@tabbio-technologies/cli 1.2.8

package/dist/chunks/program-O2BA5L6Z.js

@@ -0,0 +1,2755 @@
+import { createRequire as __tabbioCreateRequire } from 'node:module';
+const require = __tabbioCreateRequire(import.meta.url);
+import {
+  createCommandContext,
+  mcpSummary,
+  readGlobalOptions,
+  registerStatusCommand,
+  registerWhoamiCommand
+} from "./chunk-Y6GWIFHI.js";
+import {
+  ARTIFACT_KINDS,
+  ARTIFACT_PRODUCING_TOOL_IDS,
+  PREVIEW_VARIANTS,
+  RESERVED_GLOBAL_FLAGS,
+  artifactFromResult,
+  assertInteractive,
+  autoFilledProperties,
+  canUseInteractiveUi,
+  capabilityDenial,
+  capabilityRequestFields,
+  defaultVariantFor,
+  deleteArtifact,
+  describeSchema,
+  didYouMean,
+  displayWidth,
+  downloadToFile,
+  downloadUrl,
+  exampleInvocation,
+  extensionFor,
+  flagsForProperties,
+  formatDuration,
+  formatKv,
+  formatTable,
+  formatToVariant,
+  getArtifact,
+  getInteractiveHooks,
+  hyperlink,
+  isInteractiveTerminal,
+  jsonEnvelope,
+  listArtifacts,
+  listVersions,
+  loadCapabilityPrefs,
+  mergeSources,
+  parseFields,
+  parseToolInput,
+  previewUrl,
+  previewVariantFor,
+  printEmptyNotice,
+  renderResult,
+  resolveCapabilities,
+  resolveOutputMode,
+  resolveOutputPath,
+  restoreVersion,
+  safeFileName,
+  saveCapabilityPrefs,
+  schemaToFlags,
+  schemaToOptions,
+  setInteractiveHooks,
+  shortDescription,
+  sourcesFromResult,
+  streamChat,
+  streamChatFrames,
+  supportsHyperlinks,
+  toTsv,
+  truncate,
+  waitForArtifact,
+  writeJson
+} from "./chunk-QVR5KIEQ.js";
+import {
+  ApiClient,
+  CLI_PACKAGE_NAME,
+  CLI_VERSION,
+  CliError,
+  DEFAULT_PROFILE,
+  EXIT_CODE_DOCS,
+  ExitCode,
+  McpSession,
+  PRIMARY_AGENT_KEY,
+  PROFILE_PRESETS,
+  assertJwtSession,
+  assertProfileName,
+  checkForUpdate,
+  chooseLoginMethod,
+  clearCatalogCache,
+  configPaths,
+  credentialPermissionIssues,
+  credentialsFromLogin,
+  debug,
+  describeMcpBearer,
+  deviceLabel,
+  findTool,
+  fingerprint,
+  getGlobalOptions,
+  getMcpAccessState,
+  groupCatalog,
+  hasDisplay,
+  info,
+  interpretToolPayload,
+  interruptedError,
+  isCliError,
+  isInteractive,
+  listCredentialProfiles,
+  listProfileNames,
+  loadConfig,
+  loadCredentials,
+  loadStoredCredentials,
+  loginWithBrowser,
+  loginWithEmailOtp,
+  logoutProfile,
+  normalizeBaseUrl,
+  notSignedInError,
+  printJson,
+  printKeyValues,
+  readCachedCatalog,
+  readRequestId,
+  redactSecrets,
+  resolveProfile,
+  resolveProfileWithSources,
+  revokeSession,
+  saveCredentials,
+  selectMcpBearer,
+  setGlobalOptions,
+  successLine,
+  toCliError,
+  updateConfig,
+  usageError,
+  warn,
+  writeOut
+} from "./chunk-7LNC3FIV.js";
+import {
+  activeCommandSignal
+} from "./chunk-NK5RPNSV.js";
+import {
+  configureTheme,
+  theme
+} from "./chunk-VHHZFMIF.js";
+
+// src/program.ts
+import { Command as Command2, CommanderError as CommanderError2 } from "commander";
+
+// src/core/prompt.ts
+import { createInterface } from "node:readline";
+function cancelled() {
+  return interruptedError();
+}
+function promptLine(question) {
+  return new Promise((resolve, reject2) => {
+    const rl = createInterface({ input: process.stdin, output: process.stderr, terminal: Boolean(process.stdin.isTTY) });
+    let answered = false;
+    rl.once("SIGINT", () => {
+      rl.close();
+      reject2(cancelled());
+    });
+    rl.once("close", () => {
+      if (!answered) reject2(usageError("No input received"));
+    });
+    rl.question(question, (answer) => {
+      answered = true;
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+function promptSecret(question) {
+  const stdin = process.stdin;
+  if (!stdin.isTTY || typeof stdin.setRawMode !== "function") return promptLine(question);
+  return new Promise((resolve, reject2) => {
+    let value = "";
+    process.stderr.write(question);
+    const wasRaw = stdin.isRaw;
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    const finish = (error) => {
+      stdin.off("data", onData);
+      stdin.setRawMode(wasRaw);
+      stdin.pause();
+      process.stderr.write("\n");
+      if (error) reject2(error);
+      else resolve(value.trim());
+    };
+    const onData = (chunk) => {
+      for (const char of chunk) {
+        if (char === "") return finish(cancelled());
+        if (char === "" && value === "") return finish(cancelled());
+        if (char === "\r" || char === "\n") return finish();
+        if (char === "\x7F" || char === "\b") {
+          if (value.length > 0) {
+            value = value.slice(0, -1);
+            process.stderr.write("\b \b");
+          }
+          continue;
+        }
+        if (char < " ") continue;
+        value += char;
+        process.stderr.write("\u2022");
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+async function confirm(question, opts = {}) {
+  if (opts.assumeYes) return true;
+  if (!process.stdin.isTTY) {
+    throw usageError(`${question} (needs confirmation)`, "Re-run with --yes to confirm non-interactively.");
+  }
+  const suffix = opts.defaultYes ? " [Y/n] " : " [y/N] ";
+  const answer = (await promptLine(`${question}${suffix}`)).toLowerCase();
+  if (!answer) return Boolean(opts.defaultYes);
+  return answer === "y" || answer === "yes";
+}
+
+// src/core/approvals.ts
+var DEFAULT_WAIT_TIMEOUT_MS = 10 * 6e4;
+var POLL_START_MS = 3e3;
+var POLL_MAX_MS = 1e4;
+var CONFIRM_TIMEOUT_MS = 10 * 6e4;
+var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function parseDuration(value, fallbackMs = DEFAULT_WAIT_TIMEOUT_MS) {
+  if (value === void 0 || value === "") return fallbackMs;
+  const match = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h)?$/i.exec(value.trim());
+  if (!match) throw usageError(`Invalid duration "${value}"`, "Use e.g. 30s, 10m or 1h.");
+  const amount = Number(match[1]);
+  const unit = (match[2] ?? "s").toLowerCase();
+  const factor = unit === "ms" ? 1 : unit === "s" ? 1e3 : unit === "m" ? 6e4 : 36e5;
+  return Math.round(amount * factor);
+}
+function hasJwtSession(ctx) {
+  return Boolean(ctx.api.credentials?.accessToken);
+}
+function label(tool, approval) {
+  return tool?.commandPath?.length ? tool.commandPath.join(" ") : approval.toolName || tool?.id || "this action";
+}
+async function confirmApproval(api, approvalId, reason) {
+  const response = await api.request(`/api/agent/approvals/${encodeURIComponent(approvalId)}/confirm`, {
+    method: "POST",
+    body: reason ? { reason } : {},
+    timeoutMs: CONFIRM_TIMEOUT_MS
+  });
+  const data = response.data ?? {};
+  const result = data.mcp ? data.mcp.result : data.assistant?.text ?? null;
+  return { result: result === void 0 ? null : result, data, requestId: response.requestId };
+}
+async function rejectApproval(api, approvalId, reason) {
+  const response = await api.request(`/api/agent/approvals/${encodeURIComponent(approvalId)}/reject`, {
+    method: "POST",
+    body: reason ? { reason } : {}
+  });
+  return { data: response.data ?? {}, requestId: response.requestId };
+}
+async function fetchApprovalStatus(session, approvalId) {
+  const response = await session.callTool("mcp.approvalStatus", { approvalId });
+  if (!response.ok) throw response.error;
+  const record = response.result;
+  if (!record || typeof record.status !== "string") {
+    throw new CliError({ code: "BAD_RESPONSE", message: "Unexpected approval status response", exitCode: ExitCode.Server });
+  }
+  return { id: approvalId, toolName: "", ...record };
+}
+async function pollApprovalStatus(session, approvalId, opts = {}) {
+  const sleep = opts.sleep ?? defaultSleep;
+  const now = opts.now ?? Date.now;
+  const deadline = now() + (opts.timeoutMs ?? DEFAULT_WAIT_TIMEOUT_MS);
+  let interval = POLL_START_MS;
+  let last = null;
+  for (; ; ) {
+    try {
+      last = await fetchApprovalStatus(session, approvalId);
+      if (last.status !== "pending") return { record: last, timedOut: false };
+    } catch (error) {
+      if (!(error instanceof CliError) || error.exitCode !== ExitCode.Network) throw error;
+    }
+    const remaining = deadline - now();
+    if (remaining <= 0) return { record: last, timedOut: true };
+    await sleep(Math.min(interval, remaining));
+    interval = Math.min(POLL_MAX_MS, Math.round(interval * 1.5));
+  }
+}
+function notice(mode2, line) {
+  if (mode2 === "json") return;
+  process.stderr.write(`${line}
+`);
+}
+function exitCodeForApprovalStatus(status2, timedOut = false) {
+  if (timedOut || status2 === "pending") return ExitCode.ApprovalPending;
+  return status2 === "approved" ? ExitCode.Ok : ExitCode.Error;
+}
+function describeWaitResult(toolLabel, record, timedOut, timeoutMs) {
+  const status2 = record?.status ?? "pending";
+  if (timedOut || status2 === "pending") {
+    return [`${theme.warn(theme.symbols.warning)} Still pending after ${formatDuration(timeoutMs)}`];
+  }
+  if (status2 === "approved") {
+    return [
+      `${theme.success(theme.symbols.success)} Approved ${toolLabel}`,
+      `  ${theme.dim("Tabbio ran it when it was approved; the output is shown where it was approved, not here.")}`
+    ];
+  }
+  const reason = record?.reason ? `: ${record.reason}` : "";
+  return [`${theme.error(theme.symbols.error)} ${status2 === "rejected" ? "Rejected" : `Approval ${status2}`} ${toolLabel}${reason}`];
+}
+async function decide(ctx, tool, approval, args, mode2) {
+  const jwt = hasJwtSession(ctx);
+  if (ctx.globals.yes && jwt) return "approve";
+  if (mode2 === "json" || ctx.globals.json || !jwt) return "leave";
+  const hooks = getInteractiveHooks();
+  if (hooks && canUseInteractiveUi(ctx) && mode2 !== "tsv") {
+    return hooks.approvalPrompt(ctx, { ...approval, args });
+  }
+  if (process.stdin.isTTY && process.stderr.isTTY) {
+    notice(mode2, `${theme.warn(theme.symbols.warning)} ${approval.message}`);
+    return await confirm(`Approve ${label(tool, approval)} now?`) ? "approve" : "leave";
+  }
+  return "leave";
+}
+async function handleApproval(ctx, session, tool, approval, args, opts = {}) {
+  const mode2 = opts.mode;
+  const name = label(tool, approval);
+  const id = approval.approvalId;
+  const decision = await decide(ctx, tool, approval, args, mode2);
+  if (decision === "approve") {
+    const confirmed = await confirmApproval(ctx.api, id);
+    notice(mode2, `${theme.success(theme.symbols.success)} Approved ${name}`);
+    return { approval, status: "approved", executed: true, result: confirmed.result, requestId: confirmed.requestId };
+  }
+  if (decision === "reject") {
+    await rejectApproval(ctx.api, id);
+    notice(mode2, `${theme.error(theme.symbols.error)} Rejected ${name} ${theme.dim(id)}`);
+    process.exitCode = ExitCode.Error;
+    return { approval, status: "rejected", executed: false };
+  }
+  const jwt = hasJwtSession(ctx);
+  if (!opts.wait) {
+    notice(mode2, `${theme.warn(theme.symbols.warning)} Approval needed: ${name} ${theme.dim(id)}`);
+    notice(mode2, `  ${approval.message}`);
+    if (ctx.globals.yes && !jwt) {
+      notice(mode2, `  ${theme.dim("--yes can only approve with a full sign-in (`tabbio login`); this profile uses a personal MCP token.")}`);
+    }
+    notice(
+      mode2,
+      `  ${theme.dim(`\u2192 Approve it in the Tabbio app${jwt ? ` or with \`tabbio approvals approve ${id}\`` : ""}, then \`tabbio approvals wait ${id}\`.`)}`
+    );
+    process.exitCode = ExitCode.ApprovalPending;
+    return { approval, status: "pending", executed: false };
+  }
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_WAIT_TIMEOUT_MS;
+  notice(
+    mode2,
+    `${theme.warn(theme.symbols.warning)} Waiting for approval of ${name} ${theme.dim(`${id} \xB7 up to ${formatDuration(timeoutMs)} \xB7 approve it in the Tabbio app`)}`
+  );
+  const { record, timedOut } = await pollApprovalStatus(session, id, { timeoutMs, sleep: opts.sleep });
+  const status2 = timedOut ? "pending" : record?.status ?? "pending";
+  const lines = describeWaitResult(name, record, timedOut, timeoutMs);
+  for (const line of opts.followsOutput && status2 === "approved" ? lines.slice(0, 1) : lines) notice(mode2, line);
+  const code = exitCodeForApprovalStatus(status2, timedOut);
+  if (code !== ExitCode.Ok) process.exitCode = code;
+  return { approval, status: status2, executed: false, ...record ? { record } : {}, timedOut };
+}
+function approvalMeta(outcome) {
+  return {
+    approvalId: outcome.approval.approvalId,
+    toolName: outcome.approval.toolName,
+    status: outcome.status,
+    message: outcome.approval.message,
+    executed: outcome.executed,
+    ...outcome.timedOut ? { timedOut: true } : {},
+    ...outcome.record?.reason ? { reason: outcome.record.reason } : {}
+  };
+}
+
+// src/core/artifact-wait.ts
+function isArtifactProducingTool(toolId) {
+  return ARTIFACT_PRODUCING_TOOL_IDS.has(toolId);
+}
+function artifactStatusReader(ctx, session, artifactId) {
+  return async () => {
+    if (ctx.api.credentials?.accessToken || !session) {
+      const detail = await getArtifact(ctx.api, artifactId);
+      const { document: _document, sources: _sources, ...summary } = detail;
+      return summary;
+    }
+    const response = await session.callTool("artifact.get", { artifactId });
+    if (!response.ok) throw response.error;
+    const card = artifactFromResult(response.result);
+    return { ...response.result, status: card?.status ?? "pending" };
+  };
+}
+function notice2(ctx, json, line) {
+  if (json || ctx.globals.quiet) return;
+  process.stderr.write(`${line}
+`);
+}
+async function waitForToolArtifact(ctx, session, result, opts) {
+  const card = artifactFromResult(result);
+  if (!card) return null;
+  if (card.status !== "pending") return { artifactId: card.id, status: card.status, timedOut: false, latest: null };
+  notice2(ctx, opts.json, theme.dim(`${theme.symbols.pending} Waiting for ${card.kind} ${card.id} to finish rendering (up to ${formatDuration(opts.timeoutMs)})`));
+  const { artifact, timedOut } = await waitForArtifact(artifactStatusReader(ctx, session, card.id), {
+    timeoutMs: opts.timeoutMs,
+    sleep: opts.sleep
+  });
+  return { artifactId: card.id, status: artifact?.status ?? "pending", timedOut, latest: artifact };
+}
+function mergeWaitedArtifact(result, outcome) {
+  const { message: _message, ...base } = result ?? {};
+  const latest = outcome.latest ?? {};
+  const variants = latest.variants ?? base.variants;
+  const kind = String(latest.kind ?? base.kind ?? "");
+  const previewAvailable = kind === "image" ? outcome.status === "ready" && Boolean(variants?.image || variants?.thumbnail) : outcome.status !== "failed" && Boolean(variants?.html);
+  const error = latest.error ?? latest.failure;
+  return {
+    ...base,
+    ...typeof latest.kind === "string" ? { kind: latest.kind } : {},
+    ...typeof latest.title === "string" ? { title: latest.title } : {},
+    status: outcome.status,
+    ...variants ? { variants } : {},
+    previewAvailable,
+    ...latest.image !== void 0 ? { image: latest.image } : {},
+    ...outcome.status === "failed" && error ? { failure: error } : {}
+  };
+}
+function artifactHints(ctx, json, artifactId, status2, timedOut = false) {
+  if (status2 === "failed") return;
+  if (status2 === "pending" || timedOut) {
+    notice2(ctx, json, theme.dim(`${theme.symbols.arrowRight} Still rendering: tabbio artifacts wait ${artifactId}`));
+    return;
+  }
+  notice2(
+    ctx,
+    json,
