@runtypelabs/cli 2.28.1 → 2.29.0

package/dist/index.js

@@ -136,15 +136,15 @@ var init_credential_store = __esm({
 });
 
 // src/index.ts
-import { Command as Command37 } from "commander";
-import chalk46 from "chalk";
+import { Command as Command38 } from "commander";
+import chalk47 from "chalk";
 
 // src/lib/load-env.ts
 import { readFileSync } from "fs";
 import { resolve } from "path";
-function loadEnv(path19 = resolve(process.cwd(), ".env")) {
+function loadEnv(path20 = resolve(process.cwd(), ".env")) {
   try {
-    const content = readFileSync(path19, "utf8").replace(/\r\n?/g, "\n");
+    const content = readFileSync(path20, "utf8").replace(/\r\n?/g, "\n");
     for (const line of content.split("\n")) {
       if (!line.trim() || line.trimStart().startsWith("#")) continue;
       const match = line.match(/^\s*([\w.-]+)\s*=\s*(.*)?\s*$/);
@@ -1386,10 +1386,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path19) {
-  if (!path19)
+function getElementAtPath(obj, path20) {
+  if (!path20)
     return obj;
-  return path19.reduce((acc, key) => acc?.[key], obj);
+  return path20.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1798,11 +1798,11 @@ function explicitlyAborted(x2, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path19, issues) {
+function prefixIssues(path20, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path19);
+    iss.path.unshift(path20);
     return iss;
   });
 }
@@ -1949,16 +1949,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path19 = []) => {
+  const processError = (error52, path20 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path19, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path20, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path19, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path20, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path19, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path20, ...issue2.path]);
       } else {
-        const fullpath = [...path19, ...issue2.path];
+        const fullpath = [...path20, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1985,17 +1985,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path19 = []) => {
+  const processError = (error52, path20 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path19, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path20, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path19, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path20, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path19, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path20, ...issue2.path]);
       } else {
-        const fullpath = [...path19, ...issue2.path];
+        const fullpath = [...path20, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -2027,8 +2027,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path19 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path19) {
+  const path20 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path20) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -14720,13 +14720,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path19 = ref.slice(1).split("/").filter(Boolean);
-  if (path19.length === 0) {
+  const path20 = ref.slice(1).split("/").filter(Boolean);
+  if (path20.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path19[0] === defsKey) {
-    const key = path19[1];
+  if (path20[0] === defsKey) {
+    const key = path20[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -15326,8 +15326,8 @@ function renderDefaultModelStrengthsGuide() {
 }
 
 // ../shared/dist/chunk-UIQ7MVBO.mjs
-function getNestedValue(obj, path19) {
-  let normalizedPath = path19;
+function getNestedValue(obj, path20) {
+  let normalizedPath = path20;
   normalizedPath = normalizedPath.replace(/^\$\.?/, "");
   normalizedPath = normalizedPath.replace(/\[(\d+)\]/g, ".$1");
   normalizedPath = normalizedPath.replace(/\[['"]([^'"\]]+)['"]\]/g, ".$1");
@@ -17250,12 +17250,12 @@ function addSemanticIssues(schema, ctx, pathPrefix = []) {
     }
   }
   for (const [name, property] of Object.entries(schema.properties)) {
-    const path19 = [...pathPrefix, "properties", name];
+    const path20 = [...pathPrefix, "properties", name];
     if (property.type === "string" && property.enum) {
       if (new Set(property.enum).size !== property.enum.length) {
         ctx.addIssue({
           code: "custom",
-          path: [...path19, "enum"],
+          path: [...path20, "enum"],
           message: "Enum values must be unique"
         });
       }
@@ -17263,15 +17263,15 @@ function addSemanticIssues(schema, ctx, pathPrefix = []) {
     if (property.type === "number" && property.minimum !== void 0 && property.maximum !== void 0 && property.minimum > property.maximum) {
       ctx.addIssue({
         code: "custom",
-        path: path19,
+        path: path20,
         message: "minimum must be less than or equal to maximum"
       });
     }
     if (property.type === "object") {
-      addSemanticIssues(property, ctx, path19);
+      addSemanticIssues(property, ctx, path20);
     }
     if (property.type === "array" && property.items.type === "object") {
-      addSemanticIssues(property.items, ctx, [...path19, "items"]);
+      addSemanticIssues(property.items, ctx, [...path20, "items"]);
     }
   }
 }
@@ -20577,8 +20577,8 @@ function validateCodeToolNameCollisions(toolNames, stepRef, code, preSeededCount
   }
   return null;
 }
-function formatPath(path19) {
-  return path19.reduce((acc, part) => {
+function formatPath(path20) {
+  return path20.reduce((acc, part) => {
     if (typeof part === "number") {
       return `${acc}[${part}]`;
     }
@@ -20699,17 +20699,17 @@ function collectTransformDataCodeToolNameCheck(toolsConfig, stepIndex, stepRef,
     if (typeof toolId !== "string") {
       continue;
     }
-    const path19 = `flowSteps[${stepIndex}].config.tools.toolIds[${toolIdIndex}]`;
+    const path20 = `flowSteps[${stepIndex}].config.tools.toolIds[${toolIdIndex}]`;
     const named = parseNamedToolRef(toolId);
     if (named) {
-      selectedToolNames.push({ name: named.name, path: path19 });
+      selectedToolNames.push({ name: named.name, path: path20 });
       continue;
     }
     const { customToolIds } = separateToolIds([toolId]);
     if (customToolIds.length === 0) {
       continue;
     }
-    selectedToolIds.push({ toolId, path: path19 });
+    selectedToolIds.push({ toolId, path: path20 });
   }
   if (selectedToolIds.length > 0 || selectedToolNames.length > 0) {
     pendingChecks.hasAccountScopedReferences = true;
@@ -20742,10 +20742,10 @@ function collectCodeModeToolNameCheck(toolsConfig, stepIndex, stepRef, pendingCh
     if (typeof entry !== "string" || entry.length === 0 || entry.endsWith(":*")) {
       continue;
     }
-    const path19 = `flowSteps[${stepIndex}].config.tools.codeModeConfig.toolPool[${toolPoolIndex}]`;
+    const path20 = `flowSteps[${stepIndex}].config.tools.codeModeConfig.toolPool[${toolPoolIndex}]`;
