@sixb/cli-core 0.1.8 → 0.1.10

package/dist/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":""}

package/dist/memory.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The Agent's memory as installed in its sandbox: the worker writes each repo under
+ * `$SIXB_MEMORY_DIR/<repo>/` with a manifest of what it loaded, and `sixb memory` saves the files
+ * that differ from it.
+ */
+export type AgentMemoryRepo = "user" | "project";
+/** Where the manifest is, relative to `$SIXB_CONTEXT_DIR`. */
+export declare const AGENT_MEMORY_MANIFEST = "context/memory.json";
+export declare const AGENT_MEMORY_ENTRY = "MEMORY.md";
+/** What a repo starts from before its first save; it is saved with the first save. */
+export declare const AGENT_MEMORY_STARTER = "# Memory\n\n";
+/** What the local copy was loaded from: the revision and each file's SHA-256, by path. */
+export interface AgentMemoryManifest {
+    readonly repos: Partial<Record<AgentMemoryRepo, AgentMemoryManifestRepo>>;
+}
+export interface AgentMemoryManifestRepo {
+    readonly revision: number;
+    readonly files: Readonly<Record<string, string>>;
+}
+export declare function agentMemoryFileHash(contents: string): string;
+//# sourceMappingURL=memory.d.ts.map

package/dist/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../src/memory.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,CAAA;AAEhD,8DAA8D;AAC9D,eAAO,MAAM,qBAAqB,wBAAwB,CAAA;AAE1D,eAAO,MAAM,kBAAkB,cAAc,CAAA;AAE7C,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,iBAAiB,CAAA;AAElD,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC,CAAA;CAC1E;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACjD;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D"}

package/dist/output.d.ts

@@ -2,6 +2,8 @@
 export declare const INSTANCE_CLI_VERSION = "1";
 export declare const EXIT_USAGE = 2;
 export declare const EXIT_API = 3;
+/** The request waits for its user's approval: it did not run. */
+export declare const EXIT_AWAITING_APPROVAL = 4;
 export interface CliErrorBody {
     readonly code: string;
     readonly status?: number;
@@ -16,6 +18,16 @@ export declare class CliError extends Error {
 }
 export declare function fail(message: string, code?: string, hint?: string): never;
 export declare function writeJson(value: unknown): void;
+/** Ends a command that already wrote its output, with an exit code that is not a success. */
+export declare class CliExit extends Error {
+    readonly exitCode: number;
+    constructor(exitCode: number);
+}
+/**
+ * Print what a request that changes state answered. A request held for the user's approval prints
+ * as the API answered it, and exits with {@link EXIT_AWAITING_APPROVAL}: `a && b` does not run `b`.
+ */
+export declare function writeRequestResult(value: unknown): void;
 export declare function writeText(value: string): void;
 export declare function reportError(error: unknown): number;
 //# sourceMappingURL=output.d.ts.map

package/dist/output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,eAAO,MAAM,oBAAoB,MAAM,CAAA;AACvC,eAAO,MAAM,UAAU,IAAI,CAAA;AAC3B,eAAO,MAAM,QAAQ,IAAI,CAAA;AAEzB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;CACrC;AAED,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;gBAEb,IAAI,EAAE,YAAY,EAAE,QAAQ,SAAa;CAMtD;AAED,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAsB,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAEtF;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAE9C;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE7C;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAalD"}
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,eAAO,MAAM,oBAAoB,MAAM,CAAA;AACvC,eAAO,MAAM,UAAU,IAAI,CAAA;AAC3B,eAAO,MAAM,QAAQ,IAAI,CAAA;AACzB,iEAAiE;AACjE,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;CACrC;AAED,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;gBAEb,IAAI,EAAE,YAAY,EAAE,QAAQ,SAAa;CAMtD;AAED,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAsB,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAEtF;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAE9C;AAED,6FAA6F;AAC7F,qBAAa,OAAQ,SAAQ,KAAK;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM;CAItC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAIvD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE7C;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAclD"}

