@runcofactor/cli 0.10.0

package/dist/sandbox-XGSUU6G7.js

@@ -0,0 +1,2046 @@
+import { createRequire as __cr } from "module"; const require = __cr(import.meta.url);
+import {
+  SANDBOX_GUIDE_SECTIONS,
+  printGuide
+} from "./chunk-4NRDONSC.js";
+import {
+  apiRequest,
+  selectProperty
+} from "./chunk-WOHL4FTB.js";
+import {
+  INSTANCE_SIZES,
+  INSTANCE_SIZE_SPEC,
+  parseInstanceSize
+} from "./chunk-SJJW77WN.js";
+import {
+  apiFetch,
+  exitOnFailure,
+  isTerminalFailure
+} from "./chunk-3CZU7XCS.js";
+import {
+  getArgValue,
+  hasFlag,
+  resolveConfig
+} from "./chunk-A4OFTUVV.js";
+import "./chunk-JWHYXEA2.js";
+import "./chunk-VKVL7WBN.js";
+
+// src/sandbox.ts
+import process from "process";
+import { readFileSync } from "fs";
+async function fetchInstanceRoutes(apiUrl, token, instanceId) {
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "GET",
+    `/org/environments/instances/${instanceId}/routes`,
+    void 0,
+    { timeoutMs: 3e4 }
+  );
+  return res.ok ? res.data.routes : [];
+}
+var STATUS_ICONS = {
+  completed: "[done]",
+  running: "[....]",
+  pending: "[    ]",
+  failed: "[FAIL]",
+  skipped: "[skip]"
+};
+function formatDate(iso) {
+  return new Date(iso).toLocaleString();
+}
+function pad(s, n) {
+  return s.padEnd(n);
+}
+var INSTANCE_SIZE_HELP_LINES = INSTANCE_SIZES.map((size) => {
+  const spec = INSTANCE_SIZE_SPEC[size];
+  return `  ${pad(size, 8)} ${spec.ec2InstanceType} \xB7 ${spec.vcpu} vCPU \xB7 ${spec.memoryMiB / 1024} GiB`;
+});
+function printHelp() {
+  console.log(
+    [
+      "canary sandbox: Manage sandbox templates and instances",
+      "",
+      "Sub-commands:",
+      "  guide [section]                          Show sandbox authoring guide",
+      "  list                                    List templates and instances",
+      "  template [id]                           Show template details",
+      "  repo list --template <id>               List repos linked to a template",
+      "  repo add --template <id> --property-github-repo-id <uuid> [--role <r>] [--spec <r=owner/name@branch:subdir>]",
+      "  repo update --template <id> --link-id <uuid> [--role <r>] [--branch <b>] [--subdirectory <s>] [--service-name <n>]",
+      "  repo remove --template <id> --link-id <uuid>",
+      "  checklist <template-id>                 Show checklist state",
+      "  checklist skip <template-id> <item-id>  Skip a checklist item",
+      "  checklist complete <template-id> <item-id> [options]  Mark item complete from CLI",
+      "  artifacts <template-id>                 List artifacts",
+      "  artifact get <template-id> <type>       Get artifact content",
+      "  artifact create <template-id> <type> <file>  Upload artifact (use --path for file type)",
+      "  create [property] [options]              Create template from property (triggers provisioning)",
+      "  provision <template-id> [options]       Create instance from verified template",
+      "  verify <template-id>                    Verify an authoring template (provision + probe + flip to verified)",
+      '  set-size <template-id> <size>           Set EC2 size for next provision (see "Instance sizes" below)',
+      "  ami list <template-id>                  List per-template AMI history",
+      "  ami rebake <template-id> [opts]         Trigger a fresh AMI bake (--force, --wait)",
+      "  ami use <template-id> <ami-row-id>      Switch the template to a specific AMI (rollback)",
+      "  build <instance-id>                     Build and start app services on sandbox",
+      "  run-command <instance-id> <command...>  Execute shell command on sandbox",
+      "    --service <name>  Run inside a Docker container instead of on the host VM",
+      "  diagnostics <instance-id>               Show sandbox diagnostics",
+      "  logs <instance-id> [options]            Show container logs",
+      "  terminate <instance-id>                 Terminate an instance",
+      "  config list <template-id>               Show config schema and defaults",
+      "  config set <template-id> <key> <value>  Set a config default value",
+      "  delete <template-id>                    Delete template and all instances",
+      "",
+      "Create options:",
+      "  --property <name|id>  Property (prompted if omitted, auto-selected if only one)",
+      "  --branch <branch>     Branch (default: from linked repo)",
+      "  --name <name>         Template name (default: repo name)",
+      "  --subdirectory <path> Subdirectory (default: from linked repo rootDir)",
+      '  --size <size>         EC2 size for first authoring sandbox (default: medium; see "Instance sizes" below)',
+      "",
+      "Provision options:",
+      "  --name <name>         Instance name",
+      "  --ttl <hours>         Time to live in hours (default: 8)",
+      "  --with-agent          Start with sandbox agent",
+      "",
+      "Artifact get options:",
+      "  --output <file>       Write to file instead of stdout",
+      "",
+      "Logs options:",
+      "  --service <name>      Service name (default: all services)",
+      "  --tail <n>            Number of lines (default: 200)",
+      "",
+      "Guide sections:",
+      "  goal, research, artifacts, actions, verify, checklist",
+      "",
+      "Instance sizes:",
+      ...INSTANCE_SIZE_HELP_LINES,
+      "",
+      "Action sub-commands:",
+      "  action list <template-id>                    List actions for a template",
+      "  action get <template-id> <slug>              Show action definition + script",
+      "  action create <template-id> <slug> [opts]    Create or update an action",
+      "  action delete <template-id> <slug>           Delete an action",
+      "  action execute <instance-id> <slug> [opts]   Execute action on a running instance",
+      "  action executions <instance-id> [opts]       List execution history",
+      "",
+      "Action create options:",
+      "  --label <label>         Display name (default: slug \u2192 Title Case)",
+      "  --description <text>    Description",
+      "  --icon <icon>           Phosphor icon name",
+      "  --script <file>         Path to script file (bash)",
+      "  --input-schema <file>   Path to JSON Schema file for input params",
+      "  --output-schema <file>  Path to JSON Schema file for output",
+      "  --credential-output-config <file>  JSON file with ActionCredentialOutputConfig (auto-creates a Canary credential from the action result)",
+      "  --credential-template <id>  Credential template this action provisions; login nodes using it auto-provision",
+      "  --provisioning-mode <shared|unique>  shared = provision once / reused (default); unique = one credential per run (script must accept a runId input param)",
+      "  --timeout <ms>          Timeout in ms (default: 55000)",
+      "  --encrypt-script        Encrypt script content at rest",
+      "",
+      "Action execute options:",
+      "  --param <key>=<value>   Set parameter (repeatable)",
+      "  --params-file <file>    JSON file with all params",
+      "",
+      "Global options:",
+      "  --json                Output raw JSON",
+      "  --env <env>           Environment (prod, dev, local)",
+      "  -h, --help            Show help"
+    ].join("\n")
+  );
+}
+async function handleList(argv, apiUrl, token) {
+  const json = hasFlag(argv, "--json");
+  const [templatesRes, instancesRes] = await Promise.all([
+    apiRequest(
+      apiUrl,
+      token,
+      "GET",
+      "/org/environments/templates"
+    ),
+    apiRequest(
+      apiUrl,
+      token,
+      "GET",
+      "/org/environments/instances"
+    )
+  ]);
+  if (!templatesRes.ok) {
+    console.error(`Error: ${templatesRes.error}`);
+    process.exit(1);
+  }
+  if (!instancesRes.ok) {
+    console.error(`Error loading instances: ${instancesRes.error}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify({ templates: templatesRes.data, instances: instancesRes.data }, null, 2));
+    return;
+  }
+  const templates = templatesRes.data ?? [];
+  const instances = instancesRes.data ?? [];
+  console.log("Templates:");
+  if (templates.length === 0) {
+    console.log("  (none)");
+  } else {
+    console.log(`  ${pad("ID", 38)} ${pad("Name", 24)} ${pad("Status", 14)} ${pad("Profile", 12)} Repository`);
+    for (const t of templates) {
+      console.log(`  ${pad(t.id, 38)} ${pad(t.name, 24)} ${pad(t.status, 14)} ${pad(t.checklistProfile ?? "-", 12)} ${t.repositoryFullName}:${t.branch}`);
+    }
+  }
+  console.log("");
+  console.log("Instances:");
+  if (instances.length === 0) {
+    console.log("  (none)");
+  } else {
+    console.log(`  ${pad("ID", 38)} ${pad("Status", 14)} ${pad("Access", 10)} ${pad("Template", 38)} Expires`);
+    for (const i of instances) {
+      const access = i.isPrivate ? "private" : "public";
+      console.log(`  ${pad(i.id, 38)} ${pad(i.status, 14)} ${pad(access, 10)} ${pad(i.templateId, 38)} ${i.expiresAt ? formatDate(i.expiresAt) : "-"}`);
+    }
+  }
+}
+async function handleTemplate(argv, apiUrl, token) {
+  const [id] = argv.filter((a) => !a.startsWith("-"));
+  const json = hasFlag(argv, "--json");
+  if (!id) {
+    await handleList(argv, apiUrl, token);
+    return;
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "GET",
