@opvs-ai/cli 0.16.0 → 0.20.1

package/README.md

@@ -41,13 +41,23 @@ Agent runs:  opvs auth request -w <workspace> -e <admin-email>
              --> Approval email sent to admin
              --> CLI polls for approval every 3s
 
-Admin clicks: [Approve] button in email
+Admin clicks: [Approve] button in email (the link works for 60 minutes)
              --> Token generated and delivered to CLI
              --> Saved to ~/.opvs/config.json
 ```
 
 No passwords, no copy-pasting tokens. The human stays in control.
 
+The CLI waits 5 minutes for the approval (`--wait <minutes>` to change it). If the admin
+approves later, the request is still open — collect the token with:
+
+```bash
+opvs auth resume
+```
+
+Exit codes for `auth request` and `auth resume`: `0` approved · `1` denied, expired or
+failed · `2` not approved yet (run `opvs auth resume`).
+
 ## Multi-Workspace Support
 
 The CLI supports multiple workspaces (brands) with kubectl-style context switching. Each workspace has its own token, brand, and API URL.
@@ -70,7 +80,7 @@ opvs -w my-company boards list
 opvs workspace current
 
 # Remove a workspace
-opvs workspace remove old-brand
+opvs workspace remove old-brand --yes
 ```
 
 ### Config File
@@ -125,12 +135,37 @@ opvs boards set-routing ASP --harness codex          # Board routing defaults ('
 opvs boards projects ASP                             # Projects claiming the board (none|resolved|ambiguous)
 opvs boards add-to-project ASP <project-uuid>        # Additive
 opvs boards move-to-project ASP <project-uuid> --yes # REMOVES it from every other project — previews first
-opvs boards health ASP --profile factory             # Unsupplied thresholds print NOT CHECKED
+opvs boards health ASP --profile factory             # EXITS 2 on not_healthy — see below
+opvs boards health ASP --format json | jq .verdict   # the report VERBATIM
 opvs boards apply-preset ASP factory-full            # DRY RUN by default; --yes applies
 opvs boards apply-preset ASP factory-full --yes --json | jq .applied  # ONE JSON document: the applied plan
 opvs boards update ASP --archived true               # Hidden from `boards list`; cards stay CLAIMABLE
 ```
 
+#### Gating a script on board / project health
+
+`boards health` and `projects health` are the same report the dashboard shows, and they set an
+exit code so a shell can gate on them:
+
+| Exit | Verdict | Means |
+|-----:|---------|-------|
+| `0` | `healthy` | every check ran, none failed |
+| `0` | `incomplete` | **you supplied no threshold**, so some check made no finding. A fact about your REQUEST, not about the board — pass `--require-complete` to make it exit 2 |
+| `2` | `not_healthy` | at least one check FAILED |
+| `1` | — | transport, auth, a bad ref, or a verdict the CLI could not read |
+
+```bash
+# A planner gate. `2` stops the run; `1` means the check itself could not be made.
+opvs boards health "$BOARD" --profile planner-orchestration || exit $?
+```
+
+🔑 **`1` and `2` are deliberately different.** `2` is "the board failed"; `1` is "I could not
+ask". A gate that treated them alike would pass an expired token off as a healthy board.
+
+On `not_healthy` only the FAIL rows print — `--all-checks` brings the rest back. `--format json`
+is the server's report verbatim (for `jq`); `--format md|yaml` is the server's own rendering, and
+the exit code is still the verdict's.
+
 > ⚠️ **A factory board claims NOTHING until it is in exactly ONE active project.** Every claim on a
 > factory board in no project (`none`) or in two or more (`ambiguous`) returns
 > `{task_id: null, reason: "board_project_unresolved"}` — the columns can be perfectly wired and the
@@ -138,13 +173,35 @@ opvs boards update ASP --archived true               # Hidden from `boards list`
 > `add-to-project`, `move-to-project`, `apply-preset`, `projects add-board | remove-board | archive`
 > all check afterwards and warn on stderr when a factory board is left unresolved.
 
+> **Destructive commands ask first (ASP-144).** Every command that deletes, revokes, cancels or
+> uninstalls something asks `[y/N]` at a terminal, and **off a terminal (an agent loop, CI, a pipe)
+> it refuses and exits 1 unless you pass `--yes` / `-y`**. Examples here carry `--yes` because
+> that is how an agent runs them. Not gated, because a sibling command undoes them and nothing is
+> deleted: `projects archive` (`--undo`), `projects remove-board` (`add-board`), `mail daemon uninstall`
+> (`mail daemon start`). `tests/commands/destructive-gate-asp144.test.ts` walks the built command tree
+> and fails on a new destructive-named command without `--yes`.
+
+### Scheduled runs
+
+```bash
+opvs scheduled-runs list [--project <uuid>] [--board <uuid>] [--state scheduled|fired|failed|cancelled|all] [--limit 100]
+opvs scheduled-runs get <id>                  # state, fired_at, last_error
+opvs scheduled-runs create --project <uuid> --run-at 2026-09-17T08:00:00Z [--board <uuid>] [--params '{"note":"nightly"}']
+opvs scheduled-runs cancel <id> --yes         # only a run that has not fired
+```
+> Scheduling costs nothing. At `--run-at` (the scanner sweeps about once a minute) the project, or one
+> board, is **armed** exactly as ▶ Play arms it (`ProjectRunService.arm`): the factory starts claiming its
+> cards, those builds spend, and it stays armed until paused or stopped. `create` and `cancel` are brand
+> admin only (403). `--run-at` must carry a zone (`Z` or `+02:00`); ids are full UUIDs. Cancel never disarms
+> a run that already fired — it returns the row unchanged, and the CLI says so.
+
 ### Members
 