package/dist/policies.d.ts

@@ -20,6 +20,20 @@ export declare const CLI_LIMITS: {
         readonly default: 100;
         readonly maximum: 1000;
     };
+    /** The server lists at most 200 members per page. */
+    readonly users: {
+        readonly default: 20;
+        readonly maximum: 200;
+    };
+    /** The server's dataset bounds: 100 versions and 1,000 rows per page. */
+    readonly datasetVersions: {
+        readonly default: 20;
+        readonly maximum: 100;
+    };
+    readonly datasetRows: {
+        readonly default: 100;
+        readonly maximum: 1000;
+    };
     readonly inspect: {
         readonly depth: {
             readonly default: 2;

package/dist/policies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../src/policies.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,eAAO,MAAM,UAAU;;;;;;;;;IAGrB,+FAA+F;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUvF,CAAA;AAEV,eAAO,MAAM,kBAAkB,EAAG,MAAe,CAAA;AACjD,eAAO,MAAM,uBAAuB,EAAG,WAAoB,CAAA;AAC3D,eAAO,MAAM,uBAAuB,EAAG,MAAe,CAAA"}
+{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../src/policies.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,eAAO,MAAM,UAAU;;;;;;;;;IAGrB,+FAA+F;;;;;;;;;;;;IAI/F,qDAAqD;;;;;IAErD,yEAAyE;;;;;;;;;;;;;;;;;;;;;;;;CASjE,CAAA;AAEV,eAAO,MAAM,kBAAkB,EAAG,MAAe,CAAA;AACjD,eAAO,MAAM,uBAAuB,EAAG,WAAoB,CAAA;AAC3D,eAAO,MAAM,uBAAuB,EAAG,MAAe,CAAA"}

package/dist/run.d.ts

@@ -1,6 +1,7 @@
 import { ApiClient } from "./api-client";
 export interface SandboxInstanceCliMode {
     readonly kind: "sandbox";
+    /** The sandbox's credentialed address for the API: the run's token is added on the way out. */
     readonly baseUrl: string;
     readonly runContextPath: string;
 }

package/dist/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAGxC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,MAAM,eAAe,GAAG,sBAAsB,GAAG,oBAAoB,CAAA;AAE3E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAC/B;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAG9E;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,CAiBxE"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAGxC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,MAAM,eAAe,GAAG,sBAAsB,GAAG,oBAAoB,CAAA;AAE3E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAC/B;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAG9E;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,CAiBxE"}

package/dist/sandbox-cli.d.ts

@@ -0,0 +1,8 @@
+/** The `sixb` a sandbox installs: a shell launcher and the bundle it runs on Bun or Node. */
+export interface SandboxCliAssets {
+    readonly launcher: string;
+    readonly artifact: Uint8Array;
+}
+/** Read from beside this module: `src/` in the workspace, `dist/` once built. */
+export declare function loadSandboxCliAssets(): Promise<SandboxCliAssets>;
+//# sourceMappingURL=sandbox-cli.d.ts.map

package/dist/sandbox-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-cli.d.ts","sourceRoot":"","sources":["../src/sandbox-cli.ts"],"names":[],"mappings":"AAEA,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAA;CAC9B;AAID,iFAAiF;AACjF,wBAAgB,oBAAoB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAMhE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sixb/cli-core",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Shared instance command runtime for Sixb CLIs",
   "keywords": [
     "sixb",
@@ -29,10 +29,24 @@
   },
   "scripts": {
     "build": "bun ../../scripts/build-package.ts",
+    "generate:sandbox-cli": "bun ./scripts/generate-sandbox-cli.ts",
+    "check:sandbox-cli": "bun ./scripts/generate-sandbox-cli.ts --check",
     "typecheck": "tsc --noEmit",
     "test": "bun test",
     "prepack": "bun run build"
   },
+  "sixbBuild": {
+    "assets": [
+      {
+        "from": "./src/bin",
+        "to": "./dist/bin"
+      },
+      {
+        "from": "./src/generated",
+        "to": "./dist/generated"
+      }
+    ]
+  },
   "devDependencies": {
     "@types/bun": "latest",
     "typescript": "^5.7.0"

