})`);
+    }
+  },
+  // MCP Connect
+  {
+    group: "MCP Servers",
+    match: ["connect"],
+    needsArg: true,
+    usage: "oma connect <server|url> --vault <id>",
+    desc: "Connect via OAuth",
+    http: "GET    /v1/oauth/authorize?mcp_server_url=X&vault_id=Y (redirect)",
+    async run(config, args) {
+      const vaultId = flag(args, "--vault");
+      if (!vaultId) {
+        console.error("Usage: oma connect <server> --vault <vault-id>");
+        process.exit(1);
+      }
+      await connectMcp(config, resolveServerUrl(args[0]), vaultId);
+    }
+  },
+  // Linear integration
+  {
+    group: "Linear",
+    match: ["linear", "list"],
+    usage: "oma linear list",
+    desc: "List connected Linear workspaces",
+    http: "GET    /v1/integrations/linear/installations",
+    async run(config) {
+      const { data } = await apiFetch(config, "/v1/integrations/linear/installations");
+      if (config.json) {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+      }
+      if (!data.length) {
+        console.log("No Linear workspaces connected. Publish an agent with: oma linear publish <agent-id> --env <env-id>");
+        return;
+      }
+      table([["WORKSPACE", "INSTALLATION ID", "KIND", "CREATED"], ...data.map((i) => [i.workspace_name, i.id, i.install_kind, new Date(i.created_at).toLocaleDateString()])]);
+    }
+  },
+  {
+    group: "Linear",
+    match: ["linear", "pubs"],
+    needsArg: true,
+    usage: "oma linear pubs <installation-id>",
+    desc: "List agents published to a workspace",
+    http: "GET    /v1/integrations/linear/installations/:id/publications",
+    async run(config, args) {
+      const { data } = await apiFetch(config, `/v1/integrations/linear/installations/${args[0]}/publications`);
+      if (config.json) {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+      }
+      if (!data.length) {
+        console.log("No publications. Publish with: oma linear publish <agent-id> --env <env-id>");
+        return;
+      }
+      table([["PERSONA", "PUBLICATION ID", "AGENT", "STATUS", "CAPS"], ...data.map((p) => [p.persona.name, p.id, p.agent_id, p.status, capsPreview(p.capabilities)])]);
+    }
+  },
+  {
+    group: "Linear",
+    match: ["linear", "get"],
+    needsArg: true,
+    usage: "oma linear get <publication-id>",
+    desc: "Show one publication",
+    http: "GET    /v1/integrations/linear/publications/:id",
+    async run(config, args) {
+      const p = await apiFetch(config, `/v1/integrations/linear/publications/${args[0]}`);
+      if (config.json) {
+        console.log(JSON.stringify(p, null, 2));
+        return;
+      }
+      console.log(`Persona:        ${p.persona.name}
+ID:             ${p.id}
+Agent:          ${p.agent_id}
+Environment:    ${p.environment_id}
+Installation:   ${p.installation_id}
+Mode:           ${p.mode}
+Status:         ${p.status}
+Granularity:    ${p.session_granularity}
+Capabilities:   ${p.capabilities.join(", ")}`);
+    }
+  },
+  {
+    group: "Linear",
+    match: ["linear", "publish"],
+    needsArg: true,
+    usage: "oma linear publish <agent-id> --env <env-id> [--persona <name>] [--avatar <url>]",
+    desc: "Step 1: register agent \u2192 returns Linear App config",
+    http: "POST   /v1/integrations/linear/start-a1 {agentId, environmentId, personaName, personaAvatarUrl?, returnUrl}",
+    async run(config, args) {
+      const agentId = args[0];
+      const envId = flag(args, "--env");
+      const persona = flag(args, "--persona") || "";
+      const avatar = flag(args, "--avatar") || null;
+      if (!envId) {
+        console.error("Usage: oma linear publish <agent-id> --env <env-id> [--persona <name>] [--avatar <url>]");
+        process.exit(1);
+      }
+      let personaName = persona;
+      if (!personaName) {
+        const agent = await apiFetch(config, `/v1/agents/${agentId}`).catch(() => null);
+        personaName = agent?.name || agentId;
+      }
+      const r = await apiFetch(
+        config,
+        "/v1/integrations/linear/start-a1",
+        { method: "POST", body: JSON.stringify({ agentId, environmentId: envId, personaName, personaAvatarUrl: avatar, returnUrl: `${config.baseUrl}/integrations/linear` }) }
+      );
+      if (config.json) {
+        console.log(JSON.stringify(r, null, 2));
+        return;
+      }
+      console.log(`
+Step 1 complete. Now register a Linear OAuth App (Linear \u2192 Settings \u2192 API \u2192 New OAuth app):
+`);
+      console.log(`  App name:        ${r.suggestedAppName}`);
+      console.log(`  Callback URL:    ${r.callbackUrl}`);
+      console.log(`  Webhook URL:     ${r.webhookUrl}`);
+      console.log(`  Webhook secret:  (generated by Linear \u2014 see step 2)`);
+      if (!isPubliclyReachable(r.callbackUrl) || !r.callbackUrl.startsWith("https://")) {
+        console.log(`
+\u26A0  Linear requires HTTPS on a publicly-reachable host for callback/webhook URLs.`);
+        console.log(`The URLs above point at a local / non-HTTPS origin \u2014 Linear's form will reject them.`);
+        console.log(`Fix: deploy the integrations worker (or run a tunnel like cloudflared/ngrok) and set`);
+        console.log(`GATEWAY_ORIGIN to that public HTTPS host before publishing.`);
+      }
+      console.log(`
+Step 2 \u2014 submit the credentials Linear gives you:
+`);
+      console.log(`  oma linear submit <FORM_TOKEN> \\
+    --client-id <CLIENT_ID> --client-secret <CLIENT_SECRET> --webhook-secret <lin_wh_\u2026>
+`);
+      console.log(`The webhook secret is on the same Linear App page, under "Webhooks \u2192 Signing secret"`);
+      console.log(`(starts with \`lin_wh_\`). Linear auto-generates it and ignores any value you paste in,`);
+      console.log(`so OMA can't predict it \u2014 you have to copy it back here.
