@swarmcraftai/cli 0.1.0 → 0.1.5

package/README.md

@@ -1,8 +1,8 @@
 # SwarmCraft CLI
 
-Customer-facing command line tool for preparing a repository for a SwarmCraft project board and running packet-based one-shot work.
+SwarmCraft CLI prepares a local repository for a SwarmCraft project board and runs packet-based agent workflows from the terminal.
 
-The CLI is separate from `apps/driver`. The driver remains internal scenario tooling for local operator runs, docs evidence, reports, and weekly validation. Customers should install and run the SwarmCraft CLI, not the internal driver scripts.
+Use it to authenticate with SwarmCraft, list available projects, seed workspace guidance files, materialize ticket packets, run one-shot implementation passes, resume or inspect runs, and create support bundles.
 
 ## Package Shape
 
@@ -57,17 +57,19 @@ Core commands:
 
 ```bash
 swarmcraft auth login --email <email>
-swarmcraft projects list
-swarmcraft init --project <project-id> --workspace <path>
-swarmcraft one-shot --project <project-id> --workspace <path> --agent-provider codex
+swarmcraft delegation start --user <customer-email-or-id> --reason <text> --expires-in-minutes 600
+swarmcraft projects list --delegation <delegation-id>
+swarmcraft init --project <project-id> --workspace <path> --delegation <delegation-id>
+swarmcraft one-shot --project <project-id> --workspace <path> --agent-provider codex --delegation <delegation-id>
 swarmcraft one-shot --project <project-id> --workspace <path> --agent-provider codex --run-id <known-run-id>
-swarmcraft resume --run <run-id> --workspace <path>
-swarmcraft status --run <run-id> --workspace <path>
+swarmcraft resume --run <run-id> --workspace <path> --delegation <delegation-id>
+swarmcraft status --run <run-id> --workspace <path> --delegation <delegation-id>
+swarmcraft delegation end --delegation <delegation-id>
 ```
 
 `swarmcraft init` validates the workspace git state, seeds the shared SwarmCraft repo guidance files, materializes non-done ticket packets, links those packets back to SwarmCraft, and prints the next commands.
 
-`swarmcraft one-shot` bootstraps the workspace, runs doing and checking through the selected agent provider, writes `.swarmcraft/runs/<run-id>/manifest.json`, and stops at reviewing by default. Use `--done-policy auto --commit-policy done` only when automatic done moves and commits are intended.
+`swarmcraft one-shot` bootstraps the workspace, runs the doing lane through the selected agent provider, syncs packet updates back to SwarmCraft, writes `.swarmcraft/runs/<run-id>/manifest.json`, streams progress to the terminal, writes agent logs under `.swarmcraft/runs/<run-id>/logs/`, and moves accepted work to `done` by default. Customer one-shots should normally pair this with `--commit-policy done` so each completed ticket creates a local commit. Use `--checking on` or `--reviewing on` only for internal validation runs that deliberately need those extra lanes.
 
 Useful safety and support commands:
 

package/dist/main.cjs

@@ -9,6 +9,10 @@ var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __commonJS = (cb, mod) => function __require() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
@@ -25,6 +29,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
   mod
 ));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // ../../packages/packet-workflow/dist/assistantActions.js
 var require_assistantActions = __commonJS({
@@ -2922,7 +2927,8 @@ var require_seedProjectFiles = __commonJS({
       const existingEndIndex = existingContents.indexOf(renderProjectGuide_1.MANAGED_SECTION_END);
       if (existingStartIndex >= 0 && existingEndIndex >= 0 && existingEndIndex > existingStartIndex) {
         const replacementEndIndex = existingEndIndex + renderProjectGuide_1.MANAGED_SECTION_END.length;
-        const updatedContents = `${existingContents.slice(0, existingStartIndex)}${managedSection}${existingContents.slice(replacementEndIndex)}`;
+        const afterManagedSection = existingContents.slice(replacementEndIndex).replace(/^\n+/, "\n");
+        const updatedContents = `${existingContents.slice(0, existingStartIndex)}${managedSection}${afterManagedSection}`;
         return normalizeTrailingNewline(updatedContents);
       }
       const separator = existingContents.endsWith("\n\n") ? "" : existingContents.endsWith("\n") ? "\n" : "\n\n";
@@ -2971,15 +2977,66 @@ var require_dist2 = __commonJS({
 });
 
 // src/main.ts
+var main_exports = {};
+__export(main_exports, {
+  findCommand: () => findCommand,
+  main: () => main,
+  parseArgs: () => parseArgs
+});
+module.exports = __toCommonJS(main_exports);
 var import_promises4 = require("node:fs/promises");
 var import_node_path5 = __toESM(require("node:path"), 1);
 var import_promises5 = require("node:readline/promises");
 var import_node_process = require("node:process");
 var import_packet_workflow3 = __toESM(require_dist(), 1);
 
