@pixelzx/genesis 2026.5.3-5 → 2026.5.5

package/dist/daemon-cli-C_9CNoZA.js

@@ -0,0 +1,12 @@
+import { t as formatDocsLink } from "./links-DmsJCU7L.js";
+import { r as theme } from "./theme-BrRleVfL.js";
+import { t as addGatewayServiceCommands } from "./register-service-commands-DcW5qPTu.js";
+import "./install-BZaQGsDZ.js";
+import "./lifecycle-DVWaxj-A.js";
+import "./status-p4yx6E3C.js";
+//#region src/cli/daemon-cli/register.ts
+function registerDaemonCli(program) {
+	addGatewayServiceCommands(program.command("daemon").description("Manage the Gateway service (launchd/systemd/schtasks)").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/gateway", "docs.genesis.ai/cli/gateway")}\n`), { statusDescription: "Show service install status + probe connectivity/capability" });
+}
+//#endregion
+export { registerDaemonCli as t };

package/dist/delegate-B8wh-jjf.js

@@ -0,0 +1,64 @@
+import { t as buildMemoryPromptSection } from "./memory-state-CwHzq3a2.js";
+import { n as normalizeStructuredPromptSection } from "./prompt-cache-stability-UVrbE60n.js";
+//#region src/context-engine/delegate.ts
+let compactRuntimePromise = null;
+function loadCompactRuntime() {
+	compactRuntimePromise ??= import("./compact.runtime-4gW_cs7D.js");
+	return compactRuntimePromise;
+}
+/**
+* Delegate a context-engine compaction request to Genesis's built-in runtime compaction path.
+*
+* This is the same bridge used by the legacy context engine. Third-party
+* engines can call it from their own `compact()` implementations when they do
+* not own the compaction algorithm but still need `/compact` and overflow
+* recovery to use the stock runtime behavior.
+*
+* Note: `compactionTarget` is part of the public `compact()` contract, but the
+* built-in runtime compaction path does not expose that knob. This helper
+* ignores it to preserve legacy behavior; engines that need target-specific
+* compaction should implement their own `compact()` algorithm.
+*/
+async function delegateCompactionToRuntime(params) {
+	const { compactEmbeddedPiSessionDirect } = await loadCompactRuntime();
+	const runtimeContext = params.runtimeContext ?? {};
+	const currentTokenCount = params.currentTokenCount ?? (typeof runtimeContext.currentTokenCount === "number" && Number.isFinite(runtimeContext.currentTokenCount) && runtimeContext.currentTokenCount > 0 ? Math.floor(runtimeContext.currentTokenCount) : void 0);
+	const result = await compactEmbeddedPiSessionDirect({
+		...runtimeContext,
+		sessionId: params.sessionId,
+		sessionFile: params.sessionFile,
+		tokenBudget: params.tokenBudget,
+		...currentTokenCount !== void 0 ? { currentTokenCount } : {},
+		force: params.force,
+		customInstructions: params.customInstructions,
+		workspaceDir: typeof runtimeContext.workspaceDir === "string" ? runtimeContext.workspaceDir : process.cwd()
+	});
+	return {
+		ok: result.ok,
+		compacted: result.compacted,
+		reason: result.reason,
+		result: result.result ? {
+			summary: result.result.summary,
+			firstKeptEntryId: result.result.firstKeptEntryId,
+			tokensBefore: result.result.tokensBefore,
+			tokensAfter: result.result.tokensAfter,
+			details: result.result.details
+		} : void 0
+	};
+}
+/**
+* Build a context-engine-ready systemPromptAddition from the active memory
+* plugin prompt path. This lets non-legacy engines explicitly opt into the
+* same memory/wiki guidance that the legacy engine gets via system prompt
+* assembly, without reimplementing memory prompt formatting.