 ```bash
 opvs members list <boardId>
 opvs members add <boardId> --user <uuid>                 # or --agent <uuid>; a member of YOUR brand
 opvs members invite <boardId> --email x@y.com --role commenter  # outside your brand → a guest of this board
-opvs members remove <boardId> <uuid> --type agent        # --type defaults to user
+opvs members remove <boardId> <uuid> --type agent --yes  # --type defaults to user
 ```
 
 > `--role` (viewer | commenter | editor) caps an **external guest** only; a member of your own brand
@@ -167,7 +224,7 @@ opvs columns update <columnId> --wip-limit none                # 'none' clears;
 
 ```bash
 opvs projects set-routing <project-uuid> --model claude-opus-5
-opvs projects health <project-uuid> --profile planner-orchestration
+opvs projects health <project-uuid> --profile planner-orchestration  # EXITS 2 on not_healthy
 opvs projects bundle set <project-uuid> --command ship --command-body ship=./ship.md  # a body map REPLACES
 ```
 
@@ -209,6 +266,28 @@ opvs docs update <project> <slug> -f content.md
 opvs docs search "query"                   # Search docs
 ```
 
+### Code index
+
+```bash
+# "Does this already exist?" — ask BEFORE writing it.
+opvs code context "resolve_brand" --project <project-id>
+opvs code context "resolveBrand" --project <id> --kind function --limit 5
+opvs code summary --project <project-id>   # Repo orientation: languages, entry points, top files
+```
+
+Two answers you must not conflate: `indexed: false` means *there was nothing to
+search* (no index for this project, or it is not yours), while `verdict: none`
+means *we searched and found nothing*. Only the second is evidence of absence.
+A capped result set says so — read `truncated`, and read
+`freshness.index_truncated` separately: that one means the index is partial.
+`freshness.scan_truncated` says the SCAN stopped early, so parts of the repo were
+never read at all; `freshness.symbols_dropped_at_ingest` counts symbols the API
+could not store, from files that were read.
+
+Needs the `code:read` scope, which is in the default ceiling. There is no
+`opvs code index` command on purpose — writing an index is `code:write`, which
+a worker PAT does not carry, and the ingest caller is the sidecar on the desk.
+
 ### Session
 
 ```bash
@@ -231,8 +310,9 @@ opvs init                                  # Print CLAUDE.md snippet
 
