@sixb/cli-core 0.1.9 → 0.2.0

package/dist/index.d.ts

@@ -1,11 +1,16 @@
 export type { ApiClientOptions } from "./api-client";
 export { ApiClient } from "./api-client";
-export { isHelp, requestsHelp } from "./arguments";
+export { requestsHelp } from "./arguments";
 export type { InstanceCommand } from "./commands";
 export { INSTANCE_COMMANDS, isInstanceCommand } from "./commands";
 export { renderInstanceHelp } from "./commands/metadata";
-export { asRecord, isFileError } from "./commands/shared";
-export { CliError, EXIT_API, EXIT_USAGE, fail, INSTANCE_CLI_VERSION, reportError, writeJson, writeText, } from "./output";
+export type { SandboxStatusReport } from "./commands/system";
+export { AGENT_RUNTIME_PROFILE } from "./commands/system";
+export type { AgentMemoryManifest, AgentMemoryRepo } from "./memory";
+export { AGENT_MEMORY_ENTRY, AGENT_MEMORY_MANIFEST, AGENT_MEMORY_STARTER, agentMemoryFileHash, } from "./memory";
+export { CliError, EXIT_API, EXIT_USAGE, fail, INSTANCE_CLI_VERSION, reportError, writeJson, } from "./output";
 export type { InstanceCliMode, LocalInstanceCliMode, RunInstanceCliInput, SandboxInstanceCliMode, } from "./run";
 export { createInstanceApiClient, runInstanceCli } from "./run";
+export type { SandboxCliAssets } from "./sandbox-cli";
+export { loadSandboxCliAssets } from "./sandbox-cli";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAClD,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,SAAS,GACV,MAAM,UAAU,CAAA;AACjB,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,OAAO,CAAA;AACd,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,OAAO,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACzD,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AACpE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,oBAAoB,EACpB,WAAW,EACX,SAAS,GACV,MAAM,UAAU,CAAA;AACjB,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,OAAO,CAAA;AACd,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,OAAO,CAAA;AAC/D,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA"}

package/dist/index.js

@@ -3,6 +3,7 @@
 import { randomUUID } from "crypto";
 import { createWriteStream } from "fs";
 import { readFile, rename, rm } from "fs/promises";
+import { request as httpRequest } from "http";
 import { basename, dirname, join } from "path";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
@@ -63,14 +64,19 @@ function reportError(error) {
 }
 
