@sanlabs/sanbox-cli 0.0.3 → 0.0.5

package/dist/cli.js

@@ -2,24 +2,25 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { formatActivityJsonl, formatActivityLine, parseActivityView, shouldRenderEvent } from "./activity.js";
-import { flagList, flagNumber, flagString, hasFlag, parseArgs } from "./args.js";
+import { ArtifactExistsError, downloadArtifacts } from "./artifacts.js";
+import { booleanFlags, flagList, flagString, hasFlag, parseArgs } from "./args.js";
 import { SanboxApiError, SanboxClient } from "./api.js";
 import { defaultApiUrl, readConfig, readLocalConfig, readTemplateSelection } from "./config.js";
-import { inspectDossierFile, previewTaskDossier, writeTaskDossier } from "./dossier.js";
 import { CliError, commandAction, consoleAction } from "./errors.js";
+import { previewInputs } from "./inputs.js";
 import { printError, printJsonlError, printRun, printSuccess, publicRun, publicRunPayload } from "./output.js";
 import { createRun, isTerminalRun, readTasks, runPool, stableBatchId, waitForRun } from "./runs.js";
 import { version } from "./version.js";
-import { WatchInterruptedError, watchRun } from "./watch.js";
+import { WatchInterruptedError, watchEventsUntil, watchRun } from "./watch.js";
 const help = `Sanbox CLI
 
 Environment:
   SANBOX_API_URL   Sanbox API base URL
-  SANBOX_ORG       Organization slug
   SANBOX_API_KEY   Org API key
   SANBOX_TEMPLATE  Explicit template id or slug for run and batch
 
 Commands:
+  sanbox --version
   sanbox auth check [--json]
   sanbox context [--json]
   sanbox doctor [--json]
@@ -29,35 +30,32 @@ Commands:
   sanbox templates list [--json]
   sanbox templates get <template-id> [--json]
   sanbox templates validate <template-id> [--json]
-  sanbox templates create --name "..." --model-provider <provider-id> --model <model-id> [--web-access] [--json]
-  sanbox run "task" --template <template-id> [--include "app/**"] [--wait | --watch] [--json | --jsonl]
-  sanbox run --task "..." --template <template-id> [--include "app/**"] [--wait | --watch] [--json | --jsonl]
-  sanbox run --dossier ./task.zip --template <template-id> [--wait | --watch] [--json | --jsonl]
-  sanbox batch --tasks tasks.json --template <template-id> [--include "app/**"] [--max-parallel 5] [--wait] [--json]
-  sanbox bundle preview [--include "app/**"] [--json]
-  sanbox bundle create "task" --out ./run.zip [--include "app/**"]
-  sanbox bundle inspect ./run.zip [--json]
+  sanbox templates create --name "..." --model-provider <provider-id> --model <model-id> [--harness opencode|hermes] [--llm-budget-usd <amount>] [--json]
+  sanbox run "task" --template <template-id> [--input <path>] [--wait | --watch] [--json | --jsonl]
+  sanbox run --task "..." --template <template-id> [--input <path>] [--wait | --watch] [--json | --jsonl]
+  sanbox batch --tasks tasks.json --template <template-id> [--input <path>] [--max-parallel 5] [--wait] [--json]
+  sanbox runs list [--limit 50] [--json]
   sanbox runs get <run-id> [--json]
   sanbox runs events <run-id> [--after-event-id 0] [--json]
+  sanbox runs messages <run-id> [--json]
+  sanbox runs artifacts <run-id> [--json]
+  sanbox runs download <run-id> --output <directory> [--artifact <path>] [--overwrite] [--json]
   sanbox runs watch <run-id> [--after-event-id 0] [--view activity|logs|compact] [--jsonl]
   sanbox runs cancel <run-id> [--json]
-  sanbox runs message <run-id> --message "..." [--json]
+  sanbox runs message <run-id> "..." [--wait | --watch] [--json | --jsonl]
   sanbox init [--force]
   sanbox init agent [--write]
 `;
 const runHelp = `Sanbox run
 
 Usage:
-  sanbox run "Review this code" --template <template-id> --include "app/**" --wait
-  sanbox run --task "Review this code" --template <template-id> --include "app/**" --wait --json
-  sanbox run --dossier ./run.zip --template <template-id> --wait
+  sanbox run "Review these files" --template <template-id> --input report.pdf --input data/ --wait
+  sanbox run --task "Review these files" --template <template-id> --input report.pdf --wait --json
 
 Options:
-  --include <glob>              File glob or directory to include. Repeatable.
-  --dossier <path>              Submit an existing dossier/run-bundle ZIP.
+  --input <path>                File, directory, or glob to upload. Repeatable.
   --template <id>               Template id or slug. Required unless SANBOX_TEMPLATE or project config sets it.
   --external-run-id <id>        Idempotency key for retries.
-  --retention-ttl-seconds <n>   Workspace retention TTL. Default: 86400.
   --dry-run                     Preview included files without creating a run.
   --wait                        Poll until terminal status.
   --watch                       Stream activity until terminal status.
@@ -67,22 +65,12 @@ Options:
   --cancel-on-interrupt         Request run cancellation when Ctrl-C is pressed.
   --json                        Print JSON.
 `;
-const bundleHelp = `Sanbox bundle
-
-Usage:
-  sanbox bundle preview --include "app/**"
-  sanbox bundle create "Review this repo" --include "app/**" --out ./run.zip
-  sanbox bundle inspect ./run.zip
-
-Bundle is the public name for the portable ZIP contract. The runner still accepts
-the same ZIP dossier shape: RUNBOOK.md, manifest.json, and input/.
-`;
 const doctorHelp = `Sanbox doctor
 
 Usage:
   sanbox doctor [--json]
 
-Checks local configuration, API health, auth, org visibility, and template access.
+Checks local configuration, API health, auth, organization discovery, and template access.
 SANBOX_API_KEY is still read only from the environment.
 `;
 const modelProvidersHelp = `Sanbox model providers
@@ -101,52 +89,111 @@ Usage:
   sanbox templates list [--json]
   sanbox templates get <template-id> [--json]
   sanbox templates validate <template-id> [--json]
-  sanbox templates create --name "Code review" --model-provider <provider-id> --model <model-id> [--web-access] [--json]
+  sanbox templates create --name "Code review" --model-provider <provider-id> --model <model-id> [--harness opencode|hermes] [--llm-budget-usd <amount>] [--json]
 
 Template creation requires an exact provider id and that provider's exact model id.
+LiteLLM budgets are optional USD amounts and apply separately to each run.
+Hermes templates are always-on Telegram gateways. Set SANBOX_TELEGRAM_BOT_TOKEN
+and repeat --telegram-allowed-user <numeric-id> for every permitted user.