+// package.json
+var package_default = {
+  name: "@swarmcraftai/cli",
+  version: "0.1.5",
+  description: "Prepare repositories and run packet-based SwarmCraft agent workflows from the terminal.",
+  license: "SEE LICENSE IN LICENSE.txt",
+  type: "module",
+  homepage: "https://swarmcraft.ai",
+  bugs: {
+    url: "https://swarmcraft.ai/login?next=%2Fapp%2Fsupport"
+  },
+  bin: {
+    swarmcraft: "dist/main.cjs"
+  },
+  files: [
+    "dist",
+    "README.md",
+    "LICENSE.txt"
+  ],
+  publishConfig: {
+    access: "public"
+  },
+  engines: {
+    node: ">=20.19.0"
+  },
+  scripts: {
+    clean: `node -e "require('node:fs').rmSync('dist',{recursive:true,force:true})"`,
+    typecheck: "tsc --noEmit -p tsconfig.json",
+    build: "pnpm --filter @swarmcraft/repo-seed build && pnpm run typecheck && pnpm run clean && esbuild src/main.ts --bundle --platform=node --format=cjs --target=node20.19 --outfile=dist/main.cjs",
+    check: "pnpm --filter @swarmcraft/repo-seed build && pnpm run typecheck && vitest run && pnpm run build && node ./dist/main.cjs --help",
+    dev: "pnpm run build && node ./dist/main.cjs",
+    "release:smoke": "pnpm run build && node ./scripts/smoke-packed-cli.mjs"
+  },
+  devDependencies: {
+    "@swarmcraft/packet-workflow": "workspace:*",
+    "@swarmcraft/repo-seed": "workspace:*",
+    "@types/node": "^24.10.1",
+    esbuild: "^0.25.11",
+    typescript: "^5.9.3",
+    vitest: "^3.2.4"
+  }
+};
+
 // src/apiClient.ts
 var API_REQUEST_TIMEOUT_MS = 15e3;
 var CLIENT_SOURCE_HEADER = "X-SwarmCraft-Client";
+var DELEGATION_HEADER = "X-SwarmCraft-Delegation";
 var REFRESH_TOKEN_COOKIE_NAME = "swarmcraft_refresh_token";
 var SwarmCraftApiError = class extends Error {
   status;
@@ -3031,56 +3088,88 @@ var SwarmCraftClient = class {
       accessToken
     );
   }
-  listProjects(accessToken) {
-    return this.requestJson("/projects", { method: "GET" }, accessToken);
+  startDelegation(accessToken, request) {
+    return this.requestJson(
+      "/support/delegations",
+      {
+        method: "POST",
+        body: JSON.stringify(request)
+      },
+      accessToken
+    );
+  }
+  loadDelegation(accessToken, delegationId) {
+    return this.requestJson(
+      `/support/delegations/${encodeURIComponent(delegationId)}`,
+      { method: "GET" },
+      accessToken
+    );
+  }
+  endDelegation(accessToken, delegationId) {
+    return this.requestJson(
+      `/support/delegations/${encodeURIComponent(delegationId)}`,
+      { method: "DELETE" },
+      accessToken
+    );
+  }
+  listProjects(accessToken, delegationId) {
+    return this.requestJson("/projects", { method: "GET" }, accessToken, void 0, delegationId);
   }
-  loadProject(projectId, accessToken) {
-    return this.requestJson(`/projects/${encodeURIComponent(projectId)}`, { method: "GET" }, accessToken);
+  loadProject(projectId, accessToken, delegationId) {
+    return this.requestJson(`/projects/${encodeURIComponent(projectId)}`, { method: "GET" }, accessToken, void 0, delegationId);
   }
-  loadBoard(projectId, accessToken) {
-    return this.requestJson(`/projects/${encodeURIComponent(projectId)}/board`, { method: "GET" }, accessToken);
+  loadBoard(projectId, accessToken, delegationId) {
+    return this.requestJson(`/projects/${encodeURIComponent(projectId)}/board`, { method: "GET" }, accessToken, void 0, delegationId);
   }
-  upsertTicketPacketLink(projectId, ticketId, request, accessToken) {
+  upsertTicketPacketLink(projectId, ticketId, request, accessToken, delegationId) {
     return this.requestJson(
       `/projects/${encodeURIComponent(projectId)}/tickets/${encodeURIComponent(ticketId)}/packet-link`,
       {
         method: "PUT",
         body: JSON.stringify(request)
       },
-      accessToken
+      accessToken,
+      void 0,
+      delegationId
     );
   }
-  moveTicket(projectId, ticketId, request, accessToken) {
+  moveTicket(projectId, ticketId, request, accessToken, delegationId) {
     return this.requestJson(
       `/projects/${encodeURIComponent(projectId)}/tickets/${encodeURIComponent(ticketId)}/move`,
       {
         method: "POST",
         body: JSON.stringify(request)
       },
-      accessToken
+      accessToken,
+      void 0,
+      delegationId
     );
   }
-  updateTicketNotes(projectId, ticketId, request, accessToken) {
+  updateTicketNotes(projectId, ticketId, request, accessToken, delegationId) {
     return this.requestJson(
       `/projects/${encodeURIComponent(projectId)}/tickets/${encodeURIComponent(ticketId)}/notes`,
       {
         method: "PATCH",
         body: JSON.stringify(request)
       },
-      accessToken
+      accessToken,
+      void 0,
+      delegationId
     );
   }
-  updateChecklistItem(projectId, ticketId, itemId, request, accessToken) {
+  updateChecklistItem(projectId, ticketId, itemId, request, accessToken, delegationId) {
     return this.requestJson(
       `/projects/${encodeURIComponent(projectId)}/tickets/${encodeURIComponent(ticketId)}/checklist-items/${encodeURIComponent(itemId)}`,
       {
         method: "PATCH",
         body: JSON.stringify(request)
       },
-      accessToken
+      accessToken,
+      void 0,
+      delegationId
     );
   }
-  async requestJson(path6, init, accessToken, refreshToken) {
+  async requestJson(path6, init, accessToken, refreshToken, delegationId) {
     const url = `${this.apiBaseUrl}${path6.startsWith("/") ? path6 : `/${path6}`}`;
     const method = (init.method ?? "GET").toUpperCase();
     const headers = new Headers(init.headers);
@@ -3097,6 +3186,9 @@ var SwarmCraftClient = class {
     if (refreshToken) {
       headers.set("Cookie", `${REFRESH_TOKEN_COOKIE_NAME}=${refreshToken}`);
     }
+    if (delegationId) {
+      headers.set(DELEGATION_HEADER, delegationId);
+    }
     let response;
     try {
       response = await fetch(url, {
@@ -3175,6 +3267,7 @@ var import_packet_workflow = __toESM(require_dist(), 1);
 var import_repo_seed = __toESM(require_dist2(), 1);
 