+    theme.dim(`${theme.symbols.arrowRight} tabbio artifacts open ${artifactId} ${theme.symbols.middot} tabbio artifacts download ${artifactId}`)
+  );
+}
+async function findArtifactForApproval(ctx, input, approvalCreatedAt) {
+  if (typeof input.artifactId === "string" && input.artifactId) return input.artifactId;
+  const title = typeof input.title === "string" ? input.title.trim() : "";
+  if (!title || !ctx.api.credentials?.accessToken) return null;
+  const since = approvalCreatedAt ? Date.parse(approvalCreatedAt) : Number.NaN;
+  const { artifacts } = await listArtifacts(ctx.api, { limit: 10 });
+  const match = artifacts.find((a) => a.title === title && (!Number.isFinite(since) || Date.parse(a.createdAt) >= since - 1e3));
+  return match?.id ?? null;
+}
+
+// src/commands/approvals.ts
+var LIST_FIELDS = ["id", "toolName", "status", "createdAt", "args"];
+function requireJwtForApprovals(ctx, what) {
+  if (hasJwtSession(ctx)) return;
+  if (ctx.credentials?.mcpToken) {
+    throw new CliError({
+      code: "FULL_SIGN_IN_REQUIRED",
+      message: `${what} needs a full sign-in; this profile only has a personal MCP token`,
+      hint: "With the token you can still check one approval: `tabbio approvals show <id>` or `tabbio approvals wait <id>`. Run `tabbio login` for the rest.",
+      exitCode: ExitCode.Auth
+    });
+  }
+  throw notSignedInError(ctx.profile.name);
+}
+function mode(ctx) {
+  return resolveOutputMode({ json: ctx.globals.json });
+}
+function write(lines) {
+  for (const line of lines) process.stdout.write(`${line}
+`);
+}
+async function withContext(cmd, fn) {
+  const ctx = createCommandContext(cmd);
+  try {
+    await fn(ctx);
+  } finally {
+    await ctx.close();
+  }
+}
+async function list(ctx) {
+  requireJwtForApprovals(ctx, "Listing approvals");
+  const started = Date.now();
+  const state = await getMcpAccessState(ctx.api);
+  const pending = state.pendingApprovals ?? [];
+  const meta = { durationMs: Date.now() - started, requestId: ctx.api.lastRequestId };
+  const out = mode(ctx);
+  if (out === "json") return writeJson(jsonEnvelope({ id: "approvals.list" }, pending, meta));
+  if (pending.length === 0) return printEmptyNotice(out, "No pending approvals", { quiet: ctx.globals.quiet });
+  if (out === "tsv") {
+    process.stdout.write(toTsv(pending, LIST_FIELDS));
+    return;
+  }
+  const rows = pending.map((p) => ({ ...p }));
+  write(formatTable(rows, { fields: LIST_FIELDS, width: process.stdout.columns }));
+  write([
+    theme.dim(`${pending.length} pending \xB7 tabbio approvals approve <id> \xB7 tabbio approvals reject <id> \xB7 tabbio approvals show <id>`)
+  ]);
+}
+async function show(ctx, id) {
+  const started = Date.now();
+  const session = await ctx.mcp();
+  const record = await fetchApprovalStatus(session, id);
+  if (hasJwtSession(ctx) && record.status === "pending") {
+    const state = await getMcpAccessState(ctx.api).catch(() => null);
+    const match = state?.pendingApprovals.find((p) => p.id === id);
+    if (match) record.args = match.args;
+  }
+  const out = mode(ctx);
+  if (out === "json") return writeJson(jsonEnvelope({ id: "approvals.show" }, record, { durationMs: Date.now() - started }));
+  if (out === "tsv") {
+    process.stdout.write(toTsv(record));
+    return;
+  }
+  write(formatKv(record, { width: process.stdout.columns }));
+}
+async function approve(ctx, id, opts) {
+  requireJwtForApprovals(ctx, "Approving");
+  const started = Date.now();
+  const { result, data, requestId } = await confirmApproval(ctx.api, id, opts.reason);
+  const toolName = typeof data.approval?.toolName === "string" ? data.approval.toolName : "approval";
+  const extra = { approval: { approvalId: id, toolName, status: "approved", executed: Boolean(data.mcp) } };
+  const out = mode(ctx);
+  if (out !== "json") process.stderr.write(`${theme.success(theme.symbols.success)} Approved ${toolName} ${theme.dim(id)}
+`);
+  const ran = data.mcp ? interpretToolPayload(result, toolName) : null;
+  if (ran && !ran.ok) throw ran.error;
+  let shown = result;
+  const card = artifactFromResult(result);
+  if (card && opts.wait) {
+    const waited = await waitForToolArtifact(ctx, null, result, { timeoutMs: parseDuration(opts.timeout, 5 * 6e4), json: out === "json" });
+    if (waited) {
+      extra.artifactWait = { artifactId: waited.artifactId, status: waited.status, timedOut: waited.timedOut };
+      shown = mergeWaitedArtifact(result, waited);
+      if (waited.timedOut) process.exitCode = ExitCode.Network;
+      else if (waited.status === "failed") process.exitCode = ExitCode.Error;
+    }
+  }
+  await renderResult(ctx, { id: toolName, commandPath: [toolName] }, shown, {
+    durationMs: Date.now() - started,
+    requestId,
+    mode: out,
+    extra
+  });
+  const final = artifactFromResult(shown);
+  if (final) artifactHints(ctx, out === "json", final.id, final.status);
+}
+async function reject(ctx, id, reason) {
+  requireJwtForApprovals(ctx, "Rejecting");
+  const started = Date.now();
+  const { data, requestId } = await rejectApproval(ctx.api, id, reason);
+  const toolName = typeof data.approval?.toolName === "string" ? data.approval.toolName : "approval";
+  const out = mode(ctx);
+  if (out === "json") {
+    writeJson(
+      jsonEnvelope({ id: "approvals.reject" }, data.approval ?? null, {
+        durationMs: Date.now() - started,
+        requestId,
+        extra: { approval: { approvalId: id, toolName, status: "rejected", executed: false } }
+      })
+    );
+    return;
+  }
+  write([`${theme.error(theme.symbols.error)} Rejected ${toolName} ${theme.dim(id)}`]);
+}
+async function wait(ctx, id, timeout) {
+  const timeoutMs = parseDuration(timeout);
+  const started = Date.now();
+  const session = await ctx.mcp();
+  const out = mode(ctx);
+  if (out !== "json") {
+    process.stderr.write(`${theme.dim(`Waiting for ${id} (up to ${formatDuration(timeoutMs)}) \xB7 approve it in the Tabbio app`)}
+`);
+  }
+  const { record, timedOut } = await pollApprovalStatus(session, id, { timeoutMs });
+  const status2 = timedOut ? "pending" : record?.status ?? "pending";
+  if (out === "json") {
+    writeJson(
+      jsonEnvelope({ id: "approvals.wait" }, record, {
+        durationMs: Date.now() - started,
+        extra: { approval: { approvalId: id, toolName: record?.toolName ?? null, status: status2, timedOut, executed: false } }
+      })
+    );
+  } else {
+    for (const line of describeWaitResult(record?.toolName || id, record, timedOut, timeoutMs)) {
+      process.stderr.write(`${line}
+`);
+    }
+  }
+  const code = exitCodeForApprovalStatus(status2, timedOut);
+  if (code !== ExitCode.Ok) process.exitCode = code;
+}
+function registerApprovalsCommand(program) {
+  const approvals = program.command("approvals").description("Review and decide actions waiting for your approval").addHelpText(
+    "after",
+    "\nExamples:\n  $ tabbio approvals\n  $ tabbio approvals approve apr_123\n  $ tabbio approvals wait apr_123 --timeout 5m"
+  );
+  approvals.command("list", { isDefault: true }).description("List pending approvals (needs a full sign-in)").action((_opts, cmd) => withContext(cmd, list));
+  approvals.command("show").description("Show one approval (works with a personal MCP token)").argument("<id>", "Approval id").action((id, _opts, cmd) => withContext(cmd, (ctx) => show(ctx, id)));
+  approvals.command("approve").description("Approve and run it now; prints the tool output").argument("<id>", "Approval id").option("--reason <text>", "Note stored with the decision").option("--wait", "When it created a file (document, page, image), wait until it has rendered").option("--timeout <duration>", "How long --wait waits for the file (default 5m)").action(
+    (id, opts, cmd) => withContext(cmd, (ctx) => approve(ctx, id, opts))
+  );
+  approvals.command("reject").description("Reject it; the action never runs").argument("<id>", "Approval id").option("--reason <text>", "Note stored with the decision").action((id, opts, cmd) => withContext(cmd, (ctx) => reject(ctx, id, opts.reason)));
+  approvals.command("wait").description("Wait until it is approved or rejected (exit 0 approved, 1 rejected, 6 still pending)").argument("<id>", "Approval id").option("--timeout <duration>", "Give up after this long (default 10m)").action((id, opts, cmd) => withContext(cmd, (ctx) => wait(ctx, id, opts.timeout)));
+}
+
+// src/commands/artifacts.ts
+import { Option } from "commander";
+
+// src/commands/artifacts-files.ts
+import open from "open";
+var DEFAULT_WAIT = 5 * 6e4;
+function outMode(ctx) {
+  return resolveOutputMode({ json: ctx.globals.json });
+}
+function status(ctx, out, line) {
+  if (out !== "json" && !ctx.globals.quiet) process.stderr.write(`${line}
+`);
+}
+function strip(detail) {
+  const { document: _document, sources, ...summary } = detail;
+  return { ...summary, sourceCount: summary.sourceCount ?? sources?.length ?? 0 };
+}
+function notReady(id) {
+  return new CliError({
+    code: "ARTIFACT_NOT_READY",
+    message: "This file is still being created",
+    hint: `Wait for it with \`tabbio artifacts wait ${id}\`, or pass --wait.`,
+    exitCode: ExitCode.Error
+  });
+}
+async function waitCommand(ctx, id, opts) {
+  const out = outMode(ctx);
+  const timeoutMs = parseDuration(opts.timeout, DEFAULT_WAIT);
+  const started = Date.now();
+  status(ctx, out, theme.dim(`${theme.symbols.pending} Waiting for ${id} (up to ${formatDuration(timeoutMs)})`));
+  const { artifact, timedOut } = await waitForArtifact(() => getArtifact(ctx.api, id), { timeoutMs });
+  const summary = artifact ? strip(artifact) : null;
+  if (out === "json") writeJson(jsonEnvelope({ id: "artifacts.wait" }, summary, { durationMs: Date.now() - started, extra: { timedOut } }));
+  if (timedOut || !artifact) {
+    throw new CliError({
+      code: "ARTIFACT_WAIT_TIMEOUT",
+      message: `${id} was still rendering after ${formatDuration(timeoutMs)}`,
+      hint: `Try again later: tabbio artifacts wait ${id}`,
+      exitCode: ExitCode.Network,
+      retry: true
+    });
+  }
+  if (artifact.status === "failed") {
+    if (out !== "json") process.stdout.write(`${theme.error(theme.symbols.error)} ${artifact.title} failed: ${artifact.error?.message ?? "unknown error"}
+`);
+    process.exitCode = ExitCode.Error;
+    return;
+  }
+  if (out === "json") return;
+  if (out === "tsv") {
+    process.stdout.write(`${artifact.id}	${artifact.status}	${artifact.kind}	${artifact.title}
+`);
+    return;
+  }
+  process.stdout.write(`${theme.success(theme.symbols.success)} ${artifact.title} ${theme.dim(`${theme.symbols.middot} ${artifact.kind} ${theme.symbols.middot} ready`)}
+`);
+  status(ctx, out, theme.dim(`${theme.symbols.arrowRight} tabbio artifacts open ${id} ${theme.symbols.middot} tabbio artifacts download ${id}`));
+}
+async function openCommand(ctx, id, opts) {
+  const out = outMode(ctx);
+  const started = Date.now();
+  if (opts.variant && !PREVIEW_VARIANTS.includes(opts.variant)) {
+    throw usageError(`--variant must be one of ${PREVIEW_VARIANTS.join(", ")}`);
+  }
+  if (opts.theme && opts.theme !== "light" && opts.theme !== "dark") throw usageError("--theme must be light or dark");
+  let variant = opts.variant;
+  if (!variant) variant = previewVariantFor((await getArtifact(ctx.api, id)).kind);
+  const signed = await previewUrl(ctx.api, id, { variant, theme: opts.theme, versionId: opts.version });
+  if (out === "json") {
+    writeJson(jsonEnvelope({ id: "artifacts.open" }, signed, { durationMs: Date.now() - started }));
+    return;
+  }
+  process.stdout.write(`${signed.url}
+`);
+  const browse = !opts.print && process.stdout.isTTY && !process.env.CI;
+  if (browse) {
+    await open(signed.url).catch(() => void 0);
+    const label2 = supportsHyperlinks() ? hyperlink("Opened the preview", signed.url) : "Opened the preview";
+    status(ctx, out, theme.dim(`${label2} ${theme.symbols.middot} the link works for 15 minutes`));
+  } else {
+    status(ctx, out, theme.dim("The link works for 15 minutes."));
+  }
+}
+function humanBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+async function mintDownload(ctx, id, variant, opts) {
+  const deadline = Date.now() + opts.timeoutMs;
+  for (; ; ) {
+    try {
+      return await downloadUrl(ctx.api, id, { variant, versionId: opts.version });
+    } catch (error) {
+      const preparing = isCliError(error) && error.code === "ARTIFACT_NOT_READY";
+      if (!preparing || !opts.wait || Date.now() > deadline) throw preparing ? notReady(id) : error;
+      await new Promise((resolve) => setTimeout(resolve, 3e3));
+    }
+  }
+}
+async function downloadCommand(ctx, id, opts) {
+  const out = outMode(ctx);
+  const started = Date.now();
+  const timeoutMs = parseDuration(opts.timeout, DEFAULT_WAIT);
+  let artifact = await getArtifact(ctx.api, id);
+  if (artifact.status === "pending" && !opts.version) {
+    if (!opts.wait) throw notReady(id);
+    status(ctx, out, theme.dim(`${theme.symbols.pending} Waiting for ${id} to finish rendering`));
+    const waited = await waitForArtifact(() => getArtifact(ctx.api, id), { timeoutMs });
+    if (!waited.artifact || waited.timedOut) throw notReady(id);
+    artifact = waited.artifact;
+  }
+  if (artifact.status === "failed" && !opts.version) {
+    throw new CliError({ code: "ARTIFACT_FAILED", message: `${artifact.title} failed: ${artifact.error?.message ?? "no file was made"}`, exitCode: ExitCode.Error });
+  }
+  const variant = opts.format ? formatToVariant(opts.format) : defaultVariantFor(artifact);
+  const signed = await mintDownload(ctx, id, variant, { version: opts.version, wait: Boolean(opts.wait), timeoutMs });
+  const fileName = safeFileName(artifact.title, extensionFor(variant, signed.contentType));
+  const dest = resolveOutputPath(opts.out, fileName);
+  const tty = out !== "json" && process.stderr.isTTY && !ctx.globals.quiet && !process.env.CI;
+  let lastPaint = 0;
+  const saved = await downloadToFile(signed.url, dest, {
+    force: opts.force,
+    signal: activeCommandSignal,
+    onProgress: ({ received, total }) => {
+      if (!tty || Date.now() - lastPaint < 100) return;
+      lastPaint = Date.now();
+      const of = total ? ` / ${humanBytes(total)}` : "";
+      process.stderr.write(`\r\x1B[2K${theme.dim(`${theme.symbols.pending} ${fileName} ${humanBytes(received)}${of}`)}`);
+    }
+  });
+  if (tty) process.stderr.write("\r\x1B[2K");
+  const data = { artifactId: id, path: saved.path, bytes: saved.bytes, variant, contentType: saved.contentType ?? signed.contentType };
+  if (out === "json") {
+    writeJson(jsonEnvelope({ id: "artifacts.download" }, data, { durationMs: Date.now() - started }));
+    return;
+  }
+  status(ctx, out, `${theme.success(theme.symbols.success)} Saved ${variant.toUpperCase()} ${theme.dim(`${humanBytes(saved.bytes)} ${theme.symbols.middot} ${formatDuration(Date.now() - started)}`)}`);
+  process.stdout.write(`${saved.path}
+`);
+}
+
+// src/commands/artifacts.ts
+var LIST_FIELDS2 = ["id", "kind", "title", "status", "version", "createdAt"];
+function outMode2(ctx) {
+  return resolveOutputMode({ json: ctx.globals.json });
+}
+function write2(lines) {
+  for (const line of lines) process.stdout.write(`${line}
+`);
+}
+async function withSession(cmd, fn) {
+  const ctx = createCommandContext(cmd);
+  try {
+    assertJwtSession(ctx.credentials, ctx.profile, "Artifacts");
