@tangle-network/sandbox-cli 0.12.2-develop.20260726033513.aa4b682 → 0.12.6

package/dist/index.mjs

@@ -1,7 +1,7 @@
-import{createRequire as e}from"node:module";import"dotenv/config";import{Command as t}from"commander";import{createHash as n,randomBytes as r,randomUUID as i}from"node:crypto";import a from"chalk";import*as o from"node:fs";import{chmodSync as s,existsSync as c,mkdirSync as l,readFileSync as u,renameSync as d,writeFileSync as f}from"node:fs";import*as p from"node:path";import{basename as ee,dirname as te,extname as ne,join as m,resolve as re}from"node:path";import{AuthError as ie,NetworkError as h,NotFoundError as ae,QuotaError as oe,Sandbox as g,ServerError as _,StateError as v,TimeoutError as se,ValidationError as ce,createConfidentialSandbox as le,generateAttestationNonce as ue,parseSSEStream as de}from"@tangle-network/sandbox";import*as fe from"node:os";import{homedir as pe,tmpdir as me}from"node:os";import{execFileSync as he,spawn as ge}from"node:child_process";import{HubClient as _e,HubSdkError as ve}from"@tangle-network/hub-sdk";import ye from"ora";import{CONTENT_COMPLETION_KEY as be,CONTENT_PROMPT_KEY as xe,CONTENT_TOOL_ARGS_KEY as Se,CONTENT_TOOL_NAME_KEY as Ce,CONTENT_TOOL_RESULT_KEY as we,TANGLE_SUBJECT_KEY as Te,asContentField as y,asContentString as Ee}from"@tangle-network/agent-core/telemetry";import{createMcpServer as De}from"@tangle-network/sandbox/agent";import{readFile as Oe}from"node:fs/promises";import{fileURLToPath as ke}from"node:url";import Ae from"ws";import{supervise as je,workerFromBackend as Me}from"@tangle-network/agent-runtime/loops";import{createIntelligenceClient as Ne}from"@tangle-network/sandbox/intelligence";function Pe(e){if(e.startsWith(`github:`)){let[t,n]=e.slice(7).split(`@`,2),r=t.split(`/`).filter(Boolean);if(r.length<3)throw Error(`invalid github ref "${e}": expected github:<owner>/<repo>/<path>[@<ref>]`);let i=`${r[0]}/${r[1]}`,a=r.slice(2).join(`/`);return{kind:`github`,repository:i,path:a,...n?{ref:n}:{},name:ee(a)}}let t;try{t=u(e,`utf8`)}catch{throw Error(`cannot read skill/tool "${e}": not a readable file and not a github: ref`)}return{kind:`inline`,name:ee(e),content:t}}function Fe(e){let t=(e.skills??[]).map(Pe),n=(e.tools??[]).map(Pe),r=t.length>0||n.length>0;if(!(!e.model&&!e.systemPrompt&&!r))return{...e.model?{model:{default:e.model}}:{},...e.systemPrompt?{prompt:{systemPrompt:e.systemPrompt}}:{},...r?{resources:{...t.length>0?{skills:t}:{},...n.length>0?{tools:n}:{}}}:{}}}async function Ie(e){let t;if(e.startsWith(`github:`)){let[n,r]=e.slice(7).split(`@`,2),i=n.split(`/`).filter(Boolean);if(i.length<3)throw Error(`invalid --profile github ref "${e}": expected github:<owner>/<repo>/<path>[@<ref>]`);let a=r??`main`;t=await We(`https://raw.githubusercontent.com/${i[0]}/${i[1]}/${a}/${i.slice(2).join(`/`)}`)}else t=/^https?:\/\//.test(e)?await We(e):u(e,`utf8`);let n;try{n=JSON.parse(t)}catch{throw Error(`profile at "${e}" is not valid JSON`)}return Be(n,e),n}const Le=[`prompt`,`model`,`permissions`,`tools`,`mcp`,`connections`,`subagents`,`resources`,`hooks`,`modes`,`confidential`,`extensions`],Re=new Set([...Le,`name`,`description`,`version`,`tags`,`metadata`]),ze=[`files`,`tools`,`skills`,`agents`,`commands`];function Be(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`profile at "${t}" is not an object`);let n=Object.keys(e),r=n.some(e=>Le.includes(e)),i=n.includes(`name`)&&n.every(e=>Re.has(e));if(!r&&!i)throw Error(`"${t}" does not look like an agent profile: no recognized profile keys (model, prompt, resources, tools, connections, …). Got: ${n.slice(0,6).join(`, `)||`(empty object)`}.`);Ve(e,t)}function Ve(e,t){let n=e.resources;if(!n||typeof n!=`object`)return;for(let e of ze){let r=n[e];if(r!==void 0){if(!Array.isArray(r))throw Error(`profile at "${t}" is malformed: resources.${e} must be an array`);for(let n of r)Ue(e===`files`?He(n):n,t)}}let r=n.instructions;r!==void 0&&typeof r!=`string`&&Ue(r,t)}function He(e){return e&&typeof e==`object`?e.resource:e}function Ue(e,t){let n=e&&typeof e==`object`?e.kind:void 0;if(n!==`inline`&&n!==`github`)throw Error(`profile at "${t}" has an invalid resource ref kind ${JSON.stringify(n)}: expected "inline" or "github"`)}async function We(e){let t=await fetch(e);if(!t.ok)throw Error(`failed to fetch ${e} (${t.status})`);return t.text()}async function Ge(e){let t=e.profileSource?await Ie(e.profileSource):void 0,n=Fe(e);return t?n?{...t,...n,...n.resources?{resources:{...t.resources,...n.resources}}:{}}:t:n}const Ke=p.join(fe.homedir(),`.tangle`),qe=p.join(Ke,`credentials.json`),Je=`tangle-sandbox-cli`,Ye=`TANGLE_ALLOW_PLAINTEXT_CREDENTIALS`;var Xe=class extends Error{constructor(e,t){super(`Credentials file at ${e} is corrupted and cannot be parsed. Inspect or remove it manually before retrying — refusing to overwrite it automatically.`),this.filePath=e,this.name=`CredentialsFileCorruptedError`,t&&(this.cause=t)}},Ze=class extends Error{constructor(){super(`Could not store credential in the OS keychain, and the plaintext fallback is not enabled. Install a keychain provider (macOS Keychain or libsecret/secret-tool on Linux), or set ${Ye}=1 to opt into a plaintext credentials.json with mode 0600.`),this.name=`KeychainUnavailableError`}};function Qe(e){let t=nt(e);if(t)return{value:t,source:`keychain`};let n=at(e);return n?{value:n,source:`file`}:{source:`none`}}function $e(e,t){if(rt(e,t))return st(e),`keychain`;if(!tt())throw new Ze;return ot(e,t),`file`}function et(e){it(e),st(e)}function tt(){let e=process.env[Ye];if(!e)return!1;let t=e.trim().toLowerCase();return t===`1`||t===`true`||t===`yes`}function nt(e){if(process.platform===`darwin`)try{return he(`security`,[`find-generic-password`,`-s`,Je,`-a`,dt(e),`-w`],{encoding:`utf8`,stdio:[`ignore`,`pipe`,`ignore`]}).trim()}catch{return}if(process.platform===`linux`)try{return he(`secret-tool`,[`lookup`,`service`,Je,`account`,dt(e)],{encoding:`utf8`,stdio:[`ignore`,`pipe`,`ignore`]}).trim()}catch{return}}function rt(e,t){if(process.platform===`darwin`)try{return he(`security`,[`add-generic-password`,`-U`,`-s`,Je,`-a`,dt(e),`-w`,t],{stdio:[`ignore`,`ignore`,`ignore`]}),!0}catch{return!1}if(process.platform===`linux`)try{return he(`secret-tool`,[`store`,`--label=Tangle Sandbox CLI`,`service`,Je,`account`,dt(e)],{input:t,stdio:[`pipe`,`ignore`,`ignore`]}),!0}catch{return!1}return!1}function it(e){if(process.platform===`darwin`){try{he(`security`,[`delete-generic-password`,`-s`,Je,`-a`,dt(e)],{stdio:[`ignore`,`ignore`,`ignore`]})}catch{}return}if(process.platform===`linux`)try{he(`secret-tool`,[`clear`,`service`,Je,`account`,dt(e)],{stdio:[`ignore`,`ignore`,`ignore`]})}catch{}}function at(e){return ct()[e]}function ot(e,t){let n=ct();n[e]=t,lt(n)}function st(e){let t;try{t=ct()}catch(e){if(e instanceof Xe)return;throw e}e in t&&(delete t[e],lt(t))}function ct(){let e;try{e=o.readFileSync(qe,`utf8`)}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return{};throw e}try{let t=JSON.parse(e);if(typeof t!=`object`||!t||Array.isArray(t))throw new Xe(qe);let n={};for(let[e,r]of Object.entries(t))typeof r==`string`&&(n[e]=r);return n}catch(e){throw e instanceof Xe?e:new Xe(qe,e instanceof Error?e:void 0)}}function lt(e){if(ut(),Object.keys(e).length===0){o.existsSync(qe)&&o.unlinkSync(qe);return}let t=`${qe}.${process.pid}.tmp`;o.writeFileSync(t,`${JSON.stringify(e,null,2)}\n`,{mode:384}),o.renameSync(t,qe)}function ut(){if(!o.existsSync(Ke)){o.mkdirSync(Ke,{mode:448,recursive:!0});return}if(process.platform!==`win32`)try{(o.statSync(Ke).mode&511)!=448&&o.chmodSync(Ke,448)}catch{}}function dt(e){return`profile:${e}`}const ft=p.join(fe.homedir(),`.tangle`),pt=p.join(ft,`credentials`),mt=p.join(ft,`config.json`),b=`default`;function ht(){o.existsSync(ft)||o.mkdirSync(ft,{mode:448,recursive:!0})}function gt(e,t){ht();let n=`${e}.${process.pid}.tmp`;o.writeFileSync(n,t,{mode:384}),o.renameSync(n,e)}function _t(){try{if(o.existsSync(pt)){let e=o.readFileSync(pt,`utf-8`).trim();return vt(e)?e:e.match(/api_key\s*=\s*(\S+)/)?.[1]}}catch{}}function vt(e){return e.startsWith(`sk_`)||e.startsWith(`sk-tan-`)}function yt(){try{o.existsSync(pt)&&o.unlinkSync(pt)}catch{}}function x(){return zt(Rt())}function bt(e){let t=Bt(x(),e);gt(mt,`${JSON.stringify(t,null,2)}\n`)}function S(e){return Vt(e||process.env.TANGLE_PROFILE||process.env.SANDBOX_PROFILE||x().activeProfile||b)}function xt(e){bt({activeProfile:Vt(e)})}function St(){return process.env.TANGLE_SANDBOX||x().currentSandbox||void 0}function Ct(e){bt({currentSandbox:e})}function wt(){let e=x();delete e.currentSandbox,gt(mt,`${JSON.stringify(e,null,2)}\n`)}function Tt(){let e=x().deviceId;if(e&&/^[A-Za-z0-9_.-]{1,64}$/.test(e))return e;let t=fe.hostname().replace(/[^A-Za-z0-9_.-]/g,`-`).replace(/^-+|-+$/g,``).slice(0,32),n=r(4).toString(`hex`),i=`${t?`${t}-`:`device-`}${n}`;return bt({deviceId:i}),i}function Et(e){let t=e||St();if(!t)throw Error("No sandbox specified. Pass it positionally, set a default with `tangle use <id>`, pass `--box <id>`, or set TANGLE_SANDBOX.");return t}function Dt(){let e=x(),t=S(),n=new Set([b,...Object.keys(e.profiles??{})]);return e.activeProfile&&n.add(Vt(e.activeProfile)),[...n].map(e=>{let n=Qe(e),r=e===b?_t():void 0,i=n.source===`none`?r?`legacy-file`:`none`:n.source;return{name:e,active:e===t,hasApiKey:n.source!==`none`||!!r,baseUrl:Mt(void 0,e),apiKeySource:i}}).sort((e,t)=>e.name.localeCompare(t.name))}function Ot(e){let t=S(e);return{name:t,active:t===S(),apiKey:C(void 0,t),baseUrl:Mt(void 0,t),credentialSource:jt(void 0,t)}}function kt(e,t){let n=Vt(e),r=x(),i=Lt(n,r),a={},o=t.baseUrl??i.baseUrl;o&&(a.baseUrl=o);let s=t.activeTeamId??i.activeTeamId;s&&(a.activeTeamId=s);let c=t.activeTeamName??i.activeTeamName;c&&(a.activeTeamName=c);let l={...r.profiles??{}};a.baseUrl||a.activeTeamId||a.activeTeamName?l[n]=a:delete l[n];let u;return t.apiKey&&(u=$e(n,t.apiKey),n===b&&yt()),bt({profiles:Object.keys(l).length>0?l:{}}),u}function At(e){let t=S(e),n={...x().profiles??{}},r=n[t];if(r){let e={...r,apiKey:void 0};e.baseUrl||e.activeTeamId||e.activeTeamName?n[t]=e:delete n[t]}bt({profiles:n}),et(t),t===b&&yt()}function C(e,t){if(e)return e;let n=process.env.TANGLE_API_KEY||process.env.SANDBOX_API_KEY;if(n)return n;let r=S(t),i=Qe(r);if(i.value)return i.value;if(r===b)return _t()}function jt(e,t){if(e)return`flag`;if(process.env.TANGLE_API_KEY||process.env.SANDBOX_API_KEY)return`env`;let n=S(t),r=Qe(n);return r.source===`none`?n===b&&_t()?`legacy-file`:`none`:r.source}function Mt(e,t){if(e)return e;let n=process.env.TANGLE_BASE_URL||process.env.SANDBOX_BASE_URL;if(n)return n;let r=S(t),i=x(),a=Lt(r,i);return a.baseUrl?a.baseUrl:r===b&&i.baseUrl?i.baseUrl:`https://sandbox.tangle.tools`}function Nt(e){if(e)return e.replace(/\/v1\/hub\/?$/,``)}function w(e){let t=S(e.profile),n=C(e.apiKey,t);if(!n)throw Error(`No API key found for profile '${t}'. Set TANGLE_API_KEY or run: tangle auth login${t===b?``:` --profile ${t}`}`);return{apiKey:n,baseUrl:Mt(e.baseUrl,t),timeout:e.timeout??3e4,profile:t,...Pt(t)}}function Pt(e){let t=x(),n=Lt(S(e),t);return{activeTeamId:n.activeTeamId,activeTeamName:n.activeTeamName}}function Ft(e,t){kt(S(t),{activeTeamId:e.id,activeTeamName:e.name})}function It(e){let t=S(e),n=x(),r={...n.profiles??{}},i={baseUrl:Lt(t,n).baseUrl};i.baseUrl?r[t]=i:delete r[t],bt({profiles:r})}function Lt(e,t=x()){let n=Vt(e);return{...n===b?{baseUrl:t.baseUrl,activeTeamId:t.profiles?.[b]?.activeTeamId,activeTeamName:t.profiles?.[b]?.activeTeamName}:{},...t.profiles?.[n]??{}}}function Rt(){try{if(o.existsSync(mt)){let e=o.readFileSync(mt,`utf-8`);return JSON.parse(e)}}catch{}return{}}function zt(e){let t=!1,n={};e.apiKey&&($e(b,e.apiKey),yt(),t=!0);for(let[r,i]of Object.entries(e.profiles??{})){i.apiKey&&($e(r,i.apiKey),t=!0);let e={};i.baseUrl&&(e.baseUrl=i.baseUrl),i.activeTeamId&&(e.activeTeamId=i.activeTeamId),i.activeTeamName&&(e.activeTeamName=i.activeTeamName),Object.keys(e).length>0&&(n[r]=e)}let r={...e,apiKey:void 0,profiles:Object.keys(n).length>0?n:void 0};return t&&gt(mt,`${JSON.stringify(r,null,2)}\n`),r}function Bt(e,t){let n=t.profiles===void 0?{...e.profiles??{}}:Object.fromEntries(Object.entries(t.profiles).filter(([,e])=>!!(e.apiKey||e.baseUrl||e.activeTeamId||e.activeTeamName)));return{...e,...t,profiles:Object.keys(n).length>0?n:void 0}}function Vt(e){let t=e.trim().toLowerCase();if(!t)throw Error(`Profile name cannot be empty`);if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw Error(`Profile names may only contain lowercase letters, numbers, dots, underscores, and hyphens`);return t}let T=null,E=null;function D(e){if(e)return T&&E&&E.apiKey===e.apiKey&&E.baseUrl===e.baseUrl&&E.timeout===e.timeout?T:(T=new g({apiKey:e.apiKey,baseUrl:e.baseUrl,timeoutMs:e.timeout}),E=e,T);if(T)return T;let t=w({});return T=new g({apiKey:t.apiKey,baseUrl:t.baseUrl,timeoutMs:t.timeout}),E=t,T}function Ht(){T=null,E=null}async function Ut(e,t){let n=t.trim();if(n.length===0)throw Error(`Connection reference is empty.`);if(n.startsWith(`hubconn_`))return n;let{connections:r}=await e.connections.list();return Wt(r,n)}function Wt(e,t){let n=t.trim();if(n.length===0)throw Error(`Connection reference is empty.`);let r=e.find(e=>e.id===n);if(r)return r.id;let i=n.indexOf(`:`),a=(i===-1?n:n.slice(0,i)).trim().toLowerCase(),o=i===-1?null:n.slice(i+1).trim(),s=e.filter(e=>e.status!==`revoked`&&e.providerId.toLowerCase()===a);if(o&&o.length>0){let e=o.toLowerCase();s=s.filter(t=>(t.accountDisplay??``).toLowerCase()===e||t.displayName.toLowerCase()===e)}if(s.length===1)return s[0].id;throw s.length===0?Error(`No hub connection matches "${t}". List your connections with \`tangle hub connections\`.`):Error(Gt(t,s))}function Gt(e,t){let n=t.map(e=>`- ${e.id} (provider: ${e.providerId}, account: ${e.accountDisplay??e.displayName})`).join(`
+import{createRequire as e}from"node:module";import"dotenv/config";import{Command as t}from"commander";import{createHash as n,randomBytes as r,randomUUID as i}from"node:crypto";import{agentInteractiveSessionRunRef as a,canonicalAgentProfileDigest as o,modelProvider as s}from"@tangle-network/agent-interface";import{ALL_BACKEND_TYPES as c,AuthError as l,NetworkError as u,NotFoundError as d,QuotaError as f,Sandbox as p,ServerError as m,StateError as h,TimeoutError as g,ValidationError as _,createAgentRunOutcomeTracker as ee,createBatchResultAccumulator as te,createConfidentialSandbox as ne,generateAttestationNonce as re,parseBackendType as ie,parseSSEStream as v,validateBatchRunRequest as ae}from"@tangle-network/sandbox";import y from"chalk";import*as b from"node:fs";import{chmodSync as oe,existsSync as se,mkdirSync as ce,readFileSync as x,renameSync as le,writeFileSync as ue}from"node:fs";import*as S from"node:path";import{basename as de,dirname as fe,extname as pe,join as me,resolve as he}from"node:path";import*as ge from"node:os";import{homedir as _e,tmpdir as ve}from"node:os";import{execFile as ye,execFileSync as be,spawn as xe}from"node:child_process";import{lockSync as Se}from"proper-lockfile";import{HubClient as Ce,HubSdkError as we}from"@tangle-network/hub-sdk";import Te from"ora";import{CONTENT_COMPLETION_KEY as Ee,CONTENT_PROMPT_KEY as De,CONTENT_TOOL_ARGS_KEY as Oe,CONTENT_TOOL_NAME_KEY as ke,CONTENT_TOOL_RESULT_KEY as Ae,TANGLE_SUBJECT_KEY as je,asContentField as C,asContentString as Me}from"@tangle-network/agent-core/telemetry";import{createMcpServer as Ne}from"@tangle-network/sandbox/agent";import*as w from"node:fs/promises";import{readFile as Pe}from"node:fs/promises";import{fileURLToPath as Fe}from"node:url";import{generatePrivateKey as Ie,privateKeyToAccount as Le}from"viem/accounts";import{promisify as Re}from"node:util";import{createPublicClient as ze,createWalletClient as Be,decodeAbiParameters as Ve,decodeEventLog as He,encodeAbiParameters as Ue,getAddress as We,http as Ge,isAddress as Ke,keccak256 as qe,parseAbi as Je,parseAbiItem as Ye,parseAbiParameters as Xe,stringToHex as Ze,toHex as Qe}from"viem";import{tempoModerato as $e}from"viem/chains";import{Actions as et,withRelay as tt}from"viem/tempo";import nt from"ws";import{supervise as rt,workerFromBackend as it}from"@tangle-network/agent-runtime/kernel";import{createIntelligenceClient as at}from"@tangle-network/sandbox/intelligence";function ot(e){if(e.startsWith(`github:`)){let[t,n]=e.slice(7).split(`@`,2),r=t.split(`/`).filter(Boolean);if(r.length<3)throw Error(`invalid github ref "${e}": expected github:<owner>/<repo>/<path>[@<ref>]`);let i=`${r[0]}/${r[1]}`,a=r.slice(2).join(`/`);return{kind:`github`,repository:i,path:a,...n?{ref:n}:{},name:de(a)}}let t;try{t=x(e,`utf8`)}catch{throw Error(`cannot read skill/tool "${e}": not a readable file and not a github: ref`)}return{kind:`inline`,name:de(e),content:t}}function st(e){let t=(e.skills??[]).map(ot),n=(e.tools??[]).map(ot),r=t.length>0||n.length>0;if(!(!e.model&&!e.systemPrompt&&!r))return{...e.model?{model:{default:e.model}}:{},...e.systemPrompt?{prompt:{systemPrompt:e.systemPrompt}}:{},...r?{resources:{...t.length>0?{skills:t}:{},...n.length>0?{tools:n}:{}}}:{}}}async function ct(e){let t;if(e.startsWith(`github:`)){let[n,r]=e.slice(7).split(`@`,2),i=n.split(`/`).filter(Boolean);if(i.length<3)throw Error(`invalid --profile github ref "${e}": expected github:<owner>/<repo>/<path>[@<ref>]`);let a=r??`main`;t=await gt(`https://raw.githubusercontent.com/${i[0]}/${i[1]}/${a}/${i.slice(2).join(`/`)}`)}else t=/^https?:\/\//.test(e)?await gt(e):x(e,`utf8`);let n;try{n=JSON.parse(t)}catch{throw Error(`profile at "${e}" is not valid JSON`)}return ft(n,e),n}const lt=[`prompt`,`model`,`permissions`,`tools`,`mcp`,`connections`,`subagents`,`resources`,`hooks`,`modes`,`confidential`,`extensions`],ut=new Set([...lt,`name`,`description`,`version`,`tags`,`metadata`]),dt=[`files`,`tools`,`skills`,`agents`,`commands`];function ft(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`profile at "${t}" is not an object`);let n=Object.keys(e),r=n.some(e=>lt.includes(e)),i=n.includes(`name`)&&n.every(e=>ut.has(e));if(!r&&!i)throw Error(`"${t}" does not look like an agent profile: no recognized profile keys (model, prompt, resources, tools, connections, …). Got: ${n.slice(0,6).join(`, `)||`(empty object)`}.`);pt(e,t)}function pt(e,t){let n=e.resources;if(!n||typeof n!=`object`)return;for(let e of dt){let r=n[e];if(r!==void 0){if(!Array.isArray(r))throw Error(`profile at "${t}" is malformed: resources.${e} must be an array`);for(let n of r)ht(e===`files`?mt(n):n,t)}}let r=n.instructions;r!==void 0&&typeof r!=`string`&&ht(r,t)}function mt(e){return e&&typeof e==`object`?e.resource:e}function ht(e,t){let n=e&&typeof e==`object`?e.kind:void 0;if(n!==`inline`&&n!==`github`)throw Error(`profile at "${t}" has an invalid resource ref kind ${JSON.stringify(n)}: expected "inline" or "github"`)}async function gt(e){let t=await fetch(e);if(!t.ok)throw Error(`failed to fetch ${e} (${t.status})`);return t.text()}async function _t(e){let t=e.profileSource?await ct(e.profileSource):void 0,n=st(e);return t?n?{...t,...n,...n.resources?{resources:{...t.resources,...n.resources}}:{}}:t:n}const vt=S.join(ge.homedir(),`.tangle`),yt=S.join(vt,`credentials.json`),bt=`tangle-sandbox-cli`,xt=new Int32Array(new SharedArrayBuffer(4)),St=`TANGLE_ALLOW_PLAINTEXT_CREDENTIALS`;var Ct=class extends Error{constructor(e,t){super(`Credentials file at ${e} is corrupted and cannot be parsed. Inspect or remove it manually before retrying — refusing to overwrite it automatically.`),this.filePath=e,this.name=`CredentialsFileCorruptedError`,t&&(this.cause=t)}},wt=class extends Error{constructor(){super(`Could not store credential in the OS keychain, and the plaintext fallback is not enabled. Install a keychain provider (macOS Keychain or libsecret/secret-tool on Linux), or set ${St}=1 to opt into a plaintext credentials.json with mode 0600.`),this.name=`KeychainUnavailableError`}},Tt=class extends Error{constructor(e){super(`Credential storage preflight failed: ${e}`),this.name=`CredentialStorageProbeError`}},Et=class extends Error{constructor(e){super(`Credential storage is busy. Wait a moment and retry.`),this.name=`CredentialsFileLockedError`,e&&(this.cause=e)}};function Dt(e){let t=Mt(e);if(t)return{value:t,source:`keychain`};let n=Ft(e);return n?{value:n,source:`file`}:{source:`none`}}function Ot(e,t){if(Nt(e,t))return Lt(e),`keychain`;if(!jt())throw new wt;return It(e,t),`file`}function kt(){let e=`credential-write-probe:${process.pid}:${i()}`,t=i();if(Nt(e,t)){let n=Mt(e);if(!Pt(e))throw new Tt(`the OS keychain accepted a test credential but the CLI could not remove it`);if(n!==t)throw new Tt(`the OS keychain accepted a test credential but the CLI could not read it back`);return`keychain`}if(!jt())throw new wt;return Vt(e),`file`}function At(e){Pt(e),Lt(e)}function jt(){let e=process.env[St];if(!e)return!1;let t=e.trim().toLowerCase();return t===`1`||t===`true`||t===`yes`}function Mt(e){if(process.platform===`darwin`)try{return be(`security`,[`find-generic-password`,`-s`,bt,`-a`,Ut(e),`-w`],{encoding:`utf8`,stdio:[`ignore`,`pipe`,`ignore`]}).trim()}catch{return}if(process.platform===`linux`)try{return be(`secret-tool`,[`lookup`,`service`,bt,`account`,Ut(e)],{encoding:`utf8`,stdio:[`ignore`,`pipe`,`ignore`]}).trim()}catch{return}}function Nt(e,t){if(process.platform===`darwin`)try{return be(`security`,[`add-generic-password`,`-U`,`-s`,bt,`-a`,Ut(e),`-w`,t],{stdio:[`ignore`,`ignore`,`ignore`]}),!0}catch{return!1}if(process.platform===`linux`)try{return be(`secret-tool`,[`store`,`--label=Tangle Sandbox CLI`,`service`,bt,`account`,Ut(e)],{input:t,stdio:[`pipe`,`ignore`,`ignore`]}),!0}catch{return!1}return!1}function Pt(e){if(process.platform===`darwin`)try{return be(`security`,[`delete-generic-password`,`-s`,bt,`-a`,Ut(e)],{stdio:[`ignore`,`ignore`,`ignore`]}),!0}catch{return!1}if(process.platform===`linux`)try{return be(`secret-tool`,[`clear`,`service`,bt,`account`,Ut(e)],{stdio:[`ignore`,`ignore`,`ignore`]}),!0}catch{return!1}return!1}function Ft(e){return zt()[e]}function It(e,t){Rt(()=>{let n=zt();n[e]=t,Bt(n)})}function Lt(e){return Rt(()=>{let t;try{t=zt()}catch(e){if(e instanceof Ct)return!1;throw e}return e in t?(delete t[e],Bt(t),Ft(e)===void 0):!0})}function Rt(e){Ht();let t=Date.now()+2e3,n,r;for(;!n;)try{n=Se(yt,{realpath:!1,stale:5e3})}catch(e){if(r=e instanceof Error?e:void 0,!e||typeof e!=`object`||!(`code`in e)||e.code!==`ELOCKED`)throw e;if(Date.now()>=t)throw new Et(r);Atomics.wait(xt,0,0,20)}try{return e()}finally{n()}}function zt(){let e;try{e=b.readFileSync(yt,`utf8`)}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return{};throw e}try{let t=JSON.parse(e);if(typeof t!=`object`||!t||Array.isArray(t))throw new Ct(yt);let n={};for(let[e,r]of Object.entries(t))typeof r==`string`&&(n[e]=r);return n}catch(e){throw e instanceof Ct?e:new Ct(yt,e instanceof Error?e:void 0)}}function Bt(e){if(Ht(),Object.keys(e).length===0){b.existsSync(yt)&&b.unlinkSync(yt);return}let t=`${yt}.