     const named = parseNamedToolRef(entry);
     if (named) {
-      selectedToolNames.push({ name: named.name, path: path19 });
+      selectedToolNames.push({ name: named.name, path: path20 });
       continue;
     }
     if (runtimeToolNames.has(entry)) {
@@ -20756,7 +20756,7 @@ function collectCodeModeToolNameCheck(toolsConfig, stepIndex, stepRef, pendingCh
     if (customToolIds.length === 0) {
       continue;
     }
-    selectedToolIds.push({ toolId: entry, path: path19 });
+    selectedToolIds.push({ toolId: entry, path: path20 });
   }
   if (selectedToolIds.length > 0 || selectedToolNames.length > 0) {
     pendingChecks.hasAccountScopedReferences = true;
@@ -20806,19 +20806,19 @@ var TEMPLATE_STRING_FIELDS = /* @__PURE__ */ new Set([
   "script"
 ]);
 var NON_FLOW_VARIABLE_SUBTREE_KEYS = /* @__PURE__ */ new Set(["tools"]);
-function extractTemplateStrings(config3, path19 = []) {
+function extractTemplateStrings(config3, path20 = []) {
   const results = [];
   if (typeof config3 === "string") {
-    const fieldName = path19[path19.length - 1];
-    const parentFieldName = path19.length >= 2 ? path19[path19.length - 2] : void 0;
+    const fieldName = path20[path20.length - 1];
+    const parentFieldName = path20.length >= 2 ? path20[path20.length - 2] : void 0;
     if (fieldName && TEMPLATE_STRING_FIELDS.has(fieldName) || parentFieldName && TEMPLATE_STRING_FIELDS.has(parentFieldName)) {
-      results.push({ value: config3, fieldPath: path19.join(".") });
+      results.push({ value: config3, fieldPath: path20.join(".") });
     }
     return results;
   }
   if (Array.isArray(config3)) {
     for (const [index, item] of config3.entries()) {
-      results.push(...extractTemplateStrings(item, [...path19, String(index)]));
+      results.push(...extractTemplateStrings(item, [...path20, String(index)]));
     }
     return results;
   }
@@ -20826,9 +20826,9 @@ function extractTemplateStrings(config3, path19 = []) {
     for (const [key, val] of Object.entries(config3)) {
       if (NON_FLOW_VARIABLE_SUBTREE_KEYS.has(key)) continue;
       if (typeof val === "string" && TEMPLATE_STRING_FIELDS.has(key)) {
-        results.push({ value: val, fieldPath: [...path19, key].join(".") });
+        results.push({ value: val, fieldPath: [...path20, key].join(".") });
       } else if (typeof val === "object" && val !== null) {
-        results.push(...extractTemplateStrings(val, [...path19, key]));
+        results.push(...extractTemplateStrings(val, [...path20, key]));
       }
     }
   }
@@ -20859,8 +20859,8 @@ function extractVariableReferences(config3) {
     while ((match = pattern.exec(value)) !== null) {
       const expr = match[1];
       if (!expr) continue;
-      for (const path19 of extractTemplateExpressionPaths(expr)) {
-        references.push({ variable: path19, fieldPath });
+      for (const path20 of extractTemplateExpressionPaths(expr)) {
+        references.push({ variable: path20, fieldPath });
       }
     }
   }
@@ -21078,7 +21078,7 @@ function validateStoreVectorSource(flowSteps, buckets, declaredFlowInputs) {
     if (outputVar) declaredVariables.add(outputVar);
   }
 }
-function checkConditionExpression(expr, path19, stepRef, buckets) {
+function checkConditionExpression(expr, path20, stepRef, buckets) {
   if (typeof expr !== "string" || !expr.includes("{{")) return;
   const match = UNQUOTED_TEMPLATE_BEFORE_OP.exec(expr) || UNQUOTED_TEMPLATE_AFTER_OP.exec(expr);
   if (!match) return;
@@ -21088,7 +21088,7 @@ function checkConditionExpression(expr, path19, stepRef, buckets) {
     {
       code: "CONDITION_UNQUOTED_TEMPLATE_COMPARISON",
       message: `Expression compares an unquoted {{...}} placeholder against a string literal (\`${snippet}\`). \`condition\` / \`when\` predicates are JavaScript evaluated after template substitution, so a non-numeric value substitutes in as a bare identifier (e.g. \`healthy === 'watch'\`) and throws "ReferenceError: <value> is not defined" at runtime. Quote the placeholder \u2014 e.g. '{{var}}' === '...' \u2014 or compare numerically.`,
-      path: path19,
+      path: path20,
       step: stepRef,
       details: { snippet }
     },
@@ -21294,24 +21294,24 @@ function collectAccountScopedReferences(step, stepIndex, pendingChecks) {
   if (step.type === "execute-agent") {
     const agentId = step.config.agentId;
     if (typeof agentId === "string" && !agentId.includes("{{")) {
-      const path19 = `flowSteps[${stepIndex}].config.agentId`;
-      registerAgentReference(agentId, path19, stepRef, pendingChecks);
+      const path20 = `flowSteps[${stepIndex}].config.agentId`;
+      registerAgentReference(agentId, path20, stepRef, pendingChecks);
     }
     return;
   }
   if (step.type === "tool-call") {
     const toolId = step.config.toolId;
     if (typeof toolId === "string") {
-      const path19 = `flowSteps[${stepIndex}].config.toolId`;
+      const path20 = `flowSteps[${stepIndex}].config.toolId`;
       const named = parseNamedToolRef(toolId);
       if (named) {
         pendingChecks.hasAccountScopedReferences = true;
-        registerReference(pendingChecks.toolReferencesByName, named.name, { path: path19, step: stepRef });
+        registerReference(pendingChecks.toolReferencesByName, named.name, { path: path20, step: stepRef });
       } else {
         const { customToolIds } = separateToolIds([toolId]);
         if (customToolIds.length > 0) {
           pendingChecks.hasAccountScopedReferences = true;
-          registerReference(pendingChecks.toolReferencesById, toolId, { path: path19, step: stepRef });
+          registerReference(pendingChecks.toolReferencesById, toolId, { path: path20, step: stepRef });
         }
       }
     }
@@ -21330,17 +21330,17 @@ function collectAccountScopedReferences(step, stepIndex, pendingChecks) {
       if (typeof toolId !== "string") {
         continue;
       }
-      const path19 = `flowSteps[${stepIndex}].config.tools.toolIds[${toolIdIndex}]`;
+      const path20 = `flowSteps[${stepIndex}].config.tools.toolIds[${toolIdIndex}]`;
       const named = parseNamedToolRef(toolId);
       if (named) {
         pendingChecks.hasAccountScopedReferences = true;
-        registerReference(pendingChecks.toolReferencesByName, named.name, { path: path19, step: stepRef });
+        registerReference(pendingChecks.toolReferencesByName, named.name, { path: path20, step: stepRef });
         continue;
       }
       const { customToolIds } = separateToolIds([toolId]);
       if (customToolIds.length > 0) {
         pendingChecks.hasAccountScopedReferences = true;
-        registerReference(pendingChecks.toolReferencesById, toolId, { path: path19, step: stepRef });
+        registerReference(pendingChecks.toolReferencesById, toolId, { path: path20, step: stepRef });
       }
     }
   }
@@ -21378,22 +21378,22 @@ function collectAccountScopedReferences(step, stepIndex, pendingChecks) {
     }
   }
 }
-function registerAgentReference(agentId, path19, stepRef, pendingChecks) {
