@runcofactor/cli 0.55.0 → 0.56.0

package/dist/dev-PBW7BSOD.js

@@ -0,0 +1,605 @@
+import { createRequire as __cr } from "module"; import { fileURLToPath as __fup } from "url"; import { dirname as __dn } from "path"; const require = __cr(import.meta.url); const __filename = __fup(import.meta.url); const __dirname = __dn(__filename);
+import {
+  ProcessExitSignal
+} from "./chunk-WRRA4ATV.js";
+import {
+  apiRequest,
+  getPositionalArg
+} from "./chunk-EWK44F6V.js";
+import "./chunk-W7CFLOEI.js";
+import "./chunk-S3Q7MDCS.js";
+import {
+  GLOBAL_VALUE_FLAGS,
+  getArgValue,
+  hasFlag,
+  resolveConfig
+} from "./chunk-4MFMPC5P.js";
+import {
+  writeRawOutput
+} from "./chunk-2OHYMT3A.js";
+import "./chunk-RHWPZKRV.js";
+import "./chunk-TOWZAG3I.js";
+
+// src/dev.ts
+import { execFileSync } from "child_process";
+import path2 from "path";
+import process2 from "process";
+import { stripVTControlCharacters } from "util";
+
+// ../sandbox-helper/src/ade-manifest.ts
+import { parse, stringify } from "yaml";
+import { z } from "zod";
+var ADE_MANIFEST_FILE = "cofactor.ade.yaml";
+var KIB = 1024;
+var ADE_TEXT_MAX_BYTES = 32 * KIB;
+var ADE_SETUP_MAX_BYTES = 96 * KIB;
+var NAME = /^[a-z][a-z0-9-]{0,31}$/;
+var GITHUB_REPO = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+var repoPath = z.string().min(1).refine(
+  (value) => !value.startsWith("/") && value.split("/").every((segment) => segment !== "" && segment !== "." && segment !== ".."),
+  "must be a relative path inside the repo"
+);
+var command = z.string().trim().min(1);
+var repoSchema = z.strictObject({
+  github: z.string().regex(GITHUB_REPO, "must be owner/name on github.com").refine((value) => value.split("/").every((segment) => segment !== "." && segment !== ".."), "must be owner/name on github.com"),
+  install: z.array(command)
+});
+var agentSchema = z.strictObject({
+  install: command,
+  run: command,
+  /** The headless command for `--task`; an agent without one is interactive-only. */
+  task: command.optional()
+});
+var ADE_MAX_SHAPE = { vcpus: 14, memory_mib: 30720 };
+var largestShape = `the largest template a Blackcat worker can build is ${ADE_MAX_SHAPE.vcpus} vCPU / ${ADE_MAX_SHAPE.memory_mib} MiB`;
+var memoryMib = z.number().int().min(1024).max(ADE_MAX_SHAPE.memory_mib, `at most ${ADE_MAX_SHAPE.memory_mib}: ${largestShape}`).refine((value) => value % 128 === 0, "must be a multiple of 128");
+var adeManifestSchema = z.strictObject({
+  version: z.literal(1),
+  name: z.string().regex(NAME, "must be lowercase letters, digits and -, starting with a letter (at most 32)"),
+  resources: z.strictObject({
+    vcpus: z.number().int().min(1).max(ADE_MAX_SHAPE.vcpus, `at most ${ADE_MAX_SHAPE.vcpus}: ${largestShape}`),
+    memory_mib: memoryMib,
+    disk_gib: z.number().int().min(1).max(256)
+  }),
+  /** Root commands run once per template version at build; absent when the base image's toolchain is enough. */
+  setup: z.array(command).optional(),
+  repos: z.array(repoSchema).min(1).superRefine((repos, ctx) => {
+    const seen = /* @__PURE__ */ new Set();
+    repos.forEach((repo, index) => {
+      const name = repo.github.split("/")[1] ?? "";
+      if (seen.has(name)) {
+        ctx.addIssue({ code: "custom", path: [index, "github"], message: `another repo is also named ${name}: both would be /workspace/${name}` });
+      }
+      seen.add(name);
+    });
+  }),
+  agents: z.record(z.string().regex(NAME, "agent names must be lowercase letters, digits and -"), agentSchema).refine((agents) => Object.keys(agents).length > 0, "list at least one agent"),
+  setup_prompt: repoPath,
+  guidance: repoPath
+});
+function validateAdeManifest(yamlText) {
+  let raw;
+  try {
+    raw = parse(yamlText);
+  } catch (error) {