${process.pid}.tmp`;b.writeFileSync(t,`${JSON.stringify(e,null,2)}\n`,{mode:384}),b.renameSync(t,yt)}function Vt(e){let t=i(),n=!1,r;try{if(It(e,t),n=!0,Ft(e)!==t)throw new Tt(`the credentials file did not return the value just written`)}catch(e){r=e}finally{if(n)try{!Lt(e)&&!r&&(r=new Tt(`the credentials file accepted a test credential but the CLI could not remove it`))}catch(e){r??=e}}if(r)throw r}function Ht(){if(!b.existsSync(vt)){b.mkdirSync(vt,{mode:448,recursive:!0});return}if(process.platform!==`win32`)try{(b.statSync(vt).mode&511)!=448&&b.chmodSync(vt,448)}catch{}}function Ut(e){return`profile:${e}`}const Wt=S.join(ge.homedir(),`.tangle`),Gt=S.join(Wt,`credentials`),Kt=S.join(Wt,`config.json`),qt=`https://id.tangle.tools`,Jt=`https://solve.tangle.tools/api/solve`,T=`default`;function Yt(e,t){let n=nn(t??(e===`solve`?`solve`:void 0));if(e===`solve`){if(n!==`solve`)throw Error(`The solve app cannot use profile '${n}'. Use the reserved 'solve' profile.`);return n}if(e===`sandbox`&&!t&&n===`solve`)return T;if(new Set([`solve`]).has(n))throw Error(`The ${e} app cannot use the reserved '${n}' profile. Use the '${e}' profile or choose a custom profile.`);return n}function Xt(){b.existsSync(Wt)||b.mkdirSync(Wt,{mode:448,recursive:!0})}function Zt(e,t){Xt();let n=`${e}.${process.pid}.tmp`;b.writeFileSync(n,t,{mode:384}),b.renameSync(n,e)}function Qt(){try{if(b.existsSync(Gt)){let e=b.readFileSync(Gt,`utf-8`).trim();return $t(e)?e:e.match(/api_key\s*=\s*(\S+)/)?.[1]}}catch{}}function $t(e){return e.startsWith(`sk_`)||e.startsWith(`sk-tan-`)}function en(){try{b.existsSync(Gt)&&b.unlinkSync(Gt)}catch{}}function E(){return jn(An())}function tn(e){let t=Mn(E(),e);Zt(Kt,`${JSON.stringify(t,null,2)}\n`)}function nn(e){return Nn(e||process.env.TANGLE_PROFILE||process.env.SANDBOX_PROFILE||E().activeProfile||T)}function rn(e){tn({activeProfile:Nn(e)})}function an(){return process.env.TANGLE_SANDBOX||E().currentSandbox||void 0}function on(e){tn({currentSandbox:e})}function sn(){let e=E();delete e.currentSandbox,Zt(Kt,`${JSON.stringify(e,null,2)}\n`)}function cn(){let e=E().deviceId;if(e&&/^[A-Za-z0-9_.-]{1,64}$/.test(e))return e;let t=ge.hostname().replace(/[^A-Za-z0-9_.-]/g,`-`).replace(/^-+|-+$/g,``).slice(0,32),n=r(4).toString(`hex`),i=`${t?`${t}-`:`device-`}${n}`;return tn({deviceId:i}),i}function ln(e){let t=e||an();if(!t)throw Error("No sandbox specified. Pass it positionally, set a default with `tangle use <id>`, pass `--box <id>`, or set TANGLE_SANDBOX.");return t}function un(){let e=E(),t=nn(),n=new Set([T,...Object.keys(e.profiles??{})]);return e.activeProfile&&n.add(Nn(e.activeProfile)),[...n].map(e=>{let n=Dt(e),r=e===T?Qt():void 0,i=n.source===`none`?r?`legacy-file`:`none`:n.source;return{name:e,active:e===t,hasApiKey:n.source!==`none`||!!r,baseUrl:bn(void 0,e),apiKeySource:i}}).sort((e,t)=>e.name.localeCompare(t.name))}function dn(e){let t=nn(e);return{name:t,active:t===nn(),baseUrl:bn(void 0,t),credentialSource:yn(t)}}function fn(e,t){let n=Nn(e),r=E(),i=kn(n,r),a={},o=t.baseUrl??i.baseUrl;o&&(a.baseUrl=o);let s=t.activeTeamId??i.activeTeamId;s&&(a.activeTeamId=s);let c=t.activeTeamName??i.activeTeamName;c&&(a.activeTeamName=c);let l={...r.profiles??{}};a.baseUrl||a.activeTeamId||a.activeTeamName?l[n]=a:delete l[n];let u;return t.apiKey&&(u=Ot(n,t.apiKey),n===T&&en()),tn({profiles:Object.keys(l).length>0?l:{}}),u}function pn(e){let t=nn(e),n={...E().profiles??{}},r=n[t];if(r){let e={...r,apiKey:void 0};e.baseUrl||e.activeTeamId||e.activeTeamName?n[t]=e:delete n[t]}tn({profiles:n}),At(t),t===T&&en()}function mn(){let e=process.env.TANGLE_API_KEY_FILE;if(e){let t=b.readFileSync(e,`utf8`).trim();if(!t.startsWith(`sk-tan-`))throw Error(`Invalid sandbox credential file`);return t}return process.env.TANGLE_API_KEY}function hn(e,t){let n=Yt(`sandbox`,t);if(e)return e;let r=mn();if(r)return r;let i=Dt(n);if(i.value)return i.value;if(n===T||n===`sandbox`)return Qt()}function gn(e,t){return e||(process.env.TANGLE_SOLVE_API_KEY?process.env.TANGLE_SOLVE_API_KEY:Dt(Yt(`solve`,t)).value)}function _n(e,t){let n=Yt(`sandbox`,t);return e?`flag`:process.env.TANGLE_API_KEY_FILE||process.env.TANGLE_API_KEY?`env`:yn(n)}function vn(e,t){return e?`flag`:process.env.TANGLE_SOLVE_API_KEY?`env`:Dt(Yt(`solve`,t)).source}function yn(e){let t=Dt(e);return t.source===`none`?(e===T||e===`sandbox`)&&Qt()?`legacy-file`:`none`:t.source}function bn(e,t){if(e)return e;let n=process.env.TANGLE_BASE_URL||process.env.SANDBOX_BASE_URL;if(n)return n;let r=nn(t),i=E(),a=kn(r,i);return a.baseUrl?a.baseUrl:(r===T||r===`sandbox`)&&i.baseUrl?i.baseUrl:`https://sandbox.tangle.tools`}function xn(e){if(e)return e.replace(/\/v1\/hub\/?$/,``)}function Sn(e){return e?.trim().replace(/\/+$/,``)||void 0}function Cn(e){return Sn(e?.flag)??Sn(xn(Sn(process.env.TANGLE_HUB_URL)))??Sn(process.env.TANGLE_PLATFORM_URL)??Sn(e?.cachedPlatformUrl?.())??qt}function wn(e){let t=Sn(e)??Sn(process.env.TANGLE_SOLVE_API_URL);if(t&&t!==Jt)throw Error(`Solve credentials may only be sent to ${Jt}`);return Jt}function Tn(e){let t=Sn(e);if(t&&t!==qt)throw Error(`Solve credentials may only be sent to ${qt}`);return qt}function D(e){let t=Yt(`sandbox`,e.profile),n=hn(e.apiKey,t);if(!n)throw Error(`No API key found for profile '${t}'. Set TANGLE_API_KEY or run: tangle auth login${t===T?``:` --profile ${t}`}`);return{apiKey:n,baseUrl:bn(e.baseUrl,t),timeout:e.timeout??3e4,profile:t,...En(t)}}function En(e){let t=E(),n=kn(nn(e),t);return{activeTeamId:n.activeTeamId,activeTeamName:n.activeTeamName}}function Dn(e,t){fn(nn(t),{activeTeamId:e.id,activeTeamName:e.name})}function On(e){let t=nn(e),n=E(),r={...n.profiles??{}},i={baseUrl:kn(t,n).baseUrl};i.baseUrl?r[t]=i:delete r[t],tn({profiles:r})}function kn(e,t=E()){let n=Nn(e);return{...n===T?{baseUrl:t.baseUrl,activeTeamId:t.profiles?.[T]?.activeTeamId,activeTeamName:t.profiles?.[T]?.activeTeamName}:{},...t.profiles?.[n]??{}}}function An(){try{if(b.existsSync(Kt)){let e=b.readFileSync(Kt,`utf-8`);return JSON.parse(e)}}catch{}return{}}function jn(e){let t=!1,n={};e.apiKey&&(Ot(T,e.apiKey),en(),t=!0);for(let[r,i]of Object.entries(e.profiles??{})){i.apiKey&&(Ot(r,i.apiKey),t=!0);let e={};i.baseUrl&&(e.baseUrl=i.baseUrl),i.activeTeamId&&(e.activeTeamId=i.activeTeamId),i.activeTeamName&&(e.activeTeamName=i.activeTeamName),Object.keys(e).length>0&&(n[r]=e)}let r={...e,apiKey:void 0,profiles:Object.keys(n).length>0?n:void 0};return t&&Zt(Kt,`${JSON.stringify(r,null,2)}\n`),r}function Mn(e,t){let n=t.profiles===void 0?{...e.profiles??{}}:Object.fromEntries(Object.entries(t.profiles).filter(([,e])=>!!(e.apiKey||e.baseUrl||e.activeTeamId||e.activeTeamName)));return{...e,...t,profiles:Object.keys(n).length>0?n:void 0}}function Nn(e){let t=e.trim().toLowerCase();if(!t)throw Error(`Profile name cannot be empty`);if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw Error(`Profile names may only contain lowercase letters, numbers, dots, underscores, and hyphens`);return t}let Pn=null,Fn=null;function O(e){if(e)return Pn&&Fn&&Fn.apiKey===e.apiKey&&Fn.baseUrl===e.baseUrl&&Fn.timeout===e.timeout?Pn:(Pn=new p({apiKey:e.apiKey,baseUrl:e.baseUrl,timeoutMs:e.timeout}),Fn=e,Pn);if(Pn)return Pn;let t=D({});return Pn=new p({apiKey:t.apiKey,baseUrl:t.baseUrl,timeoutMs:t.timeout}),Fn=t,Pn}function In(){Pn=null,Fn=null}async function Ln(e,t){let n=t.trim();if(n.length===0)throw Error(`Connection reference is empty.`);if(n.startsWith(`hubconn_`))return n;let{connections:r}=await e.connections.list();return Rn(r,n)}function Rn(e,t){let n=t.trim();if(n.length===0)throw Error(`Connection reference is empty.`);let r=e.find(e=>e.id===n);if(r)return r.id;let i=n.indexOf(`:`),a=(i===-1?n:n.slice(0,i)).trim().toLowerCase(),o=i===-1?null:n.slice(i+1).trim(),s=e.filter(e=>e.status!==`revoked`&&e.providerId.toLowerCase()===a);if(o&&o.length>0){let e=o.toLowerCase();s=s.filter(t=>(t.accountDisplay??``).toLowerCase()===e||t.displayName.toLowerCase()===e)}if(s.length===1)return s[0].id;throw s.length===0?Error(`No hub connection matches "${t}". List your connections with \`tangle hub connections\`.`):Error(zn(t,s))}function zn(e,t){let n=t.map(e=>`- ${e.id} (provider: ${e.providerId}, account: ${e.accountDisplay??e.displayName})`).join(`
 `);return`Hub connection reference is ambiguous: "${e}" matches ${t.length} connections. Use a connection id or provider:account instead.
-`+n}function Kt(e,t){return[...t,e]}async function qt(e,t){let n=e.map(e=>{let t=e.trim(),n=t.indexOf(`:`);return n===-1?{raw:e,ref:null,tail:null}:{raw:e,ref:t.slice(0,n).trim(),tail:t.slice(n+1)}});if(!n.some(e=>e.ref!==null&&e.ref!==`*`&&!e.ref.startsWith(`hubconn_`)))return[...e];let{connections:r}=await(await t()).connections.list();return n.map(e=>e.ref===null||e.ref===`*`||e.ref.startsWith(`hubconn_`)?e.raw:`${Wt(r,e.ref)}:${e.tail}`)}function Jt(e){let t=new Map,n=[];for(let r of e){let e=r.trim(),i=e.indexOf(`:`);if(i===-1)throw Error(`Invalid --connection "${r}": expected <connectionId>:<capability>[,<capability>]. List connection ids with \`tangle hub connections\` and capability paths with \`tangle hub tools search <keyword>\`.`);let a=e.slice(0,i).trim();if(a.length===0)throw Error(`Invalid --connection "${r}": connection id is empty. Use <connectionId>:<capability> — list ids with \`tangle hub connections\`.`);let o=e.slice(i+1).split(`,`).map(e=>e.trim()).filter(e=>e.length>0);if(o.length===0)throw Error(`Invalid --connection "${r}": grant at least one capability, e.g. ${a}:gmail.messages.list. Discover paths with \`tangle hub tools search <keyword>\`.`);if(o.includes(`*`)&&o.length>1)throw Error(`Invalid --connection "${r}": "*" grants all capabilities and can't be combined with specific paths. Use <connectionId>:* alone, or list explicit paths.`);if(a===`*`&&!(o.length===1&&o[0]===`*`))throw Error(`Invalid --connection "${r}": a "*" connection is only valid as "*:*" (all connections, all capabilities). Name a connection id for specific paths.`);let s=t.get(a);s===void 0&&(s=new Set,t.set(a,s),n.push(a));for(let e of o)s.add(e)}return n.map(e=>{let n=t.get(e),r=n?[...n]:[];if(r.includes(`*`)&&r.length>1)throw Error(`Invalid --connection for "${e}": "*" can't be combined with specific capability paths across repeated --connection flags.`);return{connectionId:e,capabilities:r}})}function Yt(e){return e==null?a.dim(`-`):typeof e==`boolean`?e?a.green(`yes`):a.red(`no`):e instanceof Date?Zt(e):typeof e==`string`&&Xt(e)?Zt(new Date(e)):String(e)}function Xt(e){return/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/.test(e)}function Zt(e){let t=Date.now()-e.getTime();if(t<6e4)return`just now`;if(t<36e5)return`${Math.floor(t/6e4)} min ago`;if(t<864e5){let e=Math.floor(t/36e5);return`${e} hour${e>1?`s`:``} ago`}let n=Math.floor(t/864e5);return`${n} day${n>1?`s`:``} ago`}function Qt(e){switch(e){case`running`:return a.green(e);case`pending`:case`provisioning`:return a.yellow(e);case`stopped`:return a.gray(e);case`failed`:case`deleted`:return a.red(e);default:return e}}function O(e,t){if(e.length===0){console.log(a.dim(`No items found.`));return}let n=t.map(t=>{let n=t.header.length,r=Math.max(...e.map(e=>Yt(e[t.key]).length));return t.width??Math.max(n,r)+2}),r=t.map((e,t)=>a.bold(e.header.padEnd(n[t]))).join(``);console.log(r);for(let r of e){let e=t.map((e,t)=>{let i=Yt(r[e.key]);return e.key===`status`&&(i=Qt(String(r[e.key]))),i.padEnd(n[t])}).join(``);console.log(e)}}function k(e){console.log(JSON.stringify(e,null,2))}function A(e){console.log(a.green(`✓`),e)}function j(e){console.error(a.red(`✗`),e)}function $t(e){console.log(a.yellow(`!`),e)}function M(e){console.log(a.blue(`→`),e)}const en=new Set;function N(e){let t=ye({text:e,color:`cyan`});return en.add(t),t}function tn(){for(let e of en)e.isSpinning&&e.stop();en.clear()}function P(e,t=0){let n=` `.repeat(t);for(let[t,r]of Object.entries(e))r!=null&&console.log(`${n}${a.dim(`${t}:`)} ${Yt(r)}`)}function nn(e){if(console.log(),console.log(a.bold(`Sandbox Details`)),console.log(a.dim(`─`.repeat(40))),P({ID:e.id,Name:e.name,Status:Qt(e.status),Created:e.createdAt,Expires:e.expiresAt}),e.connection){if(console.log(),console.log(a.bold(`Connection`)),console.log(a.dim(`─`.repeat(40))),e.connection.ssh){let{ssh:t}=e.connection,n=process.platform===`win32`?`NUL`:`/dev/null`,r=`ssh -o ProxyCommand="${t.proxyCommand}" -o StrictHostKeyChecking=no -o UserKnownHostsFile=${n} -o GlobalKnownHostsFile=${n} -o LogLevel=ERROR -o ServerAliveInterval=15 -o ServerAliveCountMax=4 -o TCPKeepAlive=yes ${t.username}@localhost -p ${t.port}`;P({SSH:process.platform===`win32`?`$env:TANGLE_SSH_PROXY_AUTH_TOKEN='<token>'; ${r}`:`TANGLE_SSH_PROXY_AUTH_TOKEN='<token>' ${r}`})}e.connection.webTerminalUrl&&P({"Web Terminal":e.connection.webTerminalUrl}),e.connection.runtimeUrl&&P({"API URL":e.connection.runtimeUrl})}console.log()}function F(e,t){tn(),t?k({error:e.message}):j(e.message),process.exit(1)}function I(e){k(e)}function L(e,t){if(t.length===0){console.log(a.dim(`No items found.`));return}let n=e.map((e,n)=>{let r=Math.max(...t.map(e=>String(e[n]??``).length));return Math.max(e.length,r)+2});console.log(e.map((e,t)=>a.bold(e.padEnd(n[t]))).join(``));for(let e of t)console.log(e.map((e,t)=>String(e??``).padEnd(n[t])).join(``))}function R(e,t=!1){tn(),t&&(k(rn(e)),process.exit(dn(e)));let n=an(e);console.error(a.red(`Error:`),n),process.exit(dn(e))}function rn(e){return e instanceof ve?{error:{code:e.code,message:e.message,...typeof e.status==`number`?{status:e.status}:{},...e.details===void 0?{}:{details:e.details}}}:un(e)?{error:{code:e.code,message:e.message,status:e.status,...e.details===void 0?{}:{details:e.details}}}:{error:{message:an(e)}}}function an(e){if(e instanceof ie)return`Authentication failed. Run 'tangle auth login' to authenticate.`;if(e instanceof ae)return`Resource not found. Check the ID and try again.`;if(e instanceof oe)return`Quota exceeded. Upgrade your plan or wait for quota reset.`;if(e instanceof ce)return`Invalid input: ${e.message}`;if(e instanceof v)return`Invalid state: ${e.message}`;if(e instanceof se)return`Request timed out after ${e.timeoutMs} ms. Retry, or re-run with a longer --timeout <ms> on commands that accept it (e.g. create, resume).`;if(e instanceof h)return`Network error. Check your connection and try again.`;if(e instanceof _)return`${e.status?`HTTP ${e.status}`:`server error`}: ${e.message}`;if(e instanceof ve){let t=typeof e.status==`number`?` (HTTP ${e.status})`:``;return e.code===`HUB_CONNECTION_MISSING`?on(e.code,t,e.message,e.details):e.code===`HUB_APPROVAL_REQUIRED`?cn(e.code,t,e.message):e.code===`HUB_UNAUTHENTICATED`?ln(e.code,t,e.message):`${e.code}${t}: ${e.message}`}return un(e)?e.code===`HUB_CONNECTION_MISSING`?on(e.code,` (HTTP ${e.status})`,e.message,e.details):e.code===`HUB_APPROVAL_REQUIRED`?cn(e.code,` (HTTP ${e.status})`,e.message):e.code===`HUB_UNAUTHENTICATED`?ln(e.code,` (HTTP ${e.status})`,e.message):`${e.code} (HTTP ${e.status}): ${e.message}`:e instanceof Error?e.message:String(e)}function on(e,t,n,r){let i=sn(r);return`${e}${t}: ${n}${i?`. Run: tangle hub connect ${i}`:``}`}function sn(e){if(!e||typeof e!=`object`)return;let t=e.provider;return typeof t==`string`&&t.length>0?t:void 0}function cn(e,t,n){return`${e}${t}: ${n}. Run the command again with --auto-approve, or run: tangle hub resume <approval-id> --accept. See: tangle hub resume --help`}function ln(e,t,n){return`${e}${t}: ${n}. The CLI auto-mints a short-lived Hub key from your login session, so this usually means that session has expired — run 'tangle auth login' to re-authenticate. To use a credential directly instead, set TANGLE_API_KEY, SANDBOX_API_KEY, or TANGLE_HUB_CAPABILITY_TOKEN (and pass --no-hub-key to skip auto-minting).`}function un(e){if(!(e instanceof Error))return!1;let t=e;return typeof t.code==`string`&&t.code.startsWith(`HUB_`)&&typeof t.status==`number`}function dn(e){return e instanceof ce?2:1}function fn(e,t){return n(`sha256`).update(`${e}\0${t}`).digest(`hex`).slice(0,32)}function pn(e){return`${e}:hub`}function mn(e){let{value:t}=Qe(pn(e));if(!t)return null;try{let e=JSON.parse(t);if(typeof e.key==`string`&&typeof e.expiresAt==`string`&&typeof e.platformUrl==`string`&&typeof e.sessionFingerprint==`string`)return{key:e.key,expiresAt:e.expiresAt,platformUrl:e.platformUrl,sessionFingerprint:e.sessionFingerprint}}catch{}return null}function hn(e,t){try{$e(pn(e),JSON.stringify(t))}catch{}}async function gn(e,t,n){let r=`${e.replace(/\/+$/,``)}/auth/cli/hub-key`,i;try{i=await fetch(r,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${t}`},body:JSON.stringify({device_id:n})})}catch(e){throw Error(`Could not reach ${r} to mint a Hub key: ${e instanceof Error?e.message:String(e)}`)}let a=await i.text(),o;try{o=JSON.parse(a)}catch{o=null}if(!i.ok||!o?.success){let e=typeof o?.error?.message==`string`?o.error.message:`HTTP ${i.status}`;throw Error(`Hub key minting failed: ${e}. Your sandbox session may have expired — run \`tangle auth login\`.`)}let s=o.data;if(typeof s?.api_key!=`string`||typeof s?.expires_at!=`string`||typeof s?.platform_url!=`string`)throw Error(`Hub key minting returned an unexpected response shape.`);return{key:s.api_key,expiresAt:s.expires_at,platformUrl:s.platform_url}}var _n=class{cache;fingerprint;constructor(e,t,n,r){this.profile=e,this.sandboxBaseUrl=t,this.sessionToken=n,this.deviceId=r,this.fingerprint=fn(t,n);let i=mn(e);this.cache=i&&i.sessionFingerprint===this.fingerprint?i:null}isFresh(e){return e!==null&&Date.parse(e.expiresAt)-Date.now()>6e4}async ensure(e=!1){if(!e&&this.isFresh(this.cache))return this.cache;let t={...await gn(this.sandboxBaseUrl,this.sessionToken,this.deviceId),sessionFingerprint:this.fingerprint};return this.cache=t,hn(this.profile,t),t}};function vn(e){if(!e)return!1;let t=e.trim().toLowerCase();return t===`1`||t===`true`||t===`yes`}function yn(e,t){if(e.baseUrl)return e.baseUrl;let n=Nt(process.env.TANGLE_HUB_URL);if(n)return n;let r=mn(t);return r?r.platformUrl:`https://id.tangle.tools`}function bn(e,t){let n=S(),r=C(e.apiKey,n),i=jt(e.apiKey,n),a=process.env.TANGLE_HUB_CAPABILITY_TOKEN?.trim()||void 0;if(a&&i===`env`)throw Error(`Set exactly one of TANGLE_API_KEY/SANDBOX_API_KEY or TANGLE_HUB_CAPABILITY_TOKEN, not both`);if(i===`flag`&&r)return{kind:`static`,apiKey:r,baseUrl:yn(e,n)};if(i===`env`&&r)return{kind:`static`,apiKey:a??r,baseUrl:yn(e,n)};if(a)return{kind:`static`,apiKey:a,baseUrl:yn(e,n)};if(!r)throw Error(`No API key found for profile '${n}'. Set TANGLE_API_KEY or run: tangle auth login${n===`default`?``:` --profile ${n}`}`);return t?{kind:`static`,apiKey:r,baseUrl:yn(e,n)}:{kind:`managed`,profile:n,sandboxBaseUrl:Mt(void 0,n),sessionToken:r,deviceId:Tt(),baseUrlOverride:e.baseUrl}}async function z(e={}){let t=bn(e,e.hubKey===!1||vn(process.env.TANGLE_SKIP_HUB_KEY));if(t.kind===`static`)return new _e({baseUrl:t.baseUrl,apiKey:t.apiKey});let n=new _n(t.profile,t.sandboxBaseUrl,t.sessionToken,t.deviceId),r=await n.ensure();return new _e({baseUrl:t.baseUrlOverride??r.platformUrl,authHeaders:async()=>({Authorization:`Bearer ${(await n.ensure()).key}`}),fetch:async(e,t)=>{let r=await fetch(e,t);if(r.status!==401)return r;let i=await n.ensure(!0),a=new Headers(t?.headers);return a.set(`Authorization`,`Bearer ${i.key}`),fetch(e,{...t,headers:a})}})}function xn(e){return e instanceof Date?e.toISOString():String(e)}function Sn(e,t){return`Sandbox name is ambiguous: ${e}. Use a sandbox id instead.\n${t.map(e=>`- ${e.id} (status: ${e.status}, created: ${xn(e.createdAt)})`).join(`
-`)}`}function Cn(e){return e.activeTeamId?`team:${e.activeTeamId}`:void 0}async function B(e,t,n){let r=await e.get(n);if(r||n.startsWith(`sandbox-`)){if(!r)throw Error(`Sandbox not found: ${n}`);return r}let i=(await e.list({scope:Cn(t)})).filter(e=>e.name?.toLowerCase()===n.toLowerCase());if(i.length===0)throw Error(`Sandbox not found: ${n}`);if(i.length>1)throw Error(Sn(n,i));return i[0]}async function V(e,t){if(e.status!==`stopped`)return e;let n=t?.resumeTimeoutMs??12e4;M(`Sandbox ${e.id} is stopped. Resuming...`);try{await e.resume({timeoutMs:n}),await e.waitFor(`running`,{timeoutMs:n})}catch(t){let r=t instanceof Error?t.message:String(t);throw Error(`Failed to resume sandbox ${e.id}: ${r}. Run \`tangle sandbox resume ${e.id} --timeout ${n}\` and retry.`)}return e}const wn=[`anthropic`,`openai`,`vercel-ai`,`mastra`,`mcp-local`,`claude-desktop`,`cursor`,`zed`];function Tn(e,t,n){switch(e){case`anthropic`:return`// pnpm add @anthropic-ai/sdk @tangle-network/sandbox