 // src/api-client.ts
+var UNIX_BASE_URL_PREFIX = "unix:";
+
 class ApiClient {
   baseUrl;
+  socketPath;
   authorization;
   missingBaseUrlMessage;
   unavailableMessage;
   unavailableHint;
   constructor(options) {
-    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+    const baseUrl = options.baseUrl.replace(/\/+$/, "");
+    this.socketPath = baseUrl.startsWith(UNIX_BASE_URL_PREFIX) ? baseUrl.slice(UNIX_BASE_URL_PREFIX.length) : undefined;
+    this.baseUrl = this.socketPath === undefined ? baseUrl : "http://localhost";
     this.authorization = options.authorization;
     this.missingBaseUrlMessage = options.missingBaseUrlMessage;
     this.unavailableMessage = options.unavailableMessage;
@@ -136,7 +142,7 @@ class ApiClient {
       const headers = new Headers(init.headers);
       if (this.authorization)
         headers.set("authorization", this.authorization);
-      response = await fetch(url, { ...init, headers });
+      response = await send(url, { ...init, headers }, this.socketPath);
     } catch (error) {
       if (init.signal?.aborted)
         throw error;
@@ -193,6 +199,48 @@ function stringField(record, key) {
   const value = record[key];
   return typeof value === "string" ? value : undefined;
 }
+function send(url, init, socketPath) {
+  if (socketPath === undefined)
+    return fetch(url, init);
+  if (typeof Bun !== "undefined")
+    return fetch(url, { ...init, unix: socketPath });
+  return sendOverNodeSocket(url, init, socketPath);
+}
+async function sendOverNodeSocket(url, init, socketPath) {
+  const outgoing = new Request(url, init);
+  const body = outgoing.body ? Buffer.from(await outgoing.arrayBuffer()) : undefined;
+  const headers = Object.fromEntries(outgoing.headers);
+  if (body)
+    headers["content-length"] = String(body.byteLength);
+  return new Promise((resolve, reject) => {
+    const request = httpRequest({
+      socketPath,
+      method: outgoing.method,
+      path: `${url.pathname}${url.search}`,
+      headers: { ...headers, host: "localhost" },
+      ...init.signal ? { signal: init.signal } : {}
+    }, (response) => {
+      const responseHeaders = new Headers;
+      for (const [name, value] of Object.entries(response.headers)) {
+        for (const each of Array.isArray(value) ? value : value === undefined ? [] : [value]) {
+          responseHeaders.append(name, each);
+        }
+      }
+      const status = response.statusCode ?? 502;
+      const empty = status === 204 || status === 304 || outgoing.method === "HEAD";
+      resolve(new Response(empty ? null : nodeBody(response), {
+        status,
+        statusText: response.statusMessage ?? "",
+        headers: responseHeaders
+      }));
+    });
+    request.on("error", reject);
+    request.end(body);
+  });
+}
+function nodeBody(response) {
+  return Readable.toWeb(response);
+}
 // src/arguments.ts
 function parseCommandArgs(args, kinds, command, positionalCount = 0) {
   const positionals = [];
@@ -304,6 +352,9 @@ var CLI_LIMITS = {
   telemetryHistory: { default: 100, maximum: 1000 },
   linkPage: { default: 100, maximum: 1000 },
   users: { default: 20, maximum: 200 },
+  history: { default: 20, maximum: 100 },
+  datasetVersions: { default: 20, maximum: 100 },
+  datasetRows: { default: 100, maximum: 1000 },
   inspect: {
     depth: { default: 2, maximum: 3 },
     objects: { default: 20, maximum: 100 },
@@ -316,17 +367,17 @@ var DEFAULT_OBJECT_ORDER_BY = "updatedAt";
 var DEFAULT_TELEMETRY_ORDER = "desc";
 
 // src/commands/metadata.ts
-var SANDBOX_MAIN_HELP = `Sixb agent CLI
+var SANDBOX_MAIN_HELP = `Sixb CLI
 
 Usage:
   sixb <command> [options]
 
-The CLI uses the run-scoped SIXB_API_BASE_URL. Do not configure authentication or another origin.
+The CLI uses the run's SIXB_API_BASE_URL, which adds its credentials. Do not configure authentication or another origin.
 API commands emit JSON. Help, version, and examples emit text. Downloads write to --output and
 emit a JSON receipt.
 
 Discovery:
-  sixb doctor                         Check the sandbox and API gateway
+  sixb status                         Check the sandbox and its API access
   sixb context                        Print the current run context
   sixb project show                   Show project metadata
   sixb ontology list                  Compact visible type and relationship catalog
@@ -361,6 +412,13 @@ Actions and workflows:
   sixb workflows list|get|start ...
   sixb workflow-runs list|get ...
 
+Data:
+  sixb datasets list|get|versions|rows ...
+  sixb syncs list|get ...             Syncs you may run, each with its latest run
+  sixb sync-runs list ...
+  sixb pipelines list|get ...         Pipelines you may run, each with its latest run
+  sixb pipeline-runs list|get ...
+
 Files:
   sixb files upload|download ...
 
@@ -373,23 +431,8 @@ A user parameter or property is {"type":"user","id":"<user-id>"}. Find the id wi
 