+    await fn(ctx);
+  } finally {
+    await ctx.close();
+  }
+}
+function row(a) {
+  return {
+    id: a.id,
+    kind: a.kind,
+    title: a.title,
+    status: a.status,
+    version: a.currentVersion?.number ?? a.versionCount ?? null,
+    createdAt: a.createdAt,
+    ...a.site?.url ? { site: a.site.url } : {}
+  };
+}
+function parseLimit(value) {
+  if (value === void 0) return void 0;
+  const n = Number(value);
+  if (!Number.isInteger(n) || n < 1 || n > 50) throw usageError("--limit must be a whole number from 1 to 50");
+  return n;
+}
+async function list2(ctx, opts) {
+  const started = Date.now();
+  const page = await listArtifacts(ctx.api, { kind: opts.kind, status: opts.status, threadId: opts.thread, limit: parseLimit(opts.limit), cursor: opts.cursor });
+  const out = outMode2(ctx);
+  if (out === "json") {
+    writeJson(jsonEnvelope({ id: "artifacts.list" }, page.artifacts, { durationMs: Date.now() - started, extra: { nextCursor: page.nextCursor } }));
+    return;
+  }
+  if (page.artifacts.length === 0) return printEmptyNotice(out, "No files yet. Ask Tabbio for a document, a page or an image.", { quiet: ctx.globals.quiet });
+  const rows = page.artifacts.map(row);
+  if (out === "tsv") {
+    process.stdout.write(toTsv(rows, LIST_FIELDS2));
+    return;
+  }
+  write2(formatTable(rows, { fields: LIST_FIELDS2, width: process.stdout.columns }));
+  const more = page.nextCursor ? ` ${theme.symbols.middot} more: --cursor ${page.nextCursor}` : "";
+  write2([theme.dim(`${rows.length} ${rows.length === 1 ? "file" : "files"}${more} ${theme.symbols.middot} tabbio artifacts open <id> ${theme.symbols.middot} tabbio artifacts download <id>`)]);
+}
+async function get(ctx, id) {
+  const started = Date.now();
+  const detail = await getArtifact(ctx.api, id);
+  const out = outMode2(ctx);
+  if (out === "json") {
+    writeJson(jsonEnvelope({ id: "artifacts.get" }, detail, { durationMs: Date.now() - started }));
+    return;
+  }
+  const { document: _document, sources, variants, ...summary } = detail;
+  const panel = {
+    ...summary,
+    variants: Object.entries(variants ?? {}).filter(([, on]) => on).map(([name]) => name).join(", "),
+    currentVersion: detail.currentVersion ? `v${detail.currentVersion.number} (${detail.currentVersion.id})` : null,
+    site: detail.site?.url ?? null,
+    error: detail.error ? `${detail.error.code}: ${detail.error.message}` : null,
+    sourceCount: sources?.length ?? detail.sourceCount
+  };
+  if (out === "tsv") {
+    process.stdout.write(toTsv(panel));
+    return;
+  }
+  write2(formatKv(panel, { width: process.stdout.columns }));
+  if (detail.status === "ready") write2([theme.dim(`${theme.symbols.arrowRight} tabbio artifacts open ${id} ${theme.symbols.middot} tabbio artifacts download ${id}`)]);
+}
+async function versions(ctx, id) {
+  const started = Date.now();
+  const page = await listVersions(ctx.api, id, { limit: 50 });
+  const out = outMode2(ctx);
+  if (out === "json") {
+    writeJson(jsonEnvelope({ id: "artifacts.versions" }, page.versions, { durationMs: Date.now() - started, extra: { nextCursor: page.nextCursor } }));
+    return;
+  }
+  const rows = page.versions.map((v) => ({
+    number: v.number,
+    id: v.id,
+    status: v.status,
+    source: v.restoredFrom ? `restore of v${v.restoredFrom.number}` : v.source,
+    current: out === "table" ? v.isCurrent ? theme.symbols.success : "" : v.isCurrent,
+    summary: v.summary ?? "",
+    createdAt: v.createdAt
+  }));
+  if (rows.length === 0) return printEmptyNotice(out, "No versions yet", { quiet: ctx.globals.quiet });
+  if (out === "tsv") {
+    process.stdout.write(toTsv(rows, ["number", "id", "status", "source", "current", "createdAt"]));
+    return;
+  }
+  write2(formatTable(rows, { fields: ["number", "id", "status", "source", "current", "summary", "createdAt"], width: process.stdout.columns }));
+  write2([theme.dim(`tabbio artifacts restore ${id} <versionId> makes a copy of that version the newest one`)]);
+}
+async function restore(ctx, id, versionId) {
+  const started = Date.now();
+  const result = await restoreVersion(ctx.api, id, versionId);
+  const out = outMode2(ctx);
+  if (out === "json") {
+    writeJson(jsonEnvelope({ id: "artifacts.restore" }, result, { durationMs: Date.now() - started }));
+    return;
+  }
+  const from = result.version.restoredFrom ? `version ${result.version.restoredFrom.number}` : versionId;
+  write2([`${theme.success(theme.symbols.success)} Restored ${from} as version ${result.version.number} ${theme.dim(`${theme.symbols.middot} ${result.artifact.title} ${theme.symbols.middot} ${result.version.status}`)}`]);
+}
+async function remove(ctx, id) {
+  const started = Date.now();
+  const out = outMode2(ctx);
+  if (!ctx.globals.yes) {
+    const detail = await getArtifact(ctx.api, id);
+    const site = detail.site?.url ? ` Its site ${detail.site.url} goes offline too.` : "";
+    process.stderr.write(`${theme.warn(theme.symbols.warning)} Delete ${detail.kind} "${detail.title}"?${site} It is removed for good after 30 days.
+`);
+    if (!await confirm("Delete it?")) {
+      process.stderr.write(`${theme.dim("Kept it.")}
+`);
+      return;
+    }
+  }
+  const result = await deleteArtifact(ctx.api, id);
+  if (out === "json") writeJson(jsonEnvelope({ id: "artifacts.delete" }, result, { durationMs: Date.now() - started }));
+  else write2([`${theme.success(theme.symbols.success)} Deleted ${id}`]);
+}
+function registerArtifactsCommand(program) {
+  const artifacts = program.command("artifacts").description("Documents, slide decks, pages and images Tabbio made for you (list, open, download, versions)").addHelpText(
+    "after",
+    [
+      "",
+      "Examples:",
+      "  $ tabbio artifacts list --kind document",
+      "  $ tabbio artifacts open art_123",
+      "  $ tabbio artifacts download art_123 --format pdf --out ~/Downloads",
+      "  $ tabbio artifacts wait art_123 --timeout 2m",
+      "",
+      "Needs an app session (tabbio login). With a personal token use `tabbio artifact list|get|read`."
+    ].join("\n")
+  );
+  artifacts.command("list", { isDefault: true }).description("Your files, newest first").addOption(new Option("--kind <kind>", "Only this kind").choices([...ARTIFACT_KINDS])).addOption(new Option("--status <status>", "Only this status").choices(["pending", "ready", "failed"])).option("--thread <id>", "Only files from this chat thread").option("--limit <n>", "How many (1-50, default 20)").option("--cursor <id>", "Next page (from the previous listing)").action(
+    (opts, cmd) => withSession(cmd, (ctx) => list2(ctx, opts))
+  );
+  artifacts.command("get").description("One file: kind, status, versions, formats, site").argument("<id>", "Artifact id").action((id, _opts, cmd) => withSession(cmd, (ctx) => get(ctx, id)));
+  artifacts.command("open").description("Print a 15-minute preview link and open it in the browser (on a terminal)").argument("<id>", "Artifact id").addOption(new Option("--variant <variant>", "What to preview (default: image for images, else html)").choices(["html", "pdf", "image", "thumbnail"])).addOption(new Option("--theme <theme>", "HTML preview theme").choices(["light", "dark"])).option("--version <versionId>", "A version other than the newest").option("--print", "Only print the link, never open a browser").action(
+    (id, opts, cmd) => withSession(cmd, (ctx) => openCommand(ctx, id, opts))
+  );
+  artifacts.command("download").description("Save a file to disk (default name from its title; never overwrites without --force)").argument("<id>", "Artifact id").option("--format <format>", "pdf | pptx | html | png (image formats save the stored image). Default: pdf for documents, pptx for slides, html for pages, the image for images").option("-O, --out <path>", "File or directory to save to (default: the current directory)").option("--force", "Overwrite an existing file").option("--version <versionId>", "A version other than the newest").option("--wait", "If it is still rendering, wait for it").option("--timeout <duration>", "How long --wait waits (default 5m)").action(
+    (id, opts, cmd) => withSession(cmd, (ctx) => downloadCommand(ctx, id, opts))
+  );
+  artifacts.command("versions").description("Every version of a file, newest first").argument("<id>", "Artifact id").action((id, _opts, cmd) => withSession(cmd, (ctx) => versions(ctx, id)));
+  artifacts.command("restore").description("Make a copy of an older version the newest one (nothing is lost)").argument("<id>", "Artifact id").argument("<versionId>", "Version id from `tabbio artifacts versions <id>`").action((id, versionId, _opts, cmd) => withSession(cmd, (ctx) => restore(ctx, id, versionId)));
+  artifacts.command("delete").description("Delete a file (asks first unless --yes; its published site goes offline)").argument("<id>", "Artifact id").action((id, _opts, cmd) => withSession(cmd, (ctx) => remove(ctx, id)));
+  artifacts.command("wait").description("Wait until a file has rendered (exit 0 ready, 1 failed, 7 still rendering at the timeout)").argument("<id>", "Artifact id").option("--timeout <duration>", "Give up after this long (default 5m)").action((id, opts, cmd) => withSession(cmd, (ctx) => waitCommand(ctx, id, opts)));
+}
+
+// src/core/run-tool.ts
+import { readFileSync } from "node:fs";
+import { Command, CommanderError, Option as Option2 } from "commander";
+function addRunLevelOptions(cmd) {
+  const options = [
+    new Option2("--input <json>", 'Tool input as a JSON object; "-" reads stdin (flags override its keys)'),
+    new Option2("--input-file <path>", 'Read the tool input JSON from a file ("-" for stdin)'),
+    new Option2("--fields <list>", "Only these fields/columns, comma-separated (dot paths ok)"),
+    new Option2("--wait", "Wait for an approval instead of exiting 6, and for a created file to finish rendering"),
+    new Option2("--timeout <duration>", "How long --wait waits (default 10m)"),
+    new Option2("-o, --output <mode>", "json | table | plain (default: table on a TTY, plain TSV when piped)")
+  ];
+  for (const option of options) cmd.addOption(option);
+  return cmd;
+}
+function addToolOptions(cmd, tool) {
+  for (const option of schemaToOptions(tool.inputSchema)) cmd.addOption(option);
+  return cmd;
+}
+function validFlagsFor(tool) {
+  return [
+    ...schemaToFlags(tool.inputSchema).map((spec) => `--${spec.flag}`),
+    "--input",
+    "--input-file",
+    "--fields",
+    "--wait",
+    "--timeout",
+    "--output"
+  ];
+}
+function unknownArgsError(tool, args, commandLabel) {
+  const flag = args.find((arg) => arg.startsWith("-"));
+  const valid = validFlagsFor(tool);
+  if (!flag) {
+    return usageError(
+      `Unexpected argument "${args[0]}" for ${commandLabel}`,
+      `Tool input goes in flags: ${valid.slice(0, 8).join(" ")}${valid.length > 8 ? " \u2026" : ""}`
+    );
+  }
+  const name = flag.split("=")[0];
+  const guess = didYouMean(name, [...valid, ...RESERVED_GLOBAL_FLAGS.map((f) => `--${f}`)]);
+  const toolFlags = schemaToFlags(tool.inputSchema).map((spec) => `--${spec.flag}`);
+  return usageError(
+    `Unknown flag ${name} for ${commandLabel}`,
+    [
+      guess ? `Did you mean ${guess}?` : null,
+      toolFlags.length ? `Valid flags: ${toolFlags.join(", ")}.` : "This tool takes no flags.",
+      `See \`tabbio tools describe ${tool.id}\`.`
+    ].filter(Boolean).join(" ")
+  );
+}
+function parseDynamicFlags(tool, args) {
+  const cmd = addToolOptions(new Command(tool.id), tool).exitOverride().configureOutput({ writeOut: () => void 0, writeErr: () => void 0, outputError: () => void 0 });
+  try {
+    const parsed = cmd.parseOptions([...args]);
+    return { opts: cmd.opts(), rest: [...parsed.operands, ...parsed.unknown] };
+  } catch (error) {
+    if (error instanceof CommanderError) throw usageError(error.message.replace(/^error:\s*/i, ""));
+    throw error;
+  }
+}
+async function readStdin(stream = process.stdin) {
+  if (stream.isTTY) {
+    throw usageError('"-" reads the input from stdin, but stdin is a terminal', "Pipe JSON in, e.g. `echo '{\"limit\":5}' | tabbio run cv.list --input -`.");
+  }
+  const chunks = [];
+  for await (const chunk of stream) chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+function parseInputObject(text, source) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch (error) {
+    throw usageError(`${source} is not valid JSON: ${error.message}`);
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw usageError(`${source} must be a JSON object`, `Example: --input '{"limit":5}'`);
+  }
+  return value;
+}
+async function loadInputBase(opts, stdin = () => readStdin()) {
+  if (opts.input === "-" && opts.inputFile === "-") throw usageError("Only one of --input and --input-file can read stdin");
+  let base;
+  if (opts.inputFile !== void 0) {
+    let text;
+    if (opts.inputFile === "-") text = await stdin();
+    else {
+      try {
+        text = readFileSync(opts.inputFile, "utf8");
+      } catch (error) {
+        throw usageError(`Cannot read --input-file ${opts.inputFile}: ${error.code ?? error.message}`);
+      }
+    }
+    base = parseInputObject(text, "--input-file");
+  }
+  if (opts.input !== void 0) {
+    const text = opts.input === "-" ? await stdin() : opts.input;
+    base = { ...base, ...parseInputObject(text, "--input") };
+  }
+  return base;
+}
+function toolInputDefaults(ctx, tool) {
+  const userId = ctx.credentials?.user?.id;
+  return autoFilledProperties(tool, tool.inputSchema).includes("userId") && userId ? { userId } : {};
+}
+async function resolveCatalogTool(session, ref, filter = () => true) {
+  const find = (tools2) => findTool(tools2.filter(filter), ref);
+  let tools = await session.listTools();
+  let tool = find(tools);
+  if (!tool) {
+    tools = await session.listTools({ refresh: true });
+    tool = find(tools);
+  }
+  if (tool) return tool;
+  const candidates = tools.filter(filter).flatMap((t) => [t.id, t.commandPath.join(" ")]);
+  const guess = didYouMean(ref, candidates);
+  throw new CliError({
+    code: "UNKNOWN_TOOL",
+    message: `Unknown tool: ${ref}`,
+    hint: guess ? `Did you mean ${guess}? List tools with \`tabbio tools\`.` : "List tools with `tabbio tools` (or `tabbio tools --refresh`).",
+    exitCode: ExitCode.NotFound
+  });
+}
+function startProgress(ctx, mode2, text) {
+  if (mode2 !== "table" || ctx.globals.quiet || !process.stderr.isTTY || process.env.CI) return () => void 0;
+  process.stderr.write(`${theme.dim(`${theme.symbols.pending} ${text}`)}`);
+  return () => process.stderr.write("\r\x1B[2K");
+}
+function outputModeFor(ctx, output) {
+  const mode2 = resolveOutputMode({ json: ctx.globals.json, output });
+  if (mode2 === "json" && !ctx.globals.json) {
+    ctx.globals.json = true;
+    setGlobalOptions({ json: true });
+  }
+  return mode2;
+}
+async function runTool(ctx, tool, opts, extraArgs = []) {
+  const commandLabel = tool.kind === "tool" ? tool.commandPath.join(" ") : tool.id;
+  if (extraArgs.length) throw unknownArgsError(tool, extraArgs, commandLabel);
+  const mode2 = outputModeFor(ctx, opts.output);
+  const fields = parseFields(opts.fields);
+  const timeoutMs = parseDuration(opts.timeout);
+  const base = await loadInputBase(opts);
+  const parsed = parseToolInput(tool.inputSchema, opts, { base, defaults: toolInputDefaults(ctx, tool) });