 // src/workspace.ts
+var import_node_fs = require("node:fs");
 var import_promises = require("node:fs/promises");
 var import_node_path = __toESM(require("node:path"), 1);
 var import_node_child_process = require("node:child_process");
@@ -3216,7 +3309,11 @@ async function writeWorkspaceFile(workspacePath, relativePath, contents) {
   await (0, import_promises.mkdir)(import_node_path.default.dirname(absolutePath), { recursive: true });
   await (0, import_promises.writeFile)(absolutePath, contents, "utf8");
 }
-async function runCommand(command, cwd, env = process.env) {
+async function runCommand(command, cwd, env = process.env, options = {}) {
+  if (options.logPath) {
+    await (0, import_promises.mkdir)(import_node_path.default.dirname(options.logPath), { recursive: true });
+  }
+  const logStream = options.logPath ? (0, import_node_fs.createWriteStream)(options.logPath, { flags: "a" }) : null;
   return new Promise((resolve) => {
     const child = (0, import_node_child_process.spawn)(command, {
       cwd,
@@ -3226,14 +3323,40 @@ async function runCommand(command, cwd, env = process.env) {
     });
     const stdoutChunks = [];
     const stderrChunks = [];
-    child.stdout.on("data", (chunk) => stdoutChunks.push(chunk));
-    child.stderr.on("data", (chunk) => stderrChunks.push(chunk));
+    child.stdout.on("data", (chunk) => {
+      stdoutChunks.push(chunk);
+      logStream?.write(chunk);
+      if (options.teeOutput) {
+        process.stdout.write(chunk);
+      }
+    });
+    child.stderr.on("data", (chunk) => {
+      stderrChunks.push(chunk);
+      logStream?.write(chunk);
+      if (options.teeOutput) {
+        process.stderr.write(chunk);
+      }
+    });
+    child.on("error", (error) => {
+      const chunk = Buffer.from(`${error.message}
+`, "utf8");
+      stderrChunks.push(chunk);
+      logStream?.write(chunk);
+      if (options.teeOutput) {
+        process.stderr.write(chunk);
+      }
+    });
     child.on("close", (code) => {
-      resolve({
+      const result = {
         exitCode: code ?? 1,
         stdout: Buffer.concat(stdoutChunks).toString("utf8"),
         stderr: Buffer.concat(stderrChunks).toString("utf8")
-      });
+      };
+      if (logStream) {
+        logStream.end(() => resolve(result));
+        return;
+      }
+      resolve(result);
     });
   });
 }
@@ -3258,11 +3381,11 @@ async function runGit(args, cwd) {
 // src/bootstrap.ts
 async function runBootstrap(client, accessToken, options) {
   const workspace = await validateWorkspace(options.workspacePath);
-  const project = await client.loadProject(options.projectId, accessToken);
+  const project = await client.loadProject(options.projectId, accessToken, options.delegationId);
   if (project.boardState !== "UNLOCKED") {
     throw new Error(`Project ${project.id} is ${project.boardState}; unlock the board before bootstrapping a workspace.`);
   }
-  const board = await client.loadBoard(project.id, accessToken);
+  const board = await client.loadBoard(project.id, accessToken, options.delegationId);
   const seedFilesWritten = await seedWorkspace(project, workspace.workspacePath);
   const selectedTickets = selectBootstrapTickets(board, options);
   const packetFilesCreated = [];
@@ -3312,14 +3435,17 @@ async function runBootstrap(client, accessToken, options) {
       await writeWorkspaceFile(workspace.workspacePath, relativePacketPath, packetContents);
       packetFilesCreated.push(relativePacketPath);
     }
-    await client.upsertTicketPacketLink(project.id, ticket.id, {
-      workspaceFolder: workspace.workspaceFolderName,
-      packetFilePath: relativePacketPath,
-      expectedRevision: ticket.revision,
-      lastSyncedTicketRevision: ticket.revision,
-      lastSyncedAt: syncedAt
-    }, accessToken);
-    linkedPackets.push(relativePacketPath);
+    const packetLinkMatches = ticket.packetLink && ticket.packetLink.workspaceFolder === workspace.workspaceFolderName && ticket.packetLink.packetFilePath === relativePacketPath;
+    if (!packetLinkMatches) {
+      await client.upsertTicketPacketLink(project.id, ticket.id, {
+        workspaceFolder: workspace.workspaceFolderName,
+        packetFilePath: relativePacketPath,
+        expectedRevision: ticket.revision,
+        lastSyncedTicketRevision: ticket.revision,
+        lastSyncedAt: syncedAt
+      }, accessToken, options.delegationId);
+      linkedPackets.push(relativePacketPath);
+    }
   }
   return {
     projectTitle: project.title || project.projectTitle || project.id,
@@ -3331,7 +3457,7 @@ async function runBootstrap(client, accessToken, options) {
     linkedPackets,
     skippedTickets,
     nextCommands: [
-      `swarmcraft one-shot --project ${project.id} --workspace ${workspace.workspacePath} --agent-provider codex`,
+      `swarmcraft one-shot --project ${project.id} --workspace ${workspace.workspacePath} --agent-provider codex${options.delegationId ? ` --delegation ${options.delegationId}` : ""}`,
       "Review generated files under .swarmcraft/, .github/, .agents/, and .codex/ before running agents."
     ]
   };
@@ -3367,21 +3493,28 @@ async function seedWorkspace(project, workspacePath) {
 var import_promises2 = require("node:fs/promises");
 var import_node_path3 = __toESM(require("node:path"), 1);
 var import_packet_workflow2 = __toESM(require_dist(), 1);
-async function runOneShot(client, accessToken, options) {
+async function runOneShot(client, accessTokenProvider, options) {
   const workspace = await validateWorkspace(options.workspacePath);
+  const getAccessToken = () => resolveAccessToken(accessTokenProvider);
   if (workspace.dirtyFileCount > 0 && !options.allowDirty) {
     throw new Error(`Workspace has ${workspace.dirtyFileCount} changed file(s). Commit, stash, or rerun with --allow-dirty before one-shot.`);
   }
-  await runBootstrap(client, accessToken, {
-    projectId: options.projectId,
-    workspacePath: workspace.workspacePath,
-    ticketIds: options.ticketIds,
-    ticketLimit: options.ticketLimit
-  });
-  const project = await client.loadProject(options.projectId, accessToken);
-  let board = await client.loadBoard(project.id, accessToken);
+  if (options.resumeRunId) {
+    printProgress("Resume detected; using existing packet files without re-running bootstrap.");
+  } else {
+    await runBootstrap(client, await getAccessToken(), {
+      projectId: options.projectId,
+      workspacePath: workspace.workspacePath,
+      ticketIds: options.ticketIds,
+      ticketLimit: options.ticketLimit,
+      delegationId: options.delegation?.id ?? null
+    });
+  }
+  const project = await client.loadProject(options.projectId, await getAccessToken(), options.delegation?.id ?? null);
+  let board = await client.loadBoard(project.id, await getAccessToken(), options.delegation?.id ?? null);
   const runId = options.resumeRunId ?? options.runId ?? createRunId();
   const manifestPath = resolveManifestPath(workspace.workspacePath, runId);
+  const selectedTickets = selectTickets(board, options);
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const manifest = await loadOrCreateManifest(manifestPath, {
     generator: "swarmcraft-cli",
@@ -3404,6 +3537,9 @@ async function runOneShot(client, accessToken, options) {
     }
   });
   await persistManifest(manifestPath, manifest);
+  printProgress(`Run ${runId} started for ${project.title || project.projectTitle || project.id}.`);
+  printProgress(`Manifest: ${manifestPath}`);
+  printProgress(`Selected tickets: ${selectedTickets.length}.`);
   let agentRequests = manifest.tickets.flatMap((ticket) => ticket.stages).length;
   const completedTicketIds = new Set(
     manifest.tickets.filter((ticket) => ["done", "manual-review-required"].includes(ticket.outcome)).map((ticket) => ticket.ticketId)