+*/
+function buildMemorySystemPromptAddition(params) {
+	const lines = buildMemoryPromptSection({
+		availableTools: params.availableTools,
+		citationsMode: params.citationsMode
+	});
+	if (lines.length === 0) return;
+	return normalizeStructuredPromptSection(lines.join("\n")) || void 0;
+}
+//#endregion
+export { delegateCompactionToRuntime as n, buildMemorySystemPromptAddition as t };

package/dist/detached-task-runtime-BTq-jIGw.js

@@ -0,0 +1,73 @@
+import { t as createSubsystemLogger } from "./subsystem-DTMy5YmO.js";
+import { r as getRegisteredDetachedTaskLifecycleRuntime } from "./detached-task-runtime-state-D9Kb676J.js";
+import { t as cancelTaskById } from "./task-registry-B-kQGKt_.js";
+import "./runtime-internal-CQX4Zehn.js";
+import { a as createQueuedTaskRun$1, d as setDetachedTaskDeliveryStatusByRunId$1, f as startTaskRunByRunId$1, i as completeTaskRunByRunId$1, l as recordTaskRunProgressByRunId$1, o as createRunningTaskRun$1, s as failTaskRunByRunId$1 } from "./task-executor-DfugjJEq.js";
+//#region src/tasks/detached-task-runtime.ts
+const log = createSubsystemLogger("tasks/detached-runtime");
+const DETACHED_TASK_RECOVERY_WARN_MS = 5e3;
+const DEFAULT_DETACHED_TASK_LIFECYCLE_RUNTIME = {
+	createQueuedTaskRun: createQueuedTaskRun$1,
+	createRunningTaskRun: createRunningTaskRun$1,
+	startTaskRunByRunId: startTaskRunByRunId$1,
+	recordTaskRunProgressByRunId: recordTaskRunProgressByRunId$1,
+	completeTaskRunByRunId: completeTaskRunByRunId$1,
+	failTaskRunByRunId: failTaskRunByRunId$1,
+	setDetachedTaskDeliveryStatusByRunId: setDetachedTaskDeliveryStatusByRunId$1,
+	cancelDetachedTaskRunById: cancelTaskById
+};
+function getDetachedTaskLifecycleRuntime() {
+	return getRegisteredDetachedTaskLifecycleRuntime() ?? DEFAULT_DETACHED_TASK_LIFECYCLE_RUNTIME;
+}
+function createQueuedTaskRun(...args) {
+	return getDetachedTaskLifecycleRuntime().createQueuedTaskRun(...args);
+}
+function createRunningTaskRun(...args) {
+	return getDetachedTaskLifecycleRuntime().createRunningTaskRun(...args);
+}
+function startTaskRunByRunId(...args) {
+	return getDetachedTaskLifecycleRuntime().startTaskRunByRunId(...args);
+}
+function recordTaskRunProgressByRunId(...args) {
+	return getDetachedTaskLifecycleRuntime().recordTaskRunProgressByRunId(...args);
+}
+function completeTaskRunByRunId(...args) {
+	return getDetachedTaskLifecycleRuntime().completeTaskRunByRunId(...args);
+}
+function failTaskRunByRunId(...args) {
+	return getDetachedTaskLifecycleRuntime().failTaskRunByRunId(...args);
+}
+function setDetachedTaskDeliveryStatusByRunId(...args) {
+	return getDetachedTaskLifecycleRuntime().setDetachedTaskDeliveryStatusByRunId(...args);
+}
+async function tryRecoverTaskBeforeMarkLost(params) {
+	const hook = getDetachedTaskLifecycleRuntime().tryRecoverTaskBeforeMarkLost;
+	if (!hook) return { recovered: false };
+	const startedAt = Date.now();
+	try {
+		const result = await hook(params);
+		const elapsedMs = Date.now() - startedAt;
+		if (elapsedMs >= DETACHED_TASK_RECOVERY_WARN_MS) log.warn("Detached task recovery hook was slow", {
+			taskId: params.taskId,
+			runtime: params.runtime,
+			elapsedMs
+		});
+		if (result && typeof result.recovered === "boolean") return result;
+		log.warn("Detached task recovery hook returned invalid result, proceeding with markTaskLost", {
+			taskId: params.taskId,
+			runtime: params.runtime,
+			result
+		});
+		return { recovered: false };
+	} catch (err) {