+  const { missingRequired } = parsed;
+  let input = parsed.input;
+  if (missingRequired.length) {
+    const hooks = getInteractiveHooks();
+    if (hooks && mode2 === "table" && canUseInteractiveUi(ctx)) {
+      const filled = await hooks.runToolForm(ctx, tool, input, { missingRequired });
+      if (!filled) throw interruptedError("Cancelled");
+      input = filled;
+    } else {
+      const flags = flagsForProperties(tool.inputSchema, missingRequired);
+      throw usageError(
+        `Missing required ${flags.length === 1 ? "flag" : "flags"} for ${commandLabel}: ${flags.join(", ")}`,
+        `Pass ${flags.length === 1 ? "it as a flag" : "them as flags"} or in --input '{\u2026}'. See \`tabbio tools describe ${tool.id}\`.`
+      );
+    }
+  }
+  const session = await ctx.mcp();
+  const started = Date.now();
+  const clear = startProgress(ctx, mode2, `Running ${commandLabel}${theme.symbols.ellipsis}`);
+  let response;
+  try {
+    response = await session.callTool(tool.id, input);
+  } finally {
+    clear();
+  }
+  if (!response.ok) throw response.error;
+  if (response.approval) {
+    const outcome = await handleApproval(ctx, session, tool, response.approval, input, {
+      wait: Boolean(opts.wait),
+      timeoutMs,
+      mode: mode2,
+      followsOutput: isArtifactProducingTool(tool.id)
+    });
+    const extra2 = { approval: approvalMeta(outcome) };
+    if (outcome.executed) {
+      const ran = interpretToolPayload(outcome.result, tool.id);
+      if (!ran.ok) throw ran.error;
+      const result2 = await settleArtifact(ctx, session, tool, outcome.result, { wait: opts.wait, timeoutMs, mode: mode2, extra: extra2 });
+      await renderResult(ctx, tool, result2, {
+        durationMs: Date.now() - started,
+        requestId: outcome.requestId,
+        mode: mode2,
+        fields,
+        extra: extra2
+      });
+      afterArtifact(ctx, tool, result2, mode2);
+    } else if (opts.wait && outcome.status === "approved" && isArtifactProducingTool(tool.id)) {
+      const artifactId = await findArtifactForApproval(ctx, input, outcome.record?.createdAt).catch(() => null);
+      const result2 = artifactId ? await settleArtifact(ctx, session, tool, { artifactId, status: "pending", kind: "file", title: String(input.title ?? "") }, { wait: true, timeoutMs, mode: mode2, extra: extra2 }) : null;
+      if (result2 || mode2 === "json") {
+        await renderResult(ctx, tool, result2, { durationMs: Date.now() - started, mode: mode2, fields, extra: extra2 });
+      }
+      if (result2) afterArtifact(ctx, tool, result2, mode2);
+    } else if (mode2 === "json") {
+      writeJson(jsonEnvelope(tool, null, { durationMs: Date.now() - started, extra: extra2 }));
+    }
+    return;
+  }
+  const extra = {};
+  const result = await settleArtifact(ctx, session, tool, response.result, { wait: opts.wait, timeoutMs, mode: mode2, extra });
+  await renderResult(ctx, tool, result, { durationMs: Date.now() - started, mode: mode2, fields, extra });
+  afterArtifact(ctx, tool, result, mode2);
+}
+async function settleArtifact(ctx, session, tool, result, opts) {
+  if (!opts.wait || !isArtifactProducingTool(tool.id) || !artifactFromResult(result)) return result;
+  const outcome = await waitForToolArtifact(ctx, session, result, { timeoutMs: opts.timeoutMs, json: opts.mode === "json" });
+  if (!outcome) return result;
+  opts.extra.artifactWait = { artifactId: outcome.artifactId, status: outcome.status, timedOut: outcome.timedOut };
+  if (outcome.timedOut) process.exitCode = ExitCode.Network;
+  else if (outcome.status === "failed") process.exitCode = ExitCode.Error;
+  return mergeWaitedArtifact(result, outcome);
+}
+function afterArtifact(ctx, tool, result, mode2) {
+  const card = artifactFromResult(result);
+  if (!card || !tool.id.startsWith("artifact.")) return;
+  artifactHints(ctx, mode2 === "json", card.id, card.status);
+}
+function wantsHelp(args) {
+  return args.includes("--help") || args.includes("-h");
+}
+
+// src/commands/ask.ts
+function askInputField(schema) {
+  const properties = schema?.properties ?? {};
+  const isString = (key) => {
+    const type = properties[key]?.type;
+    return type === "string" || Array.isArray(type) && type.includes("string");
+  };
+  const required = (schema?.required ?? []).find((key) => key in properties && isString(key));
+  return required ?? Object.keys(properties).find(isString) ?? "message";
+}
+function findAskTool(tools) {
+  return tools.find((t) => t.kind === "agent" && t.key === PRIMARY_AGENT_KEY) ?? findTool(tools, `ask_${PRIMARY_AGENT_KEY}`);
+}
+function answerText(result) {
+  if (typeof result === "string") return result;
+  if (result && typeof result === "object") {
+    const record = result;
+    if (typeof record.text === "string") return record.text;
+    if (typeof record.answer === "string") return record.answer;
+  }
+  return result === null || result === void 0 ? "" : JSON.stringify(result, null, 2);
+}
+function answerData(result) {
+  const finishReason = result && typeof result === "object" && typeof result.finishReason === "string" ? result.finishReason : void 0;
+  return { text: answerText(result), ...finishReason ? { finishReason } : {} };
+}
+async function ask(ctx, words, opts = {}) {
+  const mode2 = outputModeFor(ctx);
+  let question = words.join(" ").trim();
+  if (!question && !process.stdin.isTTY) question = (await readStdin()).trim();
+  if (!question) throw usageError("Ask a question", 'e.g. tabbio ask "Which of my CVs fits product roles best?"');
+  if (!opts.viaMcp && describeMcpBearer(ctx.credentials)?.kind === "app-session") {
+    await askViaChat(ctx, question, mode2, opts.mode ?? "seeker");
+    return;
+  }
+  const session = await ctx.mcp();
+  const tool = findAskTool(await session.listTools());
+  if (!tool) {
+    throw new CliError({
+      code: "UNKNOWN_TOOL",
+      message: "This Tabbio server does not offer the ask_tabbio tool",
+      hint: "Try `tabbio chat`, or `tabbio tools --refresh`.",
+      exitCode: ExitCode.NotFound
+    });
+  }
+  const input = { [askInputField(tool.inputSchema)]: question };
+  const started = Date.now();
+  const clear = startProgress(ctx, mode2, "Asking Tabbio\u2026");
+  let response;
+  try {
+    response = await session.callTool(tool.id, input);
+  } finally {
+    clear();
+  }
+  if (!response.ok) throw response.error;
+  let result = response.result;
+  let extra;
+  if (response.approval) {
+    const outcome = await handleApproval(ctx, session, tool, response.approval, input, { mode: mode2 });
+    extra = { approval: approvalMeta(outcome) };
+    if (!outcome.executed) {
+      if (mode2 === "json") writeJson(jsonEnvelope(tool, null, { durationMs: Date.now() - started, extra }));
+      return;
+    }
+    result = outcome.result;
+  }
+  if (mode2 === "json") {
+    writeJson(jsonEnvelope(tool, answerData(result), { durationMs: Date.now() - started, extra }));
+    return;
+  }
+  const text = answerText(result).trimEnd();
+  process.stdout.write(text ? `${text}
+` : "");
+}
+async function askViaChat(ctx, question, mode2, agentMode) {
+  const started = Date.now();
+  const controller = new AbortController();
+  const onSigint = () => controller.abort();
+  process.on("SIGINT", onSigint);
+  const clear = mode2 === "json" ? () => void 0 : startProgress(ctx, mode2, "Asking Tabbio\u2026");
+  let cleared = false;
+  let text = "";
+  let finishReason;
+  let threadId;
+  let approval;
+  let errorMessage;
+  let sources = [];
+  const artifacts = /* @__PURE__ */ new Map();
+  const notices = [];
+  try {
+    const capabilities = capabilityRequestFields(agentMode, loadCapabilityPrefs(ctx.profile.name));
+    const events = streamChat(ctx, { mode: agentMode, message: question, ...capabilities }, { signal: controller.signal });
+    for await (const event of events) {
+      const payload = event.payload ?? {};
+      switch (event.type) {
+        case "start":
+          if (typeof payload.threadId === "string") threadId = payload.threadId;
+          break;
+        case "text-delta": {
+          const delta = typeof payload.text === "string" ? payload.text : "";
+          if (!delta) break;
+          if (!cleared) {
+            clear();
+            cleared = true;
+          }
+          text += delta;
+          if (mode2 !== "json") process.stdout.write(delta);
+          break;
+        }
+        case "tool-call-approval":
+          approval = { approvalId: String(payload.approvalId ?? ""), name: String(payload.name ?? "A tool") };
+          break;
+        case "tool-result": {
+          sources = mergeSources(sources, sourcesFromResult(payload.result));
+          const artifact = artifactFromResult(payload.result);
+          if (artifact) artifacts.set(artifact.id, artifact);
+          const denial = capabilityDenial(payload.result);
+          if (denial) notices.push(`${denial.message}${denial.reason ? ` (${denial.reason})` : ""}`);
+          break;
+        }
+        case "error":
+          errorMessage = typeof payload.message === "string" ? payload.message : "The agent reported an error";
+          break;
+        case "finish":
+          if (typeof payload.finishReason === "string") finishReason = payload.finishReason;
+          if (typeof payload.threadId === "string") threadId = payload.threadId;
+          if (!text.trim() && typeof payload.text === "string") text = payload.text;
+          break;
+        default:
+          break;
+      }
+    }
+  } finally {
+    if (!cleared) clear();
+    process.off("SIGINT", onSigint);
+  }
+  if (errorMessage && !text.trim()) {
+    throw new CliError({ code: "AGENT_ERROR", message: errorMessage, exitCode: ExitCode.Server });
+  }
+  const durationMs = Date.now() - started;
+  const files = [...artifacts.values()].map(({ id, kind, title, status: status2 }) => ({ id, kind, title, status: status2 }));
+  if (mode2 === "json") {
+    writeJson({
+      data: {
+        text: text.trimEnd(),
+        ...finishReason ? { finishReason } : {},
+        ...threadId ? { threadId } : {},
+        ...sources.length ? { sources } : {},
+        ...files.length ? { artifacts: files } : {}
+      },
+      meta: { schemaVersion: 1, tool: "chat", durationMs, ...approval ? { approval } : {} }
+    });
+  } else {
+    if (text && !text.endsWith("\n")) process.stdout.write("\n");
+    printAskExtras({ sources, files, notices });
+    if (approval) {
+      process.stderr.write(
+        `${theme.warn(`${theme.symbols.pending} ${approval.name} is waiting for your approval`)} ${theme.dim(approval.approvalId)}
+${theme.dim("Run:")} tabbio approvals approve ${approval.approvalId}
+`
+      );
+    }
+  }
+  if (approval) process.exitCode = ExitCode.ApprovalPending;
+}
+function printAskExtras(extras) {
+  for (const note of extras.notices) process.stderr.write(`${theme.dim(`${theme.symbols.arrowRight} ${note}`)}
+`);
+  if (extras.sources.length) {
+    process.stdout.write(`
+${theme.dim("Sources")}
+`);
+    extras.sources.forEach((source, i) => process.stdout.write(`${i + 1}. ${source.title} ${theme.dim(source.url)}
+`));
+  }
+  for (const file of extras.files) {
+    process.stdout.write(`${theme.dim(`${file.kind} ${file.status}:`)} ${file.title} ${theme.dim(`tabbio artifacts open ${file.id}`)}
+`);
+  }
+}
+function registerAskCommand(program) {
+  program.command("ask").description("Ask Tabbio one question (streams through your session; MCP ask tool with a personal token)").argument("[question...]", "Your question; read from stdin when omitted and piped").option("--mode <mode>", "seeker or employer (app session only)", "seeker").option("--via-mcp", "Force the MCP ask_tabbio tool even with an app session").addHelpText(
+    "after",
+    '\nExamples:\n  $ tabbio ask "What jobs fit my CV?"\n  $ echo "Summarise my applications" | tabbio ask\n  $ tabbio ask "Draft a headline" --json'
+  ).action(async (words, opts, cmd) => {
+    const ctx = createCommandContext(cmd);
+    const agentMode = opts.mode === "employer" ? "employer" : "seeker";
+    try {
+      await ask(ctx, words, { mode: agentMode, viaMcp: Boolean(opts.viaMcp) });
+    } finally {
+      await ctx.close();
+    }
+  });
+}
+
+// src/commands/chat.ts
+import { Option as Option3 } from "commander";
+async function readStdin2() {
+  if (process.stdin.isTTY) return void 0;
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+  return Buffer.concat(chunks).toString("utf8");
+}
+function isFailureEvent(event) {
+  return event.type === "error" || event.type === "finish" && event.payload.finishReason === "error";
+}
+async function runChatNdjson(ctx, message, opts) {
+  const text = (message ?? await readStdin2())?.trim();
+  if (!text) {
+    throw usageError("Chat needs a message when it is not interactive", 'Pass it as an argument, or pipe it in: echo "hi" | tabbio chat --json');
+  }
+  const controller = new AbortController();
+  const onSigint = () => controller.abort();
+  process.on("SIGINT", onSigint);
+  let failed = false;
+  try {
+    const capabilities = opts.capabilities ?? loadCapabilityPrefs(ctx.api.profile.name);
+    const frames = streamChatFrames(
+      ctx,
+      {
+        mode: opts.mode,
+        message: text,
+        threadId: opts.thread,
+        modelId: opts.model,
+        companyId: opts.company,
+        ...capabilityRequestFields(opts.mode, capabilities)
+      },
+      { signal: controller.signal }
+    );
+    for await (const frame of frames) {
+      process.stdout.write(`${ndjsonLine(frame.data)}
+`);
+      if (frame.event && isFailureEvent(frame.event)) failed = true;
+    }
+  } finally {
+    process.off("SIGINT", onSigint);
+  }
+  if (failed) process.exitCode = ExitCode.Error;
+}
+function ndjsonLine(data) {
+  try {
+    return JSON.stringify(JSON.parse(data));
+  } catch {
+    return JSON.stringify({ type: "unparsed", payload: { data } });
+  }
+}
+function registerChatCommand(program) {
+  program.command("chat").description("Chat with Tabbio (streaming; interactive on a terminal, NDJSON events with --json or when piped)").argument("[message]", "First message (non-interactive: the only message; stdin works too)").addOption(new Option3("--mode <mode>", "Workspace").choices(["seeker", "employer"]).default("seeker")).option("--company <id>", "Company id for employer mode").option("--thread <id>", "Continue an existing thread").option("--model <id>", "Model id from the app's picker (default: auto)").addOption(new Option3("--research <mode>", "Web research for this chat (default: your saved choice, else auto)").choices(["auto", "on", "off"])).addOption(new Option3("--image <mode>", "Image generation for this chat").choices(["auto", "on", "off"])).addOption(
+    new Option3("--result <mode>", "What to make: an answer, a document, slides, a page or an image").choices([
+      "auto",
+      "summary",
+      "document",
+      "slides",
+      "page",
+      "image"
+    ])
+  ).option("--save", "Remember --research/--image/--result for this profile (like /research in the chat)").addHelpText(
+    "after",
+    [
+      "",
+      "In the chat: /new \xB7 /threads \xB7 /mode seeker|employer \xB7 /model <id> \xB7 /research \xB7 /image \xB7 /result \xB7 /help \xB7 /exit",
+      "Research, image and result modes are sent with every message (seeker mode) with your timezone.",