@@ -3412,10 +3548,13 @@ async function runOneShot(client, accessToken, options) {
     manifest.tickets = manifest.tickets.filter((ticket) => completedTicketIds.has(ticket.ticketId));
     await persistManifest(manifestPath, manifest);
   }
-  for (const selectedTicket of selectTickets(board, options)) {
+  let finalManifestPersisted = false;
+  for (const [ticketIndex, selectedTicket] of selectedTickets.entries()) {
     if (completedTicketIds.has(selectedTicket.id)) {
+      printProgress(`Skipping completed ticket ${ticketIndex + 1}/${selectedTickets.length}: ${selectedTicket.title}.`);
       continue;
     }
+    printProgress(`Starting ticket ${ticketIndex + 1}/${selectedTickets.length}: ${selectedTicket.title}.`);
     const ticketOutcome = {
       ticketId: selectedTicket.id,
       title: selectedTicket.title,
@@ -3430,7 +3569,7 @@ async function runOneShot(client, accessToken, options) {
     await persistManifest(manifestPath, manifest);
     const result = await processTicket({
       client,
-      accessToken,
+      getAccessToken,
       project,
       board,
       ticket: selectedTicket,
@@ -3448,30 +3587,59 @@ async function runOneShot(client, accessToken, options) {
     ticketOutcome.outcome = result.outcome;
     ticketOutcome.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
     ticketOutcome.elapsedMs = (0, import_packet_workflow2.computeElapsedMs)(ticketOutcome.startedAt, ticketOutcome.finishedAt);
+    printProgress(`Ticket ${ticketIndex + 1}/${selectedTickets.length} finished as ${result.outcome} in ${formatDuration(ticketOutcome.elapsedMs)}.`);
+    if (result.outcome === "done" || result.outcome === "manual-review-required") {
+      completedTicketIds.add(selectedTicket.id);
+    }
+    const willStop = result.outcome.startsWith("blocked");
+    const isFinalSelectedTicket = !hasRemainingUncompletedTickets(selectedTickets, ticketIndex + 1, completedTicketIds);
     if (result.outcome === "done" && options.commitPolicy === "done") {
-      ticketOutcome.commitCreated = await gitAddAndCommit(workspace.workspacePath, `Complete ${selectedTicket.id}: ${selectedTicket.title}`);
+      ticketOutcome.commitCreated = true;
+    }
+    if (willStop || isFinalSelectedTicket) {
+      finalizeManifest(manifest);
+      finalManifestPersisted = true;
     }
     await persistManifest(manifestPath, manifest);
-    if (result.outcome.startsWith("blocked")) {
+    if (result.outcome === "done" && options.commitPolicy === "done") {
+      ticketOutcome.commitCreated = await gitAddAndCommit(workspace.workspacePath, `Complete ${selectedTicket.id}: ${selectedTicket.title}`);
+      if (!ticketOutcome.commitCreated) {
+        await persistManifest(manifestPath, manifest);
+      }
+      printProgress(ticketOutcome.commitCreated ? "Committed completed ticket changes." : "No completed ticket changes to commit.");
+    }
+    if (willStop) {
+      printProgress(`Stopping because ticket is ${result.outcome}.`);
       break;
     }
   }
+  if (!finalManifestPersisted) {
+    finalizeManifest(manifest);
+    await persistManifest(manifestPath, manifest);
+  }
+  printProgress(`Run ${runId} finished with status ${manifest.status} in ${formatDuration(manifest.durations.elapsedMs)}.`);
+  return manifest;
+}
+function hasRemainingUncompletedTickets(selectedTickets, startIndex, completedTicketIds) {
+  return selectedTickets.slice(startIndex).some((ticket) => !completedTicketIds.has(ticket.id));
+}
+function finalizeManifest(manifest) {
   manifest.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
   manifest.status = resolveManifestStatus(manifest);
   manifest.durations = (0, import_packet_workflow2.summarizeWorkflowRunDurations)(manifest);
-  await persistManifest(manifestPath, manifest);
-  return manifest;
 }
 async function processTicket(context) {
   let currentBoard = context.board;
   let currentTicket = requireTicket(currentBoard, context.ticket.id);
   if (currentTicket.workflowState === "todo") {
-    currentBoard = await moveTicket(context.client, context.accessToken, context.project.id, currentTicket, "doing");
+    printProgress("Moving ticket to doing.");
+    currentBoard = await moveTicket(context.client, await context.getAccessToken(), context.project.id, currentTicket, "doing", context.options.delegation?.id ?? null);
     currentTicket = requireTicket(currentBoard, context.ticket.id);
   }
   const packetPath = (0, import_packet_workflow2.resolvePacketFilePath)(context.project, currentTicket, currentTicket.packetLink);
   context.ticketOutcome.packetPath = packetPath;
   await refreshPacketMetadata(context.workspacePath, packetPath, currentTicket);
+  printProgress(`Packet: ${packetPath}`);
   if (currentTicket.workflowState !== "checking" && currentTicket.workflowState !== "reviewing") {
     const doResult = await runStageAndSync({ ...context, board: currentBoard, ticket: currentTicket, packetPath, stage: "do" });
     currentBoard = doResult.board;
@@ -3481,7 +3649,8 @@ async function processTicket(context) {
     return moveAfterAcceptedChecking(context, currentBoard, currentTicket, packetPath);
   }
   if (currentTicket.workflowState === "doing") {
-    currentBoard = await moveTicket(context.client, context.accessToken, context.project.id, currentTicket, "checking");
+    printProgress("Moving ticket to checking.");
+    currentBoard = await moveTicket(context.client, await context.getAccessToken(), context.project.id, currentTicket, "checking", context.options.delegation?.id ?? null);
     currentTicket = requireTicket(currentBoard, currentTicket.id);
     await refreshPacketMetadata(context.workspacePath, packetPath, currentTicket);
   }
@@ -3491,9 +3660,11 @@ async function processTicket(context) {
     currentTicket = checkResult.ticket;
     if (currentTicket.workflowState === "doing") {
       if (attempt >= context.options.maxCheckingAttempts) {
+        printProgress("Checking sent the ticket back to doing and retry budget is exhausted.");
         return { board: currentBoard, ticket: currentTicket, outcome: "blocked-checking-retries-exhausted" };
       }
-      currentBoard = await moveTicket(context.client, context.accessToken, context.project.id, currentTicket, "checking");
+      printProgress(`Checking requested more work; retrying checking attempt ${attempt + 1}/${context.options.maxCheckingAttempts}.`);
+      currentBoard = await moveTicket(context.client, await context.getAccessToken(), context.project.id, currentTicket, "checking", context.options.delegation?.id ?? null);
       currentTicket = requireTicket(currentBoard, currentTicket.id);
       await refreshPacketMetadata(context.workspacePath, packetPath, currentTicket);
       continue;
@@ -3523,9 +3694,12 @@ async function runStageAndSync(context) {
     ticket: context.packetPath,
     workspace: context.workspacePath
   });
+  const agentRequestNumber = context.getAgentRequests() + 1;
+  const logPath = import_node_path3.default.join(import_node_path3.default.dirname(context.manifestPath), "logs", `${String(agentRequestNumber).padStart(4, "0")}-${context.stage}.log`);
   const stageOutcome = {
     stage: context.stage,
     command,
+    logPath: import_node_path3.default.relative(context.workspacePath, logPath),
     startedAt: (/* @__PURE__ */ new Date()).toISOString(),
     finishedAt: null,
     elapsedMs: null,
@@ -3539,7 +3713,9 @@ async function runStageAndSync(context) {
   context.ticketOutcome.stages.push(stageOutcome);
   await persistManifest(context.manifestPath, context.manifest);
   context.incrementAgentRequests();
-  const costOutputPath = import_node_path3.default.join(import_node_path3.default.dirname(context.manifestPath), "agent-cost", `${String(context.getAgentRequests() + 1).padStart(4, "0")}-${context.stage}.json`);