+function registerAgentReference(agentId, path20, stepRef, pendingChecks) {
   const named = parseNamedAgentRef(agentId);
   pendingChecks.hasAccountScopedReferences = true;
   if (named) {
-    registerReference(pendingChecks.agentReferencesByName, named.name, { path: path19, step: stepRef });
+    registerReference(pendingChecks.agentReferencesByName, named.name, { path: path20, step: stepRef });
   } else {
-    registerReference(pendingChecks.agentReferencesById, agentId, { path: path19, step: stepRef });
+    registerReference(pendingChecks.agentReferencesById, agentId, { path: path20, step: stepRef });
   }
 }
-function registerFlowReference(flowId, path19, stepRef, pendingChecks) {
+function registerFlowReference(flowId, path20, stepRef, pendingChecks) {
   const named = parseNamedFlowRef(flowId);
   pendingChecks.hasAccountScopedReferences = true;
   if (named) {
-    registerReference(pendingChecks.flowReferencesByName, named.name, { path: path19, step: stepRef });
+    registerReference(pendingChecks.flowReferencesByName, named.name, { path: path20, step: stepRef });
   } else {
-    registerReference(pendingChecks.flowReferencesById, flowId, { path: path19, step: stepRef });
+    registerReference(pendingChecks.flowReferencesById, flowId, { path: path20, step: stepRef });
   }
 }
 function validateSubagentConfig(value, stepTools, stepIndex, stepRef) {
@@ -41354,7 +41354,7 @@ function buildDashboardUrl(opts) {
   while (base.endsWith("/")) {
     base = base.slice(0, -1);
   }
-  const path19 = opts.path.startsWith("/") ? opts.path : `/${opts.path}`;
+  const path20 = opts.path.startsWith("/") ? opts.path : `/${opts.path}`;
   const params = new URLSearchParams();
   if (isValidAccountId(opts.account)) {
     params.set(ACCOUNT_QUERY_PARAM, opts.account);
@@ -41367,7 +41367,7 @@ function buildDashboardUrl(opts) {
     }
   }
   const qs = params.toString();
-  return qs ? `${base}${path19}?${qs}` : `${base}${path19}`;
+  return qs ? `${base}${path20}?${qs}` : `${base}${path20}`;
 }
 function parseAccountId(value) {
   if (!value) return null;
@@ -42050,8 +42050,8 @@ var FLAT_ADVANCED_CONFIG_KEYS = {
 var FLAT_ADVANCED_CONFIG_KEY_LIST = Object.keys(
   FLAT_ADVANCED_CONFIG_KEYS
 );
-function createIssue(severity, code, message, path19, suggestedFix) {
-  return { code, message, path: path19, severity, ...suggestedFix ? { suggestedFix } : {} };
+function createIssue(severity, code, message, path20, suggestedFix) {
+  return { code, message, path: path20, severity, ...suggestedFix ? { suggestedFix } : {} };
 }
 function emptyResult() {
   return { valid: true, errors: [], warnings: [], recommendations: [] };
@@ -42886,16 +42886,16 @@ var FLOW_PREFIX = Object.values(RUNTIME_PREFIXES).find((spec) => spec.namespace
 var SECRET_PREFIX = Object.values(RUNTIME_PREFIXES).find(
   (spec) => spec.namespace === "secret"
 ).prefix;
-function collectStringLeafPaths(value, path19 = []) {
+function collectStringLeafPaths(value, path20 = []) {
   if (typeof value === "string") {
-    return [{ path: path19, value }];
+    return [{ path: path20, value }];
   }
   if (Array.isArray(value)) {
-    return value.flatMap((item, index) => collectStringLeafPaths(item, [...path19, String(index)]));
+    return value.flatMap((item, index) => collectStringLeafPaths(item, [...path20, String(index)]));
   }
   if (value && typeof value === "object") {
     return Object.entries(value).flatMap(
-      ([key, nestedValue]) => collectStringLeafPaths(nestedValue, [...path19, key])
+      ([key, nestedValue]) => collectStringLeafPaths(nestedValue, [...path20, key])
     );
   }
   return [];
@@ -46656,13 +46656,13 @@ function parseJsonObject(raw, label) {
   }
   return parsed;
 }
-function readJsonFile(path19, opts = {}) {
+function readJsonFile(path20, opts = {}) {
   const label = opts.label ?? "file";
   let raw;
   try {
-    raw = readFileSync3(path19, "utf-8");
+    raw = readFileSync3(path20, "utf-8");
   } catch {
-    console.error(chalk2.red(`Failed to read ${label}: ${path19}`));
+    console.error(chalk2.red(`Failed to read ${label}: ${path20}`));
     process.exit(1);
   }
   const obj = parseJsonObject(raw, label);
@@ -61023,7 +61023,7 @@ function mergeMarathonSessionSummaries(existingSessions, nextSessions, offset) {
   }
   return Array.from(byIndex.values()).sort((left, right) => left.index - right.index);
 }
-function buildMarathonSessionSnapshot(liveState, sessionSummary, model, status = "complete", errorMessage2) {
+function buildMarathonSessionSnapshot(liveState, sessionSummary, model, status = "complete", errorMessage3) {
   return {
     sessionIndex: sessionSummary.index,
     status,
@@ -61042,7 +61042,7 @@ function buildMarathonSessionSnapshot(liveState, sessionSummary, model, status =
       ...event,
       data: structuredClone(event.data)
     })),
-    ...errorMessage2 ? { errorMessage: errorMessage2 } : {}
+    ...errorMessage3 ? { errorMessage: errorMessage3 } : {}
   };
 }
 function mapRunTaskStatusToSnapshotStatus(status, fallback) {
@@ -61170,9 +61170,9 @@ function findLatestStateFile(stateDir) {
     const files = fs8.readdirSync(dir).filter((f2) => f2.endsWith(".json"));
     for (const file2 of files) {
       const fullPath = path9.join(dir, file2);
-      const stat = fs8.statSync(fullPath);
-      if (!latest || stat.mtimeMs > latest.mtime) {
-        latest = { name: file2.replace(".json", ""), filePath: fullPath, mtime: stat.mtimeMs };
+      const stat2 = fs8.statSync(fullPath);
+      if (!latest || stat2.mtimeMs > latest.mtime) {
+        latest = { name: file2.replace(".json", ""), filePath: fullPath, mtime: stat2.mtimeMs };
       }
     }
   }
@@ -61504,8 +61504,8 @@ function safeReadTextFile(filePath) {
   try {
     const normalized = normalizeToolPath(filePath).replace(/\\/g, "/");
     if (isSensitivePath(normalized)) return null;
-    const stat = fs9.statSync(filePath);
-    if (!stat.isFile() || stat.size > MAX_FILE_BYTES_TO_SCAN) return null;
+    const stat2 = fs9.statSync(filePath);
+    if (!stat2.isFile() || stat2.size > MAX_FILE_BYTES_TO_SCAN) return null;
     const buffer = fs9.readFileSync(filePath);
     if (buffer.includes(0)) return null;
     return buffer.toString("utf-8");
@@ -61672,14 +61672,14 @@ function resolveToolPath(toolPath, options = {}) {
     }
   }
   if (resolved.exists) {
-    const stat = fs10.statSync(resolved.canonicalPath);
-    if (options.requireFile && !stat.isFile()) {
+    const stat2 = fs10.statSync(resolved.canonicalPath);
+    if (options.requireFile && !stat2.isFile()) {
       return {
         ok: false,
         error: `Path is not a file: ${requestedPath}`
       };
     }
-    if (options.requireDirectory && !stat.isDirectory()) {
+    if (options.requireDirectory && !stat2.isDirectory()) {
       return {
         ok: false,
         error: `Path is not a directory: ${requestedPath}`
@@ -67092,8 +67092,8 @@ apiKeysCommand.command("analytics").description("Show API key usage analytics").