 Run \`sixb <group> --help\` or \`sixb <group> <command> --help\` for exact arguments.
 For query IR, run \`sixb objects query --help\` and \`sixb objects query --example list\`.`;
-var LOCAL_MAIN_HELP = SANDBOX_MAIN_HELP.replace("Sixb agent CLI", "Sixb instance CLI").replace("The CLI uses the run-scoped SIXB_API_BASE_URL. Do not configure authentication or another origin.", "The CLI uses the selected local profile and its API credentials.").replace(`  sixb doctor                         Check the sandbox and API gateway
-  sixb context                        Print the current run context
-`, "").replace(`
-When you do not know a type's properties or links, read its file under $SIXB_ONTOLOGY_DIR. Use
-\`sixb ontology get\` for a type that has no file there.
-`, "").replace(`Files:
-  sixb files upload|download ...
-`, `Files:
-  sixb files upload|download ...
-
-Models:
-  sixb models list [--kind <kind>]    Configured models of every kind, with prices
-  sixb models get <model>             One model's options and rate card
-  sixb models text|image|speech|transcribe ...   Call a model; see sixb models --help
-`);
-function renderInstanceHelp(mode) {
-  return mode === "sandbox" ? SANDBOX_MAIN_HELP : LOCAL_MAIN_HELP;
+function renderInstanceHelp() {
+  return SANDBOX_MAIN_HELP;
 }
 var SEARCH_DETAILS = `Without --type, search matches primary-id prefixes and full-text fields across visible types.
 With --type, the server embeds the text with the profile's model and ranks results by score,
@@ -513,8 +556,15 @@ identities. Put limits and pages inside the query tree.
 Vector profile names are the keys of the type's search.vectors. Vector input is a start node,
 optionally under filters; k bounds the ranked matches and results carry a score.`;
 var GROUP_HELP = {
-  doctor: "Usage: sixb doctor",
+  status: "Usage: sixb status",
   context: "Usage: sixb context",
+  history: `Usage:
+  sixb history [--offset <n>] [--limit <1-${CLI_LIMITS.history.maximum}>]
+  sixb history <seq>
+
+Prints this conversation's messages as text, oldest first, including those summarized when it
+was compacted: what was said, the files sent, and each tool call with its result. A page holds
+${CLI_LIMITS.history.default} messages by default and cuts long text; \`sixb history <seq>\` prints one message whole.`,
   project: "Usage: sixb project show",
   ontology: `Usage:
   sixb ontology list [--full]
@@ -555,7 +605,8 @@ List options:
   files: `Usage:
   sixb files upload <local-path> [--logical-path <path>]
   sixb files download object <type> <id> --path <json-pointer> --output <local-path>
-  sixb files download action-run|workflow-run <run-id> --path <json-pointer> --output <local-path>`,
+  sixb files download action-run|workflow-run <run-id> --path <json-pointer> --output <local-path>
+  sixb files download url <content-url> --output <local-path>`,
   workflows: `Usage:
   sixb workflows list
   sixb workflows get <workflow-id>
@@ -566,14 +617,15 @@ for the user's approval prints \`"status": "awaiting_approval"\` and exits with
   users: `Usage:
   sixb users list [options]
   sixb users search <text> [options]
-  sixb users get <user-id>
+  sixb users get <user-id|email>
 
 Options:
   --status active|suspended|all       Defaults to active
   --limit <1-${CLI_LIMITS.users.maximum}>                     Defaults to ${CLI_LIMITS.users.default}
   --offset <n>                        Non-negative; defaults to 0
 