+`+n}function Bn(e,t){return[...t,e]}async function Vn(e,t){let n=e.map(e=>{let t=e.trim(),n=t.indexOf(`:`);return n===-1?{raw:e,ref:null,tail:null}:{raw:e,ref:t.slice(0,n).trim(),tail:t.slice(n+1)}});if(!n.some(e=>e.ref!==null&&e.ref!==`*`&&!e.ref.startsWith(`hubconn_`)))return[...e];let{connections:r}=await(await t()).connections.list();return n.map(e=>e.ref===null||e.ref===`*`||e.ref.startsWith(`hubconn_`)?e.raw:`${Rn(r,e.ref)}:${e.tail}`)}function Hn(e){let t=new Map,n=[];for(let r of e){let e=r.trim(),i=e.indexOf(`:`);if(i===-1)throw Error(`Invalid --connection "${r}": expected <connectionId>:<capability>[,<capability>]. List connection ids with \`tangle hub connections\` and capability paths with \`tangle hub tools search <keyword>\`.`);let a=e.slice(0,i).trim();if(a.length===0)throw Error(`Invalid --connection "${r}": connection id is empty. Use <connectionId>:<capability> — list ids with \`tangle hub connections\`.`);let o=e.slice(i+1).split(`,`).map(e=>e.trim()).filter(e=>e.length>0);if(o.length===0)throw Error(`Invalid --connection "${r}": grant at least one capability, e.g. ${a}:gmail.messages.list. Discover paths with \`tangle hub tools search <keyword>\`.`);if(o.includes(`*`)&&o.length>1)throw Error(`Invalid --connection "${r}": "*" grants all capabilities and can't be combined with specific paths. Use <connectionId>:* alone, or list explicit paths.`);if(a===`*`&&!(o.length===1&&o[0]===`*`))throw Error(`Invalid --connection "${r}": a "*" connection is only valid as "*:*" (all connections, all capabilities). Name a connection id for specific paths.`);let s=t.get(a);s===void 0&&(s=new Set,t.set(a,s),n.push(a));for(let e of o)s.add(e)}return n.map(e=>{let n=t.get(e),r=n?[...n]:[];if(r.includes(`*`)&&r.length>1)throw Error(`Invalid --connection for "${e}": "*" can't be combined with specific capability paths across repeated --connection flags.`);return{connectionId:e,capabilities:r}})}function Un(e){return e==null?y.dim(`-`):typeof e==`boolean`?e?y.green(`yes`):y.red(`no`):e instanceof Date?Gn(e):typeof e==`string`&&Wn(e)?Gn(new Date(e)):String(e)}function Wn(e){return/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/.test(e)}function Gn(e){let t=Date.now()-e.getTime();if(t<6e4)return`just now`;if(t<36e5)return`${Math.floor(t/6e4)} min ago`;if(t<864e5){let e=Math.floor(t/36e5);return`${e} hour${e>1?`s`:``} ago`}let n=Math.floor(t/864e5);return`${n} day${n>1?`s`:``} ago`}function Kn(e){switch(e){case`running`:return y.green(e);case`pending`:case`provisioning`:return y.yellow(e);case`stopped`:return y.gray(e);case`failed`:case`deleted`:return y.red(e);default:return e}}function k(e,t){if(e.length===0){console.log(y.dim(`No items found.`));return}let n=t.map(t=>{let n=t.header.length,r=Math.max(...e.map(e=>Un(e[t.key]).length));return t.width??Math.max(n,r)+2}),r=t.map((e,t)=>y.bold(e.header.padEnd(n[t]))).join(``);console.log(r);for(let r of e){let e=t.map((e,t)=>{let i=Un(r[e.key]);return e.key===`status`&&(i=Kn(String(r[e.key]))),i.padEnd(n[t])}).join(``);console.log(e)}}function A(e){console.log(JSON.stringify(e,null,2))}function j(e){console.log(y.green(`✓`),e)}function qn(e){console.error(y.red(`✗`),e)}function M(e){console.log(y.yellow(`!`),e)}function N(e){console.log(y.blue(`→`),e)}const Jn=new Set;function P(e){let t=Te({text:e,color:`cyan`});return Jn.add(t),t}function Yn(){for(let e of Jn)e.isSpinning&&e.stop();Jn.clear()}function F(e,t=0){let n=` `.repeat(t);for(let[t,r]of Object.entries(e))r!=null&&console.log(`${n}${y.dim(`${t}:`)} ${Un(r)}`)}function Xn(e){let t=`${e.cpuCores} vCPU / ${e.memoryMB} MB / ${e.diskGB} GB`;return e.pool?`${t} (pool: ${e.pool})`:t}function Zn(e){if(console.log(),console.log(y.bold(`Sandbox Details`)),console.log(y.dim(`─`.repeat(40))),F({ID:e.id,Name:e.name,Status:Kn(e.status),Resources:e.resources?Xn(e.resources):void 0,Created:e.createdAt,Expires:e.expiresAt}),e.connection){if(console.log(),console.log(y.bold(`Connection`)),console.log(y.dim(`─`.repeat(40))),e.connection.ssh){let{ssh:t}=e.connection,n=process.platform===`win32`?`NUL`:`/dev/null`,r=`ssh -o ProxyCommand="${t.proxyCommand}" -o StrictHostKeyChecking=no -o UserKnownHostsFile=${n} -o GlobalKnownHostsFile=${n} -o LogLevel=ERROR -o ServerAliveInterval=15 -o ServerAliveCountMax=4 -o TCPKeepAlive=yes ${t.username}@localhost -p ${t.port}`;F({SSH:process.platform===`win32`?`$env:TANGLE_SSH_PROXY_AUTH_TOKEN='<token>'; ${r}`:`TANGLE_SSH_PROXY_AUTH_TOKEN='<token>' ${r}`})}e.connection.webTerminalUrl&&F({"Web Terminal":e.connection.webTerminalUrl}),e.connection.runtimeUrl&&F({"API URL":e.connection.runtimeUrl})}console.log()}function Qn(e,t){Yn(),t?A({error:e.message}):qn(e.message),process.exit(1)}function $n(e){A(e)}function I(e,t){if(t.length===0){console.log(y.dim(`No items found.`));return}let n=e.map((e,n)=>{let r=Math.max(...t.map(e=>String(e[n]??``).length));return Math.max(e.length,r)+2});console.log(e.map((e,t)=>y.bold(e.padEnd(n[t]))).join(``));for(let e of t)console.log(e.map((e,t)=>String(e??``).padEnd(n[t])).join(``))}function L(e,t=!1){Yn(),t&&(A(er(e)),process.exit(cr(e)));let n=tr(e);console.error(y.red(`Error:`),n),process.exit(cr(e))}function er(e){return e instanceof we?{error:{code:e.code,message:e.message,...typeof e.status==`number`?{status:e.status}:{},...e.details===void 0?{}:{details:e.details}}}:sr(e)?{error:{code:e.code,message:e.message,status:e.status,...e.details===void 0?{}:{details:e.details}}}:{error:{message:tr(e)}}}function tr(e){if(e instanceof l)return`Authentication failed. Run 'tangle auth login' to authenticate.`;if(e instanceof d)return`Resource not found. Check the ID and try again.`;if(e instanceof f)return`Quota exceeded. Upgrade your plan or wait for quota reset.`;if(e instanceof _)return`Invalid input: ${e.message}`;if(e instanceof h)return`Invalid state: ${e.message}`;if(e instanceof g)return`Request timed out after ${e.timeoutMs} ms. Retry, or re-run with a longer --timeout <ms> on commands that accept it (e.g. create, resume).`;if(e instanceof u)return`Network error. Check your connection and try again.`;if(e instanceof m)return`${e.status?`HTTP ${e.status}`:`server error`}: ${e.message}`;if(e instanceof we){let t=typeof e.status==`number`?` (HTTP ${e.status})`:``;return e.code===`HUB_CONNECTION_MISSING`?nr(e.code,t,e.message,e.details):e.code===`HUB_APPROVAL_REQUIRED`?ir(e.code,t,e.message):e.code===`HUB_UNAUTHENTICATED`?or(e.code,t,e.message):e.code===`HUB_PROVIDER_REJECTED`?ar(e.code,t,e.message,e.details):`${e.code}${t}: ${e.message}`}return sr(e)?e.code===`HUB_CONNECTION_MISSING`?nr(e.code,` (HTTP ${e.status})`,e.message,e.details):e.code===`HUB_APPROVAL_REQUIRED`?ir(e.code,` (HTTP ${e.status})`,e.message):e.code===`HUB_UNAUTHENTICATED`?or(e.code,` (HTTP ${e.status})`,e.message):e.code===`HUB_PROVIDER_REJECTED`?ar(e.code,` (HTTP ${e.status})`,e.message,e.details):`${e.code} (HTTP ${e.status}): ${e.message}`:e instanceof Error?e.message:String(e)}function nr(e,t,n,r){let i=rr(r);return`${e}${t}: ${n}${i?`. Run: tangle hub connect ${i}`:``}`}function rr(e){if(!e||typeof e!=`object`)return;let t=e.provider;return typeof t==`string`&&t.length>0?t:void 0}function ir(e,t,n){return`${e}${t}: ${n}. Run the command again with --auto-approve, or run: tangle hub resume <approval-id> --accept. See: tangle hub resume --help`}function ar(e,t,n,r){let i=typeof r==`object`&&r?r.providerRetryable:void 0;return`${e}${t}: ${n}. ${i===!0?`The provider refused this request, but this refusal can clear — the same call may succeed shortly.`:i===!1?`The provider refused this request — retrying it will not help. Change the request, or check that the account may perform this action.`:`The provider refused this request. Check that the request is valid and that the account may perform this action before retrying.`}`}function or(e,t,n){return`${e}${t}: ${n}. The CLI auto-mints a short-lived platform key from your login session, so this usually means that session has expired — run 'tangle auth login' to re-authenticate. To use a credential directly instead, set TANGLE_API_KEY or TANGLE_HUB_CAPABILITY_TOKEN (and pass --no-hub-key to skip auto-minting).`}function sr(e){if(!(e instanceof Error))return!1;let t=e;return typeof t.code==`string`&&t.code.startsWith(`HUB_`)&&typeof t.status==`number`}function cr(e){return e instanceof _?2:1}function lr(e,t){return n(`sha256`).update(`${e}\0${t}`).digest(`hex`).slice(0,32)}function ur(e){return`${e}:hub`}function dr(e){let{value:t}=Dt(ur(e));if(!t)return null;try{let e=JSON.parse(t);if(typeof e.key==`string`&&typeof e.expiresAt==`string`&&typeof e.platformUrl==`string`&&typeof e.sessionFingerprint==`string`)return{key:e.key,expiresAt:e.expiresAt,platformUrl:e.platformUrl,sessionFingerprint:e.sessionFingerprint}}catch{}return null}function fr(e,t){try{Ot(ur(e),JSON.stringify(t))}catch{}}async function pr(e,t,n){let r=`${e.replace(/\/+$/,``)}/auth/cli/hub-key`,i;try{i=await fetch(r,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${t}`},body:JSON.stringify({device_id:n})})}catch(e){throw Error(`Could not reach ${r} to mint a platform key: ${e instanceof Error?e.message:String(e)}`)}let a=await i.text(),o;try{o=JSON.parse(a)}catch{o=null}if(!i.ok||!o?.success){let e=typeof o?.error?.message==`string`?o.error.message:`HTTP ${i.status}`;throw Error(`Platform key minting failed: ${e}. Your sandbox session may have expired — run \`tangle auth login\`.`)}let s=o.data;if(typeof s?.api_key!=`string`||typeof s?.expires_at!=`string`||typeof s?.platform_url!=`string`)throw Error(`Platform key minting returned an unexpected response shape.`);return{key:s.api_key,expiresAt:s.expires_at,platformUrl:s.platform_url}}var mr=class{cache;fingerprint;constructor(e,t,n,r){this.profile=e,this.sandboxBaseUrl=t,this.sessionToken=n,this.deviceId=r,this.fingerprint=lr(t,n);let i=dr(e);this.cache=i&&i.sessionFingerprint===this.fingerprint?i:null}isFresh(e){return e!==null&&Date.parse(e.expiresAt)-Date.now()>6e4}async ensure(e=!1){if(!e&&this.isFresh(this.cache))return this.cache;let t={...await pr(this.sandboxBaseUrl,this.sessionToken,this.deviceId),sessionFingerprint:this.fingerprint};return this.cache=t,fr(this.profile,t),t}};function hr(e){if(!e)return!1;let t=e.trim().toLowerCase();return t===`1`||t===`true`||t===`yes`}function gr(e,t){return Cn({flag:e.baseUrl,...e.useCachedPlatformUrl?{cachedPlatformUrl:()=>dr(t)?.platformUrl}:{}})}function _r(e,t){let n=Yt(`sandbox`,e.profile),r=hn(e.apiKey,n),i=_n(e.apiKey,n),a=e.allowHubCapabilityToken&&process.env.TANGLE_HUB_CAPABILITY_TOKEN?.trim()||void 0;if(a&&i===`env`)throw Error(`Set exactly one of TANGLE_API_KEY or TANGLE_HUB_CAPABILITY_TOKEN, not both`);if(i===`flag`&&r)return{kind:`static`,apiKey:r,baseUrl:gr(e,n)};if(i===`env`&&r)return{kind:`static`,apiKey:a??r,baseUrl:gr(e,n)};if(a)return{kind:`static`,apiKey:a,baseUrl:gr(e,n)};if(!r)throw Error(`No API key found for profile '${n}'. Set TANGLE_API_KEY or run: tangle auth login${n===`default`?``:` --profile ${n}`}`);return r.startsWith(`sk-tan-`)||t?{kind:`static`,apiKey:r,baseUrl:gr(e,n)}:{kind:`managed`,profile:n,sandboxBaseUrl:bn(e.sandboxBaseUrl,n),sessionToken:r,deviceId:cn(),baseUrlOverride:e.baseUrl}}async function vr(e={}){let t=_r(e,e.hubKey===!1||hr(process.env.TANGLE_SKIP_HUB_KEY));if(t.kind===`static`)return{token:t.apiKey,baseUrl:t.baseUrl,minted:!1};let n=new mr(t.profile,t.sandboxBaseUrl,t.sessionToken,t.deviceId),r=await n.ensure();return{token:r.key,baseUrl:t.baseUrlOverride??r.platformUrl,refresh:async()=>(await n.ensure(!0)).key,minted:!0}}async function yr(e,t,n={}){let r=e=>{let r=new Headers(n.headers);return r.set(`Authorization`,`Bearer ${e}`),fetch(t,{...n,headers:r})},i=await r(e.token);return i.status!==401||!e.refresh?i:r(await e.refresh())}async function br(e={}){let t;try{t=await vr(e)}catch(e){return{reachable:!1,reason:e instanceof Error?e.message:String(e),refused:!0}}try{let e=await yr(t,`${t.baseUrl.replace(/\/+$/,``)}/v1/plans/current`);if(e.ok)return{reachable:!0,baseUrl:t.baseUrl};let n=e.status===401||e.status===403;return{reachable:!1,baseUrl:t.baseUrl,reason:n?`the platform refused this credential (HTTP ${e.status})`:`the platform answered HTTP ${e.status}`,refused:n}}catch(e){return{reachable:!1,baseUrl:t.baseUrl,reason:`could not reach ${t.baseUrl}: ${e instanceof Error?e.message:String(e)}`,refused:!1}}}async function xr(e){let t=_r(e,e.hubKey===!1||hr(process.env.TANGLE_SKIP_HUB_KEY));if(t.kind===`static`)return!e.apiKey&&process.env.TANGLE_API_KEY_FILE&&!process.env.TANGLE_HUB_CAPABILITY_TOKEN?new Ce({baseUrl:t.baseUrl,authHeaders:()=>({Authorization:`Bearer ${mn()}`})}):new Ce({baseUrl:t.baseUrl,apiKey:t.apiKey});let n=new mr(t.profile,t.sandboxBaseUrl,t.sessionToken,t.deviceId),r=await n.ensure();return new Ce({baseUrl:t.baseUrlOverride??r.platformUrl,authHeaders:async()=>({Authorization:`Bearer ${(await n.ensure()).key}`}),fetch:async(e,t)=>{let r=await fetch(e,t);if(r.status!==401)return r;let i=await n.ensure(!0),a=new Headers(t?.headers);return a.set(`Authorization`,`Bearer ${i.key}`),fetch(e,{...t,headers:a})}})}function Sr(e={}){return xr(e)}function R(e={}){return xr({...e,useCachedPlatformUrl:!0,allowHubCapabilityToken:!0})}function Cr(e){return e instanceof Date?e.toISOString():String(e)}function wr(e,t){return`Sandbox name is ambiguous: ${e}. Use a sandbox id instead.\n${t.map(e=>`- ${e.id} (status: ${e.status}, created: ${Cr(e.createdAt)})`).join(`
+`)}`}function Tr(e){return e.activeTeamId?`team:${e.activeTeamId}`:void 0}async function z(e,t,n,r={}){if(!r.nameOnly){let t=await e.get(n);if(t)return t;if(Dr(n))throw Error(`Sandbox not found: ${n}`)}let i=(await e.list({scope:Tr(t)})).filter(e=>e.name?.toLowerCase()===n.toLowerCase());if(i.length===0)throw Error(`Sandbox not found: ${n}`);if(i.length>1)throw Error(wr(n,i));return i[0]}const Er=/^sandbox-(?:(?:[a-z][a-z0-9-]*)-)?(?:[a-f0-9]{12}|[a-f0-9]{8}-[a-f0-9]{3})(?:-branch-[a-z0-9]+-[0-9]+)*$/;function Dr(e){return Er.test(e)}async function Or(e,t,n,r={}){try{return(await(await z(e,t,n,{nameOnly:r.name})).delete()).outcome}catch(e){if(!(e instanceof Error&&e.message===`Sandbox not found: ${n}`)||r.name||!r.retryCleanup&&!Dr(n))throw e}let i=await e.fetch(`/v1/sandboxes/${encodeURIComponent(n)}`,{method:`DELETE`});if(i.ok){let e=await i.json().catch(()=>({}));return e.outcome===`destroyed`||e.outcome===`already_absent`?e.outcome:`unknown`}let a=(await i.text()).trim();throw Error(`Sandbox cleanup failed for ${n} (HTTP ${i.status})${a?`: ${a}`:``}`)}async function B(e,t){if(e.status!==`stopped`)return e;let n=t?.resumeTimeoutMs??12e4;N(`Sandbox ${e.id} is stopped. Resuming...`);try{await e.resume({timeoutMs:n}),await e.waitFor(`running`,{timeoutMs:n})}catch(t){let r=t instanceof Error?t.message:String(t);throw Error(`Failed to resume sandbox ${e.id}: ${r}. Run \`tangle sandbox resume ${e.id} --timeout ${n}\` and retry.`)}return e}const kr=[`anthropic`,`openai`,`vercel-ai`,`mastra`,`mcp-local`,`claude-desktop`,`cursor`,`zed`];function Ar(e,t,n){switch(e){case`anthropic`:return`// pnpm add @anthropic-ai/sdk @tangle-network/sandbox
 import Anthropic from "@anthropic-ai/sdk";
 import { Sandbox } from "@tangle-network/sandbox";
 import { anthropicTools } from "@tangle-network/sandbox/agent";
@@ -121,28 +121,29 @@ await connect(new StdioServerTransport());`;case`claude-desktop`:return`// Add t
       }
     }
   }
-}`}}function En(e){return{anthropic:`Anthropic Messages API (Claude)`,openai:`OpenAI Chat Completions (function calling)`,"vercel-ai":`Vercel AI SDK (generateText / streamText)`,mastra:`Mastra agent framework`,"mcp-local":`Local MCP server bridge (stdio)`,"claude-desktop":`Claude Desktop config (uses local MCP)`,cursor:`Cursor config (uses local MCP)`,zed:`Zed config (uses local MCP)`}[e]}function Dn(){return new t(`connect`).description(`Print a copy-paste SDK integration snippet for one of: ${wn.join(`, `)} (to stream a local agent's telemetry to Intelligence, see 'tangle connect')`).argument(`<framework>`,wn.join(` | `)).option(`-i, --sandbox <id>`,`Sandbox ID to embed in the snippet`,`<SANDBOX_ID>`).option(`-s, --session <id>`,`Session ID to embed in the snippet`,`default`).action((e,t)=>{wn.includes(e)||(console.error(a.red(`unknown framework: ${e}`),`\nsupported: ${wn.join(`, `)}`),process.exit(2));let n=e;process.stdout.write(a.cyan(`# ${En(n)}\n\n`)),process.stdout.write(`${Tn(n,t.sandbox,t.session)}\n`)})}async function On(e){let{Writable:t}=await import(`node:stream`),n=await import(`node:readline`),r=!1,i=new t({write(e,t,n){r||process.stdout.write(e,t),n()}}),a=n.createInterface({input:process.stdin,output:i,terminal:!0});return process.stdout.write(e),r=!0,await new Promise(e=>{a.question(``,t=>{r=!1,a.close(),process.stdout.write(`
-`),e(t.trim())})})}async function H(e){let t=(await import(`node:readline`)).createInterface({input:process.stdin,output:process.stdout}),n=await new Promise(n=>{t.question(e,e=>{t.close(),n(e.trim().toLowerCase())})});return n===`y`||n===`yes`}async function U(e,t){let n=(await import(`node:readline`)).createInterface({input:process.stdin,output:process.stdout}),r=t?` [${t}]`:``;return await new Promise(t=>{n.question(`${e}${r}: `,e=>{n.close(),t(e.trim())})})||t||``}async function kn(){if(process.stdin.isTTY)throw Error(`Cannot read secret from stdin when stdin is a TTY`);let e=[];for await(let t of process.stdin)e.push(Buffer.isBuffer(t)?t:Buffer.from(t));return Buffer.concat(e).toString(`utf8`).replace(/\r?\n$/,``)}function An(){let e=new t(`profile`).description(`Create, inspect, and validate portable agent profiles`);return e.command(`create [output]`).description(`Create a profile — interactively (a wizard), or fully via flags`).option(`--name <name>`,`Profile name (when set, skips the wizard)`).option(`--description <text>`,`Profile description`).option(`--model <model>`,`Model (provider/model)`).option(`--system-prompt <text>`,`System prompt`).option(`--skills <ref...>`,`Skill refs: local path or github:<owner>/<repo>/<path>[@<ref>]`).option(`--tools <ref...>`,`Tool refs: local path or github:<owner>/<repo>/<path>[@<ref>]`).option(`--harness <name>`,`Harness hint shown in the run command`).option(`--json`,`Print the profile as JSON instead of writing a file`).action(async(e,t)=>{try{let n=t.name,r=t.description,i=t.harness,a=t.model,o=t.systemPrompt,s=t.skills??[],c=t.tools??[];if(!n&&process.stdin.isTTY&&(n=await U(`Profile name`,`my-agent`),r=await U(`Description (optional)`)||void 0,i=await U(`Harness`,`claude-code`)||void 0,a=await U(`Model (optional, provider/model)`)||void 0,o=await U(`System prompt (optional)`)||void 0,s=await jn(`Skill ref (local path or github:..., blank to finish)`),c=await jn(`Tool ref (blank to finish)`)),!n)throw Error(process.stdin.isTTY?`Profile name is required.`:"`agent profile create` needs at least --name in a non-interactive shell (no TTY to prompt). Pass --name <name> (and optionally --model/--skills/--tools/--system-prompt).");let l=Fe({model:a,systemPrompt:o,skills:s,tools:c}),u={...n?{name:n}:{},...r?{description:r}:{},...l??{}};if(t.json){k(u);return}let d=e??`agent-profile.json`;f(d,`${JSON.stringify(u,null,2)}\n`),M(`Wrote ${d}`),M(`Run it: tangle agent prompt <box> --profile ${d}${i?` --harness ${i}`:``}`)}catch(e){R(e,t.json)}}),e.command(`show <source>`).description(`Load and print a profile (local path, https URL, or github:owner/repo/path[@ref])`).action(async e=>{try{k(await Ie(e))}catch(e){R(e,!0)}}),e.command(`validate <source>`).description(`Check a profile loads and is a well-formed object`).action(async e=>{try{let t=await Ie(e);M(`OK — "${typeof t.name==`string`?t.name:`(unnamed)`}" loaded as a valid profile object`)}catch(e){R(e)}}),e}async function jn(e){let t=[];for(;;){let n=await U(e);if(!n)break;t.push(n)}return t}function Mn(e){let t=typeof e.type==`string`?e.type:void 0,n=t===`tool-invocation`||t===`tool_call`||t===`computer-use`||t===`computer_call`,r=e.toolInvocation??e.tool_invocation??e.computerUse??e.computer_use;if(!r&&!n)return;let i=r??e;if(t===`computer-use`||t===`computer_call`)return`computer-use:${i.action?.type??`action`}`;let a=i.toolName??i.tool_name??i.name;return typeof a==`string`&&a.length>0?a:void 0}function Nn(e){return([process.env.SANDBOX_WEB_URL,process.env.TANGLE_SANDBOX_WEB_URL].map(e=>e?.trim()).find(e=>!!e)??e).replace(/\/+$/,``)}function Pn(e){let t=e.toolInvocation??e.tool_invocation??e.computerUse??e.computer_use??e,n=t.state?.status,r=typeof t.status==`string`?t.status:void 0;return n??r}function Fn(e,t){if(process.exitCode=1,e.status===`blocked_on_approval`){console.error(a.yellow(`⚠ Blocked on a hub approval.`));let t=e.approval?.approvalId;console.error(t?`Approve it:  tangle hub approvals approve ${t}`:"Approve the pending request (`tangle hub approvals`), then re-run.");return}if(e.status===`awaiting_question`){console.error(a.yellow(`⚠ Agent is awaiting an answer to a question.`)),console.error(`Re-run with --interactive to answer it, or answer programmatically via box.session(<id>).answer({ ... }).`);return}console.error(a.red(`✗ ${e.error&&e.error.length>0?e.error:t}`))}function In(e,t){return process.exitCode=1,t&&k({status:`awaiting_question`,needsInput:e}),`Agent is awaiting an answer (questionId: ${e.questionId??`unknown`}). Re-run with --interactive to answer, or answer via box.session(<id>).answer({ ... }).`}function Ln(e){let t=e.part;if(t?.type===`text`)return t.text??t.content??void 0}function Rn(e){return e.finalText??e.response??e.output??e.content??e.text??void 0}function zn(e){if(typeof e==`string`)return e;try{return JSON.stringify(e)??``}catch{return String(e)}}function Bn(e,t=0){if(t>6||typeof e!=`object`||!e)return;let n=e,r=n.approval;if(r&&typeof r.id==`string`)return r.id;for(let e of Object.values(n)){let n=Bn(e,t+1);if(n)return n}}function Vn(e){let t=e?.toolInvocations;if(!Array.isArray(t))return;let n=t.find(e=>e?.isError===!0);if(n){if(zn(n.result).includes(`HUB_APPROVAL_REQUIRED`)){let e=Bn(n.result);return e?`Blocked on hub approval — approve with: tangle hub approvals approve ${e}`:"Blocked on hub approval — approve the pending request (`tangle hub approvals`) then re-run."}return`Tool "${n.toolName??`unknown`}" failed`}}function Hn(e){if(e.sawError){console.error(a.red(`✗ ${e.errorMsg??`Agent run failed`}`)),process.exitCode=1;return}let t=Date.now()-e.startedAt,n=e.tokenUsage,r=[`${t}ms`,n?.inputTokens===void 0?void 0:`${n.inputTokens} in`,n?.outputTokens===void 0?void 0:`${n.outputTokens} out`].filter(e=>!!e);console.log(a.green(`✓ Done`),a.dim(`(${r.join(`, `)})`))}function Un(e,t){let n=Mn(e);if(!n)return;let r=Pn(e),i=e.toolCallId??e.tool_call_id??e.callId??e.id,o=typeof i==`string`&&i.length>0?i:`${n}#${t.size}`;r===`running`||r===`in_progress`||r===void 0?t.has(o)||(t.add(o),console.log(a.dim(`\n[Tool: ${n}]`))):r===`completed`?console.log(a.dim(`[Tool ${n} completed]`)):(r===`failed`||r===`error`)&&console.log(a.yellow(`[Tool ${n} failed]`))}async function Wn(e,t,n){let r=``,i=!1,a,o,s,c=e=>{if(e.startsWith(r)){let t=e.slice(r.length);t&&process.stdout.write(t)}else process.stdout.write(e);r=e};try{for await(let t of e){switch(t.type){case`token`:{let e=t.data?.value;typeof e==`string`&&(process.stdout.write(e),r+=e);break}case`message.part.updated`:{let e=Ln(t.data);typeof e==`string`&&e.length>0&&c(e);break}case`raw`:n?.(t.data);break;case`result`:o=t.data;break;case`question`:{let e=t.data;s={questionId:e.questionId,questions:e.questions};break}case`error`:i=!0,a=t.data.message??JSON.stringify(t.data);break}if(s)break}}catch(e){i=!0,a=e instanceof Error?e.message:String(e)}if(s)return{awaitingQuestion:s,printed:r.length};if(r.length===0&&o){let e=Rn(o);typeof e==`string`&&e.length>0&&(process.stdout.write(e),r=e)}if(!i){let e=Vn(o);e&&(i=!0,a=e)}return{outcome:{sawError:i,errorMsg:a,startedAt:t,tokenUsage:o?.tokenUsage},resultData:o,printed:r.length}}function Gn(e){let t=Jt(e??[]);if(t.length!==0)return{profile:{connections:t}}}async function Kn(e){let t=Jt(e.connection??[]);if(t.length===0)throw Error(`--allow-writes needs at least one --connection to grant writes for.`);if(t.some(e=>e.connectionId===`*`))throw Error("--allow-writes needs explicit --connection ids; the `*:*` wildcard can't be bulk-granted. Grant per connection, e.g. --connection conn_x:* --allow-writes.");let n=await z({hubKey:e.hubKey});for(let r of t){let t=await n.permissions.allowWrites(r.connectionId);e.json||M(`Allowed ${t.writeActions} write action${t.writeActions===1?``:`s`} for connection ${r.connectionId} (${t.granted} newly granted).`)}e.json||M(`Revert anytime: ${t.map(e=>`tangle hub permissions revert-writes --connection ${e.connectionId}`).join(`  ·  `)}`)}async function qn(e){!e.connection||e.connection.length===0||(e.connection=await qt(e.connection,()=>z({hubKey:e.hubKey})))}async function Jn(e,t){let n=process.stdin,r=process.stdout,i=null,a=!1,o=!1,s,c=new Promise(e=>{s=e}),l=()=>{try{n.setRawMode(!1)}catch{}n.pause()},u=()=>{a||(a=!0,l(),n.off(`data`,p),process.off(`SIGWINCH`,f),process.off(`SIGINT`,d),process.off(`SIGTERM`,d),process.off(`exit`,l),s())},d=e=>{(i?.close()??Promise.resolve()).finally(()=>{u(),process.exit(e===`SIGTERM`?143:130)})},f=()=>{i?.isOpen&&i.resize(r.columns||80,r.rows||24)},p=e=>{if(!i)return;let t=e.indexOf(29);if(t===-1){i.write(e);return}t>0&&i.write(e.subarray(0,t)),i.close().finally(u)};if(i=await e.attach({cols:r.columns||80,rows:r.rows||24,handlers:{onData:e=>{r.write(Buffer.from(e.buffer,e.byteOffset,e.byteLength))},onExit:e=>{o=!0;let t=e.exitCode===void 0?