package/src/api-client.ts

@@ -1,21 +1,33 @@
 import { randomUUID } from "node:crypto"
 import { createWriteStream } from "node:fs"
 import { readFile, rename, rm } from "node:fs/promises"
+import { request as httpRequest } from "node:http"
 import { basename, dirname, join } from "node:path"
 import { Readable } from "node:stream"
 import { pipeline } from "node:stream/promises"
 import type { ReadableStream as NodeReadableStream } from "node:stream/web"
 import { CliError, EXIT_API, fail } from "./output"
 
+/**
+ * A base URL of `unix:<socket path>` reaches the API through a local socket, such as the one a
+ * sandbox's credential forwarder listens on: requests go to `http://localhost` over that socket.
+ */
+const UNIX_BASE_URL_PREFIX = "unix:"
+
 export class ApiClient {
   readonly baseUrl: string
+  private readonly socketPath: string | undefined
   private readonly authorization: string | undefined
   private readonly missingBaseUrlMessage: string
   private readonly unavailableMessage: string
   private readonly unavailableHint: string
 
   constructor(options: ApiClientOptions) {
-    this.baseUrl = options.baseUrl.replace(/\/+$/, "")
+    const baseUrl = options.baseUrl.replace(/\/+$/, "")
+    this.socketPath = baseUrl.startsWith(UNIX_BASE_URL_PREFIX)
+      ? baseUrl.slice(UNIX_BASE_URL_PREFIX.length)
+      : undefined
+    this.baseUrl = this.socketPath === undefined ? baseUrl : "http://localhost"
     this.authorization = options.authorization
     this.missingBaseUrlMessage = options.missingBaseUrlMessage
     this.unavailableMessage = options.unavailableMessage
@@ -41,9 +53,20 @@ export class ApiClient {
     })
   }
 