+		log.warn("Detached task recovery hook threw, proceeding with markTaskLost", {
+			taskId: params.taskId,
+			runtime: params.runtime,
+			elapsedMs: Date.now() - startedAt,
+			error: err
+		});
+		return { recovered: false };
+	}
+}
+//#endregion
+export { recordTaskRunProgressByRunId as a, tryRecoverTaskBeforeMarkLost as c, failTaskRunByRunId as i, createQueuedTaskRun as n, setDetachedTaskDeliveryStatusByRunId as o, createRunningTaskRun as r, startTaskRunByRunId as s, completeTaskRunByRunId as t };

package/dist/devices-cli-C_amY-AS.js

@@ -0,0 +1,496 @@
+import { a as normalizeLowercaseStringOrEmpty, c as normalizeOptionalString, d as normalizeStringifiedOptionalString } from "./string-coerce-C1IzJjqi.js";
+import { n as defaultRuntime } from "./runtime-CQ7eH0le.js";
+import { t as sanitizeForLog } from "./ansi-BZHMLcUk.js";
+import { r as theme } from "./theme-BrRleVfL.js";
+import { a as isLoopbackHost } from "./net-AycWGi8-.js";
+import { n as normalizeDeviceAuthScopes } from "./device-auth-7WDS2Ilv.js";
+import { i as GATEWAY_CLIENT_NAMES, r as GATEWAY_CLIENT_MODES } from "./client-info-CfESmEX1.js";
+import { d as readConnectPairingRequiredMessage } from "./connect-error-details-D-uC5j3Z.js";
+import { n as buildGatewayConnectionDetails, r as callGateway } from "./call-DkGNVvLy.js";
+import { n as formatTimeAgo } from "./format-relative-uQtNNoGl.js";
+import { n as withProgress } from "./progress-C6QDkZMg.js";
+import { g as summarizeDeviceTokens, i as formatDevicePairingForbiddenMessage, l as listDevicePairing, n as approveDevicePairing } from "./device-pairing-BorvqhX6.js";
+import { n as renderTable, t as getTerminalTableWidth } from "./table-DqrQ4Wmg.js";
+//#region src/shared/device-pairing-access.ts
+function normalizeRoleList(...items) {
+	const roles = /* @__PURE__ */ new Set();
+	for (const item of items) {
+		if (!item) continue;
+		if (Array.isArray(item)) {
+			for (const role of item) {
+				const trimmed = role.trim();
+				if (trimmed) roles.add(trimmed);
+			}
+			continue;
+		}
+		const trimmed = item.trim();
+		if (trimmed) roles.add(trimmed);
+	}
+	return [...roles].toSorted();
+}
+function includesAll(allowed, requested) {
+	const allowedSet = new Set(allowed);
+	return requested.every((value) => allowedSet.has(value));
+}
+function summarizePendingDeviceAccess(request) {
+	return {
+		roles: normalizeRoleList(request.roles, request.role),
+		scopes: normalizeDeviceAuthScopes(request.scopes)
+	};
+}
+function summarizeApprovedDeviceAccess(device) {
+	const approvedRoles = normalizeRoleList(device.roles, device.role);
+	const tokenList = Array.isArray(device.tokens) ? device.tokens : device.tokens ? Object.values(device.tokens) : void 0;
+	return {
+		roles: tokenList === void 0 ? approvedRoles : normalizeRoleList(tokenList.filter((token) => !token.revokedAtMs).flatMap((token) => token.role ?? [])).filter((role) => approvedRoles.includes(role)),
+		scopes: normalizeDeviceAuthScopes(device.scopes)
+	};
+}
+function resolvePendingDeviceApprovalState(request, paired) {
+	const requested = summarizePendingDeviceAccess(request);
+	const approved = paired ? summarizeApprovedDeviceAccess(paired) : null;
+	if (!approved) return {
+		kind: "new-pairing",
+		requested,
+		approved: null
+	};
+	if (!includesAll(approved.roles, requested.roles)) return {
+		kind: "role-upgrade",
+		requested,
+		approved
+	};
+	if (!includesAll(approved.scopes, requested.scopes)) return {