+      "Keys: enter send \xB7 ctrl+j newline \xB7 esc interrupt \xB7 ctrl+o expand tool \xB7 ctrl+c twice quit",
+      "",
+      "Examples:",
+      "  $ tabbio chat",
+      '  $ tabbio chat "Find senior product design roles in Dubai"',
+      `  $ tabbio chat --json "Summarise my CV" | jq -r 'select(.type=="text-delta").payload.text'`,
+      '  $ tabbio chat --research on "Latest UAE labour law changes, with sources"',
+      '  $ tabbio chat --result document "A one-page brief on my job search"'
+    ].join("\n")
+  ).action(async (message, opts, cmd) => {
+    const ctx = createCommandContext(cmd);
+    try {
+      assertJwtSession(ctx.credentials, ctx.profile, "Chat");
+      opts.capabilities = resolveCapabilities(loadCapabilityPrefs(ctx.profile.name), opts);
+      if (opts.save) saveCapabilityPrefs(ctx.profile.name, opts.capabilities);
+      if (ctx.globals.json || !isInteractiveTerminal() || process.env.CI) {
+        await runChatNdjson(ctx, message, opts);
+        return;
+      }
+      assertInteractive("Chat");
+      const { runChat } = await import("./entry-WENOOT6W.js");
+      await runChat(ctx, {
+        mode: opts.mode,
+        companyId: opts.company,
+        threadId: opts.thread,
+        modelId: opts.model,
+        message,
+        capabilities: opts.capabilities
+      });
+    } finally {
+      await ctx.close();
+    }
+  });
+}
+
+// src/commands/completion.ts
+var SHELLS = ["bash", "zsh", "fish"];
+function isHidden(cmd) {
+  return Boolean(cmd._hidden);
+}
+function toOption(option) {
+  const flags = [option.long, option.short].filter((f) => Boolean(f));
+  return {
+    flags,
+    long: option.long?.replace(/^--/, ""),
+    short: option.short?.replace(/^-/, ""),
+    description: option.description ?? "",
+    takesValue: Boolean(option.required || option.optional)
+  };
+}
+function buildCompletionTree(program) {
+  const walk = (cmd, path) => {
+    const children = cmd.commands.filter((c) => !isHidden(c)).map((c) => walk(c, [...path, c.name()]));
+    const options = cmd.options.filter((o) => !o.hidden).map(toOption);
+    options.push({ flags: ["--help", "-h"], long: "help", short: "h", description: "Show help", takesValue: false });
+    return { path: path.join(" "), name: cmd.name(), description: cmd.description(), children, options };
+  };
+  const root = walk(program, []);
+  if (!root.children.some((c) => c.name === "help")) {
+    root.children.push({ path: "help", name: "help", description: "Show help for a command", children: [], options: [] });
+  }
+  return root;
+}
+function flatten(node) {
+  return [node, ...node.children.flatMap(flatten)];
+}
+var sq = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
+var oneLine = (value) => value.replace(/\s+/g, " ").trim();
+function bashScript(root) {
+  const nodes = flatten(root);
+  const paths = nodes.filter((n) => n.path).map((n) => sq(n.path)).join("|");
+  const cases = nodes.map((n) => {
+    const words = [...n.children.map((c) => c.name), ...n.options.flatMap((o) => o.flags)].join(" ");
+    return `    ${n.path ? sq(n.path) : "''"}) cmdwords=${sq(words)} ;;`;
+  }).join("\n");
+  return `# tabbio bash completion
+# Install: tabbio completion bash > ~/.local/share/bash-completion/completions/tabbio
+_tabbio() {
+  local cur w i cmdpath="" cmdwords=""
+  cur="\${COMP_WORDS[COMP_CWORD]}"
+  for ((i=1; i<COMP_CWORD; i++)); do
+    w="\${COMP_WORDS[i]}"
+    [[ "$w" == -* ]] && continue
+    case "\${cmdpath:+$cmdpath }$w" in
+      ${paths || "''"}) cmdpath="\${cmdpath:+$cmdpath }$w" ;;
+    esac
+  done
+  case "$cmdpath" in
+${cases}
+  esac
+  COMPREPLY=( $(compgen -W "$cmdwords" -- "$cur") )
+}
+complete -F _tabbio tabbio
+`;
+}
+function zshScript(root) {
+  const nodes = flatten(root);
+  const paths = nodes.filter((n) => n.path).map((n) => sq(n.path)).join("|");
+  const escapeName = (value) => value.replace(/:/g, "\\:");
+  const cases = nodes.map((n) => {
+    const subs = n.children.map((c) => sq(`${escapeName(c.name)}:${oneLine(c.description)}`)).join(" ");
+    const opts = n.options.flatMap((o) => o.flags).map(sq).join(" ");
+    return `    ${n.path ? sq(n.path) : "''"}) subcmds=(${subs}); opts=(${opts}) ;;`;
+  }).join("\n");
+  return `#compdef tabbio
+# tabbio zsh completion
+# Install: tabbio completion zsh > "\${fpath[1]}/_tabbio"   (or: eval "$(tabbio completion zsh)")
+_tabbio() {
+  local cmdpath="" w i
+  local -a subcmds opts
+  for ((i=2; i<CURRENT; i++)); do
+    w="\${words[i]}"
+    [[ "$w" == -* ]] && continue
+    case "\${cmdpath:+$cmdpath }$w" in
+      ${paths || "''"}) cmdpath="\${cmdpath:+$cmdpath }$w" ;;
+    esac
+  done
+  case "$cmdpath" in
+${cases}
+  esac
+  if [[ "\${words[CURRENT]}" == -* ]]; then
+    compadd -- "\${opts[@]}"
+  else
+    _describe -t commands 'tabbio command' subcmds
+  fi
+}
+if [[ "\${funcstack[1]}" == "_tabbio" ]]; then
+  _tabbio "$@"
+else
+  compdef _tabbio tabbio
+fi
+`;
+}
+function fishScript(root) {
+  const nodes = flatten(root);
+  const fq = (value) => `'${value.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+  const lines = [
+    "# tabbio fish completion",
+    "# Install: tabbio completion fish > ~/.config/fish/completions/tabbio.fish",
+    `set -g __tabbio_paths ${nodes.filter((n) => n.path).map((n) => fq(n.path)).join(" ")}`,
+    "function __tabbio_cmdpath",
+    "    set -l tokens (commandline -opc)",
+    "    set -l cmdpath",
+    "    for t in $tokens[2..-1]",
+    "        if string match -q -- '-*' $t",
+    "            continue",
+    "        end",
+    "        set -l candidate (string join ' ' $cmdpath $t)",
+    "        if contains -- $candidate $__tabbio_paths",
+    "            set cmdpath $cmdpath $t",
+    "        end",
+    "    end",
+    "    string join ' ' $cmdpath",
+    "end",
+    "function __tabbio_is",
+    "    set -l current (__tabbio_cmdpath)",
+    '    test "$current" = "$argv[1]"',
+    "end",
+    "complete -c tabbio -f"
+  ];
+  for (const node of nodes) {
+    const condition = `-n ${fq(`__tabbio_is ${fq(node.path)}`)}`;
+    for (const child of node.children) {
+      lines.push(`complete -c tabbio ${condition} -a ${fq(child.name)} -d ${fq(oneLine(child.description))}`);
+    }
+    for (const option of node.options) {
+      const parts = [
+        option.long ? `-l ${option.long}` : "",
+        option.short ? `-s ${option.short}` : "",
+        option.takesValue ? "-r" : ""
+      ].filter(Boolean);
+      if (parts.length === 0) continue;
+      lines.push(`complete -c tabbio ${condition} ${parts.join(" ")} -d ${fq(oneLine(option.description))}`);
+    }
+  }
+  return `${lines.join("\n")}
+`;
+}
+function completionScript(shell, program) {
+  const tree = buildCompletionTree(program);
+  switch (shell) {
+    case "bash":
+      return bashScript(tree);
+    case "zsh":
+      return zshScript(tree);
+    case "fish":
+      return fishScript(tree);
+    default:
+      throw usageError(`Unsupported shell "${shell}"`, `Choose one of: ${SHELLS.join(", ")}`);
+  }
+}
+function registerCompletionCommand(program) {
+  program.command("completion").description("Print a shell completion script (bash, zsh or fish)").argument("<shell>", SHELLS.join(" | ")).addHelpText(
+    "after",
+    '\nExamples:\n  $ tabbio completion zsh > "${fpath[1]}/_tabbio"\n  $ tabbio completion bash > ~/.local/share/bash-completion/completions/tabbio\n  $ tabbio completion fish > ~/.config/fish/completions/tabbio.fish'
+  ).action((shell, _opts, cmd) => {
+    let root = cmd;
+    while (root.parent) root = root.parent;
+    writeOut(completionScript(shell, root).trimEnd());
+  });
+}
+
+// src/commands/config.ts
+var CONFIG_KEYS = {
+  profile: "Current profile used when --profile / TABBIO_PROFILE are not set",
+  "api-url": "API base URL for the profile",
+  "app-url": "Web app URL for the profile (browser sign-in)",
+  "mcp-url": "MCP endpoint for the profile (default: <api-url>/api/mcp)",
+  "update-check": "Check npm for a newer CLI once a day (true/false)"
+};
+function assertKey(key) {
+  if (key in CONFIG_KEYS) return key;
+  throw usageError(`Unknown config key "${key}"`, `Known keys: ${Object.keys(CONFIG_KEYS).join(", ")}`);
+}
+var PROFILE_FIELD = {
+  "api-url": "apiUrl",
+  "app-url": "appUrl",
+  "mcp-url": "mcpUrl"
+};
+function parseBoolean(value) {
+  const normalized = value.trim().toLowerCase();
+  if (["true", "1", "yes", "on"].includes(normalized)) return true;
+  if (["false", "0", "no", "off"].includes(normalized)) return false;
+  throw usageError(`Expected true or false, got "${value}"`);
+}
+function effectiveConfig(opts) {
+  const { profile, sources } = resolveProfileWithSources(opts);
+  const config = loadConfig();
+  return {
+    profile: { value: profile.name, source: sources.name },
+    "api-url": { value: profile.apiUrl, source: sources.apiUrl },
+    "app-url": { value: profile.appUrl, source: sources.appUrl },
+    "mcp-url": { value: profile.mcpUrl, source: sources.mcpUrl },
+    "update-check": { value: config.updateCheck !== false, source: config.updateCheck === void 0 ? "default" : "config" }
+  };
+}
+function registerConfig(program) {
+  const config = program.command("config").description("Read and change CLI settings");
+  config.command("list").description("Show effective settings and where each comes from").action((_opts, cmd) => {
+    const ctx = createCommandContext(cmd);
+    const values = effectiveConfig(ctx.globals);
+    if (ctx.globals.json) {
+      printJson({ ...values, paths: configPaths() });
+      return;
+    }
+    const rows = Object.entries(values).map(([key, entry]) => [
+      key,
+      `${String(entry.value)} ${theme.dim(`(${entry.source})`)}`
+    ]);
+    rows.push(["config dir", configPaths().dir]);
+    printKeyValues(rows);
+  });
+  config.command("get").description("Print one setting").argument("<key>", `One of: ${Object.keys(CONFIG_KEYS).join(", ")}`).action((key, _opts, cmd) => {
+    const ctx = createCommandContext(cmd);
+    const entry = effectiveConfig(ctx.globals)[assertKey(key)];
+    if (ctx.globals.json) printJson({ key, ...entry });
+    else writeOut(String(entry.value));
+  });
+  config.command("set").description("Change a setting (profile-scoped keys apply to --profile or the current profile)").argument("<key>", `One of: ${Object.keys(CONFIG_KEYS).join(", ")}`).argument("<value>").action((rawKey, value, _opts, cmd) => {
+    const ctx = createCommandContext(cmd);
+    const key = assertKey(rawKey);
+    const profileName = ctx.profile.name;
+    updateConfig((c) => {
+      if (key === "profile") c.currentProfile = assertProfileName(value);
+      else if (key === "update-check") c.updateCheck = parseBoolean(value);
+      else {
+        const label2 = key === "mcp-url" ? "MCP URL" : key === "api-url" ? "API URL" : "App URL";
+        c.profiles[profileName] = { ...c.profiles[profileName], [PROFILE_FIELD[key]]: normalizeBaseUrl(value, label2) };
+      }
+    });
+    if (ctx.globals.json) printJson({ key, value: effectiveConfig({ profile: key === "profile" ? value : profileName })[key].value });
+    else writeOut(successLine(`Set ${key}${key in PROFILE_FIELD ? ` for profile ${profileName}` : ""}`));
+  });
+  config.command("unset").description("Reset a setting to its default").argument("<key>", `One of: ${Object.keys(CONFIG_KEYS).join(", ")}`).action((rawKey, _opts, cmd) => {
+    const ctx = createCommandContext(cmd);
+    const key = assertKey(rawKey);
+    updateConfig((c) => {
+      if (key === "profile") delete c.currentProfile;
+      else if (key === "update-check") delete c.updateCheck;
+      else {
+        const current = { ...c.profiles[ctx.profile.name] };
+        delete current[PROFILE_FIELD[key]];
+        c.profiles[ctx.profile.name] = current;
+      }
+    });
+    if (ctx.globals.json) printJson({ key, unset: true });
+    else writeOut(successLine(`Reset ${key}`));
+  });
+  config.command("path").description("Print the config, credentials and cache locations").action((_opts, cmd) => {
+    const ctx = createCommandContext(cmd);
+    const paths = configPaths();
+    if (ctx.globals.json) printJson(paths);
+    else printKeyValues([
+      ["config", paths.configFile],
+      ["credentials", paths.credentialsFile],
+      ["cache", paths.cacheDir]
+    ]);
+  });
+  return config;
+}
+function registerProfile(config) {
+  const profile = config.command("profile").description("Manage named profiles (e.g. production, local)");
+  profile.command("list").description("List profiles").action((_opts, cmd) => {
+    const ctx = createCommandContext(cmd);
+    const names = Array.from(/* @__PURE__ */ new Set([...listProfileNames(), ...listCredentialProfiles()])).sort();
+    const rows = names.map((name) => {
+      const { profile: resolved } = resolveProfileWithSources({ profile: name });
+      const creds = loadStoredCredentials(name);
+      return {
+        name,
+        current: name === ctx.profile.name,
+        apiUrl: resolved.apiUrl,
+        signedIn: Boolean(creds?.accessToken || creds?.mcpToken),
+        user: creds?.user?.email ?? null
+      };
+    });
+    if (ctx.globals.json) {
+      printJson(rows);
+      return;
+    }
+    for (const row2 of rows) {
+      const marker = row2.current ? theme.accent(theme.symbols.dot) : " ";
+      const who = row2.signedIn ? row2.user ?? "token" : theme.dim("signed out");
+      writeOut(`${marker} ${row2.name.padEnd(14)} ${who}  ${theme.dim(row2.apiUrl)}`);
+    }
+  });
+  profile.command("use").description("Make a profile the default").argument("<name>").action((name, _opts, cmd) => {
+    const ctx = createCommandContext(cmd);
+    const profileName = assertProfileName(name);
+    const known = /* @__PURE__ */ new Set([...listProfileNames(), ...listCredentialProfiles(), ...Object.keys(PROFILE_PRESETS)]);
+    if (!known.has(profileName)) {
+      throw usageError(`No profile named "${profileName}"`, `Create it with \`tabbio config profile add ${profileName} --api-url \u2026\`.`);
+    }
+    updateConfig((c) => {
+      if (profileName === DEFAULT_PROFILE) delete c.currentProfile;
+      else c.currentProfile = profileName;
+    });
+    if (ctx.globals.json) printJson({ current: profileName });
+    else writeOut(successLine(`Now using profile ${profileName}`));
+  });
+  profile.command("add").description("Create or update a profile").argument("<name>").option("--api-url <url>", "API base URL").option("--app-url <url>", "Web app URL (browser sign-in)").option("--mcp-url <url>", "MCP endpoint (default: <api-url>/api/mcp)").action((name, opts, cmd) => {
+    const ctx = createCommandContext(cmd);
+    const profileName = assertProfileName(name);
+    const local = cmd.opts();
+    const apiUrl = local.apiUrl ?? opts.apiUrl ?? ctx.globals.apiUrl;
+    const appUrl = local.appUrl ?? opts.appUrl ?? ctx.globals.appUrl;
+    const mcpUrl = local.mcpUrl ?? opts.mcpUrl;
+    if (!apiUrl && !PROFILE_PRESETS[profileName]) {
+      throw usageError("A new profile needs --api-url", "Example: tabbio config profile add staging --api-url https://\u2026 --app-url https://\u2026");
+    }
+    updateConfig((c) => {
+      c.profiles[profileName] = {
+        ...c.profiles[profileName],
+        ...apiUrl ? { apiUrl: normalizeBaseUrl(apiUrl, "API URL") } : {},
+        ...appUrl ? { appUrl: normalizeBaseUrl(appUrl, "App URL") } : {},