+  printProgress(`Running ${context.stage} stage for ${context.ticket.title}.`);
+  printProgress(`Agent log: ${stageOutcome.logPath}`);
+  const costOutputPath = import_node_path3.default.join(import_node_path3.default.dirname(context.manifestPath), "agent-cost", `${String(agentRequestNumber).padStart(4, "0")}-${context.stage}.json`);
   await (0, import_promises2.mkdir)(import_node_path3.default.dirname(costOutputPath), { recursive: true });
   const execution = await runCommand(command, context.workspacePath, await buildAgentEnvironment(context.options, {
     SWARMCRAFT_STAGE: context.stage,
@@ -3547,23 +3723,26 @@ async function runStageAndSync(context) {
     SWARMCRAFT_WORKSPACE: context.workspacePath,
     SWARMCRAFT_AGENT_PROVIDER: context.options.agentProvider,
     SWARMCRAFT_AGENT_COST_OUTPUT: costOutputPath
-  }));
+  }), { logPath, teeOutput: true });
   stageOutcome.exitCode = execution.exitCode;
   if (execution.exitCode !== 0) {
     stageOutcome.result = "failed";
     stageOutcome.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
     stageOutcome.elapsedMs = (0, import_packet_workflow2.computeElapsedMs)(stageOutcome.startedAt, stageOutcome.finishedAt);
     await persistManifest(context.manifestPath, context.manifest);
+    printProgress(`${context.stage} stage failed in ${formatDuration(stageOutcome.elapsedMs)}.`);
     throw new Error(`Agent command failed during ${context.stage}: ${execution.stderr || execution.stdout || command}`);
   }
   const syncResult = await syncPacketFile({
     client: context.client,
-    accessToken: context.accessToken,
+    getAccessToken: context.getAccessToken,
     project: context.project,
     board: context.board,
     ticket: context.ticket,
     workspacePath: context.workspacePath,
-    relativePacketPath: context.packetPath
+    relativePacketPath: context.packetPath,
+    allowLaneSync: context.options.checking || context.stage !== "do",
+    delegationId: context.options.delegation?.id ?? null
   });
   stageOutcome.result = "synced";
   stageOutcome.costUsd = await readStageCostUsd(costOutputPath);
@@ -3579,6 +3758,7 @@ async function runStageAndSync(context) {
   stageOutcome.laneAfter = syncResult.ticket.workflowState;
   stageOutcome.syncedChanges = syncResult.syncedChanges;
   await persistManifest(context.manifestPath, context.manifest);
+  printProgress(`${context.stage} stage completed in ${formatDuration(stageOutcome.elapsedMs)}; synced ${syncResult.syncedChanges} change(s); lane is ${syncResult.ticket.workflowState}.`);
   return { board: syncResult.board, ticket: syncResult.ticket };
 }
 async function syncPacketFile(input2) {
@@ -3609,7 +3789,7 @@ async function syncPacketFile(input2) {
       currentBoard = await input2.client.updateChecklistItem(input2.project.id, currentTicket.id, currentItem.id, {
         completed: parsedItem.completed,
         expectedRevision: currentItem.revision
-      }, input2.accessToken);
+      }, await input2.getAccessToken(), input2.delegationId);
       currentTicket = requireTicket(currentBoard, currentTicket.id);
       syncedChanges += 1;
     }
@@ -3619,12 +3799,12 @@ async function syncPacketFile(input2) {
     currentBoard = await input2.client.updateTicketNotes(input2.project.id, currentTicket.id, {
       notes: desiredNotes,
       expectedRevision: currentTicket.revision
-    }, input2.accessToken);
+    }, await input2.getAccessToken(), input2.delegationId);
     currentTicket = requireTicket(currentBoard, currentTicket.id);
     syncedChanges += 1;
   }
-  if (parsedPacket.frontmatter.lane !== currentTicket.workflowState) {
-    currentBoard = await moveTicket(input2.client, input2.accessToken, input2.project.id, currentTicket, parsedPacket.frontmatter.lane);
+  if (input2.allowLaneSync && parsedPacket.frontmatter.lane !== currentTicket.workflowState) {
+    currentBoard = await moveTicket(input2.client, await input2.getAccessToken(), input2.project.id, currentTicket, parsedPacket.frontmatter.lane, input2.delegationId);
     currentTicket = requireTicket(currentBoard, currentTicket.id);
     syncedChanges += 1;
   }
@@ -3639,6 +3819,10 @@ async function buildAgentEnvironment(options, stageEnv) {
     TERM: process.env.TERM,
     ...stageEnv
   };
+  if (options.commitPolicy === "done") {
+    env.SWARMCRAFT_DRIVER_AUTO_COMMIT = "true";
+    env.SWARMCRAFT_CLI_AUTO_COMMIT = "true";
+  }
   if (!options.agentApiKeyEnvName) {
     return env;
   }
@@ -3675,23 +3859,28 @@ function sumStageCostUsd(manifest) {
   return manifest.tickets.flatMap((ticket) => ticket.stages).reduce((total, stage) => total + Number(stage.costUsd ?? 0), 0);
 }
 async function moveAfterAcceptedChecking(context, board, ticket, packetPath) {
-  if (context.options.donePolicy === "auto") {
-    const doneBoard = ticket.workflowState === "done" ? board : await moveTicket(context.client, context.accessToken, context.project.id, ticket, "done");
+  if (!context.options.reviewing) {
+    printProgress("Moving accepted ticket to done.");
+    const doneBoard = ticket.workflowState === "done" ? board : await moveTicket(context.client, await context.getAccessToken(), context.project.id, ticket, "done", context.options.delegation?.id ?? null);
     const doneTicket = requireTicket(doneBoard, ticket.id);
     await refreshPacketMetadata(context.workspacePath, packetPath, doneTicket);
     return { board: doneBoard, ticket: doneTicket, outcome: "done" };
   }
-  const reviewBoard = ticket.workflowState === "reviewing" ? board : await moveTicket(context.client, context.accessToken, context.project.id, ticket, "reviewing");
+  let reviewBoard = board;
+  if (ticket.workflowState !== "reviewing") {
+    printProgress("Moving accepted ticket to reviewing.");
+    reviewBoard = await moveTicket(context.client, await context.getAccessToken(), context.project.id, ticket, "reviewing", context.options.delegation?.id ?? null);
+  }
   const reviewTicket = requireTicket(reviewBoard, ticket.id);
   await refreshPacketMetadata(context.workspacePath, packetPath, reviewTicket);
   return { board: reviewBoard, ticket: reviewTicket, outcome: "manual-review-required" };
 }
-async function moveTicket(client, accessToken, projectId, ticket, workflowState) {
+async function moveTicket(client, accessToken, projectId, ticket, workflowState, delegationId) {
   return client.moveTicket(projectId, ticket.id, {
     workflowState,
     targetIndex: null,
     expectedRevision: ticket.revision
-  }, accessToken);
+  }, accessToken, delegationId);
 }
 async function refreshPacketMetadata(workspacePath, relativePacketPath, ticket, syncedAt = (/* @__PURE__ */ new Date()).toISOString()) {
   const contents = await readWorkspaceFile(workspacePath, relativePacketPath);
@@ -3782,6 +3971,29 @@ function describeAgentPolicy(options) {
     })
   };
 }
+function printProgress(message) {
+  console.log(`[one-shot] ${message}`);
+}
+async function resolveAccessToken(accessTokenProvider) {
+  return typeof accessTokenProvider === "string" ? accessTokenProvider : accessTokenProvider();
+}
+function formatDuration(elapsedMs) {
+  if (elapsedMs === null || elapsedMs === void 0) {
+    return "unknown";
+  }
+  const seconds = Math.round(elapsedMs / 1e3);
+  if (seconds < 60) {
+    return `${seconds}s`;
+  }
+  const minutes = Math.floor(seconds / 60);
+  const remainingSeconds = seconds % 60;
+  if (minutes < 60) {
+    return remainingSeconds === 0 ? `${minutes}m` : `${minutes}m ${remainingSeconds}s`;
+  }
+  const hours = Math.floor(minutes / 60);
+  const remainingMinutes = minutes % 60;
+  return remainingMinutes === 0 ? `${hours}h` : `${hours}h ${remainingMinutes}m`;
+}
 