+    `/org/environments/templates/${id}`
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(res.data, null, 2));
+    return;
+  }
+  const t = res.data;
+  console.log(`Template: ${t.name}`);
+  console.log(`  ID:         ${t.id}`);
+  console.log(`  Repository: ${t.repositoryFullName}:${t.branch}`);
+  if (t.subdirectory) console.log(`  Subdir:     ${t.subdirectory}`);
+  console.log(`  Status:     ${t.status}`);
+  console.log(`  Profile:    ${t.checklistProfile ?? "full-stack (default)"}`);
+  console.log(`  Created:    ${formatDate(t.createdAt)}`);
+  console.log(`  Updated:    ${formatDate(t.updatedAt)}`);
+  if (t.configSchema && t.configSchema.length > 0) {
+    console.log("");
+    console.log("  Config Schema:");
+    for (const c of t.configSchema) {
+      const flags = [c.required ? "required" : "optional", c.sensitive ? "sensitive" : ""].filter(Boolean).join(", ");
+      console.log(`    ${c.key} (${flags})${c.description ? ` \u2014 ${c.description}` : ""}`);
+    }
+  }
+}
+async function handleArtifacts(argv, apiUrl, token) {
+  const [templateId] = argv.filter((a) => !a.startsWith("-"));
+  const json = hasFlag(argv, "--json");
+  if (!templateId) {
+    console.error("Error: template ID required. Usage: canary sandbox artifacts <template-id>");
+    process.exit(1);
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "GET",
+    `/org/environments/templates/${templateId}/artifacts`
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(res.data, null, 2));
+    return;
+  }
+  const artifacts = res.data ?? [];
+  if (artifacts.length === 0) {
+    console.log("No artifacts found.");
+    return;
+  }
+  console.log(`${pad("Type", 22)} ${pad("Filename", 30)} ${pad("Task", 24)} Created`);
+  for (const a of artifacts) {
+    console.log(`${pad(a.artifactType, 22)} ${pad(a.filename, 30)} ${pad(a.taskId, 24)} ${formatDate(a.createdAt)}`);
+  }
+}
+async function handleChecklist(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const json = hasFlag(argv, "--json");
+  if (positional[0] === "skip") {
+    await handleChecklistSkip(argv.slice(1), apiUrl, token);
+    return;
+  }
+  if (positional[0] === "complete") {
+    await handleChecklistComplete(argv.slice(1), apiUrl, token);
+    return;
+  }
+  const templateId = positional[0];
+  if (!templateId) {
+    console.error("Error: template ID required. Usage: canary sandbox checklist <template-id>");
+    process.exit(1);
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "GET",
+    `/org/environments/templates/${templateId}/checklist`
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(res.data, null, 2));
+    return;
+  }
+  const items = res.data ?? [];
+  if (items.length === 0) {
+    console.log("No checklist items.");
+    return;
+  }
+  console.log("Checklist:");
+  for (const item of items) {
+    const icon = STATUS_ICONS[item.itemStatus.status] ?? "[????]";
+    const actionable = item.actionable ? " *" : "";
+    console.log(`  ${icon} ${item.label}${actionable}`);
+    if (item.itemStatus.summary) {
+      console.log(`         ${item.itemStatus.summary}`);
+    }
+    if (item.itemStatus.error) {
+      console.log(`         ERROR: ${item.itemStatus.error}`);
+    }
+    if (item.artifacts.length > 0) {
+      console.log(`         Artifacts: ${item.artifacts.map((a) => a.artifactType).join(", ")}`);
+    }
+  }
+  console.log("");
+  console.log("  * = actionable (deps met, ready to run)");
+}
+async function handleChecklistSkip(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const templateId = positional[0];
+  const itemId = positional[1];
+  if (!templateId || !itemId) {
+    console.error("Error: both template ID and item ID required. Usage: canary sandbox checklist skip <template-id> <item-id>");
+    process.exit(1);
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "POST",
+    `/org/environments/templates/${templateId}/checklist/${itemId}/skip`
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  console.log(`Skipped checklist item: ${itemId}`);
+}
+async function handleChecklistComplete(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const templateId = positional[0];
+  const itemId = positional[1];
+  const json = hasFlag(argv, "--json");
+  if (!templateId || !itemId) {
+    console.error("Error: both template ID and item ID required.");
+    console.error('Usage: canary sandbox checklist complete <template-id> <item-id> [--status success|failed] [--summary "..."]');
+    process.exit(1);
+  }
+  const status = getArgValue(argv, "--status") ?? "success";
+  const summary = getArgValue(argv, "--summary");
+  const configSchemaArg = getArgValue(argv, "--config-schema");
+  const healthCheckPath = getArgValue(argv, "--health-check-path");
+  let configSchema;
+  if (configSchemaArg) {
+    try {
+      configSchema = JSON.parse(configSchemaArg);
+    } catch {
+      try {
+        configSchema = JSON.parse(readFileSync(configSchemaArg, "utf-8"));
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        console.error(`Error reading config schema from "${configSchemaArg}": ${msg}`);
+        process.exit(1);
+      }
+    }
+  }
+  const body = {
+    status: status === "failed" ? "failed" : "completed",
+    ...summary ? { summary } : {},
+    ...configSchema ? { configSchema } : {},
+    ...healthCheckPath ? { healthCheckPath } : {}
+  };
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "POST",
+    `/org/environments/templates/${templateId}/checklist/${itemId}/complete`,
+    body
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(res.data, null, 2));
+    return;
+  }
+  console.log(`Completed checklist item: ${itemId} (${res.data?.status})`);
+}
+async function handleConfigList(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const templateId = positional[0];
+  const json = hasFlag(argv, "--json");
+  if (!templateId) {
+    console.error("Error: template ID required. Usage: canary sandbox config list <template-id>");
+    process.exit(1);
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "GET",
+    `/org/environments/templates/${templateId}`
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  const t = res.data;
+  const schema = t.configSchema ?? [];
+  const defaults = t.configDefaults ?? {};
+  if (json) {
+    console.log(JSON.stringify({ configSchema: schema, configDefaults: defaults }, null, 2));
+    return;
+  }
+  if (schema.length === 0) {
+    console.log("No config schema defined for this template.");
+    return;
+  }
+  console.log("Config Schema:");
+  for (const item of schema) {
+    const value = defaults[item.key];
+    const display = item.sensitive && value ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : value ?? "(not set)";
+    const required = item.required ? " (required)" : "";
+    const sensitive = item.sensitive ? " [sensitive]" : "";
+    console.log(`  ${item.key}${required}${sensitive}`);
+    if (item.description) console.log(`    ${item.description}`);
+    console.log(`    Value: ${display}`);
+  }
+}
+async function handleConfigSet(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const fromStdin = hasFlag(argv, "--value-stdin");
+  const templateId = positional[0];
+  const key = positional[1];
+  let value = positional[2];
+  if (!templateId || !key) {
+    console.error("Error: template ID and key required.");
+    console.error("Usage: canary sandbox config set <template-id> <key> <value>");
+    console.error('  For sensitive values: echo "sk-ant-..." | canary sandbox config set <template-id> <key> --value-stdin');
+    process.exit(1);
+  }
+  if (fromStdin) {
+    const chunks = [];
+    for await (const chunk of process.stdin) chunks.push(chunk);
+    value = Buffer.concat(chunks).toString("utf-8").trim();
+  }
+  if (value === void 0) {
+    console.error("Error: value required. Pass as argument or use --value-stdin");
+    process.exit(1);
+  }
+  const getRes = await apiRequest(
+    apiUrl,
+    token,
+    "GET",
+    `/org/environments/templates/${templateId}`
+  );
+  if (!getRes.ok) {
+    console.error(`Error: ${getRes.error}`);
+    process.exit(1);
+  }
+  const currentDefaults = getRes.data?.configDefaults ?? {};
+  const updatedDefaults = { ...currentDefaults, [key]: value };
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "PATCH",
+    `/org/environments/templates/${templateId}/config`,
+    {
+      configDefaults: updatedDefaults
+    },
+    { timeoutMs: 9e4 }
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  console.log(`Config set: ${key}`);
+}
+async function handleSetSize(argv, apiUrl, token) {
+  const [templateId, sizeArg] = argv.filter((a) => !a.startsWith("-"));
+  if (!templateId || !sizeArg) {
+    console.error("Error: template ID and size required.");
+    console.error(`Usage: canary sandbox set-size <template-id> <${INSTANCE_SIZES.join("|")}>`);
+    process.exit(1);
+  }
+  const size = parseInstanceSize(sizeArg);
+  if (!size) {
+    console.error(`Error: invalid size '${sizeArg}'. Must be one of: ${INSTANCE_SIZES.join(", ")}`);
+    process.exit(1);
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "PATCH",
+    `/org/environments/templates/${templateId}/instance-size`,
+    { instanceSize: size }
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  console.log(`Instance size set to ${size}`);