+`);
+      console.log(`Form token (expires ~30 min):
+  ${r.formToken}
+`);
+      console.log(`Or, to send the Linear App registration to a workspace admin instead:`);
+      console.log(`  oma linear handoff ${r.formToken}`);
+      console.log(`
+For scripts, re-run with --json to get the raw response.`);
+    }
+  },
+  {
+    group: "Linear",
+    match: ["linear", "submit"],
+    needsArg: true,
+    usage: "oma linear submit <form-token> --client-id <id> --client-secret <secret> --webhook-secret <lin_wh_\u2026>",
+    desc: "Step 2: validate creds \u2192 returns OAuth install URL",
+    http: "POST   /v1/integrations/linear/credentials {formToken, clientId, clientSecret, webhookSecret}",
+    async run(config, args) {
+      const formToken = args[0];
+      const clientId = flag(args, "--client-id");
+      const clientSecret = flag(args, "--client-secret");
+      const webhookSecret = flag(args, "--webhook-secret");
+      if (!clientId || !clientSecret || !webhookSecret) {
+        console.error(
+          "Usage: oma linear submit <form-token> --client-id <id> --client-secret <secret> --webhook-secret <lin_wh_\u2026>\n  webhook-secret is the 'Signing secret' on the Linear App's Webhooks panel."
+        );
+        process.exit(1);
+      }
+      const r = await apiFetch(
+        config,
+        "/v1/integrations/linear/credentials",
+        { method: "POST", body: JSON.stringify({ formToken, clientId, clientSecret, webhookSecret }) }
+      ).catch((err) => {
+        if (/form_token_invalid|JwtSigner\.verify/i.test(err.message)) {
+          console.error(`Form token rejected. Re-run \`oma linear publish <agent-id> --env <env-id>\` to mint a fresh token.`);
+          process.exit(1);
+        }
+        throw err;
+      });
+      if (config.json) {
+        console.log(JSON.stringify(r, null, 2));
+        return;
+      }
+      console.log(`
+Step 2 complete. Open this URL in a browser to authorize the install in Linear:
+`);
+      console.log(`  ${r.url}
+`);
+      console.log(`After approval Linear redirects to the callback; the publication then transitions to 'live'.`);
+      console.log(`Verify with: oma linear list && oma linear pubs <installation-id>`);
+    }
+  },
+  {
+    group: "Linear",
+    match: ["linear", "handoff"],
+    needsArg: true,
+    usage: "oma linear handoff <form-token>",
+    desc: "Step 2 alt: 7-day shareable URL for an admin",
+    http: "POST   /v1/integrations/linear/handoff-link {formToken}",
+    async run(config, args) {
+      const r = await apiFetch(
+        config,
+        "/v1/integrations/linear/handoff-link",
+        { method: "POST", body: JSON.stringify({ formToken: args[0] }) }
+      ).catch((err) => {
+        if (/form_token_invalid|JwtSigner\.verify/i.test(err.message)) {
+          console.error(`Form token rejected. Re-run \`oma linear publish <agent-id> --env <env-id>\` to mint a fresh token.`);
+          process.exit(1);
+        }
+        throw err;
+      });
+      if (config.json) {
+        console.log(JSON.stringify(r, null, 2));
+        return;
+      }
+      console.log(`
+Send this URL to your Linear workspace admin:
+  ${r.url}
+Expires in ${r.expiresInDays} days.`);
+    }
+  },
+  {
+    group: "Linear",
+    match: ["linear", "update"],
+    needsArg: true,
+    usage: "oma linear update <publication-id> [--persona <name>] [--avatar <url>] [--caps <a,b,c>]",
+    desc: "Update persona / capabilities of a publication",
+    http: "PATCH  /v1/integrations/linear/publications/:id {persona?, capabilities?}",
+    async run(config, args) {
+      const id = args[0];
+      const personaName = flag(args, "--persona");
+      const avatarRaw = flag(args, "--avatar");
+      const capsRaw = flag(args, "--caps");
+      const patch = {};
+      if (personaName !== void 0 || avatarRaw !== void 0) {
+        patch.persona = {
+          ...personaName !== void 0 ? { name: personaName } : {},
+          // --avatar "" clears the avatar (sends null), --avatar <url> sets it.
+          ...avatarRaw !== void 0 ? { avatarUrl: avatarRaw === "" ? null : avatarRaw } : {}
+        };
+      }
+      if (capsRaw !== void 0) {
+        patch.capabilities = capsRaw.split(",").map((s) => s.trim()).filter(Boolean);
+      }
+      if (!Object.keys(patch).length) {
+        console.error("Nothing to update. Pass at least --persona, --avatar, or --caps.");
+        process.exit(1);
+      }
+      const updated = await apiFetch(config, `/v1/integrations/linear/publications/${id}`, {
+        method: "PATCH",
+        body: JSON.stringify(patch)
+      });
+      if (config.json) {
+        console.log(JSON.stringify(updated, null, 2));
+        return;
+      }
+      console.log(`Updated: ${updated.persona.name} (${updated.id}) \u2014 caps: ${updated.capabilities.length}`);
+    }
+  },
+  {
+    group: "Linear",
+    match: ["linear", "unpublish"],
+    needsArg: true,
+    usage: "oma linear unpublish <publication-id>",
+    desc: "Mark a publication unpublished",
+    http: "DELETE /v1/integrations/linear/publications/:id",
+    async run(config, args) {
+      try {
+        await apiFetch(config, `/v1/integrations/linear/publications/${args[0]}`, { method: "DELETE" });
+      } catch (err) {
+        if (/^404 /.test(err.message)) {
+          console.error(`No publication with id ${args[0]}.`);
+          console.error(`Find valid publication ids with: oma linear list && oma linear pubs <installation-id>`);
+          process.exit(1);
+        }
+        throw err;
+      }
+      console.log(`Unpublished: ${args[0]}`);
+    }
+  },
+  // GitHub integration — mirrors `oma linear *` shape exactly.
