@secondlayer/sentinel 0.4.0 → 0.6.0

package/dist/cli.js

@@ -85,6 +85,13 @@ class SentinelError extends Error {
     this.name = "SentinelError";
   }
 }
+var runInProgress = (status) => status === "queued" || status === "running";
+function runPhase(run) {
+  if (run.status === "queued")
+    return "queued";
+  const last = run.events.at(-1);
+  return last ? [last.name ?? last.kind, last.state].filter(Boolean).join(" ") : "starting";
+}
 var rowsOf = (intents) => intents.flatMap((i) => i.rows);
 var subjectKey = (s) => s.kind === "fn" ? `fn:${s.fn}` : s.kind === "group" ? `group:${s.group}` : `asset:${s.asset}`;
 var CONTROL_NAME = "Control changes";
@@ -191,10 +198,30 @@ function mutedUntilOf(w, now = Date.now()) {
   const at = w.delivery.mutedUntil;
   return at && Date.parse(at) > now ? at : null;
 }
+function changeText(c) {
+  const name = c.subject.kind === "asset" ? subjectName(c.subject, c.units) : c.watch.title;
+  const rule = (r) => ruleSummary(r, c.units);
+  switch (c.action) {
+    case "on":
+      return `${c.watch.title} turned on`;
+    case "off":
+      return `${c.watch.title} turned off`;
+    case "muted":
+    case "cooldown":
+      return `${c.watch.title}: ${c.action === "muted" ? "mute" : "cooldown"} ${c.note ?? ""}`.trim();
+    case "applied":
+      if (c.prevRule && c.rule)
+        return `${name} rule changed: ${rule(c.prevRule)} → ${rule(c.rule)}`;
+      return c.rule ? `${name} rule set: ${rule(c.rule)}` : `${name} rule set`;
+  }
+}
 function createClient(opts) {
   const baseUrl = (opts.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
   const doFetch = opts.fetch ?? globalThis.fetch;
-  const authHeader = () => ({ authorization: `Bearer ${opts.token}` });
+  const authHeader = () => ({
+    authorization: `Bearer ${opts.token}`,
+    ...opts.client ? { "x-sentinel-client": opts.client } : {}
+  });
   async function call(method, path, body) {
     const res = await doFetch(`${baseUrl}${path}`, {
       method,
@@ -211,6 +238,7 @@ function createClient(opts) {
   }
   const plan = (id) => `/v1/plans/${encodeURIComponent(id)}`;
   const appPlan = (id) => `/plan/${encodeURIComponent(id)}`;
+  const appProject = (id) => `/projects/${encodeURIComponent(id)}`;
   return {
     me: () => call("GET", "/v1/me"),
     plans: async () => (await call("GET", "/v1/plans")).plans,
@@ -226,6 +254,8 @@ function createClient(opts) {
     testsFromRepo: (id) => call("POST", `${appPlan(id)}/tests`, { fromRepo: true }),
     previewPlan: (contractId) => call("POST", "/plan/preview", { contractId }),
     createPlan: (contractId) => call("POST", "/plan", { contractId }),
+    previewImport: (url) => call("POST", "/projects/import/preview", { url }),
+    importRepo: (input) => call("POST", "/projects/import", input),
     billing: () => call("GET", "/billing"),
     watches: (planId) => call("GET", `${appPlan(planId)}/watches`),
     setRule: (planId, watchId, rule) => call("POST", `${appPlan(planId)}/watches/${encodeURIComponent(watchId)}/rule`, { rule }),
@@ -242,9 +272,70 @@ function createClient(opts) {
     watchContract: (contractId) => call("POST", "/contracts/watch", {
       contractId
     }),
-    stopMonitoring: (planId) => call("DELETE", `${appPlan(planId)}/monitor`)
+    stopMonitoring: (planId) => call("DELETE", `${appPlan(planId)}/monitor`),
+    watchActivity: (planId, intentId, opts = {}) => call("GET", `${appPlan(planId)}/watches/${encodeURIComponent(intentId)}/activity${query(opts)}`),
+    functions: async (planId) => (await call("GET", `${appPlan(planId)}/functions`)).functions,
+    functionActivity: (planId, fn) => call("GET", `${appPlan(planId)}/functions/${encodeURIComponent(fn)}/activity`),
+    alertPreview: (planId, example) => call("GET", `${appPlan(planId)}/alert-preview${query({ example })}`),
+    threshold: (planId, asset) => call("GET", `${appPlan(planId)}/watches/asset/${encodeURIComponent(asset)}/threshold`),
+    setThreshold: (planId, asset, amount) => call("POST", `${appPlan(planId)}/watches/asset/${encodeURIComponent(asset)}/threshold`, { amount }),
+    retryHistory: (planId) => call("POST", `${appPlan(planId)}/history/retry`, {}),
+    readAlert: (alertId) => call("POST", `/alerts/${encodeURIComponent(alertId)}/read`),
+    readAllAlerts: () => call("POST", "/alerts/read-all"),
+    ask: (q) => call("POST", "/ask", { q }),
+    acknowledge: (planId, finding, title, reason, note = null) => call("POST", `${appPlan(planId)}/acknowledge`, {
+      finding,
+      title,
+      reason,
+      note
+    }),
+    reopen: (planId, finding, title) => call("POST", `${appPlan(planId)}/reopen`, { finding, title }),
+    ackHistory: async (planId) => (await call("GET", `${appPlan(planId)}/acks`)).events,
+    notes: async (planId, finding) => (await call("GET", `${appPlan(planId)}/findings/${finding}/notes`)).notes,
+    addNote: (planId, finding, title, body) => call("POST", `${appPlan(planId)}/findings/${finding}/notes`, {
+      title,
+      body
+    }),
+    tests: (planId, files) => call("POST", `${appPlan(planId)}/tests`, { files }),
+    fuzzCheck: (planId, harness) => call("POST", `${appPlan(planId)}/fuzzcheck`, { harness }),
+    fuzz: (planId, invariants) => call("POST", `${appPlan(planId)}/fuzz`, { invariants }),
+    latestCommit: (planId) => call("GET", `${appPlan(planId)}/latest`),
+    updatePlan: (planId, commit) => call("POST", `${appPlan(planId)}/update`, commit ? { commit } : {}),
+    setAutoPlan: (planId, auto) => call("POST", `${appPlan(planId)}/wait`, { auto }),
+    setLink: (planId, dependency, url) => call("POST", `${appPlan(planId)}/link`, { id: dependency, url }),
+    planLinked: (planId) => call("POST", `${appPlan(planId)}/plan-linked`, {}),
+    renameContract: (planId, name) => call("POST", `${appPlan(planId)}/settings`, { name }),
+    removeContract: (planId, confirm) => call("POST", `${appPlan(planId)}/remove`, {
+      confirm
+    }),
+    projects: () => call("GET", "/projects"),
+    project: (projectId) => call("GET", appProject(projectId)),
+    projectOverview: (projectId, opts = {}) => call("GET", `${appProject(projectId)}/overview${opts.watches ? "?watches=1" : ""}`),