+}
+async function handleCreate(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const json = hasFlag(argv, "--json");
+  const propertyHint = positional[0] ?? getArgValue(argv, "--property");
+  const property = await selectProperty(apiUrl, token, propertyHint ?? void 0);
+  if (!property) process.exit(1);
+  const reposRes = await apiRequest(
+    apiUrl,
+    token,
+    "GET",
+    `/org/properties/${property.id}/github-repos`
+  );
+  if (!reposRes.ok || !reposRes.items?.length) {
+    console.error(`No GitHub repos linked to property "${property.name}". Link one first in the web app.`);
+    process.exit(1);
+  }
+  const linkedRepo = reposRes.items[0];
+  const branch = getArgValue(argv, "--branch") ?? linkedRepo.defaultBranch ?? "main";
+  const name = getArgValue(argv, "--name") ?? linkedRepo.repoName ?? linkedRepo.repoFullName.split("/").pop() ?? property.name;
+  const subdirectory = getArgValue(argv, "--subdirectory") ?? linkedRepo.rootDir ?? void 0;
+  const sizeArg = getArgValue(argv, "--size");
+  const instanceSize = sizeArg ? parseInstanceSize(sizeArg) : void 0;
+  if (sizeArg && !instanceSize) {
+    console.error(`Error: invalid --size '${sizeArg}'. Must be one of: ${INSTANCE_SIZES.join(", ")}`);
+    process.exit(1);
+  }
+  const body = {
+    name,
+    propertyId: property.id,
+    repositoryFullName: linkedRepo.repoFullName,
+    branch
+  };
+  if (subdirectory) body.subdirectory = subdirectory;
+  if (linkedRepo.agentHint) body.hints = linkedRepo.agentHint;
+  if (instanceSize) body.instanceSize = instanceSize;
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "POST",
+    "/org/environments/templates",
+    body
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(res.data, null, 2));
+    return;
+  }
+  console.log(`Template created: ${res.data.id}`);
+  console.log(`  Property: ${property.name}`);
+  console.log(`  Repository: ${res.data.repositoryFullName}:${res.data.branch}`);
+  console.log(`  Status: ${res.data.status}`);
+  console.log("");
+  console.log("Authoring job enqueued. Poll status with:");
+  console.log(`  canary sandbox template ${res.data.id}`);
+}
+async function handleProvision(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const templateId = positional[0];
+  const json = hasFlag(argv, "--json");
+  if (!templateId) {
+    console.error("Error: template ID required. Usage: canary sandbox provision <template-id> [--ttl 8]");
+    process.exit(1);
+  }
+  const name = getArgValue(argv, "--name") ?? `instance-${Date.now()}`;
+  const ttl = parseInt(getArgValue(argv, "--ttl") ?? "8", 10);
+  const withAgent = hasFlag(argv, "--with-agent");
+  const isPrivate = hasFlag(argv, "--private");
+  const body = {
+    templateId,
+    name,
+    expiresInHours: ttl,
+    userConfig: {},
+    withAgent,
+    isPrivate
+  };
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "POST",
+    "/org/environments/instances",
+    body
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(res.data, null, 2));
+    return;
+  }
+  console.log(`Instance created: ${res.data.id}`);
+  console.log(`  Status: ${res.data.status}`);
+  if (isPrivate) console.log(`  Access: private (no public URL)`);
+  console.log(`  Expires: ${res.data.expiresAt ? formatDate(res.data.expiresAt) : "-"}`);
+}
+function parseDockerPs(stdout) {
+  const lines = stdout.split("\n").map((l) => l.trim()).filter(Boolean);
+  return lines.map((line) => {
+    const [name = "", status = ""] = line.split("	");
+    const lower = status.toLowerCase();
+    let state = "other";
+    if (lower.startsWith("restarting")) state = "restarting";
+    else if (lower.startsWith("exited")) state = "exited";
+    else if (lower.startsWith("up") && lower.includes("unhealthy")) state = "up-unhealthy";
+    else if (lower.startsWith("up") && lower.includes("healthy")) state = "up-healthy";
+    else if (lower.startsWith("up")) state = "up";
+    return { name, status, state };
+  });
+}
+function isBrokenContainer(c) {
+  return c.state === "restarting" || c.state === "exited" || c.state === "up-unhealthy";
+}
+function containerNameToService(containerName) {
+  const withProject = containerName.match(/^workspace-(.+)-\d+$/);
+  if (withProject) return withProject[1];
+  const withoutProject = containerName.match(/^(.+)-\d+$/);
+  if (withoutProject) return withoutProject[1];
+  return containerName;
+}
+async function fetchServiceLogs(apiUrl, token, instanceId, service, tail) {
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "POST",
+    `/org/environments/instances/${instanceId}/docker/logs`,
+    { service, tail }
+  );
+  if (!res.ok) return `(log fetch failed: ${res.error ?? "unknown"})`;
+  return res.data?.logs ?? "";
+}
+async function handleVerify(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const templateId = positional[0];
+  const json = hasFlag(argv, "--json");
+  const keepInstance = hasFlag(argv, "--keep-instance");
+  const autoTerminateOnFailure = hasFlag(argv, "--auto-terminate-on-failure");
+  if (!templateId) {
+    console.error("Error: template ID required. Usage: canary sandbox verify <template-id>");
+    process.exit(1);
+  }
+  console.log(`Verifying template ${templateId}...`);
+  const verifyRes = await apiRequest(
+    apiUrl,
+    token,
+    "POST",
+    `/org/environments/templates/${templateId}/verify`,
+    {}
+  );
+  if (!verifyRes.ok) {
+    console.error(`Error: ${verifyRes.error}`);
+    process.exit(1);
+  }
+  const instanceId = verifyRes.data.instanceId;
+  console.log(`  Verification instance: ${instanceId}`);
+  const POLL_INTERVAL_MS = 1e4;
+  const TIMEOUT_MS = 6e5;
+  const DETAIL_DUMP_INTERVAL_MS = 3e4;
+  const LOG_TAIL_LINES = 40;
+  const startTime = Date.now();
+  let finalStatus = "";
+  let publicUrl;
+  let lastDetailDumpAt = 0;
+  let routes = [];
+  let routesFetched = false;
+  while (Date.now() - startTime < TIMEOUT_MS) {
+    await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+    const diag = await apiRequest(
+      apiUrl,
+      token,
+      "GET",
+      `/org/environments/instances/${instanceId}/diagnostics`,
+      void 0,
+      { timeoutMs: 6e4 }
+    );
+    if (!diag.ok) continue;
+    const now = Date.now();
+    const elapsed = Math.round((now - startTime) / 1e3);
+    const remaining = Math.max(0, Math.round((TIMEOUT_MS - (now - startTime)) / 1e3));
+    const status = String(diag.data.instance.status ?? "");
+    publicUrl = diag.data.instance.publicUrl;
+    const appOutput = "stdout" in diag.data.appHealth ? diag.data.appHealth.stdout : "";
+    const appUp = appOutput.length > 0 && !appOutput.includes("UNREACHABLE");
+    const dockerOutput = "stdout" in diag.data.docker ? diag.data.docker.stdout : "";
+    const containers = parseDockerPs(dockerOutput);
+    const broken = containers.filter(isBrokenContainer);
+    const ttl = remaining > 60 ? `${elapsed}s elapsed` : `${remaining}s remaining`;
+    process.stdout.write(
+      `\r  [${ttl}] status: ${status}, app: ${appUp ? "up" : "waiting"}, containers: ${containers.length}, unhealthy: ${broken.length}        `
+    );
+    if (status === "running" && appUp) {
+      process.stdout.write("\n");
+      finalStatus = "running";
+      break;
+    }
+    if (status === "failed" || status === "terminated") {
+      process.stdout.write("\n");
+      finalStatus = status;
+      break;
+    }
+    const shouldDump = !appUp && broken.length > 0 && now - lastDetailDumpAt >= DETAIL_DUMP_INTERVAL_MS;
+    if (shouldDump) {
+      lastDetailDumpAt = now;
+      process.stdout.write("\n");
+      console.log("");
+      console.log(`  App unreachable after ${elapsed}s. Container state:`);
+      for (const c of containers) {
+        console.log(`    ${c.name.padEnd(40)}  ${c.status}`);
+      }
+      console.log("");
+      const MAX_LOG_CONTAINERS = 3;
+      const toFetch = broken.slice(0, MAX_LOG_CONTAINERS);
+      const overflow = broken.length - toFetch.length;
+      const fetched = await Promise.all(
+        toFetch.map(
+          (c) => fetchServiceLogs(apiUrl, token, instanceId, containerNameToService(c.name), LOG_TAIL_LINES).then((logs) => ({ c, logs }))
+        )
+      );
+      for (const { c, logs } of fetched) {
+        const tail = logs.trim().split("\n").slice(-LOG_TAIL_LINES).join("\n    ");
+        console.log(`  --- ${c.name} (${c.state}) ---`);
+        console.log(`    ${tail || "(no logs)"}`);
+        console.log("");
+      }
+      if (overflow > 0) {
+        console.log(
+          `  (+${overflow} more broken container${overflow === 1 ? "" : "s"} \u2014 re-run with: canary sandbox logs ${instanceId} --service <name>)`
+        );
+        console.log("");
+      }
+      if (!routesFetched) {
+        routes = await fetchInstanceRoutes(apiUrl, token, instanceId);
+        routesFetched = true;
+      }
+      const nginxProxy = containers.find((c) => containerNameToService(c.name) === "nginx-proxy");
+      if (nginxProxy?.state === "restarting" && routes.length > 0) {
+        const failedUpstreams = routes.map((r) => ({
+          route: r.route,
+          service: r.service,
+          container: broken.find((c) => containerNameToService(c.name) === r.service)
+        })).filter((x) => x.container);
+        if (failedUpstreams.length > 0) {