+    return { issues: [{ path: "", message: `invalid YAML: ${error instanceof Error ? error.message : String(error)}` }] };
+  }
+  const parsed = adeManifestSchema.safeParse(raw);
+  if (!parsed.success) {
+    return { issues: parsed.error.issues.map((issue) => ({ path: issue.path.map(String).join(".") || "(root)", message: issue.message })) };
+  }
+  return { manifest: parsed.data, issues: [] };
+}
+
+// src/dev-ssh.ts
+import { spawnSync } from "child_process";
+import { existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, renameSync, writeFileSync } from "fs";
+import os from "os";
+import path from "path";
+import process from "process";
+
+// ../ade-relay-protocol/src/index.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var ADE_SSH_SUBPROTOCOL = "ade-ssh.v1";
+
+// src/dev-ssh.ts
+var adeDir = () => path.join(os.homedir(), ".config", "cofactor", "ade");
+var keyPath = () => path.join(adeDir(), "id_ed25519");
+var knownHostsPath = () => path.join(adeDir(), "known_hosts");
+var grantsPath = () => path.join(adeDir(), "grants.json");
+var sshConfigDir = () => path.join(os.homedir(), ".ssh", "config.d");
+var sshConfigPath = () => path.join(sshConfigDir(), "cofactor-ade");
+var REGRANT_BEFORE_MS = 36e5;
+var PROXY_ATTEMPTS = 5;
+var RELAY_CLOSE_HINTS = {
+  4001: "the relay restarted; run `cofactor dev attach` again",
+  4410: "the session has ended (`cofactor dev list --all`)",
+  4502: "the box could not be reached; it is being woken, so try again in a minute",
+  4503: "the Cofactor API did not answer; try again shortly"
+};
+var MAX_BUFFERED_STDIN = 1024 * 1024;
+var SESSION_ID = /^ades_([1-9A-HJ-NP-Za-km-z]{8})[1-9A-HJ-NP-Za-km-z]*$/;
+var shellQuote = (value) => `'${value.replaceAll("'", `'\\''`)}'`;
+function adeHostAlias(sessionId) {
+  const match = SESSION_ID.exec(sessionId);
+  if (!match) throw new Error(`not an ADE session id: ${JSON.stringify(sessionId)}`);
+  return `ade-${match[1]}`;
+}
+function isTicketSafeUrl(url) {
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === "wss:" || parsed.protocol === "ws:" && ["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname);
+  } catch {
+    return false;
+  }
+}
+function writeAtomic(file, content, mode) {
+  const temp = `${file}.${process.pid}.tmp`;
+  writeFileSync(temp, content, { mode });
+  renameSync(temp, file);
+}
+function ensureMachineKey() {
+  mkdirSync(adeDir(), { recursive: true, mode: 448 });
+  if (!existsSync(keyPath())) {
+    const made = spawnSync("ssh-keygen", ["-q", "-t", "ed25519", "-N", "", "-C", `cofactor-ade@${os.hostname()}`, "-f", keyPath()], {
+      stdio: ["ignore", "ignore", "inherit"]
+    });
+    if (made.error || made.status !== 0) throw new Error("ssh-keygen failed: install the OpenSSH client and retry");
+  }
+  return readFileSync(`${keyPath()}.pub`, "utf8").trim();
+}
+function readGrants() {
+  try {
+    return JSON.parse(readFileSync(grantsPath(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function replaceEntry(existing, alias, entry, isOwn) {
+  const kept = existing.split("\n").filter((line) => line.trim() !== "" && !isOwn(line));
+  return [...kept, entry].join("\n") + "\n";
+}
+function sshConfigBlock(alias, sessionId, user, envArgs2) {
+  adeHostAlias(sessionId);
+  if (envArgs2.some((arg) => /[\r\n]/.test(arg))) throw new Error("a CLI flag value with a line break cannot go into the SSH config");
+  return [
+    `Host ${alias}`,
+    `  HostName ${alias}`,
+    `  User ${user}`,
+    `  IdentityFile "${keyPath()}"`,
+    "  IdentitiesOnly yes",
+    `  UserKnownHostsFile "${knownHostsPath()}"`,
+    "  StrictHostKeyChecking yes",
+    "  ForwardAgent no",
+    "  ServerAliveInterval 30",
+    "  ServerAliveCountMax 4",
+    // `%` would be one of ssh's own tokens (`%h`); `%%` is a literal one.