-\`users search\` matches part of a display name or email, ignoring case. Each member is
+\`users search\` matches part of a display name or email, ignoring case; \`users get\` takes an
+exact email, ignoring case, and finds suspended members too. Each member is
 {"id","email","displayName","avatarUrl","status"}; a user parameter takes
 {"type":"user","id":"<id>"}. Reading members requires can.view(project.users).`,
   models: `Usage:
@@ -611,7 +663,57 @@ List options:
   --started-after|--started-before <RFC3339>
   --limit <1-${CLI_LIMITS.list.maximum}>              Defaults to ${CLI_LIMITS.list.default}
   --offset <n>                  Non-negative; defaults to 0
-  --order <asc|desc>            Started-time order; defaults to ${DEFAULT_LIST_ORDER}`
+  --order <asc|desc>            Started-time order; defaults to ${DEFAULT_LIST_ORDER}`,
+  datasets: `Usage:
+  sixb datasets list
+  sixb datasets get <dataset-id>
+  sixb datasets versions <dataset-id> [--limit <1-${CLI_LIMITS.datasetVersions.maximum}>]
+  sixb datasets rows <dataset-id> [options]
+
+Rows options:
+  --version <version-id>        Defaults to the latest version
+  --columns <a,b,...>           Defaults to every column
+  --limit <1-${CLI_LIMITS.datasetRows.maximum}>              Defaults to ${CLI_LIMITS.datasetRows.default}
+  --offset <n>                  Non-negative; defaults to 0
+
+\`list\` and \`get\` show a dataset's schema, its latest version, and the syncs and pipelines you
+may run that read or write it. \`versions\` lists the newest first. \`rows\` leaves out the
+columns your clearances do not cover and names them under redactions.`,
+  syncs: `Usage:
+  sixb syncs list
+  sixb syncs get <sync-id>
+
+Lists the syncs you may run, each with its latest run. \`sixb sync-runs list\` shows the history.`,
+  "sync-runs": `Usage:
+  sixb sync-runs list [options]
+
+List options:
+  --sync <sync-id>
+  --dataset <dataset-id>
+  --status queued|running|succeeded|failed|cancelled
+  --started-after|--started-before <RFC3339>
+  --limit <1-${CLI_LIMITS.list.maximum}>              Defaults to ${CLI_LIMITS.list.default}
+  --offset <n>                  Non-negative; defaults to 0
+  --order <asc|desc>            Started-time order; defaults to ${DEFAULT_LIST_ORDER}`,
+  pipelines: `Usage:
+  sixb pipelines list
+  sixb pipelines get <pipeline-id>
+
+Lists the pipelines you may run, each with its latest run. \`sixb pipeline-runs\` shows the
+history and each run's steps.`,
+  "pipeline-runs": `Usage:
+  sixb pipeline-runs list [options]
+  sixb pipeline-runs get <run-id>
+
+List options:
+  --pipeline <pipeline-id>
+  --status queued|running|succeeded|failed|cancelled
+  --started-after|--started-before <RFC3339>
+  --limit <1-${CLI_LIMITS.list.maximum}>              Defaults to ${CLI_LIMITS.list.default}
+  --offset <n>                  Non-negative; defaults to 0
+  --order <asc|desc>            Started-time order; defaults to ${DEFAULT_LIST_ORDER}
+
+\`get\` includes the run's steps.`
 };
 var QUERY_EXAMPLES = {
   exact: '{"kind":"refs","refs":[{"objectTypeId":"RepositoryIssue","primaryId":"github:issue:owner/repo#297"}]}',
@@ -633,6 +735,11 @@ var FACETS_EXAMPLE = '{"query":{"kind":"start","objectTypeId":"WorkOrder"},"face
 
 // src/commands/shared.ts
 import { readFile as readFile2 } from "fs/promises";
+function idSegment(value) {
+  if (!value || value === "." || value === "..")
+    fail(`'${value ?? ""}' is not an id.`);
+  return encodeURIComponent(value);
+}
 function parseQueryOptions(args, names, command) {
   const kinds = Object.fromEntries(Object.keys(names).map((flag) => [flag, "string"]));
   const { options } = parseCommandArgs(args, kinds, command);
@@ -706,7 +813,7 @@ async function actions(api, args, requestWaitMs = ACTION_REQUEST_WAIT_MS) {
     return writeText(GROUP_HELP.actions);
   if (sub === "get") {
     const { positionals } = parseCommandArgs(rest, {}, "actions get", 1);
-    return writeJson(await api.get(`/api/actions/${encodeURIComponent(positionals[0] ?? "")}`));
+    return writeJson(await api.get(`/api/actions/${idSegment(positionals[0])}`));
   }
   if (sub === "list") {
     const options = parseQueryOptions(rest, { "--type": "objectTypeId" }, "actions list");
@@ -739,7 +846,7 @@ async function actions(api, args, requestWaitMs = ACTION_REQUEST_WAIT_MS) {
     const requestedRunId = runId ?? `act_${randomUUID2()}`;
     const waiting = AbortSignal.timeout(requestWaitMs);
     try {
-      return writeRequestResult(await api.post(`/api/actions/${encodeURIComponent(actionId)}`, {
+      return writeRequestResult(await api.post(`/api/actions/${idSegment(actionId)}`, {
         params,
         ...subjectType && subjectId ? { subject: { kind: "object", objectTypeId: subjectType, primaryId: subjectId } } : {},
         runId: requestedRunId
@@ -757,6 +864,59 @@ async function actions(api, args, requestWaitMs = ACTION_REQUEST_WAIT_MS) {
   fail(`Unknown actions command '${sub}'.`);
 }
 