+          for (const fu of failedUpstreams) {
+            console.log(
+              `  >> nginx-proxy is restart-looping because upstream '${fu.service}' (route '${fu.route}') is ${fu.container.state}. Read that service's logs above, not nginx's.`
+            );
+          }
+          console.log("");
+        }
+      }
+    }
+  }
+  if (finalStatus !== "running") {
+    console.error("");
+    console.error(`Verification failed \u2014 instance ended in status '${finalStatus || "timeout"}'.`);
+    if (publicUrl) console.error(`  Instance URL: ${publicUrl}`);
+    console.error(`  Instance ID:  ${instanceId}`);
+    console.error(`  Debug with:   canary sandbox diagnostics ${instanceId}`);
+    console.error(`                canary sandbox logs ${instanceId} --service <name>`);
+    console.error(`                canary sandbox run-command ${instanceId} 'docker ps -a'`);
+    if (autoTerminateOnFailure) {
+      await apiRequest(apiUrl, token, "POST", `/org/environments/instances/${instanceId}/terminate`);
+      console.error(`  Terminated (--auto-terminate-on-failure).`);
+    } else {
+      console.error(`  Instance preserved by default for debugging. Pass --auto-terminate-on-failure in CI.`);
+      console.error(`  Terminate manually with:`);
+      console.error(`                canary sandbox terminate ${instanceId}`);
+    }
+    process.exit(1);
+  }
+  const evidenceSummary = `Verified via canary sandbox verify \u2014 fresh instance ${instanceId} came up healthy.`;
+  for (const itemId of ["server-running", "server-accessible"]) {
+    await apiRequest(
+      apiUrl,
+      token,
+      "POST",
+      `/org/environments/templates/${templateId}/checklist/${itemId}/complete`,
+      { status: "completed", summary: evidenceSummary }
+    ).catch(() => {
+    });
+  }
+  const completeRes = await apiRequest(
+    apiUrl,
+    token,
+    "POST",
+    `/org/environments/templates/${templateId}/checklist/template-verified/complete`,
+    {
+      status: "completed",
+      summary: evidenceSummary
+    }
+  );
+  if (!completeRes.ok) {
+    console.error(`Failed to record verification: ${completeRes.error}`);
+    console.error(`Instance ${instanceId} left running for inspection.`);
+    process.exit(1);
+  }
+  if (!keepInstance) {
+    await apiRequest(apiUrl, token, "POST", `/org/environments/instances/${instanceId}/terminate`);
+    console.log(`  Terminated verification instance.`);
+  } else {
+    console.log(`  --keep-instance: instance ${instanceId} left running${publicUrl ? ` at ${publicUrl}` : ""}.`);
+  }
+  const templateAfter = await apiRequest(
+    apiUrl,
+    token,
+    "GET",
+    `/org/environments/templates/${templateId}`
+  ).catch(() => ({ ok: false }));
+  const templateStatus = templateAfter.data?.status;
+  const verified = templateStatus === "verified";
+  if (json) {
+    console.log(JSON.stringify({ templateId, verified, status: templateStatus, instanceId, publicUrl }, null, 2));
+    return;
+  }
+  if (verified) {
+    console.log("Template verified.");
+    return;
+  }
+  console.log(`Verification probe passed (instance ${instanceId} came up healthy),`);
+  console.log(`but template status is still '${templateStatus ?? "unknown"}'.`);
+  const checklistRes = await apiRequest(
+    apiUrl,
+    token,
+    "GET",
+    `/org/environments/templates/${templateId}/checklist`
+  ).catch(() => ({ ok: false }));
+  const pending = (checklistRes.data ?? []).filter((it) => {
+    const s = it.itemStatus?.status ?? "pending";
+    return s !== "completed" && s !== "skipped";
+  });
+  if (pending.length > 0) {
+    console.log("Pending checklist items must be completed or skipped:");
+    for (const item of pending) {
+      console.log(`  - ${item.label} (${item.id})`);
+    }
+    console.log("");
+    console.log('Complete:  canary sandbox checklist complete <template-id> <item-id> --status success --summary "..."');
+    console.log("Skip:      canary sandbox checklist skip     <template-id> <item-id>");
+  }
+  process.exit(1);
+}
+async function handleArtifactGet(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const templateId = positional[0];
+  const type = positional[1];
+  const outputFile = getArgValue(argv, "--output");
+  if (!templateId || !type) {
+    console.error("Error: template ID and artifact type required. Usage: canary sandbox artifact get <template-id> <type>");
+    process.exit(1);
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "GET",
+    `/org/environments/templates/${templateId}/artifacts/${type}`
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  if (outputFile) {
+    const { writeFileSync } = await import("fs");
+    writeFileSync(outputFile, res.data.content ?? "", "utf-8");
+    console.log(`Written to ${outputFile}`);
+  } else {
+    process.stdout.write(res.data.content ?? "");
+  }
+}
+async function handleArtifactCreate(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const templateId = positional[0];
+  const type = positional[1];
+  const filePath = positional[2];
+  const json = hasFlag(argv, "--json");
+  if (!templateId || !type || !filePath) {
+    console.error("Error: all args required. Usage: canary sandbox artifact create <template-id> <type> <file>");
+    process.exit(1);
+  }
+  const WELL_KNOWN_TYPES = ["docker-compose", "dockerfile", "startup-script", "setup-script", "seed-script", "environment-config", "file"];
+  if (!WELL_KNOWN_TYPES.includes(type)) {
+    console.error(`Error: invalid artifact type "${type}". Valid types: ${WELL_KNOWN_TYPES.join(", ")}`);
+    process.exit(1);
+  }
+  const destinationPath = getArgValue(argv, "--path");
+  if (type === "file" && !destinationPath) {
+    console.error("Error: file artifacts require --path <destination>. Example: --path /workspace/.canary/vite.sandbox.config.ts");
+    process.exit(1);
+  }
+  if (destinationPath && !destinationPath.startsWith("/workspace/.canary/")) {
+    const suggestedName = destinationPath.split("/").filter(Boolean).pop() ?? "yourfile";
+    console.error(
+      `Error: --path must be under /workspace/.canary/ (the repo tree is user-owned \u2014 sandbox files live in .canary/).
+       try: --path /workspace/.canary/${suggestedName}`
+    );
+    process.exit(1);
+  }
+  let content;
+  try {
+    content = readFileSync(filePath, "utf-8");
+  } catch (err) {
+    console.error(`Error reading file: ${err}`);
+    process.exit(1);
+  }
+  const filename = filePath.split("/").pop() ?? filePath;
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "PUT",
+    `/org/environments/templates/${templateId}/artifacts`,
+    {
+      artifactType: type,
+      filename,
+      content,
+      ...destinationPath ? { destinationPath } : {}
+    },
+    { timeoutMs: 9e4 }
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(res.data, null, 2));
+    return;
+  }
+  const kind = res.data?.kind;
+  const marker = kind === "replaced" ? " (replaced)" : kind === "created" ? " (created)" : "";
+  console.log(`Artifact uploaded: ${type} (${filename}, ${content.length} bytes)${marker}`);
+  if (kind === "replaced" && res.data?.previousPath) {
+    console.log(`  previous destination removed: ${res.data.previousPath}`);
+  }
+}
+async function handleBuild(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const json = hasFlag(argv, "--json");
+  const noWait = hasFlag(argv, "--no-wait");
+  const instanceId = positional[0];
+  if (!instanceId) {
+    console.error("Error: instance ID required. Usage: canary sandbox build <instance-id>");
+    process.exit(1);
+  }
+  console.log("Building sandbox (this takes a few minutes)...");
+  const KICKOFF_TIMEOUT_MS = 8e3;
+  let buildCompleted = false;
+  let buildResult = null;
+  const result = await apiFetch(`${apiUrl}/org/environments/instances/${instanceId}/build`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json"
+    },
+    token,
+    timeoutMs: KICKOFF_TIMEOUT_MS
+  });
+  if (result.ok) {
+    const data = await result.response.json().catch(() => null);
+    if (data?.ok && data.data) {
+      buildCompleted = true;
+      buildResult = data.data;
+    } else if (data && !data.ok) {
+      console.error(`Error: ${data.error ?? "build failed"}`);
+      process.exit(1);
+    }
+  } else {
+    const { failure } = result;
+    const isExpectedAsync = failure.kind === "network" || failure.kind === "http-error" && (failure.status === 502 || failure.status === 504);
+    if (!isExpectedAsync) {
+      if (isTerminalFailure(failure)) exitOnFailure(failure);
+      console.error(`Error: ${failure.message}`);
+      process.exit(1);
+    }
+  }
+  if (buildCompleted && buildResult) {
+    if (json) {
+      console.log(JSON.stringify(buildResult, null, 2));
+      return;
+    }
+    if (buildResult.stdout) {
+      process.stdout.write(buildResult.stdout);
+      if (!buildResult.stdout.endsWith("\n")) process.stdout.write("\n");
+    }
+    if (buildResult.stderr) {
+      process.stderr.write(`STDERR: ${buildResult.stderr}`);
+      if (!buildResult.stderr.endsWith("\n")) process.stderr.write("\n");
+    }
+    if (buildResult.exitCode === 0) {
+      console.log("Build complete.");
+    } else {
+      console.error(`Build failed with exit code ${buildResult.exitCode}`);
+      process.exit(1);