 // src/sessionStore.ts
 var import_promises3 = require("node:fs/promises");
@@ -3822,10 +4034,52 @@ function sessionExpiresSoon(session) {
   return expiresAt - Date.now() < 6e4;
 }
 
+// src/supportBundle.ts
+function summarizeDelegationForBundle(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || !("options" in value)) {
+    return null;
+  }
+  const options = value.options;
+  if (!options || typeof options !== "object" || Array.isArray(options) || !("delegation" in options)) {
+    return null;
+  }
+  const delegation = options.delegation;
+  if (!delegation || typeof delegation !== "object" || Array.isArray(delegation)) {
+    return null;
+  }
+  const typedDelegation = delegation;
+  return {
+    id: typedDelegation.id ?? null,
+    status: typedDelegation.status ?? null,
+    expiresAt: typedDelegation.expiresAt ?? null,
+    supportTicketId: typedDelegation.supportTicketId ?? null,
+    hasActorEmail: Boolean(typedDelegation.actorEmail),
+    hasTargetEmail: Boolean(typedDelegation.targetEmail),
+    hasTargetUserId: Boolean(typedDelegation.targetUserId),
+    hasReason: Boolean(typedDelegation.reason)
+  };
+}
+function redactSupportBundleValue(value) {
+  if (Array.isArray(value)) {
+    return value.map(redactSupportBundleValue);
+  }
+  if (!value || typeof value !== "object") {
+    return value;
+  }
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => [
+      key,
+      /token|secret|password|api[-_]?key|credential|actorEmail|targetEmail|targetUserId|actorUserId|reason/i.test(key) ? "<redacted>" : redactSupportBundleValue(entry)
+    ])
+  );
+}
+
 // src/main.ts
-var VERSION = "0.1.0";
+var VERSION = package_default.version;
 var DEFAULT_API_BASE_URL = "https://swarmcraft.ai/api";
 var AGENT_PROVIDER_USAGE = import_packet_workflow3.EXTERNAL_AGENT_PROVIDERS.join("|");
+var MIN_DELEGATION_EXPIRY_MINUTES = 5;
+var MAX_DELEGATION_EXPIRY_MINUTES = 600;
 var COMMANDS = [
   {
     name: "auth login",
@@ -3833,45 +4087,57 @@ var COMMANDS = [
     summary: "Sign in to SwarmCraft and store a local CLI session.",
     implemented: true
   },
+  {
+    name: "delegation start",
+    usage: "swarmcraft delegation start --user <email-or-id> --reason <text> [--support-ticket <id>] [--expires-in-minutes <n>]",
+    summary: "Start short-lived operator access to a customer project workspace.",
+    implemented: true
+  },
+  {
+    name: "delegation end",
+    usage: "swarmcraft delegation end --delegation <id>",
+    summary: "End an active operator delegation.",
+    implemented: true
+  },
   {
     name: "projects list",
-    usage: "swarmcraft projects list",
+    usage: "swarmcraft projects list [--delegation <id>] [--on-behalf-of <email-or-id> --delegation-reason <text>]",
     summary: "List SwarmCraft projects available to the signed-in user.",
     implemented: true
   },
   {
     name: "init",
-    usage: "swarmcraft init --project <project-id> --workspace <path> [--ticket <ticket-id>] [--ticket-limit <n|all>]",
+    usage: "swarmcraft init --project <project-id> --workspace <path> [--ticket <ticket-id>] [--ticket-limit <n|all>] [--delegation <id>]",
     summary: "Prepare a repository with SwarmCraft packet and agent guidance files.",
     implemented: true
   },
   {
     name: "one-shot",
-    usage: `swarmcraft one-shot --project <project-id> --workspace <path> --agent-provider ${AGENT_PROVIDER_USAGE} [--run-id <id>] [--done-policy stop|auto] [--commit-policy none|done] [--allow-dirty]`,
+    usage: `swarmcraft one-shot --project <project-id> --workspace <path> --agent-provider ${AGENT_PROVIDER_USAGE} [--delegation <id>] [--run-id <id>] [--checking on|off] [--reviewing on|off] [--done-policy stop|auto] [--commit-policy none|done] [--allow-dirty]`,
     summary: "Run the project board packet loop with the selected agent provider.",
     implemented: true
   },
   {
     name: "resume",
-    usage: "swarmcraft resume --run <run-id> --workspace <path>",
+    usage: "swarmcraft resume --run <run-id> --workspace <path> [--allow-dirty] [--delegation <id>]",
     summary: "Resume a prior CLI run from its recorded manifest.",
     implemented: true
   },
   {
     name: "status",
-    usage: "swarmcraft status --run <run-id> --workspace <path>",
+    usage: "swarmcraft status --run <run-id> --workspace <path> [--delegation <id>]",
     summary: "Show the status of a recorded CLI run.",
     implemented: true
   },
   {
     name: "doctor",
-    usage: "swarmcraft doctor [--workspace <path>] [--agent-provider codex|copilot|custom]",
+    usage: "swarmcraft doctor [--workspace <path>] [--agent-provider codex|copilot|custom] [--delegation <id>]",
     summary: "Check local auth, API, git, workspace, runtime, and agent prerequisites.",
     implemented: true
   },
   {
     name: "support-bundle",
-    usage: "swarmcraft support-bundle --run <run-id> --workspace <path>",
+    usage: "swarmcraft support-bundle --run <run-id> --workspace <path> [--delegation <id>]",
     summary: "Collect a redacted support bundle for a CLI run.",
     implemented: true
   }
@@ -3908,6 +4174,12 @@ Run "swarmcraft --help" for available commands.`);
     case "auth login":
       await runAuthLogin(parsed);
       return 0;
+    case "delegation start":
+      await runDelegationStart(parsed);
+      return 0;
+    case "delegation end":
+      await runDelegationEnd(parsed);
+      return 0;
     case "projects list":
       await runProjectsList(parsed);
       return 0;
@@ -3958,9 +4230,23 @@ async function runAuthLogin(parsed) {
   await writeStoredSession(toStoredSession(apiBaseUrl, tokenResponse));
   console.log(`Signed in as ${tokenResponse.user.email}.`);
 }
-async function runProjectsList(parsed) {
+async function runDelegationStart(parsed) {
   const { client, session } = await resolveAuthenticatedClient(parsed);
-  const projects = await client.listProjects(session.accessToken);
+  const delegation = await client.startDelegation(session.accessToken, buildStartDelegationRequest(parsed, {
+    userOption: "user",
+    reasonOption: "reason"
+  }));
+  printDelegationLifecycle("Delegation started", toDelegationContext(delegation));
+}
+async function runDelegationEnd(parsed) {
+  const { client, session } = await resolveAuthenticatedClient(parsed);
+  const delegation = await client.endDelegation(session.accessToken, requireOption(parsed, "delegation"));
+  printDelegationLifecycle("Delegation ended", toDelegationContext(delegation));
+}
+async function runProjectsList(parsed) {
+  const { client, session, delegation } = await resolveProjectCommandContext(parsed);
+  printDelegationContext(delegation);
+  const projects = await client.listProjects(session.accessToken, delegation?.id ?? null);
   if (projects.length === 0) {
     console.log("No projects available.");
     return;
@@ -3975,19 +4261,25 @@ async function runInit(parsed) {
   const projectId = requireOption(parsed, "project");
   const workspacePath = requireOption(parsed, "workspace");
   const ticketLimit = parseTicketLimit(getOption(parsed, "ticket-limit") ?? "all");
-  const { client, session } = await resolveAuthenticatedClient(parsed);