+    renameProject: (projectId, name) => call("POST", `${appProject(projectId)}/rename`, { name }),
+    removeProject: (projectId, confirm) => call("POST", `${appProject(projectId)}/remove`, {
+      confirm
+    }),
+    answerMergeSuggestion: (from, into, accept) => call("POST", "/projects/merge", { from, into, accept }),
+    mergeProject: (projectId, into) => call("POST", `${appProject(projectId)}/merge-into`, { into }),
+    moveProjectContract: (projectId, contractId, into) => call("POST", `${appProject(projectId)}/contracts/${encodeURIComponent(contractId)}/move`, { into }),
+    removeProjectContract: (projectId, contractId, confirm) => call("POST", `${appProject(projectId)}/contracts/${encodeURIComponent(contractId)}/remove`, { confirm }),
+    previewProjectContract: (projectId, contractId) => call("POST", `${appProject(projectId)}/contracts/preview`, { contractId }),
+    addProjectContract: (projectId, contractId, opts = {}) => call("POST", `${appProject(projectId)}/contracts`, { contractId, ...opts }),
+    setProjectDestinations: (projectId, dest) => call("POST", `${appProject(projectId)}/destinations`, dest),
+    setProjectMonitoring: (projectId, on) => call("POST", `${appProject(projectId)}/monitoring`, { on }),
+    projectWatches: (projectId) => call("GET", `${appProject(projectId)}/watches`),
+    projectActivity: (projectId, intentId, opts = {}) => call("GET", `${appProject(projectId)}/watches/${encodeURIComponent(intentId)}/activity${query(opts)}`),
+    projectChanges: (projectId, opts = {}) => call("GET", `${appProject(projectId)}/changes${query(opts)}`)
   };
 }
+function query(params) {
+  const q = new URLSearchParams;
+  for (const [k, v] of Object.entries(params))
+    if (v !== undefined && v !== null)
+      q.set(k, String(v));
+  const s = q.toString();
+  return s ? `?${s}` : "";
+}
 var HOUR_MS = 3600000;
 var muteEnd = (hours) => new Date(Date.now() + Math.min(hours * HOUR_MS, 7 * 24 * HOUR_MS - 60000)).toISOString();
 async function watchContext(client, planId) {
@@ -418,6 +509,9 @@ async function whoami(client, io) {
   return 0;
 }
 
+// cli/sentinel.ts
+import { readFileSync } from "node:fs";
+
 // client/kind.ts
 var isGreen = (f) => f.poc === "green";
 function findingKind(f) {
@@ -432,7 +526,7 @@ function findingKind(f) {
 }
 var URGENT_CONSEQUENCES = new Set(["authority", "code", "value"]);
 var KIND_LABEL = {
-  exploitable: "Exploitable",
+  exploitable: "Reproducible",
   trust: "Trust assumption",
   worth_a_look: "Worth a look",
   refuted: "refuted"
@@ -494,9 +588,9 @@ function assertionsOf(output) {
 var FENCE = "```";
 var FOOTER = "Sentinel's findings are a starting point for your own review, not an audit sign-off.";
 var KIND_LINE = {
-  exploitable: "Exploitable (verified, re-verified, reproduced in the sandbox)",
+  exploitable: "Reproducible (verified, re-verified, reproduced in the sandbox)",
   trust: "Trust assumption (watched: Sentinel alerts when it's used)",
-  worth_a_look: "Worth a look (not proven exploitable)",
+  worth_a_look: "Worth a look (not reproduced)",
   refuted: "Refuted"
 };
 var tick = (s) => `\`${s}\``;
@@ -587,16 +681,16 @@ function issueMd(f, withCondition) {
     "## The issue",
     f.headline && f.headline !== f.title ? `${f.headline} (${f.title})` : f.title,
     ...f.blastRadius ? ["", `**Impact:** ${f.blastRadius}`] : [],
-    ...withCondition && f.precondition ? ["", `**Exploitable when:** ${f.precondition}`] : [],
+    ...withCondition && f.precondition ? ["", `**Reproduces when:** ${f.precondition}`] : [],
     ""
   ];
 }
 function prelaunchBrief(f, ctx, kind) {
-  const kindLine = kind === "exploitable" ? "Exploitable · look before launch" : kind === "trust" ? "Trust assumption" : "Worth a look before launch";
+  const kindLine = kind === "exploitable" ? "Reproducible · look before launch" : kind === "trust" ? "Trust assumption" : "Worth a look before launch";
   return [
     "# Task: review a Sentinel finding on pre-launch code",
     "",
-    `Sentinel found an issue${f.targetFn ? ` in ${tick(f.targetFn)}` : ""}: ${f.title}. PoCs and exploit detail open once Sentinel confirms this code isn't already live on mainnet; possible approaches are shown now, so this brief carries the finding and a direction, not the PoC. Look at the code before launch: the watch arms at launch, but it isn't a substitute for the review.`,
+    `Sentinel found an issue${f.targetFn ? ` in ${tick(f.targetFn)}` : ""}: ${f.title}. PoCs and reproduction detail open once Sentinel confirms this code isn't already live on mainnet; possible approaches are shown now, so this brief carries the finding and a direction, not the PoC. Look at the code before launch: the watch arms at launch, but it isn't a substitute for the review.`,
     "",
     "## Start here",
     `1. ${where(f, ctx)}`,
@@ -628,7 +722,7 @@ function trustBrief(f, ctx) {
     `2. Find every place that reads what ${f.targetFn ? tick(f.targetFn) : "this power"} changes, and show each one, so the reach of this power is clear.`,
     "3. Only then discuss options that fit this codebase's design.",
     "",
-    ...reportBackMd(ctx, "- There is no PoC for a trust assumption. Don't write an exploit for it."),
+    ...reportBackMd(ctx, "- There is no PoC for a trust assumption. Don't write a PoC for it."),
     ...contextMd(f, ctx, "trust"),
     "- Class: trust assumption (a power held by design)",
     "- Evidence: checked by Sentinel's adversarial verifier. No PoC; nothing to run.",
@@ -750,6 +844,9 @@ var USAGE = `sentinel <command>
   logout                      forget the saved login (also signs the secondlayer CLI out)
   whoami                      who you are and where the credential came from
   new <contract> [--yes]      plan a contract: see what it would do and cost; --yes starts it
+  import <repo-url> [--only a,b] [--all] [--project <id>|new] [--yes]
+                              plan a public Clarinet repo's contracts into one project: see each one and the
+                              cost (the suggested ones, unless --only or --all); --yes imports them