 `;
-const agentInstructions = `# Sanbox Agent Integration
+const agentInstructions = `# Operate Sanbox Autonomously
+
+Use the \`sanbox\` CLI for focused, isolated, long-running, risky, or parallel work. The canonical
+protocol is https://console.sanbox.cloud/agent.md.
 
-Use Sanbox when a task is independent, long-running, risky to run locally, or can be split into parallel subtasks.
+Always use the latest published CLI. Install and verify it at the start of every operating session:
+\`\`\`bash
+npm install -g @sanlabs/sanbox-cli@latest
+latest_cli_version="$(npm view @sanlabs/sanbox-cli version)"
+installed_cli_version="$(sanbox --version)"
+test "$installed_cli_version" = "$latest_cli_version"
+\`\`\`
 
-Environment expected by the CLI:
-- SANBOX_API_URL
-- SANBOX_ORG
-- SANBOX_API_KEY
-- SANBOX_TEMPLATE, or an explicit --template flag/project default
+Human bootstrap:
+- A human/admin supplies an organization-scoped SANBOX_API_KEY and configures provider credentials plus a runnable template.
+- Never print, persist, prompt with, or upload API keys or provider credentials.
+- If the key or a runnable template is unavailable, stop with the exact human action required.
 
-Useful commands:
+Deterministic startup:
 \`\`\`bash
-sanbox auth check
-sanbox doctor
+sanbox --version
+sanbox auth check --json
 sanbox context --json
-sanbox model-providers list --json
-sanbox model-providers models <provider-id> --json
 sanbox templates list --json
-sanbox templates validate <template-id> --json
-sanbox run "Investigate one focused task" --template <template-id> --include "app/**" --watch
-sanbox batch --tasks .sanbox/tasks.json --template <template-id> --include "app/**" --max-parallel 5 --wait --json
+export SANBOX_TEMPLATE=<returned-template-id-or-slug>
+sanbox templates validate "$SANBOX_TEMPLATE" --json
+sanbox doctor --json
+\`\`\`
+
+Never guess opaque IDs. The CLI derives the organization from the API key and requires the key to
+resolve to exactly one organization. For task execution, select only a template with runnable: true,
+template_type: "runner", and runner_config.harness: "opencode". Never select a Hermes service
+template for a waited task because it is always-on. Select automatically only when exactly one task
+template qualifies; otherwise ask the user. Provider credentials and template administration are
+console-only.
+
+Use --json for request/response commands and --jsonl for streams. Parse the versioned envelope:
+schema_version, ok, command, context, data or error, and next_actions. Execute command actions as
+argv arrays, never shell strings. Exit 0 means command success, 1 local/API failure, 2 readiness or
+waited remote failure, and 130 detached while remote work continues.
+
+Preview and submit each logical task with a stable idempotency key:
+\`\`\`bash
+sanbox run "Investigate one focused task and write output/report.md" --input app/ --dry-run --json
+sanbox run "Investigate one focused task and write output/report.md" \\
+  --template "$SANBOX_TEMPLATE" --external-run-id "<stable-project-task-id>" \\
+  --input app/ --wait --json
+\`\`\`
+
+Reuse the same --external-run-id after ambiguous failures. Retry network errors, HTTP 429, HTTP 5xx,
+and workspace_busy with bounded backoff. Do not retry other 4xx errors unless next_actions directs
+recovery. Terminal statuses are completed, failed, and canceled.
+
+Recover and retrieve results:
+\`\`\`bash
+sanbox runs list --limit 50 --json
+sanbox runs get <run-id> --json
+sanbox runs events <run-id> --after-event-id <cursor> --json
+sanbox runs watch <run-id> --after-event-id <cursor> --jsonl
+sanbox runs artifacts <run-id> --json
+sanbox runs download <run-id> --output .sanbox/output/<run-id> --json
+\`\`\`
+
+Tasks must put durable files under /workspace/output. Downloads preserve relative paths and report
+byte counts plus SHA-256 digests; existing files require explicit --overwrite.
+
+Continue through the same paused writable sandbox:
+\`\`\`bash
+sanbox runs messages <run-id> --json
 sanbox runs get <run-id> --json
-sanbox runs watch <run-id>
-sanbox runs events <run-id> --json
-sanbox runs message <run-id> --message "Summarize the retained output" --json
+sanbox runs message <run-id> "Summarize the retained output" --wait --json
 \`\`\`
 
-Do not put secrets in run bundles. The CLI excludes common env and secret-like filenames by default.
-Provider credentials are console-only and must never be passed in CLI flags or prompts.
+Before a follow-up, require sandbox_state: "paused" and a positive snapshot_generation. The message
+resumes the same sandbox and OpenCode session, then pauses it as a new generation. Follow-up waits
+are correlated to the returned chat_job.id. Never submit concurrent follow-ups to one run. Retry
+sandbox_not_paused only after the run returns to paused; treat sandbox_not_resumable,
+sandbox_snapshot_missing, sandbox_worker_missing, and hermes_uses_channel as blockers.
+
+For independent fan-out, use \`sanbox batch\` with a stable external_run_id per task and keep the
+client alive until submission completes.
+
+Do not claim completion until the run is completed, required artifacts are downloaded and verified,
+and required follow-ups succeeded. Report run/external/template IDs, status, sandbox state, snapshot
+generation, artifact paths/digests, and blockers. The CLI excludes common secrets by default; add
+.sanboxignore for project rules.
 `;
 const cwd = () => process.cwd();
 const makeClient = (flags) => new SanboxClient(readConfig(flags));
 const jsonContext = (client) => ({
     api_url: client.config.apiUrl,
-    org: client.config.org
+    ...(client.resolvedOrganizationSlug() ? { org: client.resolvedOrganizationSlug() } : {})
 });
 const localJsonContext = (flags) => {
     try {
         const local = readLocalConfig();
         const apiUrl = String(flags["api-url"] || process.env.SANBOX_API_URL || local.api_url || defaultApiUrl).replace(/\/+$/, "");
-        const org = String(flags.org || process.env.SANBOX_ORG || local.org || "").trim();
-        return { api_url: apiUrl, ...(org ? { org } : {}) };
+        return { api_url: apiUrl };
     }
     catch {
         return {};
@@ -157,7 +204,7 @@ const consoleUrl = (client) => consolePathUrl(client, "/model-providers");
 const providerConsoleAction = (client) => consoleAction(consoleUrl(client), "Ask an organization admin to configure or repair the model provider in the Sanbox console.");
 const templateAdminConsoleAction = (client) => consoleAction(consolePathUrl(client, "/templates"), "Ask an organization admin to create a template in the Sanbox console.");
 const templateActions = () => [
-    commandAction(["sanbox", "templates", "list", "--json"], "List templates available to the selected organization."),
+    commandAction(["sanbox", "templates", "list", "--json"], "List templates available to the API key's organization."),
     commandAction(["sanbox", "templates", "validate", "<template-id>", "--json"], "Check whether a template is runnable.")