+    `  ProxyCommand cofactor dev proxy ${[sessionId, ...envArgs2].map(shellQuote).join(" ").replaceAll("%", "%%")}`
+  ].join("\n");
+}
+function ensureSshInclude() {
+  const link = path.join(os.homedir(), ".ssh", "config");
+  const isLink = lstatSync(link, { throwIfNoEntry: false })?.isSymbolicLink() ?? false;
+  const config = isLink ? path.resolve(path.dirname(link), readlinkSync(link)) : link;
+  mkdirSync(sshConfigDir(), { recursive: true, mode: 448 });
+  const existing = existsSync(config) ? readFileSync(config, "utf8") : "";
+  if (/^\s*Include\s+config\.d\/\*\s*$/m.test(existing)) return;
+  try {
+    writeAtomic(config, `Include config.d/*
+
+${existing}`, 384);
+  } catch (error) {
+    throw new Error(`could not add \`Include config.d/*\` to ${config} (${error instanceof Error ? error.message : String(error)}); add it at the top yourself, then retry`);
+  }
+}
+async function grantAndConfigure(apiUrl, token, sessionId, envArgs2) {
+  const publicKey = ensureMachineKey();
+  const result = await apiRequest(apiUrl, token, "POST", `/org/ade/sessions/${encodeURIComponent(sessionId)}/ssh-grant`, {
+    publicKey
+  });
+  if (!result.ok || !result.data) throw new Error(result.error ?? "the SSH grant failed");
+  const { user, hostKey, expiresAt } = result.data;
+  if (!/^ssh-ed25519 [A-Za-z0-9+/=]+(?: \S*)?$/.test(hostKey)) throw new Error("the box returned an unexpected host key");
+  if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(user)) throw new Error("the box returned an unexpected login user");
+  const alias = adeHostAlias(sessionId);
+  const known = existsSync(knownHostsPath()) ? readFileSync(knownHostsPath(), "utf8") : "";
+  const pinned = hostKey.split(" ").slice(0, 2).join(" ");
+  writeAtomic(knownHostsPath(), replaceEntry(known, alias, `${alias} ${pinned}`, (line) => line.startsWith(`${alias} `)), 384);
+  ensureSshInclude();
+  const config = existsSync(sshConfigPath()) ? readFileSync(sshConfigPath(), "utf8") : "";
+  const blocks = config.split(/\n(?=Host )/).filter((block) => block.trim() !== "" && !block.startsWith(`Host ${alias}
+`));
+  writeAtomic(sshConfigPath(), [...blocks.map((block) => block.trimEnd()), sshConfigBlock(alias, sessionId, user, envArgs2)].join("\n\n") + "\n", 384);
+  writeAtomic(grantsPath(), JSON.stringify({ ...readGrants(), [sessionId]: { user, hostKey: pinned, expiresAt } }, null, 2), 384);
+  return alias;
+}
+function attachSsh(alias) {
+  const ssh = spawnSync("ssh", ["-t", alias, "tmux", "attach-session", "-t", "ade"], { stdio: "inherit" });
+  if (ssh.error) throw new Error(`ssh failed to start: ${ssh.error.message}`);
+  return ssh.status ?? 1;
+}
+async function runProxy(apiUrl, token, sessionId, envArgs2) {
+  const grant = readGrants()[sessionId];
+  if (!grant || new Date(grant.expiresAt).getTime() - Date.now() < REGRANT_BEFORE_MS) {
+    await grantAndConfigure(apiUrl, token, sessionId, envArgs2);
+  }
+  let resolveFinished = () => void 0;
+  const finished = new Promise((resolve) => {
+    resolveFinished = resolve;
+  });
+  const finish = (status) => {
+    process.stdin.destroy();
+    resolveFinished(status);
+  };
+  const buffered = [];
+  let bufferedBytes = 0;
+  let socket = null;
+  let stdinEnded = false;
+  process.stdin.on("data", (chunk) => {
+    if (socket?.readyState === WebSocket.OPEN) {
+      socket.send(new Uint8Array(chunk));
+      return;