 ```bash
 opvs auth request -w <slug> -e <email>     # Request token
+opvs auth resume                           # Collect a token approved after the wait
 opvs auth status                           # Current auth info
-opvs auth revoke                           # Revoke token
+opvs auth revoke --yes                     # Revoke token
 opvs auth list                             # List agent tokens (admin)
 ```
 
@@ -252,7 +332,7 @@ opvs tools help @opvs-ai/agentboard --section methods   # Just the methods
 opvs tools list                                  # Installed packages on this brand
 opvs tools install @opvs-ai/agentboard \
   --grants '{"vendor.opvs-ai.agentboard.read":true}'   # Install with entitlements
-opvs tools uninstall @opvs-ai/agentboard         # Soft-uninstall
+opvs tools uninstall @opvs-ai/agentboard --yes   # Soft-uninstall
 
 # Invoke
 opvs tools call @opvs-ai/agentboard list_tasks \
@@ -270,7 +350,7 @@ gateway plugin `skill_pin` tool is the canonical surface.
 opvs workspace list                        # List all workspaces
 opvs workspace use <slug>                  # Switch current workspace
 opvs workspace current                     # Show current workspace details
-opvs workspace remove <slug>               # Remove a saved workspace
+opvs workspace remove <slug> --yes         # Remove a saved workspace
 ```
 
 ## YAML Output

package/dist/.build-stamp.json

@@ -1,9 +1,9 @@
 {
   "stamp_version": 1,
   "package": "@opvs-ai/cli",
-  "version": "0.16.0",
-  "source_digest": "4d5002b9cebabfe3ca99d102e5d83e94161b9464cfefccf1c77f2da8f8aa8b43",
-  "source_files": 41,
-  "built_at": "2026-09-16T09:59:57.093Z",
-  "node": "v22.22.0"
+  "version": "0.20.1",
+  "source_digest": "5f2aeb431e9a054d49cf81631229a8b256b90a0120ea1b37ce860dfccf7302ca",
+  "source_files": 44,
+  "built_at": "2026-09-28T13:58:06.956Z",
+  "node": "v22.23.2"
 }

package/dist/commands/agent.js

@@ -71,7 +71,7 @@ export function registerAgentCommands(program) {
     agent
         .command("batch-create")
         .description("Create multiple tasks at once from a JSON file")
-        .requiredOption("--file <path>", "JSON file with array of task objects (board_id, title, description, priority)")
+        .requiredOption("--file <path>", "JSON file with an array of task objects: board_id and title required; column_id, description, priority, agent_instructions optional")
         .action(async (opts) => {
         const wsSlug = program.opts().workspace;
         try {
@@ -173,14 +173,15 @@ export function registerAgentCommands(program) {
         .command("mention <taskId>")
         .description("@mention an agent on a task (triggers agent to respond)")
         .requiredOption("--agent <slug>", "Agent slug to mention")
-        .option("--message <text>", "Message for the agent")
+        // Required: the gateway answers `400 agent_slug and message are required`
+        // without one, so an optional flag only moved the failure to the server
+        // (ASP-271).
+        .requiredOption("--message <text>", "Message for the agent")
         .action(async (taskId, opts) => {
         const wsSlug = program.opts().workspace;
         try {
             const client = createClient(wsSlug);
-            const body = { agent_slug: opts.agent };
-            if (opts.message)
-                body.message = opts.message;
+            const body = { agent_slug: opts.agent, message: opts.message };
             const res = await client.post(`/api/v1/board/tasks/${taskId}/agent-mention`, body);
             const data = await res.json();
             printJson(data);