 ];
 const runReadinessCodes = new Set([
@@ -239,7 +286,155 @@ const formatBytes = (bytes) => {
 };
 const positionalText = (command, startIndex) => command.slice(startIndex).join(" ").trim();
 const runTask = (command, flags) => flagString(flags, "task") || positionalText(command, 1);
-const bundleTask = (command, flags) => flagString(flags, "task") || positionalText(command, 2);
+const commonFlags = ["api-url", "json", "help"];
+const flagSets = {
+    "auth.check": commonFlags,
+    context: [...commonFlags, "template"],
+    doctor: [...commonFlags, "template"],
+    "model-providers.list": commonFlags,
+    "model-providers.get": commonFlags,
+    "model-providers.models": commonFlags,
+    "templates.list": commonFlags,
+    "templates.get": commonFlags,
+    "templates.validate": commonFlags,
+    "templates.create": [
+        ...commonFlags,
+        "name",
+        "model-provider",
+        "model",
+        "harness",
+        "llm-budget-usd",
+        "web-access",
+        "telegram-allowed-user"
+    ],
+    run: [
+        ...commonFlags, "task", "input", "template", "external-run-id",
+        "dry-run", "wait", "watch", "jsonl", "view", "after-event-id", "cancel-on-interrupt",
+        "poll-interval-ms", "event-page-size", "timeout-seconds", "verbose"
+    ],
+    batch: [
+        ...commonFlags, "tasks", "template", "input", "max-parallel", "wait", "batch-id",
+        "poll-interval-ms", "timeout-seconds"
+    ],
+    "runs.list": [...commonFlags, "limit"],
+    "runs.get": commonFlags,
+    "runs.events": [...commonFlags, "after-event-id"],
+    "runs.messages": commonFlags,
+    "runs.artifacts": commonFlags,
+    "runs.download": [...commonFlags, "output", "artifact", "overwrite"],
+    "runs.watch": [
+        ...commonFlags, "after-event-id", "view", "jsonl", "cancel-on-interrupt",
+        "poll-interval-ms", "event-page-size", "timeout-seconds"
+    ],
+    "runs.cancel": commonFlags,
+    "runs.message": [
+        ...commonFlags, "message", "wait", "watch", "jsonl", "view",
+        "poll-interval-ms", "event-page-size", "timeout-seconds"
+    ],
+    init: [...commonFlags, "force", "template"],
+    "init.agent": [...commonFlags, "write"],
+    version: ["json", "help"]
+};
+const commandKey = (command) => {
+    if (command.length === 0)
+        return "help";
+    if (command[0] === "version")
+        return "version";
+    if (command[0] === "auth")
+        return `auth.${command[1] || ""}`;
+    if (command[0] === "model-providers" || command[0] === "templates" || command[0] === "runs") {
+        return `${command[0]}.${command[1] || ""}`;
+    }
+    if (command[0] === "init" && command[1] === "agent")
+        return "init.agent";
+    return command[0];
+};
+const requiredValueFlags = new Set([
+    "api-url", "template", "task", "input", "include", "external-run-id",
+    "tasks", "max-parallel", "batch-id", "poll-interval-ms",
+    "event-page-size", "timeout-seconds", "view", "after-event-id", "limit", "name",
+    "model-provider", "model", "harness", "llm-budget-usd", "telegram-allowed-user",
+    "message", "output", "artifact"
+]);
+const validateFlagValues = (flags) => {
+    for (const flag of requiredValueFlags) {
+        const value = flags[flag];
+        const missing = value === true
+            || (typeof value === "string" && value.trim() === "")
+            || (Array.isArray(value) && value.some((item) => item.trim() === ""));
+        if (missing)
+            throw new CliError("flag_value_required", `--${flag} requires a value.`);
+    }
+    for (const flag of booleanFlags) {
+        if (flags[flag] !== undefined && flags[flag] !== true) {
+            throw new CliError("unexpected_flag_value", `--${flag} does not accept a value.`);
+        }
+    }
+};
+const normalizeInputAlias = (command, flags) => {
+    if (command[0] !== "run" && command[0] !== "batch")
+        return;
+    const legacyInputs = flagList(flags, "include");
+    if (legacyInputs.length === 0)
+        return;
+    flags.input = [...flagList(flags, "input"), ...legacyInputs];
+    delete flags.include;
+    if (!hasFlag(flags, "json") && !hasFlag(flags, "jsonl")) {
+        process.stderr.write("Warning: --include is deprecated; use --input.\n");
+    }
+};
+const validateFlags = (command, flags) => {
+    const key = commandKey(command);
+    if (key === "help") {
+        const unknown = Object.keys(flags).filter((flag) => !["help", "version", "json"].includes(flag));
+        if (unknown.length > 0)
+            throw new CliError("unknown_flag", `Unknown flag: --${unknown[0]}`);
+        return;
+    }
+    const knownRoots = new Set([
+        "auth", "context", "doctor", "model-providers", "templates",
+        "run", "batch", "runs", "init", "version"
+    ]);
+    const allowed = flagSets[key] ?? (knownRoots.has(command[0] || "") ? commonFlags : null);
+    if (!allowed)
+        return;
+    const unknown = Object.keys(flags).filter((flag) => !allowed.includes(flag));
+    if (unknown.length > 0) {
+        throw new CliError("unknown_flag", `Unknown flag for ${command.join(" ")}: --${unknown[0]}`);
+    }
+};
+const validatePositionals = (command, flags) => {
+    if (hasFlag(flags, "help"))
+        return;
+    const maximums = {
+        "auth.check": 2,
+        context: 1,
+        doctor: 1,
+        "model-providers.list": 2,
+        "model-providers.get": 3,
+        "model-providers.models": 3,
+        "templates.list": 2,
+        "templates.get": 3,
+        "templates.validate": 3,
+        "templates.create": 2,
+        batch: 1,
+        "runs.list": 2,
+        "runs.get": 3,
+        "runs.events": 3,
+        "runs.messages": 3,
+        "runs.artifacts": 3,
+        "runs.download": 3,
+        "runs.watch": 3,
+        "runs.cancel": 3,
+        init: 1,
+        "init.agent": 2,
+        version: 1
+    };
+    const maximum = maximums[commandKey(command)];
+    if (maximum !== undefined && command.length > maximum) {
+        throw new CliError("unexpected_argument", `Unexpected positional argument: ${command[maximum]}`);
+    }
+};
 const wantsWatch = (flags) => hasFlag(flags, "watch") || hasFlag(flags, "jsonl");
 const integerFlag = (flags, key, fallback, minimum, maximum) => {
     if (flags[key] === undefined)
@@ -328,23 +523,20 @@ const writeIfNeeded = async (filePath, content, force) => {
     }
 };
 const commandRun = async (command, flags) => {
+    if (flagString(flags, "task") && positionalText(command, 1)) {
+        throw new CliError("conflicting_arguments", "Use either --task or a positional task, not both.");
+    }
     const task = runTask(command, flags);
-    const dossierPath = flagString(flags, "dossier");
-    if (!task && !dossierPath)
-        throw new Error("--task, positional task, or --dossier is required.");
+    if (!task)
+        throw new Error("--task or a positional task is required.");
+    if (hasFlag(flags, "wait") && wantsWatch(flags)) {
+        throw new Error("--wait cannot be combined with --watch or --jsonl.");
+    }
     validateWatchFlags(flags);
     if (hasFlag(flags, "dry-run")) {
         if (wantsWatch(flags))
             throw new Error("--dry-run cannot be combined with --watch or --jsonl.");
-        if (dossierPath) {
-            const inspection = await inspectDossierFile(path.resolve(cwd(), dossierPath));
-            if (hasFlag(flags, "json"))
-                printSuccess("run.preview", inspection, localJsonContext(flags));
-            else
-                process.stdout.write(`Bundle has ${inspection.entries.length} entries\n`);
-            return;
-        }
-        const preview = await previewTaskDossier({ cwd: cwd(), include: flagList(flags, "include") });