+  const { client, session, delegation } = await resolveProjectCommandContext(parsed);
+  printDelegationContext(delegation);
   const summary = await runBootstrap(client, session.accessToken, {
     projectId,
     workspacePath,
     ticketIds: getOptions(parsed, "ticket"),
-    ticketLimit
+    ticketLimit,
+    delegationId: delegation?.id ?? null
   });
   printBootstrapSummary(summary);
 }
 async function runOneShotCommand(parsed) {
-  const { client, session } = await resolveAuthenticatedClient(parsed);
-  const options = parseOneShotOptions(parsed);
+  const { client, session, delegation } = await resolveProjectCommandContext(parsed);
+  const options = {
+    ...parseOneShotOptions(parsed),
+    delegation
+  };
   const policy = describeAgentPolicy(options);
+  printDelegationContext(delegation);
   console.log(`Agent provider: ${options.agentProvider}`);
   console.log(`Agent sandbox: ${policy.sandboxMode ?? "custom"}`);
   console.log(`Agent approval posture: ${policy.approvalPosture ?? "custom"}`);
@@ -3997,7 +4289,7 @@ async function runOneShotCommand(parsed) {
   };
   process.once("SIGINT", onSigint);
   try {
-    const manifest = await runOneShot(client, session.accessToken, options);
+    const manifest = await runOneShot(client, createAccessTokenProvider(client, session), options);
     printRunSummary(manifest);
   } finally {
     process.off("SIGINT", onSigint);
@@ -4007,10 +4299,13 @@ async function runResume(parsed) {
   const runId = requireOption(parsed, "run");
   const workspacePath = requireOption(parsed, "workspace");
   const manifest = await readRunManifest(workspacePath, runId);
-  const { client, session } = await resolveAuthenticatedClient(parsed);
-  const resumed = await runOneShot(client, session.accessToken, {
+  const { client, session, delegation } = await resolveProjectCommandContext(parsed, manifest.options.delegation ?? null);
+  printDelegationContext(delegation);
+  const resumed = await runOneShot(client, createAccessTokenProvider(client, session), {
     ...manifest.options,
+    delegation,
     workspacePath,
+    allowDirty: hasFlag(parsed, "allow-dirty") ? true : manifest.options.allowDirty,
     resumeRunId: runId
   });
   printRunSummary(resumed);
@@ -4018,7 +4313,8 @@ async function runResume(parsed) {
 async function runStatus(parsed) {
   const runId = requireOption(parsed, "run");
   const workspacePath = requireOption(parsed, "workspace");
-  printRunSummary(await readRunManifest(workspacePath, runId));
+  const manifest = await readRunManifest(workspacePath, runId);
+  printRunSummary(manifest);
 }
 async function runDoctor(parsed) {
   console.log(`Node: ${process.version}`);
@@ -4026,8 +4322,9 @@ async function runDoctor(parsed) {
   console.log(`Session: ${session ? `signed in as ${session.user.email}` : "missing"}`);
   if (session) {
     try {
-      const client = new SwarmCraftClient(getOption(parsed, "api-base-url") ?? session.apiBaseUrl);
-      await client.listProjects(session.accessToken);
+      const { client, session: resolvedSession, delegation } = await resolveProjectCommandContext(parsed);
+      await client.listProjects(resolvedSession.accessToken, delegation?.id ?? null);
+      printDelegationContext(delegation);
       console.log("API: reachable");
     } catch (error) {
       console.log(`API: ${error instanceof Error ? error.message : String(error)}`);
@@ -4058,13 +4355,14 @@ async function runSupportBundle(parsed) {
   const manifest = JSON.parse(await (0, import_promises4.readFile)(manifestPath, "utf8"));
   const bundleDir = import_node_path5.default.join(workspacePath, ".swarmcraft", "runs", runId, "support-bundle");
   await (0, import_promises4.mkdir)(bundleDir, { recursive: true });
-  await (0, import_promises4.writeFile)(import_node_path5.default.join(bundleDir, "manifest.redacted.json"), `${JSON.stringify(redact(manifest), null, 2)}
+  await (0, import_promises4.writeFile)(import_node_path5.default.join(bundleDir, "manifest.redacted.json"), `${JSON.stringify(redactSupportBundleValue(manifest), null, 2)}
 `, "utf8");
   await (0, import_promises4.writeFile)(import_node_path5.default.join(bundleDir, "summary.json"), `${JSON.stringify({
     runId,
     manifestPath,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    node: process.version
+    node: process.version,
+    delegation: summarizeDelegationForBundle(manifest)
   }, null, 2)}
 `, "utf8");
   console.log(`Support bundle written: ${bundleDir}`);
@@ -4076,6 +4374,10 @@ async function resolveAuthenticatedClient(parsed) {
   }
   const apiBaseUrl = getOption(parsed, "api-base-url") ?? process.env.SWARMCRAFT_API_BASE_URL ?? session.apiBaseUrl;
   const client = new SwarmCraftClient(apiBaseUrl);
+  session = {
+    ...session,
+    apiBaseUrl
+  };
   if (sessionExpiresSoon(session)) {
     if (!session.refreshToken) {
       throw new Error("Stored SwarmCraft session has expired. Run `swarmcraft auth login` again.");
@@ -4089,6 +4391,79 @@ async function resolveAuthenticatedClient(parsed) {
   }
   return { client, session };
 }
+function createAccessTokenProvider(client, initialSession) {
+  let session = initialSession;
+  let refreshPromise = null;
+  return async () => {
+    if (!sessionExpiresSoon(session)) {
+      return session.accessToken;
+    }
+    if (!session.refreshToken) {
+      throw new Error("Stored SwarmCraft session has expired. Run `swarmcraft auth login` again.");
+    }
+    refreshPromise ??= (async () => {
+      const refreshed = await client.refresh(session.refreshToken);
+      session = toStoredSession(session.apiBaseUrl, {
+        ...refreshed,
+        refreshToken: refreshed.refreshToken ?? session.refreshToken
+      });
+      await writeStoredSession(session);
+    })().finally(() => {
+      refreshPromise = null;
+    });
+    await refreshPromise;
+    return session.accessToken;
+  };
+}
+async function resolveProjectCommandContext(parsed, fallbackDelegation = null) {
+  const { client, session } = await resolveAuthenticatedClient(parsed);
+  const delegation = await resolveDelegationContext(client, session, parsed, fallbackDelegation);
+  return { client, session, delegation };
+}
+async function resolveDelegationContext(client, session, parsed, fallbackDelegation) {
+  const delegationId = getOption(parsed, "delegation");
+  const onBehalfOf = getOption(parsed, "on-behalf-of");
+  if (delegationId && onBehalfOf) {
+    throw new Error("Use either --delegation or --on-behalf-of, not both.");
+  }
+  if (delegationId) {
+    return toDelegationContext(await client.loadDelegation(session.accessToken, delegationId));
+  }
+  if (onBehalfOf) {
+    const delegation = await client.startDelegation(session.accessToken, buildStartDelegationRequest(parsed, {
+      userOption: "on-behalf-of",
+      reasonOption: "delegation-reason"
+    }));
+    const context = toDelegationContext(delegation);
+    printDelegationLifecycle("Delegation started", context);
+    return context;
+  }
+  if (hasFlag(parsed, "delegation-reason")) {
+    throw new Error("--delegation-reason requires --on-behalf-of.");
+  }
+  return fallbackDelegation;
+}
+function buildStartDelegationRequest(parsed, options) {