``:` (code ${e.exitCode})`;r.write(`\r\n[interactive session exited${t}]\r\n`),i?.close().finally(u)},onError:e=>{r.write(`\r\n[terminal stream error: ${e.message}]\r\n`)},onClose:()=>u()}}),n.setRawMode(!0),n.resume(),n.on(`data`,p),process.on(`SIGWINCH`,f),process.on(`SIGINT`,d),process.on(`SIGTERM`,d),process.on(`exit`,l),await c,console.log(),o){M(`Interactive session ended.`);return}M(`Detached — the session keeps running.`),P({"Watch & drive":t})}function Yn(){let e=new t(`agent`).description(`Interact with AI agent`);return e.command(`prompt <idOrMessage> [message]`).description("Send a single prompt to the agent. With one arg it's the prompt and the box comes from `tangle use` / --box / TANGLE_SANDBOX; with two it's <id> <message>.").option(`--box <id>`,`Target sandbox (overrides the active one)`).option(`--session <id>`,`Continue existing session`).option(`--model <model>`,`Model to use`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`,`300000`).option(`--stream`,`Stream response in real-time`).option(`--interactive`,`Spawn the harness's interactive TUI in the sandbox, inject this prompt, and print a link to watch + drive the live session in the browser (omit for the default headless run)`).option(`--harness <name>`,`Harness that executes this run (claude-code, codex, kimi-code, opencode, pi, amp, hermes). Defaults to the sandbox's configured backend. The box ships all harnesses, so this is a per-run choice.`).option(`--profile <source>`,`Agent profile to run: a local JSON path, an https URL, or github:<owner>/<repo>/<path>[@<ref>]`).option(`--skills <ref...>`,`Attach skills (repeatable): a local file path, or github:<owner>/<repo>/<path>[@<ref>] to pull from a repo`).option(`--tools <ref...>`,`Attach tools (repeatable): a local file path, or github:<owner>/<repo>/<path>[@<ref>]`).option(`--system-prompt <text>`,`Override the agent's system prompt for this run`).option(`--connection <spec>`,"Grant a hub connection to the agent as MCP tools (repeatable). The connection is a connection id or a provider name. Modes: <connection>:<cap1>,<cap2> (least privilege, recommended), <connection>:* (all of one connection), or *:* (all connections). List connections with `tangle hub connections`; paths with `tangle hub tools search <keyword>`.",Kt,[]).option(`--allow-writes`,"Pre-approve every WRITE action of each granted --connection so the agent can write unattended (reads are already allowed; destructive actions still prompt). Revert with `tangle hub permissions revert-writes`.").option(`--no-hub-key`,`Do not auto-mint a platform Hub key for --allow-writes; use the stored credential as-is`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=t===void 0?e:t,o=t===void 0?Et(n.box):e,s=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),c=D(s);if(n.interactive){let e=[n.profile?`--profile`:null,n.skills?.length?`--skills`:null,n.tools?.length?`--tools`:null,n.systemPrompt?`--system-prompt`:null,n.connection?.length?`--connection`:null,n.allowWrites?`--allow-writes`:null].filter(e=>e!==null);if(e.length>0)throw Error(`${e.join(`, `)} ${e.length===1?`is`:`are`} not supported with --interactive: the interactive harness launches its own TUI and is configured by --harness/--model. Drop --interactive to run with a profile, or bake the agent into the box with \`tangle backend configure\`.`)}let l=await Ge({profileSource:n.profile,systemPrompt:n.systemPrompt,skills:n.skills,tools:n.tools});await qn(n);let u=Gn(n.connection);n.allowWrites&&await Kn(n);let d=l||u?{...l??{},...u?.profile??{}}:void 0,f=d||n.harness?{...n.harness?{type:n.harness}:{},...d?{profile:d}:{}}:void 0,p=await B(c,s,o);if(p=await V(p),n.interactive){let e=n.session??`int-${i()}`,t=n.harness??(await p.backend.status()).type,a=p.session(e).interactive(),c=N(`Starting interactive ${t} session...`);c.start();let l;try{l=await a.start({harness:t,...n.model?{model:n.model}:{}})}finally{c.stop()}try{await a.sendPrompt(r)}catch(e){throw await a.stop().catch(()=>void 0),e}let u=`${Nn(s.baseUrl)}/dashboard/sandbox/${encodeURIComponent(o)}?interactive=${encodeURIComponent(l.sessionId)}`;if(n.json){k({sessionId:l.sessionId,harness:l.harness,streamUrl:l.streamUrl,webUrl:u});return}M(`Interactive ${l.harness} session started — prompt sent.`),console.log(),P({"Watch & drive":u,Session:l.sessionId}),console.log(),M(`Open the link to watch the agent and type to take over. Send more prompts with --session ${l.sessionId} --interactive.`),process.stdin.isTTY===!0&&process.stdout.isTTY===!0&&(console.log(),M(`Attaching to the live session — press Ctrl-] to detach.`),await Jn(a,u));return}if(n.stream){M(`Streaming response...`),console.log();let e=Date.now(),t=await Wn(p.streamPrompt(r,{sessionId:n.session,model:n.model,timeoutMs:Number.parseInt(n.timeout,10),...f?{backend:f}:{}}),e);if(`awaitingQuestion`in t){t.printed>0&&console.log();let e=In(t.awaitingQuestion,n.json);n.json||console.error(a.yellow(`⚠ ${e}`));return}t.printed>0&&console.log(),Hn(t.outcome)}else{let e=N(`Processing prompt...`);e.start();let t=await p.prompt(r,{sessionId:n.session,model:n.model,timeoutMs:Number.parseInt(n.timeout,10),...f?{backend:f}:{}});e.stop(),n.json?(k(t),t.success===!1&&(process.exitCode=1)):t.success===!1?Fn(t,`Agent prompt failed`):(console.log(t.response),console.log(),P({Duration:`${t.durationMs}ms`,"Input Tokens":t.usage?.inputTokens,"Output Tokens":t.usage?.outputTokens}))}}catch(e){R(e,n.json)}}),e.command(`task <idOrPrompt> [prompt]`).description("Execute a multi-turn task. One arg = the task (box from `tangle use` / --box / TANGLE_SANDBOX); two = <id> <prompt>.").option(`--box <id>`,`Target sandbox (overrides the active one)`).option(`--session <id>`,`Continue existing session`).option(`--model <model>`,`Model to use`).option(`--max-turns <n>`,`Maximum turns`,`10`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`,`600000`).option(`--stream`,`Stream events in real-time`).option(`--connection <spec>`,"Grant a hub connection to the agent as MCP tools (repeatable). The connection is a connection id or a provider name. Modes: <connection>:<cap1>,<cap2> (least privilege, recommended), <connection>:* (all of one connection), or *:* (all connections). List connections with `tangle hub connections`; paths with `tangle hub tools search <keyword>`.",Kt,[]).option(`--allow-writes`,"Pre-approve every WRITE action of each granted --connection so the agent can write unattended (reads are already allowed; destructive actions still prompt). Revert with `tangle hub permissions revert-writes`.").option(`--no-hub-key`,`Do not auto-mint a platform Hub key for --allow-writes; use the stored credential as-is`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=t===void 0?e:t,i=t===void 0?Et(n.box):e,o=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),s=D(o);await qn(n);let c=Gn(n.connection);n.allowWrites&&await Kn(n);let l=await B(s,o,i);if(l=await V(l),n.stream){M(`Executing task...`),console.log();let e=new Set,t=Date.now(),i=await Wn(l.streamTask(r,{sessionId:n.session,model:n.model,maxTurns:Number.parseInt(n.maxTurns,10),timeoutMs:Number.parseInt(n.timeout,10),...c?{backend:c}:{}}),t,t=>Un(t,e));if(`awaitingQuestion`in i){i.printed>0&&console.log();let e=In(i.awaitingQuestion,n.json);n.json||console.error(a.yellow(`⚠ ${e}`));return}i.printed>0&&console.log(),Hn(i.outcome)}else{let e=N(`Executing task...`);e.start();let t=await l.task(r,{sessionId:n.session,model:n.model,maxTurns:Number.parseInt(n.maxTurns,10),timeoutMs:Number.parseInt(n.timeout,10),...c?{backend:c}:{}});e.stop(),n.json?(k(t),t.success===!1&&(process.exitCode=1)):t.success===!1?Fn(t,`Agent task failed`):(console.log(t.response),console.log(),P({"Session ID":t.sessionId,"Turns Used":t.turnsUsed,Duration:`${t.durationMs}ms`,"Input Tokens":t.usage?.inputTokens,"Output Tokens":t.usage?.outputTokens}))}}catch(e){R(e,n.json)}}),e.addCommand(Dn()),e.addCommand(An()),e}async function Xn(e){let t=e.timeoutMs??1e4,n=e.baseUrl.replace(/\/$/,``),r=`${n}/v1/account/me`;try{let n=await fetch(r,{headers:{Accept:`application/json`,Authorization:`Bearer ${e.apiKey}`},signal:AbortSignal.timeout(t)});if(!n.ok){let e=await Qn(n);throw n.status===401||n.status===403?new ie(e||`Invalid API key`):n.status>=500?new _(e||`Sandbox API returned an unexpected error`,n.status):Error(e||`Credential validation failed with status ${n.status}`)}let i=await n.json();if(!i.success||!i.data)throw Error(`Sandbox API returned an invalid account response`);return{customerId:i.data.customer_id,email:i.data.email,name:i.data.name,tier:i.data.tier,createdAt:i.data.created_at}}catch(e){throw e instanceof ie||e instanceof _||e instanceof se?e:e instanceof Error&&e.name===`AbortError`?new se(t,`Timed out validating credentials against ${n}`):e instanceof Error&&!(e instanceof TypeError)?e:new h(`Failed to reach ${n}`,Zn(e))}}function Zn(e){return e instanceof Error?e:void 0}async function Qn(e){let t=await e.text();if(t)try{let e=JSON.parse(t);return e.error?.message??e.message??t}catch{return t}}function $n(e){if(!tr(e.hostHeader))return{kind:`host-mismatch`};let t;try{t=new URL(e.requestUrl??`/`,`http://127.0.0.1`)}catch{return{kind:`not-found`}}if(t.pathname!==`/callback`)return{kind:`not-found`};if(t.searchParams.get(`state`)!==e.expectedState)return{kind:`state-mismatch`};let n=t.searchParams.get(`error`);if(n)return{kind:`error`,reason:n};let r=t.searchParams.get(`grant_token`);return r?{kind:`ok`,token:r}:{kind:`missing-token`}}async function er(e){let t=e.timeoutMs??12e4,n=e.baseUrl.replace(/\/$/,``),i=await import(`node:http`),a=r(32).toString(`hex`),o=null,s=null,c=new Promise((e,t)=>{o=e,s=t}),l=i.createServer((e,t)=>{try{let n=$n({hostHeader:e.headers.host,requestUrl:e.url,expectedState:a});switch(n.kind){case`host-mismatch`:t.writeHead(421,{"content-type":`text/plain; charset=utf-8`}),t.end(`Misdirected request`);return;case`not-found`:t.writeHead(404,{"content-type":`text/plain; charset=utf-8`}),t.end(`Not found`);return;case`state-mismatch`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(or(`State mismatch — refusing login`)),s?.(Error(`Browser login state mismatch — refusing potentially hijacked callback`));return;case`error`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(or(n.reason)),s?.(Error(`Browser login failed: ${n.reason}`));return;case`missing-token`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(or(null)),s?.(Error(`Browser login did not return a grant token`));return;case`ok`:t.writeHead(200,{"content-type":`text/html; charset=utf-8`}),t.end(or(null)),o?.(n.token);return}}catch(e){s?.(e instanceof Error?e:Error(`Browser login callback failed`))}});await new Promise((e,t)=>{l.once(`error`,t),l.listen(0,`127.0.0.1`,()=>e())});try{let r=l.address();if(!r||typeof r==`string`)throw Error(`Failed to bind local callback server`);let i=new URL(`http://127.0.0.1:${r.port}/callback`);i.searchParams.set(`state`,a);let o=new URL(`${n}/auth/cli/login`);o.searchParams.set(`callback_url`,i.toString()),e.provider&&o.searchParams.set(`provider`,e.provider);let s=await ir(o.toString());e.onLoginUrl?.({loginUrl:o.toString(),browserOpened:s});let u=await rr({baseUrl:n,grantToken:await nr(c,t),timeoutMs:t});return{apiKey:u.apiKey,email:u.email,name:u.name,tier:u.tier}}finally{await new Promise((e,t)=>{l.close(n=>{if(n){t(n);return}e()})}).catch(()=>void 0)}}function tr(e){if(!e)return!1;let t=e.toLowerCase().match(/^(\[[^\]]+\]|[^:]+)(?::\d+)?$/);if(!t)return!1;let n=t[1];return n===`127.0.0.1`||n===`localhost`||n===`[::1]`}async function nr(e,t){return await new Promise((n,r)=>{let i=setTimeout(()=>{r(new se(t,`Timed out waiting for browser login to complete`))},t);e.then(e=>{clearTimeout(i),n(e)},e=>{clearTimeout(i),r(e)})})}async function rr(e){let t=await fetch(`${e.baseUrl}/auth/cli/exchange`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify({grant_token:e.grantToken}),signal:AbortSignal.timeout(e.timeoutMs)}).catch(t=>{throw new h(`Failed to reach ${e.baseUrl}`,t instanceof Error?t:void 0)}),n=await t.json().catch(()=>null);if(!t.ok||!n?.success||!n.data?.api_key)throw Error(n?.error?.message||`Failed to exchange browser login grant`);return{apiKey:n.data.api_key,email:n.data.email,name:n.data.name,tier:n.data.tier}}async function ir(e){let{spawn:t}=await import(`node:child_process`),n=process.platform===`darwin`?[`open`,e]:process.platform===`win32`?[`cmd`,`/c`,`start`,``,e]:[`xdg-open`,e];return await new Promise(e=>{let r=t(n[0],n.slice(1),{detached:!0,stdio:`ignore`});r.once(`error`,()=>e(!1)),r.once(`spawn`,()=>{r.unref(),e(!0)})})}function ar(e){return e.replace(/&/g,`&amp;`).replace(/</g,`&lt;`).replace(/>/g,`&gt;`).replace(/"/g,`&quot;`).replace(/'/g,`&#39;`)}function or(e){return`<!doctype html>
+}`}}function jr(e){return{anthropic:`Anthropic Messages API (Claude)`,openai:`OpenAI Chat Completions (function calling)`,"vercel-ai":`Vercel AI SDK (generateText / streamText)`,mastra:`Mastra agent framework`,"mcp-local":`Local MCP server bridge (stdio)`,"claude-desktop":`Claude Desktop config (uses local MCP)`,cursor:`Cursor config (uses local MCP)`,zed:`Zed config (uses local MCP)`}[e]}function Mr(){return new t(`connect`).description(`Print a copy-paste SDK integration snippet for one of: ${kr.join(`, `)} (to stream a local agent's telemetry to Intelligence, see 'tangle connect')`).argument(`<framework>`,kr.join(` | `)).option(`-i, --sandbox <id>`,`Sandbox ID to embed in the snippet`,`<SANDBOX_ID>`).option(`-s, --session <id>`,`Session ID to embed in the snippet`,`default`).action((e,t)=>{kr.includes(e)||(console.error(y.red(`unknown framework: ${e}`),`\nsupported: ${kr.join(`, `)}`),process.exit(2));let n=e;process.stdout.write(y.cyan(`# ${jr(n)}\n\n`)),process.stdout.write(`${Ar(n,t.sandbox,t.session)}\n`)})}async function Nr(e){let{Writable:t}=await import(`node:stream`),n=await import(`node:readline`),r=!1,i=new t({write(e,t,n){r||process.stdout.write(e,t),n()}}),a=n.createInterface({input:process.stdin,output:i,terminal:!0});return process.stdout.write(e),r=!0,await new Promise(e=>{a.question(``,t=>{r=!1,a.close(),process.stdout.write(`
+`),e(t.trim())})})}async function Pr(e){let t=(await import(`node:readline`)).createInterface({input:process.stdin,output:process.stdout}),n=await new Promise(n=>{t.question(e,e=>{t.close(),n(e.trim().toLowerCase())})});return n===`y`||n===`yes`}async function Fr(e,t){let n=(await import(`node:readline`)).createInterface({input:process.stdin,output:process.stdout}),r=t?` [${t}]`:``;return await new Promise(t=>{n.question(`${e}${r}: `,e=>{n.close(),t(e.trim())})})||t||``}async function Ir(){if(process.stdin.isTTY)throw Error(`Cannot read secret from stdin when stdin is a TTY`);let e=[];for await(let t of process.stdin)e.push(Buffer.isBuffer(t)?t:Buffer.from(t));return Buffer.concat(e).toString(`utf8`).replace(/\r?\n$/,``)}function Lr(){let e=new t(`profile`).description(`Create, inspect, and validate portable agent profiles`);return e.command(`create [output]`).description(`Create a profile — interactively (a wizard), or fully via flags`).option(`--name <name>`,`Profile name (when set, skips the wizard)`).option(`--description <text>`,`Profile description`).option(`--model <model>`,`Model (provider/model)`).option(`--system-prompt <text>`,`System prompt`).option(`--skills <ref...>`,`Skill refs: local path or github:<owner>/<repo>/<path>[@<ref>]`).option(`--tools <ref...>`,`Tool refs: local path or github:<owner>/<repo>/<path>[@<ref>]`).option(`--harness <name>`,`Harness hint shown in the run command`).option(`--json`,`Print the profile as JSON instead of writing a file`).action(async(e,t)=>{try{let n=t.name,r=t.description,i=t.harness,a=t.model,o=t.systemPrompt,s=t.skills??[],c=t.tools??[];if(!n&&process.stdin.isTTY&&(n=await Fr(`Profile name`,`my-agent`),r=await Fr(`Description (optional)`)||void 0,i=await Fr(`Harness`,`claude-code`)||void 0,a=await Fr(`Model (optional, provider/model)`)||void 0,o=await Fr(`System prompt (optional)`)||void 0,s=await Rr(`Skill ref (local path or github:..., blank to finish)`),c=await Rr(`Tool ref (blank to finish)`)),!n)throw Error(process.stdin.isTTY?`Profile name is required.`:"`agent profile create` needs at least --name in a non-interactive shell (no TTY to prompt). Pass --name <name> (and optionally --model/--skills/--tools/--system-prompt).");let l=st({model:a,systemPrompt:o,skills:s,tools:c}),u={...n?{name:n}:{},...r?{description:r}:{},...l??{}};if(t.json){A(u);return}let d=e??`agent-profile.json`;ue(d,`${JSON.stringify(u,null,2)}\n`),N(`Wrote ${d}`),N(`Run it: tangle agent prompt <box> --profile ${d}${i?` --harness ${i}`:``}`)}catch(e){L(e,t.json)}}),e.command(`show <source>`).description(`Load and print a profile (local path, https URL, or github:owner/repo/path[@ref])`).action(async e=>{try{A(await ct(e))}catch(e){L(e,!0)}}),e.command(`validate <source>`).description(`Check a profile loads and is a well-formed object`).action(async e=>{try{let t=await ct(e);N(`OK — "${typeof t.name==`string`?t.name:`(unnamed)`}" loaded as a valid profile object`)}catch(e){L(e)}}),e}async function Rr(e){let t=[];for(;;){let n=await Fr(e);if(!n)break;t.push(n)}return t}function zr(e){return([process.env.SANDBOX_WEB_URL,process.env.TANGLE_SANDBOX_WEB_URL].map(e=>e?.trim()).find(e=>!!e)??e).replace(/\/+$/,``)}function Br(e,t){if(process.exitCode=1,e.status===`blocked_on_approval`){console.error(y.yellow(`⚠ Blocked on a hub approval.`));let t=e.approval?.approvalId;console.error(t?`Approve it:  tangle hub approvals approve ${t}`:"Approve the pending request (`tangle hub approvals`), then re-run.");return}if(e.status===`awaiting_question`){console.error(y.yellow(`⚠ Agent is awaiting an answer to a question.`)),console.error(`Re-run with --interactive to answer it, or answer programmatically via box.session(<id>).answer(<questionId>, { ... }).`);return}if(e.status===`awaiting_interaction`){console.error(y.yellow(`⚠ Agent is awaiting a response.`)),console.error(`Open an interactive session, or answer the canonical interaction through the Sandbox SDK.`);return}if(e.status===`awaiting_plan_decision`){console.error(y.yellow(`⚠ Agent is awaiting a plan decision.`)),console.error(`Approve or reject the pending plan before continuing.`);return}console.error(y.red(`✗ ${e.error&&e.error.length>0?e.error:t}`))}function Vr(e){let t=e.part;if(t?.type===`text`)return t.text??t.content??void 0}function Hr(e){return e.finalText??e.response??e.output??e.content??e.text??void 0}function Ur(e){if(!e.result.success){Br(e.result,`Agent run failed`);return}let t=Date.now()-e.startedAt,n=e.tokenUsage,r=[`${t}ms`,n?.inputTokens===void 0?void 0:`${n.inputTokens} in`,n?.outputTokens===void 0?void 0:`${n.outputTokens} out`].filter(e=>!!e);console.log(y.green(`✓ Done`),y.dim(`(${r.join(`, `)})`))}async function Wr(e,t,n=!0){let r=``,i,a=ee(),o=e=>{if(e.startsWith(r)){let t=e.slice(r.length);t&&n&&process.stdout.write(t)}else n&&process.stdout.write(e);r=e};try{for await(let t of e)switch(a.observe(t),t.type){case`token`:{let e=t.data?.value;typeof e==`string`&&(n&&process.stdout.write(e),r+=e);break}case`message.part.updated`:{let e=Vr(t.data);typeof e==`string`&&e.length>0&&o(e);break}case`raw`:break;case`result`:i=t.data;break}}catch(e){a.observe({type:`error`,data:{message:e instanceof Error?e.message:String(e)}})}if(r.length===0&&i){let e=Hr(i);typeof e==`string`&&e.length>0&&(n&&process.stdout.write(e),r=e)}return{outcome:{result:a.finish(),startedAt:t,tokenUsage:i?.tokenUsage},resultData:i,printed:r.length,...r.length>0?{response:r}:{}}}function Gr(e){let t=Hn(e??[]);if(t.length!==0)return{profile:{connections:t}}}function Kr(e,t,n,r,i,s){let c={...r??{},harness:n,...i?{model:{...r?.model??{},default:i}}:{}},l={profile:c,requestedProfileDigest:o(c),initialPrompt:s};return{...l,run:a({provider:`tangle-sandbox`,environmentId:e,sessionId:t,executionId:`interactive-execution-${t}`},l)}}async function qr(e){let t=Hn(e.connection??[]);if(t.length===0)throw Error(`--allow-writes needs at least one --connection to grant writes for.`);if(t.some(e=>e.connectionId===`*`))throw Error("--allow-writes needs explicit --connection ids; the `*:*` wildcard can't be bulk-granted. Grant per connection, e.g. --connection conn_x:* --allow-writes.");let n=await R({hubKey:e.hubKey});for(let r of t){let t=await n.permissions.allowWrites(r.connectionId);e.json||N(`Allowed ${t.writeActions} write action${t.writeActions===1?``:`s`} for connection ${r.connectionId} (${t.granted} newly granted).`)}e.json||N(`Revert anytime: ${t.map(e=>`tangle hub permissions revert-writes --connection ${e.connectionId}`).join(`  ·  `)}`)}async function Jr(e){!e.connection||e.connection.length===0||(e.connection=await Vn(e.connection,()=>R({hubKey:e.hubKey})))}async function Yr(e,t){let n=process.stdin,r=process.stdout,i=null,a=!1,o=!1,s,c=new Promise(e=>{s=e}),l=()=>{try{n.setRawMode(!1)}catch{}n.pause()},u=()=>{a||(a=!0,l(),n.off(`data`,p),process.off(`SIGWINCH`,f),process.off(`SIGINT`,d),process.off(`SIGTERM`,d),process.off(`exit`,l),s())},d=e=>{(i?.close()??Promise.resolve()).finally(()=>{u(),process.exit(e===`SIGTERM`?143:130)})},f=()=>{i?.isOpen&&i.resize(r.columns||80,r.rows||24)},p=e=>{if(!i)return;let t=e.indexOf(29);if(t===-1){i.write(e);return}t>0&&i.write(e.subarray(0,t)),i.close().finally(u)};if(i=await e.attach({cols:r.columns||80,rows:r.rows||24,handlers:{onData:e=>{r.write(Buffer.from(e.buffer,e.byteOffset,e.byteLength))},onExit:e=>{o=!0;let t=e.exitCode===void 0?``:` (code ${e.exitCode})`;r.write(`\r\n[interactive session exited${t}]\r\n`),i?.close().finally(u)},onError:e=>{r.write(`\r\n[terminal stream error: ${e.message}]\r\n`)},onClose:()=>u()}}),n.setRawMode(!0),n.resume(),n.on(`data`,p),process.on(`SIGWINCH`,f),process.on(`SIGINT`,d),process.on(`SIGTERM`,d),process.on(`exit`,l),await c,console.log(),o){N(`Interactive session ended.`);return}N(`Detached — the session keeps running.`),F({"Watch & drive":t})}function Xr(){let e=new t(`agent`).description(`Interact with AI agent`);return e.command(`prompt <idOrMessage> [message]`).description("Send a single prompt to the agent. With one arg it's the prompt and the box comes from `tangle use` / --box / TANGLE_SANDBOX; with two it's <id> <message>.").option(`--box <id>`,`Target sandbox (overrides the active one)`).option(`--session <id>`,`Continue existing session`).option(`--model <model>`,`Model to use`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`,`300000`).option(`--stream`,`Stream response in real-time`).option(`--interactive`,`Spawn the harness's interactive TUI in the sandbox, inject this prompt, and print a link to watch + drive the live session in the browser (omit for the default headless run)`).option(`--harness <name>`,`Harness that executes this run (claude-code, codex, kimi-code, opencode, pi, amp, hermes). Defaults to the sandbox's configured backend. The box ships all harnesses, so this is a per-run choice.