+  {
+    group: "GitHub",
+    match: ["github", "list"],
+    usage: "oma github list",
+    desc: "List connected GitHub installations",
+    http: "GET    /v1/integrations/github/installations",
+    async run(config) {
+      const { data } = await apiFetch(config, "/v1/integrations/github/installations");
+      if (config.json) {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+      }
+      if (!data.length) {
+        console.log("No GitHub installations. Publish an agent with: oma github publish <agent-id> --env <env-id>");
+        return;
+      }
+      table([["ORG/USER", "INSTALLATION ID", "BOT LOGIN", "CREATED"], ...data.map((i) => [i.workspace_name, i.id, i.bot_login, new Date(i.created_at).toLocaleDateString()])]);
+    }
+  },
+  {
+    group: "GitHub",
+    match: ["github", "pubs"],
+    needsArg: true,
+    usage: "oma github pubs <installation-id>",
+    desc: "List agents published to a GitHub install",
+    http: "GET    /v1/integrations/github/installations/:id/publications",
+    async run(config, args) {
+      const { data } = await apiFetch(config, `/v1/integrations/github/installations/${args[0]}/publications`);
+      if (config.json) {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+      }
+      if (!data.length) {
+        console.log("No publications. Publish with: oma github publish <agent-id> --env <env-id>");
+        return;
+      }
+      table([["PERSONA", "PUBLICATION ID", "AGENT", "STATUS", "CAPS"], ...data.map((p) => [p.persona.name, p.id, p.agent_id, p.status, capsPreview(p.capabilities)])]);
+    }
+  },
+  {
+    group: "GitHub",
+    match: ["github", "get"],
+    needsArg: true,
+    usage: "oma github get <publication-id>",
+    desc: "Show one GitHub publication",
+    http: "GET    /v1/integrations/github/publications/:id",
+    async run(config, args) {
+      const p = await apiFetch(config, `/v1/integrations/github/publications/${args[0]}`);
+      if (config.json) {
+        console.log(JSON.stringify(p, null, 2));
+        return;
+      }
+      console.log(`Persona:        ${p.persona.name}
+ID:             ${p.id}
+Agent:          ${p.agent_id}
+Environment:    ${p.environment_id}
+Installation:   ${p.installation_id}
+Mode:           ${p.mode}
+Status:         ${p.status}
+Granularity:    ${p.session_granularity}
+Capabilities:   ${p.capabilities.join(", ")}`);
+    }
+  },
+  {
+    group: "GitHub",
+    match: ["github", "bind"],
+    needsArg: true,
+    usage: "oma github bind <agent-id> --env <env-id> [--persona <name>] [--avatar <url>]",
+    desc: "Bind agent to GitHub via App Manifest (one-click)",
+    http: "POST   /v1/integrations/github/start-a1 {agentId, environmentId, personaName, personaAvatarUrl?, returnUrl}",
+    async run(config, args) {
+      const agentId = args[0];
+      const envId = flag(args, "--env");
+      const persona = flag(args, "--persona") || "";
+      const avatar = flag(args, "--avatar") || null;
+      if (!envId) {
+        console.error("Usage: oma github bind <agent-id> --env <env-id> [--persona <name>] [--avatar <url>]");
+        process.exit(1);
+      }
+      let personaName = persona;
+      if (!personaName) {
+        const agent = await apiFetch(config, `/v1/agents/${agentId}`).catch(() => null);
+        personaName = agent?.name || agentId;
+      }
+      const r = await apiFetch(
+        config,
+        "/v1/integrations/github/start-a1",
+        { method: "POST", body: JSON.stringify({ agentId, environmentId: envId, personaName, personaAvatarUrl: avatar, returnUrl: `${config.baseUrl}/integrations/github` }) }
+      );
+      if (config.json) {
+        console.log(JSON.stringify(r, null, 2));
+        return;
+      }
+      console.log(`
+Binding "${r.suggestedAppName}" to GitHub.`);
+      if (!isPubliclyReachable(r.setupUrl) || !r.setupUrl.startsWith("https://")) {
+        console.log(`
+\u26A0  GitHub requires HTTPS on a publicly-reachable host for Setup / Webhook URLs.`);
+        console.log(`The gateway URL above is local / non-HTTPS \u2014 GitHub will reject it.`);
+        console.log(`Fix: deploy the integrations worker (or run a tunnel like cloudflared/ngrok)`);
+        console.log(`and set GATEWAY_ORIGIN to that public HTTPS host before retrying.`);
+      }
+      console.log(`
+\u2192 Open this URL to register the GitHub App in one click:
+`);
+      console.log(`   ${r.manifestStartUrl}
+`);
+      console.log(`After confirming on GitHub you'll bounce through to "Install on org" automatically.`);
+      console.log(`Verify with:  oma github list && oma github pubs <installation-id>
+`);
+      console.log(`Manual fallback (if you want to register the App by hand instead):`);
+      console.log(`  oma github submit ${r.formToken} --app-id <ID> --private-key-file <PEM> --webhook-secret <SECRET>`);
+    }
+  },
+  {
+    group: "GitHub",
+    match: ["github", "submit"],
+    needsArg: true,
+    usage: "oma github submit <form-token> --app-id <id> (--private-key <pem> | --private-key-file <path>) --webhook-secret <secret> [--client-id X] [--client-secret Y]",
+    desc: "Step 2: validate App credentials \u2192 returns install URL",
+    http: "POST   /v1/integrations/github/credentials {formToken, appId, privateKey, webhookSecret, clientId?, clientSecret?}",
+    async run(config, args) {
+      const formToken = args[0];
+      const appId = flag(args, "--app-id");
+      const privateKeyInline = flag(args, "--private-key");
+      const privateKeyFile = flag(args, "--private-key-file");
+      const webhookSecret = flag(args, "--webhook-secret");
+      const clientId = flag(args, "--client-id");
+      const clientSecret = flag(args, "--client-secret");
+      if (!appId || !webhookSecret || !privateKeyInline && !privateKeyFile) {
+        console.error(
+          "Usage: oma github submit <form-token> --app-id <id> --private-key-file <path> --webhook-secret <secret>\n  --private-key-file points at the .pem you downloaded from the App's settings page."