+		kind: "scope-upgrade",
+		requested,
+		approved
+	};
+	return {
+		kind: "re-approval",
+		requested,
+		approved
+	};
+}
+//#endregion
+//#region src/cli/devices-cli.ts
+const FALLBACK_NOTICE = "Direct scope access failed; using local fallback.";
+const DEFAULT_DEVICES_TIMEOUT_MS = 1e4;
+const devicesCallOpts = (cmd, defaults) => cmd.option("--url <url>", "Gateway WebSocket URL (defaults to gateway.remote.url when configured)").option("--token <token>", "Gateway token (if required)").option("--password <password>", "Gateway password (password auth)").option("--timeout <ms>", "Timeout in ms", String(defaults?.timeoutMs ?? DEFAULT_DEVICES_TIMEOUT_MS)).option("--json", "Output JSON", false);
+const callGatewayCli = async (method, opts, params) => withProgress({
+	label: `Devices ${method}`,
+	indeterminate: true,
+	enabled: opts.json !== true
+}, async () => await callGateway({
+	url: opts.url,
+	token: opts.token,
+	password: opts.password,
+	method,
+	params,
+	timeoutMs: Number(opts.timeout ?? DEFAULT_DEVICES_TIMEOUT_MS),
+	clientName: GATEWAY_CLIENT_NAMES.CLI,
+	mode: GATEWAY_CLIENT_MODES.CLI
+}));
+function normalizeErrorMessage(error) {
+	if (error instanceof Error) return error.message;
+	return String(error);
+}
+function shouldUseLocalPairingFallback(opts, error) {
+	if (!readConnectPairingRequiredMessage(normalizeLowercaseStringOrEmpty(normalizeErrorMessage(error)))) return false;
+	if (typeof opts.url === "string" && opts.url.trim().length > 0) return false;
+	const connection = buildGatewayConnectionDetails();
+	if (connection.urlSource !== "local loopback") return false;
+	try {
+		return isLoopbackHost(new URL(connection.url).hostname);
+	} catch {
+		return false;
+	}
+}
+function redactLocalPairedDevice(device) {
+	const { tokens, ...rest } = device;
+	return {
+		...rest,
+		tokens: summarizeDeviceTokens(tokens)
+	};
+}
+async function listPairingWithFallback(opts) {
+	try {
+		return parseDevicePairingList(await callGatewayCli("device.pair.list", opts, {}));
+	} catch (error) {
+		if (!shouldUseLocalPairingFallback(opts, error)) throw error;
+		if (opts.json !== true) defaultRuntime.log(theme.warn(FALLBACK_NOTICE));
+		const local = await listDevicePairing();
+		return {
+			pending: local.pending,
+			paired: local.paired.map((device) => redactLocalPairedDevice(device))
+		};
+	}
+}
+async function approvePairingWithFallback(opts, requestId) {
+	try {
+		return await callGatewayCli("device.pair.approve", opts, { requestId });
+	} catch (error) {
+		if (!shouldUseLocalPairingFallback(opts, error)) throw error;
+		if (opts.json !== true) defaultRuntime.log(theme.warn(FALLBACK_NOTICE));
+		const approved = await approveDevicePairing(requestId, { callerScopes: ["operator.admin"] });
+		if (!approved) return null;
+		if (approved.status === "forbidden") throw new Error(formatDevicePairingForbiddenMessage(approved), { cause: error });
+		return {
+			requestId,
+			device: redactLocalPairedDevice(approved.device)
+		};
+	}
+}
+function parseDevicePairingList(value) {
+	const obj = typeof value === "object" && value !== null ? value : {};
+	return {
+		pending: Array.isArray(obj.pending) ? obj.pending : [],
+		paired: Array.isArray(obj.paired) ? obj.paired : []
+	};
+}
+function selectLatestPendingRequest(pending) {
+	if (!pending?.length) return null;
+	return pending.reduce((latest, current) => {
+		const latestTs = typeof latest.ts === "number" ? latest.ts : 0;