+        const preview = await previewInputs({ cwd: cwd(), inputs: flagList(flags, "input") });
         if (hasFlag(flags, "json"))
             printSuccess("run.preview", preview, localJsonContext(flags));
         else
@@ -357,13 +549,10 @@ const commandRun = async (command, flags) => {
     try {
         payload = await createRun(client, {
             cwd: cwd(),
-            cliVersion: version,
-            task,
-            dossierPath,
-            include: flagList(flags, "include"),
+            instruction: task,
+            inputs: flagList(flags, "input"),
             externalRunId: flagString(flags, "external-run-id") || undefined,
-            templateId: template.id,
-            retentionTtlSeconds: flagNumber(flags, "retention-ttl-seconds", 86400)
+            templateId: template.id
         });
     }
     catch (error) {
@@ -382,8 +571,8 @@ const commandRun = async (command, flags) => {
     }
     if (hasFlag(flags, "wait")) {
         payload = await waitForRun(client, payload.run.id, {
-            pollIntervalMs: flagNumber(flags, "poll-interval-ms", 2000),
-            timeoutSeconds: flagNumber(flags, "timeout-seconds", 1800)
+            pollIntervalMs: integerFlag(flags, "poll-interval-ms", 2000, 250, 60_000),
+            timeoutSeconds: integerFlag(flags, "timeout-seconds", 1800, 1, 604_800)
         });
     }
     if (hasFlag(flags, "json")) {
@@ -405,20 +594,18 @@ const commandBatch = async (flags) => {
     const template = readTemplateSelection(flags);
     const tasks = await readTasks(tasksPath);
     const batchId = flagString(flags, "batch-id") || await stableBatchId(tasksPath);
-    const include = flagList(flags, "include");
-    const maxParallel = flagNumber(flags, "max-parallel", 5);
+    const inputs = flagList(flags, "input");
+    const maxParallel = integerFlag(flags, "max-parallel", 5, 1, 100);
     const wait = hasFlag(flags, "wait");
     const results = await runPool(tasks, maxParallel, async (task, index) => {
         let payload;
         try {
             payload = await createRun(client, {
                 cwd: cwd(),
-                cliVersion: version,
-                task: task.task,
-                include: task.include || include,
+                instruction: task.task,
+                inputs: task.input || inputs,
                 externalRunId: task.external_run_id || `sanbox-batch-${batchId}-${index + 1}`,
-                templateId: template.id,
-                retentionTtlSeconds: flagNumber(flags, "retention-ttl-seconds", 86400)
+                templateId: template.id
             });
         }
         catch (error) {
@@ -426,8 +613,8 @@ const commandBatch = async (flags) => {
         }
         if (wait) {
             payload = await waitForRun(client, payload.run.id, {
-                pollIntervalMs: flagNumber(flags, "poll-interval-ms", 2000),
-                timeoutSeconds: flagNumber(flags, "timeout-seconds", 1800)
+                pollIntervalMs: integerFlag(flags, "poll-interval-ms", 2000, 250, 60_000),
+                timeoutSeconds: integerFlag(flags, "timeout-seconds", 1800, 1, 604_800)
             });
         }
         return payload;
@@ -447,37 +634,28 @@ const commandBatch = async (flags) => {
 };
 const commandAuthCheck = async (flags) => {
     const client = makeClient(flags);
-    const me = await client.me();
-    const org = client.config.org;
-    const organizations = Array.isArray(me.organizations)
-        ? me.organizations
-        : [];
-    const selected = organizations.find((item) => item.slug === org) || null;
-    const output = { ok: Boolean(selected), org, selected, me };
+    const [me, selected] = await Promise.all([client.me(), client.organization()]);
+    const org = selected.slug;
+    const output = { ok: true, org, selected, me };
     if (hasFlag(flags, "json"))
         printSuccess("auth.check", output, jsonContext(client));
     else
-        process.stdout.write(selected ? `ok org=${org}\n` : `authenticated, but org ${org} is not visible\n`);
-    if (!selected)
-        process.exitCode = 2;
+        process.stdout.write(`ok org=${org}\n`);
 };
 const commandContext = async (flags) => {
     const client = makeClient(flags);
     const selection = readTemplateSelection(flags, { required: false });
-    const [me, providerPayload, templatePayload] = await Promise.all([
+    const [organization, me, providerPayload, templatePayload] = await Promise.all([
+        client.organization(),
         client.me(),
         client.listModelProviders(),
         client.listTemplates()
     ]);
-    const organizations = Array.isArray(me.organizations)
-        ? me.organizations
-        : [];
-    const selectedOrganization = organizations.find((item) => item.slug === client.config.org) || null;
     const selectedTemplate = selection
         ? templatePayload.templates.find((item) => item.id === selection.id || item.template_slug === selection.id) || null
         : null;
     const output = {
-        organization: selectedOrganization,
+        organization,
         authentication: me.auth || null,
         template_selection: selection
             ? { id: selection.id, source: selection.source, found: Boolean(selectedTemplate), template: selectedTemplate }
@@ -486,22 +664,17 @@ const commandContext = async (flags) => {
         templates: templatePayload.templates
     };
     const nextActions = [];
-    if (!selectedOrganization) {
-        nextActions.push(commandAction(["sanbox", "auth", "check", "--json"], "Verify that the API key can access the selected organization."));
-    }
     if (!selection) {
         nextActions.push(commandAction(["sanbox", "templates", "list", "--json"], "List available templates."), commandAction(["sanbox", "context", "--json"], "Select a template for this shell and inspect the resolved context.", { SANBOX_TEMPLATE: "<template-id>" }));
     }
     else if (!selectedTemplate) {
         nextActions.push(commandAction(["sanbox", "templates", "list", "--json"], "Choose a template that exists in this organization."));
     }
-    if (!selectedOrganization)
-        process.exitCode = 2;
     if (hasFlag(flags, "json")) {
         printSuccess("context.get", output, jsonContext(client), nextActions);
         return;
     }
-    process.stdout.write(`org=${client.config.org}\n`);
+    process.stdout.write(`org=${organization.slug}\n`);
     process.stdout.write(`template=${selection ? `${selection.id} source=${selection.source}${selectedTemplate ? "" : " missing"}` : "not selected"}\n`);
     process.stdout.write(`model_providers=${providerPayload.providers.map((item) => providerId(item)).filter(Boolean).join(",") || "none"}\n`);
     process.stdout.write(`templates=${templatePayload.templates.map((item) => item.template_slug || item.id).join(",") || "none"}\n`);
@@ -584,7 +757,7 @@ const commandTemplates = async (command, flags) => {
         const payload = await client.listTemplates();
         const nextActions = payload.templates.length === 0
             ? [
-                commandAction(["sanbox", "context", "--json"], "Inspect the selected organization and current authentication role."),
+                commandAction(["sanbox", "context", "--json"], "Inspect the API key's organization and current authentication role."),
                 templateAdminConsoleAction(client)
             ]
             : [];
@@ -608,7 +781,7 @@ const commandTemplates = async (command, flags) => {
                 throw new CliError("template_not_found", error.message, {
                     status: error.status,
                     details: { template_id: id },
-                    nextActions: [commandAction(["sanbox", "templates", "list", "--json"], "List templates available to the selected organization.")]