+        );
+        process.exit(1);
+      }
+      let privateKey;
+      if (privateKeyInline) {
+        privateKey = privateKeyInline.replace(/\\n/g, "\n");
+      } else {
+        const fs = await import("node:fs/promises");
+        privateKey = await fs.readFile(privateKeyFile, "utf8");
+      }
+      const r = await apiFetch(
+        config,
+        "/v1/integrations/github/credentials",
+        { method: "POST", body: JSON.stringify({ formToken, appId, privateKey, webhookSecret, clientId, clientSecret }) }
+      ).catch((err) => {
+        if (/form_token_invalid|JwtSigner\.verify/i.test(err.message)) {
+          console.error(`Form token rejected. Re-run \`oma github publish <agent-id> --env <env-id>\` to mint a fresh token.`);
+          process.exit(1);
+        }
+        if (/credentials_mismatch|appId mismatch/i.test(err.message)) {
+          console.error(`appId / private key mismatch. Both must come from the same GitHub App's settings page.`);
+          process.exit(1);
+        }
+        throw err;
+      });
+      if (config.json) {
+        console.log(JSON.stringify(r, null, 2));
+        return;
+      }
+      console.log(`
+Step 2 complete. Bot will appear as @${r.botLogin}.`);
+      console.log(`
+Open this URL in a browser and pick which org / repos to install on:
+`);
+      console.log(`  ${r.url}
+`);
+      console.log(`After approval GitHub redirects to the setup URL; the publication transitions to 'live'.`);
+      console.log(`Verify with: oma github list && oma github pubs <installation-id>`);
+    }
+  },
+  {
+    group: "GitHub",
+    match: ["github", "handoff"],
+    needsArg: true,
+    usage: "oma github handoff <form-token>",
+    desc: "Step 2 alt: 7-day shareable URL for an org owner",
+    http: "POST   /v1/integrations/github/handoff-link {formToken}",
+    async run(config, args) {
+      const r = await apiFetch(
+        config,
+        "/v1/integrations/github/handoff-link",
+        { method: "POST", body: JSON.stringify({ formToken: args[0] }) }
+      ).catch((err) => {
+        if (/form_token_invalid|JwtSigner\.verify/i.test(err.message)) {
+          console.error(`Form token rejected. Re-run \`oma github publish <agent-id> --env <env-id>\` to mint a fresh token.`);
+          process.exit(1);
+        }
+        throw err;
+      });
+      if (config.json) {
+        console.log(JSON.stringify(r, null, 2));
+        return;
+      }
+      console.log(`
+Send this URL to your GitHub org owner:
+  ${r.url}
+Expires in ${r.expiresInDays} days.`);
+    }
+  },
+  {
+    group: "GitHub",
+    match: ["github", "update"],
+    needsArg: true,
+    usage: "oma github update <publication-id> [--persona <name>] [--avatar <url>] [--caps <a,b,c>]",
+    desc: "Update persona / capabilities of a GitHub publication",
+    http: "PATCH  /v1/integrations/github/publications/:id {persona?, capabilities?}",
+    async run(config, args) {
+      const id = args[0];
+      const personaName = flag(args, "--persona");
+      const avatarRaw = flag(args, "--avatar");
+      const capsRaw = flag(args, "--caps");
+      const patch = {};
+      if (personaName !== void 0 || avatarRaw !== void 0) {
+        patch.persona = {
+          ...personaName !== void 0 ? { name: personaName } : {},
+          ...avatarRaw !== void 0 ? { avatarUrl: avatarRaw === "" ? null : avatarRaw } : {}
+        };
+      }
+      if (capsRaw !== void 0) {
+        patch.capabilities = capsRaw.split(",").map((s) => s.trim()).filter(Boolean);
+      }
+      if (!Object.keys(patch).length) {
+        console.error("Nothing to update. Pass at least --persona, --avatar, or --caps.");
+        process.exit(1);
+      }
+      const updated = await apiFetch(config, `/v1/integrations/github/publications/${id}`, {
+        method: "PATCH",
+        body: JSON.stringify(patch)
+      });
+      if (config.json) {
+        console.log(JSON.stringify(updated, null, 2));
+        return;
+      }
+      console.log(`Updated: ${updated.persona.name} (${updated.id}) \u2014 caps: ${updated.capabilities.length}`);
+    }
+  },
+  {
+    group: "GitHub",
+    match: ["github", "unpublish"],
+    needsArg: true,
+    usage: "oma github unpublish <publication-id>",
+    desc: "Mark a GitHub publication unpublished",
+    http: "DELETE /v1/integrations/github/publications/:id",
+    async run(config, args) {
+      try {
+        await apiFetch(config, `/v1/integrations/github/publications/${args[0]}`, { method: "DELETE" });
+      } catch (err) {
+        if (/^404 /.test(err.message)) {
+          console.error(`No publication with id ${args[0]}.`);
+          console.error(`Find valid publication ids with: oma github list && oma github pubs <installation-id>`);
+          process.exit(1);
+        }
+        throw err;
+      }
+      console.log(`Unpublished: ${args[0]}`);
+    }
+  },
+  // Slack integration — mirrors Linear's surface (A1 per-publication App).