+    }
+    bufferedBytes += chunk.length;
+    if (bufferedBytes > MAX_BUFFERED_STDIN) {
+      console.error("cofactor dev proxy: ssh sent too much before the relay answered");
+      finish(1);
+      return;
+    }
+    buffered.push(chunk);
+  });
+  process.stdin.on("end", () => {
+    stdinEnded = true;
+    socket?.close(1e3);
+  });
+  const connect = async (attempt) => {
+    const ticket = await apiRequest(apiUrl, token, "POST", `/org/ade/sessions/${encodeURIComponent(sessionId)}/relay-ticket`);
+    if (!ticket.ok || !ticket.data) {
+      console.error(`cofactor dev proxy: ${ticket.error ?? "no relay ticket"}`);
+      finish(1);
+      return;
+    }
+    if (!isTicketSafeUrl(ticket.data.url)) {
+      console.error("cofactor dev proxy: the API returned a relay URL that is not wss://; refusing to send the ticket");
+      finish(1);
+      return;
+    }
+    const ws = new WebSocket(ticket.data.url, [ADE_SSH_SUBPROTOCOL, ticket.data.ticket]);
+    ws.binaryType = "arraybuffer";
+    ws.onopen = () => {
+      socket = ws;
+      for (const chunk of buffered.splice(0)) ws.send(new Uint8Array(chunk));
+      if (stdinEnded) ws.close(1e3);
+    };
+    ws.onmessage = (event) => {
+      process.stdout.write(Buffer.from(event.data));
+    };
+    ws.onclose = (event) => {
+      if (socket === ws) {
+        if (event.code !== 1e3) {
+          console.error(`cofactor dev proxy: the relay closed the connection (${event.code}${event.reason ? `: ${event.reason}` : ""})`);
+          const hint = RELAY_CLOSE_HINTS[event.code];
+          if (hint) console.error(`cofactor dev proxy: ${hint}`);
+        }
+        finish(event.code === 1e3 ? 0 : 1);
+        return;
+      }
+      if (attempt >= PROXY_ATTEMPTS) {
+        console.error(`cofactor dev proxy: could not reach the relay after ${PROXY_ATTEMPTS} attempts`);
+        finish(1);
+        return;
+      }
+      setTimeout(() => {
+        connect(attempt + 1).catch((error) => {
+          if (error instanceof ProcessExitSignal) {
+            finish(error.exitCode);
+            return;
+          }
+          console.error(`cofactor dev proxy: ${error instanceof Error ? error.message : String(error)}`);
+          finish(1);
+        });
+      }, attempt * 500);
+    };
+  };
+  await connect(1);
+  return finished;
+}
+
+// src/dev.ts
+var POLL_MS = 5e3;
+var DESTROY_WAIT_MS = 16 * 6e4;
+var DEV_VALUE_FLAGS = [...GLOBAL_VALUE_FLAGS, "--template"];
+function printHelp() {
+  console.log(
+    [
+      "Usage: cofactor dev [<sub-command>] [options]",
+      "",
+      "Dev environments (ADEs): remote sandboxes a coding agent works in.",
+      "",
+      "Sub-commands:",
+      "  (none) [--template <name>]  Claim a session, follow it, and attach once it is ready. --template is required when the org has several",
+      "  attach [<id>]               SSH into a session (your only live one by default) from this machine. Makes",
+      "                              ~/.config/cofactor/ade/id_ed25519 (no passphrase) once; each grant lasts 12 h",
+      "  proxy <id>                  The SSH ProxyCommand `cofactor dev attach` writes; not run by hand",
+      "  list [--all]                Your sessions: status, phase, size, lease end, last event; --all adds those ended in 7 days",
+      "  destroy <id>                End a session (its home is saved), wait for it, and print the result",