   balance                     your balance and what a plan, a deep run and a monitored event cost
   alerts [--contract <id>]    your alerts, newest first
 
@@ -758,7 +855,7 @@ var USAGE = `sentinel <command>
   finding <id> <n> [--poc] [--run] [--brief] [--json]   one finding; --poc adds the PoC source, --run the command
                               to re-run it, --brief the agent brief (the finding page's "Copy agent brief")
   runs <id>                   follow-up runs on a plan
-  watch <id>                  follow running runs until none are left
+  watch <id>                  follow running (and queued) runs until none are left
   reverify <id> [--yes]       check a plan's leads again (stronger second pass, $3); only starts with --yes
 
 paid runs on a plan you own (each starts only with --yes; without it you see what it would do):
@@ -766,10 +863,44 @@ paid runs on a plan you own (each starts only with --yes; without it you see wha
   challenge <plan> <n> "<reason>" [--yes]    re-verify finding n against your argument
   replay <plan> <n> [--yes]                  re-run finding n's stored PoC
   directed <plan> "<what to watch>" [--yes]  re-plan around what you want watched
-  tests <plan> --from-repo [--yes]           run the Clarinet suite from a pre-launch plan's repo
+  tests <plan> --from-repo|<file>... [--yes] run the Clarinet suite from a pre-launch plan's repo, or your test files
+  fuzz <plan> <invariants.clar> [--yes]      compile-check the invariants (free); --yes fuzzes them in the sandbox
+
+your plans and findings (owners; a write only happens with --yes):
+  latest <plan>                              whether a pre-launch plan's branch moved on, and what an update reviews
+  update <plan> [--commit <sha>] [--yes]     plan the latest commit (or --commit): free while monitoring is on
+  auto-plan <plan> on|off [--yes]            plan a waiting plan on its own once the contracts it waits on deploy
+  link <plan> <contract> <url>|--clear [--yes]   link code for a contract the plan waits on
+  plan-linked <plan> [--yes]                 plan now with the linked code (a paid plan)
+  name <plan> "<name>" [--yes]               your own name for the contract ("" clears it)
+  remove <plan> --confirm <name> [--yes]     take the contract off your account: monitoring, alerts and claim
+  ack <plan> <n> accepted|fixed|disagree [--note "<text>"] [--yes]   label finding n for your team
+  reopen <plan> <n> [--yes]                  put an acknowledged finding back on the list
+  acks <plan>                                every acknowledgement change on the contract
+  notes <plan> <n>                           your notes on finding n
+  note <plan> <n> "<text>" [--yes]           add a note to finding n
+  ask "<question>"                           an answer from Sentinel's docs
+
+projects (the contracts of one protocol; a write only happens with --yes):
+  projects [--json]                                  your projects and the merges Sentinel suggests
+  projects show <project> [--json]                   its contracts, each one's plan and monitoring
+  projects overview <project> [--watches]            the project, its plans and (--watches) watches, as JSON
+  projects add <project> <contract> [--into <project>|new] [--yes]   where it would go; --yes plans it (paid)
+  projects rename <project> "<name>" [--yes]
+  projects merge <project> <into> [--yes]            move every contract into another of your projects
+  projects suggestion <from> <into> accept|dismiss [--yes]   answer a merge Sentinel suggested
+  projects move <project> <contract> <into>|new [--yes]
+  projects remove-contract <project> <contract> [--confirm <name>] [--yes]   a contract you added needs --confirm
+  projects remove <project> --confirm "<name>" [--yes]   every contract you added in it, and the project
+  projects watches <project> [--json]                the project's watches as one list
+  projects activity <project> <watch> [--contract <id>] [--window 7|90] [--json]
+  projects changes <project> [--watch <watch>] [--mutes] [--limit N] [--cursor C] [--json]   who turned watches on/off or changed rules
+  projects destinations <project> [--email on|off] [--webhook URL] [--slack URL] [--yes]   a URL left out is cleared
+  projects monitoring <project> on|off [--yes]
 
-A key needs Plans & findings (read for the above, write for new and the runs above); monitoring commands need Monitoring
-(read to look, write to change); mute-alert needs Alerts: write.
+A key needs Plans & findings (read for the above, write for new, the runs and changes above, and project changes);
+monitoring commands and a project's watches, destinations and monitoring need Monitoring (read to look, write to
+change); mute-alert and mark-read need Alerts: write.
 
 monitoring (a write only happens with --yes; without it you see what would change):
   watches <plan> [--json]                        subjects, rules, status, mutes
@@ -783,23 +914,42 @@ monitoring (a write only happens with --yes; without it you see what would chang
   test-alert <plan> [--yes]                      a sample alert to every saved destination
   follow <contract> [--yes]                      start monitoring a deployed contract
   unfollow <contract> [--yes]
+  activity <plan> <watch> [--window 7|90] [--json]   what a watch saw (<watch>: its title or id) and what alerted
+  functions <plan> [<fn>] [--json]               every public function and its watch; with <fn>, what a watch
+                                                 on it would have seen
+  alert-preview <plan> [--example money_out|finding]   a sample alert as email and Slack get it
+  threshold <plan> <asset> [<amount>] [--yes]    an asset's Money out limit; with <amount> (base units), set it
+  retry-history <plan> [--yes]                   read the watches' history again after a failed read
+  mark-read <alert>|--all [--yes]                mark one alert, or every alert, read
 
 <subject> is a function name or a token symbol, as the watches command shows it.