+  {
+    group: "Slack",
+    match: ["slack", "list"],
+    usage: "oma slack list",
+    desc: "List connected Slack workspaces",
+    http: "GET    /v1/integrations/slack/installations",
+    async run(config) {
+      const { data } = await apiFetch(config, "/v1/integrations/slack/installations");
+      if (config.json) {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+      }
+      if (!data.length) {
+        console.log("No Slack workspaces connected. Publish an agent with: oma slack publish <agent-id> --env <env-id>");
+        return;
+      }
+      table([["WORKSPACE", "INSTALLATION ID", "KIND", "CREATED"], ...data.map((i) => [i.workspace_name, i.id, i.install_kind, new Date(i.created_at).toLocaleDateString()])]);
+    }
+  },
+  {
+    group: "Slack",
+    match: ["slack", "pubs"],
+    needsArg: true,
+    usage: "oma slack pubs <installation-id>",
+    desc: "List agents published to a workspace",
+    http: "GET    /v1/integrations/slack/installations/:id/publications",
+    async run(config, args) {
+      const { data } = await apiFetch(config, `/v1/integrations/slack/installations/${args[0]}/publications`);
+      if (config.json) {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+      }
+      if (!data.length) {
+        console.log("No publications. Publish with: oma slack publish <agent-id> --env <env-id>");
+        return;
+      }
+      table([["PERSONA", "PUBLICATION ID", "AGENT", "STATUS", "CAPS"], ...data.map((p) => [p.persona.name, p.id, p.agent_id, p.status, capsPreview(p.capabilities)])]);
+    }
+  },
+  {
+    group: "Slack",
+    match: ["slack", "get"],
+    needsArg: true,
+    usage: "oma slack get <publication-id>",
+    desc: "Show one publication",
+    http: "GET    /v1/integrations/slack/publications/:id",
+    async run(config, args) {
+      const p = await apiFetch(config, `/v1/integrations/slack/publications/${args[0]}`);
+      if (config.json) {
+        console.log(JSON.stringify(p, null, 2));
+        return;
+      }
+      console.log(`Persona:        ${p.persona.name}
+ID:             ${p.id}
+Agent:          ${p.agent_id}
+Environment:    ${p.environment_id}
+Installation:   ${p.installation_id}
+Mode:           ${p.mode}
+Status:         ${p.status}
+Granularity:    ${p.session_granularity}
+Capabilities:   ${p.capabilities.join(", ")}`);
+    }
+  },
+  {
+    group: "Slack",
+    match: ["slack", "publish"],
+    needsArg: true,
+    usage: "oma slack publish <agent-id> --env <env-id> [--persona <name>] [--avatar <url>]",
+    desc: "Step 1: register agent \u2192 returns Slack App config",
+    http: "POST   /v1/integrations/slack/start-a1 {agentId, environmentId, personaName, personaAvatarUrl?, returnUrl}",
+    async run(config, args) {
+      const agentId = args[0];
+      const envId = flag(args, "--env");
+      const persona = flag(args, "--persona") || "";
+      const avatar = flag(args, "--avatar") || null;
+      if (!envId) {
+        console.error("Usage: oma slack publish <agent-id> --env <env-id> [--persona <name>] [--avatar <url>]");
+        process.exit(1);
+      }
+      let personaName = persona;
+      if (!personaName) {
+        const agent = await apiFetch(config, `/v1/agents/${agentId}`).catch(() => null);
+        personaName = agent?.name || agentId;
+      }
+      const r = await apiFetch(
+        config,
+        "/v1/integrations/slack/start-a1",
+        { method: "POST", body: JSON.stringify({ agentId, environmentId: envId, personaName, personaAvatarUrl: avatar, returnUrl: `${config.baseUrl}/integrations/slack` }) }
+      );
+      if (config.json) {
+        console.log(JSON.stringify(r, null, 2));
+        return;
+      }
+      if (r.manifestLaunchUrl) {
+        console.log(`
+Step 1 complete. One-click setup \u2014 open this URL to have Slack create the App for you:
+`);
+        console.log(`  ${r.manifestLaunchUrl}
+`);
+        console.log(`Slack will pre-fill name, scopes, events, and redirect URL from a manifest.`);
+        console.log(`Confirm Create on Slack, then come back and paste the secrets it shows you.
+`);
+        console.log(`Or set up manually:`);
+      } else {
+        console.log(`
+Step 1 complete. Now create a Slack App (https://api.slack.com/apps \u2192 Create New App \u2192 From scratch):
+`);
+      }
+      console.log(`  App name:             ${r.suggestedAppName}`);
+      console.log(`  Redirect URL:         ${r.callbackUrl}`);
+      console.log(`  Events Request URL:   ${r.webhookUrl}`);
+      console.log(`
+In the App settings:`);
+      console.log(`  \u2022 OAuth & Permissions \u2192 paste Redirect URL`);
+      console.log(`  \u2022 Event Subscriptions \u2192 paste Events Request URL, wait for green "Verified" check`);
+      console.log(`  \u2022 Subscribe to bot events: app_mention, message.channels, message.im,`);
+      console.log(`    message.groups, message.mpim, tokens_revoked, app_uninstalled`);
+      if (!isPubliclyReachable(r.callbackUrl) || !r.callbackUrl.startsWith("https://")) {
+        console.log(`
+\u26A0  Slack requires HTTPS on a publicly-reachable host for Redirect / Events URLs.`);
+        console.log(`The URLs above point at a local / non-HTTPS origin \u2014 Slack's Verify button will fail.`);
+        console.log(`Fix: deploy the integrations worker (or run a tunnel like cloudflared/ngrok) and set`);
+        console.log(`GATEWAY_ORIGIN to that public HTTPS host before publishing.`);
+      }
+      console.log(`
+Step 2 \u2014 submit the credentials Slack gives you (Basic Information page):
+`);
+      console.log(`  oma slack submit <FORM_TOKEN> \\
+    --client-id <CLIENT_ID> --client-secret <CLIENT_SECRET> --signing-secret <SIGNING_SECRET>
+`);
+      console.log(`The Signing Secret is on the same Basic Information page; Slack uses it to`);
+      console.log(`sign every webhook event.
+`);
+      console.log(`Form token (expires ~60 min):
+  ${r.formToken}
+`);
+      console.log(`Or, to send the Slack App registration to a workspace admin instead:`);
+      console.log(`  oma slack handoff ${r.formToken}`);
+      console.log(`
+For scripts, re-run with --json to get the raw response.`);
+    }
+  },
+  {
+    group: "Slack",
+    match: ["slack", "submit"],
+    needsArg: true,
+    usage: "oma slack submit <form-token> --client-id <id> --client-secret <secret> --signing-secret <secret>",
+    desc: "Step 2: validate creds \u2192 returns OAuth install URL",
+    http: "POST   /v1/integrations/slack/credentials {formToken, clientId, clientSecret, signingSecret}",
+    async run(config, args) {
+      const formToken = args[0];
+      const clientId = flag(args, "--client-id");
+      const clientSecret = flag(args, "--client-secret");
+      const signingSecret = flag(args, "--signing-secret");
+      if (!clientId || !clientSecret || !signingSecret) {
+        console.error(
+          "Usage: oma slack submit <form-token> --client-id <id> --client-secret <secret> --signing-secret <secret>\n  signing-secret is the 'Signing Secret' on the Slack App's Basic Information page."