-  async upload(path: string, source: string, logicalPath?: string): Promise<unknown> {
+  /** `mediaType` labels the part; without it, the server reads the type from the file name. */
+  async upload(
+    path: string,
+    source: string,
+    logicalPath?: string,
+    mediaType?: string
+  ): Promise<unknown> {
     const form = new FormData()
-    form.append("file", new Blob([new Uint8Array(await readFile(source))]), basename(source))
+    const bytes = new Uint8Array(await readFile(source))
+    form.append(
+      "file",
+      new Blob([bytes], mediaType ? { type: mediaType } : undefined),
+      basename(source)
+    )
     if (logicalPath) form.append("logicalPath", logicalPath)
     return this.json(this.url(path), { method: "POST", body: form })
   }
@@ -96,7 +119,7 @@ export class ApiClient {
     try {
       const headers = new Headers(init.headers)
       if (this.authorization) headers.set("authorization", this.authorization)
-      response = await fetch(url, { ...init, headers })
+      response = await send(url, { ...init, headers }, this.socketPath)
     } catch (error) {
       if (init.signal?.aborted) throw error
       throw new CliError(
@@ -182,3 +205,59 @@ function stringField(record: Readonly<Record<string, unknown>>, key: string): st
   const value = record[key]
   return typeof value === "string" ? value : undefined
 }
+
+/** One request, over a Unix socket when the API is behind one. */
+function send(url: URL, init: RequestInit, socketPath: string | undefined): Promise<Response> {
+  if (socketPath === undefined) return fetch(url, init)
+  // Bun's fetch speaks over a Unix socket itself; Node's does not, so it goes through node:http.
+  if (typeof Bun !== "undefined") return fetch(url, { ...init, unix: socketPath })
+  return sendOverNodeSocket(url, init, socketPath)
+}
+
+async function sendOverNodeSocket(
+  url: URL,
+  init: RequestInit,
+  socketPath: string
+): Promise<Response> {
+  // A Request settles the body and its content type (a form's boundary included) as fetch would.
+  const outgoing = new Request(url, init)
+  const body = outgoing.body ? Buffer.from(await outgoing.arrayBuffer()) : undefined
+  const headers: Record<string, string> = Object.fromEntries(outgoing.headers)
+  if (body) headers["content-length"] = String(body.byteLength)
+
+  return new Promise((resolve, reject) => {
+    const request = httpRequest(
+      {
+        socketPath,
+        method: outgoing.method,
+        path: `${url.pathname}${url.search}`,
+        headers: { ...headers, host: "localhost" },
+        ...(init.signal ? { signal: init.signal } : {}),
+      },
+      (response) => {
+        const responseHeaders = new Headers()
+        for (const [name, value] of Object.entries(response.headers)) {
+          for (const each of Array.isArray(value) ? value : value === undefined ? [] : [value]) {
+            responseHeaders.append(name, each)
+          }
+        }
+        const status = response.statusCode ?? 502
+        const empty = status === 204 || status === 304 || outgoing.method === "HEAD"
+        resolve(
+          new Response(empty ? null : nodeBody(response), {
+            status,
+            statusText: response.statusMessage ?? "",
+            headers: responseHeaders,
+          })
+        )
+      }
+    )
+    request.on("error", reject)
+    request.end(body)
+  })
+}
+
+/** The response body as a web stream: Node's and the global stream types differ only in typing. */
+function nodeBody(response: Readable): ReadableStream<Uint8Array> {
+  return Readable.toWeb(response) as unknown as ReadableStream<Uint8Array>
+}

package/src/arguments.ts

@@ -1,6 +1,13 @@
 import { fail } from "./output"
 
-type OptionKinds = Readonly<Record<string, "string" | "boolean">>
+/** `strings` may repeat, and collects every value in order. */
+type OptionKinds = Readonly<Record<string, "string" | "strings" | "boolean">>
+
+type OptionValue<TKind> = TKind extends "boolean"
+  ? boolean
+  : TKind extends "strings"
+    ? string[]
+    : string
 
 /** Parse a command's options once, before reading files or calling the API. */
 export function parseCommandArgs<const T extends OptionKinds>(
@@ -10,10 +17,10 @@ export function parseCommandArgs<const T extends OptionKinds>(
   positionalCount: number | readonly [number, number] = 0
 ): {
   positionals: string[]
-  options: { [K in keyof T]?: T[K] extends "boolean" ? boolean : string }
+  options: { [K in keyof T]?: OptionValue<T[K]> }
 } {
   const positionals: string[] = []
-  const options: Record<string, string | boolean> = {}
+  const options: Record<string, string | string[] | boolean> = {}
   let positionalOnly = false
   for (let index = 0; index < args.length; index++) {
     const argument = args[index] ?? ""
@@ -28,7 +35,9 @@ export function parseCommandArgs<const T extends OptionKinds>(
     const equals = argument.indexOf("=")
     const flag = equals < 0 ? argument : argument.slice(0, equals)
     if (!Object.hasOwn(kinds, flag)) fail(`Unknown ${command} option '${flag}'.`)
-    if (Object.hasOwn(options, flag)) fail(`${flag} may only be provided once.`)
+    if (Object.hasOwn(options, flag) && kinds[flag] !== "strings") {
+      fail(`${flag} may only be provided once.`)
+    }
     if (kinds[flag] === "boolean") {
       if (equals >= 0) fail(`${flag} does not accept a value.`)
       options[flag] = true
@@ -37,7 +46,9 @@ export function parseCommandArgs<const T extends OptionKinds>(
       if (!value || (equals < 0 && value.startsWith("--"))) {
         fail(`${flag} requires a value.`)
       }
-      options[flag] = value
+      const previous = options[flag]
+      options[flag] =
+        kinds[flag] === "strings" ? [...(Array.isArray(previous) ? previous : []), value] : value
     }
   }
   const [minimum, maximum] =
@@ -48,7 +59,7 @@ export function parseCommandArgs<const T extends OptionKinds>(
   return {
     positionals,
     // Every assigned option was checked against its declared kind above.
-    options: options as { [K in keyof T]?: T[K] extends "boolean" ? boolean : string },
+    options: options as { [K in keyof T]?: OptionValue<T[K]> },
   }
 }
 