`).option(`--profile <source>`,`Agent profile to run: a local JSON path, an https URL, or github:<owner>/<repo>/<path>[@<ref>]`).option(`--skills <ref...>`,`Attach skills (repeatable): a local file path, or github:<owner>/<repo>/<path>[@<ref>] to pull from a repo`).option(`--tools <ref...>`,`Attach tools (repeatable): a local file path, or github:<owner>/<repo>/<path>[@<ref>]`).option(`--system-prompt <text>`,`Override the agent's system prompt for this run`).option(`--connection <spec>`,"Grant a hub connection to the agent as MCP tools (repeatable). The connection is a connection id or a provider name. Modes: <connection>:<cap1>,<cap2> (least privilege, recommended), <connection>:* (all of one connection), or *:* (all connections). List connections with `tangle hub connections`; paths with `tangle hub tools search <keyword>`.",Bn,[]).option(`--allow-writes`,"Pre-approve every WRITE action of each granted --connection so the agent can write unattended (reads are already allowed; destructive actions still prompt). Revert with `tangle hub permissions revert-writes`.").option(`--no-hub-key`,`Do not auto-mint a platform Hub key for --allow-writes; use the stored credential as-is`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=t===void 0?e:t,a=t===void 0?ln(n.box):e,o=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),s=O(o),c=await _t({profileSource:n.profile,systemPrompt:n.systemPrompt,skills:n.skills,tools:n.tools});await Jr(n);let l=Gr(n.connection);n.allowWrites&&await qr(n);let u=c||l?{...c,...l?.profile}:void 0,d=n.harness,f=u||d||n.model?{...d?{type:d}:{},...u?{profile:u}:{},...n.model?{model:{model:n.model}}:{}}:void 0,p=await z(s,o,a);if(p=await B(p),n.interactive){let e=n.session??`int-${i()}`,t=d??(await p.backend.status()).type,s=Kr(a,e,t,u,n.model,r),c=p.session(e).interactive(),l=P(`Starting interactive ${t} session...`);l.start();let f;try{f=await c.start(s)}finally{l.stop()}let m=f.ref.preparationReceipt.harness,h=f.state===`running`?f.streamUrl:void 0,g=`${zr(o.baseUrl)}/dashboard/sandbox/${encodeURIComponent(a)}?interactive=${encodeURIComponent(f.ref.run.sessionId)}`;if(n.json){A({state:f.state,sessionId:f.ref.run.sessionId,harness:m,...h?{streamUrl:h}:{},webUrl:g});return}if(N(`Interactive ${m} session ${f.state}.`),console.log(),F({...f.state===`running`?{"Watch & drive":g}:{},Session:f.ref.run.sessionId}),console.log(),f.state===`exited`){N(`The initial prompt completed with reason: ${f.reason}.`);return}N(`Open the link to watch the agent and type to take over.`),process.stdin.isTTY===!0&&process.stdout.isTTY===!0&&(console.log(),N(`Attaching to the live session — press Ctrl-] to detach.`),await Yr(c,g));return}if(n.stream){n.json||(N(`Streaming response...`),console.log());let e=Date.now(),t=await Wr(p.streamPrompt(r,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10),...f?{backend:f}:{}}),e,!n.json);n.json?(A({...t.outcome.result,...t.response?{response:t.response}:{},...t.outcome.tokenUsage?{tokenUsage:t.outcome.tokenUsage}:{},durationMs:Date.now()-e}),t.outcome.result.success||(process.exitCode=1)):(t.printed>0&&console.log(),Ur(t.outcome))}else{let e=P(`Processing prompt...`);e.start();let t=await p.prompt(r,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10),...f?{backend:f}:{}});e.stop(),n.json?(A(t),t.success===!1&&(process.exitCode=1)):t.success===!1?Br(t,`Agent prompt failed`):(console.log(t.response),console.log(),F({Duration:`${t.durationMs}ms`,"Input Tokens":t.usage?.inputTokens,"Output Tokens":t.usage?.outputTokens}))}}catch(e){L(e,n.json)}}),e.addCommand(Mr()),e.addCommand(Lr()),e}async function Zr(e){let t=e.timeoutMs??1e4,n=e.baseUrl.replace(/\/$/,``),r=`${n}/v1/account/me`;try{let n=await fetch(r,{headers:{Accept:`application/json`,Authorization:`Bearer ${e.apiKey}`},signal:AbortSignal.timeout(t)});if(!n.ok){let e=await $r(n);throw n.status===401||n.status===403?new l(e||`Invalid API key`):n.status>=500?new m(e||`Sandbox API returned an unexpected error`,n.status):Error(e||`Credential validation failed with status ${n.status}`)}let i=await n.json();if(!i.success||!i.data)throw Error(`Sandbox API returned an invalid account response`);return{customerId:i.data.customer_id,email:i.data.email,name:i.data.name,tier:i.data.tier,createdAt:i.data.created_at}}catch(e){throw e instanceof l||e instanceof m||e instanceof g?e:e instanceof Error&&e.name===`AbortError`?new g(t,`Timed out validating credentials against ${n}`):e instanceof Error&&!(e instanceof TypeError)?e:new u(`Failed to reach ${n}`,Qr(e))}}function Qr(e){return e instanceof Error?e:void 0}async function $r(e){let t=await e.text();if(t)try{let e=JSON.parse(t);return e.error?.message??e.message??t}catch{return t}}function ei(e){if(!ni(e.hostHeader))return{kind:`host-mismatch`};let t;try{t=new URL(e.requestUrl??`/`,`http://127.0.0.1`)}catch{return{kind:`not-found`}}if(t.pathname!==`/callback`)return{kind:`not-found`};if(t.searchParams.get(`state`)!==e.expectedState)return{kind:`state-mismatch`};let n=t.searchParams.get(`error`);if(n)return{kind:`error`,reason:n};let r=t.searchParams.get(`grant_token`);return r?{kind:`ok`,token:r}:{kind:`missing-token`}}async function ti(e){let t=e.timeoutMs??12e4,n=e.baseUrl.replace(/\/$/,``),i=await import(`node:http`),a=r(32).toString(`hex`),o=null,s=null,c=new Promise((e,t)=>{o=e,s=t}),l=i.createServer((e,t)=>{try{let n=ei({hostHeader:e.headers.host,requestUrl:e.url,expectedState:a});switch(n.kind){case`host-mismatch`:t.writeHead(421,{"content-type":`text/plain; charset=utf-8`}),t.end(`Misdirected request`);return;case`not-found`:t.writeHead(404,{"content-type":`text/plain; charset=utf-8`}),t.end(`Not found`);return;case`state-mismatch`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(si(`State mismatch — refusing login`)),s?.(Error(`Browser login state mismatch — refusing potentially hijacked callback`));return;case`error`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(si(n.reason)),s?.(Error(`Browser login failed: ${n.reason}`));return;case`missing-token`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(si(null)),s?.(Error(`Browser login did not return a grant token`));return;case`ok`:t.writeHead(200,{"content-type":`text/html; charset=utf-8`}),t.end(si(null)),o?.(n.token);return}}catch(e){s?.(e instanceof Error?e:Error(`Browser login callback failed`))}});await new Promise((e,t)=>{l.once(`error`,t),l.listen(0,`127.0.0.1`,()=>e())});try{let r=l.address();if(!r||typeof r==`string`)throw Error(`Failed to bind local callback server`);let i=new URL(`http://127.0.0.1:${r.port}/callback`);i.searchParams.set(`state`,a);let o=new URL(`${n}/auth/cli/login`);o.searchParams.set(`callback_url`,i.toString()),e.provider&&o.searchParams.set(`provider`,e.provider);let s=await ai(o.toString());e.onLoginUrl?.({loginUrl:o.toString(),browserOpened:s});let u=await ii({baseUrl:n,grantToken:await ri(c,t),timeoutMs:t});return{apiKey:u.apiKey,email:u.email,name:u.name,tier:u.tier}}finally{await new Promise((e,t)=>{l.close(n=>{if(n){t(n);return}e()})}).catch(()=>void 0)}}function ni(e){if(!e)return!1;let t=e.toLowerCase().match(/^(\[[^\]]+\]|[^:]+)(?::\d+)?$/);if(!t)return!1;let n=t[1];return n===`127.0.0.1`||n===`localhost`||n===`[::1]`}async function ri(e,t){return await new Promise((n,r)=>{let i=setTimeout(()=>{r(new g(t,`Timed out waiting for browser login to complete`))},t);e.then(e=>{clearTimeout(i),n(e)},e=>{clearTimeout(i),r(e)})})}async function ii(e){let t=await fetch(`${e.baseUrl}/auth/cli/exchange`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify({grant_token:e.grantToken}),signal:AbortSignal.timeout(e.timeoutMs)}).catch(t=>{throw new u(`Failed to reach ${e.baseUrl}`,t instanceof Error?t:void 0)}),n=await t.json().catch(()=>null);if(!t.ok||!n?.success||!n.data?.api_key)throw Error(n?.error?.message||`Failed to exchange browser login grant`);return{apiKey:n.data.api_key,email:n.data.email,name:n.data.name,tier:n.data.tier}}async function ai(e){let{spawn:t}=await import(`node:child_process`),n=process.platform===`darwin`?[`open`,e]:process.platform===`win32`?[`cmd`,`/c`,`start`,``,e]:[`xdg-open`,e];return await new Promise(e=>{let r=t(n[0],n.slice(1),{detached:!0,stdio:`ignore`});r.once(`error`,()=>e(!1)),r.once(`spawn`,()=>{r.unref(),e(!0)})})}function oi(e){return e.replace(/&/g,`&amp;`).replace(/</g,`&lt;`).replace(/>/g,`&gt;`).replace(/"/g,`&quot;`).replace(/'/g,`&#39;`)}function si(e){return`<!doctype html>
 <html lang="en">
   <head>
     <meta charset="utf-8" />
     <title>Sandbox CLI Login</title>
   </head>
   <body>
-    <p>${e?`Sandbox CLI login failed: ${ar(e)}`:`Sandbox CLI login complete. You can close this window.`}</p>
+    <p>${e?`Sandbox CLI login failed: ${oi(e)}`:`Sandbox CLI login complete. You can close this window.`}</p>
   </body>
-</html>`}const sr=15*6e4;function cr(e){return Number.isFinite(e)&&e>0?e:sr}async function lr(e){let t=e.timeoutMs??sr,n=Date.now(),r=await ur({baseUrl:e.baseUrl,timeoutMs:t,provider:e.provider});for(e.onInstructions?.({userCode:r.user_code,verificationUrl:r.verification_uri,verificationUrlComplete:r.verification_uri_complete,expiresIn:r.expires_in,intervalSeconds:r.interval});;){if(Date.now()-n>t)throw new se(t,`Timed out waiting for device authorization to complete`);let i=await dr({baseUrl:e.baseUrl,deviceCode:r.device_code,timeoutMs:t});if(i.status===`approved`)return i.data;let a=i.intervalSeconds*1e3;await new Promise(e=>setTimeout(e,a))}}async function ur(e){let t=cr(e.timeoutMs),n=await fetch(`${fr(e.baseUrl)}/auth/cli/device/start`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify(e.provider?{provider:e.provider}:{}),signal:AbortSignal.timeout(t)}).catch(t=>{throw new h(`Failed to reach ${e.baseUrl}`,t instanceof Error?t:void 0)}),r=await n.json().catch(()=>null);if(!n.ok||!r?.success||!r.data?.device_code)throw Error(r?.error?.message||`Failed to start device login`);return r.data}async function dr(e){let t=cr(e.timeoutMs),n=await fetch(`${fr(e.baseUrl)}/auth/cli/device/poll`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify({device_code:e.deviceCode}),signal:AbortSignal.timeout(t)}).catch(t=>{throw new h(`Failed to reach ${e.baseUrl}`,t instanceof Error?t:void 0)}),r=await n.json().catch(()=>null);if(n.status===428&&r?.error?.code===`AUTHORIZATION_PENDING`)return{status:`pending`,intervalSeconds:typeof r.data?.interval==`number`&&r.data.interval>0?r.data.interval:5};if(!n.ok||!r?.success||!r.data?.api_key||!r.data.email)throw Error(r?.error?.message||`Failed to complete device authorization`);return{status:`approved`,data:{apiKey:r.data.api_key,email:r.data.email,name:r.data.name,tier:r.data.tier}}}function fr(e){return e.replace(/\/$/,``)}function pr(){let e=new t(`auth`).description(`Manage authentication`);e.command(`login`).description(`Authenticate with browser login or an API key`).option(`--api-key <key>`,`API key`).option(`--no-browser`,`Use device-code login instead of opening a browser`).option(`--profile <name>`,`Profile name`).option(`--provider <provider>`,`Identity provider (github, google, microsoft)`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=e.apiKey,n=S(e.profile),r=yr(e.provider),i=Mt(e.baseUrl,n),a=e.browser!==!1;if(!t){if(a){let a=N(`Starting browser login...`);a.start();let o=await er({baseUrl:i,provider:r,onLoginUrl:({loginUrl:e,browserOpened:t})=>{a.stop(),M(t?`Browser login opened.`:`Open this URL to continue browser login:`),console.log(e)}}).finally(()=>{a.stop()});t=o.apiKey,gr({profile:n,apiKey:t,baseUrl:e.baseUrl?i:void 0}),Ht(),A(`Authenticated`),P({Profile:n,Email:o.email,Tier:o.tier,"Base URL":i}),M(_r);return}let o=N(`Starting device login...`);o.start();let s=await lr({baseUrl:i,provider:r,onInstructions:({userCode:e,verificationUrl:t,verificationUrlComplete:n})=>{o.stop(),M(`Complete login in a browser on any device:`),P({"Verification URL":t,"Verification URL (prefilled)":n,"Device Code":e})}}).finally(()=>{o.stop()});t=s.apiKey,gr({profile:n,apiKey:t,baseUrl:e.baseUrl?i:void 0}),Ht(),A(`Authenticated`),P({Profile:n,Email:s.email,Tier:s.tier,"Base URL":i}),M(_r);return}t||(j(`No API key provided.`),process.exit(1)),vt(t)||(j(`Invalid API key format. Keys should start with 'sk_' or 'sk-tan-'.`),process.exit(1));let o=N(`Validating credentials...`);o.start();let s=await Xn({apiKey:t,baseUrl:i});o.stop(),gr({profile:n,apiKey:t,baseUrl:e.baseUrl?i:void 0}),Ht(),A(`Authenticated`),P({Profile:n,Email:s.email,Tier:s.tier,"Base URL":i}),M(_r)}catch(e){R(e)}}),e.command(`logout`).description(`Remove stored credentials`).option(`--profile <name>`,`Profile name`).action(e=>{try{let t=S(e.profile);At(t),Ht(),A(`Logged out successfully.`),M(`Credentials removed for profile '${t}'.`)}catch(e){R(e)}}),e.command(`status`).description(`Show current authentication status`).option(`--json`,`Output as JSON`).option(`--profile <name>`,`Profile name`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=S(e.profile),n=C(e.apiKey,t),r=Mt(e.baseUrl,t),i=jt(e.apiKey,t);if(!n){if(e.json){k({authenticated:!1,reason:`missing_credentials`,profile:t,baseUrl:r,credentialSource:null});return}j(`Not authenticated`),M(`Run 'tangle auth login --profile ${t}' to authenticate.`),process.exit(1)}let a=e.json?null:N(`Checking credentials...`);a?.start();try{let o=await Xn({apiKey:n,baseUrl:r});if(a?.stop(),e.json){k({authenticated:!0,profile:t,baseUrl:r,credentialSource:i,account:o});return}A(`Authenticated`),P({Profile:t,"API Key":mr(n),"Base URL":r,Source:hr(i),Email:o.email,Tier:o.tier})}catch(o){a?.stop(),e.json&&(k({authenticated:!1,profile:t,baseUrl:r,credentialSource:i,error:o instanceof Error?o.message:String(o)}),process.exit(1)),o instanceof ie?j(`Stored credentials are invalid.`):$t(`Stored credentials found, but validation could not complete.`),P({Profile:t,"API Key":mr(n),"Base URL":r,Source:hr(i),Error:o instanceof Error?o.message:String(o)}),process.exit(1)}}catch(e){R(e)}});let n=new t(`profiles`).description(`Manage CLI profiles`);return n.command(`list`).description(`List configured profiles`).option(`--json`,`Output as JSON`).action(e=>{try{let t=Dt();if(e.json){k(t);return}if(t.length===0){M(`No profiles found.`);return}L([`Profile`,`Active`,`Base URL`,`Credentials`,`Source`],t.map(e=>[e.name,e.active?`yes`:`no`,e.baseUrl,e.hasApiKey?`configured`:`none`,e.apiKeySource]))}catch(e){R(e)}}),n.command(`use <name>`).description(`Set the active profile`).action(e=>{try{xt(e);let t=Ot(e);A(`Active profile set to '${t.name}'.`),P({"Base URL":t.baseUrl,Credentials:t.credentialSource===`none`?`missing`:`configured`})}catch(e){R(e)}}),n.command(`current`).description(`Show the active profile`).option(`--json`,`Output as JSON`).action(e=>{try{let t=Ot();if(e.json){k(t);return}P({Profile:t.name,"Base URL":t.baseUrl,Credentials:t.credentialSource===`none`?`missing`:`configured`,Source:hr(t.credentialSource)})}catch(e){R(e)}}),e.addCommand(n),e}function mr(e){return e.length<=14?e:`${e.slice(0,10)}...${e.slice(-4)}`}function hr(e){switch(e){case`flag`:return`command flag`;case`env`:return`environment`;case`keychain`:return`OS keychain`;case`file`:return`credentials file`;case`legacy-file`:return`legacy credentials file`;default:return`unknown`}}function gr(e){let t=kt(e.profile,{apiKey:e.apiKey,...e.baseUrl?{baseUrl:e.baseUrl}:{}});xt(e.profile),bt({...e.baseUrl&&e.profile===`default`?{baseUrl:e.baseUrl}:{}}),_r=vr(e.profile,t)}let _r=`Credentials updated.`;function vr(e,t){return t===`keychain`?e===`default`?`API key saved to the OS keychain for the default profile`:`API key saved to the OS keychain for profile '${e}'`:t===`file`?e===`default`?`API key saved to ~/.tangle/credentials.json for the default profile`:`API key saved to ~/.tangle/credentials.json for profile '${e}'`:`Profile '${e}' updated.`}function yr(e){if(e===void 0||e===`github`||e===`google`||e===`microsoft`)return e;throw Error(`--provider must be one of: github, google, microsoft`)}function br(){let e=new t(`backend`).description(`Manage sandbox AI agent backend`);return e.command(`status <sandboxId-or-name>`).description(`Get backend agent status`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Fetching backend status...`);i.start();let a=await(await B(r,n,e)).backend.status();i.stop(),t.json?k(a):(M(`Backend Type: ${a.type}`),M(`Status: ${a.status}`),a.version&&M(`Version: ${a.version}`),a.error&&M(`Error: ${a.error}`),a.metadata&&M(`Metadata: ${JSON.stringify(a.metadata,null,2)}`))}catch(e){R(e)}}),e.command(`capabilities <sandboxId-or-name>`).description(`Get backend capabilities`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Fetching capabilities...`);i.start();let a=await(await B(r,n,e)).backend.capabilities();i.stop(),t.json?k(a):(M(`Backend Capabilities:`),M(`  Streaming: ${a.streaming?`✓`:`✗`}`),M(`  Tool Use: ${a.toolUse?`✓`:`✗`}`),M(`  Reasoning: ${a.reasoning?`✓`:`✗`}`),M(`  Multimodal: ${a.multimodal?`✓`:`✗`}`),M(`  Context Window: ${a.contextWindow.toLocaleString()} tokens`))}catch(e){R(e)}}),e.command(`configure <sandboxId-or-name>`).description(`Update backend configuration`).option(`--model <model>`,`Model string (format: provider/model)`).option(`--max-thinking-tokens <n>`,`Maximum thinking tokens`).option(`--profile <name>`,`Backend profile name`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Updating backend config...`);i.start();let a=await B(r,n,e),o={};if(t.profile&&(o.profile=t.profile),t.model||t.maxThinkingTokens){if(o.model={},t.model){let e=t.model.split(`/`);e.length>=2?(o.model.provider=e[0],o.model.model=e.slice(1).join(`/`)):o.model.model=t.model}t.maxThinkingTokens&&(o.model.maxThinkingTokens=Number.parseInt(t.maxThinkingTokens,10))}await a.backend.updateConfig(o),i.stop(),A(`Backend configuration updated`),t.json&&k(o)}catch(e){R(e)}}),e.command(`add-mcp <sandboxId-or-name>`).description(`Add an MCP server to the backend`).requiredOption(`--name <name>`,`MCP server name`).requiredOption(`--command <cmd>`,`Command to run (e.g., npx)`).option(`--args <args...>`,`Command arguments`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`--cwd <dir>`,`Working directory`).option(`--url <url>`,`Remote MCP server URL (for SSE)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Adding MCP server...`);i.start();let a=await B(r,n,e),o={};if(t.env)for(let e of t.env){let[t,...n]=e.split(`=`);t&&n.length>0&&(o[t]=n.join(`=`))}await a.backend.addMcp(t.name,{command:t.command,args:t.args,env:Object.keys(o).length>0?o:void 0,cwd:t.cwd,url:t.url}),i.stop(),A(`MCP server "${t.name}" added`),t.json&&k({name:t.name,command:t.command,args:t.args,env:Object.keys(o).length>0?o:void 0,cwd:t.cwd,url:t.url})}catch(e){R(e)}}),e.command(`mcp-status <sandboxId-or-name>`).description(`Get status of MCP servers`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Fetching MCP status...`);i.start();let a=await(await B(r,n,e)).backend.getMcpStatus();if(i.stop(),t.json)k(a);else{let e=Object.entries(a);e.length===0?M(`No MCP servers configured`):O(e.map(([e,t])=>{let n=t;return{name:e,status:n.status,error:n.error??``}}),[{key:`name`,header:`Name`,width:24},{key:`status`,header:`Status`,width:12},{key:`error`,header:`Error`,width:40}])}}catch(e){R(e)}}),e.command(`restart <sandboxId-or-name>`).description(`Restart the backend agent`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Restarting backend...`);i.start(),await(await B(r,n,e)).backend.restart(),i.stop(),A(`Backend restarted`)}catch(e){R(e)}}),e}function xr(e){let t=e.indexOf(`=`);if(t<=0)throw Error(`Invalid --task "${e}": expected format id=message (e.g. t1=summarize README)`);let n=e.slice(0,t).trim(),r=e.slice(t+1).trim();if(!n||!r)throw Error(`Invalid --task "${e}": id and message must be non-empty`);return{id:n,message:r}}function Sr(e){let t;try{t=JSON.parse(e)}catch(e){throw Error(`--tasks file is not valid JSON: ${e.message}`)}let n=Array.isArray(t)?t:t?.tasks;if(!Array.isArray(n))throw Error(`--tasks file must contain an array or an object with a "tasks" array`);return n.map((e,t)=>{if(!e||typeof e!=`object`)throw Error(`--tasks[${t}] must be an object`);let n=e,r=typeof n.id==`string`?n.id.trim():``,i=typeof n.message==`string`?n.message:``;if(!r)throw Error(`--tasks[${t}].id must be a non-empty string`);if(!i.trim())throw Error(`--tasks[${t}].message must be a non-empty string`);let a={id:r,message:i};return n.context&&typeof n.context==`object`&&(a.context=n.context),typeof n.timeoutMs==`number`&&n.timeoutMs>0&&(a.timeoutMs=n.timeoutMs),a})}function Cr(e){let t=e.readFile??(e=>u(e,`utf8`)),n=[];e.file&&n.push(...Sr(t(e.file)));for(let t of e.inline??[])n.push(xr(t));if(n.length===0)throw Error(`No tasks provided. Use --tasks <file> and/or --task id=message.`);let r=new Set;for(let e of n){if(r.has(e.id))throw Error(`Duplicate task id: ${e.id}`);r.add(e.id)}return n}function wr(e){if(e!==`fastest`&&e!==`balanced`&&e!==`cheapest`)throw Error(`--scaling must be one of: fastest, balanced, cheapest (got "${e}")`);return e}function Tr(e){let t=e.trim(),n=t.indexOf(`/`);if(n<=0||n===t.length-1)throw Error(`--model must be in the form provider/model (got "${e}")`);return{provider:t.slice(0,n),model:t.slice(n+1)}}function Er(){let e=new t(`batch`).description(`Run multiple agent tasks in parallel across sandboxes`);return e.command(`run`).description(`Execute a batch of tasks. Provide tasks via --tasks <file.json> and/or repeated --task id=message flags.`).option(`--tasks <file>`,`Path to a JSON file with an array of tasks (or {tasks: [...]})`).option(`--task <id=message>`,`Inline task, id=message. Repeatable.`,(e,t=[])=>[...t,e],[]).option(`--stream`,`Stream per-task events as they arrive`).option(`-t, --timeout <ms>`,`Total batch timeout in milliseconds`,`300000`).option(`--scaling <mode>`,`Scaling mode: fastest | balanced | cheapest`,`balanced`).option(`--persistent`,`Keep sandboxes alive after completion`,!1).option(`--model <provider/model>`,`Model override, e.g. anthropic/claude-sonnet-4-5-20250929`).option(`--profile <id>`,`Named execution profile to apply to every task`).option(`--json`,`Output the final result as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{let t=new AbortController,n=!1,r=()=>{n||(n=!0,M(`Cancel requested — stopping stream...`),t.abort())};process.on(`SIGINT`,r),process.on(`SIGTERM`,r);try{let n=Cr({file:e.tasks,inline:e.task}),r=wr(e.scaling),i=Number(e.timeout);if(!Number.isFinite(i)||i<=0)throw Error(`--timeout must be a positive number of milliseconds`);let o=D(w({apiKey:e.apiKey,baseUrl:e.baseUrl})),s={type:`opencode`};e.model&&(s.model=Tr(e.model)),e.profile&&(s.profile=String(e.profile));let c={timeoutMs:i,scalingMode:r,persistent:!!e.persistent,signal:t.signal,backend:s};if(e.stream){M(`Streaming batch of ${n.length} task(s)...`),console.log();let t=new Map;for await(let e of o.streamBatch(n,c)){let r=e.data,i=r.taskId??``;switch(e.type){case`batch.started`:M(`Batch started (${r.totalTasks??n.length} tasks)`);break;case`task.started`:i&&console.log(a.dim(`→ ${i} started`));break;case`task.retry`:i&&console.log(a.yellow(`↻ ${i} retry ${r.attempt??