package/dist/commands/agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../src/commands/agent.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,KAAK,GAAG,OAAO;SAClB,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,qEAAqE,CAAC,CAAC;IAEtF,KAAK;SACF,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,8CAA8C,CAAC;SAC3D,MAAM,CAAC,cAAc,EAAE,uGAAuG,CAAC;SAC/H,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,aAAa,EAAE,wCAAwC,CAAC;SAC/D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC;QACxC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,KAAK;gBAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC;YAC7C,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,kCAAkC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA0B,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,sBAAsB,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,aAAa,EAAE,wCAAwC,CAAC;SAC/D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC;QACxC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,wCAAwC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACnF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA0B,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,4BAA4B,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,gDAAgD,CAAC;SAC7D,cAAc,CAAC,eAAe,EAAE,+EAA+E,CAAC;SAChH,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA0B,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,8BAA8B,EAAE,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,qDAAqD,CAAC;SAClE,cAAc,CAAC,eAAe,EAAE,6BAA6B,CAAC;SAC9D,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;SAC9C,MAAM,CAAC,oBAAoB,EAAE,+BAA+B,CAAC;SAC7D,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAAI,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAA4B;gBACpC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;aACpC,CAAC;YACF,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC9C,IAAI,IAAI,CAAC,SAAS;gBAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC;YAC5D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,WAAW,EAAE,IAAI,CAAC,CAAC;YACxF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA0B,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,2BAA2B,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,mBAAmB,EAAE,gCAAgC,EAAE,MAAM,CAAC;SACrE,MAAM,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;SAChD,MAAM,CAAC,uBAAuB,EAAE,8BAA8B,CAAC;SAC/D,MAAM,CAAC,iBAAiB,EAAE,qBAAqB,CAAC;SAChD,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAAI,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAA4B,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9D,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC9C,IAAI,IAAI,CAAC,WAAW;gBAAE,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7E,IAAI,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,WAAW,EAAE,IAAI,CAAC,CAAC;YACxF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA0B,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,yBAAyB,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,0CAA0C,CAAC;SACvD,cAAc,CAAC,aAAa,EAAE,mBAAmB,CAAC;SAClD,MAAM,CAAC,uBAAuB,EAAE,mCAAmC,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAAI,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAA4B,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YAC9D,IAAI,IAAI,CAAC,YAAY;gBAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;YAC7D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,WAAW,EAAE,IAAI,CAAC,CAAC;YACxF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA0B,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,yBAAyB,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,yDAAyD,CAAC;SACtE,cAAc,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;SACzD,MAAM,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;SACnD,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAAI,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAA4B,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YACjE,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC9C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,gBAAgB,EAAE,IAAI,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA0B,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,yBAAyB,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,iDAAiD,CAAC;SAC9D,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,aAAa,EAAE,wCAAwC,CAAC;SAC/D,MAAM,CAAC,YAAY,EAAE,kCAAkC,CAAC;SACxD,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAI,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC;QACxC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC7C,mEAAmE;YACnE,iEAAiE;YACjE,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,OAAO;gBAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC;YACvC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC5D,IAAI,IAAI;gBAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;YAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,wBAAwB,IAAI,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA0B,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,2BAA2B,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../src/commands/agent.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,KAAK,GAAG,OAAO;SAClB,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,qEAAqE,CAAC,CAAC;IAEtF,KAAK;SACF,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,8CAA8C,CAAC;SAC3D,MAAM,CAAC,cAAc,EAAE,uGAAuG,CAAC;SAC/H,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,aAAa,EAAE,wCAAwC,CAAC;SAC/D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC;QACxC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,KAAK;gBAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC;YAC7C,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,kCAAkC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA0B,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,sBAAsB,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,aAAa,EAAE,wCAAwC,CAAC;SAC/D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC;QACxC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,wCAAwC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACnF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA0B,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,4BAA4B,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,gDAAgD,CAAC;SAC7D,cAAc,CACb,eAAe,EACf,qIAAqI,CACtI;SACA,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA0B,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,8BAA8B,EAAE,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,qDAAqD,CAAC;SAClE,cAAc,CAAC,eAAe,EAAE,6BAA6B,CAAC;SAC9D,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;SAC9C,MAAM,CAAC,oBAAoB,EAAE,+BAA+B,CAAC;SAC7D,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAAI,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAA4B;gBACpC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;aACpC,CAAC;YACF,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC9C,IAAI,IAAI,CAAC,SAAS;gBAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC;YAC5D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,WAAW,EAAE,IAAI,CAAC,CAAC;YACxF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA0B,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,2BAA2B,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,mBAAmB,EAAE,gCAAgC,EAAE,MAAM,CAAC;SACrE,MAAM,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;SAChD,MAAM,CAAC,uBAAuB,EAAE,8BAA8B,CAAC;SAC/D,MAAM,CAAC,iBAAiB,EAAE,qBAAqB,CAAC;SAChD,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAAI,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAA4B,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9D,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC9C,IAAI,IAAI,CAAC,WAAW;gBAAE,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC7E,IAAI,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,WAAW,EAAE,IAAI,CAAC,CAAC;YACxF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA0B,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,yBAAyB,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,0CAA0C,CAAC;SACvD,cAAc,CAAC,aAAa,EAAE,mBAAmB,CAAC;SAClD,MAAM,CAAC,uBAAuB,EAAE,mCAAmC,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAAI,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAA4B,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YAC9D,IAAI,IAAI,CAAC,YAAY;gBAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;YAC7D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,WAAW,EAAE,IAAI,CAAC,CAAC;YACxF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA0B,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,yBAAyB,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,yDAAyD,CAAC;SACtE,cAAc,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;QAC1D,0EAA0E;QAC1E,wEAAwE;QACxE,aAAa;SACZ,cAAc,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;SAC3D,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAAI,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAA4B,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YACxF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,gBAAgB,EAAE,IAAI,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA0B,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,yBAAyB,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,iDAAiD,CAAC;SAC9D,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,aAAa,EAAE,wCAAwC,CAAC;SAC/D,MAAM,CAAC,YAAY,EAAE,kCAAkC,CAAC;SACxD,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAI,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC;QACxC,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC7C,mEAAmE;YACnE,iEAAiE;YACjE,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,OAAO;gBAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC;YACvC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC5D,IAAI,IAAI;gBAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;YAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,wBAAwB,IAAI,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAA0B,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,2BAA2B,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/auth.js