+		return (typeof current.ts === "number" ? current.ts : 0) > latestTs ? current : latest;
+	});
+}
+function formatTokenSummary(tokens) {
+	if (!tokens || tokens.length === 0) return "none";
+	return tokens.map((t) => `${sanitizeForLog(t.role)}${t.revokedAtMs ? " (revoked)" : ""}`).toSorted((a, b) => a.localeCompare(b)).join(", ");
+}
+function formatPendingDeviceIdentity(request) {
+	const displayName = normalizeOptionalString(request.displayName);
+	if (displayName) return sanitizeForLog(displayName);
+	return sanitizeForLog(normalizeOptionalString(request.deviceId) ?? "");
+}
+function formatAccessSummary(access) {
+	if (!access) return "none";
+	return `roles: ${access.roles.length > 0 ? access.roles.map((role) => sanitizeForLog(role)).join(", ") : "none"}; scopes: ${access.scopes.length > 0 ? access.scopes.map((scope) => sanitizeForLog(scope)).join(", ") : "none"}`;
+}
+function formatPendingApprovalKind(kind) {
+	switch (kind) {
+		case "new-pairing": return "new pairing";
+		case "role-upgrade": return "role upgrade";
+		case "scope-upgrade": return "scope upgrade";
+		case "re-approval": return "re-approval";
+	}
+	throw new Error("unsupported pending approval kind");
+}
+function indexPairedDevices(paired) {
+	const out = /* @__PURE__ */ new Map();
+	for (const device of paired ?? []) {
+		const deviceId = normalizeOptionalString(device.deviceId);
+		if (deviceId) out.set(deviceId, device);
+	}
+	return out;
+}
+function lookupPairedDevice(pairedByDeviceId, request) {
+	const normalizedDeviceId = normalizeOptionalString(request.deviceId);
+	if (!normalizedDeviceId) return;
+	const paired = pairedByDeviceId.get(normalizedDeviceId);
+	if (!paired) return;
+	const requestPublicKey = normalizeOptionalString(request.publicKey);
+	const pairedPublicKey = normalizeOptionalString(paired.publicKey);
+	if (requestPublicKey && pairedPublicKey && requestPublicKey !== pairedPublicKey) return;
+	return paired;
+}
+function quoteCliArg(value) {
+	if (/^[A-Za-z0-9_/:=.,@%+-]+$/.test(value)) return value;
+	return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function buildExplicitApproveCommand(opts, requestId) {
+	const args = [
+		"genesis",
+		"devices",
+		"approve",
+		requestId
+	];
+	const url = normalizeOptionalString(opts.url);
+	if (url) args.push("--url", url);
+	const timeout = normalizeOptionalString(opts.timeout);
+	if (timeout && timeout !== String(DEFAULT_DEVICES_TIMEOUT_MS)) args.push("--timeout", timeout);
+	if (opts.json === true) args.push("--json");
+	return args.map(quoteCliArg).join(" ");
+}
+function formatAuthFlagReminder(opts) {
+	const flags = [];
+	if (normalizeOptionalString(opts.token)) flags.push("--token");
+	if (normalizeOptionalString(opts.password)) flags.push("--password");
+	if (flags.length === 0) return "";
+	return `Reuse the same ${flags.join("/")} option${flags.length === 1 ? "" : "s"} when rerunning.`;
+}
+function resolveRequiredDeviceRole(opts) {
+	const deviceId = normalizeStringifiedOptionalString(opts.device) ?? "";
+	const role = normalizeStringifiedOptionalString(opts.role) ?? "";
+	if (deviceId && role) return {
+		deviceId,
+		role
+	};
+	defaultRuntime.error("--device and --role required");
+	defaultRuntime.exit(1);
+	return null;
+}
+function registerDevicesCli(program) {
+	const devices = program.command("devices").description("Device pairing and auth tokens");
+	devicesCallOpts(devices.command("list").description("List pending and paired devices").action(async (opts) => {