+    }
+    return;
+  }
+  if (noWait) {
+    console.log("Build started. Use diagnostics to monitor progress:");
+    console.log(`  canary sandbox diagnostics ${instanceId}`);
+    return;
+  }
+  console.log("Build started, watching for services...");
+  const BUILD_POLL_TIMEOUT_MS = 3e5;
+  const POLL_INTERVAL_MS = 1e4;
+  const startTime = Date.now();
+  while (Date.now() - startTime < BUILD_POLL_TIMEOUT_MS) {
+    await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+    const diag = await apiRequest(
+      apiUrl,
+      token,
+      "GET",
+      `/org/environments/instances/${instanceId}/diagnostics`,
+      void 0,
+      { timeoutMs: 6e4 }
+    );
+    if (!diag.ok) continue;
+    const elapsed = Math.round((Date.now() - startTime) / 1e3);
+    const dockerOutput = "stdout" in diag.data.docker ? diag.data.docker.stdout : "";
+    const appOutput = "stdout" in diag.data.appHealth ? diag.data.appHealth.stdout : "";
+    const appUp = appOutput.length > 0 && !appOutput.includes("UNREACHABLE");
+    const containerCount = (dockerOutput.match(/\n/g) || []).length + (dockerOutput ? 1 : 0);
+    const healthyCount = (dockerOutput.match(/\(healthy\)/g) || []).length;
+    process.stdout.write(`\r  [${elapsed}s] containers: ${containerCount}, healthy: ${healthyCount}, app: ${appUp ? "up" : "waiting"}  `);
+    if (appUp) {
+      process.stdout.write("\n");
+      console.log("Build complete.");
+      return;
+    }
+  }
+  process.stdout.write("\n");
+  console.error("Build timed out waiting for the app to respond. Check diagnostics and logs:");
+  console.error(`  canary sandbox diagnostics ${instanceId}`);
+  console.error(`  canary sandbox logs ${instanceId} --service <name>`);
+  process.exit(1);
+}
+async function handleRunCommand(argv, apiUrl, token) {
+  const json = hasFlag(argv, "--json");
+  const service = getArgValue(argv, "--service");
+  const timeoutFlag = getArgValue(argv, "--timeout");
+  const filtered = argv.filter((a, i, arr) => {
+    if (a === "--json") return false;
+    if (a === "--service" || a === "--timeout") return false;
+    if (i > 0 && (arr[i - 1] === "--service" || arr[i - 1] === "--timeout")) return false;
+    return true;
+  });
+  const firstNonFlag = filtered.findIndex((a) => !a.startsWith("-"));
+  const instanceId = firstNonFlag >= 0 ? filtered[firstNonFlag] : void 0;
+  const command = firstNonFlag >= 0 ? filtered.slice(firstNonFlag + 1).join(" ") : "";
+  if (!instanceId || !command) {
+    console.error("Error: instance ID and command required. Usage: canary sandbox run-command <instance-id> [--service <name>] [--timeout <ms>] <command...>");
+    process.exit(1);
+  }
+  const timeoutMs = timeoutFlag ? Math.max(parseInt(timeoutFlag, 10), 1e3) : 6e4;
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "POST",
+    `/org/environments/instances/${instanceId}/run-command`,
+    { command, ...service ? { service } : {} },
+    { timeoutMs }
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(res.data, null, 2));
+    return;
+  }
+  if (res.data.stdout) {
+    process.stdout.write(res.data.stdout);
+    if (!res.data.stdout.endsWith("\n")) process.stdout.write("\n");
+  }
+  if (res.data.stderr) {
+    process.stderr.write(`STDERR: ${res.data.stderr}`);
+    if (!res.data.stderr.endsWith("\n")) process.stderr.write("\n");
+  }
+  if (res.data.exitCode !== 0) {
+    console.log(`Exit code: ${res.data.exitCode}`);
+  }
+}
+async function handleDiagnostics(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const instanceId = positional[0];
+  const json = hasFlag(argv, "--json");
+  if (!instanceId) {
+    console.error("Error: instance ID required. Usage: canary sandbox diagnostics <instance-id>");
+    process.exit(1);
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "GET",
+    `/org/environments/instances/${instanceId}/diagnostics`,
+    void 0,
+    { timeoutMs: 6e4 }
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  const routes = await fetchInstanceRoutes(apiUrl, token, instanceId);
+  const data = { ...res.data, routes };
+  if (json) {
+    console.log(JSON.stringify(data, null, 2));
+    return;
+  }
+  const d = data;
+  console.log("=== Instance ===");
+  for (const [key, value] of Object.entries(d.instance)) {
+    console.log(`  ${key}: ${value}`);
+  }
+  if (d.provision) {
+    console.log("");
+    console.log("=== Provisioning ===");
+    console.log(`  phase: ${d.provision.phase}`);
+    console.log(`  jobStatus: ${d.provision.jobStatus}`);
+    if (d.provision.startedAt) console.log(`  startedAt: ${d.provision.startedAt}`);
+    if (d.provision.elapsedSeconds !== null) console.log(`  elapsed: ${d.provision.elapsedSeconds}s`);
+    if (d.provision.lastError) console.log(`  lastError: ${d.provision.lastError}`);
+  }
+  const sections = [
+    ["Docker Containers", d.docker],
+    ["Git Status", d.git],
+    ["Disk Usage", d.disk],
+    ["Agent Health", d.agentHealth],
+    ["App Health", d.appHealth]
+  ];
+  for (const [title, result] of sections) {
+    console.log("");
+    console.log(`=== ${title} ===`);
+    if ("error" in result) {
+      console.log(`  Error: ${result.error}`);
+    } else {
+      if (result.stdout) console.log(result.stdout);
+      if (result.stderr) console.log(`  STDERR: ${result.stderr}`);
+    }
+  }
+}
+async function handleLogs(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const instanceId = positional[0];
+  const json = hasFlag(argv, "--json");
+  if (!instanceId) {
+    console.error("Error: instance ID required. Usage: canary sandbox logs <instance-id>");
+    process.exit(1);
+  }
+  const service = getArgValue(argv, "--service");
+  const tail = getArgValue(argv, "--tail") ?? "200";
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "POST",
+    `/org/environments/instances/${instanceId}/docker/logs`,
+    {
+      ...service ? { service } : {},
+      tail: parseInt(tail, 10)
+    }
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(res.data, null, 2));
+    return;
+  }
+  process.stdout.write(res.data.logs ?? "(no logs)");
+}
+async function handleTerminate(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const instanceId = positional[0];
+  if (!instanceId) {
+    console.error("Error: instance ID required. Usage: canary sandbox terminate <instance-id>");
+    process.exit(1);
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "POST",
+    `/org/environments/instances/${instanceId}/terminate`
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  console.log(`Instance ${instanceId} termination initiated.`);
+}
+async function handleDelete(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const templateId = positional[0];
+  if (!templateId) {
+    console.error("Error: template ID required. Usage: canary sandbox delete <template-id>");
+    process.exit(1);
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "DELETE",
+    `/org/environments/templates/${templateId}`
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  console.log(`Template ${templateId} deleted.`);
+}
+async function handleActionList(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const templateId = positional[0];
+  const json = hasFlag(argv, "--json");
+  if (!templateId) {
+    console.error("Error: template ID required. Usage: canary sandbox action list <template-id>");
+    process.exit(1);
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "GET",
+    `/org/environments/templates/${templateId}/actions`
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(res.data, null, 2));
+    return;
+  }
+  const actions = res.data ?? [];
+  if (actions.length === 0) {
+    console.log("No actions defined for this template.");
+    return;
+  }
+  console.log(`Actions (${actions.length}):`);
+  for (const a of actions) {
+    const status = a.enabled ? "" : " [disabled]";
+    console.log(`  ${pad(a.slug, 30)} ${pad(a.label, 25)}${status}`);
+  }
+}
+async function handleActionGet(argv, apiUrl, token) {
+  const positional = argv.filter((a2) => !a2.startsWith("-"));
+  const templateId = positional[0];
+  const slug = positional[1];
+  const json = hasFlag(argv, "--json");
+  if (!templateId || !slug) {
+    console.error("Error: template ID and slug required. Usage: canary sandbox action get <template-id> <slug>");
+    process.exit(1);
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "GET",
+    `/org/environments/templates/${templateId}/actions/${slug}`
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(res.data, null, 2));
+    return;
+  }
+  const a = res.data;
+  console.log(`Action: ${a.slug}`);
+  console.log(`  Label:       ${a.label}`);
+  console.log(`  Description: ${a.description ?? "(none)"}`);
+  console.log(`  Icon:        ${a.icon ?? "(none)"}`);
+  console.log(`  Enabled:     ${a.enabled}`);
+  console.log(`  Timeout:     ${a.timeoutMs}ms`);
+  console.log(`  Input Schema:`);
+  console.log(`    ${JSON.stringify(a.inputSchema, null, 2).split("\n").join("\n    ")}`);
+  if (a.outputSchema) {
+    console.log(`  Output Schema:`);
+    console.log(`    ${JSON.stringify(a.outputSchema, null, 2).split("\n").join("\n    ")}`);
+  }
+  console.log(`  Script:`);
+  console.log(`    ${a.scriptContent.split("\n").join("\n    ")}`);
+}