@@ -2,21 +2,205 @@
  * opvs auth — AI-native token provisioning + management
  */
 import { getEffectiveConfig, saveWorkspace, setCurrentWorkspace, loadRawConfig, apiUnauthPost, createClient, DEFAULT_WORKSPACE, } from "@opvs-ai/core";
+/**
+ * Point `current_workspace` at `fallback` ONLY if the pointer is currently
+ * empty or dangling.
+ *
+ * `auth request` used to call `setCurrentWorkspace(workspaces[0].brand_slug)`
+ * unconditionally, so re-authing to refresh an expiring token silently moved
+ * the CLI to whichever brand the server happened to list first. Everything
+ * after that ran against the wrong brand while still looking right: the very
+ * next command reported `skill '@opvs-ai/agentmemory' is not installed on
+ * this brand`, which is true of the brand it had been moved to and false of
+ * the one the operator thought they were on. Reported by @di-atomic
+ * 2026-09-21.
+ *
+ * The workspace pointer is sticky state. `opvs workspace use <slug>` is what
+ * changes it; re-authenticating is not. (`saveWorkspace` already has exactly
+ * these semantics — it sets current only when none is set. This makes the
+ * explicit call agree with it instead of overriding it.)
+ *
+ * Returns the slug that is current afterwards, so the caller can print it —
+ * a workspace pointer you cannot see is how this went unnoticed.
+ */
+function ensureCurrentWorkspace(fallback) {
+    const cfg = loadRawConfig();
+    const existing = cfg.current_workspace;
+    if (existing && cfg.workspaces[existing])
+        return existing;
+    setCurrentWorkspace(fallback);
+    return fallback;
+}
 import { buildFingerprint } from "../lib/fingerprint.js";
 import { pollForApproval } from "../lib/auth-poll.js";
+import { clearPendingAuth, loadPendingAuth, savePendingAuth, } from "../lib/pending-auth.js";
 import { printJson } from "../lib/format.js";
+import { confirmOrExit, YES_HELP } from "../lib/confirm.js";
+const WAIT_HELP = "Minutes to wait here for the approval before handing off to `opvs auth resume` " +
+    "(default: 5). The request itself stays approvable on the server for longer.";
+/**
+ * `--wait <minutes>` → milliseconds. `undefined` when the flag is absent (the poll
+ * loop's own default applies); `null` when it is not a positive number.
+ */
+function parseWaitMinutes(value) {
+    if (value === undefined)
+        return undefined;
+    const minutes = Number(value);
+    if (!Number.isFinite(minutes) || minutes <= 0)
+        return null;
+    return Math.round(minutes * 60_000);
+}
+/**
+ * Save the request for `opvs auth resume` BEFORE the first poll, so a process
+ * killed mid-wait (an agent's tool-call timeout) still leaves it collectable.
+ * A failure to save must not cost the login itself — it only loses the resume.
+ */
+function rememberPending(fields) {
+    const pending = { ...fields, created_at: new Date().toISOString() };
+    try {
+        savePendingAuth(pending);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`Warning: could not save this request for \`opvs auth resume\` (${msg}). ` +
+            "If the wait below ends before it is approved, request access again.\n");
+    }
+    return pending;
+}
+function forgetPending() {
+    try {
+        clearPendingAuth();
+    }
+    catch {
+        /* nothing to clean up is not an error */
+    }
+}
+function handoffMessage(pending, now = Date.now()) {
+    const who = pending.owner_email ? `The approval email went to ${pending.owner_email}. ` : "";
+    const expiry = new Date(pending.expires_at).getTime();
+    if (Number.isFinite(expiry) && expiry > now) {
+        const minutes = Math.max(1, Math.ceil((expiry - now) / 60_000));
+        return (`Not approved yet. The request stays open for about ${minutes} more minute${minutes === 1 ? "" : "s"} ` +
+            `(until ${pending.expires_at}).\n${who}Once it has been approved, run:\n  opvs auth resume`);
+    }
+    return `Not approved yet. ${who}If it is approved in time, run:\n  opvs auth resume`;
+}
+/**
+ * Turn a poll result into saved credentials and a message — shared by
+ * `auth request` and `auth resume`, so a late approval ends exactly like a
+ * prompt one. The saved request is dropped on every final answer and kept only
+ * while the server may still approve it.
+ */
+function settleApproval(result, pending) {
+    const baseUrl = pending.api_url;
+    const wsSlug = pending.workspace_slug;
+    if (result.status === "active" && wsSlug && result.token) {
+        saveWorkspace(wsSlug, {
+            api_url: baseUrl,
+            token: result.token,
+            brand_id: result.brand_id ?? null,