+                    nextActions: [commandAction(["sanbox", "templates", "list", "--json"], "List templates available to the API key's organization.")]
                 });
             }
             throw error;
@@ -631,7 +804,7 @@ const commandTemplates = async (command, flags) => {
                 throw new CliError("template_validation_failed", error.message, {
                     status: error.status,
                     details: { template_id: id },
-                    nextActions: [commandAction(["sanbox", "templates", "list", "--json"], "List templates available to the selected organization.")]
+                    nextActions: [commandAction(["sanbox", "templates", "list", "--json"], "List templates available to the API key's organization.")]
                 });
             }
             throw error;
@@ -652,13 +825,42 @@ const commandTemplates = async (command, flags) => {
         const name = requiredPositional(flagString(flags, "name"), "template_name_required", "templates create requires --name.");
         const modelProvider = requiredPositional(flagString(flags, "model-provider"), "model_provider_required", "templates create requires --model-provider.");
         const model = requiredPositional(flagString(flags, "model"), "model_required", "templates create requires --model.");
+        const harness = flagString(flags, "harness", "opencode");
+        if (harness !== "opencode" && harness !== "hermes") {
+            throw new CliError("invalid_harness", "templates create --harness must be opencode or hermes.");
+        }
+        const budgetRaw = flagString(flags, "llm-budget-usd");
+        const parsedBudgetUsd = budgetRaw ? Number(budgetRaw) : undefined;
+        const llmBudgetUsd = parsedBudgetUsd === undefined
+            ? undefined
+            : Math.round(parsedBudgetUsd * 1_000_000) / 1_000_000;
+        if (budgetRaw &&
+            (!Number.isFinite(parsedBudgetUsd) || llmBudgetUsd <= 0 || llmBudgetUsd > 100_000)) {
+            throw new CliError("invalid_llm_budget", "templates create --llm-budget-usd must be at least 0.000001 and no more than 100000.");
+        }
+        if (harness === "hermes" && llmBudgetUsd !== undefined) {
+            throw new CliError("hermes_budget_unsupported", "Always-on Hermes templates do not support --llm-budget-usd yet.");
+        }
+        const telegramBotToken = process.env.SANBOX_TELEGRAM_BOT_TOKEN?.trim() || "";
+        const telegramAllowedUsers = flagList(flags, "telegram-allowed-user").map((value) => value.trim()).filter(Boolean);
+        if (harness === "hermes" && !telegramBotToken) {
+            throw new CliError("telegram_bot_token_required", "Hermes template creation requires SANBOX_TELEGRAM_BOT_TOKEN.");
+        }
+        if (harness === "hermes" && telegramAllowedUsers.length === 0) {
+            throw new CliError("telegram_allowed_user_required", "Hermes template creation requires at least one --telegram-allowed-user.");
+        }
         let payload;
         try {
             payload = await client.createTemplate({
                 name,
                 provider_id: modelProvider,
                 model_id: model,
-                web_access: hasFlag(flags, "web-access")
+                ...(llmBudgetUsd === undefined ? {} : { llm_budget_usd: llmBudgetUsd }),
+                ...(harness === "hermes" ? {
+                    harness,
+                    telegram_bot_token: telegramBotToken,
+                    telegram_allowed_users: telegramAllowedUsers
+                } : {})
             });
         }
         catch (error) {
@@ -667,11 +869,14 @@ const commandTemplates = async (command, flags) => {
         if (hasFlag(flags, "json")) {
             printSuccess("templates.create", payload, jsonContext(client), [
                 commandAction(["sanbox", "templates", "validate", payload.template.id, "--json"], "Validate the new template before running it."),
-                commandAction(["sanbox", "run", "<task>", "--template", payload.template.id], "Create a run with the new template.")
+                commandAction(["sanbox", "run", harness === "hermes" ? "<agent role and instructions>" : "<task>", "--template", payload.template.id], harness === "hermes"
+                    ? "Start the always-on gateway; interact with it through the configured Telegram bot."
+                    : "Create a run with the new template.")