+async function handleActionCreate(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const templateId = positional[0];
+  const slug = positional[1];
+  const json = hasFlag(argv, "--json");
+  if (!templateId || !slug) {
+    console.error("Error: template ID and slug required. Usage: canary sandbox action create <template-id> <slug> [options]");
+    process.exit(1);
+  }
+  const scriptPath = getArgValue(argv, "--script");
+  const inputSchemaPath = getArgValue(argv, "--input-schema");
+  const outputSchemaPath = getArgValue(argv, "--output-schema");
+  const credentialOutputConfigPath = getArgValue(argv, "--credential-output-config");
+  const label = getArgValue(argv, "--label") ?? slug.replace(/-/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
+  const description = getArgValue(argv, "--description");
+  const icon = getArgValue(argv, "--icon");
+  const timeoutStr = getArgValue(argv, "--timeout");
+  const encryptScript = hasFlag(argv, "--encrypt-script");
+  const credentialTemplateId = getArgValue(argv, "--credential-template");
+  const provisioningMode = getArgValue(argv, "--provisioning-mode");
+  if (provisioningMode && provisioningMode !== "shared" && provisioningMode !== "unique") {
+    console.error("Error: --provisioning-mode must be 'shared' or 'unique'");
+    process.exit(1);
+  }
+  if (!scriptPath) {
+    console.error("Error: --script <file> is required");
+    process.exit(1);
+  }
+  if (!inputSchemaPath) {
+    console.error("Error: --input-schema <file> is required");
+    process.exit(1);
+  }
+  let scriptContent;
+  try {
+    scriptContent = readFileSync(scriptPath, "utf-8");
+  } catch (err) {
+    console.error(`Error reading script file: ${err}`);
+    process.exit(1);
+  }
+  let inputSchema;
+  try {
+    inputSchema = JSON.parse(readFileSync(inputSchemaPath, "utf-8"));
+  } catch (err) {
+    console.error(`Error reading input schema file: ${err}`);
+    process.exit(1);
+  }
+  let outputSchema;
+  if (outputSchemaPath) {
+    try {
+      outputSchema = JSON.parse(readFileSync(outputSchemaPath, "utf-8"));
+    } catch (err) {
+      console.error(`Error reading output schema file: ${err}`);
+      process.exit(1);
+    }
+  }
+  let credentialOutputConfig;
+  if (credentialOutputConfigPath) {
+    try {
+      credentialOutputConfig = JSON.parse(readFileSync(credentialOutputConfigPath, "utf-8"));
+    } catch (err) {
+      console.error(`Error reading credential output config file: ${err}`);
+      process.exit(1);
+    }
+  }
+  const body = {
+    label,
+    scriptContent,
+    inputSchema,
+    ...description ? { description } : {},
+    ...icon ? { icon } : {},
+    ...outputSchema ? { outputSchema } : {},
+    ...credentialOutputConfig ? { credentialOutputConfig } : {},
+    ...credentialTemplateId ? { credentialTemplateId } : {},
+    ...provisioningMode ? { provisioningMode } : {},
+    ...timeoutStr ? { timeoutMs: parseInt(timeoutStr, 10) } : {},
+    ...encryptScript ? { scriptEncrypted: true } : {}
+  };
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "PUT",
+    `/org/environments/templates/${templateId}/actions/${slug}`,
+    body
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(res.data, null, 2));
+    return;
+  }
+  console.log(`Action '${slug}' saved (${scriptContent.length} bytes script, label: "${label}")`);
+}
+async function handleActionDelete(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const templateId = positional[0];
+  const slug = positional[1];
+  if (!templateId || !slug) {
+    console.error("Error: template ID and slug required. Usage: canary sandbox action delete <template-id> <slug>");
+    process.exit(1);
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "DELETE",
+    `/org/environments/templates/${templateId}/actions/${slug}`
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  console.log(`Action '${slug}' deleted.`);
+}
+async function handleActionExecute(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const instanceId = positional[0];
+  const slug = positional[1];
+  const json = hasFlag(argv, "--json");
+  if (!instanceId || !slug) {
+    console.error("Error: instance ID and slug required. Usage: canary sandbox action execute <instance-id> <slug> [options]");
+    process.exit(1);
+  }
+  let params = {};
+  const paramsFile = getArgValue(argv, "--params-file");
+  if (paramsFile) {
+    try {
+      params = JSON.parse(readFileSync(paramsFile, "utf-8"));
+    } catch (err) {
+      console.error(`Error reading params file: ${err}`);
+      process.exit(1);
+    }
+  }
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === "--param" && argv[i + 1]) {
+      const [key, ...valueParts] = argv[i + 1].split("=");
+      if (key && valueParts.length > 0) {
+        params[key] = valueParts.join("=");
+      }
+      i++;
+    }
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "POST",
+    `/org/environments/instances/${instanceId}/actions/${slug}/execute`,
+    {
+      params,
+      source: "cli"
+    }
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(res.data, null, 2));
+    return;
+  }
+  const exec = res.data;
+  const statusIcon = exec.status === "completed" ? "[done]" : exec.status === "failed" ? "[FAIL]" : `[${exec.status}]`;
+  console.log(`${statusIcon} Action '${slug}' ${exec.status} (${exec.durationMs ?? 0}ms, exit ${exec.exitCode ?? "?"})`);
+  if (exec.result) {
+    console.log(`Result: ${JSON.stringify(exec.result, null, 2)}`);
+  }
+  if (exec.credentialId) {
+    console.log(`Credential: ${exec.credentialId} (linked in property vault)`);
+  }
+  if (exec.status === "failed" && exec.stderr) {
+    const tail = exec.stderr.slice(-1e4).trim().split("\n").slice(-20).join("\n");
+    console.log(`Stderr (last 20 lines):
+${tail}`);
+  }
+  if (exec.error) {
+    console.log(`Error: ${exec.error}`);
+  }
+}
+async function handleActionExecutions(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const instanceId = positional[0];
+  const json = hasFlag(argv, "--json");
+  if (!instanceId) {
+    console.error("Error: instance ID required. Usage: canary sandbox action executions <instance-id>");
+    process.exit(1);
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "GET",
+    `/org/environments/instances/${instanceId}/actions/executions`
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(res.data, null, 2));
+    return;
+  }
+  const execs = res.data ?? [];
+  if (execs.length === 0) {
+    console.log("No executions yet.");
+    return;
+  }
+  console.log("Executions:");
+  for (const e of execs) {
+    const icon = STATUS_ICONS[e.status] ?? `[${e.status}]`;
+    const dur = e.durationMs !== null && e.durationMs !== void 0 ? `${e.durationMs}ms` : "?ms";
+    console.log(`  ${icon} ${pad(e.id.slice(0, 8), 10)} ${pad(e.source, 6)} ${pad(e.status, 12)} ${pad(dur, 8)} ${formatDate(e.createdAt)}`);
+  }
+}
+function parseRepoSpec(spec) {
+  let rest = spec;
+  let role;
+  const eq = rest.indexOf("=");
+  if (eq > -1 && !rest.slice(0, eq).includes("/")) {
+    role = rest.slice(0, eq);
+    rest = rest.slice(eq + 1);
+  }
+  let subdirectory;
+  const colon = rest.indexOf(":");
+  if (colon > -1) {
+    subdirectory = rest.slice(colon + 1);
+    rest = rest.slice(0, colon);
+  }
+  let branch;
+  const at = rest.indexOf("@");
+  if (at > -1) {
+    branch = rest.slice(at + 1);
+    rest = rest.slice(0, at);
+  }
+  return { role, repoFullName: rest, branch, subdirectory };
+}
+async function handleRepoList(argv, apiUrl, token) {
+  const json = hasFlag(argv, "--json");
+  const templateId = getArgValue(argv, "--template");
+  if (!templateId) {
+    console.error("Error: --template is required.");
+    process.exit(1);
+  }
+  const result = await apiRequest(
+    apiUrl,
+    token,
+    "GET",
+    `/org/environments/templates/${templateId}/repos`
+  );
+  if (!result.ok) {
+    console.error(`Error: ${result.error ?? "Unknown error"}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(result.items ?? [], null, 2));
+    return;
+  }
+  const items = result.items ?? [];
+  if (items.length === 0) {
+    console.log("No repos linked to this template.");
+    return;
+  }
+  for (const r of items) {
+    const role = r.role ? ` [${r.role}]` : "";
+    const subdir = r.subdirectory ? `:${r.subdirectory}` : "";
+    console.log(`  ${r.serviceName} \u2192 ${r.propertyGithubRepoId}@${r.branch}${subdir}${role}  (link=${r.id})`);
+  }
+}
+async function handleRepoAdd(argv, apiUrl, token) {
+  const json = hasFlag(argv, "--json");
+  const templateId = getArgValue(argv, "--template");
+  const propertyGithubRepoId = getArgValue(argv, "--property-github-repo-id");
+  const spec = getArgValue(argv, "--spec");
+  const role = getArgValue(argv, "--role");
+  const branch = getArgValue(argv, "--branch");
+  const subdirectory = getArgValue(argv, "--subdirectory");
+  const serviceName = getArgValue(argv, "--service-name");
+  if (!templateId || !propertyGithubRepoId) {
+    console.error("Error: --template and --property-github-repo-id are required.");
+    console.error("Tip: link the repo to the property first via `canary property repo link`, then pass its id here.");
+    process.exit(1);
+  }
+  const parsed = spec ? parseRepoSpec(spec) : {};
+  const body = { propertyGithubRepoId };
+  const finalRole = role ?? parsed.role;