`?`}: ${r.error??`retrying`}`));break;case`task.completed`:if(i){let e=r.usage,n=(e?.inputTokens??0)+(e?.outputTokens??0);t.set(i,{success:!0,durationMs:r.durationMs,retries:r.retries,tokensUsed:r.tokensUsed??(n>0?n:void 0),response:r.resultSummary??r.response}),console.log(a.green(`✓ ${i} completed in ${r.durationMs??`?`}ms`+(r.retries?` (${r.retries} retries)`:``)))}break;case`task.failed`:i&&(t.set(i,{success:!1,durationMs:r.durationMs,retries:r.retries,error:r.error}),console.log(a.red(`✗ ${i} failed: ${r.error??`unknown error`}`)));break;case`batch.failed`:throw Error(r.error??`Batch failed`);case`batch.completed`:break}}let r=[...t.values()].filter(e=>e.success).length,i=[...t.values()].filter(e=>!e.success).length,s=[...t.values()].reduce((e,t)=>e+(t.retries??0),0);console.log(),e.json?k({totalTasks:n.length,succeeded:r,failed:i,totalRetries:s,successRate:n.length>0?r/n.length*100:0,results:Array.from(t.entries()).map(([e,t])=>({taskId:e,...t}))}):P({"Total tasks":n.length,Succeeded:r,Failed:i,"Total retries":s,"Success rate":n.length>0?`${(r/n.length*100).toFixed(1)}%`:`0%`}),i>0&&(process.exitCode=1)}else{M(`Running batch of ${n.length} task(s)...`);let t=await o.runBatch(n,c);if(e.json)k(t);else if(console.log(),P({"Total tasks":t.totalTasks,Succeeded:t.succeeded,Failed:t.failed,"Total retries":t.totalRetries,"Success rate":`${t.successRate.toFixed(1)}%`}),t.results.length>0){console.log(),console.log(a.bold(`Task Results`)),console.log(a.dim(`─`.repeat(40)));for(let e of t.results){let t=e.success?a.green(`✓`):a.red(`✗`),n=typeof e.tokensUsed==`number`?` • ${e.tokensUsed} tokens`:``;console.log(`${t} ${e.taskId} ${a.dim(`(${e.durationMs}ms, ${e.retries} retries${n})`)}`),e.error&&console.log(a.red(`    ${e.error}`))}}t.failed>0&&(process.exitCode=1)}}catch(e){if(n){console.log(),M(`Batch cancelled.`),process.exitCode=130;return}R(e)}finally{process.off(`SIGINT`,r),process.off(`SIGTERM`,r)}}),e}function Dr(){let e=new t(`branch`).description(`Branch a running sandbox into copy-on-write children`);return e.command(`create <sandbox-id-or-name>`).description(`Branch a running sandbox into N copy-on-write children`).option(`--count <n>`,`Number of children to create`,`1`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=Number.parseInt(t.count,10);if(!Number.isInteger(n)||n<1)throw Error(`--count must be an integer >= 1 (got ${t.count})`);let r=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),i=D(r),a=N(`Branching into ${n} child(ren)...`);a.start();let o=await B(i,r,e),s=await o.branch(n);a.stop(),t.json?k(s.map(e=>({sandboxId:e.id}))):(A(`Branched ${s.length} child(ren) from ${o.id}`),O(s.map(e=>({sandboxId:e.id})),[{key:`sandboxId`,header:`Child Sandbox`,width:28}]))}catch(e){R(e)}}),e}const Or=[`codex`,`claude-code`,`nanoclaw`,`kimi-code`,`opencode`,`pi`,`openclaw`,`hermes`],kr=`https://intelligence.tangle.tools/v1/otlp`,Ar=[`codex`,`claude-code`],jr=[`codex`,`claude-code`,`nanoclaw`],Mr=[`SessionStart`,`UserPromptSubmit`,`PreToolUse`,`PostToolUse`,`Stop`],Nr={codex:{kind:`native`,surface:`codex`,label:`Codex`,buildFiles:Kr},"claude-code":{kind:`native`,surface:`claude-code`,label:`Claude Code`,buildFiles:qr},nanoclaw:{kind:`native`,surface:`nanoclaw`,label:`NanoClaw`,buildFiles:qr},"kimi-code":{kind:`manual`,surface:`kimi-code`,label:`Kimi Code`,reason:`Kimi Code loads hooks through an explicit config file, so use standard OTLP env wiring until the native config adapter is verified.`},opencode:{kind:`manual`,surface:`opencode`,label:`OpenCode`,reason:`OpenCode hooks run as plugins; use standard OTLP env wiring until the native plugin adapter is verified.`},pi:{kind:`manual`,surface:`pi`,label:`Pi`,reason:`Pi hooks run through TypeScript extensions; use standard OTLP env wiring until the native extension adapter is verified.`},openclaw:{kind:`manual`,surface:`openclaw`,label:`OpenClaw`,reason:`OpenClaw project hooks require user opt-in; use standard OTLP env wiring until the hook toggle and adapter are verified.`},hermes:{kind:`manual`,surface:`hermes`,label:`Hermes`,reason:`Hermes project plugins require explicit enablement; use standard OTLP env wiring until the plugin adapter is verified.`}};function Pr(e){let t=e.split(`,`).map(e=>e.trim()).filter(Boolean).flatMap(e=>Gr(e));return t.length===0?[...Ar]:oi(t)}function Fr(e){return Object.hasOwn(Nr,e)}function Ir(e=process.cwd()){return ee(re(e))||`agent-workspace`}function Lr(){return m(pe(),`.tangle`,`intelligence.json`)}function Rr(e=Lr()){if(!c(e))return null;let t=ri(e),n=si(t,`apiKey`),r=si(t,`endpoint`),i=si(t,`serviceName`),a=si(t,`environment`);if(!n||!r||!i||!a)throw Error(`${e} is missing apiKey, endpoint, serviceName, or environment`);return{apiKey:n,endpoint:r,serviceName:i,environment:a}}async function zr(e){let t=re(e.workspace),n=Lr(),r=Pr(e.selection),i=[],a=[],o=[],s={apiKey:e.apiKey,endpoint:W(e.endpoint),serviceName:e.serviceName,environment:e.environment};e.dryRun||ei(n,s),o.push(n);for(let n of r){let r=Nr[n];if(r.kind===`manual`){a.push({agent:r.surface,label:r.label,reason:r.reason});continue}i.push(r.surface);let s=t=>Br(e.hookCommand,r.surface,t);for(let n of r.buildFiles(s)){let r=m(t,n.relPath);if(e.dryRun){o.push(r);continue}ni(r,JSON.parse(n.content),n.mode),o.push(r)}}return!e.smoke||e.dryRun?{configPath:n,written:o,agents:r,nativeAgents:i,manual:a}:{configPath:n,written:o,agents:r,nativeAgents:i,manual:a,smokeTraceId:await Hr({agent:i[0]??r[0]??`codex`,event:`install.smoke`,endpoint:s.endpoint,apiKey:s.apiKey,serviceName:s.serviceName,environment:s.environment,sessionId:`install-smoke-${Date.now()}`,payload:{source:`tangle intelligence connect`}})}}function Br(e,t,n){return`${e.trim()} --agent ${t} --event ${n} --non-blocking`}function Vr(e){let t=BigInt(Date.now())*1000000n,n=li(16),r=li(8),i=e.sessionId??Jr(e.payload),a={"service.name":e.serviceName,"deployment.environment":e.environment,"tangle.agent.surface":e.agent,"tangle.agent.hook.event":e.event,"tangle.agent.hook.source":`local-hook`,...Yr(e.payload)};return i&&(a[`session.id`]=i,a[`gen_ai.conversation.id`]=i,a[`tangle.sessionId`]=i),{body:{resourceSpans:[{resource:{attributes:[ui(`service.name`,e.serviceName),ui(`deployment.environment`,e.environment),ui(`tangle.agent.surface`,e.agent)]},scopeSpans:[{scope:{name:`tangle.intelligence.agent-hook`,version:`1.0.0`},spans:[{traceId:n,spanId:r,name:`agent.${e.agent}.${e.event}`,kind:1,startTimeUnixNano:t.toString(),endTimeUnixNano:(t+1000000n).toString(),attributes:Object.entries(a).map(([e,t])=>ui(e,t)),status:{code:1}}]}]}]},traceId:n}}async function Hr(e){let{body:t,traceId:n}=Vr(e),r=await fetch(`${W(e.endpoint)}/v1/traces`,{method:`POST`,headers:{Authorization:`Bearer ${e.apiKey}`,"Content-Type":`application/json`},body:JSON.stringify(t)});if(!r.ok){let e=await r.text().catch(()=>``);throw Error(`OTLP smoke ingest failed: ${r.status}${e?` ${e}`:``}`)}return n}function Ur(e){return W(e).replace(/\/v1\/otlp$/,``).replace(/\/+$/,``)}async function Wr(e){let t=`${Ur(e.endpoint)}/v1/onboarding/status`,n=await fetch(t,{headers:{Authorization:`Bearer ${e.apiKey}`},signal:e.timeoutMs&&e.timeoutMs>0?AbortSignal.timeout(e.timeoutMs):void 0});if(!n.ok){let e=await n.text().catch(()=>``);throw Error(`onboarding status request failed: ${n.status}${e?` ${e}`:``}`)}let r=await n.json();return{tracesSeen:!!r.tracesSeen,contentSeen:!!r.contentSeen,lastSeenAt:typeof r.lastSeenAt==`string`?r.lastSeenAt:null,windowDays:typeof r.windowDays==`number`?r.windowDays:7,byAgent:r.byAgent&&typeof r.byAgent==`object`?r.byAgent:{}}}function W(e){let t=e.trim().replace(/\/+$/,``);return t.endsWith(`/v1/traces`)?t.slice(0,-10):t.endsWith(`/v1/logs`)?t.slice(0,-8):t}function Gr(e){switch(e){case`local`:case`both`:return[...Ar];case`all`:return[...jr];case`claude`:return[`claude-code`];case`kimi`:return[`kimi-code`];default:if(Fr(e))return[e];throw Error(`agent must be one of: local, all, both, ${Or.join(`, `)}`)}}function Kr(e){let t=Object.fromEntries(Mr.map(t=>[t,[{command:e(t),timeoutMs:3e3,blocking:!1,matcher:`*`}]]));return[{relPath:`.codex/hooks.json`,content:JSON.stringify({hooks:t},null,2)}]}function qr(e){let t=Object.fromEntries(Mr.map(t=>[t,[{matcher:`*`,hooks:[{type:`command`,command:e(t),timeout:3}]}]]));return[{relPath:`.claude/settings.json`,content:JSON.stringify({hooks:t},null,2)}]}function Jr(e){return Zr(e,[`session.id`,`sessionId`,`session_id`,`conversationId`,`conversation_id`,`threadId`,`thread_id`,`transcriptId`,`transcript_id`])||process.env.TANGLE_SESSION_ID||process.env.CODEX_THREAD_ID||process.env.CLAUDE_SESSION_ID||process.env.OPENCODE_SESSION_ID}function Yr(e){let t={},n=Xr(e,[`tool.name`,`toolName`,`tool_name`,`tool`]),r=Xr(e,[`command`,`cmd`,`shell_command`,`shellCommand`]),i=Xr(e,[`tool.input`,`toolInput`,`tool_input`,`input`,`arguments`,`args`]),a=Xr(e,[`tool.output`,`toolOutput`,`tool_output`,`output`,`result`]),o=Xr(e,[`tool.exit_code`,`exitCode`,`exit_code`,`status`]),s=Xr(e,[`tool.error.message`,`errorMessage`,`error_message`,`error`]);return n&&(t[`tool.name`]=n),r&&(t[`process.command`]=r),i&&(t[`tool.input.summary`]=i),a&&(t[`tool.output.summary`]=a),o&&(t[`tool.exit_code`]=o),s&&(t[`tool.error.message`]=s),t}function Xr(e,t){let n=Qr(e,t);if(n===void 0)return null;if(typeof n==`string`)return $r(n);if(typeof n==`number`||typeof n==`boolean`||typeof n==`bigint`)return String(n);try{return $r(JSON.stringify(n))}catch{return null}}function Zr(e,t){let n=Qr(e,t);return typeof n==`string`&&n.length>0?n:void 0}function Qr(e,t){if(typeof e!=`object`||!e)return;let n=[e],r=new Set;for(;n.length;){let e=n.pop();if(typeof e!=`object`||!e||r.has(e))continue;r.add(e);let i=e;for(let e of t){let t=i[e];if(t!=null&&t!==``)return t}for(let e of Object.values(i))typeof e==`object`&&e&&n.push(e)}}function $r(e){return e.length>4096?`${e.slice(0,4093)}...`:e}function ei(e,t){ti(e,`${JSON.stringify(t,null,2)}\n`)}function ti(e,t){l(te(e),{mode:448,recursive:!0});let n=`${e}.${process.pid}.tmp`;f(n,t,{mode:384}),d(n,e)}function ni(e,t,n){l(te(e),{recursive:!0});let r=ii(ri(e),t);f(e,`${JSON.stringify(r,null,2)}\n`,{mode:n??420})}function ri(e){if(!c(e))return{};let t=JSON.parse(u(e,`utf8`));if(!ci(t))throw Error(`${e} must contain a JSON object`);return t}function ii(e,t){let n={...e};for(let[e,r]of Object.entries(t)){let t=n[e];ci(t)&&ci(r)?n[e]=ii(t,r):Array.isArray(t)&&Array.isArray(r)?n[e]=ai([...t,...r]):n[e]=r}return n}function ai(e){let t=new Set,n=[];for(let r of e){let e=JSON.stringify(r);t.has(e)||(t.add(e),n.push(r))}return n}function oi(e){return[...new Set(e)]}function si(e,t){let n=e[t];return typeof n==`string`&&n.length>0?n:void 0}function ci(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&(Object.getPrototypeOf(e)===Object.prototype||Object.getPrototypeOf(e)===null)}function li(e){return r(e).toString(`hex`)}function ui(e,t){return{key:e,value:{stringValue:t}}}const di=`tangle.opencode-exporter`,fi=16384;function pi(e){return e.length<=fi?e:`${e.slice(0,fi-1)}…`}function G(e,t){return{key:e,value:{stringValue:t}}}function mi(e){if(!e||typeof e!=`object`)return null;let t=e,n=y(t.type);return n?{type:n,properties:t.properties&&typeof t.properties==`object`?t.properties:void 0}:null}function hi(e,t){let n=[G(`event.name`,e),G(`gen_ai.system`,`opencode`),G(`service.name`,`opencode`)];return t&&(n.push(G(`session.id`,t)),n.push(G(`gen_ai.conversation.id`,t))),n}function gi(e){if(!e)return null;let t=e.part,n=e.info;return y(t?.sessionID)??y(n?.sessionID)??y(e.sessionID)??null}function _i(e,t){let n=y(e.role)??y(e.info?.role);if(n)return n.toLowerCase();let r=y(e.messageID),i=t?.(r)??null;return i?i.toLowerCase():null}function vi(e,t,n){let r=[],i=gi(e.properties),a=(n,r)=>({timeUnixNano:t,severityNumber:9,severityText:`INFO`,...n===null?{}:{body:{stringValue:pi(n)}},attributes:[...hi(e.type,i),...r]});if(e.type===`message.part.updated`){let t=e.properties?.part;if(!t)return r;let i=y(t.type);if(i===`text`||i===`reasoning`){let e=y(t.text);if(e){let i=_i(t,n)===`user`?xe:be;r.push(a(e,[G(i,pi(e))]))}return r}if(i===`tool`){let e=y(t.tool),n=t.state,i=Ee(n?.input),o=Ee(n?.output),s=y(n?.error)??(typeof n?.error==`object`&&n?.error!==null?Ee(n.error):null);if(e||i){let t=[];e&&t.push(G(Ce,e)),i&&t.push(G(Se,pi(i))),r.push(a(null,t))}let c=o??s;if(c){let t=[G(we,pi(c))];e&&t.push(G(Ce,e)),r.push(a(c,t))}return r}return r}if(e.type===`session.next.text.delta`||e.type===`session.next.text.ended`){let t=e.properties??{},n=y(t.text)??(e.type===`session.next.text.delta`?y(t.delta):null);return n&&r.push(a(n,[G(be,pi(n))])),r}return r}function yi(e=process.env.OTEL_RESOURCE_ATTRIBUTES){if(!e)return null;for(let t of e.split(`,`)){let e=t.indexOf(`=`);if(e===-1||t.slice(0,e).trim()!==Te)continue;let n=t.slice(e+1).trim();if(n.length>0)return n}return null}function bi(e,t){if(e.length===0)return null;let n=[G(`service.name`,`opencode`),G(`gen_ai.system`,`opencode`),G(`telemetry.sdk.name`,di)];return t&&t.trim().length>0&&n.push(G(Te,t.trim())),{resourceLogs:[{resource:{attributes:n},scopeLogs:[{scope:{name:di,version:`1.0.0`},logRecords:e}]}]}}function xi(e){return(e??process.env.OPENCODE_BASE_URL??`http://127.0.0.1:4096`).replace(/\/+$/,``)}async function Si(e){let t=W(e.endpoint),n=await(e.fetchImpl??fetch)(`${t}/v1/logs`,{method:`POST`,headers:{Authorization:`Bearer ${e.apiKey}`,"Content-Type":`application/json`},body:JSON.stringify(e.request),signal:e.timeoutMs&&e.timeoutMs>0?AbortSignal.timeout(e.timeoutMs):void 0});if(!n.ok){let e=await n.text().catch(()=>``);throw Error(`OpenCode OTLP logs ingest failed: ${n.status}${e?` ${e}`:``}`)}}var Ci=class extends Error{partial;constructor(e,t){let n=e instanceof Error?e.message:String(e);super(n),this.name=`OpencodeExporterError`,this.partial=t,e instanceof Error&&(this.cause=e)}};function wi(){return(BigInt(Date.now())*1000000n).toString()}async function Ti(e){let t=xi(e.opencodeBaseUrl),n=e.nowUnixNano??wi,r=e.fetchImpl??fetch,i=e.subjectKey===void 0?yi():e.subjectKey,a=await r(`${t}/event`,{headers:{Accept:`text/event-stream`},signal:e.signal});if(!a.ok){let e=await a.text().catch(()=>``);throw Error(`OpenCode event subscribe failed: ${a.status} at ${t}/event${e?` ${e}`:``}. Is OpenCode running with 'opencode serve'?`)}if(!a.body)throw Error(`OpenCode event stream at ${t}/event returned no body — cannot subscribe`);let o={eventsSeen:0,contentEventsExported:0,recordsExported:0},s=new Map,c=e=>e?s.get(e)??null:null;try{for await(let t of de(a.body,{signal:e.signal})){o.eventsSeen++;let a=mi(t.data);if(!a)continue;if(a.type===`message.updated`){let e=a.properties?.info,t=y(e?.id),n=y(e?.role);t&&n&&s.set(t,n);continue}let l=vi(a,n(),c),u=bi(l,i);u&&(await Si({endpoint:e.endpoint,apiKey:e.apiKey,request:u,timeoutMs:e.postTimeoutMs,fetchImpl:r}),o.contentEventsExported++,o.recordsExported+=l.length,e.onExport?.({eventType:a.type,records:l.length}))}}catch(e){if(e instanceof Error&&(e.name===`AbortError`||e.message.toLowerCase().includes(`abort`)))return o;throw new Ci(e,o)}return o}function Ei(e,t){let n=Number(e);if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} must be a positive integer`);return n}const Di=[`claude-code`,`codex`,`opencode`,`openclaw`,`hermes`,`nanoclaw`],Oi={"claude-code":`Claude Code`,codex:`Codex`,opencode:`OpenCode`,openclaw:`OpenClaw`,hermes:`Hermes`,nanoclaw:`NanoClaw`},ki=`# >>> tangle intelligence (claude-code) >>>`,Ai=`# <<< tangle intelligence (claude-code) <<<`;function ji(e){return Di.includes(e)}function Mi(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??C(void 0);if(!t)throw Error(`No Tangle API key found. Pass --api-key, set TANGLE_API_KEY, or run: tangle auth login`);return t}const Ni={full:[{key:`OTEL_LOG_USER_PROMPTS`,comment:`the user/task prompt text`},{key:`OTEL_LOG_TOOL_DETAILS`,comment:`tool arguments`},{key:`OTEL_LOG_TOOL_CONTENT`,comment:`full tool input+output bodies`},{key:`OTEL_LOG_RAW_API_BODIES`,comment:`full prompt+completion JSON (richest)`}],prompts:[{key:`OTEL_LOG_USER_PROMPTS`,comment:`the user/task prompt text`},{key:`OTEL_LOG_TOOL_DETAILS`,comment:`tool arguments`}],metadata:[]};function Pi(e,t){return t===`env`?e:/\s/.test(e)?`"${e}"`:e}function Fi(e,t){let n=t===`shell`?`export `:t===`dockerfile`?`ENV `:``,r=[];for(let i of e){if(i.kind===`blank`){t===`shell`&&r.push(``);continue}if(i.kind===`comment`){t===`shell`&&r.push(`# ${i.text}`);continue}let e=t===`shell`&&i.comment?`   # ${i.comment}`:``;r.push(`${n}${i.key}=${Pi(i.value,t)}${e}`)}return r.join(`
-`)}function Ii(e){let t=W(e.endpoint),n=e.apiKey??"${TANGLE_API_KEY}",r=e.content??`full`,i=e.format??`shell`,a=[{kind:`comment`,text:`Enable + point Claude Code at Tangle (JSON protocol — matches our adapter)`},{kind:`set`,key:`CLAUDE_CODE_ENABLE_TELEMETRY`,value:`1`},{kind:`set`,key:`OTEL_EXPORTER_OTLP_PROTOCOL`,value:`http/json`},{kind:`set`,key:`OTEL_EXPORTER_OTLP_ENDPOINT`,value:t},{kind:`set`,key:`OTEL_EXPORTER_OTLP_HEADERS`,value:`Authorization=Bearer ${n}`}];e.projectKey?a.push({kind:`blank`},{kind:`comment`,text:`Groups your runs into a project so Tangle can roll up + automate per-project:`},{kind:`set`,key:`OTEL_RESOURCE_ATTRIBUTES`,value:`tangle.subject.key=${e.projectKey}`}):a.push({kind:`blank`},{kind:`comment`,text:`Label this project so Tangle rolls up + automates per-project (pick your own):`},{kind:`comment`,text:`  export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=<your project>`}),a.push({kind:`blank`},{kind:`comment`,text:`CONTENT rides LOG EVENTS, so the logs exporter is MANDATORY.`},{kind:`set`,key:`OTEL_LOGS_EXPORTER`,value:`otlp`,comment:`required for prompt/completion/tool content`},{kind:`set`,key:`OTEL_METRICS_EXPORTER`,value:`otlp`,comment:`tokens / cost`},{kind:`set`,key:`OTEL_TRACES_EXPORTER`,value:`otlp`,comment:`spans (beta)`},{kind:`blank`});let o=Ni[r];if(o.length===0)a.push({kind:`comment`,text:`Content gates intentionally OFF (metadata-only: tokens, durations, tool names — no prompt/completion/tool bodies).`});else{a.push({kind:`comment`,text:`THE CONTENT GATES (all default OFF):`});for(let e of o)a.push({kind:`set`,key:e.key,value:`1`,comment:e.comment})}return Fi(a,i)}function Li(e){return[ki,Ii(e),Ai].join(`
-`)}function Ri(e,t){let n=e.indexOf(ki);if(n!==-1){let r=e.indexOf(Ai,n);if(r===-1)throw Error(`shell rc has a '${ki}' marker without its closing '${Ai}' — fix it by hand and re-run`);let i=r+43,a=`${e.slice(0,n)}${t}${e.slice(i)}`;return{contents:a,changed:a!==e}}return{contents:`${e.length===0?``:zi(e)}${t}\n`,changed:!0}}function zi(e){return e.endsWith(`
+</html>`}const ci=15*6e4,li=`sandbox`;function ui(e){return Number.isFinite(e)&&e>0?e:ci}async function di(e){let t=e.timeoutMs??ci,n=Date.now(),r=await fi({baseUrl:e.baseUrl,app:e.app??li,timeoutMs:t,provider:e.provider});for(e.onInstructions?.({userCode:r.user_code,verificationUrl:r.verification_uri,verificationUrlComplete:r.verification_uri_complete,expiresIn:r.expires_in,intervalSeconds:r.interval});;){if(Date.now()-n>t)throw new g(t,`Timed out waiting for device authorization to complete`);let i=await pi({baseUrl:e.baseUrl,app:e.app??li,deviceCode:r.device_code,timeoutMs:t});if(i.status===`approved`)return i.data;let a=i.intervalSeconds*1e3;await new Promise(e=>setTimeout(e,a))}}async function fi(e){let t=ui(e.timeoutMs),n=e.app!==li,r=await fetch(`${mi(e.baseUrl)}${n?`/cross-site/device/start`:`/auth/cli/device/start`}`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify(n?{app:e.app,...e.provider?{provider:e.provider}:{}}:e.provider?{provider:e.provider}:{}),signal:AbortSignal.timeout(t)}).catch(t=>{throw new u(`Failed to reach ${e.baseUrl}`,t instanceof Error?t:void 0)}),i=await r.json().catch(()=>null);if(!r.ok||!i?.success||!i.data?.device_code)throw Error(i?.error?.message||`Failed to start device login`);return i.data}async function pi(e){let t=ui(e.timeoutMs),n=e.app!==li,r=await fetch(`${mi(e.baseUrl)}${n?`/cross-site/device/poll`:`/auth/cli/device/poll`}`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify(n?{app:e.app,device_code:e.deviceCode}:{device_code:e.deviceCode}),signal:AbortSignal.timeout(t)}).catch(t=>{throw new u(`Failed to reach ${e.baseUrl}`,t instanceof Error?t:void 0)}),i=await r.json().catch(()=>null);if(r.status===428&&i?.error?.code===`AUTHORIZATION_PENDING`)return{status:`pending`,intervalSeconds:typeof i.data?.interval==`number`&&i.data.interval>0?i.data.interval:5};if(!r.ok||!i?.success||!i.data?.api_key||!i.data.email)throw Error(i?.error?.message||`Failed to complete device authorization`);return{status:`approved`,data:{apiKey:i.data.api_key,email:i.data.email,name:i.data.name,tier:i.data.tier}}}function mi(e){return e.replace(/\/$/,``)}function hi(){let e=new t(`auth`).description(`Manage authentication`);e.command(`login`).description(`Authenticate with browser login, device code, or an API key`).option(`--api-key <key>`,`API key`).option(`--no-browser`,`Use device-code login instead of opening a browser`).option(`--profile <name>`,`Profile name`).option(`--provider <provider>`,`Identity provider (github, google, microsoft)`).option(`--app <app>`,`Product to authorize (sandbox or solve)`,`sandbox`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=e.apiKey,n=xi(e.app),r=Si(n,e.profile),i=bi(e.provider),a=n===`solve`?Tn(e.baseUrl):bn(e.baseUrl,r),o=e.browser!==!1;if(t&&!$t(t)){qn(`Invalid API key format. Keys should start with 'sk_' or 'sk-tan-'.`),process.exit(1);return}if(kt(),!t){if(o&&n===`sandbox`){let o=P(`Starting browser login...`);o.start();let s=await ti({baseUrl:a,provider:i,onLoginUrl:({loginUrl:e,browserOpened:t})=>{o.stop(),N(t?`Browser login opened.`:`Open this URL to continue browser login:`),console.log(e)}}).finally(()=>{o.stop()});t=s.apiKey,_i({profile:r,apiKey:t,baseUrl:e.baseUrl?a:void 0,activate:n===`sandbox`}),In(),j(`Authenticated`),F({Profile:r,Email:s.email,Tier:s.tier,"Base URL":a}),N(vi);return}let s=P(`Starting device login...`);s.start();let c=await di({baseUrl:a,app:n,provider:i,onInstructions:({userCode:e,verificationUrl:t,verificationUrlComplete:r})=>{s.stop(),N(`Complete login in a browser on any device:`),F({"Verification URL":t,"Verification URL (prefilled)":r,"Device Code":e}),n===`solve`&&o&&ai(r)}}).finally(()=>{s.stop()});t=c.apiKey,_i({profile:r,apiKey:t,baseUrl:e.baseUrl?a:void 0,activate:n===`sandbox`}),In(),j(`Authenticated`),F({Profile:r,Email:c.email,Tier:c.tier,"Base URL":a}),N(vi);return}t||(qn(`No API key provided.`),process.exit(1));let s=P(`Validating credentials...`);s.start();let c=await Zr({apiKey:t,baseUrl:a});s.stop(),_i({profile:r,apiKey:t,baseUrl:e.baseUrl?a:void 0,activate:n===`sandbox`}),In(),j(`Authenticated`),F({Profile:r,Email:c.email,Tier:c.tier,"Base URL":a}),N(vi)}catch(e){L(e)}}),e.command(`logout`).description(`Remove stored credentials`).option(`--profile <name>`,`Profile name`).option(`--app <app>`,`Product credentials to remove (sandbox or solve)`,`sandbox`).action(e=>{try{let t=Si(xi(e.app),e.profile);pn(t),In(),j(`Logged out successfully.