             ]);
             return;
         }
-        process.stdout.write(`created ${payload.template.id} provider=${payload.template.provider_id || modelProvider} model=${payload.template.model_id || model}\n`);
+        process.stdout.write(`created ${payload.template.id} provider=${payload.template.provider_id || modelProvider} model=${payload.template.model_id || model}` +
+            `${payload.template.llm_budget_usd ? ` budget=$${payload.template.llm_budget_usd}/run` : ""}\n`);
         return;
     }
     throw new CliError("templates_action_required", "templates requires an action: list, get, validate, or create.");
@@ -679,9 +884,21 @@ const commandTemplates = async (command, flags) => {
 const commandRuns = async (command, flags) => {
     const client = makeClient(flags);
     const action = command[1];
-    const runId = command[2];
-    if (!action || !runId)
-        throw new Error("runs command requires an action and run id.");
+    if (!action)
+        throw new Error("runs command requires an action.");
+    if (action === "list") {
+        const limit = integerFlag(flags, "limit", 50, 1, 200);
+        const payload = await client.listRuns(limit);
+        if (hasFlag(flags, "json")) {
+            printSuccess("runs.list", { ...payload, runs: payload.runs.map(publicRun) }, jsonContext(client));
+            return;
+        }
+        for (const run of payload.runs) {
+            process.stdout.write(`${run.id}\t${run.status}\t${run.created_at}\t${run.instruction.replace(/\s+/g, " ").slice(0, 100)}\n`);
+        }
+        return;
+    }
+    const runId = requiredPositional(command[2], "run_id_required", `runs ${action} requires a run id.`);
     if (action === "get") {
         const payload = await client.getRun(runId);
         if (hasFlag(flags, "json"))
@@ -691,13 +908,82 @@ const commandRuns = async (command, flags) => {
         return;
     }
     if (action === "events") {
-        const payload = await client.listEvents(runId, flagNumber(flags, "after-event-id", 0));
+        const payload = await client.listEvents(runId, integerFlag(flags, "after-event-id", 0, 0, Number.MAX_SAFE_INTEGER));
         if (hasFlag(flags, "json"))
             printSuccess("runs.events", payload, jsonContext(client));
         else
             payload.events.forEach((event) => process.stdout.write(`${event.id} ${event.level} ${event.kind} ${event.message}\n`));
         return;
     }
+    if (action === "messages") {
+        const payload = await client.listMessages(runId);
+        if (hasFlag(flags, "json")) {
+            printSuccess("runs.messages", payload, jsonContext(client));
+            return;
+        }
+        for (const message of payload.messages) {
+            process.stdout.write(`${message.role}\t${message.created_at}\t${message.message}\n`);
+        }
+        return;
+    }
+    if (action === "artifacts") {
+        const payload = await client.listArtifacts(runId);
+        if (hasFlag(flags, "json")) {
+            printSuccess("runs.artifacts", payload, jsonContext(client));
+            return;
+        }
+        for (const artifact of payload.artifacts) {
+            process.stdout.write(`${artifact.path}\t${artifact.size_bytes}\n`);
+        }
+        return;
+    }
+    if (action === "download") {
+        const outputDirectory = requiredPositional(flagString(flags, "output"), "output_directory_required", "runs download requires --output.");
+        const payload = await client.listArtifacts(runId);
+        const requested = flagList(flags, "artifact");
+        const selected = requested.length === 0
+            ? payload.artifacts
+            : requested.map((artifactPath) => {
+                const artifact = payload.artifacts.find((item) => item.path === artifactPath);
+                if (!artifact) {
+                    throw new CliError("artifact_not_found", `Run ${runId} has no artifact named ${artifactPath}.`, {
+                        details: { run_id: runId, artifact_path: artifactPath },
+                        nextActions: [commandAction(["sanbox", "runs", "artifacts", runId, "--json"], "List exact artifact paths for this run.")]
+                    });
+                }
+                return artifact;
+            });
+        let downloads;
+        try {
+            downloads = await downloadArtifacts(client, runId, selected, outputDirectory, hasFlag(flags, "overwrite"));
+        }
+        catch (error) {
+            if (error instanceof ArtifactExistsError) {
+                throw new CliError("artifact_exists", error.message, {
+                    details: {
+                        run_id: runId,
+                        artifact_path: error.artifactPath,
+                        local_path: error.destination
+                    },
+                    nextActions: [commandAction(["sanbox", "runs", "download", runId, "--output", "<new-output-directory>", "--json"], "Download into a new directory without replacing an existing file.")]
+                });
+            }
+            throw error;
+        }
+        const result = {
+            run_id: runId,
+            output_directory: path.resolve(outputDirectory),
+            downloads
+        };
+        if (hasFlag(flags, "json")) {
+            printSuccess("runs.download", result, jsonContext(client));
+            return;
+        }
+        for (const download of downloads) {
+            process.stdout.write(`${download.path}\t${download.local_path}\t${download.size_bytes}\t${download.sha256}\n`);
+        }
+        return;
+    }
     if (action === "watch") {
         validateWatchFlags({ ...flags, watch: true });
         const payload = await watchRunWithOutput(client, runId, { ...flags, watch: true });
@@ -718,14 +1004,102 @@ const commandRuns = async (command, flags) => {
         return;
     }
     if (action === "message") {
-        const message = flagString(flags, "message");
+        const flaggedMessage = flagString(flags, "message");
+        const positionalMessage = positionalText(command, 3);
+        if (flaggedMessage && positionalMessage) {
+            throw new CliError("conflicting_arguments", "Use either --message or a positional message, not both.");
+        }
+        const message = flaggedMessage || positionalMessage;
         if (!message)
-            throw new Error("--message is required.");
-        const payload = await client.sendMessage(runId, message);
-        if (hasFlag(flags, "json"))
-            printSuccess("runs.message", publicRunPayload(payload), jsonContext(client));
-        else
-            printRun(payload);
+            throw new Error("--message or a positional message is required.");
+        if (wantsWatch(flags) && hasFlag(flags, "json")) {
+            throw new Error("--json cannot be combined with --watch or --jsonl.");
+        }
+        if (hasFlag(flags, "wait") && wantsWatch(flags)) {
+            throw new Error("--wait cannot be combined with --watch or --jsonl.");
+        }
+        const submitted = await client.sendMessage(runId, message);
+        if (!hasFlag(flags, "wait") && !wantsWatch(flags)) {
+            if (hasFlag(flags, "json")) {
+                printSuccess("runs.message", {
+                    ...publicRunPayload(submitted),
+                    message: submitted.message,
+                    chat_job: submitted.chat_job
+                }, jsonContext(client));
+            }
+            else
+                process.stdout.write(`queued follow-up for run ${runId}\n`);
+            return;
+        }
+        const chatJobId = submitted.chat_job.id;
+        const belongsToFollowup = (event) => event.payload.chat_job_id === chatJobId;
+        const queuedEventId = submitted.events.reduce((latest, event) => event.kind === "chat.queued" && belongsToFollowup(event) ? Math.max(latest, event.id) : latest, 0);
+        const receivedEventId = [...submitted.events]
+            .reverse()
+            .find((event) => event.kind === "message.received" && belongsToFollowup(event))?.id ?? queuedEventId;