   const client = createCliClient(apiKey);
   if (!isTTY(options) || options.json) {
     try {
-      const path19 = options.key ? `/api-keys/${options.key}/analytics` : "/api-keys/analytics";
-      const data = await client.get(path19);
+      const path20 = options.key ? `/api-keys/${options.key}/analytics` : "/api-keys/analytics";
+      const data = await client.get(path20);
       printJson(data);
     } catch (error51) {
       const message = error51 instanceof Error ? error51.message : "Unknown error";
@@ -67110,8 +67110,8 @@ apiKeysCommand.command("analytics").description("Show API key usage analytics").
     useEffect32(() => {
       const run2 = async () => {
         try {
-          const path19 = options.key ? `/api-keys/${options.key}/analytics` : "/api-keys/analytics";
-          const data = await client.get(path19);
+          const path20 = options.key ? `/api-keys/${options.key}/analytics` : "/api-keys/analytics";
+          const data = await client.get(path20);
           printJson(data);
           setSuccess(true);
           setLoading(false);
@@ -72830,9 +72830,9 @@ function collectBundleFiles(dir) {
     for (const entry of readdirSync7(current)) {
       if (entry.startsWith(".")) continue;
       const full = join14(current, entry);
-      const stat = lstatSync(full);
-      if (stat.isSymbolicLink()) continue;
-      if (stat.isDirectory()) {
+      const stat2 = lstatSync(full);
+      if (stat2.isSymbolicLink()) continue;
+      if (stat2.isDirectory()) {
         if (entry === "node_modules") continue;
         walk(full);
       } else {
@@ -73310,11 +73310,11 @@ function isHealthyManagedVersion(paths, version2) {
   return readInstalledPackageVersion(packageRoot) === version2 && existsSync17(getVersionEntrypoint(paths, version2));
 }
 function isPathInside(parent, child) {
-  const canonicalize = (path19) => {
+  const canonicalize = (path20) => {
     try {
-      return realpathSync3(path19);
+      return realpathSync3(path20);
     } catch {
-      return resolve12(path19);
+      return resolve12(path20);
     }
   };
   const relativePath = relative8(canonicalize(parent), canonicalize(child));
@@ -74012,9 +74012,9 @@ async function resolveMcpArguments(options, dependencies = {}) {
   for (const typedField of typedFields) {
     const [key, rawValue] = splitField(typedField, "-F");
     if (rawValue.startsWith("@")) {
-      const path19 = rawValue.slice(1);
-      if (!path19) throw new Error("-F file references require @<path> or @-");
-      const fileValue = path19 === "-" ? await deps.readStdin() : await deps.readFile(path19, "utf8");
+      const path20 = rawValue.slice(1);
+      if (!path20) throw new Error("-F file references require @<path> or @-");
+      const fileValue = path20 === "-" ? await deps.readStdin() : await deps.readFile(path20, "utf8");
       setField(key, parseTypedValue(fileValue));
     } else {
       setField(key, parseTypedValue(rawValue));
@@ -74190,6 +74190,828 @@ function createMcpCommand(overrides = {}) {
 }
 var mcpCommand = createMcpCommand();
 
+// src/commands/devices.ts
+import { spawn as spawn4 } from "child_process";
+import { readFile as readFile2 } from "fs/promises";
+import { Command as Command37 } from "commander";
+import chalk46 from "chalk";
+
+// src/lib/device-provider.ts
+var DEVICE_SIDECAR_PROTOCOL_VERSION = 1;
+var DeviceProviderError = class extends Error {
+  constructor(message, code, retryable = false, options) {
+    super(message, options);
+    this.code = code;
+    this.retryable = retryable;
+    this.name = "DeviceProviderError";
+  }
+  code;
+  retryable;
+};
+
+// src/lib/macos-device-provider.ts
+import { spawn as spawn3 } from "child_process";
+import { randomUUID as randomUUID2 } from "crypto";
+import { constants as fsConstants } from "fs";
+import { access, chmod, copyFile, mkdir, realpath, rename, rm, stat } from "fs/promises";
+import os6 from "os";
+import path19 from "path";
+var MAX_SIDECAR_OUTPUT_BYTES = 1048576;
+var MAX_HELPER_BYTES = 100 * 1048576;
+var DEFAULT_SIDECAR_TIMEOUT_MS = 3e4;
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseHello(value) {
+  if (!isRecord3(value) || typeof value.providerId !== "string" || typeof value.protocolVersion !== "number" || typeof value.helperVersion !== "string" || typeof value.platform !== "string" || !Array.isArray(value.capabilities) || !value.capabilities.every((capability) => typeof capability === "string")) {
+    throw new DeviceProviderError(
+      "The native helper returned an invalid hello response",
+      "INVALID_RESPONSE"
+    );
+  }
+  return value;
+}
+async function isExecutable(filePath) {
+  try {
+    await access(filePath, fsConstants.X_OK);
+    const details = await stat(filePath);
+    return details.isFile();
+  } catch {
+    return false;
+  }
+}
+var MacOSDeviceProvider = class {
+  id = "com.runtype.device.macos";
+  platform;
+  architecture;
+  operatingSystemRelease;
+  homeDirectory;
+  workingDirectory;
+  environment;
+  sidecarTimeoutMs;
+  constructor(options = {}) {
+    this.platform = options.platform ?? process.platform;
+    this.architecture = options.architecture ?? process.arch;
+    this.operatingSystemRelease = options.operatingSystemRelease ?? os6.release();
+    this.homeDirectory = options.homeDirectory ?? os6.homedir();
+    this.workingDirectory = options.workingDirectory ?? process.cwd();
+    this.environment = options.environment ?? process.env;
+    this.sidecarTimeoutMs = options.sidecarTimeoutMs ?? DEFAULT_SIDECAR_TIMEOUT_MS;
+  }
+  async probe() {
+    const unsupportedReason = this.unsupportedReason();
+    if (unsupportedReason) {
+      return {
+        providerId: this.id,
+        supported: false,
+        installed: false,
+        reason: unsupportedReason
+      };
+    }
+    const binaryPath = await this.resolveBinary();
+    if (!binaryPath) {
+      return {
+        providerId: this.id,
+        supported: true,
+        installed: false,
+        reason: "The Runtype macOS device helper is not installed"
+      };
+    }
+    try {
+      const hello = parseHello(await this.invokeAt(binaryPath, "hello"));
+      this.assertCompatible(hello);
+      return {
+        providerId: this.id,
+        supported: true,
+        installed: true,
+        binaryPath,
+        helperVersion: hello.helperVersion,
+        protocolVersion: hello.protocolVersion
+      };
+    } catch (error51) {
+      return {
+        providerId: this.id,
+        supported: true,
+        installed: true,
+        binaryPath,
+        reason: error51 instanceof Error ? error51.message : String(error51)
+      };
+    }
+  }
+  async ensureInstalled(options = {}) {
+    this.assertPlatform();
+    if (!options.helperPath) {
+      const installedPath = await this.resolveInstalledBinary();
+      if (installedPath) {
+        return this.describeInstallation(installedPath, false);
+      }
+    }
+    const sourcePath = options.helperPath ? path19.resolve(options.helperPath) : await this.resolveDevelopmentSource();
+    if (!sourcePath) {
+      throw new DeviceProviderError(
+        [
+          "The Runtype macOS device helper is not installed.",