+      `  template publish [<path>]   Admin. Publish a pushed ${ADE_MANIFEST_FILE} (default: the repo root's) and wait for its build`,
+      "  template list               Template versions: status, source commit, setup-prompt hash, error",
+      "",
+      "Options:",
+      "  --json                      Output raw JSON (list, template list)",
+      "  --env <env>                 Target environment (prod, dev, local)"
+    ].join("\n")
+  );
+}
+function fail(message) {
+  console.error(`Error: ${message}`);
+  process2.exit(1);
+}
+var git = (cwd, ...args) => execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+function githubRepoOf(url) {
+  const match = url.match(/^(?:https:\/\/github\.com\/|git@github\.com:|ssh:\/\/git@github\.com\/)([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?\/?$/);
+  return match ? match[1] : null;
+}
+function publishedRepo(root, commit) {
+  let upstream;
+  try {
+    upstream = git(root, "rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}").trim();
+  } catch {
+    fail("this branch has no upstream: push it first (git push -u)");
+  }
+  try {
+    git(root, "merge-base", "--is-ancestor", commit, "@{u}");
+  } catch {
+    fail(`HEAD (${commit.slice(0, 12)}) is not on ${upstream}: push it first`);
+  }
+  const remote = upstream.split("/")[0];
+  const repo = githubRepoOf(git(root, "remote", "get-url", remote).trim());
+  if (!repo) fail(`the ${remote} remote is not a github.com repository`);
+  return repo;
+}
+function committed(root, commit, file) {
+  try {
+    return git(root, "show", `${commit}:${file}`);
+  } catch {
+    fail(`${file} is not committed at ${commit.slice(0, 12)} (paths in ${ADE_MANIFEST_FILE} are relative to the repo root)`);
+  }
+}
+async function allPages(apiUrl, token, route, what) {
+  const items = [];
+  let cursor = null;
+  do {
+    const separator = route.includes("?") ? "&" : "?";
+    const query = `${separator}limit=100${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`;
+    const page = await apiRequest(apiUrl, token, "GET", `${route}${query}`);
+    if (!page.ok || !page.data) fail(page.error ?? `could not list ${what}`);
+    items.push(...page.data);
+    cursor = page.nextCursor ?? null;
+  } while (cursor);
+  return items;
+}
+var allTemplates = (apiUrl, token) => allPages(apiUrl, token, "/org/ade/templates", "templates");
+function printVersion(template) {
+  const source = `${template.sourceRepo}@${template.sourceCommit.slice(0, 12)}`;
+  console.log(
+    `${template.name} v${template.version}  ${template.status.padEnd(8)}  ${source}  base v${template.baseVersion}  setup-prompt ${template.setupPromptSha256.slice(0, 12)}`
+  );
+  if (template.status === "failed" && template.error) console.log(`  ${template.error.trim().split("\n").slice(-20).join("\n  ")}`);
+}
+async function publish(argv, apiUrl, token) {
+  const given = getPositionalArg(argv, GLOBAL_VALUE_FLAGS);
+  const start = given ? path2.dirname(path2.resolve(given)) : process2.cwd();
+  let root;
+  try {
+    root = git(start, "rev-parse", "--show-toplevel").trim();
+  } catch {
+    fail(`${start} is not inside a git repository`);
+  }
+  const yamlFile = given ? path2.relative(root, path2.resolve(given)) : ADE_MANIFEST_FILE;
+  if (yamlFile.startsWith("..")) fail(`${given} is outside the repository at ${root}`);
+  const commit = git(root, "rev-parse", "HEAD").trim();