+  const finalBranch = branch ?? parsed.branch;
+  const finalSubdir = subdirectory ?? parsed.subdirectory;
+  if (finalRole !== void 0) body.role = finalRole;
+  if (finalBranch !== void 0) body.branch = finalBranch;
+  if (finalSubdir !== void 0) body.subdirectory = finalSubdir;
+  if (serviceName !== void 0) body.serviceName = serviceName;
+  const result = await apiRequest(
+    apiUrl,
+    token,
+    "POST",
+    `/org/environments/templates/${templateId}/repos`,
+    body
+  );
+  if (!result.ok) {
+    if (json) console.log(JSON.stringify(result, null, 2));
+    else console.error(`Error: ${result.error ?? "Unknown error"}`);
+    process.exit(1);
+  }
+  if (json) console.log(JSON.stringify(result.data, null, 2));
+  else console.log(`Linked repo to template ${templateId} (link=${result.data?.id})`);
+}
+async function handleRepoUpdate(argv, apiUrl, token) {
+  const json = hasFlag(argv, "--json");
+  const templateId = getArgValue(argv, "--template");
+  const linkId = getArgValue(argv, "--link-id");
+  const role = getArgValue(argv, "--role");
+  const branch = getArgValue(argv, "--branch");
+  const subdirectory = getArgValue(argv, "--subdirectory");
+  const serviceName = getArgValue(argv, "--service-name");
+  if (!templateId || !linkId) {
+    console.error("Error: --template and --link-id are required.");
+    process.exit(1);
+  }
+  const body = {};
+  if (role !== void 0) body.role = role;
+  if (branch !== void 0) body.branch = branch;
+  if (subdirectory !== void 0) body.subdirectory = subdirectory;
+  if (serviceName !== void 0) body.serviceName = serviceName;
+  const result = await apiRequest(
+    apiUrl,
+    token,
+    "PATCH",
+    `/org/environments/templates/${templateId}/repos/${linkId}`,
+    body
+  );
+  if (!result.ok) {
+    if (json) console.log(JSON.stringify(result, null, 2));
+    else console.error(`Error: ${result.error ?? "Unknown error"}`);
+    process.exit(1);
+  }
+  if (json) console.log(JSON.stringify(result.data, null, 2));
+  else console.log(`Updated repo link ${linkId}`);
+}
+async function handleRepoRemove(argv, apiUrl, token) {
+  const json = hasFlag(argv, "--json");
+  const templateId = getArgValue(argv, "--template");
+  const linkId = getArgValue(argv, "--link-id");
+  if (!templateId || !linkId) {
+    console.error("Error: --template and --link-id are required.");
+    process.exit(1);
+  }
+  const result = await apiRequest(
+    apiUrl,
+    token,
+    "DELETE",
+    `/org/environments/templates/${templateId}/repos/${linkId}`
+  );
+  if (!result.ok) {
+    if (json) console.log(JSON.stringify(result, null, 2));
+    else console.error(`Error: ${result.error ?? "Unknown error"}`);
+    process.exit(1);
+  }
+  if (json) console.log(JSON.stringify(result, null, 2));
+  else console.log(`Removed repo link ${linkId} from template ${templateId}`);
+}
+async function handleRepo(argv, apiUrl, token) {
+  const [action, ...rest] = argv;
+  switch (action) {
+    case "list":
+      await handleRepoList(rest, apiUrl, token);
+      break;
+    case "add":
+      await handleRepoAdd(rest, apiUrl, token);
+      break;
+    case "update":
+      await handleRepoUpdate(rest, apiUrl, token);
+      break;
+    case "remove":
+    case "rm":
+      await handleRepoRemove(rest, apiUrl, token);
+      break;
+    default:
+      console.error(
+        `Unknown repo action: ${action ?? "(none)"}. Use list/add/update/remove.
+Examples:
+  canary sandbox repo list --template <template-id>
+  canary sandbox repo add --template <template-id> --property-github-repo-id <uuid> --role frontend
+  canary sandbox repo add --template <template-id> --property-github-repo-id <uuid> --spec frontend=owner/web@main:/apps/web`
+      );
+      process.exit(1);
+  }
+}
+var AMI_TERMINAL_STATUSES = /* @__PURE__ */ new Set(["ready", "failed", "superseded", "deregistered"]);
+var formatHashShort = (hash) => hash.slice(0, 8);
+var AMI_COL = {
+  status: 12,
+  hash: 8,
+  built: 20,
+  size: 8,
+  amiId: 22
+};
+function printAmiTable(rows, currentAmiId) {
+  if (rows.length === 0) {
+    console.log("No AMI history yet \u2014 trigger one with `canary sandbox ami rebake <template-id>`.");
+    return;
+  }
+  const header = `  ${"STATUS".padEnd(AMI_COL.status)} ${"HASH".padEnd(AMI_COL.hash)} ${"BUILT".padEnd(AMI_COL.built)} ${"SIZE".padEnd(AMI_COL.size)} ${"AMI-ID".padEnd(AMI_COL.amiId)} ROW-ID`;
+  const lines = [header];
+  const markerFor = (row) => {
+    if (currentAmiId && row.id === currentAmiId) return "*";
+    if (row.status === "ready" || row.status === "superseded") return "R";
+    return " ";
+  };
+  for (const row of rows) {
+    const marker = markerFor(row);
+    const built = row.builtAt ? new Date(row.builtAt).toISOString().slice(0, 19) + "Z" : "\u2014";
+    lines.push(
+      `${marker} ${row.status.padEnd(AMI_COL.status)} ${formatHashShort(row.artifactHash).padEnd(AMI_COL.hash)} ${built.padEnd(AMI_COL.built)} ${row.instanceSize.padEnd(AMI_COL.size)} ${(row.amiId ?? "\u2014").padEnd(AMI_COL.amiId)} ${row.id}`
+    );
+  }
+  console.log(lines.join("\n"));
+  console.log("");
+  console.log("  '*' = current   'R' = ready/superseded (eligible for `canary sandbox ami use`)");
+}
+async function handleAmiList(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const templateId = positional[0];
+  const json = hasFlag(argv, "--json");
+  if (!templateId) {
+    console.error("Error: template ID required. Usage: canary sandbox ami list <template-id>");
+    process.exit(1);
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "GET",
+    `/org/environments/templates/${templateId}/amis`
+  );
+  if (!res.ok) {
+    if (json) console.log(JSON.stringify(res, null, 2));
+    else console.error(`Error: ${res.error ?? "Unknown error"}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(res, null, 2));
+    return;
+  }
+  console.log(`Template: ${res.templateId}`);
+  console.log(`Current AMI row: ${res.currentAmiId ?? "\u2014 (using base AMI)"}`);
+  if (res.pendingAmiBakeHash) {
+    console.log(`Pending bake hash: ${formatHashShort(res.pendingAmiBakeHash)}`);
+  }
+  console.log("");
+  printAmiTable(res.amis ?? [], res.currentAmiId);
+}
+var POLL_TRANSIENT_FAILURE_LIMIT = 3;
+async function pollAmiBuild(apiUrl, token, templateId, jobId, pollIntervalMs = 5e3, timeoutMs = 45 * 60 * 1e3) {
+  const startedAt = Date.now();
+  let lastSeenStatus = null;
+  let consecutiveFailures = 0;
+  while (Date.now() - startedAt < timeoutMs) {
+    const res = await apiRequest(
+      apiUrl,
+      token,
+      "GET",
+      `/org/environments/templates/${templateId}/amis`
+    );
+    if (!res.ok) {
+      consecutiveFailures += 1;
+      if (consecutiveFailures >= POLL_TRANSIENT_FAILURE_LIMIT) {
+        console.error(
+          `Aborting wait after ${consecutiveFailures} consecutive poll failures: ${res.error ?? "Unknown"}`
+        );
+        return null;
+      }
+      console.error(
+        `  \u21B3 poll failure ${consecutiveFailures}/${POLL_TRANSIENT_FAILURE_LIMIT} \u2014 ${res.error ?? "Unknown"}; retrying`
+      );
+      await new Promise((r) => setTimeout(r, pollIntervalMs));
+      continue;
+    }
+    consecutiveFailures = 0;
+    const matching = (res.amis ?? []).find((r) => r.buildJobId === jobId);
+    if (matching && AMI_TERMINAL_STATUSES.has(matching.status)) {
+      return matching;
+    }
+    if (matching && matching.status !== lastSeenStatus) {
+      lastSeenStatus = matching.status;
+      console.log(`  \u21B3 ${(/* @__PURE__ */ new Date()).toISOString()} \u2014 status: ${matching.status}`);
+    }
+    await new Promise((r) => setTimeout(r, pollIntervalMs));
+  }
+  console.error(`Timed out after ${Math.round(timeoutMs / 1e3)}s waiting for bake to finish.`);
+  return null;
+}
+async function handleAmiRebake(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const templateId = positional[0];
+  const json = hasFlag(argv, "--json");
+  const force = hasFlag(argv, "--force");
+  const wait = hasFlag(argv, "--wait");
+  if (!templateId) {
+    console.error("Error: template ID required.");
+    console.error("Usage: canary sandbox ami rebake <template-id> [--force] [--wait]");
+    process.exit(1);
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "POST",
+    `/org/environments/templates/${templateId}/amis/rebake`,
+    { force }
+  );
+  if (!res.ok) {
+    if (json) console.log(JSON.stringify(res, null, 2));
+    else console.error(`Error: ${res.error ?? "Unknown error"}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(res, null, 2));
+    return;
+  }
+  if (res.reason === "already-baked") {
+    console.log(`AMI for hash ${formatHashShort(res.artifactHash ?? "")} already exists (${res.status}).`);
+    console.log(`  Row id: ${res.amiRowId}`);
+    console.log(`  Use \`canary sandbox ami use ${templateId} ${res.amiRowId}\` to switch to it,`);
+    console.log("  or pass --force to bake a fresh copy anyway.");
+    return;
+  }
+  if (res.reason === "coalesced") {
+    console.log("Another rebake was already queued for this template; nothing to do.");
+    if (wait) {
+      console.log(
+        "  (--wait skipped: coalesced response has no job handle to follow. Watch via `canary task list --status in_progress` or re-run rebake when the in-flight one finishes.)"