+        );
+        process.exit(1);
+      }
+      const r = await apiFetch(
+        config,
+        "/v1/integrations/slack/credentials",
+        { method: "POST", body: JSON.stringify({ formToken, clientId, clientSecret, signingSecret }) }
+      ).catch((err) => {
+        if (/form_token_invalid|JwtSigner\.verify/i.test(err.message)) {
+          console.error(`Form token rejected. Re-run \`oma slack publish <agent-id> --env <env-id>\` to mint a fresh token.`);
+          process.exit(1);
+        }
+        throw err;
+      });
+      if (config.json) {
+        console.log(JSON.stringify(r, null, 2));
+        return;
+      }
+      console.log(`
+Step 2 complete. Open this URL in a browser to authorize the install in Slack:
+`);
+      console.log(`  ${r.url}
+`);
+      console.log(`After approval Slack redirects to the callback; the publication then transitions to 'live'.`);
+      console.log(`Verify with: oma slack list && oma slack pubs <installation-id>`);
+    }
+  },
+  {
+    group: "Slack",
+    match: ["slack", "handoff"],
+    needsArg: true,
+    usage: "oma slack handoff <form-token>",
+    desc: "Step 2 alt: 7-day shareable URL for an admin",
+    http: "POST   /v1/integrations/slack/handoff-link {formToken}",
+    async run(config, args) {
+      const r = await apiFetch(
+        config,
+        "/v1/integrations/slack/handoff-link",
+        { method: "POST", body: JSON.stringify({ formToken: args[0] }) }
+      ).catch((err) => {
+        if (/form_token_invalid|JwtSigner\.verify/i.test(err.message)) {
+          console.error(`Form token rejected. Re-run \`oma slack publish <agent-id> --env <env-id>\` to mint a fresh token.`);
+          process.exit(1);
+        }
+        throw err;
+      });
+      if (config.json) {
+        console.log(JSON.stringify(r, null, 2));
+        return;
+      }
+      console.log(`
+Send this URL to your Slack workspace admin:
+  ${r.url}
+Expires in ${r.expiresInDays} days.`);
+    }
+  },
+  {
+    group: "Slack",
+    match: ["slack", "update"],
+    needsArg: true,
+    usage: "oma slack update <publication-id> [--persona <name>] [--avatar <url>] [--caps <a,b,c>]",
+    desc: "Update persona / capabilities of a publication",
+    http: "PATCH  /v1/integrations/slack/publications/:id {persona?, capabilities?}",
+    async run(config, args) {
+      const id = args[0];
+      const personaName = flag(args, "--persona");
+      const avatarRaw = flag(args, "--avatar");
+      const capsRaw = flag(args, "--caps");
+      const patch = {};
+      if (personaName !== void 0 || avatarRaw !== void 0) {
+        patch.persona = {
+          ...personaName !== void 0 ? { name: personaName } : {},
+          ...avatarRaw !== void 0 ? { avatarUrl: avatarRaw === "" ? null : avatarRaw } : {}
+        };
+      }
+      if (capsRaw !== void 0) {
+        patch.capabilities = capsRaw.split(",").map((s) => s.trim()).filter(Boolean);
+      }
+      if (!Object.keys(patch).length) {
+        console.error("Nothing to update. Pass at least --persona, --avatar, or --caps.");
+        process.exit(1);
+      }
+      const updated = await apiFetch(config, `/v1/integrations/slack/publications/${id}`, {
+        method: "PATCH",
+        body: JSON.stringify(patch)
+      });
+      if (config.json) {
+        console.log(JSON.stringify(updated, null, 2));
+        return;
+      }
+      console.log(`Updated: ${updated.persona.name} (${updated.id}) \u2014 caps: ${updated.capabilities.length}`);
+    }
+  },
+  {
+    group: "Slack",
+    match: ["slack", "unpublish"],
+    needsArg: true,
+    usage: "oma slack unpublish <publication-id>",
+    desc: "Mark a publication unpublished",
+    http: "DELETE /v1/integrations/slack/publications/:id",
+    async run(config, args) {
+      try {
+        await apiFetch(config, `/v1/integrations/slack/publications/${args[0]}`, { method: "DELETE" });
+      } catch (err) {
+        if (/^404 /.test(err.message)) {
+          console.error(`No publication with id ${args[0]}.`);
+          console.error(`Find valid publication ids with: oma slack list && oma slack pubs <installation-id>`);
+          process.exit(1);
+        }
+        throw err;
+      }
+      console.log(`Unpublished: ${args[0]}`);
+    }
+  },
+  // Memory
+  {
+    group: "Memory",
+    match: ["memory", "reconcile"],
+    usage: "oma memory reconcile [--store <id>] [--limit N] [--all]",
+    desc: "Re-embed memories whose Vectorize sync is stale (vector_synced_at IS NULL).",
+    http: "POST   /v1/memory_stores/_reconcile {store_id?, limit?}",
+    async run(config, args) {
+      const storeId = flag(args, "--store");
+      const limitStr = flag(args, "--limit");
+      const all = args.includes("--all");
+      const limit = limitStr ? Number(limitStr) : 200;
+      if (!storeId && !all) {
+        console.error("Specify either --store <id> or --all (drains all stores in the tenant).");
+        process.exit(1);
+      }
+      let totalScanned = 0, totalFixed = 0, totalFailing = 0;
+      const errors = [];
+      for (let pass = 1; pass <= 100; pass++) {
+        const body = { limit };
+        if (storeId) body.store_id = storeId;
+        const result = await apiFetch(config, "/v1/memory_stores/_reconcile", {
+          method: "POST",
+          body: JSON.stringify(body)
+        });
+        totalScanned += result.scanned;
+        totalFixed += result.fixed;
+        totalFailing = result.still_failing;
+        for (const e of result.sample_errors) if (errors.length < 10) errors.push(e);
+        if (config.json) {
+          console.log(JSON.stringify({ pass, ...result }));
+        } else {
+          console.log(`pass ${pass}: scanned=${result.scanned} fixed=${result.fixed} failing=${result.still_failing}`);
+        }
+        if (result.scanned === 0) break;
+        if (result.fixed === 0 && result.still_failing > 0) {
+          console.error("No progress this pass \u2014 remaining rows keep failing. Stopping.");
+          break;
+        }
+      }
+      if (config.json) {
+        console.log(JSON.stringify({ totals: { scanned: totalScanned, fixed: totalFixed, failing: totalFailing }, errors }));
+      } else {
+        console.log(`
+Done. scanned=${totalScanned} fixed=${totalFixed} still_failing=${totalFailing}`);