+            brand_name: result.brand_name ?? "",
+        });
+        forgetPending();
+        const current = ensureCurrentWorkspace(wsSlug);
+        console.log(`\nAuthenticated! Token saved to workspace "${wsSlug}".`);
+        console.log(`Brand: ${result.brand_name} (ID: ${result.brand_id})`);
+        console.log(`Scopes: ${result.scopes?.join(", ")}`);
+        console.log(current === wsSlug
+            ? `Current workspace: ${current}`
+            : `Current workspace: ${current} (unchanged — "opvs workspace use ${wsSlug}" to switch)`);
+        return;
+    }
+    if (result.status === "active" && !wsSlug && result.workspaces?.length) {
+        // Save each workspace
+        for (const ws of result.workspaces) {
+            saveWorkspace(ws.brand_slug, {
+                api_url: baseUrl,
+                token: ws.token,
+                brand_id: ws.brand_id,
+                brand_name: ws.brand_name,
+            });
+        }
+        forgetPending();
+        // Keep whatever workspace was already current — re-authing is not
+        // a request to switch brands. Falls back to the first only when
+        // there is no usable pointer yet (first auth on this machine).
+        const current = ensureCurrentWorkspace(result.workspaces[0].brand_slug);
+        const slugs = result.workspaces.map((ws) => ws.brand_slug).join(", ");
+        console.log(`\nAuthenticated! ${result.workspaces.length} workspace${result.workspaces.length !== 1 ? "s" : ""} configured: ${slugs}`);
+        for (const ws of result.workspaces) {
+            // Print the granted scopes per workspace — each token is clamped to its
+            // own workspace's policy, so they are not necessarily what was asked for
+            // and are not necessarily the same across workspaces.
+            const granted = ws.scopes?.length ? ws.scopes.join(", ") : "(none)";
+            const marker = ws.brand_slug === current ? " [current]" : "";
+            console.log(`  ${ws.brand_slug}: ${ws.brand_name} (ID: ${ws.brand_id})${marker}`);
+            console.log(`    scopes: ${granted}`);
+        }
+        console.log(`\nCurrent workspace: ${current} — unchanged by this command. ` +
+            `Switch with "opvs workspace use <slug>".`);
+        return;
+    }
+    if (result.status === "active" && !wsSlug && result.token) {
+        // Fallback: server returned single-brand format
+        const slug = pending.brands?.[0]?.brand_slug || "default";
+        saveWorkspace(slug, {
+            api_url: baseUrl,
+            token: result.token,
+            brand_id: result.brand_id ?? null,
+            brand_name: result.brand_name ?? "",
+        });
+        forgetPending();
+        const currentFb = ensureCurrentWorkspace(slug);
+        console.log(`\nAuthenticated! Token saved to workspace "${slug}".`);
+        console.log(`Current workspace: ${currentFb}`);
+        return;
+    }
+    if (result.status === "denied") {
+        forgetPending();
+        console.error("\nAccess denied by the workspace admin. Check with them before requesting again.");
+        process.exit(1);
+        return;
+    }
+    if (result.status === "expired") {
+        forgetPending();
+        console.error("\nRequest expired before it was approved, so nothing was granted.\n" +
+            "Run `opvs auth request` again, and approve the newest email.");
+        process.exit(1);
+        return;
+    }
+    if (result.status === "invalid") {
+        forgetPending();
+        console.error("\nThe server no longer recognises this request. Run `opvs auth request` to start a new one.");
+        process.exit(1);
+        return;
+    }
+    // Not decided yet — or approved, but the token has not arrived yet. Either
+    // way the request can still be collected; keep it, and say how.
+    console.error(`\n${handoffMessage(pending)}`);
+    process.exit(2);
+}
 export function registerAuthCommands(program) {
     const auth = program.command("auth").description("Token authentication");
     auth
         .command("request")
-        .description("Request a PAT token (sends approval email to admin)")
+        .description("Request a PAT token (sends an approval email to the workspace admin). Waits here for the approval, " +
+        "then hands off — the request stays approvable on the server for longer, and `opvs auth resume` " +
+        "collects the token. Exit codes: 0 approved · 1 denied, expired or failed · 2 not approved yet.")
         .requiredOption("-e, --email <email>", "Admin email (who approves)")