+          "For this internal-alpha build, compile it from the core repository and pass:",
+          "  runtype devices setup --helper-path apps/device-daemon-macos/.build/release/runtype-device"
+        ].join("\n"),
+        "HELPER_NOT_INSTALLED"
+      );
+    }
+    const resolvedSource = await realpath(sourcePath).catch(() => sourcePath);
+    const sourceDetails = await stat(resolvedSource).catch(() => null);
+    if (!sourceDetails?.isFile() || sourceDetails.size > MAX_HELPER_BYTES) {
+      throw new DeviceProviderError(
+        `Device helper is not a valid executable file: ${sourcePath}`,
+        "INVALID_HELPER"
+      );
+    }
+    await access(resolvedSource, fsConstants.X_OK).catch((error51) => {
+      throw new DeviceProviderError(
+        `Device helper is not executable: ${sourcePath}`,
+        "INVALID_HELPER",
+        false,
+        { cause: error51 }
+      );
+    });
+    const sourceHello = parseHello(await this.invokeAt(resolvedSource, "hello"));
+    this.assertCompatible(sourceHello);
+    const targetPath = this.stableBinaryPath;
+    const resolvedTarget = await realpath(targetPath).catch(() => targetPath);
+    if (resolvedSource !== resolvedTarget) {
+      const targetDirectory = path19.dirname(targetPath);
+      await mkdir(targetDirectory, { recursive: true, mode: 448 });
+      await chmod(targetDirectory, 448);
+      const temporaryPath = path19.join(targetDirectory, `.runtype-device-${randomUUID2()}.tmp`);
+      try {
+        await copyFile(resolvedSource, temporaryPath, fsConstants.COPYFILE_EXCL);
+        await chmod(temporaryPath, 448);
+        await rename(temporaryPath, targetPath);
+      } finally {
+        await rm(temporaryPath, { force: true });
+      }
+    }
+    return this.describeInstallation(targetPath, true);
+  }
+  async invoke(method, params = {}) {
+    this.assertPlatform();
+    const binaryPath = await this.resolveBinary();
+    if (!binaryPath) {
+      throw new DeviceProviderError(
+        "The Runtype macOS device helper is not installed. Run `runtype devices setup` first.",
+        "HELPER_NOT_INSTALLED"
+      );
+    }
+    const result = await this.invokeAt(binaryPath, method, params);
+    if (!isRecord3(result)) {
+      throw new DeviceProviderError(
+        "The native helper returned a non-object result",
+        "INVALID_RESPONSE"
+      );
+    }
+    return result;
+  }
+  async removeInstalledBinary() {
+    const installed = await isExecutable(this.stableBinaryPath);
+    if (!installed) return false;
+    await rm(this.stableBinaryPath, { force: true });
+    return true;
+  }
+  get stableBinaryPath() {
+    return path19.join(this.homeDirectory, ".runtype", "device", "bin", "runtype-device");
+  }
+  installedCandidates() {
+    return [
+      this.stableBinaryPath,
+      path19.join(
+        this.homeDirectory,
+        "Applications",
+        "Runtype Device.app",
+        "Contents",
+        "MacOS",
+        "runtype-device"
+      ),
+      "/Applications/Runtype Device.app/Contents/MacOS/runtype-device"
+    ];
+  }
+  developmentCandidates() {
+    return [
+      ...this.environment.RUNTYPE_DEVICE_HELPER_PATH ? [path19.resolve(this.environment.RUNTYPE_DEVICE_HELPER_PATH)] : [],
+      path19.join(
+        this.workingDirectory,
+        "apps",
+        "device-daemon-macos",
+        ".build",
+        "release",
+        "runtype-device"
+      ),
+      path19.join(
+        this.workingDirectory,
+        "apps",
+        "device-daemon-macos",
+        ".build",
+        "debug",
+        "runtype-device"
+      )
+    ];
+  }
+  async firstExecutable(candidates) {
+    for (const candidate of candidates) {
+      if (await isExecutable(candidate)) return candidate;
+    }
+    return null;
+  }
+  resolveInstalledBinary() {
+    return this.firstExecutable(this.installedCandidates());
+  }
+  resolveDevelopmentSource() {
+    return this.firstExecutable(this.developmentCandidates());
+  }
+  async resolveBinary() {
+    return await this.resolveInstalledBinary() ?? await this.firstExecutable(this.developmentCandidates());
+  }
+  assertPlatform() {
+    const reason = this.unsupportedReason();
+    if (!reason) return;
+    throw new DeviceProviderError(
+      reason,
+      this.platform === "darwin" ? "UNSUPPORTED_OS_VERSION" : "UNSUPPORTED_PLATFORM"
+    );
+  }
+  unsupportedReason() {
+    if (this.platform !== "darwin") {
+      return `Runtype Device currently supports macOS only (detected ${this.platform}/${this.architecture})`;
+    }
+    const darwinMajor = Number.parseInt(this.operatingSystemRelease.split(".")[0] ?? "", 10);
+    if (!Number.isInteger(darwinMajor) || darwinMajor < 23) {
+      return `Runtype Device requires macOS 14 or newer (detected Darwin ${this.operatingSystemRelease})`;
+    }
+    return null;
+  }
+  assertCompatible(hello) {
+    if (hello.providerId !== this.id || hello.platform !== "macos") {
+      throw new DeviceProviderError(
+        `Unexpected native provider identity: ${hello.providerId}/${hello.platform}`,
+        "PROVIDER_MISMATCH"
+      );
+    }
+    if (hello.protocolVersion !== DEVICE_SIDECAR_PROTOCOL_VERSION) {
+      throw new DeviceProviderError(
+        `Native helper protocol ${hello.protocolVersion} is incompatible with CLI protocol ${DEVICE_SIDECAR_PROTOCOL_VERSION}`,
+        "PROTOCOL_MISMATCH"
+      );
+    }
+  }
+  async describeInstallation(binaryPath, installed) {
+    const hello = parseHello(await this.invokeAt(binaryPath, "hello"));
+    this.assertCompatible(hello);
+    return {
+      providerId: this.id,
+      binaryPath,
+      helperVersion: hello.helperVersion,
+      protocolVersion: hello.protocolVersion,
+      installed
+    };
+  }
+  async invokeAt(binaryPath, method, params = {}) {
+    const id = randomUUID2();
+    const request = JSON.stringify({
+      protocolVersion: DEVICE_SIDECAR_PROTOCOL_VERSION,
+      id,
+      method,
+      params
+    });
+    const child = spawn3(binaryPath, ["control"], {
+      env: this.environment,
+      stdio: ["pipe", "pipe", "pipe"],
+      shell: false
+    });
+    const stdout = [];
+    const stderr = [];
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    let outputExceeded = false;
+    let timedOut = false;
+    child.stdout.on("data", (chunk) => {
+      stdoutBytes += chunk.length;
+      if (stdoutBytes > MAX_SIDECAR_OUTPUT_BYTES) {
+        outputExceeded = true;
+        child.kill("SIGKILL");
+        return;
+      }
+      stdout.push(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      if (stderrBytes >= MAX_SIDECAR_OUTPUT_BYTES) return;
+      stderrBytes += chunk.length;
+      stderr.push(chunk.subarray(0, MAX_SIDECAR_OUTPUT_BYTES - (stderrBytes - chunk.length)));
+    });
+    const completion = new Promise(
+      (resolve13, reject) => {
+        child.once("error", reject);
+        child.once("close", (code, signal) => resolve13({ code, signal }));
+      }
+    );
+    const timeout = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+    }, this.sidecarTimeoutMs);
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(`${request}
+`);
+    let completionResult;
+    try {