+      );
+    }
+    return;
+  }
+  console.log(`Bake job enqueued.`);
+  console.log(`  Job id: ${res.jobId}`);
+  console.log(`  Hash:   ${formatHashShort(res.artifactHash ?? "")}`);
+  if (wait) {
+    if (!res.jobId) {
+      console.error("Cannot --wait: API did not return a jobId for the enqueued bake.");
+      process.exit(1);
+    }
+    console.log("");
+    console.log("Polling for completion (Ctrl+C to detach; bake continues server-side)\u2026");
+    const final = await pollAmiBuild(apiUrl, token, templateId, res.jobId);
+    if (final) {
+      console.log("");
+      if (final.status === "ready") {
+        console.log(`Bake complete: AMI ${final.amiId} (row ${final.id})`);
+      } else {
+        console.error(`Bake ended in status: ${final.status}`);
+        if (final.buildError) console.error(`  ${final.buildError}`);
+        process.exit(1);
+      }
+    }
+  }
+}
+async function handleAmiUse(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const templateId = positional[0];
+  const amiRowId = positional[1];
+  const json = hasFlag(argv, "--json");
+  if (!templateId || !amiRowId) {
+    console.error("Error: template ID and AMI row id required.");
+    console.error("Usage: canary sandbox ami use <template-id> <ami-row-id>");
+    console.error("Find row ids with `canary sandbox ami list <template-id>`.");
+    process.exit(1);
+  }
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "PATCH",
+    `/org/environments/templates/${templateId}/current-ami`,
+    { amiRowId }
+  );
+  if (!res.ok) {
+    if (json) console.log(JSON.stringify(res, null, 2));
+    else console.error(`Error: ${res.error ?? "Unknown error"}`);
+    process.exit(1);
+  }
+  if (json) {
+    console.log(JSON.stringify(res, null, 2));
+    return;
+  }
+  if (res.alreadyCurrent) {
+    console.log(`Row ${amiRowId} is already the current AMI for template ${templateId}.`);
+    return;
+  }
+  console.log(`Current AMI updated.`);
+  console.log(`  Template:  ${res.templateId}`);
+  console.log(`  Row:       ${res.currentAmiRowId}`);
+  if (res.currentAmiId) {
+    console.log(`  AMI:       ${res.currentAmiId}`);
+  }
+  if (res.promotedFromSuperseded) {
+    console.log("  Note:      chosen row was superseded; promoted back to ready.");
+  }
+  if (res.demotedPriorAmiRowId) {
+    console.log(`  Demoted:   ${res.demotedPriorAmiRowId} (prior current \u2192 superseded)`);
+  }
+  if (res.priorDemoteSkipped) {
+    console.log(
+      "  Warning:   prior current row was not in `ready` status \u2014 demote skipped (see server logs)."
+    );
+  }
+}
+async function handleAmi(argv, apiUrl, token) {
+  const [action, ...rest] = argv;
+  switch (action) {
+    case "list":
+      await handleAmiList(rest, apiUrl, token);
+      break;
+    case "rebake":
+      await handleAmiRebake(rest, apiUrl, token);
+      break;
+    case "use":
+      await handleAmiUse(rest, apiUrl, token);
+      break;
+    default:
+      console.error(
+        `Unknown ami action: ${action ?? "(none)"}. Use list/rebake/use.
+Examples:
+  canary sandbox ami list <template-id>
+  canary sandbox ami rebake <template-id> [--force] [--wait]
+  canary sandbox ami use <template-id> <ami-row-id>`
+      );
+      process.exit(1);
+  }
+}
+async function runSandbox(argv) {
+  const [subCommand, ...rest] = argv;
+  if (!subCommand || subCommand === "help" || hasFlag(argv, "--help", "-h")) {
+    printHelp();
+    return;
+  }
+  if (subCommand === "guide") {
+    const section = rest.find((a) => !a.startsWith("-"));
+    const json = hasFlag(rest, "--json");
+    printGuide(SANDBOX_GUIDE_SECTIONS, section, json);
+    return;
+  }
+  const { apiUrl, token } = await resolveConfig(argv);
+  const globalFlags = /* @__PURE__ */ new Set(["--env", "--api-url", "--token"]);
+  const args = rest.filter((arg, i) => {
+    if (globalFlags.has(arg)) return false;
+    if (i > 0 && globalFlags.has(rest[i - 1])) return false;
+    return true;
+  });
+  switch (subCommand) {
+    case "list":
+      await handleList(args, apiUrl, token);
+      break;
+    case "template":
+      await handleTemplate(args, apiUrl, token);
+      break;
+    case "repo":
+      await handleRepo(args, apiUrl, token);
+      break;
+    case "artifacts":
+      await handleArtifacts(args, apiUrl, token);
+      break;
+    case "checklist":
+      await handleChecklist(args, apiUrl, token);
+      break;
+    case "create":
+      await handleCreate(args, apiUrl, token);
+      break;
+    case "provision":
+      await handleProvision(args, apiUrl, token);
+      break;
+    case "verify":
+      await handleVerify(args, apiUrl, token);
+      break;
+    case "set-size":
+      await handleSetSize(args, apiUrl, token);
+      break;
+    case "ami":
+      await handleAmi(args, apiUrl, token);
+      break;
+    case "artifact": {
+      const [action, ...actionRest] = args;
+      if (action === "get") {
+        await handleArtifactGet(actionRest, apiUrl, token);
+      } else if (action === "create") {
+        await handleArtifactCreate(actionRest, apiUrl, token);
+      } else {
+        console.error(`Unknown artifact action: ${action}. Use "get" or "create".`);
+        process.exit(1);
+      }
+      break;
+    }
+    case "config": {
+      const [configAction, ...configRest] = args;
+      if (configAction === "list") {
+        await handleConfigList(configRest, apiUrl, token);
+      } else if (configAction === "set") {
+        await handleConfigSet(configRest, apiUrl, token);
+      } else {
+        console.error(`Unknown config action: ${configAction}. Use "list" or "set".`);
+        process.exit(1);
+      }
+      break;
+    }
+    case "action": {
+      const [actionSub, ...actionRest] = args;
+      switch (actionSub) {
+        case "list":
+          await handleActionList(actionRest, apiUrl, token);
+          break;
+        case "get":
+          await handleActionGet(actionRest, apiUrl, token);
+          break;
+        case "create":
+          await handleActionCreate(actionRest, apiUrl, token);
+          break;
+        case "delete":
+          await handleActionDelete(actionRest, apiUrl, token);
+          break;
+        case "execute":
+          await handleActionExecute(actionRest, apiUrl, token);
+          break;
+        case "executions":
+          await handleActionExecutions(actionRest, apiUrl, token);
+          break;
+        default:
+          console.error(`Unknown action sub-command: ${actionSub}. Use "list", "get", "create", "delete", "execute", or "executions".`);
+          process.exit(1);
+      }
+      break;
+    }
+    case "build":
+      await handleBuild(args, apiUrl, token);
+      break;
+    case "run-command":
+      await handleRunCommand(args, apiUrl, token);
+      break;
+    case "diagnostics":
+      await handleDiagnostics(args, apiUrl, token);
+      break;
+    case "logs":
+      await handleLogs(args, apiUrl, token);
+      break;
+    case "terminate":
+      await handleTerminate(args, apiUrl, token);
+      break;
+    case "delete":
+      await handleDelete(args, apiUrl, token);
+      break;
+    default:
+      console.error(`Unknown sub-command: ${subCommand}`);
+      printHelp();
+      process.exit(1);
+  }
+}
+export {
+  containerNameToService,
+  isBrokenContainer,
+  parseDockerPs,
+  runSandbox
+};
+//# sourceMappingURL=sandbox-XGSUU6G7.js.map