 
 credential: SENTINEL_API_KEY, then --token <key>, then sentinel login. env: SENTINEL_API_URL
 `;
 var POLL_MS = 5000;
-var VALUE_FLAGS = new Set(["--email", "--webhook", "--slack", "--contract"]);
+var VALUE_FLAGS = new Set([
+  "--email",
+  "--webhook",
+  "--slack",
+  "--contract",
+  "--only",
+  "--project",
+  "--confirm",
+  "--note",
+  "--commit",
+  "--into",
+  "--window",
+  "--example",
+  "--watch",
+  "--limit",
+  "--cursor"
+]);
 var cell2 = (v, empty = "—") => v === null || v === undefined || v === "" ? empty : String(v);
 var table = (rows) => {
   const text = rows.map((r) => r.map((c) => cell2(c)));
   const w = text[0]?.map((_, i) => Math.max(...text.map((r) => r[i].length))) ?? [];
   return text.map((r) => r.map((c, i) => c.padEnd(w[i])).join("  ").trimEnd());
 };
-var phaseOf = (r) => {
-  const last = r.events.at(-1);
-  return last ? [last.name ?? last.kind, last.state].filter(Boolean).join(" ") : "starting";
-};
 var verdictLine = (p) => {
   const r = p.report;
   const head = `${p.contractId}  ${p.status}`;
@@ -837,7 +987,10 @@ ${USAGE}` : USAGE);
     "--from-repo",
     "--poc",
     "--run",
-    "--brief"
+    "--brief",
+    "--all",
+    "--clear",
+    "--watches"
   ]);
   if (flags.some((f) => !known.has(f)))
     return usage(`Unknown flag ${flags.find((f) => !known.has(f))}`);
@@ -949,7 +1102,7 @@ No run command: no PoC is stored for this finding.`);
           r.id,
           r.kind,
           r.status,
-          r.status === "running" ? phaseOf(r) : r.finishedAt ?? ""
+          runInProgress(r.status) ? runPhase(r) : r.finishedAt ?? ""
         ])))
           io.out(l);
         return 0;
@@ -964,9 +1117,9 @@ No run command: no PoC is stored for this finding.`);
         const sleep = io.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
         const seen = new Map;
         for (;; ) {
-          const running = (await io.client.runs(id)).filter((r) => r.status === "running");
+          const running = (await io.client.runs(id)).filter((r) => runInProgress(r.status));
           for (const r of running) {
-            const phase = phaseOf(r);
+            const phase = runPhase(r);
             if (seen.get(r.id) !== phase) {
               seen.set(r.id, phase);
               io.out(`${r.kind} ${r.id}: ${phase}`);
@@ -1019,6 +1172,8 @@ No run command: no PoC is stored for this finding.`);
         io.out(`Follow it with: sentinel runs ${r.planId}`);
         return 0;
       }
+      case "import":
+        return await importRepo(args.slice(1), flags, values, io, usage);
       case "balance": {
         const b = await io.client.billing();
         if (json)
@@ -1051,6 +1206,39 @@ No run command: no PoC is stored for this finding.`);
       case "directed":
       case "tests":
         return await ownerRun(cmd, args.slice(1), flags, io, usage);
+      case "fuzz":
+        return await fuzz(args.slice(1), flags, io, usage);
+      case "latest":
+      case "update":
+      case "auto-plan":
+      case "link":
+      case "plan-linked":
+      case "name":
+      case "remove":
+      case "ack":
+      case "reopen":
+      case "acks":
+      case "notes":
+      case "note":
+        return await upkeep(cmd, args.slice(1), flags, values, io, usage);
+      case "ask": {
+        if (!id)
+          return usage("sentinel ask needs a question, in quotes");
+        const a = await io.client.ask(args.slice(1).join(" "));
+        io.out(a.answer);
+        if (a.sources.length)
+          io.out(`Sources: ${a.sources.join(", ")}`);
+        return 0;
+      }
+      case "projects":
+        return await projects(args.slice(1), flags, values, io, usage);
+      case "activity":
+      case "functions":
+      case "alert-preview":
+      case "threshold":
+      case "retry-history":
+      case "mark-read":
+        return await monitoringMore(cmd, args.slice(1), flags, values, io, usage);
       case "watches":
       case "rule":
       case "mute":
@@ -1071,6 +1259,64 @@ No run command: no PoC is stored for this finding.`);
 }
 var usd = (n) => `$${n.toFixed(2)}`;
 var RUN_NOTE = "A paid run from your balance, charged only if it finishes.";
+async function importRepo(pos, flags, values, io, usage) {
+  const [url] = pos;
+  if (!url)
+    return usage("sentinel import needs a GitHub repo link");
+  const only = values["--only"]?.split(",").map((n) => n.trim()).filter(Boolean);
+  if (only && flags.includes("--all"))
+    return usage("Use --only or --all, not both");
+  const p = await io.client.previewImport(url);
+  const picked = only ? only : p.contracts.filter((c) => flags.includes("--all") || c.suggested).map((c) => c.name);
+  const missing = picked.filter((n) => !p.contracts.some((c) => c.name === n));
+  if (missing.length)
+    return usage(`Not in ${p.repo} at ${p.commit.slice(0, 7)}: ${missing.join(", ")}`);
+  io.out(`${p.owner}/${p.repo}${p.root ? `/${p.root}` : ""} @ ${p.commit.slice(0, 7)} (${p.ref})`);
+  for (const l of table([
+    [" ", "NAME", "DEPS", "STATE", "SUGGESTED"],
+    ...p.contracts.map((c) => [
+      picked.includes(c.name) ? "+" : " ",
+      c.name,
+      c.deps.join(",") || "—",
+      c.state,
+      c.suggested ? "yes" : `no (${c.why})`
+    ])
+  ]))
+    io.out(l);
+  if (p.cycle)
+    io.out("These contracts call each other in a loop: listed in manifest order.");
+  for (const s of p.skipped)
+    io.out(`Skipped ${s.path}: ${s.reason}`);
+  for (const d of p.mainnetMatch.deployers)
+    io.out(`Live on mainnet under ${d.deployer}: ${d.files.map((f) => `${f.name} (${f.kind} match of ${f.contractId})`).join(", ")}`);
+  if (picked.length === 0) {
+    io.out("Nothing to import. Pick contracts with --only a,b or --all.");
+    return 0;
+  }
+  const fresh = p.contracts.filter((c) => picked.includes(c.name) && c.state === "new").length;
+  io.out(fresh === 0 ? `Importing ${picked.length}: no new plan, nothing to pay.` : p.cost.runUsdMicros === null ? `Importing ${picked.length}: ${fresh} new plan${fresh === 1 ? "" : "s"}. Billing isn't linked: the free daily plan limit applies.` : `Importing ${picked.length}: ${fresh} new plan${fresh === 1 ? "" : "s"}, ${usd(p.cost.runUsdMicros * fresh / 1e6)}, each charged only if it finishes.`);
+  if (fresh > p.runsAtOnce)
+    io.out(`Plans run ${p.runsAtOnce} at a time; the rest wait their turn (queued).`);
+  const project = values["--project"];
+  if (!flags.includes("--yes")) {
+    const tail = [
+      only ? `--only ${only.join(",")}` : flags.includes("--all") ? "--all" : "",
+      project ? `--project ${project}` : ""
+    ].filter(Boolean).join(" ");
+    io.out(`Run again with --yes to import: sentinel import ${url}${tail ? ` ${tail}` : ""} --yes`);
+    return 0;
+  }
+  const r = await io.client.importRepo({ url, commit: p.commit, contracts: picked, project });
+  io.out(`Project: ${r.projectId ?? "—"}`);
+  for (const x of r.plans)
+    io.out(`${x.name}  ${x.status === "kept" ? "already in the project" : x.cached ? "already planned" : x.status === "queued" ? "queued" : "started"}  ${x.planId ?? "—"}`);
+  for (const x of r.notStarted ?? [])
+    io.out(`${x.name}  not started: ${x.error}`);
+  const first = r.plans.find((x) => x.planId)?.planId;
+  if (first)
+    io.out(`Follow a plan with: sentinel runs ${first}`);
+  return 0;
+}
 async function ownerRun(cmd, pos, flags, io, usage) {
   const [planId, second, third] = pos;
   if (!planId)
@@ -1085,16 +1331,19 @@ async function ownerRun(cmd, pos, flags, io, usage) {
     return usage("sentinel challenge needs a reason, in quotes");
   if (cmd === "directed" && !second)
     return usage("sentinel directed needs what to watch, in quotes");
-  if (cmd === "tests" && !flags.includes("--from-repo"))
-    return usage("sentinel tests needs --from-repo (a pre-launch plan's repo tests)");
+  const fromRepo = flags.includes("--from-repo");
+  const testPaths = cmd === "tests" ? pos.slice(1) : [];
+  if (cmd === "tests" && fromRepo === testPaths.length > 0)
+    return usage("sentinel tests needs --from-repo (a pre-launch plan's repo tests) or your test files");
+  const files = testPaths.map((path) => ({ path, content: readLocal(io, path) }));
   const willDo = {
     reproduce: `Write and run a PoC for finding ${finding} in the airgapped sandbox (never touches mainnet).`,
     replay: `Re-run finding ${finding}'s stored PoC in the airgapped sandbox.`,
     challenge: `Re-verify finding ${finding} against your argument.`,
     directed: "Re-plan this contract around what you asked to have watched.",
-    tests: "Run the Clarinet suite from this pre-launch plan's repo in the airgapped sandbox."