+      completionResult = await completion;
+    } catch (error51) {
+      throw new DeviceProviderError(
+        `Unable to start the native device helper at ${binaryPath}`,
+        "HELPER_START_FAILED",
+        false,
+        { cause: error51 }
+      );
+    } finally {
+      clearTimeout(timeout);
+    }
+    if (timedOut) {
+      throw new DeviceProviderError(
+        `Native device helper timed out after ${this.sidecarTimeoutMs}ms`,
+        "HELPER_TIMEOUT",
+        true
+      );
+    }
+    if (outputExceeded) {
+      throw new DeviceProviderError(
+        `Native device helper output exceeded ${MAX_SIDECAR_OUTPUT_BYTES} bytes`,
+        "OUTPUT_TOO_LARGE"
+      );
+    }
+    const output = Buffer.concat(stdout).toString("utf8").trim();
+    let response;
+    try {
+      response = JSON.parse(output);
+    } catch (error51) {
+      const detail = Buffer.concat(stderr).toString("utf8").trim();
+      throw new DeviceProviderError(
+        `Native device helper returned invalid JSON${detail ? `: ${detail}` : ""}`,
+        "INVALID_RESPONSE",
+        false,
+        { cause: error51 }
+      );
+    }
+    if (response.protocolVersion !== DEVICE_SIDECAR_PROTOCOL_VERSION || response.id !== id || typeof response.ok !== "boolean") {
+      throw new DeviceProviderError(
+        "Native device helper returned a mismatched response envelope",
+        "INVALID_RESPONSE"
+      );
+    }
+    if (!response.ok) {
+      throw new DeviceProviderError(
+        response.error?.message || "Native device operation failed",
+        response.error?.code || "OPERATION_FAILED",
+        response.error?.retryable === true
+      );
+    }
+    if (completionResult.code !== 0) {
+      throw new DeviceProviderError(
+        `Native device helper exited with status ${completionResult.code ?? completionResult.signal ?? "unknown"}`,
+        "HELPER_EXITED"
+      );
+    }
+    return response.result;
+  }
+};
+
+// src/commands/devices.ts
+var defaultDependencies2 = {
+  ensureAuth,
+  createClient: (apiKey) => createCliClient(apiKey),
+  createProvider: () => new MacOSDeviceProvider(),
+  getApiUrl,
+  sleep: (milliseconds) => new Promise((resolve13) => setTimeout(resolve13, milliseconds)),
+  setExitCode: (code) => {
+    process.exitCode = code;
+  }
+};
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function unwrapData(response) {
+  if (!isRecord4(response) || !("data" in response)) {
+    throw new Error("Runtype API returned an invalid device response");
+  }
+  return response.data;
+}
+function errorMessage2(error51) {
+  return error51 instanceof Error ? error51.message : String(error51);
+}
+function apiStatusCode(error51) {
+  return isRecord4(error51) && typeof error51.statusCode === "number" ? error51.statusCode : null;
+}
+function isRecordedRevocationError(error51) {
+  if (apiStatusCode(error51) !== 503) return false;
+  const data = isRecord4(error51) && isRecord4(error51.data) ? error51.data : null;
+  const detail = typeof data?.error === "string" ? data.error : errorMessage2(error51);
+  return detail.toLowerCase().includes("revocation was recorded");
+}
+function printCommandError(label, error51) {
+  console.error(chalk46.red(label));
+  console.error(chalk46.red(errorMessage2(error51)));
+}
+function printDevice(device) {
+  printDetail("Runtype Device", [
+    { label: "ID", value: device.id },
+    { label: "Name", value: device.name },
+    { label: "Platform", value: device.platform },
+    { label: "Online", value: device.status?.online },
+    { label: "Last seen", value: device.status?.lastSeenAt },
+    { label: "Available tools", value: device.status?.availableTools.join(", ") },
+    { label: "MCP URL", value: device.mcpUrl },
+    { label: "Revoked", value: device.revokedAt }
+  ]);
+}
+function localDeviceId(status) {
+  return typeof status.deviceId === "string" && status.deviceId.length > 0 ? status.deviceId : null;
+}
+async function authenticatedClient(dependencies) {
+  const apiKey = await dependencies.ensureAuth({ exitOnFailure: false });
+  if (!apiKey) {
+    dependencies.setExitCode(1);
+    return null;
+  }
+  return dependencies.createClient(apiKey);
+}
+async function waitForDevice(client, deviceId, dependencies) {
+  let latest = null;
+  for (let attempt = 0; attempt < 8; attempt += 1) {
+    try {
+      latest = unwrapData(
+        await client.get(`/devices/${encodeURIComponent(deviceId)}`)
+      );
+      if (latest.status?.online) return latest;
+    } catch {
+    }
+    if (attempt < 7) await dependencies.sleep(750);
+  }
+  return latest;
+}
+async function runTail2(logPath, lines) {
+  const child = spawn4("/usr/bin/tail", ["-n", String(lines), "-f", logPath], {
+    stdio: "inherit",
+    shell: false
+  });
+  return new Promise((resolve13, reject) => {
+    child.once("error", reject);
+    child.once("close", (code) => resolve13(code ?? 1));
+  });
+}
+function createDevicesCommand(overrides = {}) {
+  const dependencies = { ...defaultDependencies2, ...overrides };
+  const command = new Command37("devices").description(
+    "Manage local computers connected to Runtype agents"
+  );
+  command.command("setup").description("Install, pair, and start Runtype Device on this Mac").option("--name <name>", "Device name shown in Runtype").option("--helper-path <path>", "Install a locally built native helper (internal alpha)").option("--json", "Output as JSON").action(async (options) => {
+    const provider = dependencies.createProvider();
+    let pairedDeviceId = null;
+    try {
+      const installation = await provider.ensureInstalled({ helperPath: options.helperPath });
+      const before = await provider.invoke("status");
+      const existingDeviceId = localDeviceId(before);
+      if (existingDeviceId) {
+        throw new DeviceProviderError(
+          `This Mac is already paired as ${existingDeviceId}. Run \`runtype devices status\` instead.`,
+          "ALREADY_PAIRED"
+        );
+      }
+      const client = await authenticatedClient(dependencies);
+      if (!client) return;
+      const pairing = unwrapData(
+        await client.post("/devices/pairing-sessions", {})
+      );
+      const pairParams = {
+        pairingUri: pairing.pairingUri,
+        apiUrl: dependencies.getApiUrl()
+      };
+      if (options.name) pairParams.name = options.name;
+      const paired = await provider.invoke("pair", pairParams);
+      pairedDeviceId = paired.deviceId;
+      const service = await provider.invoke("install");
+      const local = await provider.invoke("status");
+      const device = await waitForDevice(client, paired.deviceId, dependencies);
+      const result = {
+        deviceId: paired.deviceId,
+        name: paired.name,
+        online: device?.status?.online ?? false,
+        mcpUrl: device?.mcpUrl ?? null,
+        installation,
+        service,
+        local
+      };
+      if (options.json) {
+        printJson(result);
+        return;
+      }
+      console.log(chalk46.green(`Paired and started ${paired.name}`));
+      console.log(`  Device ID: ${chalk46.green(paired.deviceId)}`);
+      console.log(
+        `  Relay: ${device?.status?.online ? chalk46.green("online") : chalk46.yellow("connecting")}`