`),N(`Credentials removed for profile '${t}'.`)}catch(e){L(e)}}),e.command(`status`).description(`Show current authentication status`).option(`--json`,`Output as JSON`).option(`--profile <name>`,`Profile name`).option(`--app <app>`,`Product credentials to check (sandbox or solve)`,`sandbox`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=xi(e.app),n=Si(t,e.profile),r=t===`solve`?gn(e.apiKey,n):hn(e.apiKey,n),i=t===`solve`?Tn(e.baseUrl):bn(e.baseUrl,n),a=t===`solve`?vn(e.apiKey,n):_n(e.apiKey,n);if(!r){if(e.json){A({authenticated:!1,reason:`missing_credentials`,profile:n,baseUrl:i,credentialSource:null});return}qn(`Not authenticated`),N(`Run 'tangle auth login --profile ${n}' to authenticate.`),process.exit(1)}let o=e.json?null:P(`Checking credentials...`);o?.start();try{let s=await Zr({apiKey:r,baseUrl:i}),c=t===`solve`?null:await br({...e.apiKey===void 0?{}:{apiKey:e.apiKey},...e.profile===void 0?{}:{profile:e.profile},sandboxBaseUrl:i});o?.stop();let l=c!==null&&!c.reachable&&c.refused,u=!l,d=c!==null&&!c.reachable&&!c.refused;if(e.json){A({authenticated:u,profile:n,baseUrl:i,credentialSource:a,account:s,...c?{sandbox:{authenticated:!0},platform:c}:{}}),u||process.exit(1);return}l?M(`Authenticated for sandbox only`):d?M(`Authenticated — the platform is unreachable right now`):j(`Authenticated`),F({Profile:n,Credentials:`configured`,"Base URL":i,Source:gi(a),Email:s.email,Tier:s.tier,...c?{Platform:c.reachable?`reachable (${c.baseUrl})`:`UNREACHABLE — ${c.reason}`}:{}}),d&&N(`Platform commands (keys, workflows, hub) will not work until the platform answers again. The stored credential is not the cause and does not need replacing.`),u||(N("Platform commands (keys, workflows, hub) will not work until this resolves. Set TANGLE_API_KEY to a key you minted in the console, or run `tangle auth login` again."),process.exit(1))}catch(t){o?.stop(),e.json&&(A({authenticated:!1,profile:n,baseUrl:i,credentialSource:a,error:t instanceof Error?t.message:String(t)}),process.exit(1)),t instanceof l?qn(`Stored credentials are invalid.`):M(`Stored credentials found, but validation could not complete.`),F({Profile:n,Credentials:`configured`,"Base URL":i,Source:gi(a),Error:t instanceof Error?t.message:String(t)}),process.exit(1)}}catch(e){L(e)}});let n=new t(`profiles`).description(`Manage CLI profiles`);return n.command(`list`).description(`List configured profiles`).option(`--json`,`Output as JSON`).action(e=>{try{let t=un();if(e.json){A(t);return}if(t.length===0){N(`No profiles found.`);return}I([`Profile`,`Active`,`Base URL`,`Credentials`,`Source`],t.map(e=>[e.name,e.active?`yes`:`no`,e.baseUrl,e.hasApiKey?`configured`:`none`,e.apiKeySource]))}catch(e){L(e)}}),n.command(`use <name>`).description(`Set the active profile`).action(e=>{try{rn(e);let t=dn(e);j(`Active profile set to '${t.name}'.`),F({"Base URL":t.baseUrl,Credentials:t.credentialSource===`none`?`missing`:`configured`})}catch(e){L(e)}}),n.command(`current`).description(`Show the active profile`).option(`--json`,`Output as JSON`).action(e=>{try{let t=dn();if(e.json){A({name:t.name,active:t.active,baseUrl:t.baseUrl,credentialSource:t.credentialSource});return}F({Profile:t.name,"Base URL":t.baseUrl,Credentials:t.credentialSource===`none`?`missing`:`configured`,Source:gi(t.credentialSource)})}catch(e){L(e)}}),e.addCommand(n),e}function gi(e){switch(e){case`flag`:return`command flag`;case`env`:return`environment`;case`keychain`:return`OS keychain`;case`file`:return`credentials file`;case`legacy-file`:return`legacy credentials file`;default:return`unknown`}}function _i(e){let t=fn(e.profile,{apiKey:e.apiKey,...e.baseUrl?{baseUrl:e.baseUrl}:{}});e.activate!==!1&&rn(e.profile),tn(e.baseUrl&&e.profile===`default`?{baseUrl:e.baseUrl}:{}),vi=yi(e.profile,t)}let vi=`Credentials updated.`;function yi(e,t){return t===`keychain`?e===`default`?`API key saved to the OS keychain for the default profile`:`API key saved to the OS keychain for profile '${e}'`:t===`file`?e===`default`?`API key saved to ~/.tangle/credentials.json for the default profile`:`API key saved to ~/.tangle/credentials.json for profile '${e}'`:`Profile '${e}' updated.`}function bi(e){if(e===void 0||e===`github`||e===`google`||e===`microsoft`)return e;throw Error(`--provider must be one of: github, google, microsoft`)}function xi(e){if(e===void 0||e===`sandbox`||e===`solve`)return e??`sandbox`;throw Error(`--app must be one of: sandbox, solve`)}function Si(e,t){return Yt(e,t)}function Ci(){let e=new t(`backend`).description(`Manage sandbox AI agent backend`);return e.command(`status <sandboxId-or-name>`).description(`Get backend agent status`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Fetching backend status...`);i.start();let a=await(await z(r,n,e)).backend.status();i.stop(),t.json?A(a):(N(`Backend Type: ${a.type}`),N(`Status: ${a.status}`),a.version&&N(`Version: ${a.version}`),a.error&&N(`Error: ${a.error}`),a.capabilities&&N(`Capabilities: ${JSON.stringify(a.capabilities)}`))}catch(e){L(e)}}),e.command(`configure <sandboxId-or-name>`).description(`Update backend configuration`).option(`--model <model>`,`Model id (e.g. provider/model)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Updating backend config...`);i.start();let a=await z(r,n,e),o=t.model?{model:t.model}:{};await a.backend.updateConfig(o),i.stop(),j(`Backend configuration updated`),t.json&&A(o)}catch(e){L(e)}}),e.command(`mcp-status <sandboxId-or-name>`).description(`Get status of MCP servers`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Fetching MCP status...`);i.start();let a=await(await z(r,n,e)).backend.getMcpStatus();if(i.stop(),t.json)A(a);else{let e=Object.entries(a);e.length===0?N(`No MCP servers configured`):k(e.map(([e,t])=>{let n=t;return{name:e,status:n.status,error:n.error??``}}),[{key:`name`,header:`Name`,width:24},{key:`status`,header:`Status`,width:12},{key:`error`,header:`Error`,width:40}])}}catch(e){L(e)}}),e.command(`restart <sandboxId-or-name>`).description(`Restart the backend agent`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Restarting backend...`);i.start(),await(await z(r,n,e)).backend.restart(),i.stop(),j(`Backend restarted`)}catch(e){L(e)}}),e}function wi(e){let t=e.indexOf(`=`);if(t<=0)throw Error(`Invalid --task "${e}": expected format id=message (e.g. t1=summarize README)`);let n=e.slice(0,t).trim(),r=e.slice(t+1).trim();if(!n||!r)throw Error(`Invalid --task "${e}": id and message must be non-empty`);return{id:n,message:r}}function Ti(e){let t;try{t=JSON.parse(e)}catch(e){throw Error(`--tasks file is not valid JSON: ${e.message}`)}let n=Array.isArray(t)?t:t?.tasks;if(!Array.isArray(n))throw Error(`--tasks file must contain an array or an object with a "tasks" array`);return n.map((e,t)=>{if(!e||typeof e!=`object`)throw Error(`--tasks[${t}] must be an object`);let n=e,r=typeof n.id==`string`?n.id.trim():``,i=typeof n.message==`string`?n.message:``;if(!r)throw Error(`--tasks[${t}].id must be a non-empty string`);if(!i.trim())throw Error(`--tasks[${t}].message must be a non-empty string`);let a={id:r,message:i};if(n.context!==void 0&&(typeof n.context!=`object`||n.context===null||Array.isArray(n.context)))throw Error(`--tasks[${t}].context must be a JSON object`);if(n.context!==void 0&&(a.context=n.context),n.timeoutMs!==void 0&&(!Number.isInteger(n.timeoutMs)||n.timeoutMs<=0))throw Error(`--tasks[${t}].timeoutMs must be a positive integer`);return n.timeoutMs!==void 0&&(a.timeoutMs=n.timeoutMs),a})}function Ei(e){let t=e.readFile??(e=>x(e,`utf8`)),n=[];e.file&&n.push(...Ti(t(e.file)));for(let t of e.inline??[])n.push(wi(t));if(n.length===0)throw Error(`No tasks provided. Use --tasks <file> and/or --task id=message.`);let r=new Set;for(let e of n){if(r.has(e.id))throw Error(`Duplicate task id: ${e.id}`);r.add(e.id)}return n}const Di=/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;function Oi(e){let t=e.trim(),n=t.indexOf(`/`);if(n<=0||n===t.length-1)throw Error(`--model must be in the form provider/model (got "${e}")`);return{provider:t.slice(0,n),model:t.slice(n+1)}}function ki(e){let t=e.indexOf(`=`);if(t<=0||t===e.length-1)throw Error(`Invalid --backend "${e}": expected format id=type (e.g. primary=opencode)`);let n=e.slice(0,t).trim(),r=e.slice(t+1).trim();if(!Di.test(n))throw Error(`Invalid backend id "${n}": use 1-128 letters, numbers, dots, underscores, or hyphens, starting with a letter or number`);if(!r||r.includes(`=`))throw Error(`Invalid --backend "${e}": type must be a non-empty backend name`);return{id:n,type:r}}function Ai(e,t){if(!e||e.length===0)throw Error(`No backends provided. Use --backend id=type or --request <file>.`);let n=e.map(ki),r=new Set;for(let e of n){if(r.has(e.id))throw Error(`Duplicate backend id: ${e.id}`);r.add(e.id)}if(t&&n.length!==1)throw Error(`--model requires exactly one backend; use a profile to configure models for multiple backends`);return t&&(n[0]={...n[0],model:Oi(t)}),n}function ji(e){let t;try{t=JSON.parse(e)}catch(e){throw Error(`--request file is not valid JSON: ${e.message}`)}try{return ae(t)}catch(e){throw Error(`--request file is not a valid batch request: ${e.message}`)}}function Mi(e,t,n){return n?`${e} [${t}]`:e}function Ni(e){let t=new Map;for(let n of e)t.set(n.taskId,(t.get(n.taskId)??0)+1);return new Set([...t.entries()].filter(([,e])=>e>1).map(([e])=>e))}function Pi(){let e=new t(`batch`).description(`Run multiple agent tasks in parallel across sandboxes`);return e.command(`run`).description(`Execute a batch of tasks. Provide tasks via --tasks <file.json> and/or repeated --task id=message flags.`).option(`--tasks <file>`,`Path to a JSON file with an array of tasks (or {tasks: [...]})`).option(`--request <file>`,`Path to a complete batch request JSON file`).option(`--task <id=message>`,`Inline task, id=message. Repeatable.`,(e,t=[])=>[...t,e],[]).option(`--stream`,`Stream per-task events as they arrive`).option(`-t, --timeout <ms>`,`Per-task timeout in milliseconds`,`300000`).option(`--persistent`,`Keep sandboxes alive after completion`,!1).option(`--reuse-key <key>`,`Stable workspace identity required by --persistent`).option(`--idempotency-key <key>`,`Retry identity; keyed runs continue after disconnect`).option(`--backend <id=type>`,`Backend identity and type. Required and repeatable without --request.`,(e,t=[])=>[...t,e],[]).option(`--model <provider/model>`,`Model override when exactly one backend is selected`).option(`--json`,`Output the final result as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{let n=new AbortController,r=!1,i=()=>{r||(r=!0,N(`Cancel requested — stopping stream...`),n.abort())};process.on(`SIGINT`,i),process.on(`SIGTERM`,i);try{let r;if(e.request){let n=[`tasks`,`task`,`backend`,`model`,`timeout`,`persistent`,`reuseKey`].filter(e=>t.getOptionValueSource(e)===`cli`);if(n.length>0){let e={reuseKey:`reuse-key`};throw Error(`--request cannot be combined with ${n.map(t=>`--${e[t]??t}`).join(`, `)}`)}r=ji(x(e.request,`utf8`))}else{let t=Ei({file:e.tasks,inline:e.task}),n=Ai(e.backend,e.model),i=Number(e.timeout);if(!Number.isInteger(i)||i<=0)throw Error(`--timeout must be a positive integer number of milliseconds`);let a=!!e.persistent;if(a&&!e.reuseKey)throw Error(`--persistent requires --reuse-key`);if(!a&&e.reuseKey)throw Error(`--reuse-key requires --persistent`);r=ae({tasks:t,timeoutMs:i,backends:n,...a?{persistent:!0,reuseKey:e.reuseKey}:{persistent:!1}})}let{tasks:i,backends:a}=r,o=O(D({apiKey:e.apiKey,baseUrl:e.baseUrl})),s={signal:n.signal,...e.idempotencyKey?{idempotencyKey:e.idempotencyKey}:{}};if(e.stream){N(`Streaming batch of ${i.length} task(s)...`),console.log();let t=te(r),n=a.length>1;for await(let e of o.streamBatch(r,s))switch(t.add(e),e.type){case`batch.started`:{let t=e.data;N(`Batch started (${t.taskCount} tasks, ${t.backendCount} backends)`);break}case`task.started`:{let t=e.data;console.log(y.dim(`→ ${Mi(t.taskId,t.backendId,n)} started`));break}case`task.retry`:{let t=e.data;console.log(y.yellow(`↻ ${Mi(t.taskId,t.backendId,n)} retry ${t.attempt}: ${t.error}`));break}case`task.completed`:{let t=e.data;console.log(y.green(`✓ ${Mi(t.taskId,t.backendId,n)} completed in ${t.durationMs}ms`+(t.retries?` (${t.retries} retries)`:``)));break}case`task.failed`:{let t=e.data;console.log(y.red(`✗ ${Mi(t.taskId,t.backendId,n)} failed: ${t.error}`));break}case`batch.completed`:break}let c=t.finish();console.log(),e.json?A(c):F({"Total tasks":c.totalTasks,"Total backends":c.totalBackends,"Total executions":c.totalExecutions,Succeeded:c.totalSuccess,Failed:c.totalFailure,"Total retries":c.totalRetries,"Success rate":`${c.successRate.toFixed(1)}%`}),c.totalFailure>0&&(process.exitCode=1)}else{N(`Running batch of ${i.length} task(s)...`);let t=await o.runBatch(r,s);if(e.json)A(t);else if(console.log(),F({"Total tasks":t.totalTasks,"Total backends":t.totalBackends,"Total executions":t.totalExecutions,Succeeded:t.totalSuccess,Failed:t.totalFailure,"Total retries":t.totalRetries,"Success rate":`${t.successRate.toFixed(1)}%`}),t.results.length>0){let e=Ni(t.results);console.log(),console.log(y.bold(`Task Results`)),console.log(y.dim(`─`.repeat(40)));for(let n of t.results){let t=n.success?y.green(`✓`):y.red(`✗`),r=n.success?n.usage.inputTokens+n.usage.outputTokens:0,i=r>0?` • ${r} tokens`:``;console.log(`${t} ${Mi(n.taskId,n.backendId,e.has(n.taskId))} ${y.dim(`(${n.durationMs}ms, ${n.retries} retries${i})`)}`),n.success||console.log(y.red(`    ${n.error}`))}}t.totalFailure>0&&(process.exitCode=1)}}catch(e){if(r){console.log(),N(`Batch cancelled.`),process.exitCode=130;return}L(e)}finally{process.off(`SIGINT`,i),process.off(`SIGTERM`,i)}}),e}function Fi(){let e=new t(`branch`).description(`Branch a running sandbox into copy-on-write children`);return e.command(`create <sandbox-id-or-name>`).description(`Branch a running sandbox into N copy-on-write children`).option(`--count <n>`,`Number of children to create`,`1`).option(`--idempotency-key <key>`,`Retry identity: the same key and count replays the first fan-out and creates no second one`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=Number.parseInt(t.count,10);if(!Number.isInteger(n)||n<1)throw Error(`--count must be an integer >= 1 (got ${t.count})`);let r=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),i=O(r),a=P(`Branching into ${n} child(ren)...`);a.start();let o=await z(i,r,e),s=await o.fork(n,{...t.idempotencyKey?{idempotencyKey:t.idempotencyKey}:{}}),c=s.children;a.stop(),t.json?A({children:c.map(e=>({sandboxId:e.id})),requestedCount:s.requestedCount,materializedCount:s.materializedCount,complete:s.complete,...s.idempotency?{idempotency:s.idempotency}:{}}):(s.complete?j(`Branched ${c.length} child(ren) from ${o.id}`):M(`Branched ${s.materializedCount} of ${s.requestedCount} requested child(ren) from ${o.id}`),s.idempotency?.outcome===`replayed`&&N(`Replayed an earlier fan-out under this key; created none.`),k(c.map(e=>({sandboxId:e.id})),[{key:`sandboxId`,header:`Child Sandbox`,width:28}]))}catch(e){L(e)}}),e}const Ii=[`codex`,`claude-code`,`nanoclaw`,`kimi-code`,`opencode`,`pi`,`openclaw`,`hermes`],Li=`https://intelligence.tangle.tools/v1/otlp`,Ri=[`codex`,`claude-code`],zi=[`codex`,`claude-code`,`nanoclaw`],Bi=[`SessionStart`,`UserPromptSubmit`,`PreToolUse`,`PostToolUse`,`Stop`],Vi={codex:{kind:`native`,surface:`codex`,label:`Codex`,buildFiles:ea},"claude-code":{kind:`native`,surface:`claude-code`,label:`Claude Code`,buildFiles:ta},nanoclaw:{kind:`native`,surface:`nanoclaw`,label:`NanoClaw`,buildFiles:ta},"kimi-code":{kind:`manual`,surface:`kimi-code`,label:`Kimi Code`,reason:`Kimi Code loads hooks through an explicit config file, so use standard OTLP env wiring until the native config adapter is verified.`},opencode:{kind:`manual`,surface:`opencode`,label:`OpenCode`,reason:`OpenCode hooks run as plugins; use standard OTLP env wiring until the native plugin adapter is verified.`},pi:{kind:`manual`,surface:`pi`,label:`Pi`,reason:`Pi hooks run through TypeScript extensions; use standard OTLP env wiring until the native extension adapter is verified.`},openclaw:{kind:`manual`,surface:`openclaw`,label:`OpenClaw`,reason:`OpenClaw project hooks require user opt-in; use standard OTLP env wiring until the hook toggle and adapter are verified.`},hermes:{kind:`manual`,surface:`hermes`,label:`Hermes`,reason:`Hermes project plugins require explicit enablement; use standard OTLP env wiring until the plugin adapter is verified.`}};function Hi(e){let t=e.split(`,`).map(e=>e.trim()).filter(Boolean).flatMap(e=>$i(e));return t.length===0?[...Ri]:ma(t)}function Ui(e){return Object.hasOwn(Vi,e)}function Wi(e=process.cwd()){return de(he(e))||`agent-workspace`}function Gi(){return me(_e(),`.tangle`,`intelligence.json`)}function Ki(e=Gi()){if(!se(e))return null;let t=da(e),n=ha(t,`apiKey`),r=ha(t,`endpoint`),i=ha(t,`serviceName`),a=ha(t,`environment`);if(!n||!r||!i||!a)throw Error(`${e} is missing apiKey, endpoint, serviceName, or environment`);return{apiKey:n,endpoint:r,serviceName:i,environment:a}}async function qi(e){let t=he(e.workspace),n=Gi(),r=Hi(e.selection),i=[],a=[],o=[],s={apiKey:e.apiKey,endpoint:V(e.endpoint),serviceName:e.serviceName,environment:e.environment};e.dryRun||ca(n,s),o.push(n);for(let n of r){let r=Vi[n];if(r.kind===`manual`){a.push({agent:r.surface,label:r.label,reason:r.reason});continue}i.push(r.surface);let s=t=>Ji(e.hookCommand,r.surface,t);for(let n of r.buildFiles(s)){let r=me(t,n.relPath);if(e.dryRun){o.push(r);continue}ua(r,JSON.parse(n.content),n.mode),o.push(r)}}return!e.smoke||e.dryRun?{configPath:n,written:o,agents:r,nativeAgents:i,manual:a}:{configPath:n,written:o,agents:r,nativeAgents:i,manual:a,smokeTraceId:await Xi({agent:i[0]??r[0]??`codex`,event:`install.smoke`,endpoint:s.endpoint,apiKey:s.apiKey,serviceName:s.serviceName,environment:s.environment,sessionId:`install-smoke-${Date.now()}`,payload:{source:`tangle intelligence connect`}})}}function Ji(e,t,n){return`${e.trim()} --agent ${t} --event ${n} --non-blocking`}function Yi(e){let t=BigInt(Date.now())*1000000n,n=_a(16),r=_a(8),i=e.sessionId??na(e.payload),a={"service.name":e.serviceName,"deployment.environment":e.environment,"tangle.agent.surface":e.agent,"tangle.agent.hook.event":e.event,"tangle.agent.hook.source":`local-hook`,...ra(e.payload)};return i&&(a[`session.id`]=i,a[`gen_ai.conversation.id`]=i,a[`tangle.sessionId`]=i),{body:{resourceSpans:[{resource:{attributes:[va(`service.name`,e.serviceName),va(`deployment.environment`,e.environment),va(`tangle.agent.surface`,e.agent)]},scopeSpans:[{scope:{name:`tangle.intelligence.agent-hook`,version:`1.0.0`},spans:[{traceId:n,spanId:r,name:`agent.${e.agent}.${e.event}`,kind:1,startTimeUnixNano:t.toString(),endTimeUnixNano:(t+1000000n).toString(),attributes:Object.entries(a).map(([e,t])=>va(e,t)),status:{code:1}}]}]}]},traceId:n}}async function Xi(e){let{body:t,traceId:n}=Yi(e),r=await fetch(`${V(e.endpoint)}/v1/traces`,{method:`POST`,headers:{Authorization:`Bearer ${e.apiKey}`,"Content-Type":`application/json`},body:JSON.stringify(t)});if(!r.ok){let e=await r.text().catch(()=>``);throw Error(`OTLP smoke ingest failed: ${r.status}${e?` ${e}`:``}`)}return n}function Zi(e){return V(e).replace(/\/v1\/otlp$/,``).replace(/\/+$/,``)}async function Qi(e){let t=`${Zi(e.endpoint)}/v1/onboarding/status`,n=await fetch(t,{headers:{Authorization:`Bearer ${e.apiKey}`},signal:e.timeoutMs&&e.timeoutMs>0?AbortSignal.timeout(e.timeoutMs):void 0});if(!n.ok){let e=await n.text().catch(()=>``);throw Error(`onboarding status request failed: ${n.status}${e?` ${e}`:``}`)}let r=await n.json();return{tracesSeen:!!r.tracesSeen,contentSeen:!!r.contentSeen,lastSeenAt:typeof r.lastSeenAt==`string`?r.lastSeenAt:null,windowDays:typeof r.windowDays==`number`?r.windowDays:7,byAgent:r.byAgent&&typeof r.byAgent==`object`?r.byAgent:{}}}function V(e){let t=e.trim().replace(/\/+$/,``);return t.endsWith(`/v1/traces`)?t.slice(0,-10):t.endsWith(`/v1/logs`)?t.slice(0,-8):t}function $i(e){switch(e){case`local`:case`both`:return[...Ri];case`all`:return[...zi];case`claude`:return[`claude-code`];case`kimi`:return[`kimi-code`];default:if(Ui(e))return[e];throw Error(`agent must be one of: local, all, both, ${Ii.join(`, `)}`)}}function ea(e){let t=Object.fromEntries(Bi.map(t=>[t,[{command:e(t),timeoutMs:3e3,blocking:!1,matcher:`*`}]]));return[{relPath:`.codex/hooks.json`,content:JSON.stringify({hooks:t},null,2)}]}function ta(e){let t=Object.fromEntries(Bi.map(t=>[t,[{matcher:`*`,hooks:[{type:`command`,command:e(t),timeout:3}]}]]));return[{relPath:`.claude/settings.json`,content:JSON.stringify({hooks:t},null,2)}]}function na(e){return aa(e,[`session.id`,`sessionId`,`session_id`,`conversationId`,`conversation_id`,`threadId`,`thread_id`,`transcriptId`,`transcript_id`])||process.env.TANGLE_SESSION_ID||process.env.CODEX_THREAD_ID||process.env.CLAUDE_SESSION_ID||process.env.OPENCODE_SESSION_ID}function ra(e){let t={},n=ia(e,[`tool.name`,`toolName`,`tool_name`,`tool`]),r=ia(e,[`command`,`cmd`,`shell_command`,`shellCommand`]),i=ia(e,[`tool.input`,`toolInput`,`tool_input`,`input`,`arguments`,`args`]),a=ia(e,[`tool.output`,`toolOutput`,`tool_output`,`output`,`result`]),o=ia(e,[`tool.exit_code`,`exitCode`,`exit_code`,`status`]),s=ia(e,[`tool.error.message`,`errorMessage`,`error_message`,`error`]);return n&&(t[`tool.name`]=n),r&&(t[`process.command`]=r),i&&(t[`tool.input.summary`]=i),a&&(t[`tool.output.summary`]=a),o&&(t[`tool.exit_code`]=o),s&&(t[`tool.error.message`]=s),t}function ia(e,t){let n=oa(e,t);if(n===void 0)return null;if(typeof n==`string`)return sa(n);if(typeof n==`number`||typeof n==`boolean`||typeof n==`bigint`)return String(n);try{return sa(JSON.stringify(n))}catch{return null}}function aa(e,t){let n=oa(e,t);return typeof n==`string`&&n.length>0?n:void 0}function oa(e,t){if(typeof e!=`object`||!e)return;let n=[e],r=new Set;for(;n.length;){let e=n.pop();if(typeof e!=`object`||!e||r.has(e))continue;r.add(e);let i=e;for(let e of t){let t=i[e];if(t!=null&&t!==``)return t}for(let e of Object.values(i))typeof e==`object`&&e&&n.push(e)}}function sa(e){return e.length>4096?`${e.slice(0,4093)}...`:e}function ca(e,t){la(e,`${JSON.stringify(t,null,2)}\n`)}function la(e,t){ce(fe(e),{mode:448,recursive:!0});let n=`${e}.${process.pid}.tmp`;ue(n,t,{mode:384}),le(n,e)}function ua(e,t,n){ce(fe(e),{recursive:!0});let r=fa(da(e),t);ue(e,`${JSON.stringify(r,null,2)}\n`,{mode:n??420})}function da(e){if(!se(e))return{};let t=JSON.parse(x(e,`utf8`));if(!ga(t))throw Error(`${e} must contain a JSON object`);return t}function fa(e,t){let n={...e};for(let[e,r]of Object.entries(t)){let t=n[e];ga(t)&&ga(r)?n[e]=fa(t,r):Array.isArray(t)&&Array.isArray(r)?n[e]=pa([...t,...r]):n[e]=r}return n}function pa(e){let t=new Set,n=[];for(let r of e){let e=JSON.stringify(r);t.has(e)||(t.add(e),n.push(r))}return n}function ma(e){return[...new Set(e)]}function ha(e,t){let n=e[t];return typeof n==`string`&&n.length>0?n:void 0}function ga(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&(Object.getPrototypeOf(e)===Object.prototype||Object.getPrototypeOf(e)===null)}function _a(e){return r(e).toString(`hex`)}function va(e,t){return{key:e,value:{stringValue:t}}}const ya=`tangle.opencode-exporter`,ba=16384;function xa(e){return e.length<=ba?e:`${e.slice(0,ba-1)}…`}function H(e,t){return{key:e,value:{stringValue:t}}}function Sa(e){if(!e||typeof e!