package/src/bin/sixb

@@ -0,0 +1,26 @@
+#!/usr/bin/env sh
+
+set -eu
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+artifact="$script_dir/../lib/sixb.mjs"
+if [ ! -f "$artifact" ]; then
+  artifact="$script_dir/../generated/sixb.mjs"
+fi
+if [ ! -f "$artifact" ]; then
+  printf '%s\n' '{"error":{"code":"runtime_unavailable","message":"The Sixb CLI artifact is missing."}}' >&2
+  exit 2
+fi
+
+bun_path=$(command -v bun || true)
+if [ -n "$bun_path" ]; then
+  exec "$bun_path" "$artifact" "$@"
+fi
+
+node_path=$(command -v node || true)
+if [ -n "$node_path" ]; then
+  exec "$node_path" "$artifact" "$@"
+fi
+
+printf '%s\n' '{"error":{"code":"runtime_unavailable","message":"The Sixb CLI requires Bun or Node.js."}}' >&2
+exit 2

package/src/commands/actions.ts

@@ -1,9 +1,9 @@
 import { randomUUID } from "node:crypto"
 import type { ApiClient } from "../api-client"
 import { isHelp, parseCommandArgs, requestsHelp } from "../arguments"
-import { CliError, EXIT_API, fail, writeJson, writeText } from "../output"
+import { CliError, EXIT_API, fail, writeJson, writeRequestResult, writeText } from "../output"
 import { GROUP_HELP } from "./metadata"
-import { asRecord, parseQueryOptions, readJson } from "./shared"
+import { asRecord, idSegment, parseQueryOptions, readJson } from "./shared"
 
 /**
  * How long `actions request` waits for the run it requested. An agent's command is killed after 30
@@ -22,7 +22,7 @@ export async function actions(
   if (!sub || isHelp(sub) || requestsHelp(rest)) return writeText(GROUP_HELP.actions)
   if (sub === "get") {
     const { positionals } = parseCommandArgs(rest, {}, "actions get", 1)
-    return writeJson(await api.get(`/api/actions/${encodeURIComponent(positionals[0] ?? "")}`))
+    return writeJson(await api.get(`/api/actions/${idSegment(positionals[0])}`))
   }
   if (sub === "list") {
     const options = parseQueryOptions(rest, { "--type": "objectTypeId" }, "actions list")
@@ -62,9 +62,9 @@ export async function actions(
     const requestedRunId = runId ?? `act_${randomUUID()}`
     const waiting = AbortSignal.timeout(requestWaitMs)
     try {
-      return writeJson(
+      return writeRequestResult(
         await api.post(
-          `/api/actions/${encodeURIComponent(actionId)}`,
+          `/api/actions/${idSegment(actionId)}`,
           {
             params,
             ...(subjectType && subjectId