+      );
+      if (device?.mcpUrl) console.log(`  MCP URL: ${device.mcpUrl}`);
+      if (local.messagesDatabaseReadable !== true) {
+        console.log(
+          chalk46.yellow(
+            `
+Grant Full Disk Access to ${String(local.executablePath)} to enable iMessage reads.`
+          )
+        );
+      }
+      console.log(chalk46.gray("iMessage sending remains disabled by local policy."));
+    } catch (error51) {
+      printCommandError("Failed to set up Runtype Device", error51);
+      if (pairedDeviceId) {
+        console.error(
+          chalk46.yellow(
+            `Pairing completed as ${pairedDeviceId}, but startup did not finish. Run \`runtype devices install\` after correcting the error.`
+          )
+        );
+      }
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("install").description("Install or restart the local Runtype Device background service").option("--helper-path <path>", "Install a locally built native helper (internal alpha)").option("--json", "Output as JSON").action(async (options) => {
+    const provider = dependencies.createProvider();
+    try {
+      const installation = await provider.ensureInstalled({ helperPath: options.helperPath });
+      const service = await provider.invoke("install");
+      if (options.json) {
+        printJson({ installation, service });
+      } else {
+        console.log(chalk46.green("Runtype Device is installed and running"));
+        console.log(`  Helper: ${installation.binaryPath}`);
+        if (typeof service.logPath === "string") console.log(`  Logs: ${service.logPath}`);
+      }
+    } catch (error51) {
+      printCommandError("Failed to install Runtype Device", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("list").description("List paired devices and relay status").option("--json", "Output as JSON").action(async (options) => {
+    try {
+      const client = await authenticatedClient(dependencies);
+      if (!client) return;
+      const devices = unwrapData(await client.get("/devices"));
+      if (options.json) {
+        printJson({ data: devices });
+        return;
+      }
+      if (devices.length === 0) {
+        console.log(chalk46.gray("No paired devices"));
+        return;
+      }
+      console.log(chalk46.cyan("Runtype Devices:"));
+      for (const device of devices) {
+        const state = device.revokedAt ? "revoked" : device.status?.online ? "online" : "offline";
+        console.log(`  ${chalk46.green(device.id)}  ${device.name}  ${state}`);
+      }
+    } catch (error51) {
+      printCommandError("Failed to list Runtype devices", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("status [id]").description("Show local status, or cloud relay status for a device ID").option("--json", "Output as JSON").action(async (id, options) => {
+    try {
+      if (id) {
+        const client = await authenticatedClient(dependencies);
+        if (!client) return;
+        const device = unwrapData(
+          await client.get(`/devices/${encodeURIComponent(id)}`)
+        );
+        if (options.json) printJson(device);
+        else printDevice(device);
+        return;
+      }
+      const local = await dependencies.createProvider().invoke("status");
+      if (options.json) {
+        printJson(local);
+      } else {
+        printDetail("Local Runtype Device", [
+          { label: "Device ID", value: local.deviceId ?? "not paired" },
+          { label: "API URL", value: local.apiUrl },
+          { label: "Helper version", value: local.helperVersion },
+          { label: "Service installed", value: local.serviceInstalled },
+          { label: "Service running", value: local.serviceRunning },
+          { label: "Messages readable", value: local.messagesDatabaseReadable },
+          { label: "Sending enabled", value: local.allowSend },
+          { label: "Executable", value: local.executablePath },
+          { label: "Logs", value: local.logPath }
+        ]);
+      }
+    } catch (error51) {
+      printCommandError("Failed to read Runtype Device status", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("doctor").description("Check native helper, background service, and Messages permissions").option("--json", "Output as JSON").action(async (options) => {
+    const provider = dependencies.createProvider();
+    try {
+      const probe = await provider.probe();
+      const local = probe.installed && !probe.reason ? await provider.invoke("doctor") : null;
+      const healthy = probe.supported && probe.installed && local?.serviceRunning === true && local.messagesDatabaseReadable === true;
+      const result = { healthy, probe, local };
+      if (options.json) {
+        printJson(result);
+      } else {
+        console.log(
+          healthy ? chalk46.green("Runtype Device is healthy") : chalk46.yellow("Runtype Device needs attention")
+        );
+        console.log(`  Platform supported: ${probe.supported ? "yes" : "no"}`);
+        console.log(`  Helper installed: ${probe.installed ? "yes" : "no"}`);
+        if (probe.reason) console.log(`  Helper: ${probe.reason}`);
+        if (local) {
+          console.log(`  Service running: ${local.serviceRunning === true ? "yes" : "no"}`);
+          console.log(
+            `  Messages readable: ${local.messagesDatabaseReadable === true ? "yes" : "no"}`
+          );
+          if (local.messagesDatabaseReadable !== true) {
+            console.log(
+              chalk46.yellow(`  Grant Full Disk Access to ${String(local.executablePath)}`)
+            );
+          }
+        }
+      }
+      if (!healthy) dependencies.setExitCode(1);
+    } catch (error51) {
+      printCommandError("Runtype Device diagnostics failed", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("policy <mode>").description("Set local iMessage send policy (allow-send or deny-send)").option("--json", "Output as JSON").action(async (mode, options) => {
+    if (mode !== "allow-send" && mode !== "deny-send") {
+      console.error(chalk46.red("Policy must be allow-send or deny-send"));
+      dependencies.setExitCode(1);
+      return;
+    }
+    const provider = dependencies.createProvider();
+    let policyUpdated = false;
+    try {
+      const policy = await provider.invoke("policy", {
+        allowSend: mode === "allow-send"
+      });
+      policyUpdated = true;
+      const status = await provider.invoke("status");
+      const service = status.serviceInstalled === true ? await provider.invoke("install") : null;
+      const result = {
+        ...policy,
+        capabilitiesRepublished: service !== null,
+        service
+      };
+      if (options.json) printJson(result);
+      else {
+        console.log(
+          chalk46.green(
+            `Local iMessage sending is ${mode === "allow-send" ? "enabled" : "disabled"}`
+          )
+        );
+        if (service)
+          console.log(chalk46.gray("Restarted the device service to publish capabilities."));
+        else {
+          console.log(
+            chalk46.yellow(
+              "The device service is not installed; run `runtype devices install` to publish this policy."