+  const expiresInMinutes = getOption(parsed, "expires-in-minutes") ? parseDelegationExpiry(getOption(parsed, "expires-in-minutes")) : null;
+  return {
+    user: requireOption(parsed, options.userOption),
+    reason: requireOption(parsed, options.reasonOption),
+    supportTicketId: getOption(parsed, "support-ticket") ?? null,
+    expiresInMinutes
+  };
+}
+function toDelegationContext(delegation) {
+  return {
+    id: delegation.id,
+    actorEmail: delegation.actorEmail,
+    targetUserId: delegation.targetUserId,
+    targetEmail: delegation.targetEmail,
+    reason: delegation.reason,
+    supportTicketId: delegation.supportTicketId,
+    status: delegation.status,
+    expiresAt: delegation.expiresAt
+  };
+}
 function printBootstrapSummary(summary) {
   console.log(`Bootstrapped ${summary.projectTitle}`);
   console.log(`Workspace: ${summary.workspacePath}`);
@@ -4110,10 +4485,26 @@ function printBootstrapSummary(summary) {
     console.log(`  ${nextCommand}`);
   }
 }
+function printDelegationLifecycle(prefix, delegation) {
+  console.log(`${prefix}: ${delegation.id}`);
+  printDelegationContext(delegation);
+  if (delegation.expiresAt) {
+    console.log(`Delegation expires: ${delegation.expiresAt}`);
+  }
+}
+function printDelegationContext(delegation) {
+  if (!delegation) {
+    return;
+  }
+  const actor = delegation.actorEmail ?? "operator";
+  const target = delegation.targetEmail ?? delegation.targetUserId ?? "target user";
+  console.log(`Delegated access: ${actor} -> ${target} (${delegation.id})`);
+}
 function printRunSummary(manifest) {
   console.log(`Run: ${manifest.runId}`);
   console.log(`Status: ${manifest.status}`);
   console.log(`Workspace: ${manifest.workspacePath}`);
+  printDelegationContext(manifest.options?.delegation ?? null);
   console.log(`Tickets: ${manifest.tickets.length}`);
   for (const ticket of manifest.tickets) {
     console.log(`  - ${ticket.outcome}: ${ticket.title} (${ticket.stages.length} stage(s))`);
@@ -4124,14 +4515,16 @@ function printRunSummary(manifest) {
 }
 function parseOneShotOptions(parsed) {
   const agentProvider = (0, import_packet_workflow3.parseExternalAgentProvider)(requireOption(parsed, "agent-provider"));
-  const donePolicy = parseChoice(getOption(parsed, "done-policy") ?? "stop", ["stop", "auto"], "--done-policy");
+  const donePolicy = parseChoice(getOption(parsed, "done-policy") ?? "auto", ["stop", "auto"], "--done-policy");
   const commitPolicy = parseChoice(getOption(parsed, "commit-policy") ?? "none", ["none", "done"], "--commit-policy");
+  const explicitReviewing = getOption(parsed, "reviewing");
   return {
     projectId: requireOption(parsed, "project"),
     workspacePath: requireOption(parsed, "workspace"),
     agentProvider,
     agentCommand: getOption(parsed, "agent-command") ?? process.env.SWARMCRAFT_AGENT_COMMAND ?? null,
-    checking: parseOnOff(getOption(parsed, "checking") ?? "on", "--checking"),
+    checking: parseOnOff(getOption(parsed, "checking") ?? "off", "--checking"),
+    reviewing: explicitReviewing ? parseOnOff(explicitReviewing, "--reviewing") : donePolicy === "stop",
     maxCheckingAttempts: parsePositiveInteger(getOption(parsed, "max-checking-attempts") ?? "2", "--max-checking-attempts"),
     donePolicy,
     commitPolicy,
@@ -4143,6 +4536,7 @@ function parseOneShotOptions(parsed) {
     agentApiKeyEnvName: getOption(parsed, "agent-api-key-env-name") ?? null,
     ticketIds: getOptions(parsed, "ticket"),
     ticketLimit: parseTicketLimit(getOption(parsed, "ticket-limit") ?? "all"),
+    delegation: null,
     runId: parseRunId(getOption(parsed, "run-id"))
   };
 }
@@ -4178,7 +4572,7 @@ function findCommand(positionals) {
   if (positionals.length === 0) {
     return void 0;
   }
-  const commandKey = positionals[0] === "auth" || positionals[0] === "projects" ? positionals.slice(0, 2).join(" ") : positionals[0];
+  const commandKey = positionals[0] === "auth" || positionals[0] === "projects" || positionals[0] === "delegation" ? positionals.slice(0, 2).join(" ") : positionals[0];
   return COMMANDS.find((command) => command.name === commandKey);
 }
 function printGeneralHelp() {
@@ -4243,6 +4637,13 @@ function parsePositiveInteger(rawValue, flagName) {
   }
   return parsed;
 }
+function parseDelegationExpiry(rawValue) {
+  const parsed = parsePositiveInteger(rawValue, "--expires-in-minutes");
+  if (parsed < MIN_DELEGATION_EXPIRY_MINUTES || parsed > MAX_DELEGATION_EXPIRY_MINUTES) {
+    throw new Error(`--expires-in-minutes must be between ${MIN_DELEGATION_EXPIRY_MINUTES} and ${MAX_DELEGATION_EXPIRY_MINUTES}.`);
+  }
+  return parsed;
+}
 function parseNonNegativeNumber(rawValue, flagName) {
   const parsed = Number.parseFloat(rawValue);
   if (!Number.isFinite(parsed) || parsed < 0) {
@@ -4274,20 +4675,6 @@ function parseRunId(rawValue) {
   }
   return rawValue;
 }
-function redact(value) {
-  if (Array.isArray(value)) {
-    return value.map(redact);
-  }
-  if (!value || typeof value !== "object") {
-    return value;
-  }
-  return Object.fromEntries(
-    Object.entries(value).map(([key, entry]) => [
-      key,
-      /token|secret|password|api[-_]?key|credential/i.test(key) ? "<redacted>" : redact(entry)
-    ])
-  );
-}
 async function promptLine(prompt) {
   const readline = (0, import_promises5.createInterface)({ input: import_node_process.stdin, output: import_node_process.stdout });
   try {
@@ -4299,14 +4686,26 @@ async function promptLine(prompt) {
 async function promptSecret(prompt) {
   return promptLine(prompt);
 }
-main(process.argv.slice(2)).then((exitCode) => {
-  process.exitCode = exitCode;
-}).catch((error) => {
-  if (error instanceof SwarmCraftApiError) {
-    const request = error.requestId ? ` requestId=${error.requestId}` : "";
-    console.error(`${error.code}: ${error.message}${request}`);
-  } else {
-    console.error(error instanceof Error ? error.message : String(error));
-  }
-  process.exitCode = 1;
+if (isCliEntrypoint()) {
+  main(process.argv.slice(2)).then((exitCode) => {
+    process.exitCode = exitCode;
+  }).catch((error) => {
+    if (error instanceof SwarmCraftApiError) {
+      const request = error.requestId ? ` requestId=${error.requestId}` : "";
+      console.error(`${error.code}: ${error.message}${request}`);
+    } else {
+      console.error(error instanceof Error ? error.message : String(error));
+    }
+    process.exitCode = 1;
+  });
+}
+function isCliEntrypoint() {
+  const invokedScript = process.argv[1] ? import_node_path5.default.basename(process.argv[1]) : "";
+  return invokedScript === "main.cjs" || invokedScript === "main.js" || invokedScript === "main.ts";
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  findCommand,
+  main,
+  parseArgs
 });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@swarmcraftai/cli",
-  "version": "0.1.0",
-  "description": "Customer-facing SwarmCraft command line tool.",
+  "version": "0.1.5",
+  "description": "Prepare repositories and run packet-based SwarmCraft agent workflows from the terminal.",
   "license": "SEE LICENSE IN LICENSE.txt",
   "type": "module",
   "homepage": "https://swarmcraft.ai",