package/src/commands/data.ts

@@ -0,0 +1,90 @@
+import type { ApiClient } from "../api-client"
+import {
+  integerInRange,
+  isHelp,
+  nonNegativeInteger,
+  parseCommandArgs,
+  requestsHelp,
+} from "../arguments"
+import { fail, writeJson, writeText } from "../output"
+import { CLI_LIMITS } from "../policies"
+import { GROUP_HELP } from "./metadata"
+import { idSegment, type QueryOptions } from "./shared"
+
+export async function datasets(api: ApiClient, args: readonly string[]): Promise<void> {
+  const [sub, ...rest] = args
+  if (!sub || isHelp(sub) || requestsHelp(rest)) return writeText(GROUP_HELP.datasets)
+
+  if (sub === "list") {
+    parseCommandArgs(rest, {}, "datasets list")
+    return writeJson(await api.get("/api/datasets"))
+  }
+
+  if (sub === "get") {
+    const { positionals } = parseCommandArgs(rest, {}, "datasets get", 1)
+    return writeJson(await api.get(`/api/datasets/${idSegment(positionals[0])}`))
+  }
+
+  if (sub === "versions") {
+    const { positionals, options } = parseCommandArgs(
+      rest,
+      { "--limit": "string" },
+      "datasets versions",
+      1
+    )
+    const { default: fallback, maximum } = CLI_LIMITS.datasetVersions
+    const limit = integerInRange("--limit", options["--limit"] ?? String(fallback), 1, maximum)
+    return writeJson(
+      await api.get(`/api/datasets/${idSegment(positionals[0])}/versions`, { limit: String(limit) })
+    )
+  }
+
+  if (sub === "rows") {
+    const { positionals, options } = parseCommandArgs(
+      rest,
+      { "--version": "string", "--columns": "string", "--limit": "string", "--offset": "string" },
+      "datasets rows",
+      1
+    )
+    const { default: fallback, maximum } = CLI_LIMITS.datasetRows
+    const query: QueryOptions = {
+      limit: String(integerInRange("--limit", options["--limit"] ?? String(fallback), 1, maximum)),
+      ...(options["--version"] === undefined ? {} : { versionId: options["--version"] }),
+      ...(options["--columns"] === undefined ? {} : { columns: columnList(options["--columns"]) }),
+      ...(options["--offset"] === undefined
+        ? {}
+        : { offset: String(nonNegativeInteger("--offset", options["--offset"])) }),
+    }
+    return writeJson(await api.get(`/api/datasets/${idSegment(positionals[0])}/rows`, query))
+  }
+
+  fail(`Unknown datasets command '${sub}'.`)
+}
+
+/** `syncs` and `pipelines`: the definitions the caller may run, with each one's latest run. */
+export async function runnables(
+  api: ApiClient,
+  group: "syncs" | "pipelines",
+  args: readonly string[]
+): Promise<void> {
+  const [sub, ...rest] = args
+  if (!sub || isHelp(sub) || requestsHelp(rest)) return writeText(GROUP_HELP[group])
+
+  if (sub === "list") {
+    parseCommandArgs(rest, {}, `${group} list`)
+    return writeJson(await api.get(`/api/${group}`))
+  }
+
+  if (sub === "get") {
+    const { positionals } = parseCommandArgs(rest, {}, `${group} get`, 1)
+    return writeJson(await api.get(`/api/${group}/${idSegment(positionals[0])}`))
+  }
+
+  fail(`Unknown ${group} command '${sub}'.`)
+}
+
+function columnList(value: string): string {
+  const columns = value.split(",").map((column) => column.trim())
+  if (columns.some((column) => !column)) fail("--columns takes column names separated by commas.")
+  return columns.join(",")
+}

package/src/commands/files.ts

@@ -3,6 +3,7 @@ import type { ApiClient } from "../api-client"
 import { isHelp, parseCommandArgs, requestsHelp, requireExact } from "../arguments"
 import { fail, writeJson, writeText } from "../output"
 import { GROUP_HELP } from "./metadata"
+import { idSegment } from "./shared"
 