+    tests: fromRepo ? "Run the Clarinet suite from this pre-launch plan's repo in the airgapped sandbox." : `Run ${files.length} test file(s) against this plan's contract in the airgapped sandbox.`
   }[cmd];
-  const flagTail = cmd === "tests" ? " --from-repo" : "";
+  const flagTail = cmd === "tests" ? fromRepo ? " --from-repo" : ` ${testPaths.join(" ")}` : "";
   const quoted = (v) => v ? ` ${JSON.stringify(v)}` : "";
   const argTail = {
     reproduce: ` ${finding}`,
@@ -1114,7 +1363,7 @@ async function ownerRun(cmd, pos, flags, io, usage) {
     replay: () => io.client.replay(planId, finding),
     challenge: () => io.client.challenge(planId, finding, third),
     directed: () => io.client.directed(planId, second),
-    tests: () => io.client.testsFromRepo(planId)
+    tests: () => fromRepo ? io.client.testsFromRepo(planId) : io.client.tests(planId, files)
   }[cmd]();
   io.out(`${r.existing ? "Already running" : "Started"}: ${r.planId}`);
   return 0;
@@ -1276,6 +1525,571 @@ async function monitoring(cmd, pos, on, flags, values, io, usage) {
   io.out(mute ? `Muted ${g.name} until ${mutedUntil}` : `Unmuted ${g.name}.`);
   return 0;
 }
+function readLocal(io, path) {
+  try {
+    return (io.readFile ?? ((p) => readFileSync(p, "utf8")))(path);
+  } catch (e) {
+    throw new SentinelError(0, `Can't read ${path}: ${e.message}`);
+  }
+}
+var SHA = /^[0-9a-f]{40}$/;
+var short = (sha) => sha.slice(0, 7);
+var onOff = (v) => v === "on" ? true : v === "off" ? false : null;
+async function fuzz(pos, flags, io, usage) {
+  const [planId, file] = pos;
+  if (!planId || !file)
+    return usage("sentinel fuzz needs a plan id and an invariants file");
+  const harness = readLocal(io, file);
+  const check = await io.client.fuzzCheck(planId, harness);
+  if (!check.ok) {
+    io.err(`The invariants don't compile: ${check.message ?? "no detail"}`);
+    return 1;
+  }
+  io.out("The invariants compile.");
+  if (!flags.includes("--yes")) {
+    io.out("Fuzz the contract against them in the airgapped sandbox (never touches mainnet).");
+    io.out(RUN_NOTE);
+    io.out(`Run again with --yes to start: sentinel fuzz ${planId} ${file} --yes`);
+    return 0;
+  }
+  const r = await io.client.fuzz(planId, harness);
+  io.out(`Started: ${r.planId}`);
+  return 0;
+}
+async function findingTitle(io, planId, n, usage) {
+  if (n === undefined || !/^\d+$/.test(n))
+    return usage("It needs a plan id and a finding number");
+  return (await io.client.finding(planId, Number(n))).title;
+}
+async function upkeep(cmd, pos, flags, values, io, usage) {
+  const [planId, second, third] = pos;
+  if (!planId)
+    return usage(`sentinel ${cmd} needs a plan id`);
+  const yes = flags.includes("--yes");
+  switch (cmd) {
+    case "latest": {
+      const l = await io.client.latestCommit(planId);
+      if (l.status === "unsupported")
+        io.out("Only a plan made from a GitHub link follows newer commits.");
+      else if (l.status === "current")
+        io.out(`On the latest commit of ${l.ref}: ${short(l.commit)}.`);
+      else if (l.status === "gone")
+        io.out(`The file isn't on ${l.ref} anymore (head ${short(l.head)}).`);
+      else {
+        io.out(`${l.ahead} commit(s) behind ${l.ref}: ${short(l.commit)} → ${short(l.head)}. An update would be ${l.mode}${l.affected.length ? ` (${l.affected.join(", ")})` : ""}.`);
+        io.out(l.free ? "Free: monitoring is on." : "Priced as a new plan: monitoring is off.");
+        io.out(`Plan it with: sentinel update ${planId} --yes`);
+      }
+      return 0;
+    }
+    case "update": {
+      const commit = values["--commit"];
+      if (commit !== undefined && !SHA.test(commit))
+        return usage("--commit takes a full 40-character sha");
+      const willDo = `Plan ${commit ? `commit ${short(commit)}` : "the branch's latest commit"}; the new plan replaces this one when it finishes.`;
+      if (previewOnly(io, flags, willDo, "Free while monitoring is on, else a paid plan."))
+        return 0;
+      const r = await io.client.updatePlan(planId, commit);
+      io.out(`${r.existing ? "Already running" : "Started"}: ${r.planId}${r.mode ? ` (${r.mode})` : ""}`);
+      return 0;
+    }
+    case "auto-plan": {
+      const on = onOff(second);
+      if (on === null)
+        return usage("sentinel auto-plan takes on or off");
+      const willDo = on ? "Plan this on its own once every contract it waits on is deployed (a paid plan)." : "Don't plan this on its own when its contracts deploy.";
+      if (previewOnly(io, flags, willDo, "Takes effect now."))
+        return 0;
+      await io.client.setAutoPlan(planId, on);
+      io.out(`Auto-plan is ${on ? "on" : "off"}.`);
+      return 0;
+    }
+    case "link": {
+      const clear = flags.includes("--clear");
+      if (!second || clear === Boolean(third))
+        return usage("sentinel link needs a plan id, the contract it waits on, and a link or --clear");
+      const willDo = clear ? `Clear the code linked for ${second}.` : `Link ${third} as the code of ${second} (a repo link also fills the others it holds).`;
+      if (previewOnly(io, flags, willDo, "Takes effect now."))
+        return 0;
+      const r = await io.client.setLink(planId, second, clear ? null : third);
+      io.out(`Linked: ${r.links.map((l) => l.id).join(", ") || "nothing"}`);
+      return 0;
+    }
+    case "plan-linked": {
+      if (!yes) {
+        io.out("Plan this contract now, with the linked code loaded at its real principals.");
+        io.out(RUN_NOTE);
+        io.out(`Run again with --yes to start: sentinel plan-linked ${planId} --yes`);
+        return 0;
+      }
+      const r = await io.client.planLinked(planId);
+      io.out(`Started: ${r.planId}`);
+      return 0;
+    }
+    case "name": {
+      if (second === undefined)
+        return usage('sentinel name needs a plan id and a name ("" clears it)');
+      const willDo = second.trim() ? `Call this contract "${second.trim()}".` : "Clear your name for this contract.";
+      if (previewOnly(io, flags, willDo, "Takes effect now."))