+        ...mcpUrl ? { mcpUrl: normalizeBaseUrl(mcpUrl, "MCP URL") } : {}
+      };
+    });
+    const { profile: resolved } = resolveProfileWithSources({ profile: profileName });
+    if (ctx.globals.json) printJson(resolved);
+    else writeOut(successLine(`Saved profile ${profileName} (${resolved.apiUrl})`));
+  });
+  profile.command("remove").description("Delete a profile from the config (sign out of it first)").argument("<name>").action((name, _opts, cmd) => {
+    const ctx = createCommandContext(cmd);
+    const profileName = assertProfileName(name);
+    if (loadStoredCredentials(profileName)) {
+      throw usageError(
+        `Profile "${profileName}" is still signed in`,
+        `Run \`tabbio logout --profile ${profileName}\` first so its tokens are revoked.`
+      );
+    }
+    updateConfig((c) => {
+      delete c.profiles[profileName];
+      if (c.currentProfile === profileName) delete c.currentProfile;
+    });
+    if (ctx.globals.json) printJson({ removed: profileName });
+    else writeOut(successLine(`Removed profile ${profileName}`));
+  });
+}
+function registerConfigCommands(program) {
+  const config = registerConfig(program);
+  registerProfile(config);
+}
+
+// src/commands/doctor.ts
+var MAX_CLOCK_SKEW_MS = 2 * 60 * 1e3;
+function checkNodeVersion(version = process.versions.node) {
+  const major = Number.parseInt(version.split(".")[0] ?? "0", 10);
+  return major >= 20 ? { name: "Node.js", status: "ok", detail: `v${version}` } : { name: "Node.js", status: "fail", detail: `v${version}`, hint: "Tabbio CLI needs Node.js 20 or newer." };
+}
+function checkPermissions() {
+  const issues = credentialPermissionIssues();
+  return issues.length === 0 ? { name: "Credential store", status: "ok", detail: `${configPaths().dir} (private)` } : {
+    name: "Credential store",
+    status: "fail",
+    detail: issues.join("; "),
+    hint: `Run: chmod 700 "${configPaths().dir}" && chmod 600 "${configPaths().credentialsFile}"`
+  };
+}
+async function checkApi(ctx) {
+  const started = Date.now();
+  const api = new ApiClient(ctx.profile, null, { persist: false });
+  try {
+    const response = await api.raw("/api/health", { auth: "none", timeoutMs: 1e4 });
+    const latency = Date.now() - started;
+    const body = await response.json().catch(() => null);
+    const checks = [
+      {
+        name: "API health",
+        status: response.ok ? "ok" : "fail",
+        detail: `${ctx.profile.apiUrl} \u2192 HTTP ${response.status} in ${latency}ms${body?.data?.commitSha ? ` \xB7 ${body.data.commitSha.slice(0, 7)}` : ""}${readRequestId(response.headers) ? ` \xB7 req ${readRequestId(response.headers)}` : ""}`
+      }
+    ];
+    const serverDate = response.headers.get("date");
+    if (serverDate) {
+      const skew = Date.parse(serverDate) - (started + latency / 2);
+      checks.push(
+        Math.abs(skew) > MAX_CLOCK_SKEW_MS ? {
+          name: "Clock",
+          status: "warn",
+          detail: `local clock is ${Math.round(Math.abs(skew) / 1e3)}s ${skew > 0 ? "behind" : "ahead of"} the server`,
+          hint: "Token expiry checks may misfire; sync your system clock."
+        } : { name: "Clock", status: "ok", detail: `within ${Math.round(Math.abs(skew) / 1e3)}s of the server` }
+      );
+    }
+    return checks;
+  } catch (error) {
+    return [
+      {
+        name: "API health",
+        status: "fail",
+        detail: `${ctx.profile.apiUrl}: ${error.message}`,
+        hint: "Check your network or the API URL (`tabbio config get api-url`)."
+      }
+    ];
+  }
+}
+async function checkSession(ctx) {
+  if (!ctx.credentials?.accessToken) {
+    return { name: "Session (JWT)", status: "skip", detail: "no app session (MCP-only or signed out)" };
+  }
+  try {
+    const me = await ctx.api.json("/api/users/me");
+    return { name: "Session (JWT)", status: "ok", detail: `valid${me?.email ? ` for ${me.email}` : ""}` };
+  } catch (error) {
+    return {
+      name: "Session (JWT)",
+      status: "fail",
+      detail: error.message,
+      hint: "Run `tabbio login`."
+    };
+  }
+}
+async function checkMcp(ctx) {
+  const creds = ctx.api.credentials ?? ctx.credentials;
+  const via = mcpSummary(creds);
+  if (!via) return { name: "MCP", status: "skip", detail: "not signed in", hint: "Run `tabbio login`." };
+  const started = Date.now();
+  let session = null;
+  try {
+    session = await McpSession.connect(ctx.profile, creds, { api: ctx.api });
+    const tools = await session.listTools({ refresh: true });
+    return {
+      name: "MCP",
+      status: tools.length > 0 ? "ok" : "warn",
+      detail: `${ctx.profile.mcpUrl} \u2192 ${tools.length} tools in ${Date.now() - started}ms via ${via.label}`
+    };
+  } catch (error) {
+    return {
+      name: "MCP",
+      status: "fail",
+      detail: `${error.message} (via ${via.label})`,
+      hint: error.hint
+    };
+  } finally {
+    await session?.close();
+  }
+}
+var SYMBOL = {
+  ok: () => theme.success(theme.symbols.success),
+  warn: () => theme.warn(theme.symbols.warning),
+  fail: () => theme.error(theme.symbols.error),
+  skip: () => theme.dim("-")
+};
+function registerDoctorCommand(program) {
+  program.command("doctor").description("Diagnose Node, config permissions, API reachability, clock skew, session and MCP").action(async (_opts, cmd) => {
+    const ctx = createCommandContext(cmd);
+    const checks = [
+      { name: "Tabbio CLI", status: "ok", detail: `v${CLI_VERSION} \xB7 profile ${ctx.profile.name}` },
+      checkNodeVersion(),
+      checkPermissions(),
+      ...await checkApi(ctx),
+      await checkSession(ctx),
+      await checkMcp(ctx)
+    ];
+    const failed = checks.some((check) => check.status === "fail");
+    if (ctx.globals.json) {
+      printJson({ ok: !failed, checks });
+    } else {
+      const width = Math.max(...checks.map((c) => c.name.length));
+      for (const check of checks) {
+        writeOut(`${SYMBOL[check.status]()} ${check.name.padEnd(width)}  ${theme.dim(check.detail)}`);
+        if (check.hint && check.status !== "ok") writeOut(`  ${" ".repeat(width)}  ${check.hint}`);
+      }
+    }
+    if (failed) process.exitCode = ExitCode.Error;
+  });
+}
+
+// src/commands/home.ts
+function registerHome() {
+  setHomeHandler(async (ctx) => {
+    const { runHome } = await import("./entry-WENOOT6W.js");
+    await runHome(ctx);
+  });
+}
+
+// src/commands/generated.ts
+var STATIC_COMMAND_NAMES = /* @__PURE__ */ new Set([
+  "login",
+  "logout",
+  "status",
+  "whoami",
+  "doctor",
+  "config",
+  "mcp",
+  "completion",
+  "tools",
+  "run",
+  "workflows",
+  "approvals",
+  "artifacts",
+  "ask",
+  "chat",
+  "help"
+]);
+var TOOL_COMMANDS_HELP_GROUP = "Tool commands:";
+function generatedCommandPath(tool) {
+  if (tool.hidden || tool.kind !== "tool" || tool.commandPath.length < 2) return null;
+  const [group, action] = tool.commandPath;
+  if (!group || !action || STATIC_COMMAND_NAMES.has(group)) return null;
+  return [group, action];
+}
+function invocationPath(tool) {
+  if (tool.kind === "agent") return tool.commandPath.length === 1 ? tool.commandPath : ["run", tool.id];
+  if (tool.kind === "workflow") return ["workflows", "run", tool.action];
+  return generatedCommandPath(tool) ?? ["run", tool.id];
+}
+function invocation(tool) {
+  return `tabbio ${invocationPath(tool).join(" ")}`;
+}
+function toolHelpText(tool) {
+  const lines = ["", "Example:", `  $ ${exampleInvocation(tool, tool.inputSchema)}`, ""];
+  lines.push(`Tool: ${tool.id}${tool.readOnly ? " (read-only)" : " (writes; may need approval)"}`);
+  return lines.join("\n");
+}
+function registerGeneratedCommands(program, catalog) {
+  const taken = new Set(program.commands.flatMap((c) => [c.name(), ...c.aliases()]));
+  const groups = /* @__PURE__ */ new Map();
+  const counts = /* @__PURE__ */ new Map();
+  for (const tool of catalog) {
+    const path = generatedCommandPath(tool);
+    if (!path) continue;
+    const [group, action] = path;
+    let groupCmd = groups.get(group);
+    if (!groupCmd) {
+      if (taken.has(group)) continue;
+      groupCmd = program.command(group).helpGroup(TOOL_COMMANDS_HELP_GROUP);
+      groups.set(group, groupCmd);
+    }
+    if (groupCmd.commands.some((c) => c.name() === action)) continue;
+    counts.set(group, (counts.get(group) ?? 0) + 1);
+    const cmd = groupCmd.command(action).summary(tool.title).description(tool.description || tool.title).allowUnknownOption().allowExcessArguments().addHelpText("after", () => toolHelpText(tool));
+    addToolOptions(cmd, tool);
+    addRunLevelOptions(cmd);
+    cmd.action(async (opts, command) => {
+      const ctx = createCommandContext(command);
+      try {
+        await runTool(ctx, tool, opts, command.args);
+      } finally {
+        await ctx.close();
+      }
+    });
+  }
+  for (const [group, cmd] of groups) {
+    const n = counts.get(group) ?? 0;
+    cmd.description(`${n} ${group} ${n === 1 ? "tool" : "tools"}`);
+  }
+}
+
+// src/commands/login.ts
+import open2 from "open";
+async function readTokenFromStdin(stdin = process.stdin) {
+  if (stdin.isTTY) {
+    throw usageError("--with-token reads the token from stdin", "Pipe it in: `tabbio login --with-token < token.txt`.");
+  }
+  const chunks = [];
+  for await (const chunk of stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+  const token = Buffer.concat(chunks).toString("utf8").trim();
+  if (!token) throw usageError("No token on stdin");
+  return token;
+}
+function persistProfileUrls(profile, sources) {
+  if (sources.apiUrl !== "flag" && sources.appUrl !== "flag") return;
+  updateConfig((config) => {
+    const current = config.profiles[profile.name] ?? {};
+    config.profiles[profile.name] = {
+      ...current,
+      ...sources.apiUrl === "flag" ? { apiUrl: profile.apiUrl } : {},
+      ...sources.appUrl === "flag" ? { appUrl: profile.appUrl } : {}
+    };
+  });
+}
+async function revokePrevious(profile, refreshToken, keep) {
+  if (!refreshToken || refreshToken === keep) return;
+  await revokeSession(new ApiClient(profile, null, { persist: false }), refreshToken).catch(
+    (error) => debug(`previous session not revoked: ${error.message}`)
+  );
+}
+async function loginWithToken(ctx, rawToken) {
+  const token = rawToken.trim();
+  if (!token.startsWith("tabbio_mcp_")) {
+    warn("This is not a tabbio_mcp_ token; treating it as an OAuth access token.");
+  }
+  const probe = { profile: ctx.profile.name, mcpToken: token };
+  const session = await McpSession.connect(ctx.profile, probe);
+  let toolCount = 0;
+  try {
+    toolCount = (await session.listTools({ refresh: true })).length;
+  } finally {
+    await session.close();
+  }
+  const previous = loadStoredCredentials(ctx.profile.name);
+  saveCredentials(probe);
+  persistProfileUrls(ctx.profile, ctx.sources);
+  await revokePrevious(ctx.profile, previous?.refreshToken);
+  if (ctx.globals.json) {
+    printJson({
+      profile: ctx.profile.name,
+      method: "token",
+      user: null,
+      mcp: { kind: "personal-token", token: fingerprint(token) },
+      tools: toolCount
+    });
+    return;
+  }
+  writeOut(successLine(`Token accepted \xB7 ${toolCount} tools available \xB7 profile ${ctx.profile.name}`));
+  writeOut(theme.dim("  MCP-only mode: `tabbio chat` and approving actions need `tabbio login` (browser or --email)."));
+}
+async function obtainSession(ctx, method, opts) {
+  const api = new ApiClient(ctx.profile, null, { persist: false });
+  if (method === "email") {
+    const email = opts.email?.trim() || await promptLine("Email: ");
+    info(`Sending a sign-in code to ${email}\u2026`);
+    return loginWithEmailOtp(api, {
+      email,
+      promptCode: (attempt) => promptSecret(attempt === 1 ? "Enter the 6-digit code: " : "Try the code again: "),
+      onInvalidCode: (left) => warn(`That code did not match. ${left} attempt${left === 1 ? "" : "s"} left.`)
+    });
+  }
+  const agentMode = Boolean(opts.nonInteractive);
+  if (!agentMode) info(`Connecting this computer (${deviceLabel()}) to Tabbio\u2026`);
+  const controller = new AbortController();
+  const onSigint = () => controller.abort();
+  process.once("SIGINT", onSigint);
+  try {
+    return await loginWithBrowser(api, {
+      device: deviceLabel(),
+      signal: controller.signal,
+      openUrl: async (url) => {
+        if (agentMode) return false;
+        try {
+          await open2(url);
+          return true;
+        } catch {
+          return false;
+        }
+      },
+      onWaiting: (url, opened, details) => {
+        if (agentMode) {
+          printJson({ url, state: details.state, expiresAt: details.expiresAt });
+          return;
+        }
+        info(opened ? theme.dim("If your browser did not open, visit:") : "Open this URL to continue:");
+        info(`  ${theme.accent(url)}`);
+        info(theme.dim("Waiting for you to approve in the browser\u2026 (Ctrl-C to cancel)"));
+      }
+    });
+  } finally {
+    process.off("SIGINT", onSigint);
+  }
+}
+async function runLogin(opts, cmd) {
+  const ctx = createCommandContext(cmd);
+  if (opts.nonInteractive) ctx.globals.json = true;
+  const method = chooseLoginMethod({
+    browser: opts.browser,
+    email: opts.email,
+    token: opts.token,
+    withToken: opts.withToken,
+    nonInteractive: opts.nonInteractive,
+    isTTY: Boolean(process.stdin.isTTY && process.stderr.isTTY),
+    hasDisplay: hasDisplay()
+  });
+  if (method === "token") {
+    return loginWithToken(ctx, opts.withToken ? await readTokenFromStdin() : opts.token ?? "");
+  }
+  const previous = loadStoredCredentials(ctx.profile.name);
+  const payload = await obtainSession(ctx, method, opts);
+  const creds = credentialsFromLogin(ctx.profile, payload);
+  saveCredentials(creds);
+  clearCatalogCache(ctx.profile);
+  persistProfileUrls(ctx.profile, ctx.sources);
+  await revokePrevious(ctx.profile, previous?.refreshToken, payload.refreshToken);
+  if (ctx.globals.json) {
+    printJson({
+      profile: ctx.profile.name,
+      method,
+      apiUrl: ctx.profile.apiUrl,
+      user: creds.user ?? null,
+      mcp: { kind: "app-session" }
+    });
+    return;
+  }
+  const who = creds.user?.name ? `${creds.user.name} <${creds.user.email}>` : creds.user?.email ?? "your account";
+  writeOut(successLine(`Signed in as ${theme.bold(who)} \xB7 profile ${ctx.profile.name}`));
+  if (process.env.TABBIO_TOKEN) {
+    warn("TABBIO_TOKEN is set, so tool commands keep using that personal token.");
+  }
+  writeOut(theme.dim("  Next: tabbio status \xB7 tabbio tools \xB7 tabbio chat"));
+}
+function registerLoginCommand(program) {
+  program.command("login").description("Sign in (browser by default; --email for SSH/headless; --token for MCP-only)").option("--browser", "Approve this computer in your browser").option("--email <address>", "Sign in with a one-time code sent to this email").option("--token <token>", "Use a personal MCP token (tabbio_mcp_\u2026); tool commands only").option("--with-token", "Read a personal MCP token from stdin (CI)").option(
+    "--non-interactive",
+    'For agents: print {"url","state","expiresAt"} as JSON, wait for the browser approval, never prompt'
+  ).addHelpText(
+    "after",
+    "\nThe browser flow opens <app-url>/cli/connect and receives the session on 127.0.0.1.\nEnvironment: TABBIO_TOKEN / TABBIO_ACCESS_TOKEN override stored credentials (never saved)."