+        const cursor = submitted.events.reduce((latest, event) => Math.max(latest, event.id), 0);
+        const completedInResponse = [...submitted.events]
+            .reverse()
+            .find((event) => (event.kind === "chat.completed" || event.kind === "chat.failed") && belongsToFollowup(event));
+        const view = parseActivityView(flagString(flags, "view", "activity"));
+        const jsonl = hasFlag(flags, "jsonl");
+        const controller = new AbortController();
+        const onInterrupt = () => controller.abort();
+        process.once("SIGINT", onInterrupt);
+        if (wantsWatch(flags) && !jsonl)
+            process.stdout.write(`Watching follow-up for run ${runId}. Ctrl-C detaches.\n`);
+        try {
+            const renderFollowupEvent = (event) => {
+                if (!belongsToFollowup(event))
+                    return;
+                if (!wantsWatch(flags) || !shouldRenderEvent(event, view))
+                    return;
+                process.stdout.write(`${jsonl ? formatActivityJsonl(event) : formatActivityLine(event, submitted.run.created_at)}\n`);
+            };
+            for (const event of submitted.events) {
+                if (event.id >= receivedEventId)
+                    renderFollowupEvent(event);
+            }
+            const terminalEvent = completedInResponse ?? await watchEventsUntil(client, runId, {
+                afterEventId: cursor,
+                pageSize: integerFlag(flags, "event-page-size", 200, 1, 500),
+                pollIntervalMs: integerFlag(flags, "poll-interval-ms", 2000, 250, 60_000),
+                timeoutSeconds: integerFlag(flags, "timeout-seconds", 1800, 1, 604_800),
+                signal: controller.signal,
+                stopWhen: (event) => (event.kind === "chat.completed" || event.kind === "chat.failed") && belongsToFollowup(event),
+                onRetry: ({ error, attempt, delayMs }) => {
+                    const detail = error instanceof Error ? error.message : String(error);
+                    process.stderr.write(`Follow-up connection lost (${detail}); retry ${attempt} in ${delayMs}ms.\n`);
+                },
+                onEvent: renderFollowupEvent
+            });
+            const messages = await client.listMessages(runId);
+            if (hasFlag(flags, "json")) {
+                printSuccess("runs.message", {
+                    ...publicRunPayload(submitted),
+                    message: submitted.message,
+                    chat_job: submitted.chat_job,
+                    messages: messages.messages,
+                    followup_event: terminalEvent
+                }, jsonContext(client));
+            }
+            else if (!jsonl) {
+                const assistant = [...messages.messages].reverse().find((item) => item.role === "assistant" && item.payload.chat_job_id === chatJobId);
+                if (assistant)
+                    process.stdout.write(`${assistant.message}\n`);
+            }
+            if (terminalEvent.kind === "chat.failed")
+                process.exitCode = 2;
+        }
+        catch (error) {
+            if (!(error instanceof WatchInterruptedError))
+                throw error;
+            process.stderr.write(`Detached from follow-up for run ${runId}; processing continues.\n`);
+            process.exitCode = 130;
+        }
+        finally {
+            process.off("SIGINT", onInterrupt);
+        }
         return;
     }
     throw new Error(`Unknown runs action: ${action}`);
@@ -733,9 +1107,9 @@ const commandRuns = async (command, flags) => {
 const commandDoctor = async (flags) => {
     const localConfig = readLocalConfig();
     const apiUrl = String(flags["api-url"] || process.env.SANBOX_API_URL || localConfig.api_url || defaultApiUrl).replace(/\/+$/, "");
-    const org = String(flags.org || process.env.SANBOX_ORG || localConfig.org || "").trim();
     const apiKey = process.env.SANBOX_API_KEY || "";
     const selection = readTemplateSelection(flags, { required: false });
+    let resolvedOrg = "";
     const checks = [];
     const nextActions = [];
     const add = (name, ok, detail, data) => checks.push({
@@ -746,11 +1120,7 @@ const commandDoctor = async (flags) => {
     });
     add("node", Number(process.versions.node.split(".")[0]) >= 20, process.version);
     add("api_url", Boolean(apiUrl), apiUrl);
-    add("org", Boolean(org), org || "missing SANBOX_ORG, --org, or .sanbox/config.json org");
     add("api_key", Boolean(apiKey), apiKey ? "present in environment" : "missing SANBOX_API_KEY");
-    if (!org) {
-        nextActions.push(commandAction(["sanbox", "doctor", "--json"], "Select an organization and run the checks again.", { SANBOX_ORG: "<org-slug>" }));
-    }
     if (!apiKey) {
         nextActions.push(commandAction(["sanbox", "doctor", "--json"], "Set a Sanbox control-plane API key and run the checks again.", { SANBOX_API_KEY: "<sanbox-api-key>" }));
     }
@@ -761,58 +1131,58 @@ const commandDoctor = async (flags) => {
     catch (error) {
         add("api_health", false, error instanceof Error ? error.message : String(error));
     }
-    if (org && apiKey) {
-        const client = new SanboxClient({ apiUrl, org, apiKey });
+    if (apiKey) {
+        const client = new SanboxClient({ apiUrl, apiKey });
         try {
-            const me = await client.me();
-            const organizations = Array.isArray(me.organizations)
-                ? me.organizations
-                : [];
+            const organization = await client.organization();
+            resolvedOrg = organization.slug;
             add("auth", true, "authenticated");
-            add("org_visible", organizations.some((item) => item.slug === org), org);
+            add("organization", true, organization.slug, organization);
         }
         catch (error) {
             add("auth", false, error instanceof Error ? error.message : String(error));
         }
-        try {
-            const providers = await client.listModelProviders();
-            add("model_providers", true, providers.providers.map((item) => `${providerId(item)}:${item.status || (item.configured ? "configured" : "not_configured")}`).join(", ") || "none", providers.providers);
-        }
-        catch (error) {
-            add("model_providers", false, error instanceof Error ? error.message : String(error));
-        }
-        if (!selection) {
-            add("template", false, "not selected; use --template, SANBOX_TEMPLATE, or .sanbox/config.json default_template");
-            nextActions.push(...templateActions());
-        }
-        else {
+        if (resolvedOrg) {
             try {
-                const template = await client.getTemplate(selection.id);
-                add("template", true, `${template.template.id}; source=${selection.source}`, template.template);
+                const providers = await client.listModelProviders();
+                add("model_providers", true, providers.providers.map((item) => `${providerId(item)}:${item.status || (item.configured ? "configured" : "not_configured")}`).join(", ") || "none", providers.providers);
+            }
+            catch (error) {
+                add("model_providers", false, error instanceof Error ? error.message : String(error));
+            }
+            if (!selection) {
+                add("template", false, "not selected; use --template, SANBOX_TEMPLATE, or .sanbox/config.json default_template");
+                nextActions.push(...templateActions());
+            }
+            else {
                 try {
-                    const validation = await client.validateTemplate(selection.id);
-                    const runnable = validationRunnable(validation);
-                    add("template_readiness", runnable, runnable ? "ready" : "blocked", validation);
-                    if (!runnable) {
-                        nextActions.push(commandAction(["sanbox", "model-providers", "list", "--json"], "Inspect model-provider status."), providerConsoleAction(client));