+  const yaml = committed(root, commit, yamlFile);
+  const { manifest, issues } = validateAdeManifest(yaml);
+  if (!manifest) {
+    console.error(`Error: ${yamlFile} is invalid:`);
+    for (const issue of issues) console.error(`  ${issue.path}: ${issue.message}`);
+    process2.exit(1);
+  }
+  const repo = publishedRepo(root, commit);
+  if (git(root, "status", "--porcelain", "--", yamlFile, manifest.setup_prompt, manifest.guidance).trim() !== "") {
+    console.error(`Note: uncommitted changes to the template's files are not published; publishing them as of ${commit.slice(0, 12)}.`);
+  }
+  const result = await apiRequest(apiUrl, token, "POST", "/org/ade/templates/publish", {
+    yaml,
+    setupPrompt: committed(root, commit, manifest.setup_prompt),
+    guidance: committed(root, commit, manifest.guidance),
+    repo,
+    commit
+  });
+  if (!result.ok || !result.data) {
+    console.error(`Error: ${result.error ?? "publish failed"}`);
+    for (const issue of result.issues ?? []) console.error(`  ${issue.path}: ${issue.message}`);
+    process2.exit(1);
+  }
+  const { id, name, version } = result.data;
+  console.log(`Published ${name} v${version} (${id}) from ${repo}@${commit.slice(0, 12)}; building\u2026`);
+  console.log("Ctrl-C stops waiting; the build carries on (`cofactor dev template list`).");
+  const started = Date.now();
+  for (; ; ) {
+    await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+    const current = await apiRequest(apiUrl, token, "GET", `/org/ade/templates/${id}`);
+    if (!current.ok || !current.data) {
+      fail(`could not read the build's status (${current.error ?? "unknown error"}); it carries on: check \`cofactor dev template list\``);
+    }
+    if (current.data.status === "building") continue;
+    console.log(`${current.data.status === "ready" ? "\u2713" : "\u2717"} after ${Math.round((Date.now() - started) / 1e3)} s`);
+    printVersion(current.data);
+    if (current.data.status === "failed") process2.exit(1);
+    return;
+  }
+}
+async function list(argv, apiUrl, token) {
+  const templates = await allTemplates(apiUrl, token);
+  if (hasFlag(argv, "--json")) {
+    writeRawOutput(JSON.stringify(templates, null, 2));
+    return;
+  }
+  if (templates.length === 0) {
+    console.log("No ADE templates yet. Publish one with `cofactor dev template publish`.");
+    return;
+  }
+  for (const template of templates) printVersion(template);
+}
+var guestText = (value) => (
+  // eslint-disable-next-line no-control-regex -- C0 and C1 controls are exactly what is stripped
+  value ? stripVTControlCharacters(value).replace(/[\u0000-\u001f\u007f-\u009f]/g, " ") : ""
+);
+function printSession(session) {
+  const size = `${session.vcpus}c/${Math.round(session.memoryMib / 1024)}G`;
+  const lease = session.leaseCapAt ? `  lease ends ${session.leaseCapAt}` : "";
+  console.log(`${session.id}  ${session.status.padEnd(12)}  ${session.phase ?? "-"}  ${size}${lease}`);
+  if (session.lastEvent?.identity) console.log(`  logged in as ${guestText(session.lastEvent.identity)}`);
+  if (session.lastEvent?.branches?.length) console.log(`  branches: ${session.lastEvent.branches.map(guestText).join(", ")}`);
+  if (session.lastEvent?.error) console.log(`  ${guestText(session.lastEvent.error)}`);
+  if (session.endReason) console.log(`  ended: ${session.endReason}${session.endDetail ? ` (${session.endDetail})` : ""}`);