         .option("-p, --project <name>", "Project name (shown in approval email)")
         .option("-s, --scopes <scopes>", "Comma-separated scopes to request (default: the workspace's standard agent scopes)")
         .option("-t, --ttl <hours>", "Token TTL in hours (omit for no expiry)")
         .option("--api-url <url>", "API base URL (overrides config)")
+        .option("--wait <minutes>", WAIT_HELP)
         .action(async (opts) => {
         const wsSlug = program.opts().workspace;
+        const waitMs = parseWaitMinutes(opts.wait);
+        if (waitMs === null) {
+            console.error("Error: --wait takes a number of minutes greater than 0");
+            process.exit(1);
+            return;
+        }
         const config = loadRawConfig();
         const fingerprint = buildFingerprint();
         // No client-side default. This used to be hard-coded to "board:read,board:write",
@@ -47,31 +231,17 @@ export function registerAuthCommands(program) {
                 const { request_id, poll_token, expires_at } = data;
                 console.log(`Request ID: ${request_id}`);
                 console.log(`Expires: ${expires_at}`);
-                const result = await pollForApproval(baseUrl, request_id, poll_token);
-                if (result.status === "active" && result.token) {
-                    saveWorkspace(wsSlug, {
-                        api_url: baseUrl,
-                        token: result.token,
-                        brand_id: result.brand_id ?? null,
-                        brand_name: result.brand_name ?? "",
-                    });
-                    setCurrentWorkspace(wsSlug);
-                    console.log(`\nAuthenticated! Token saved to workspace "${wsSlug}".`);
-                    console.log(`Brand: ${result.brand_name} (ID: ${result.brand_id})`);
-                    console.log(`Scopes: ${result.scopes?.join(", ")}`);
-                }
-                else if (result.status === "denied") {
-                    console.error("\nAccess denied by workspace owner.");
-                    process.exit(1);
-                }
-                else if (result.status === "expired") {
-                    console.error("\nRequest expired. Try again.");
-                    process.exit(1);
-                }
-                else {
-                    console.error("\nRequest timed out. The owner may not have seen the email.");
-                    process.exit(1);
-                }
+                const pending = rememberPending({
+                    request_id,
+                    poll_token,
+                    api_url: baseUrl,
+                    expires_at,
+                    owner_email: opts.email,
+                    workspace_slug: wsSlug,
+                    brands: [],
+                });
+                const result = await pollForApproval(baseUrl, request_id, poll_token, waitMs, expires_at);
+                settleApproval(result, pending);
             }
             catch (err) {
                 const e = err;
@@ -96,54 +266,17 @@ export function registerAuthCommands(program) {
                 console.log(`Found ${brandCount} workspace${brandCount !== 1 ? "s" : ""}. Approval email sent to ${opts.email}`);
                 console.log(`Request ID: ${request_id}`);
                 console.log(`Expires: ${expires_at}`);
-                const result = await pollForApproval(baseUrl, request_id, poll_token);
-                if (result.status === "active" && result.workspaces?.length) {
-                    // Save each workspace
-                    for (const ws of result.workspaces) {
-                        saveWorkspace(ws.brand_slug, {
-                            api_url: baseUrl,
-                            token: ws.token,
-                            brand_id: ws.brand_id,
-                            brand_name: ws.brand_name,
-                        });
-                    }
-                    // Set the first workspace as current
-                    setCurrentWorkspace(result.workspaces[0].brand_slug);
-                    const slugs = result.workspaces.map((ws) => ws.brand_slug).join(", ");
-                    console.log(`\nAuthenticated! ${result.workspaces.length} workspace${result.workspaces.length !== 1 ? "s" : ""} configured: ${slugs}`);
-                    for (const ws of result.workspaces) {
-                        // Print the granted scopes per workspace — each token is clamped to its
-                        // own workspace's policy, so they are not necessarily what was asked for