+// src/commands/data.ts
+async function datasets(api, args) {
+  const [sub, ...rest] = args;
+  if (!sub || isHelp(sub) || requestsHelp(rest))
+    return writeText(GROUP_HELP.datasets);
+  if (sub === "list") {
+    parseCommandArgs(rest, {}, "datasets list");
+    return writeJson(await api.get("/api/datasets"));
+  }
+  if (sub === "get") {
+    const { positionals } = parseCommandArgs(rest, {}, "datasets get", 1);
+    return writeJson(await api.get(`/api/datasets/${idSegment(positionals[0])}`));
+  }
+  if (sub === "versions") {
+    const { positionals, options } = parseCommandArgs(rest, { "--limit": "string" }, "datasets versions", 1);
+    const { default: fallback, maximum } = CLI_LIMITS.datasetVersions;
+    const limit = integerInRange("--limit", options["--limit"] ?? String(fallback), 1, maximum);
+    return writeJson(await api.get(`/api/datasets/${idSegment(positionals[0])}/versions`, { limit: String(limit) }));
+  }
+  if (sub === "rows") {
+    const { positionals, options } = parseCommandArgs(rest, { "--version": "string", "--columns": "string", "--limit": "string", "--offset": "string" }, "datasets rows", 1);
+    const { default: fallback, maximum } = CLI_LIMITS.datasetRows;
+    const query = {
+      limit: String(integerInRange("--limit", options["--limit"] ?? String(fallback), 1, maximum)),
+      ...options["--version"] === undefined ? {} : { versionId: options["--version"] },
+      ...options["--columns"] === undefined ? {} : { columns: columnList(options["--columns"]) },
+      ...options["--offset"] === undefined ? {} : { offset: String(nonNegativeInteger("--offset", options["--offset"])) }
+    };
+    return writeJson(await api.get(`/api/datasets/${idSegment(positionals[0])}/rows`, query));
+  }
+  fail(`Unknown datasets command '${sub}'.`);
+}
+async function runnables(api, group, args) {
+  const [sub, ...rest] = args;
+  if (!sub || isHelp(sub) || requestsHelp(rest))
+    return writeText(GROUP_HELP[group]);
+  if (sub === "list") {
+    parseCommandArgs(rest, {}, `${group} list`);
+    return writeJson(await api.get(`/api/${group}`));
+  }
+  if (sub === "get") {
+    const { positionals } = parseCommandArgs(rest, {}, `${group} get`, 1);
+    return writeJson(await api.get(`/api/${group}/${idSegment(positionals[0])}`));
+  }
+  fail(`Unknown ${group} command '${sub}'.`);
+}
+function columnList(value) {
+  const columns = value.split(",").map((column) => column.trim());
+  if (columns.some((column) => !column))
+    fail("--columns takes column names separated by commas.");
+  return columns.join(",");
+}
+
 // src/commands/files.ts
 import { access } from "fs/promises";
 async function files(api, args) {
@@ -776,20 +936,28 @@ async function files(api, args) {
   if (sub === "download") {
     const { positionals, options } = parseCommandArgs(rest, { "--path": "string", "--output": "string" }, "files download", [2, 3]);
     const context = positionals[0];
+    const output = options["--output"];
+    if (context === "url") {
+      requireExact(positionals, 2, "files download url requires exactly one content URL.");
+      const url = parseContentUrl(positionals[1] ?? "");
+      if (!output)
+        fail("files download requires --output <local-path>.");
+      await api.download(url.pathname, output, Object.fromEntries(url.searchParams));
+      return writeJson({ downloaded: true, output });
+    }
     let route;
     if (context === "object") {
       requireExact(positionals, 3, "files download object requires object type and primary id.");
       const type = positionals[1] ?? "";
       const id = positionals[2] ?? "";
-      route = `/api/objects/${encodeURIComponent(type)}/${encodeURIComponent(id)}/files/content`;
+      route = `/api/objects/${idSegment(type)}/${idSegment(id)}/files/content`;
     } else if (context === "action-run" || context === "workflow-run") {
       requireExact(positionals, 2, `files download ${context} requires exactly one run id.`);
       const id = positionals[1] ?? "";
-      route = `/api/${context}s/${encodeURIComponent(id)}/files/content`;
+      route = `/api/${context}s/${idSegment(id)}/files/content`;
     } else
       fail(`Unknown file download context '${context}'.`);
     const path = options["--path"];
-    const output = options["--output"];
     if (!path)
       fail("files download requires --path <json-pointer>.");
     if (!output)
@@ -799,6 +967,18 @@ async function files(api, args) {
   }
   fail(`Unknown files command '${sub}'.`);
 }
+function parseContentUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    fail(`'${value}' is not a URL.`);
+  }
+  if (!url.pathname.startsWith("/api/") || !url.pathname.endsWith("/files/content")) {
+    fail(`'${value}' is not a Sixb file content URL.`);
+  }
+  return url;
+}
 