+        if (errors.length) {
+          console.log("\nSample errors:");
+          for (const e of errors) console.log(`  ${e.memory_id}: ${e.error}`);
+        }
+      }
+    }
+  }
+];
+var extraEndpoints = [
+  { group: "Agents", http: "POST   /v1/agents/:id                          Update agent" },
+  { group: "Agents", http: "GET    /v1/agents/:id/versions                 List versions" },
+  { group: "Agents", http: "POST   /v1/agents/:id/archive                  Archive agent" },
+  { group: "Sessions", http: "GET    /v1/sessions/:id                        Get session (status, usage)" },
+  { group: "Sessions", http: "GET    /v1/sessions/:id/events?limit=N         Get events (JSON)" },
+  { group: "Sessions", http: "GET    /v1/sessions/:id/stream                 Stream events (SSE)" },
+  { group: "Sessions", http: "POST   /v1/sessions/:id/archive                Archive session" },
+  { group: "Sessions", http: "DELETE /v1/sessions/:id                        Delete session" },
+  { group: "Sessions", http: "POST   /v1/sessions/:id/files                  Promote sandbox file {path}" },
+  { group: "Sessions", http: "POST   /v1/sessions/:id/resources              Add resource {type, file_id?, memory_store_id?}" },
+  { group: "Sessions", http: "GET    /v1/sessions/:id/threads                List threads (multi-agent)" },
+  { group: "Environments", http: "GET    /v1/environments/:id                    Get environment" },
+  { group: "Environments", http: "PUT    /v1/environments/:id                    Update environment" },
+  { group: "Environments", http: "DELETE /v1/environments/:id                    Delete environment" },
+  { group: "Model Cards", http: "GET    /v1/model_cards/:id                     Get model card" },
+  { group: "Model Cards", http: "POST   /v1/model_cards/:id                     Update model card" },
+  { group: "Model Cards", http: "DELETE /v1/model_cards/:id                     Delete model card" },
+  { group: "Model Cards", http: "POST   /v1/models/list                         Fetch provider models {provider, api_key}" },
+  { group: "Vaults", http: "DELETE /v1/vaults/:id                          Delete vault" },
+  { group: "Vaults", http: "DELETE /v1/vaults/:id/credentials/:cid         Delete credential" },
+  { group: "Linear", http: "PATCH  /v1/integrations/linear/publications/:id  Update persona / capabilities" },
+  { group: "GitHub", http: "PATCH  /v1/integrations/github/publications/:id  Update persona / capabilities" },
+  { group: "OAuth", http: "GET    /v1/oauth/callback                      OAuth callback (internal)" },
+  { group: "OAuth", http: "POST   /v1/oauth/refresh                       Refresh token {vault_id, credential_id}" },
+  { group: "Skills", http: "POST   /v1/skills                              Create skill {files:[{filename,content}]}" },
+  { group: "Skills", http: "GET    /v1/skills/:id                          Get skill" },
+  { group: "Skills", http: "DELETE /v1/skills/:id                          Delete skill" },
+  { group: "Skills", http: "POST   /v1/skills/:id/versions                 Create new version {files}" },
+  { group: "Skills", http: "GET    /v1/skills/:id/versions                 List versions" },
+  { group: "Files", http: "POST   /v1/files                               Upload (multipart or JSON {filename,content,encoding?})" },
+  { group: "Files", http: "GET    /v1/files?scope_id=X&limit=N            List files (cursor-paginated)" },
+  { group: "Files", http: "GET    /v1/files/:id                           Get file metadata" },
+  { group: "Files", http: "GET    /v1/files/:id/content                   Download file content" },
+  { group: "Files", http: "DELETE /v1/files/:id                           Delete file" },
+  { group: "Memory", http: "POST   /v1/memory_stores                       Create store {name}" },
+  { group: "Memory", http: "GET    /v1/memory_stores                       List stores" },
+  { group: "Memory", http: "DELETE /v1/memory_stores/:id                   Delete store" },
+  { group: "Memory", http: "POST   /v1/memory_stores/:id/memories          Write memory {path, content} (max 100KB)" },
+  { group: "Memory", http: "GET    /v1/memory_stores/:id/memories?prefix=X List memories (metadata)" },
+  { group: "Memory", http: "GET    /v1/memory_stores/:id/memories/:mid     Get memory with content" },
+  { group: "Memory", http: "DELETE /v1/memory_stores/:id/memories/:mid     Delete memory" },
+  { group: "Memory", http: "POST   /v1/memory_stores/_reconcile {store_id?,limit?}  Re-embed stale rows" },
+  { group: "Evals", http: "POST   /v1/evals/runs                          Create eval run {agent_id, environment_id, tasks:[...]}" },
+  { group: "Evals", http: "GET    /v1/evals/runs                          List eval runs" },
+  { group: "Evals", http: "GET    /v1/evals/runs/:id                      Get eval run results" },
+  { group: "ClawHub", http: "GET    /v1/clawhub/search?q=X                  Search ClawHub registry" }
+];
+var KNOWN_SERVERS = {
+  airtable: "https://mcp.airtable.com/mcp",
+  amplitude: "https://mcp.amplitude.com/mcp",
+  apollo: "https://mcp.apollo.io/mcp",
+  asana: "https://mcp.asana.com/v2/mcp",
+  atlassian: "https://mcp.atlassian.com/v1/mcp",
+  clickup: "https://mcp.clickup.com/mcp",
+  github: "https://api.githubcopilot.com/mcp/",
+  intercom: "https://mcp.intercom.com/mcp",
+  linear: "https://mcp.linear.app/mcp",
+  notion: "https://mcp.notion.com/mcp",
+  sentry: "https://mcp.sentry.dev/mcp",
+  slack: "https://mcp.slack.com/mcp"
+};
+function resolveServerUrl(nameOrUrl) {
+  if (nameOrUrl.startsWith("http://") || nameOrUrl.startsWith("https://")) return nameOrUrl;
+  const url = KNOWN_SERVERS[nameOrUrl.toLowerCase()];
+  if (!url) {
+    console.error(`Unknown server: ${nameOrUrl}. Known: ${Object.keys(KNOWN_SERVERS).join(", ")}`);
+    process.exit(1);
+  }
+  return url;
+}
+async function connectMcp(config, mcpServerUrl, vaultId) {
+  const port = 19284 + Math.floor(Math.random() * 1e3);
+  const redirectUri = `http://localhost:${port}/callback`;
+  const authUrl = `${config.baseUrl}/v1/oauth/authorize?mcp_server_url=${encodeURIComponent(mcpServerUrl)}&vault_id=${encodeURIComponent(vaultId)}&redirect_uri=${encodeURIComponent(redirectUri)}`;
+  console.log(`Opening browser...