+                    const template = await client.getTemplate(selection.id);
+                    add("template", true, `${template.template.id}; source=${selection.source}`, template.template);
+                    try {
+                        const validation = await client.validateTemplate(selection.id);
+                        const runnable = validationRunnable(validation);
+                        add("template_readiness", runnable, runnable ? "ready" : "blocked", validation);
+                        if (!runnable) {
+                            nextActions.push(commandAction(["sanbox", "model-providers", "list", "--json"], "Inspect model-provider status."), providerConsoleAction(client));
+                        }
+                    }
+                    catch (error) {
+                        add("template_readiness", false, error instanceof Error ? error.message : String(error));
                     }
                 }
                 catch (error) {
-                    add("template_readiness", false, error instanceof Error ? error.message : String(error));
+                    add("template", false, error instanceof Error ? error.message : String(error));
+                    nextActions.push(...templateActions());
                 }
             }
-            catch (error) {
-                add("template", false, error instanceof Error ? error.message : String(error));
-                nextActions.push(...templateActions());
-            }
         }
     }
     try {
-        const preview = await previewTaskDossier({ cwd: cwd(), include: ["README.md"] });
-        add("bundle_preview", true, `${preview.files.length} file(s), ${formatBytes(preview.totalBytes)}`);
+        const preview = await previewInputs({ cwd: cwd(), inputs: ["README.md"] });
+        add("input_preview", true, `${preview.files.length} file(s), ${formatBytes(preview.totalBytes)}`);
     }
     catch (error) {
-        add("bundle_preview", false, error instanceof Error ? error.message : String(error));
+        add("input_preview", false, error instanceof Error ? error.message : String(error));
     }
     const output = {
         ok: checks.every((check) => check.ok),
@@ -820,7 +1190,7 @@ const commandDoctor = async (flags) => {
         checks
     };
     if (hasFlag(flags, "json")) {
-        printSuccess("doctor", output, { api_url: apiUrl, ...(org ? { org } : {}) }, nextActions);
+        printSuccess("doctor", output, { api_url: apiUrl, ...(resolvedOrg ? { org: resolvedOrg } : {}) }, nextActions);
     }
     else {
         for (const check of checks) {
@@ -830,55 +1200,6 @@ const commandDoctor = async (flags) => {
     if (!output.ok)
         process.exitCode = 2;
 };
-const commandBundle = async (command, flags) => {
-    const action = command[1];
-    if (action === "preview") {
-        const preview = await previewTaskDossier({ cwd: cwd(), include: flagList(flags, "include") });
-        if (hasFlag(flags, "json"))
-            printSuccess("bundle.preview", preview, localJsonContext(flags));
-        else
-            printPreview(preview, hasFlag(flags, "verbose"));
-        return;
-    }
-    if (action === "create") {
-        const task = bundleTask(command, flags);
-        const outPath = flagString(flags, "out");
-        if (!task)
-            throw new Error("bundle create requires a positional task or --task.");
-        if (!outPath)
-            throw new Error("bundle create requires --out.");
-        const dossier = await writeTaskDossier({
-            cwd: cwd(),
-            task,
-            include: flagList(flags, "include"),
-            cliVersion: version,
-            outPath: path.resolve(cwd(), outPath)
-        });
-        const output = { path: outPath, sha256: dossier.sha256, files: dossier.files, bytes: dossier.buffer.byteLength };
-        if (hasFlag(flags, "json"))
-            printSuccess("bundle.create", output, localJsonContext(flags));
-        else
-            process.stdout.write(`Wrote ${outPath} with ${dossier.files.length} files (${formatBytes(dossier.buffer.byteLength)})\n`);
-        return;
-    }
-    if (action === "inspect") {
-        const bundlePath = command[2] || flagString(flags, "dossier") || flagString(flags, "bundle");
-        if (!bundlePath)
-            throw new Error("bundle inspect requires a ZIP path.");
-        const inspection = await inspectDossierFile(path.resolve(cwd(), bundlePath));
-        if (hasFlag(flags, "json")) {
-            printSuccess("bundle.inspect", inspection, localJsonContext(flags));
-            return;
-        }
-        process.stdout.write(`Entries: ${inspection.entries.length}\n`);
-        if (inspection.manifest)
-            process.stdout.write("manifest.json: present\n");
-        if (inspection.runbook)
-            process.stdout.write(`RUNBOOK.md: ${inspection.runbook.split(/\r?\n/)[0] || "present"}\n`);
-        return;
-    }
-    throw new Error("bundle requires action: preview, create, or inspect.");
-};
 const commandInit = async (command, flags) => {
     const dir = path.join(cwd(), ".sanbox");
     if (command[1] === "agent") {
@@ -906,11 +1227,9 @@ const commandInit = async (command, flags) => {
     const force = hasFlag(flags, "force");
     const localConfig = readLocalConfig();
     const apiUrl = String(flags["api-url"] || process.env.SANBOX_API_URL || localConfig.api_url || defaultApiUrl).replace(/\/+$/, "");
-    const org = String(flags.org || process.env.SANBOX_ORG || localConfig.org || "").trim();
     const template = readTemplateSelection(flags, { required: false });
     const config = {
         api_url: apiUrl,
-        org,
         ...(template ? { default_template: template.id } : {})
     };
     const sanboxIgnore = [
@@ -931,7 +1250,7 @@ const commandInit = async (command, flags) => {
         printSuccess("init", {
             files: results.map(([file, status]) => ({ file, status })),
             template_selection: template
-        }, { api_url: apiUrl, ...(org ? { org } : {}) }, template ? [] : templateActions());
+        }, { api_url: apiUrl }, template ? [] : templateActions());
     }
     else {
         for (const [file, status] of results)
@@ -941,8 +1260,6 @@ const commandInit = async (command, flags) => {
 const helpFor = (command) => {
     if (command[0] === "run")
         return runHelp;
-    if (command[0] === "bundle")
-        return bundleHelp;
     if (command[0] === "doctor")
         return doctorHelp;
     if (command[0] === "model-providers")
@@ -952,6 +1269,8 @@ const helpFor = (command) => {
     return help;
 };
 const commandId = (command) => {
+    if (command[0] === "version" || command.length === 0)
+        return "version";
     if (command[0] === "auth")
         return "auth.check";
     if (command[0] === "context")
@@ -964,13 +1283,22 @@ const commandId = (command) => {
         return "run.create";
     if (command[0] === "batch")
         return "batch.create";
-    if (command[0] === "bundle")
-        return `bundle.${command[1] || "unknown"}`;
     if (command[0] === "runs")
         return `runs.${command[1] || "unknown"}`;
     return command[0] || "help";
 };
 const main = async (command, flags) => {
+    validateFlagValues(flags);
+    normalizeInputAlias(command, flags);
+    validateFlags(command, flags);
+    validatePositionals(command, flags);
+    if (command[0] === "version" || (command.length === 0 && hasFlag(flags, "version"))) {
+        if (hasFlag(flags, "json"))
+            printSuccess("version", { version });
+        else
+            process.stdout.write(`${version}\n`);
+        return;
+    }
     if (command.length === 0) {
         process.stdout.write(help);
         return;
@@ -993,8 +1321,6 @@ const main = async (command, flags) => {
         return commandRun(command, flags);
     if (command[0] === "batch")
         return commandBatch(flags);
-    if (command[0] === "bundle")
-        return commandBundle(command, flags);
     if (command[0] === "runs")
         return commandRuns(command, flags);
     if (command[0] === "init")