 // src/commands/models.ts
 import { access as access2, mkdir, stat } from "fs/promises";
@@ -979,7 +1159,7 @@ async function calls(api, args) {
     fail(`Unknown models calls command '${sub ?? ""}'. Use 'models calls files'.`);
   const { positionals, options } = parseCommandArgs(rest, { "--output": "string" }, "models calls files", 1);
   const callId = positionals[0] ?? "";
-  const call = await api.get(`/api/ai/model-calls/${encodeURIComponent(callId)}/files`);
+  const call = await api.get(`/api/ai/model-calls/${idSegment(callId)}/files`);
   const output = options["--output"];
   if (output === undefined)
     return writeJson(call);
@@ -1052,7 +1232,7 @@ async function saveFiles(api, callId, files, output) {
   });
   for (const [index, path] of paths.entries()) {
     await mkdir(dirname2(path), { recursive: true });
-    await api.download(`/api/ai/model-calls/${encodeURIComponent(callId)}/files/content`, path, {
+    await api.download(`/api/ai/model-calls/${idSegment(callId)}/files/content`, path, {
       path: `/files/${index}`
     });
   }
@@ -1696,7 +1876,7 @@ async function ontology(api, args) {
     if (requestsHelp(rest))
       return writeText("Usage: sixb ontology get <object-type>");
     const { positionals } = parseCommandArgs(rest, {}, "ontology get", 1);
-    return writeJson(await api.get(`/api/object-types/${encodeURIComponent(positionals[0] ?? "")}`));
+    return writeJson(await api.get(`/api/object-types/${idSegment(positionals[0])}`));
   }
   fail(`Unknown ontology command '${sub}'.`);
 }
@@ -1722,12 +1902,25 @@ var WORKFLOW_RUN_STATUSES = [
   "failed",
   "cancelled"
 ];
+var DATA_RUN_STATUSES = ["queued", "running", "succeeded", "failed", "cancelled"];
+var STATUSES = {
+  action: ACTION_RUN_STATUSES,
+  workflow: WORKFLOW_RUN_STATUSES,
+  sync: DATA_RUN_STATUSES,
+  pipeline: DATA_RUN_STATUSES
+};
+var FILTERS = {
+  action: { "--action": "actionId", "--type": "objectTypeId", "--id": "primaryId" },
+  workflow: { "--workflow": "workflowId" },
+  sync: { "--sync": "syncId", "--dataset": "datasetId" },
+  pipeline: { "--pipeline": "pipelineId" }
+};
 async function runs(api, kind, args) {
   const [sub, ...rest] = args;
   const group = `${kind}-runs`;
   if (!sub || isHelp(sub) || requestsHelp(rest))
     return writeText(GROUP_HELP[group]);
-  if (sub === "get") {
+  if (sub === "get" && kind !== "sync") {
     const { positionals } = parseCommandArgs(rest, {}, `${group} get`, 1);
     return writeJson(await api.get(`/api/${group}/${encodeURIComponent(positionals[0] ?? "")}`));
   }
@@ -1740,21 +1933,14 @@ async function runs(api, kind, args) {
       "--offset": "offset",
       "--order": "order"
     };
-    const action = {
-      ...common,
-      "--action": "actionId",
-      "--type": "objectTypeId",
-      "--id": "primaryId"
-    };
-    const workflow = { ...common, "--workflow": "workflowId" };
-    const options = normalizeWindowOptions(parseQueryOptions(rest, kind === "action" ? action : workflow, `${group} list`), {
+    const options = normalizeWindowOptions(parseQueryOptions(rest, { ...common, ...FILTERS[kind] }, `${group} list`), {