-                        // and are not necessarily the same across workspaces.
-                        const granted = ws.scopes?.length ? ws.scopes.join(", ") : "(none)";
-                        console.log(`  ${ws.brand_slug}: ${ws.brand_name} (ID: ${ws.brand_id})`);
-                        console.log(`    scopes: ${granted}`);
-                    }
-                }
-                else if (result.status === "active" && result.token) {
-                    // Fallback: server returned single-brand format
-                    const slug = brands?.[0]?.brand_slug || "default";
-                    saveWorkspace(slug, {
-                        api_url: baseUrl,
-                        token: result.token,
-                        brand_id: result.brand_id ?? null,
-                        brand_name: result.brand_name ?? "",
-                    });
-                    setCurrentWorkspace(slug);
-                    console.log(`\nAuthenticated! Token saved to workspace "${slug}".`);
-                }
-                else if (result.status === "denied") {
-                    console.error("\nAccess denied by admin.");
-                    process.exit(1);
-                }
-                else if (result.status === "expired") {
-                    console.error("\nRequest expired. Try again.");
-                    process.exit(1);
-                }
-                else {
-                    console.error("\nRequest timed out. The admin may not have seen the email.");
-                    process.exit(1);
-                }
+                const pending = rememberPending({
+                    request_id,
+                    poll_token,
+                    api_url: baseUrl,
+                    expires_at,
+                    owner_email: opts.email,
+                    workspace_slug: null,
+                    brands: brands ?? [],
+                });
+                const result = await pollForApproval(baseUrl, request_id, poll_token, waitMs, expires_at);
+                settleApproval(result, pending);
             }
             catch (err) {
                 const e = err;
@@ -152,6 +285,30 @@ export function registerAuthCommands(program) {
             }
         }
     });
+    auth
+        .command("resume")
+        .description("Collect the token for the last `auth request` on this machine — for an approval that came after " +
+        "it stopped waiting. Same exit codes as `auth request`.")
+        .option("--wait <minutes>", WAIT_HELP)
+        .action(async (opts) => {
+        const waitMs = parseWaitMinutes(opts.wait);
+        if (waitMs === null) {
+            console.error("Error: --wait takes a number of minutes greater than 0");
+            process.exit(1);
+            return;
+        }
+        const pending = loadPendingAuth();
+        if (!pending) {
+            console.error("No pending access request on this machine. Run `opvs auth request` to start one.");
+            process.exit(1);
+            return;
+        }
+        console.log(`Resuming request ${pending.request_id}` +
+            (pending.owner_email ? ` (approval email: ${pending.owner_email})` : "") +
+            ".");
+        const result = await pollForApproval(pending.api_url, pending.request_id, pending.poll_token, waitMs, pending.expires_at);
+        settleApproval(result, pending);
+    });
     auth
         .command("status")
         .description("Show current authentication status")
@@ -181,9 +338,22 @@ export function registerAuthCommands(program) {
     });
     auth
         .command("revoke")
-        .description("Revoke the token for the current workspace")
-        .action(async () => {
+        .description("Revoke the token for the current workspace, on the server and on this machine. Asks first; needs --yes off a terminal.")
+        .option("-y, --yes", YES_HELP)
+        .action(async (opts) => {
         const wsSlug = program.opts().workspace;
+        // Ask OUTSIDE the try below: its catch clears the local token, so a
+        // refusal raised inside it would be handled as a failed revoke.
+        let hasToken = false;
+        try {
+            hasToken = Boolean(getEffectiveConfig(wsSlug).token);
+        }
+        catch {
+            /* the try below reports a config error */
+        }
+        if (hasToken) {
+            await confirmOrExit("Revoke this workspace's token?", opts.yes, "It stops working at once, and getting another needs a new `opvs auth request` and an approval");
+        }
         try {
             const cfg = getEffectiveConfig(wsSlug);
             if (!cfg.token) {