+  ${authUrl}
+`);
+  try {
+    const p = process.platform;
+    if (p === "darwin") execSync(`open "${authUrl}"`);
+    else if (p === "linux") execSync(`xdg-open "${authUrl}"`);
+    else if (p === "win32") execSync(`start "${authUrl}"`);
+  } catch {
+  }
+  return new Promise((resolve) => {
+    const server = createServer((req, res) => {
+      const url = new URL(req.url || "/", `http://localhost:${port}`);
+      if (url.pathname === "/callback") {
+        const service = url.searchParams.get("service");
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(`<html><body><h2>Connected${service ? ` to ${service}` : ""}!</h2><script>window.close()</script></body></html>`);
+        console.log(`Connected to ${service || mcpServerUrl}`);
+        server.close();
+        resolve();
+      }
+    });
+    server.listen(port);
+    setTimeout(() => {
+      console.log("Timed out.");
+      server.close();
+      resolve();
+    }, 3e5);
+  });
+}
+function apiRef(resource) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const c of commands) {
+    const list = groups.get(c.group) || [];
+    list.push(`  ${c.http}`);
+    groups.set(c.group, list);
+  }
+  for (const e of extraEndpoints) {
+    const list = groups.get(e.group) || [];
+    list.push(`  ${e.http}`);
+    groups.set(e.group, list);
+  }
+  const normalized = resource?.toLowerCase();
+  const groupAlias = {
+    agents: "Agents",
+    sessions: "Sessions",
+    environments: "Environments",
+    models: "Model Cards",
+    vaults: "Vaults",
+    oauth: "OAuth",
+    skills: "Skills",
+    files: "Files",
+    memory: "Memory",
+    keys: "API Keys",
+    evals: "Evals",
+    clawhub: "ClawHub",
+    "mcp": "MCP Servers",
+    linear: "Linear",
+    github: "GitHub",
+    integrations: "Linear"
+  };
+  if (normalized && groupAlias[normalized]) {
+    const name = groupAlias[normalized];
+    const lines = groups.get(name);
+    if (lines) {
+      console.log(`
+${name}
+${lines.join("\n")}
+`);
+      return;
+    }
+  }
+  console.log(`
+oma api \u2014 HTTP API Quick Reference
+Auth: all /v1/* endpoints require x-api-key header
+`);
+  for (const [name, lines] of groups) {
+    console.log(`${name}
+${lines.join("\n")}
+`);
+  }
+  if (normalized && !groupAlias[normalized]) {
+    console.log(`Unknown resource: ${resource}
+Available: ${Object.keys(groupAlias).join(", ")}`);
+  }
+}
+function usage() {
+  console.log(`
+oma \u2014 Open Managed Agents CLI
+
+Usage:`);
+  let lastGroup = "";
+  for (const c of commands) {
+    if (c.group !== lastGroup) {
+      console.log(`
+  ${c.group}:`);
+      lastGroup = c.group;
+    }
+    console.log(`    ${c.usage.padEnd(42)} ${c.desc}`);
+  }
+  console.log(`
+  API Reference:
+    oma api                                    Show all HTTP endpoints
+    oma api <resource>                         Show endpoints for a resource
+
+Environment:
+  OMA_BASE_URL   API base (default: http://localhost:8787)
+  OMA_API_KEY    API key (required)
+`);
+}
+async function main() {
+  let args = process.argv.slice(2);
+  if (!args.length || ["-h", "--help", "help"].includes(args[0])) {
+    usage();
+    process.exit(0);
+  }
+  if (args[0] === "api") {
+    apiRef(args[1]);
+    return;
+  }
+  const wantJson = args.includes("--json");
+  args = args.filter((a) => a !== "--json");
+  const config = loadConfig();
+  config.json = wantJson;
+  let needsArgMatch = null;
+  for (const c of commands) {
+    const verbMatch = c.match.length === 1 ? args[0] === c.match[0] : args[0] === c.match[0] && args[1] === c.match[1];
+    if (!verbMatch) continue;
+    if (c.needsArg && !args[c.match.length]) {
+      needsArgMatch = c;
+      continue;
+    }
+    const rest = args.slice(c.match.length);
+    return c.run(config, rest);
+  }
+  if (needsArgMatch) {
+    console.error(`${needsArgMatch.usage}
+  ${needsArgMatch.desc}`);
+    process.exit(1);
+  }
+  console.error(`Unknown command: ${args.join(" ")}`);
+  usage();
+  process.exit(1);
+}
+main().catch((err) => {
+  console.error(err.message);
+  process.exit(1);
+});