+		const list = await listPairingWithFallback(opts);
+		const pairedByDeviceId = indexPairedDevices(list.paired);
+		if (opts.json) {
+			defaultRuntime.writeJson(list);
+			return;
+		}
+		if (list.pending?.length) {
+			const tableWidth = getTerminalTableWidth();
+			defaultRuntime.log(`${theme.heading("Pending")} ${theme.muted(`(${list.pending.length})`)}`);
+			defaultRuntime.log(renderTable({
+				width: tableWidth,
+				columns: [
+					{
+						key: "Request",
+						header: "Request",
+						minWidth: 10
+					},
+					{
+						key: "Device",
+						header: "Device",
+						minWidth: 16,
+						flex: true
+					},
+					{
+						key: "Requested",
+						header: "Requested",
+						minWidth: 20,
+						flex: true
+					},
+					{
+						key: "Approved",
+						header: "Approved",
+						minWidth: 20,
+						flex: true
+					},
+					{
+						key: "Age",
+						header: "Age",
+						minWidth: 8
+					},
+					{
+						key: "Status",
+						header: "Status",
+						minWidth: 12
+					}
+				],
+				rows: list.pending.map((req) => {
+					const approval = resolvePendingDeviceApprovalState(req, lookupPairedDevice(pairedByDeviceId, req));
+					const statusParts = [formatPendingApprovalKind(approval.kind)];
+					if (req.isRepair) statusParts.push("repair");
+					return {
+						Request: req.requestId,
+						Device: `${formatPendingDeviceIdentity(req)}${req.remoteIp ? ` · ${sanitizeForLog(req.remoteIp)}` : ""}`,
+						Requested: formatAccessSummary(approval.requested),
+						Approved: formatAccessSummary(approval.approved),
+						Age: typeof req.ts === "number" ? formatTimeAgo(Date.now() - req.ts) : "",
+						Status: statusParts.join(", ")
+					};
+				})
+			}).trimEnd());
+		}
+		if (list.paired?.length) {
+			const tableWidth = getTerminalTableWidth();
+			defaultRuntime.log(`${theme.heading("Paired")} ${theme.muted(`(${list.paired.length})`)}`);
+			defaultRuntime.log(renderTable({
+				width: tableWidth,
+				columns: [
+					{
+						key: "Device",
+						header: "Device",
+						minWidth: 16,
+						flex: true
+					},
+					{
+						key: "Roles",
+						header: "Roles",
+						minWidth: 12,
+						flex: true
+					},
+					{
+						key: "Scopes",
+						header: "Scopes",
+						minWidth: 12,
+						flex: true
+					},
+					{
+						key: "Tokens",
+						header: "Tokens",
+						minWidth: 12,
+						flex: true
+					},
+					{
+						key: "IP",
+						header: "IP",
+						minWidth: 12
+					}
+				],
+				rows: list.paired.map((device) => ({
+					Device: sanitizeForLog(device.displayName || device.deviceId),
+					Roles: device.roles?.length ? device.roles.map((role) => sanitizeForLog(role)).join(", ") : "",
+					Scopes: device.scopes?.length ? device.scopes.map((scope) => sanitizeForLog(scope)).join(", ") : "",
+					Tokens: formatTokenSummary(device.tokens),
+					IP: device.remoteIp ? sanitizeForLog(device.remoteIp) : ""
+				}))
+			}).trimEnd());
+		}
+		if (!list.pending?.length && !list.paired?.length) defaultRuntime.log(theme.muted("No device pairing entries."));
+	}));
+	devicesCallOpts(devices.command("remove").description("Remove a paired device entry").argument("<deviceId>", "Paired device id").action(async (deviceId, opts) => {
+		const trimmed = deviceId.trim();
+		if (!trimmed) {
+			defaultRuntime.error("deviceId is required");
+			defaultRuntime.exit(1);
+			return;
+		}