+        return 0;
+      const r = await io.client.renameContract(planId, second);
+      io.out(r.name ? `Named: ${r.name}` : "Name cleared.");
+      return 0;
+    }
+    case "remove": {
+      const p = await io.client.plan(planId);
+      const name = contractName(p.contractId);
+      const confirm = values["--confirm"];
+      if (confirm === undefined)
+        return usage(`sentinel remove needs --confirm ${name} (the contract's name, typed)`);
+      const willDo = `Take ${p.contractId} off your account: its monitoring, alerts and claim go.`;
+      if (previewOnly(io, flags, willDo, "Can't be undone."))
+        return 0;
+      const r = await io.client.removeContract(planId, confirm);
+      io.out(`Removed ${p.contractId}${r.monitoringOff ? "; monitoring is off" : ""}.`);
+      return 0;
+    }
+    case "ack":
+    case "reopen": {
+      const title = await findingTitle(io, planId, second, usage);
+      if (typeof title === "number")
+        return title;
+      if (cmd === "reopen") {
+        if (previewOnly(io, flags, `Put "${title}" back on the list.`, "Takes effect now."))
+          return 0;
+        await io.client.reopen(planId, Number(second), title);
+        io.out(`Reopened: ${title}`);
+        return 0;
+      }
+      if (third !== "accepted" && third !== "fixed" && third !== "disagree")
+        return usage("sentinel ack takes a reason: accepted, fixed or disagree");
+      const note = values["--note"] ?? null;
+      const willDo = `Label "${title}" ${third}${note ? `, noting: ${note}` : ""}. It changes no verdict.`;
+      if (previewOnly(io, flags, willDo, "Your team sees it now."))
+        return 0;
+      const r = await io.client.acknowledge(planId, Number(second), title, third, note);
+      io.out(`Labelled ${third}: ${title}`);
+      if (r.watchId)
+        io.out(`A watch on it is suggested (${r.watchId}): turn it on to keep watching.`);
+      return 0;
+    }
+    case "acks": {
+      const events = await io.client.ackHistory(planId);
+      if (events.length === 0)
+        io.out("No acknowledgements yet.");
+      for (const l of table(events.map((e) => [e.at, e.action, e.reason, e.by ?? "Sentinel", e.title, e.note])))
+        io.out(l);
+      return 0;
+    }
+    case "notes": {
+      if (second === undefined || !/^\d+$/.test(second))
+        return usage("sentinel notes needs a plan id and a finding number");
+      const notes = await io.client.notes(planId, Number(second));
+      if (notes.length === 0)
+        io.out("No notes yet.");
+      for (const n of notes)
+        io.out(`${n.at}  ${n.system ? "Sentinel" : n.by ?? ""}
+  ${n.body}`);
+      return 0;
+    }
+    default: {
+      const title = await findingTitle(io, planId, second, usage);
+      if (typeof title === "number")
+        return title;
+      if (!third?.trim())
+        return usage("sentinel note needs the note, in quotes");
+      if (previewOnly(io, flags, `Add a note to "${title}": ${third.trim()}`, "Your team sees it now."))
+        return 0;
+      await io.client.addNote(planId, Number(second), title, third);
+      io.out("Noted.");
+      return 0;
+    }
+  }
+}
+function pickIntent(intents, name) {
+  const q = name.trim().toLowerCase();
+  const hit = intents.find((i) => i.id === name) ?? intents.find((i) => i.title.toLowerCase() === q);
+  if (hit)
+    return hit;
+  throw new SubjectError(`No watch called "${name}". Watches: ${intents.map((i) => i.title).join(", ") || "none yet"}`, intents.map((i) => i.title));
+}
+function windowOf(values) {
+  const w = values["--window"];
+  if (w === undefined)
+    return;
+  return w === "7" ? 7 : w === "90" ? 90 : null;
+}
+function printActivity(io, title, a) {
+  io.out(`${title}: ${a.counts.total} event(s), ${a.counts.over} over a rule's line, last ${a.window} days${a.history === "ready" ? "" : ` (history ${a.history})`}`);
+  for (const l of table(a.events.map((e) => [
+    e.t,
+    e.fn,
+    e.value !== null && a.unit ? `${toUnits(e.value, a.unit.decimals)} ${a.unit.symbol}` : e.value,
+    e.caller,
+    e.result
+  ])))
+    io.out(l);
+}
+async function monitoringMore(cmd, pos, flags, values, io, usage) {
+  const [first, second, third] = pos;
+  const json = flags.includes("--json");
+  if (cmd === "mark-read") {
+    const all = flags.includes("--all");
+    if (all === Boolean(first))
+      return usage("sentinel mark-read needs an alert id or --all");
+    if (previewOnly(io, flags, all ? "Mark every alert read." : `Mark alert ${first} read.`, ""))
+      return 0;
+    if (all)
+      io.out(`Marked ${(await io.client.readAllAlerts()).count} read.`);
+    else {
+      await io.client.readAlert(first);
+      io.out("Marked read.");
+    }
+    return 0;
+  }
+  if (!first)
+    return usage(`sentinel ${cmd} needs a plan id`);
+  const planId = first;
+  switch (cmd) {
+    case "activity": {
+      if (!second)
+        return usage("sentinel activity needs a plan id and a watch (its title or id)");
+      const window = windowOf(values);
+      if (window === null)
+        return usage("--window takes 7 or 90");
+      const intent = pickIntent((await io.client.watches(planId)).intents, second);
+      const a = await io.client.watchActivity(planId, intent.id, { window });
+      if (json)
+        io.out(JSON.stringify(a, null, 2));
+      else
+        printActivity(io, intent.title, a);
+      return 0;
+    }
+    case "functions": {
+      if (second) {
+        const r = await io.client.functionActivity(planId, second);
+        if (json)
+          io.out(JSON.stringify(r, null, 2));
+        else if (!r.collected)
+          io.out(`Sentinel is still reading ${second}'s history. Try again in a few minutes.`);
+        else
+          printActivity(io, `${second} (if watched)`, r.activity);
+        return 0;
+      }
+      const fns = await io.client.functions(planId);
+      if (json)
+        io.out(JSON.stringify(fns, null, 2));
+      else
+        for (const l of table([
+          ["FUNCTION", "DOES", "WATCH", "DESCRIPTION"],
+          ...fns.map((f) => [f.fn, f.consequence, f.intentId ?? "not watched", f.description])
+        ]))
+          io.out(l);
+      return 0;
+    }
+    case "alert-preview": {
+      const example = values["--example"];
+      if (example !== undefined && example !== "money_out" && example !== "finding")
+        return usage("--example takes money_out or finding");
+      const p = await io.client.alertPreview(planId, example);
+      if (json)
+        io.out(JSON.stringify(p, null, 2));
+      else
+        io.out(`${p.message.subject}
+
+${p.message.text}`);
+      return 0;
+    }
+    case "threshold": {
+      if (!second)
+        return usage("sentinel threshold needs a plan id and an asset (its symbol)");
+      const ctx = await watchContext(io.client, planId);
+      const g = resolveSubject(ctx.watches.filter((w) => w.subject.kind === "asset"), second);
+      const subject = g.watches[0].subject;
+      if (subject.kind !== "asset")
+        return usage(`${second} isn't an asset`);
+      const units = g.watches[0].units;
+      const inUnits = (base) => units ? `${toUnits(base, units.decimals)} ${units.symbol}` : `${base} base units`;
+      const { threshold } = await io.client.threshold(planId, subject.asset);
+      io.out(`${g.name}: ${threshold.amount === null ? "every outflow alerts" : `alerts over ${inUnits(threshold.amount)}`}${threshold.confirmed ? "" : " (not confirmed yet)"}`);
+      if (third === undefined)
+        return 0;
+      if (!/^\d{1,30}$/.test(third))
+        return usage("The amount is in base units, digits only");
+      if (previewOnly(io, flags, `Alert on ${g.name} outflows over ${inUnits(third)}.`, "Live now."))