+  ).action(async (opts, cmd) => runLogin(opts, cmd));
+}
+
+// src/commands/logout.ts
+async function logoutOne(name, apiUrl, appUrl) {
+  const profile = resolveProfile({ profile: name, apiUrl, appUrl });
+  const creds = loadStoredCredentials(profile.name);
+  if (!creds) {
+    return { profile: profile.name, signedOut: false, revokedSession: false, warnings: [] };
+  }
+  const result = await logoutProfile(profile, creds);
+  return { profile: profile.name, signedOut: true, ...result };
+}
+function registerLogoutCommand(program) {
+  program.command("logout").description("Sign out: end the session on the server and delete local credentials").option("--all", "Sign out of every profile").action(async (opts, cmd) => {
+    const ctx = createCommandContext(cmd);
+    const names = opts.all ? listCredentialProfiles() : [ctx.profile.name];
+    const results = [];
+    for (const name of names) {
+      results.push(
+        await logoutOne(name, opts.all ? void 0 : ctx.globals.apiUrl, opts.all ? void 0 : ctx.globals.appUrl)
+      );
+    }
+    const envNote = process.env.TABBIO_TOKEN || process.env.TABBIO_ACCESS_TOKEN ? "TABBIO_TOKEN / TABBIO_ACCESS_TOKEN is still set in your environment." : void 0;
+    if (ctx.globals.json) {
+      printJson({ results, ...envNote ? { note: envNote } : {} });
+      return;
+    }
+    if (results.length === 0 || results.every((r) => !r.signedOut)) {
+      writeOut(theme.dim(opts.all ? "No stored sign-ins." : `Not signed in (profile ${ctx.profile.name}).`));
+    }
+    for (const result of results.filter((r) => r.signedOut)) {
+      for (const warning of result.warnings) warn(warning);
+      writeOut(successLine(`Signed out of profile ${result.profile}`));
+    }
+    if (envNote) warn(envNote);
+  });
+}
+
+// src/commands/mcp-serve.ts
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+var BRIDGE_CALL_TIMEOUT_MS = 15 * 60 * 1e3;
+function bridgeErrorResult(error) {
+  const cliError = toCliError(error);
+  const text = [cliError.message, cliError.hint].filter(Boolean).join("\n");
+  return { isError: true, content: [{ type: "text", text: redactSecrets(text) }] };
+}
+function createBridgeServer(remote, opts = {}) {
+  const server = new Server(
+    { name: "tabbio", version: CLI_VERSION },
+    { capabilities: { tools: { listChanged: false } }, instructions: remote.instructions }
+  );
+  let refreshNext = Boolean(opts.refreshFirstList);
+  server.setRequestHandler(ListToolsRequestSchema, async () => {
+    const tools = await remote.listRawTools({ refresh: refreshNext });
+    refreshNext = false;
+    return { tools };
+  });
+  server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+    try {
+      return await remote.callRaw(request.params, { signal: extra.signal, timeoutMs: BRIDGE_CALL_TIMEOUT_MS });
+    } catch (error) {
+      return bridgeErrorResult(error);
+    }
+  });
+  return server;
+}
+async function serve(opts, cmd) {
+  const ctx = createCommandContext(cmd);
+  const remote = await ctx.mcp();
+  const server = createBridgeServer(remote, { refreshFirstList: opts.refresh });
+  const transport = new StdioServerTransport();
+  const closed = new Promise((resolve) => {
+    transport.onclose = () => resolve();
+    process.stdin.once("end", () => resolve());
+    process.stdin.once("close", () => resolve());
+  });
+  await server.connect(transport);
+  const via = mcpSummary(ctx.api.credentials ?? ctx.credentials);
+  info(theme.dim(`tabbio mcp serve: bridging stdio \u2192 ${ctx.profile.mcpUrl} (profile ${ctx.profile.name}, via ${via?.label ?? "unknown"})`));
+  await closed;
+  await server.close().catch(() => void 0);
+  await ctx.close();
+}
+function registerMcpCommands(program) {
+  const mcp = program.command("mcp").description("Use Tabbio from other MCP clients (Claude, Cursor, \u2026)");
+  mcp.command("serve").description("Run a stdio MCP server that forwards to Tabbio using this CLI's sign-in").option("--refresh", "Reload the tool list from the server instead of the 1h cache").addHelpText(
+    "after",
+    "\nExample:\n  $ claude mcp add tabbio -- tabbio mcp serve\n  $ claude mcp add tabbio -- tabbio --profile work mcp serve"
+  ).action(async (opts, cmd) => serve(opts, cmd));
+  mcp.command("url").description("Print the MCP endpoint URL and how to add it to a client").action((_opts, cmd) => {
+    const ctx = createCommandContext(cmd);
+    const url = ctx.profile.mcpUrl;
+    const commands = {
+      http: `claude mcp add --transport http tabbio ${url}`,
+      stdio: `claude mcp add tabbio -- tabbio${ctx.profile.name === "default" ? "" : ` --profile ${ctx.profile.name}`} mcp serve`
+    };
+    if (ctx.globals.json) {
+      printJson({ url, profile: ctx.profile.name, commands });
+      return;
+    }
+    writeOut(url);
+    if (!ctx.globals.quiet) {
+      writeOut(theme.dim(`  Remote (the client signs in with OAuth):  ${commands.http}`));
+      writeOut(theme.dim(`  Local stdio bridge (uses this CLI):       ${commands.stdio}`));
+    }
+  });
+}
+
+// src/commands/tools.ts
+function toListEntry(tool) {
+  return {
+    id: tool.id,
+    name: tool.mcpName,
+    title: tool.title,
+    description: tool.description,
+    readOnly: tool.readOnly,
+    kind: tool.kind,
+    group: tool.group,
+    action: tool.action,
+    command: invocation(tool)
+  };
+}
+function matchScore(tool, query) {
+  const tokens = query.toLowerCase().split(/\s+/).filter(Boolean);
+  if (tokens.length === 0) return 1;
+  const id = `${tool.id} ${tool.mcpName} ${tool.commandPath.join(" ")}`.toLowerCase();
+  const title = tool.title.toLowerCase();
+  const description = tool.description.toLowerCase();
+  let score = 0;
+  for (const token of tokens) {
+    if (id.includes(token)) score += 3;
+    else if (title.includes(token)) score += 2;
+    else if (description.includes(token)) score += 1;
+    else return 0;
+  }
+  return score;
+}
+function filterTools(tools, filter = {}) {
+  if (filter.reads && filter.writes) throw usageError("Use either --reads or --writes, not both");
+  const group = filter.group?.trim().toLowerCase();
+  const scored = tools.filter((t) => !t.hidden).filter((t) => !group || t.group === group || t.group.startsWith(group)).filter((t) => filter.reads ? t.readOnly : filter.writes ? !t.readOnly : true).map((tool) => ({ tool, score: filter.query ? matchScore(tool, filter.query) : 1 })).filter((entry) => entry.score > 0);
+  if (filter.query) scored.sort((a, b) => b.score - a.score);
+  return scored.map((entry) => entry.tool);
+}
+var WRITES_LABEL = " \xB7 writes";
+function readWrite(tool) {
+  return tool.readOnly ? theme.muted(theme.symbols.dot) : theme.warn(theme.symbols.dot);
+}
+function formatToolList(tools, width = process.stdout.columns ?? 100) {
+  if (tools.length === 0) return [theme.dim("No tools match.")];
+  const idWidth = Math.min(36, Math.max(...tools.map((t) => displayWidth(t.id))));
+  const lines = [];
+  const groups = [...groupCatalog(tools)].sort(([a], [b]) => a.localeCompare(b));
+  for (const [group, list3] of groups) {
+    lines.push(`${theme.bold(group)} ${theme.dim(`(${list3.length})`)}`);
+    for (const tool of list3) {
+      const id = truncate(tool.id, idWidth);
+      const room = Math.max(10, width - idWidth - 6 - (tool.readOnly ? 0 : WRITES_LABEL.length));
+      const writes = tool.readOnly ? "" : theme.dim(WRITES_LABEL);
+      lines.push(`  ${readWrite(tool)} ${id}${" ".repeat(idWidth - displayWidth(id))}  ${truncate(tool.title, room)}${writes}`);
+    }
+  }
+  lines.push(
+    theme.dim(
+      `${tools.length} tools \xB7 ${theme.symbols.dot} read \xB7 ${theme.symbols.dot} writes (may need approval) \xB7 tabbio tools describe <id>`
+    )
+  );
+  return lines;
+}
+function toolsToTsv(tools) {
+  return tools.map((t) => [t.id, invocationPath(t).join(" "), t.readOnly ? "read" : "write", t.title].join("	")).join("\n");
+}
+function noToolsMessage(filter) {
+  const scope = [
+    filter.group ? `in group "${filter.group}"` : null,
+    filter.reads ? "(read-only)" : filter.writes ? "(writes)" : null
+  ].filter(Boolean);
+  if (!filter.query && scope.length === 0) return "No tools are available to this account";
+  return ["No tools match", filter.query ? `"${filter.query}"` : "these filters", ...scope].join(" ");
+}
+async function listTools(ctx, filter) {
+  const mode2 = resolveOutputMode({ json: ctx.globals.json });
+  const session = await ctx.mcp();
+  const all = await session.listTools({ refresh: filter.refresh });
+  const hooks = getInteractiveHooks();
+  if (hooks && mode2 === "table" && canUseInteractiveUi(ctx)) {
+    await hooks.browseTools(ctx, filterTools(all, { reads: filter.reads, writes: filter.writes }), {
+      query: filter.query,
+      group: filter.group
+    });
+    return;
+  }
+  const tools = filterTools(all, filter);
+  if (mode2 === "json") writeJson(tools.map(toListEntry));
+  else if (tools.length === 0) printEmptyNotice(mode2, noToolsMessage(filter), { quiet: ctx.globals.quiet });
+  else if (mode2 === "tsv") process.stdout.write(`${toolsToTsv(tools)}
+`);
+  else for (const line of formatToolList(tools)) process.stdout.write(`${line}
+`);
+}
+function describeTool(tool) {
+  return {
+    ...toListEntry(tool),
+    inputSchema: tool.inputSchema,
+    flags: describeSchema(tool.inputSchema),
+    example: exampleInvocation(tool, tool.inputSchema, invocationPath(tool)),
+    mayRequireApproval: !tool.readOnly,
+    autoFilled: autoFilledProperties(tool, tool.inputSchema)
+  };
+}
+function formatToolDescription(info2, width = process.stdout.columns ?? 100) {
+  const lines = [
+    theme.bold(info2.title),
+    theme.dim(`${info2.id} \xB7 MCP ${info2.name} \xB7 ${info2.kind} \xB7 ${info2.readOnly ? "read-only" : "writes"}`)
+  ];
+  if (info2.description) lines.push("", info2.description);
+  if (info2.mayRequireApproval) {
+    lines.push("", `${theme.warn(theme.symbols.warning)} May require approval before it runs (exit 6 until approved; --wait to wait).`);
+  }
+  lines.push("", theme.bold("Flags"));
+  if (info2.flags.length === 0) lines.push(theme.dim("  (none)"));
+  const flagWidth = Math.min(32, Math.max(0, ...info2.flags.map((f) => f.flag.length)));
+  const typeWidth = Math.min(24, Math.max(0, ...info2.flags.map((f) => f.type.length)));
+  for (const row2 of info2.flags) {
+    const auto = info2.autoFilled.includes(row2.property) ? "filled from your session" : null;
+    const notes = [row2.required && !auto ? "required" : null, auto, ...row2.notes].filter(Boolean).join("; ");
+    const text = [row2.description, notes ? `(${notes})` : ""].filter(Boolean).join(" ");
+    const room = Math.max(20, width - flagWidth - typeWidth - 6);
+    lines.push(`  ${row2.flag.padEnd(flagWidth)}  ${theme.dim(truncate(row2.type, typeWidth).padEnd(typeWidth))}  ${truncate(text, room)}`.trimEnd());
+  }
+  lines.push(
+    theme.dim("  Also: --input <json> | --input-file <path> | --fields a,b | --wait | --timeout 10m | -o json|table|plain"),
+    "",
+    theme.bold("Example"),
+    `  $ ${info2.example}`
+  );
+  return lines;
+}
+async function describe(ctx, ref) {
+  const session = await ctx.mcp();
+  const tool = await resolveCatalogTool(session, ref);
+  const info2 = describeTool(tool);
+  if (resolveOutputMode({ json: ctx.globals.json }) === "json") writeJson(info2);
+  else for (const line of formatToolDescription(info2)) process.stdout.write(`${line}
+`);
+}
+function registerToolsCommand(program) {
+  const tools = program.command("tools").description("Browse and search every Tabbio tool (TTY: interactive browser)").argument("[query]", "Filter by id, title or description").option("--group <group>", "Only this group (e.g. cv, job)").option("--reads", "Only read-only tools").option("--writes", "Only tools that change data").option("--refresh", "Reload the catalog from Tabbio (ignores the 1h cache)").addHelpText("after", "\nExamples:\n  $ tabbio tools cv\n  $ tabbio tools --group job --reads\n  $ tabbio tools describe cv.list").action(async (query, opts, cmd) => {
+    const ctx = createCommandContext(cmd);
+    try {
+      await listTools(ctx, { ...opts, query });
+    } finally {
+      await ctx.close();
+    }
+  });
+  tools.command("describe").description("Show a tool: flags, types, approval note and an example").argument("<tool>", "Tool id (cv.list), MCP name (cvList) or command (cv list)").action(async (ref, _opts, cmd) => {
+    const ctx = createCommandContext(cmd);
+    try {
+      await describe(ctx, ref);
+    } finally {
+      await ctx.close();
+    }
+  });
+}
+
+// src/commands/run.ts
+function runLevel(opts) {
+  const { input, inputFile, fields, wait: wait2, timeout, output } = opts;
+  return { input, inputFile, fields, wait: wait2, timeout, output };
+}
+async function runDynamic(cmd, ref, rest, opts, filter) {
+  if (!ref) {
+    if (opts.help) {
+      cmd.outputHelp();
+      return;
+    }
+    throw usageError(`Missing the ${filter ? "workflow" : "tool"} to run`, `Usage: tabbio ${cmd.parent?.name() === "workflows" ? "workflows run <key>" : "run <tool>"} [flags]. List them with \`tabbio ${filter ? "workflows list" : "tools"}\`.`);
+  }
+  if (ref.startsWith("-")) throw usageError(`Put the ${filter ? "workflow key" : "tool"} first, then its flags`, `e.g. tabbio run cv.list --limit 5`);
+  const ctx = createCommandContext(cmd);
+  try {
+    const session = await ctx.mcp();
+    const tool = await resolveCatalogTool(session, ref, filter);
+    if (opts.help || wantsHelp(rest)) {
+      const info2 = describeTool(tool);
+      if (resolveOutputMode({ json: ctx.globals.json }) === "json") writeJson(info2);
+      else for (const line of formatToolDescription(info2)) process.stdout.write(`${line}
+`);
+      return;
+    }
+    const parsed = parseDynamicFlags(tool, rest);
+    await runTool(ctx, tool, { ...parsed.opts, ...runLevel(opts) }, parsed.rest);