+		const result = await callGatewayCli("device.pair.remove", opts, { deviceId: trimmed });
+		if (opts.json) {
+			defaultRuntime.writeJson(result);
+			return;
+		}
+		defaultRuntime.log(`${theme.warn("Removed")} ${theme.command(trimmed)}`);
+	}));
+	devicesCallOpts(devices.command("clear").description("Clear paired devices from the gateway table").option("--pending", "Also reject all pending pairing requests", false).option("--yes", "Confirm destructive clear", false).action(async (opts) => {
+		if (!opts.yes) {
+			defaultRuntime.error("Refusing to clear pairing table without --yes");
+			defaultRuntime.exit(1);
+			return;
+		}
+		const list = parseDevicePairingList(await callGatewayCli("device.pair.list", opts, {}));
+		const removedDeviceIds = [];
+		const rejectedRequestIds = [];
+		const paired = Array.isArray(list.paired) ? list.paired : [];
+		for (const device of paired) {
+			const deviceId = normalizeOptionalString(device.deviceId) ?? "";
+			if (!deviceId) continue;
+			await callGatewayCli("device.pair.remove", opts, { deviceId });
+			removedDeviceIds.push(deviceId);
+		}
+		if (opts.pending) {
+			const pending = Array.isArray(list.pending) ? list.pending : [];
+			for (const req of pending) {
+				const requestId = normalizeOptionalString(req.requestId) ?? "";
+				if (!requestId) continue;
+				await callGatewayCli("device.pair.reject", opts, { requestId });
+				rejectedRequestIds.push(requestId);
+			}
+		}
+		if (opts.json) {
+			defaultRuntime.writeJson({
+				removedDevices: removedDeviceIds,
+				rejectedPending: rejectedRequestIds
+			});
+			return;
+		}
+		defaultRuntime.log(`${theme.warn("Cleared")} ${removedDeviceIds.length} paired device${removedDeviceIds.length === 1 ? "" : "s"}`);
+		if (opts.pending) defaultRuntime.log(`${theme.warn("Rejected")} ${rejectedRequestIds.length} pending request${rejectedRequestIds.length === 1 ? "" : "s"}`);
+	}));
+	devicesCallOpts(devices.command("approve").description("Approve a pending device pairing request").argument("[requestId]", "Pending request id").option("--latest", "Show the most recent pending request to approve explicitly", false).action(async (requestId, opts) => {
+		let pairingList = null;
+		let resolvedRequestId = requestId?.trim();
+		const usingImplicitSelection = !resolvedRequestId || Boolean(opts.latest);
+		let selectedRequest = null;
+		if (usingImplicitSelection) {
+			pairingList = await listPairingWithFallback(opts);
+			selectedRequest = selectLatestPendingRequest(pairingList.pending);
+			resolvedRequestId = selectedRequest?.requestId?.trim();
+		}
+		if (!resolvedRequestId) {
+			defaultRuntime.error("No pending device pairing requests to approve");
+			defaultRuntime.exit(1);
+			return;
+		}
+		if (usingImplicitSelection) {
+			const req = selectedRequest;
+			const approval = resolvePendingDeviceApprovalState(req, lookupPairedDevice(indexPairedDevices(pairingList?.paired), req));
+			const approveCommand = buildExplicitApproveCommand(opts, req.requestId);
+			const authReminder = formatAuthFlagReminder(opts);
+			if (opts.json) {
+				defaultRuntime.writeJson({
+					selected: req,
+					approvalState: {
+						kind: approval.kind,
+						requested: approval.requested,
+						approved: approval.approved
+					},
+					approveCommand,
+					requiresAuthFlags: {
+						token: Boolean(normalizeOptionalString(opts.token)),
+						password: Boolean(normalizeOptionalString(opts.password))
+					}
+				});
+				defaultRuntime.exit(1);