+        return 0;
+      await io.client.setThreshold(planId, subject.asset, third);
+      io.out(`${g.name} alerts over ${inUnits(third)}.`);
+      return 0;
+    }
+    default: {
+      if (previewOnly(io, flags, "Read the history of this plan's watches again.", "Starts now."))
+        return 0;
+      await io.client.retryHistory(planId);
+      io.out("Reading again; activity fills in over the next few minutes.");
+      return 0;
+    }
+  }
+}
+async function projects(pos, flags, values, io, usage) {
+  const [sub, id, second, third] = pos;
+  const json = flags.includes("--json");
+  if (!sub) {
+    const r = await io.client.projects();
+    if (json) {
+      io.out(JSON.stringify(r, null, 2));
+      return 0;
+    }
+    for (const l of table([
+      ["PROJECT", "CONTRACTS", "MONITORING", "FINDINGS", "ALERTS 7D", "ID"],
+      ...r.projects.map((p) => [
+        p.name,
+        p.contracts.length,
+        p.status,
+        p.findings,
+        p.alerts7d,
+        p.id
+      ])
+    ]))
+      io.out(l);
+    const nameOf = (pid) => r.projects.find((p) => p.id === pid)?.name ?? pid;
+    for (const s of r.suggestions)
+      io.out(`Suggested: merge ${nameOf(s.from)} into ${nameOf(s.into)} (${s.evidence.kind}). Answer with: sentinel projects suggestion ${s.from} ${s.into} accept|dismiss`);
+    return 0;
+  }
+  const subs = [
+    "show",
+    "overview",
+    "add",
+    "rename",
+    "merge",
+    "suggestion",
+    "move",
+    "remove-contract",
+    "remove",
+    "watches",
+    "activity",
+    "changes",
+    "destinations",
+    "monitoring"
+  ];
+  if (!subs.includes(sub))
+    return usage(`Unknown command projects ${sub}`);
+  if (!id)
+    return usage(`sentinel projects ${sub} needs a project id (sentinel projects lists them)`);
+  const projectNamed = async (pid) => {
+    const { projects: all } = await io.client.projects();
+    const p = all.find((x) => x.id === pid);
+    if (!p)
+      throw new SentinelError(404, `No project ${pid}. Yours: ${all.map((x) => `${x.name} (${x.id})`).join(", ") || "none"}`);
+    return p;
+  };
+  switch (sub) {
+    case "show": {
+      const p = await io.client.project(id);
+      if (json) {
+        io.out(JSON.stringify(p, null, 2));
+        return 0;
+      }
+      io.out(`${p.name}  ${p.status}  findings ${p.findings}  alerts 7d ${p.alerts7d}`);
+      for (const l of table([
+        ["CONTRACT", "HOW", "ROLE", "PLAN"],
+        ...p.contracts.map((c) => [c.contractId, c.origin, c.role, c.planId])
+      ]))
+        io.out(l);
+      return 0;
+    }
+    case "overview":
+      io.out(JSON.stringify(await io.client.projectOverview(id, { watches: flags.includes("--watches") }), null, 2));
+      return 0;
+    case "add": {
+      if (!second)
+        return usage("sentinel projects add needs a project id and a contract (SP….name or a GitHub link)");
+      const into = values["--into"] ?? id;
+      const p = await io.client.previewProjectContract(id, second);
+      const s = p.suggestion;
+      const target = into === "new" ? "a new project" : into;
+      io.out(`${p.contractId} goes into ${target}.`);
+      if (s.project !== into && s.kind !== "none")
+        io.out(`Sentinel suggests ${s.project === "new" ? "a new project" : s.project} (${s.kind}${s.with ? ` via ${s.with}` : ""}): add --into ${s.project} to put it there.`);
+      const b = await io.client.billing();
+      io.out(b.prices ? `A new plan costs ${usd(b.prices.run)}, charged only if it finishes.` : "Billing isn't linked: the free daily plan limit applies.");
+      if (!flags.includes("--yes")) {
+        io.out(`Run again with --yes to add it: sentinel projects add ${id} ${second}${values["--into"] ? ` --into ${into}` : ""} --yes`);
+        return 0;
+      }
+      const r = await io.client.addProjectContract(id, second, into === id ? {} : { project: into });
+      io.out(`${r.cached ? "Already planned" : "Started"}: ${r.planId} in project ${r.projectId}`);
+      return 0;
+    }
+    case "rename": {
+      if (!second?.trim())
+        return usage("sentinel projects rename needs a project id and a name");
+      if (previewOnly(io, flags, `Rename ${id} to "${second.trim()}".`, "Takes effect now."))
+        return 0;
+      io.out(`Renamed: ${(await io.client.renameProject(id, second)).name}`);
+      return 0;
+    }
+    case "merge": {
+      if (!second)
+        return usage("sentinel projects merge needs a project id and the project to merge it into");
+      const [from, to] = [await projectNamed(id), await projectNamed(second)];
+      const willDo = `Move every contract of ${from.name} (${from.contracts.length}) into ${to.name}; ${from.name} goes. Monitoring, watches and verification stay as they are.`;
+      if (previewOnly(io, flags, willDo, "Takes effect now."))
+        return 0;
+      const r = await io.client.mergeProject(id, second);
+      io.out(`Merged ${r.contracts} contract(s) into ${to.name}.`);
+      return 0;
+    }
+    case "suggestion": {
+      const accept = third === "accept" ? true : third === "dismiss" ? false : null;
+      if (!second || accept === null)
+        return usage("sentinel projects suggestion needs <from> <into> accept|dismiss");
+      const r = await io.client.projects();
+      if (!r.suggestions.some((s) => s.from === id && s.into === second))
+        throw new SentinelError(404, `No open suggestion to merge ${id} into ${second}.`);
+      const nameOf = (pid) => r.projects.find((p) => p.id === pid)?.name ?? pid;
+      const willDo = accept ? `Merge ${nameOf(id)} into ${nameOf(second)}: every contract moves.` : `Dismiss the suggestion to merge ${nameOf(id)} into ${nameOf(second)}.`;
+      if (previewOnly(io, flags, willDo, "Takes effect now."))