       defaultLimit: CLI_LIMITS.list.default,
       maximumLimit: CLI_LIMITS.list.maximum,
       defaultOrder: DEFAULT_LIST_ORDER,
       offset: true
     });
     if (options.status !== undefined) {
-      options.status = enumValue("--status", options.status, kind === "action" ? ACTION_RUN_STATUSES : WORKFLOW_RUN_STATUSES);
+      options.status = enumValue("--status", options.status, STATUSES[kind]);
     }
     for (const [name, flag] of [
       ["startedAfter", "--started-after"],
@@ -1808,7 +1994,7 @@ async function telemetry(api, args) {
   fail(`Unknown telemetry command '${sub}'.`);
 }
 function telemetryPath(args, terminal) {
-  return `/api/objects/${encodeURIComponent(args[0] ?? "")}/${encodeURIComponent(args[1] ?? "")}/telemetry/${encodeURIComponent(args[2] ?? "")}/${terminal}`;
+  return `/api/objects/${idSegment(args[0])}/${idSegment(args[1])}/telemetry/${idSegment(args[2])}/${terminal}`;
 }
 function normalizeTelemetryQueryInput(input) {
   if (Array.isArray(input) || typeof input !== "object" || input === null) {
@@ -1850,7 +2036,18 @@ async function users(api, args) {
     return writeText(GROUP_HELP.users);
   if (sub === "get") {
     const { positionals } = parseCommandArgs(rest, {}, "users get", 1);
-    return writeJson(await api.get(`/api/users/${encodeURIComponent(positionals[0] ?? "")}`));
+    const user = positionals[0]?.trim();
+    if (!user)
+      fail("users get requires a user id or email.");
+    if (!user.includes("@")) {
+      return writeJson(await api.get(`/api/users/${idSegment(user)}`));
+    }
+    const page = await api.get("/api/users", { email: user });
+    const [member] = isRecord(page) && Array.isArray(page.users) ? page.users : [];
+    if (member === undefined) {
+      throw new CliError({ code: "not_found", message: `No member has the email '${user}'.` }, EXIT_API);
+    }
+    return writeJson(member);
   }
   if (sub === "list") {
     const { options } = parseCommandArgs(rest, LIST_FLAGS, "users list");
@@ -1873,6 +2070,9 @@ function listQuery(options) {
     ...options["--offset"] === undefined ? {} : { offset: String(nonNegativeInteger("--offset", options["--offset"])) }
   };
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 
 // src/commands/workflows.ts
 import { randomUUID as randomUUID3 } from "crypto";
@@ -1888,7 +2088,7 @@ async function workflows(api, args) {
     const {
       positionals: [workflowId]
     } = parseCommandArgs(rest, {}, "workflows get", 1);
-    return writeJson(await api.get(`/api/workflows/${encodeURIComponent(workflowId ?? "")}`));
+    return writeJson(await api.get(`/api/workflows/${idSegment(workflowId)}`));
   }
   if (sub === "start") {
     const {
@@ -1900,7 +2100,7 @@ async function workflows(api, args) {
       fail("Workflow input must be a JSON object.");
     }
     const runId = options["--run-id"] ?? `run_${randomUUID3()}`;
-    return writeRequestResult(await api.post(`/api/workflows/${encodeURIComponent(workflowId ?? "")}/runs`, {
+    return writeRequestResult(await api.post(`/api/workflows/${idSegment(workflowId)}/runs`, {
       input,
       runId
     }));