+            )
+          );
+        }
+      }
+    } catch (error51) {
+      printCommandError(
+        policyUpdated ? "Local policy was updated, but the device service could not publish it" : "Failed to update local device policy",
+        error51
+      );
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("mcp-url <id>").description("Print the managed MCP endpoint for a paired device").option("--json", "Output as JSON").action(async (id, options) => {
+    try {
+      const client = await authenticatedClient(dependencies);
+      if (!client) return;
+      const device = unwrapData(
+        await client.get(`/devices/${encodeURIComponent(id)}`)
+      );
+      if (options.json) printJson({ deviceId: id, mcpUrl: device.mcpUrl ?? null });
+      else if (device.mcpUrl) console.log(device.mcpUrl);
+      else throw new Error("The API did not return an MCP URL for this device");
+    } catch (error51) {
+      printCommandError("Failed to get device MCP URL", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("revoke <id>").description("Revoke a paired device in Runtype").option("--yes", "Confirm irreversible device revocation").option("--json", "Output as JSON").action(async (id, options) => {
+    if (!options.yes) {
+      console.error(chalk46.red("Pass --yes to confirm irreversible device revocation"));
+      dependencies.setExitCode(1);
+      return;
+    }
+    try {
+      const client = await authenticatedClient(dependencies);
+      if (!client) return;
+      const device = unwrapData(
+        await client.post(`/devices/${encodeURIComponent(id)}/revoke`, {})
+      );
+      if (options.json) printJson(device);
+      else {
+        console.log(chalk46.green(`Revoked ${device.name} (${device.id})`));
+        console.log(chalk46.gray("If this is the local Mac, run `runtype devices reset --yes`."));
+      }
+    } catch (error51) {
+      if (isRecordedRevocationError(error51)) {
+        const result = {
+          deviceId: id,
+          revoked: true,
+          relayDisconnectConfirmed: false,
+          message: errorMessage2(error51)
+        };
+        if (options.json) printJson(result);
+        else {
+          console.error(
+            chalk46.yellow(
+              `Revocation was recorded for ${id}, but relay disconnection was not confirmed.`
+            )
+          );
+          console.error(
+            chalk46.yellow("Retry this command, and reset the local Mac if applicable.")
+          );
+        }
+        dependencies.setExitCode(1);
+        return;
+      }
+      printCommandError("Failed to revoke Runtype device", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("logs").description("Read local Runtype Device logs").option("-n, --lines <count>", "Number of lines", "100").option("-f, --follow", "Follow the log file").action(async (options) => {
+    try {
+      const lines = Number.parseInt(options.lines, 10);
+      if (!Number.isInteger(lines) || lines < 1 || lines > 1e4) {
+        throw new Error("--lines must be an integer between 1 and 10000");
+      }
+      const status = await dependencies.createProvider().invoke("status");
+      if (typeof status.logPath !== "string")
+        throw new Error("The helper did not return a log path");
+      if (options.follow) {
+        const code = await runTail2(status.logPath, lines);
+        if (code !== 0) dependencies.setExitCode(code);
+        return;
+      }
+      const content = await readFile2(status.logPath, "utf8").catch((error51) => {
+        const code = isRecord4(error51) ? error51.code : void 0;
+        if (code === "ENOENT") return "";
+        throw error51;
+      });
+      const entries = content.split(/\r?\n/u);
+      if (entries.at(-1) === "") entries.pop();
+      const selected = entries.slice(-lines).join("\n");
+      if (selected) console.log(selected);
+      else console.log(chalk46.gray("No local device logs yet"));
+    } catch (error51) {
+      printCommandError("Failed to read Runtype Device logs", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("uninstall").description("Stop the local background service while preserving pairing state").option("--remove-binary", "Also remove the CLI-managed helper binary").option("--json", "Output as JSON").action(async (options) => {
+    const provider = dependencies.createProvider();
+    try {
+      const service = await provider.invoke("uninstall");
+      const removedBinary = options.removeBinary ? await provider.removeInstalledBinary() : false;
+      if (options.json) printJson({ service, removedBinary });
+      else console.log(chalk46.green("Stopped and uninstalled the local Runtype Device service"));
+    } catch (error51) {
+      printCommandError("Failed to uninstall Runtype Device", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("reset").description("Clear local pairing state and rotate the native signing identity").option("--yes", "Confirm destructive local reset").option("--json", "Output as JSON").action(async (options) => {
+    if (!options.yes) {
+      console.error(chalk46.red("Pass --yes to confirm destructive local reset"));
+      dependencies.setExitCode(1);
+      return;
+    }
+    try {
+      const result = await dependencies.createProvider().invoke("reset", { rotateIdentity: true });
+      if (options.json) printJson(result);
+      else {
+        console.log(chalk46.green("Cleared local device state and rotated the signing identity"));
+        console.log(
+          chalk46.gray("Revoke the old device in Runtype if it has not already been revoked.")
+        );
+      }
+    } catch (error51) {
+      printCommandError("Failed to reset local Runtype Device state", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  return command;
+}
+var devicesCommand = createDevicesCommand();
+
 // src/index.ts
 init_credential_store();
 
@@ -74209,7 +75031,7 @@ function registerGlobalOptionForwarding(program2) {
 // src/index.ts
 loadEnv();
 setCliTitle();
-var program = new Command37();
+var program = new Command38();
 program.name("runtype").description("CLI for Runtype AI Platform").version(getCliVersion()).option("-v, --verbose", "Enable verbose output").option("--api-url <url>", "Override API URL").option("--json", "Output as JSON");
 program.addCommand(initCommand);
 program.addCommand(loginCommand);
@@ -74247,6 +75069,7 @@ program.addCommand(skillsCommand);
 program.addCommand(updateCommand);
 program.addCommand(installMcpCommand);
 program.addCommand(mcpCommand);
+program.addCommand(devicesCommand);
 program.addCommand(appsCommand, { hidden: process.env.RUNTYPE_APPS_CLI !== "1" });
 registerGlobalOptionForwarding(program);
 program.exitOverride();
@@ -74279,17 +75102,17 @@ async function run() {
 run().catch((error51) => {
   const commanderError = error51;
   if (commanderError.code === "commander.missingArgument") {
-    console.error(chalk46.red(`Error: ${commanderError.message}`));
+    console.error(chalk47.red(`Error: ${commanderError.message}`));
     process.exit(1);
   } else if (commanderError.code === "commander.unknownOption") {
-    console.error(chalk46.red(`Error: ${commanderError.message}`));
+    console.error(chalk47.red(`Error: ${commanderError.message}`));
     process.exit(1);
   } else if (commanderError.code === "commander.unknownCommand") {
     process.exit(1);
   } else if (commanderError.code === "commander.help" || commanderError.code === "commander.helpDisplayed" || commanderError.code === "commander.version") {
     process.exit(0);
   } else {
-    console.error(chalk46.red("An unexpected error occurred:"));
+    console.error(chalk47.red("An unexpected error occurred:"));
     console.error(error51);
     process.exit(1);
   }
@@ -74298,12 +75121,12 @@ async function handleNoCommand() {
   const store = new CredentialStore();
   const hasCredentials = await store.hasCredentials();
   if (!hasCredentials) {
-    console.log(chalk46.cyan("\nWelcome to Runtype CLI!\n"));
+    console.log(chalk47.cyan("\nWelcome to Runtype CLI!\n"));
     console.log("It looks like this is your first time. Run the setup wizard:");
-    console.log(`  ${chalk46.green("runtype init")}
+    console.log(`  ${chalk47.green("runtype init")}
 `);
     console.log("Or see all available commands:");
-    console.log(`  ${chalk46.green("runtype --help")}
+    console.log(`  ${chalk47.green("runtype --help")}
 `);
   } else {
     try {