 export async function files(api: ApiClient, args: readonly string[]): Promise<void> {
   const [sub, ...rest] = args
@@ -30,19 +31,28 @@ export async function files(api: ApiClient, args: readonly string[]): Promise<vo
       [2, 3]
     )
     const context = positionals[0]
+    const output = options["--output"]
+    if (context === "url") {
+      // A content URL a manifest lists, such as an attachment's: fetched the way every other
+      // command reaches the API, so its credential is added wherever the CLI's address adds it.
+      requireExact(positionals, 2, "files download url requires exactly one content URL.")
+      const url = parseContentUrl(positionals[1] ?? "")
+      if (!output) fail("files download requires --output <local-path>.")
+      await api.download(url.pathname, output, Object.fromEntries(url.searchParams))
+      return writeJson({ downloaded: true, output })
+    }
     let route: string
     if (context === "object") {
       requireExact(positionals, 3, "files download object requires object type and primary id.")
       const type = positionals[1] ?? ""
       const id = positionals[2] ?? ""
-      route = `/api/objects/${encodeURIComponent(type)}/${encodeURIComponent(id)}/files/content`
+      route = `/api/objects/${idSegment(type)}/${idSegment(id)}/files/content`
     } else if (context === "action-run" || context === "workflow-run") {
       requireExact(positionals, 2, `files download ${context} requires exactly one run id.`)
       const id = positionals[1] ?? ""
-      route = `/api/${context}s/${encodeURIComponent(id)}/files/content`
+      route = `/api/${context}s/${idSegment(id)}/files/content`
     } else fail(`Unknown file download context '${context}'.`)
     const path = options["--path"]
-    const output = options["--output"]
     if (!path) fail("files download requires --path <json-pointer>.")
     if (!output) fail("files download requires --output <local-path>.")
     await api.download(route, output, { path })
@@ -50,3 +60,17 @@ export async function files(api: ApiClient, args: readonly string[]): Promise<vo
   }
   fail(`Unknown files command '${sub}'.`)
 }
+
+/** A Sixb API file content URL: only its path and query are used, never its origin. */
+function parseContentUrl(value: string): URL {
+  let url: URL
+  try {
+    url = new URL(value)
+  } catch {
+    fail(`'${value}' is not a URL.`)
+  }
+  if (!url.pathname.startsWith("/api/") || !url.pathname.endsWith("/files/content")) {
+    fail(`'${value}' is not a Sixb file content URL.`)
+  }
+  return url
+}

package/src/commands/index.ts

@@ -1,12 +1,15 @@
 import type { ApiClient } from "../api-client"
 import { fail } from "../output"
 import { actions } from "./actions"
+import { datasets, runnables } from "./data"
 import { files } from "./files"
+import { models } from "./models"
 import { objects } from "./objects"
 import { ontology } from "./ontology"
 import { project } from "./project"
 import { runs } from "./runs"
 import { telemetry } from "./telemetry"
+import { users } from "./users"
 import { workflows } from "./workflows"
 
 export const INSTANCE_COMMANDS = [
@@ -19,6 +22,13 @@ export const INSTANCE_COMMANDS = [
   "files",
   "workflows",
   "workflow-runs",
+  "users",
+  "models",
+  "datasets",
+  "syncs",
+  "sync-runs",
+  "pipelines",
+  "pipeline-runs",
 ] as const
 
 export type InstanceCommand = (typeof INSTANCE_COMMANDS)[number]
@@ -51,6 +61,20 @@ export async function dispatch(
       return workflows(api, args)
     case "workflow-runs":
       return runs(api, "workflow", args)
+    case "users":
+      return users(api, args)
+    case "models":
+      return models(api, args)
+    case "datasets":
+      return datasets(api, args)
+    case "syncs":
+      return runnables(api, "syncs", args)
+    case "sync-runs":
+      return runs(api, "sync", args)
+    case "pipelines":
+      return runnables(api, "pipelines", args)
+    case "pipeline-runs":
+      return runs(api, "pipeline", args)
     default:
       fail(`Unknown command '${command}'. Run 'sixb --help'.`)
   }