@@ -1920,7 +2120,12 @@ var INSTANCE_COMMANDS = [
   "workflows",
   "workflow-runs",
   "users",
-  "models"
+  "models",
+  "datasets",
+  "syncs",
+  "sync-runs",
+  "pipelines",
+  "pipeline-runs"
 ];
 function isInstanceCommand(command) {
   return INSTANCE_COMMANDS.includes(command);
@@ -1949,6 +2154,16 @@ async function dispatch(api, command, args) {
       return users(api, args);
     case "models":
       return models(api, args);
+    case "datasets":
+      return datasets(api, args);
+    case "syncs":
+      return runnables(api, "syncs", args);
+    case "sync-runs":
+      return runs(api, "sync", args);
+    case "pipelines":
+      return runnables(api, "pipelines", args);
+    case "pipeline-runs":
+      return runs(api, "pipeline", args);
     default:
       fail(`Unknown command '${command}'. Run 'sixb --help'.`);
   }
@@ -1963,29 +2178,54 @@ function createInstanceApiClient(mode) {
     baseUrl: mode.baseUrl,
     ...mode.kind === "local" && mode.token ? { authorization: `Bearer ${mode.token}` } : {},
     missingBaseUrlMessage: mode.kind === "sandbox" ? "SIXB_API_BASE_URL is not set." : "The selected Sixb profile has no API URL.",
-    unavailableMessage: mode.kind === "sandbox" ? "The Sixb API gateway could not be reached." : "The Sixb API could not be reached.",
-    unavailableHint: mode.kind === "sandbox" ? "Run 'sixb doctor' to verify the sandbox runtime and gateway." : "Run 'sixb status' to verify the current profile."
+    unavailableMessage: mode.kind === "sandbox" ? "The Sixb API could not be reached from the sandbox." : "The Sixb API could not be reached.",
+    unavailableHint: mode.kind === "sandbox" ? "Run 'sixb status' to verify the sandbox runtime and its API access." : "Run 'sixb status' to verify the current profile."
   });
 }
+
+// src/commands/system.ts
+var AGENT_RUNTIME_PROFILE = "sixb-agent-runtime/v1";
+// src/memory.ts
+import { createHash } from "crypto";
+var AGENT_MEMORY_MANIFEST = "context/memory.json";
+var AGENT_MEMORY_ENTRY = "MEMORY.md";
+var AGENT_MEMORY_STARTER = `# Memory
+
+`;
+function agentMemoryFileHash(contents) {
+  return createHash("sha256").update(contents).digest("hex");
+}
+// src/sandbox-cli.ts
+import { readFile as readFile3 } from "fs/promises";
+var cachedAssets;
+function loadSandboxCliAssets() {
+  cachedAssets ??= Promise.all([
+    readFile3(new URL("./bin/sixb", import.meta.url), "utf8"),
+    readFile3(new URL("./generated/sixb.mjs", import.meta.url))
+  ]).then(([launcher, artifact]) => ({ launcher, artifact }));
+  return cachedAssets;
+}
 export {
+  AGENT_MEMORY_ENTRY,
+  AGENT_MEMORY_MANIFEST,
+  AGENT_MEMORY_STARTER,
+  AGENT_RUNTIME_PROFILE,
   ApiClient,
   CliError,
   EXIT_API,
   EXIT_USAGE,
   INSTANCE_CLI_VERSION,
   INSTANCE_COMMANDS,
-  asRecord2 as asRecord,
+  agentMemoryFileHash,
   createInstanceApiClient,
   fail,
-  isFileError,
-  isHelp,
   isInstanceCommand,
+  loadSandboxCliAssets,
   renderInstanceHelp,
   reportError,
   requestsHelp,
   runInstanceCli,
-  writeJson,
-  writeText
+  writeJson
 };
 
-//# debugId=7F5CD0F40A1B96CA64756E2164756E21
+//# debugId=35B6967DDC6E812864756E2164756E21