+				return;
+			}
+			defaultRuntime.log(`${theme.warn("Selected pending device request")} ${theme.command(req.requestId)}`);
+			defaultRuntime.log(`  Device: ${formatPendingDeviceIdentity(req)}`);
+			defaultRuntime.log(`  Requested: ${formatAccessSummary(approval.requested)}`);
+			if (approval.approved) defaultRuntime.log(`  Approved: ${formatAccessSummary(approval.approved)}`);
+			if (req.remoteIp) defaultRuntime.log(`  IP:     ${sanitizeForLog(req.remoteIp)}`);
+			switch (approval.kind) {
+				case "scope-upgrade":
+					defaultRuntime.log("  Note:   Already paired. Requested scopes exceed the current approval, so reconnect stays blocked until you approve this upgrade.");
+					break;
+				case "role-upgrade":
+					defaultRuntime.log("  Note:   Already paired. Requested role exceeds the current approval, so reconnect stays blocked until you approve this upgrade.");
+					break;
+				case "re-approval":
+					defaultRuntime.log("  Note:   Already paired. Approval-bound device details changed, so Genesis created a fresh request instead of silently reusing the old approval.");
+					break;
+				case "new-pairing":
+					defaultRuntime.log("  Note:   First-time device pairing request.");
+					break;
+			}
+			defaultRuntime.error(`Approve this exact request with: ${approveCommand}`);
+			if (authReminder) defaultRuntime.error(authReminder);
+			defaultRuntime.exit(1);
+			return;
+		}
+		const result = await approvePairingWithFallback(opts, resolvedRequestId);
+		if (!result) {
+			defaultRuntime.error("unknown requestId");
+			defaultRuntime.exit(1);
+			return;
+		}
+		if (opts.json) {
+			defaultRuntime.writeJson(result);
+			return;
+		}
+		const deviceId = result?.device?.deviceId;
+		defaultRuntime.log(`${theme.success("Approved")} ${theme.command(deviceId ?? "ok")} ${theme.muted(`(${resolvedRequestId})`)}`);
+	}));
+	devicesCallOpts(devices.command("reject").description("Reject a pending device pairing request").argument("<requestId>", "Pending request id").action(async (requestId, opts) => {
+		const result = await callGatewayCli("device.pair.reject", opts, { requestId });
+		if (opts.json) {
+			defaultRuntime.writeJson(result);
+			return;
+		}
+		const deviceId = result?.deviceId;
+		defaultRuntime.log(`${theme.warn("Rejected")} ${theme.command(deviceId ?? "ok")}`);
+	}));
+	devicesCallOpts(devices.command("rotate").description("Rotate a device token for a role").requiredOption("--device <id>", "Device id").requiredOption("--role <role>", "Role name").option("--scope <scope...>", "Scopes to attach to the token (repeatable)").action(async (opts) => {
+		const required = resolveRequiredDeviceRole(opts);
+		if (!required) return;
+		const result = await callGatewayCli("device.token.rotate", opts, {
+			deviceId: required.deviceId,
+			role: required.role,
+			scopes: Array.isArray(opts.scope) ? opts.scope : void 0
+		});
+		defaultRuntime.writeJson(result);
+	}));
+	devicesCallOpts(devices.command("revoke").description("Revoke a device token for a role").requiredOption("--device <id>", "Device id").requiredOption("--role <role>", "Role name").action(async (opts) => {
+		const required = resolveRequiredDeviceRole(opts);
+		if (!required) return;
+		const result = await callGatewayCli("device.token.revoke", opts, {
+			deviceId: required.deviceId,
+			role: required.role
+		});
+		defaultRuntime.writeJson(result);
+	}));
+}
+//#endregion
+export { registerDevicesCli };