+        return 0;
+      await io.client.answerMergeSuggestion(id, second, accept);
+      io.out(accept ? "Merged." : "Dismissed.");
+      return 0;
+    }
+    case "move": {
+      if (!second || !third)
+        return usage("sentinel projects move needs a project id, a contract and where to (a project id or new)");
+      const to = third === "new" ? "a new project named after it" : (await projectNamed(third)).name;
+      if (previewOnly(io, flags, `Move ${second} to ${to}.`, "Takes effect now."))
+        return 0;
+      const r = await io.client.moveProjectContract(id, second, third);
+      io.out(`Moved to ${r.projectId}${r.projectRemoved ? `; ${id} had nothing left and is gone` : ""}.`);
+      return 0;
+    }
+    case "remove-contract": {
+      if (!second)
+        return usage("sentinel projects remove-contract needs a project id and a contract");
+      const member = (await io.client.project(id)).contracts.find((c) => c.contractId === second);
+      if (!member)
+        throw new SentinelError(404, `${second} isn't in project ${id}.`);
+      const added = member.origin === "added";
+      const confirm = values["--confirm"];
+      if (added && confirm === undefined)
+        return usage(`${second} is one you added: removing it takes its monitoring, alerts and claim. Type its name: --confirm ${contractName(second)}`);
+      const willDo = added ? `Remove ${second}: its monitoring, alerts and claim go.` : `Take ${second} out of the project (Sentinel found it; you never claimed it).`;
+      if (previewOnly(io, flags, willDo, added ? "Can't be undone." : ""))
+        return 0;
+      const r = await io.client.removeProjectContract(id, second, added ? confirm : undefined);
+      io.out(`Removed ${second}${r.projectRemoved ? `; ${id} had nothing left and is gone` : ""}.`);
+      return 0;
+    }
+    case "remove": {
+      const p = await io.client.project(id);
+      const confirm = values["--confirm"];
+      if (confirm === undefined)
+        return usage(`sentinel projects remove needs --confirm "${p.name}" (the project's name, typed)`);
+      const added = p.contracts.filter((c) => c.origin === "added").length;
+      const willDo = `Remove ${p.name} and the ${added} contract(s) you added in it: their monitoring, alerts and claims go.`;
+      if (previewOnly(io, flags, willDo, "Can't be undone."))
+        return 0;
+      const r = await io.client.removeProject(id, confirm);
+      io.out(`Removed ${p.name} (${r.contracts} contract(s)).`);
+      return 0;
+    }
+    case "watches": {
+      const w = await io.client.projectWatches(id);
+      if (json) {
+        io.out(JSON.stringify(w, null, 2));
+        return 0;
+      }
+      io.out(`${w.counts.on} of ${w.counts.total} on`);
+      for (const i of w.intents)
+        io.out([i.title, i.on ? "on" : "off", i.summary].join("  "));
+      return 0;
+    }
+    case "activity": {
+      if (!second)
+        return usage("sentinel projects activity needs a project id and a watch (its title or id)");
+      const window = windowOf(values);
+      if (window === null)
+        return usage("--window takes 7 or 90");
+      const intent = pickIntent((await io.client.projectWatches(id)).intents, second);
+      const a = await io.client.projectActivity(id, intent.id, {
+        window,
+        contract: values["--contract"]
+      });
+      if (json)
+        io.out(JSON.stringify(a, null, 2));
+      else
+        printActivity(io, intent.title, a);
+      return 0;
+    }
+    case "changes": {
+      const limit = values["--limit"] === undefined ? undefined : Number(values["--limit"]);
+      if (limit !== undefined && !(Number.isInteger(limit) && limit > 0))
+        return usage("--limit takes a whole number above 0");
+      const watchName = values["--watch"];
+      const watch = watchName ? pickIntent((await io.client.projectWatches(id)).intents, watchName).id : undefined;
+      const r = await io.client.projectChanges(id, {
+        limit,
+        cursor: values["--cursor"],
+        watch,
+        ...flags.includes("--mutes") ? { filter: "mutes" } : {}
+      });
+      if (json) {
+        io.out(JSON.stringify(r, null, 2));
+        return 0;
+      }
+      if (!r.events.length)
+        io.out("No changes yet.");
+      for (const c of r.events)
+        io.out([c.at, changeText(c), c.source ?? ""].join("  ").trimEnd());
+      if (r.next)
+        io.out(`More: --cursor ${r.next}`);
+      return 0;
+    }
+    case "destinations": {
+      const email = values["--email"];
+      if (email !== undefined && onOff(email) === null)
+        return usage("--email takes on or off");
+      if (email === undefined && !("--webhook" in values) && !("--slack" in values))
+        return usage("sentinel projects destinations needs --email, --webhook or --slack");
+      const dest = {
+        ...email === undefined ? {} : { email: email === "on" },
+        ...values["--webhook"] ? { webhookUrl: values["--webhook"] } : {},
+        ...values["--slack"] ? { slackUrl: values["--slack"] } : {}
+      };
+      const places = [
+        dest.email === true ? "email" : null,
+        dest.webhookUrl ? "webhook" : null,
+        dest.slackUrl ? "Slack" : null
+      ].filter(Boolean).join(", ") || "nowhere new";
+      const willDo = `Alerts for every contract you added in ${id} go to: ${places}. A webhook or Slack URL left out is cleared.`;
+      if (previewOnly(io, flags, willDo, "Takes effect now."))
+        return 0;
+      const r = await io.client.setProjectDestinations(id, dest);
+      for (const c of r.contracts) {
+        io.out(`${c.contractId}: ${c.result}${c.error ? ` (${c.error})` : ""}`);
+        if (c.signingSecret)
+          io.out(`  webhook signing secret (shown once): ${c.signingSecret}`);
+      }
+      return 0;
+    }
+    default: {
+      const on = onOff(second);
+      if (on === null)
+        return usage("sentinel projects monitoring takes on or off");
+      const willDo = `Turn monitoring ${on ? "on" : "off"} for every contract you added in ${id}.`;
+      if (previewOnly(io, flags, willDo, on ? "Live now; events are billed." : "Off now."))
+        return 0;
+      const r = await io.client.setProjectMonitoring(id, on);
+      for (const c of r.contracts)
+        io.out(`${c.contractId}: ${c.result}${c.error ? ` (${c.error})` : ""}`);
+      io.out(`Project monitoring: ${r.status}`);
+      return 0;
+    }
+  }
+}
 
 // cli/main.ts
 function takeToken(argv) {
@@ -1311,7 +2125,7 @@ async function main() {
     return 2;
   }
   const baseUrl = process.env.SENTINEL_API_URL;
-  const clientFor = (token) => createClient({ token, baseUrl });
+  const clientFor = (token) => createClient({ token, baseUrl, client: "cli" });
   return run(argv, {
     client: clientFor(credential?.token ?? ""),
     out: console.log,