+  } finally {
+    await ctx.close();
+  }
+}
+function configureDynamicRunCommand(cmd, refName, refHelp) {
+  cmd.argument(`[${refName}]`, refHelp).argument("[flags...]", "The tool's own flags, e.g. --limit 5 (see --help after the tool)").helpOption(false).option("-h, --help", "Show help; after a tool, show that tool's flags").allowUnknownOption().allowExcessArguments();
+  return addRunLevelOptions(cmd);
+}
+function registerRunCommand(program) {
+  const run = program.command("run").description("Run any Tabbio tool by id, MCP name or command path");
+  configureDynamicRunCommand(run, "tool", 'Tool id (cv.list), MCP name (cvList) or command ("cv list")').addHelpText(
+    "after",
+    [
+      "",
+      "Examples:",
+      "  $ tabbio run cv.list",
+      '  $ tabbio run job.search --query "product designer" --fields id,title,company',
+      "  $ tabbio run cv.delete --cv-id cv_123 --wait",
+      `  $ echo '{"limit":5}' | tabbio run cv.list --input - --json`,
+      "  $ tabbio run cv.get --help          # that tool's flags"
+    ].join("\n")
+  ).action(async (ref, rest, opts, cmd) => {
+    await runDynamic(cmd, ref, rest, opts);
+  });
+}
+
+// src/commands/workflows.ts
+var isWorkflow = (tool) => tool.kind === "workflow";
+function workflowSummary(tool) {
+  return shortDescription(tool.description.replace(/^Run workflow '[^']*'\.\s*(Workflow description:\s*)?/i, ""), 120);
+}
+function toWorkflowEntry(tool) {
+  const auto = new Set(autoFilledProperties(tool, tool.inputSchema));
+  const required = (tool.inputSchema.required ?? []).filter((key) => !auto.has(key));
+  return {
+    key: tool.action,
+    id: tool.id,
+    name: tool.mcpName,
+    command: invocation(tool),
+    description: workflowSummary(tool),
+    requiredFlags: flagsForProperties(tool.inputSchema, required)
+  };
+}
+function formatWorkflowList(entries, width = process.stdout.columns ?? 100) {
+  if (entries.length === 0) return [theme.dim("No workflows are exposed over MCP; multi-step flows run through `tabbio chat`.")];
+  const keyWidth = Math.max(...entries.map((e) => e.key.length));
+  const lines = [`${theme.bold("Workflows")} ${theme.dim(`(${entries.length})`)}`];
+  for (const entry of entries) {
+    const needs = entry.requiredFlags.length ? theme.dim(`  needs ${entry.requiredFlags.join(" ")}`) : "";
+    const room = Math.max(20, width - keyWidth - 4 - (entry.requiredFlags.join(" ").length + 8));
+    lines.push(`  ${entry.key.padEnd(keyWidth)}  ${truncate(entry.description, room)}${needs}`);
+  }
+  lines.push(theme.dim("Run one: tabbio workflows run <key> [flags] \xB7 its flags: tabbio workflows run <key> --help"));
+  return lines;
+}
+function registerWorkflowsCommand(program) {
+  const workflows = program.command("workflows").description("List and run multi-step Tabbio workflows");
+  workflows.command("list", { isDefault: true }).description("List the workflows available to you").action(async (_opts, cmd) => {
+    const ctx = createCommandContext(cmd);
+    try {
+      const session = await ctx.mcp();
+      const entries = (await session.listTools()).filter(isWorkflow).map(toWorkflowEntry);
+      const mode2 = resolveOutputMode({ json: ctx.globals.json });
+      if (mode2 === "json") writeJson(entries);
+      else if (entries.length === 0) {
+        printEmptyNotice(mode2, "No workflows are exposed over MCP; multi-step flows run through tabbio chat", { quiet: ctx.globals.quiet });
+      } else if (mode2 === "tsv") {
+        for (const e of entries) process.stdout.write(`${[e.key, e.command, e.description].join("	")}
+`);
+      } else for (const line of formatWorkflowList(entries)) process.stdout.write(`${line}
+`);
+    } finally {
+      await ctx.close();
+    }
+  });
+  const run = workflows.command("run").description("Run a workflow (same flags and output options as `tabbio run`)");
+  configureDynamicRunCommand(run, "key", "Workflow key (tailored-cv-flow) or MCP name (run_tailoredCvFlow)").addHelpText(
+    "after",
+    "\nExamples:\n  $ tabbio workflows run tailored-cv-flow --cv-id cv_1 --job-id job_9\n  $ tabbio workflows run tailored-cv-flow --help"
+  ).action(async (ref, rest, opts, cmd) => {
+    await runDynamic(cmd, ref, rest, opts, isWorkflow);
+  });
+}
+
+// src/ui/index.ts
+function installInteractiveUi() {
+  const hooks = {
+    async browseTools(ctx, tools, options) {
+      const { runBrowseTools } = await import("./entry-WENOOT6W.js");
+      return runBrowseTools(ctx, tools, options);
+    },
+    async runToolForm(ctx, tool, initial, options) {
+      const { runToolForm } = await import("./entry-WENOOT6W.js");
+      return runToolForm(ctx, tool, initial, options);
+    },
+    async approvalPrompt(ctx, approval) {
+      const { runApprovalPrompt } = await import("./entry-WENOOT6W.js");
+      return runApprovalPrompt(ctx, approval);
+    },
+    async showResult(ctx, tool, result, meta) {
+      const { runShowResult } = await import("./entry-WENOOT6W.js");
+      return runShowResult(ctx, tool, result, meta);
+    }
+  };
+  setInteractiveHooks(hooks);
+}
+
+// src/program.ts
+var PROGRAM_NAME = "tabbio";
+var VALUE_FLAGS = /* @__PURE__ */ new Set(["--profile", "--api-url", "--app-url"]);
+var CACHED_CATALOG_COMMANDS = /* @__PURE__ */ new Set(["completion", "help"]);
+var NO_UPDATE_NOTICE = /* @__PURE__ */ new Set(["mcp", "completion"]);
+var homeHandler = null;
+function setHomeHandler(handler) {
+  homeHandler = handler;
+}
+function createProgram() {
+  const program = new Command2(PROGRAM_NAME).description("Tabbio in your terminal: every Tabbio tool, chat, approvals and an MCP bridge.").version(CLI_VERSION, "-v, --version", "Print the CLI version").option("--profile <name>", "Use a named profile (env TABBIO_PROFILE)").option("--api-url <url>", "Override the API URL (env TABBIO_API_URL)").option("--app-url <url>", "Override the web app URL used for browser sign-in (env TABBIO_APP_URL)").option("--json", "Machine-readable JSON output").option("--color", "Force colors (also FORCE_COLOR / CLICOLOR_FORCE)").option("--no-color", "Disable colors (also NO_COLOR)").option("--debug", "Trace requests to stderr (secrets redacted)").option("-y, --yes", "Non-interactive: assume yes for confirmations").option("-q, --quiet", "Only print results").showHelpAfterError("(add --help for usage)").addHelpText(
+    "after",
+    "\nGet started:\n  $ tabbio login\n  $ tabbio status\n  $ tabbio tools\n\nExit codes: tabbio help exit-codes\nDocs: https://tabbio.com/developers"
+  );
+  program.hook("preAction", (_root, actionCommand) => {
+    const globals = readGlobalOptions(actionCommand);
+    configureTheme({ noColor: !globals.color });
+  });
+  return program;
+}
+function registerStaticCommands(program) {
+  registerLoginCommand(program);
+  registerLogoutCommand(program);
+  registerStatusCommand(program);
+  registerWhoamiCommand(program);
+  registerDoctorCommand(program);
+  registerConfigCommands(program);
+  registerMcpCommands(program);
+  registerCompletionCommand(program);
+  registerToolsCommand(program);
+  registerRunCommand(program);
+  registerWorkflowsCommand(program);
+  registerApprovalsCommand(program);
+  registerArtifactsCommand(program);
+  registerAskCommand(program);
+  registerChatCommand(program);
+  registerHome();
+}
+function applySettings(command) {
+  command.exitOverride();
+  command.configureOutput({
+    writeOut: (str) => process.stdout.write(str),
+    writeErr: (str) => process.stderr.write(str),
+    outputError: (str, write3) => write3(theme.error(redactSecrets(str)))
+  });
+  for (const sub of command.commands) applySettings(sub);
+}
+function scanArgv(args) {
+  const scan = { help: false };
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--") break;
+    if (arg === "--help" || arg === "-h") {
+      scan.help = true;
+      continue;
+    }
+    const [flag, inline] = arg.startsWith("--") ? arg.split("=", 2) : [arg];
+    if (VALUE_FLAGS.has(flag)) {
+      const value = inline ?? args[i + 1];
+      if (inline === void 0) i += 1;
+      if (flag === "--profile") scan.profile = value;
+      if (flag === "--api-url") scan.apiUrl = value;
+      if (flag === "--app-url") scan.appUrl = value;
+      continue;
+    }
+    if (arg.startsWith("-")) continue;
+    if (scan.firstCommand === void 0) scan.firstCommand = arg;
+  }
+  return scan;
+}
+async function attachCatalog(program, scan) {
+  const staticNames = new Set(program.commands.flatMap((c) => [c.name(), ...c.aliases()]));
+  const first = scan.firstCommand;
+  if (first && staticNames.has(first) && !CACHED_CATALOG_COMMANDS.has(first)) return;
+  let profile;
+  try {
+    profile = resolveProfile({ profile: scan.profile, apiUrl: scan.apiUrl, appUrl: scan.appUrl });
+  } catch {
+    return;
+  }
+  const creds = loadCredentials(profile.name);
+  if (!selectMcpBearer(creds)) return;
+  const cached = readCachedCatalog(profile, creds);
+  const cacheOnly = !first || CACHED_CATALOG_COMMANDS.has(first);
+  if (cacheOnly || cached?.fresh) {
+    if (cached) registerGeneratedCommands(program, cached.tools);
+    return;
+  }
+  let session = null;
+  try {
+    session = await McpSession.connect(profile, creds);
+    registerGeneratedCommands(program, await session.listTools());
+  } catch (error) {
+    if (!cached) throw error;
+    debug(`catalog refresh failed, using stale cache: ${error.message}`);
+    registerGeneratedCommands(program, cached.tools);
+  } finally {
+    await session?.close();
+  }
+}
+function formatErrorLines(error, opts = {}) {
+  const lines = [`${theme.error(`${theme.symbols.error} ${redactSecrets(error.message)}`)}`];
+  if (error.hint) lines.push(`  ${theme.dim(redactSecrets(error.hint))}`);
+  if (error.requestId) lines.push(`  ${theme.dim(`request id: ${error.requestId}`)}`);
+  if (opts.debug) {
+    const cause = error.cause instanceof Error ? error.cause : error;
+    if (cause.stack) lines.push(theme.dim(redactSecrets(cause.stack)));
+  }
+  return lines;
+}
+function handleCliError(error) {
+  if (error instanceof CommanderError2) {
+    if (error.exitCode === 0) return ExitCode.Ok;
+    if (error.code === "commander.unknownCommand" && !getGlobalOptions().json) {
+      process.stderr.write(
+        `${theme.dim("  Tool commands (e.g. `tabbio cv list`) load from your account: run `tabbio login`, then `tabbio tools`.")}
+`
+      );
+    }
+    return ExitCode.Usage;
+  }
+  const globals = getGlobalOptions();
+  const cliError = toCliError(error);
+  if (globals.json) {
+    process.stderr.write(`${JSON.stringify({ error: cliError.toJSON() })}
+`);
+  } else if (isCliError(error)) {
+    for (const line of formatErrorLines(cliError, { debug: globals.debug })) process.stderr.write(`${line}
+`);
+  } else {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`${theme.error(`${theme.symbols.error} Unexpected error: ${redactSecrets(message)}`)}
+`);
+    if (globals.debug && error instanceof Error && error.stack) {
+      process.stderr.write(`${theme.dim(redactSecrets(error.stack))}
+`);
+    } else {
+      process.stderr.write(`  ${theme.dim("Re-run with --debug for details.")}
+`);
+    }
+  }
+  return cliError.exitCode;
+}
+function printExitCodes(json) {
+  if (json) {
+    printJson(EXIT_CODE_DOCS);
+    return;
+  }
+  writeOut(theme.bold("Exit codes"));
+  for (const doc of EXIT_CODE_DOCS) {
+    writeOut(`  ${String(doc.code).padStart(3)}  ${doc.name.padEnd(16)}${theme.dim(doc.meaning)}`);
+  }
+}
+async function maybeNotifyUpdate(scan) {
+  const globals = getGlobalOptions();
+  if (globals.json || globals.quiet || NO_UPDATE_NOTICE.has(scan.firstCommand ?? "")) return;
+  const latest = await checkForUpdate().catch(() => null);
+  if (latest) {
+    process.stderr.write(
+      `
+${theme.accent(`Update available ${CLI_VERSION} \u2192 ${latest}`)}  ${theme.dim(`npm i -g ${CLI_PACKAGE_NAME}`)}
+`
+    );
+  }
+}
+async function runCli(argv = process.argv) {
+  const args = argv.slice(2);
+  const scan = scanArgv(args);
+  setGlobalOptions({
+    json: args.includes("--json"),
+    debug: args.includes("--debug") || getGlobalOptions().debug,
+    color: !args.includes("--no-color"),
+    quiet: args.includes("--quiet") || args.includes("-q")
+  });
+  configureTheme({ noColor: args.includes("--no-color") });
+  const positionals = args.filter((a) => !a.startsWith("-"));
+  if (positionals[0] === "help" && positionals[1] === "exit-codes") {
+    printExitCodes(args.includes("--json"));
+    return ExitCode.Ok;
+  }
+  const program = createProgram();
+  try {
+    installInteractiveUi();
+    registerStaticCommands(program);
+    await attachCatalog(program, scan);
+    applySettings(program);
+    const bare = scan.firstCommand === void 0 && !scan.help && !args.some((a) => a === "-v" || a === "--version");
+    const unknownFlags = bare ? program.parseOptions(args).unknown : [];
+    if (bare && unknownFlags.length === 0) {
+      const ctx = createCommandContext(program);
+      if (homeHandler && isInteractive() && !ctx.globals.json) {
+        try {
+          await homeHandler(ctx);
+        } finally {
+          await ctx.close();
+        }
+      } else {
+        program.outputHelp();
+      }
+      return ExitCode.Ok;
+    }
+    await program.parseAsync(argv);
+    if (activeCommandSignal.aborted) return ExitCode.Interrupted;
+    const code = typeof process.exitCode === "number" ? process.exitCode : ExitCode.Ok;
+    if (code === ExitCode.Ok) await maybeNotifyUpdate(scan);
+    return code;
+  } catch (error) {
+    if (activeCommandSignal.aborted) return ExitCode.Interrupted;
+    return handleCliError(error);
+  }
+}
+export {
+  PROGRAM_NAME,
+  createProgram,
+  formatErrorLines,
+  handleCliError,
+  registerGeneratedCommands,
+  registerStaticCommands,
+  runCli,
+  scanArgv,
+  setHomeHandler
+};
+//# sourceMappingURL=program-O2BA5L6Z.js.map