+}
+async function templateToClaim(argv, apiUrl, token) {
+  const given = getArgValue(argv, "--template");
+  if (given) return given;
+  const names = new Set((await allTemplates(apiUrl, token)).map((template) => template.name));
+  if (names.size === 1) return [...names][0];
+  if (names.size === 0) fail("this org has no ADE template yet: an admin publishes one with `cofactor dev template publish`");
+  fail(`this org has several ADE templates; pass --template <name> (one of: ${[...names].sort().join(", ")})`);
+}
+var ATTACHABLE_PHASES = /* @__PURE__ */ new Set(["home_mounted", "setup_done", "needs_user", "repos_synced", "agent_started"]);
+var ATTACH_WAIT_MS = 70 * 6e4;
+function envArgs(argv) {
+  const out = [];
+  for (const flag of ["--env", "--api-url", "--org", "--target-org"]) {
+    const value = getArgValue(argv, flag);
+    if (value) out.push(flag, value);
+  }
+  return out;
+}
+async function followUntilAttachable(apiUrl, token, id) {
+  const sessionPath = `/org/ade/sessions/${encodeURIComponent(id)}`;
+  const deadline = Date.now() + ATTACH_WAIT_MS;
+  let shown = "";
+  for (; ; ) {
+    const current = await apiRequest(apiUrl, token, "GET", sessionPath);
+    if (!current.ok || !current.data) fail(current.error ?? "could not read the session");
+    const session = current.data;
+    const state = `${session.status}${session.phase ? ` (${session.phase})` : ""}`;
+    if (state !== shown) {
+      console.log(`  ${state}`);
+      shown = state;
+    }
+    if (session.status === "ending" || session.status === "ended") {
+      printSession(session);
+      process2.exit(1);
+    }
+    if (session.status === "running" || session.phase && ATTACHABLE_PHASES.has(session.phase)) return session;
+    if (Date.now() > deadline) fail(`${id} is still ${state}; it carries on: check \`cofactor dev list\``);
+    await new Promise((resolve) => setTimeout(resolve, 3e3));
+  }
+}
+async function attach(id, argv, apiUrl, token) {
+  await followUntilAttachable(apiUrl, token, id);
+  const alias = await grantAndConfigure(apiUrl, token, id, envArgs(argv)).catch((error) => fail(error instanceof Error ? error.message : String(error)));
+  console.log(`Attaching to ${id} (ssh ${alias}). Detach with Ctrl-b d; reattach with \`cofactor dev attach ${id}\`.`);
+  process2.exit(attachSsh(alias));
+}
+async function claim(argv, apiUrl, token) {
+  const template = await templateToClaim(argv, apiUrl, token);
+  const result = await apiRequest(apiUrl, token, "POST", "/org/ade/sessions", { template });
+  if (!result.ok || !result.data) fail(result.error ?? "the claim failed");
+  console.log(`Claimed ${result.data.id} from ${template}. Ctrl-C stops following; the session carries on.`);
+  await attach(result.data.id, argv, apiUrl, token);
+}
+async function sessionToAttach(argv, apiUrl, token) {
+  const given = getPositionalArg(argv, DEV_VALUE_FLAGS);
+  if (given) return given;
+  const live = await allPages(apiUrl, token, "/org/ade/sessions", "sessions");
+  if (live.length === 1) return live[0].id;
+  if (live.length === 0) fail("you have no live ADE session: claim one with `cofactor dev`");
+  fail(`you have several live sessions; pass one: ${live.map((session) => session.id).join(", ")}`);
+}
+async function listSessions(argv, apiUrl, token) {
+  const all = hasFlag(argv, "--all");
+  const sessions = await allPages(apiUrl, token, all ? "/org/ade/sessions?all=true" : "/org/ade/sessions", "sessions");
+  if (hasFlag(argv, "--json")) {
+    writeRawOutput(JSON.stringify(sessions, null, 2));
+    return;
+  }
+  if (sessions.length === 0) {
+    console.log(all ? "No ADE sessions in the last 7 days." : "No live ADE sessions. Claim one with `cofactor dev`.");
+    return;
+  }
+  for (const session of sessions) printSession(session);
+}
+async function destroy(argv, apiUrl, token) {
+  const id = getPositionalArg(argv, DEV_VALUE_FLAGS);
+  if (!id) fail("usage: cofactor dev destroy <id>");
+  const sessionPath = `/org/ade/sessions/${encodeURIComponent(id)}`;
+  const result = await apiRequest(apiUrl, token, "DELETE", sessionPath);
+  if (!result.ok || !result.data) fail(result.error ?? "the destroy failed");
+  console.log(`Ending ${id}\u2026`);
+  const deadline = Date.now() + DESTROY_WAIT_MS;
+  let session = result.data;
+  while (session.status !== "ended") {
+    if (Date.now() > deadline) fail(`${id} is still ${session.status}; it carries on: check \`cofactor dev list --all\``);
+    await new Promise((resolve) => setTimeout(resolve, 3e3));
+    const current = await apiRequest(apiUrl, token, "GET", sessionPath);
+    if (!current.ok || !current.data) fail(current.error ?? "could not read the session");
+    session = current.data;
+  }
+  printSession(session);
+  if (session.endDetail === "final save failed") console.log("Warning: the final save of the home failed; changes since its last save are lost.");
+}
+async function runDev(argv) {
+  const [group, subCommand, ...rest] = argv;
+  if (group === "help" || hasFlag(argv, "--help", "-h")) {
+    printHelp();
+    return;
+  }
+  if (group === void 0 || group.startsWith("--")) {
+    const { apiUrl: apiUrl2, token: token2 } = await resolveConfig(argv);
+    await claim(argv, apiUrl2, token2);
+    return;
+  }
+  if (group === "attach" || group === "proxy") {
+    const args = argv.slice(1);
+    const { apiUrl: apiUrl2, token: token2 } = await resolveConfig(args);
+    if (group === "attach") {
+      await attach(await sessionToAttach(args, apiUrl2, token2), args, apiUrl2, token2);
+      return;
+    }
+    const id = getPositionalArg(args, DEV_VALUE_FLAGS);
+    if (!id) fail("usage: cofactor dev proxy <id>");
+    const status = await runProxy(apiUrl2, token2, id, envArgs(args)).catch((error) => {
+      if (error instanceof ProcessExitSignal) throw error;
+      console.error(`cofactor dev proxy: ${error instanceof Error ? error.message : String(error)}`);
+      return 1;
+    });
+    process2.exit(status);
+  }
+  if (group === "list" || group === "destroy") {
+    const args = argv.slice(1);
+    const { apiUrl: apiUrl2, token: token2 } = await resolveConfig(args);
+    if (group === "list") await listSessions(args, apiUrl2, token2);
+    else await destroy(args, apiUrl2, token2);
+    return;
+  }
+  if (group !== "template" || subCommand !== "publish" && subCommand !== "list") {
+    console.error(`Unknown dev sub-command: ${[group, subCommand].filter(Boolean).join(" ")}`);
+    printHelp();
+    process2.exit(1);
+  }
+  const { apiUrl, token } = await resolveConfig(rest);
+  if (subCommand === "publish") await publish(rest, apiUrl, token);
+  else await list(rest, apiUrl, token);
+}
+export {
+  runDev
+};
+//# sourceMappingURL=dev-PBW7BSOD.js.map