=`object`)return null;let t=e,n=C(t.type);return n?{type:n,properties:t.properties&&typeof t.properties==`object`?t.properties:void 0}:null}function Ca(e,t){let n=[H(`event.name`,e),H(`gen_ai.system`,`opencode`),H(`service.name`,`opencode`)];return t&&(n.push(H(`session.id`,t)),n.push(H(`gen_ai.conversation.id`,t))),n}function wa(e){if(!e)return null;let t=e.part,n=e.info;return C(t?.sessionID)??C(n?.sessionID)??C(e.sessionID)??null}function Ta(e,t){let n=C(e.role)??C(e.info?.role);if(n)return n.toLowerCase();let r=C(e.messageID),i=t?.(r)??null;return i?i.toLowerCase():null}function Ea(e,t,n){let r=[],i=wa(e.properties),a=(n,r)=>({timeUnixNano:t,severityNumber:9,severityText:`INFO`,...n===null?{}:{body:{stringValue:xa(n)}},attributes:[...Ca(e.type,i),...r]});if(e.type===`message.part.updated`){let t=e.properties?.part;if(!t)return r;let i=C(t.type);if(i===`text`||i===`reasoning`){let e=C(t.text);if(e){let i=Ta(t,n)===`user`?De:Ee;r.push(a(e,[H(i,xa(e))]))}return r}if(i===`tool`){let e=C(t.tool),n=t.state,i=Me(n?.input),o=Me(n?.output),s=C(n?.error)??(typeof n?.error==`object`&&n?.error!==null?Me(n.error):null);if(e||i){let t=[];e&&t.push(H(ke,e)),i&&t.push(H(Oe,xa(i))),r.push(a(null,t))}let c=o??s;if(c){let t=[H(Ae,xa(c))];e&&t.push(H(ke,e)),r.push(a(c,t))}return r}return r}if(e.type===`session.next.text.delta`||e.type===`session.next.text.ended`){let t=e.properties??{},n=C(t.text)??(e.type===`session.next.text.delta`?C(t.delta):null);return n&&r.push(a(n,[H(Ee,xa(n))])),r}return r}function Da(e=process.env.OTEL_RESOURCE_ATTRIBUTES){if(!e)return null;for(let t of e.split(`,`)){let e=t.indexOf(`=`);if(e===-1||t.slice(0,e).trim()!==je)continue;let n=t.slice(e+1).trim();if(n.length>0)return n}return null}function Oa(e,t){if(e.length===0)return null;let n=[H(`service.name`,`opencode`),H(`gen_ai.system`,`opencode`),H(`telemetry.sdk.name`,ya)];return t&&t.trim().length>0&&n.push(H(je,t.trim())),{resourceLogs:[{resource:{attributes:n},scopeLogs:[{scope:{name:ya,version:`1.0.0`},logRecords:e}]}]}}function ka(e){return(e??process.env.OPENCODE_BASE_URL??`http://127.0.0.1:4096`).replace(/\/+$/,``)}async function Aa(e){let t=V(e.endpoint),n=await(e.fetchImpl??fetch)(`${t}/v1/logs`,{method:`POST`,headers:{Authorization:`Bearer ${e.apiKey}`,"Content-Type":`application/json`},body:JSON.stringify(e.request),signal:e.timeoutMs&&e.timeoutMs>0?AbortSignal.timeout(e.timeoutMs):void 0});if(!n.ok){let e=await n.text().catch(()=>``);throw Error(`OpenCode OTLP logs ingest failed: ${n.status}${e?` ${e}`:``}`)}}var ja=class extends Error{partial;constructor(e,t){let n=e instanceof Error?e.message:String(e);super(n),this.name=`OpencodeExporterError`,this.partial=t,e instanceof Error&&(this.cause=e)}};function Ma(){return(BigInt(Date.now())*1000000n).toString()}async function Na(e){let t=ka(e.opencodeBaseUrl),n=e.nowUnixNano??Ma,r=e.fetchImpl??fetch,i=e.subjectKey===void 0?Da():e.subjectKey,a=await r(`${t}/event`,{headers:{Accept:`text/event-stream`},signal:e.signal});if(!a.ok){let e=await a.text().catch(()=>``);throw Error(`OpenCode event subscribe failed: ${a.status} at ${t}/event${e?` ${e}`:``}. Is OpenCode running with 'opencode serve'?`)}if(!a.body)throw Error(`OpenCode event stream at ${t}/event returned no body — cannot subscribe`);let o={eventsSeen:0,contentEventsExported:0,recordsExported:0},s=new Map,c=e=>e?s.get(e)??null:null;try{for await(let t of v(a.body,{signal:e.signal})){o.eventsSeen++;let a=Sa(t.data);if(!a)continue;if(a.type===`message.updated`){let e=a.properties?.info,t=C(e?.id),n=C(e?.role);t&&n&&s.set(t,n);continue}let l=Ea(a,n(),c),u=Oa(l,i);u&&(await Aa({endpoint:e.endpoint,apiKey:e.apiKey,request:u,timeoutMs:e.postTimeoutMs,fetchImpl:r}),o.contentEventsExported++,o.recordsExported+=l.length,e.onExport?.({eventType:a.type,records:l.length}))}}catch(e){if(e instanceof Error&&(e.name===`AbortError`||e.message.toLowerCase().includes(`abort`)))return o;throw new ja(e,o)}return o}function U(e,t){let n=Number(e);if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} must be a positive integer`);return n}const Pa=[`claude-code`,`codex`,`opencode`,`openclaw`,`hermes`,`nanoclaw`],Fa={"claude-code":`Claude Code`,codex:`Codex`,opencode:`OpenCode`,openclaw:`OpenClaw`,hermes:`Hermes`,nanoclaw:`NanoClaw`},Ia=`# >>> tangle intelligence (claude-code) >>>`,La=`# <<< tangle intelligence (claude-code) <<<`;function Ra(e){return Pa.includes(e)}function za(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??hn(void 0);if(!t)throw Error(`No Tangle API key found. Pass --api-key, set TANGLE_API_KEY, or run: tangle auth login`);return t}const Ba={full:[{key:`OTEL_LOG_USER_PROMPTS`,comment:`the user/task prompt text`},{key:`OTEL_LOG_TOOL_DETAILS`,comment:`tool arguments`},{key:`OTEL_LOG_TOOL_CONTENT`,comment:`full tool input+output bodies`},{key:`OTEL_LOG_RAW_API_BODIES`,comment:`full prompt+completion JSON (richest)`}],prompts:[{key:`OTEL_LOG_USER_PROMPTS`,comment:`the user/task prompt text`},{key:`OTEL_LOG_TOOL_DETAILS`,comment:`tool arguments`}],metadata:[]};function Va(e,t){return t===`env`?e:/\s/.test(e)?`"${e}"`:e}function Ha(e,t){let n=t===`shell`?`export `:t===`dockerfile`?`ENV `:``,r=[];for(let i of e){if(i.kind===`blank`){t===`shell`&&r.push(``);continue}if(i.kind===`comment`){t===`shell`&&r.push(`# ${i.text}`);continue}let e=t===`shell`&&i.comment?`   # ${i.comment}`:``;r.push(`${n}${i.key}=${Va(i.value,t)}${e}`)}return r.join(`
+`)}function Ua(e){let t=V(e.endpoint),n=e.apiKey??"${TANGLE_API_KEY}",r=e.content??`full`,i=e.format??`shell`,a=[{kind:`comment`,text:`Enable + point Claude Code at Tangle (JSON protocol — matches our adapter)`},{kind:`set`,key:`CLAUDE_CODE_ENABLE_TELEMETRY`,value:`1`},{kind:`set`,key:`OTEL_EXPORTER_OTLP_PROTOCOL`,value:`http/json`},{kind:`set`,key:`OTEL_EXPORTER_OTLP_ENDPOINT`,value:t},{kind:`set`,key:`OTEL_EXPORTER_OTLP_HEADERS`,value:`Authorization=Bearer ${n}`}];e.projectKey?a.push({kind:`blank`},{kind:`comment`,text:`Groups your runs into a project so Tangle can roll up + automate per-project:`},{kind:`set`,key:`OTEL_RESOURCE_ATTRIBUTES`,value:`tangle.subject.key=${e.projectKey}`}):a.push({kind:`blank`},{kind:`comment`,text:`Label this project so Tangle rolls up + automates per-project (pick your own):`},{kind:`comment`,text:`  export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=<your project>`}),a.push({kind:`blank`},{kind:`comment`,text:`CONTENT rides LOG EVENTS, so the logs exporter is MANDATORY.`},{kind:`set`,key:`OTEL_LOGS_EXPORTER`,value:`otlp`,comment:`required for prompt/completion/tool content`},{kind:`set`,key:`OTEL_METRICS_EXPORTER`,value:`otlp`,comment:`tokens / cost`},{kind:`set`,key:`OTEL_TRACES_EXPORTER`,value:`otlp`,comment:`spans (beta)`},{kind:`blank`});let o=Ba[r];if(o.length===0)a.push({kind:`comment`,text:`Content gates intentionally OFF (metadata-only: tokens, durations, tool names — no prompt/completion/tool bodies).`});else{a.push({kind:`comment`,text:`THE CONTENT GATES (all default OFF):`});for(let e of o)a.push({kind:`set`,key:e.key,value:`1`,comment:e.comment})}return Ha(a,i)}function Wa(e){return[Ia,Ua(e),La].join(`
+`)}function Ga(e,t){let n=e.indexOf(Ia);if(n!==-1){let r=e.indexOf(La,n);if(r===-1)throw Error(`shell rc has a '${Ia}' marker without its closing '${La}' — fix it by hand and re-run`);let i=r+43,a=`${e.slice(0,n)}${t}${e.slice(i)}`;return{contents:a,changed:a!==e}}return{contents:`${e.length===0?``:Ka(e)}${t}\n`,changed:!0}}function Ka(e){return e.endsWith(`
 
 `)?e:e.endsWith(`
-`)?`${e}\n`:`${e}\n\n`}function Bi(e){let t=[],n={header:null,body:[]};for(let r of e.split(`
-`))Vi(r)?(t.push(n),n={header:r.trim(),body:[]}):n.body.push(r);return t.push(n),t.length>1&&t[0].header===null&&t[0].body.every(e=>e.trim()===``)&&t.shift(),t}function Vi(e){let t=e.trim();return t.startsWith(`[`)&&t.endsWith(`]`)&&!t.includes(`=`)||t.startsWith(`[[`)&&t.endsWith(`]]`)}function Hi(e){let t=[];for(let n of e)n.header!==null&&t.push(n.header),t.push(...n.body);return t.join(`
-`)}function Ui(e){return[{key:`environment`,line:`environment = "prod"`},{key:`log_user_prompt`,line:`log_user_prompt = true`},{key:`exporter`,line:`exporter = { otlp-http = { endpoint = "${W(e.endpoint)}/v1/logs", protocol = "json", headers = { "Authorization" = "Bearer ${e.apiKey??"${TANGLE_API_KEY}"}" } } }`}]}function Wi(e){let t=e.trim();if(t===``||t.startsWith(`#`))return null;let n=t.indexOf(`=`);if(n===-1)return null;let r=t.slice(0,n).trim();return/^[A-Za-z0-9_-]+$/.test(r)?r:null}function Gi(e,t){let n=Ui(t),r=new Set(n.map(e=>e.key));if(e.trim()===``)return{contents:`${[`[otel]`,...n.map(e=>e.line)].join(`
-`)}\n`,changed:!0};let i=Bi(e),a=i.find(e=>e.header===`[otel]`);if(!a){let t={header:`[otel]`,body:n.map(e=>e.line)},r=i[i.length-1];r&&!Ki(r)&&r.body.push(``),i.push(t);let a=qi(Hi(i));return{contents:a,changed:a!==qi(e)}}let o=a.body.filter(e=>{let t=Wi(e);return t===null||!r.has(t)}),s=[];for(;o.length>0&&o[o.length-1].trim()===``;)s.unshift(o.pop());a.body=[...o,...n.map(e=>e.line),...s];let c=qi(Hi(i));return{contents:c,changed:c!==qi(e)}}function Ki(e){return e.body.length>0&&e.body[e.body.length-1].trim()===``}function qi(e){return e.endsWith(`
-`)?e:`${e}\n`}function Ji(e){switch(e){case`claude-code`:return`Claude Code: set OTEL_LOGS_EXPORTER=otlp and the four OTEL_LOG_* gates (OTEL_LOG_USER_PROMPTS, OTEL_LOG_TOOL_DETAILS, OTEL_LOG_TOOL_CONTENT, OTEL_LOG_RAW_API_BODIES).`;case`codex`:return`Codex: set log_user_prompt = true in [otel] (default false redacts content).`;case`opencode`:return`OpenCode: a standalone install emits nothing without the tangle-opencode-exporter shim; inside a Tangle sandbox it is already instrumented.`;case`openclaw`:case`hermes`:case`nanoclaw`:return`${Oi[e]}: no native OTLP exporter and no standalone server to subscribe to — run it inside a Tangle sandbox, where the sidecar adapter exports its content with gen_ai.system=${e}. A bare standalone install emits metadata only.`}}function Yi(){let e=process.env.SHELL??``;return e.includes(`zsh`)?m(pe(),`.zshrc`):e.includes(`bash`)?m(pe(),`.bashrc`):m(pe(),`.zshrc`)}function Xi(e){return c(e)?u(e,`utf8`):``}function Zi(e,t){l(te(e),{recursive:!0});let n=`${e}.${process.pid}.tmp`;f(n,t,{mode:384}),s(n,384),d(n,e)}function Qi(){return new t(`connect`).description(`Connect a local coding agent's telemetry to Tangle Intelligence, content on (for SDK integration snippets, see 'tangle agent connect')`).argument(`[agent]`,`claude-code | codex | opencode | openclaw | hermes | nanoclaw`).option(`--api-key <key>`,`Tangle API key (or set TANGLE_API_KEY)`).option(`--endpoint <url>`,`OTLP endpoint base`,kr).option(`-p, --project <key>`,`Project label (tangle.subject.key) to group runs; omit to set it yourself`).option(`--rc <path>`,`Shell rc file to append the Claude Code env block to`).option(`--no-write`,`Print the config instead of writing files (Claude Code / Codex)`).option(`--inline-key`,"Embed the resolved API key literally in the config (default: keep ${TANGLE_API_KEY})").option(`--verify`,`Poll onboarding status and report whether CONTENT is flowing`).option(`--timeout <seconds>`,`Verify poll timeout in seconds`,`120`).option(`--run`,`OpenCode only: run the content exporter against a live OpenCode server until interrupted`).option(`--opencode-url <url>`,`OpenCode server base URL for --run (or set OPENCODE_BASE_URL)`).option(`--format <kind>`,`Claude Code output: shell (export block) | env (.env / docker --env-file) | dockerfile (ENV lines). env/dockerfile are the cron/container path — printed to stdout, no shell-rc edit, no TTY`,`shell`).option(`--content <tier>`,`Claude Code content tier: full (everything) | prompts (task+prompts+tool-args) | metadata (telemetry on, content off)`,`full`).action(async(e,t)=>{try{let n=W(t.endpoint);if(t.run){if((e?ea(e):`opencode`)!==`opencode`)throw Error(`--run is OpenCode-only: it runs the content exporter against a live OpenCode server. Other agents export natively once configured.`);await ca({endpoint:n,apiKey:Mi(t.apiKey),opencodeUrl:t.opencodeUrl});return}if(t.verify){await la({endpoint:n,apiKey:Mi(t.apiKey),agent:e?ea(e):void 0,timeoutSeconds:Ei(t.timeout,`--timeout`)});return}let r=e?ea(e):await ra(),i=t.inlineKey?Mi(t.apiKey):void 0;r===`claude-code`?await ia({endpoint:n,apiKey:i,projectKey:t.project,rcPath:t.rc,write:t.write!==!1,content:na(t.content),format:ta(t.format)}):r===`codex`?aa({endpoint:n,apiKey:i,projectKey:t.project,write:t.write!==!1}):r===`opencode`?oa({endpoint:n}):sa(r,{endpoint:n}),console.log(),M(`Run your agent on a real task, then verify content is flowing: tangle connect ${r} --verify`)}catch(e){R(e)}})}function $i(){return new t(`opencode-exporter`).description(`Export a running OpenCode's content to Tangle Intelligence (standalone shim)`).option(`--api-key <key>`,`Tangle API key (or set TANGLE_API_KEY)`).option(`--endpoint <url>`,`OTLP endpoint base`,kr).option(`--opencode-url <url>`,`OpenCode server base URL (or set OPENCODE_BASE_URL)`).action(async e=>{try{await ca({endpoint:W(e.endpoint),apiKey:Mi(e.apiKey),opencodeUrl:e.opencodeUrl})}catch(e){R(e)}})}function ea(e){if(ji(e))return e;throw Error(`Unknown agent '${e}'. Choose one of: ${Di.join(`, `)}`)}function ta(e){if(e===`shell`||e===`env`||e===`dockerfile`)return e;throw Error(`--format must be one of: shell, env, dockerfile (got '${e}')`)}function na(e){if(e===`full`||e===`prompts`||e===`metadata`)return e;throw Error(`--content must be one of: full, prompts, metadata (got '${e}')`)}async function ra(){if(!process.stdin.isTTY)throw Error(`Specify an agent: tangle connect <${Di.join(`|`)}>`);console.log(`Which coding agent are you connecting?`),Di.forEach((e,t)=>{console.log(`  ${t+1}) ${Oi[e]} (${e})`)});let e=await U(`Enter a number or name`,`1`);return Di[Number.parseInt(e,10)-1]||ea(e.trim())}async function ia(e){let t=Ii({endpoint:e.endpoint,apiKey:e.apiKey,projectKey:e.projectKey,content:e.content,format:e.format});if(console.log(t),e.format!==`shell`){console.log(),M(e.format===`env`?"Cron/container path: feed these to your service env (.env, `docker run --env-file`, k8s envFrom). No shell-rc edit, no TTY needed.":`Dockerfile path: paste these ENV lines into your image. No shell-rc edit, no TTY needed.`);return}if(console.log(),M(`Privacy tiers: --content full ships the whole conversation; --content prompts keeps task, prompts, and tool args only; --content metadata turns content off (telemetry still flows). Secrets are scrubbed server-side regardless.`),!e.write)return;let n=e.rcPath??Yi(),r=process.stdin.isTTY?await U(`Append this idempotent block to ${n}? (y/N)`,`n`):`n`;if(r.toLowerCase()!==`y`&&r.toLowerCase()!==`yes`){console.log(),M(`Not writing. To append later: tangle connect claude-code --rc ${n}`);return}let i=Li({endpoint:e.endpoint,apiKey:e.apiKey,projectKey:e.projectKey,content:e.content,format:e.format}),{contents:a,changed:o}=Ri(Xi(n),i);if(!o){console.log(),A(`Already present in ${n} — nothing to change.`);return}Zi(n,a),console.log(),A(`Wrote Tangle Intelligence env block to ${n}.`),M(`Reload your shell (e.g. 'source ${n}') before running the agent.`)}function aa(e){let t=m(pe(),`.codex`,`config.toml`),{contents:n,changed:r}=Gi(Xi(t),{endpoint:e.endpoint,apiKey:e.apiKey});if(!e.write){console.log(n.trimEnd());return}if(!r){A(`${t} already has the Tangle [otel] block — nothing to change.`);return}Zi(t,n),A(`Merged the Tangle [otel] block into ${t}.`),M("Codex emits content on the logs signal (codex.* events). Set TANGLE_API_KEY in your env before running if you kept the ${TANGLE_API_KEY} reference."),M(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=${e.projectKey??`<your project>`} before running codex.`)}function oa(e){let t=W(e.endpoint);$t(`OpenCode has no native OTel exporter, so a standalone install emits nothing without a shim.`),console.log(),P({"Inside a Tangle sandbox":`already instrumented — our adapter exports OpenCode's event-stream content. Nothing to do.`,Standalone:`run 'tangle connect opencode --run' alongside a running OpenCode, exporting to ${t}.`}),console.log(),M(`Start OpenCode in server mode ('opencode serve'), then in another terminal run: tangle connect opencode --run`),M(`The exporter subscribes to OpenCode's SSE event bus and exports content-bearing OTLP (prompt/completion/tool content) to Tangle. Verify with: tangle connect opencode --verify`),M(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=my-project before starting the exporter.`)}function sa(e,t){let n=W(t.endpoint),r=Oi[e];$t(`${r} has no native OTel exporter, so a standalone install emits nothing without instrumentation.`),console.log(),P({"Inside a Tangle sandbox":`already instrumented — the sidecar adapter exports ${r}'s prompt/completion/tool content (gen_ai.system=${e}) to ${n}. Nothing to do.`,Standalone:`${r} exposes no OTLP and no event-bus server; run it inside a Tangle sandbox to capture content.`}),console.log(),M(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=my-project before starting ${r}.`),M(`Verify content is flowing: tangle connect ${e} --verify`)}async function ca(e){let t=xi(e.opencodeUrl),n=new AbortController,r=()=>n.abort();process.on(`SIGINT`,r),process.on(`SIGTERM`,r),M(`Subscribing to OpenCode at ${t} — exporting content to Tangle.`),M(`Run OpenCode tasks now. Press Ctrl-C to stop.`),console.log();let i=0,a;try{a=await Ti({endpoint:e.endpoint,apiKey:e.apiKey,opencodeBaseUrl:t,signal:n.signal,onExport:({eventType:e,records:t})=>{i+=t,M(`exported ${t} record(s) from ${e} (total ${i})`)}})}catch(e){if(e instanceof Ci){let{recordsExported:t,contentEventsExported:n}=e.partial;console.log(),$t(`Exporter failed after exporting ${t} content record(s) from ${n} event(s): ${e.message}`)}throw e}finally{process.off(`SIGINT`,r),process.off(`SIGTERM`,r)}if(console.log(),a.contentEventsExported===0){$t(`Saw ${a.eventsSeen} event(s) but none carried content. Run a real OpenCode task (a prompt that produces text or a tool call), then re-run.`);return}A(`Exported ${a.recordsExported} content record(s) from ${a.contentEventsExported} event(s).`),M(`Verify it landed: tangle connect opencode --verify`)}async function la(e){let t=Date.now()+e.timeoutSeconds*1e3,n=3e3,r=Math.min(e.timeoutSeconds*1e3,1e4),i=N(`Checking whether content is flowing…`);i.start();let a;try{for(;;){try{a=await Wr({endpoint:e.endpoint,apiKey:e.apiKey,timeoutMs:r})}catch(e){if(Date.now()>=t)throw e;await da(n);continue}if(a.contentSeen||Date.now()>=t)break;await da(n)}}finally{i.stop()}if(!a)throw Error(`onboarding status check returned no result`);ua(a,e.agent),a.contentSeen||(process.exitCode=1)}function ua(e,t){if(e.contentSeen){A(`Content flowing — Tangle Intelligence can analyze this feed.`),P({"Last seen":e.lastSeenAt??`just now`,Window:`${e.windowDays}d`});return}if(e.tracesSeen){$t(`Metadata-only — traces are arriving but carry no content. You missed a content gate.`);let n=t?[t]:Object.keys(e.byAgent).filter(ji),r=n.length>0?n:Di;for(let n of r){let r=e.byAgent[n];(t||!r||r.tracesSeen&&!r.contentSeen)&&M(Ji(n))}return}$t(`No traces yet for your tenant. Run your agent once on a real task, then re-run --verify.`),t&&M(Ji(t))}function da(e){return new Promise(t=>setTimeout(t,e))}function fa(){let e=new t(`environments`).alias(`env`).description(`Manage sandbox environments`);return e.command(`list`).alias(`ls`).description(`List available environments`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=D(w({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=N(`Fetching environments...`);e.json||n.start();let r=await t.environments.list();n.stop(),e.json?k(r):r.length===0?console.log(`No environments found`):L([`ID`,`Description`,`Version`],r.map(e=>[e.id,e.description??``,e.version]))}catch(e){R(e)}}),e.command(`get`).description(`Get environment details`).argument(`<id>`,`Environment ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D(w({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=N(`Fetching environment...`);t.json||r.start();let i=await n.environments.get(e);if(r.stop(),!i){console.error(`Environment not found: ${e}`),process.exit(1);return}t.json?k(i):(console.log(`ID:          ${i.id}`),console.log(`Description: ${i.description??`-`}`),console.log(`Version:     ${i.version}`),i.base&&console.log(`Base:        ${i.base}`))}catch(e){R(e)}}),e}function pa(){return new t(`exec`).description(`Execute a command in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command...>`,`Command to execute`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`,`60000`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=D(r),a=t.join(` `),o={};if(n.env)for(let e of n.env){let[t,...n]=e.split(`=`);t&&n.length>0&&(o[t]=n.join(`=`))}let s=N(`Executing: ${a}`);n.json||s.start();let c=await B(i,r,e);c=await V(c);let l=await c.exec(a,{cwd:n.cwd,env:Object.keys(o).length>0?o:void 0,timeoutMs:Number.parseInt(n.timeout,10)});s.stop(),n.json?k(l):(l.stdout&&process.stdout.write(l.stdout),l.stderr&&process.stderr.write(l.stderr),l.exitCode!==0&&process.exit(l.exitCode))}catch(e){if(e instanceof h){let t=`Exec transport lost before command status was confirmed. Remote command status is unknown. Original error: ${e.message}. For long-running commands, use \`tangle process spawn\`, \`tangle process logs\`, and \`tangle process kill --tree\`.`;return R(Error(t,{cause:e}))}R(e)}})}const ma=[`runpod`,`vast-ai`,`lambda-labs`,`tensordock`,`paperspace`,`aws`,`gcp`,`azure`,`crusoe`,`fluidstack`];function ha(e){let t=e.memory?K(e.memory,`--accelerator-memory`):void 0;return{kind:ba(e.kind),count:e.count?K(e.count,`--accelerator-count`):1,...t===void 0?{}:{memoryMB:t}}}function ga(e,t,n){let r=!!(e.provider||e.image||e.env||e.maxSpendUsd||e.maxLifetime||e.idleTimeout);if(!t&&r)throw Error(n);if(t){if(!e.maxSpendUsd||!e.maxLifetime)throw Error(`--accelerator-kind requires --gpu-max-spend-usd and --gpu-max-lifetime`);return{...e.provider?{provider:ya(e.provider,`--gpu-provider`)}:{},...e.image?{image:e.image}:{},...e.env?{env:va(e.env,`--gpu-env`,`GPU env`)}:{},maxSpendUsd:xa(e.maxSpendUsd,`--gpu-max-spend-usd`),maxLifetimeSeconds:K(e.maxLifetime,`--gpu-max-lifetime`),...e.idleTimeout?{idleTimeoutSeconds:K(e.idleTimeout,`--gpu-idle-timeout`)}:{}}}}function _a(e){return{...e.provider?{provider:ya(e.provider,`GPU provider`)}:{},accelerator:ha({kind:e.acceleratorKind,count:e.acceleratorCount,memory:e.acceleratorMemory}),...e.image?{image:e.image}:{},...e.env?{env:va(e.env,`--env`,`env`)}:{},maxSpendUsd:xa(e.maxSpendUsd,`--max-spend-usd`),maxLifetimeSeconds:K(e.maxLifetime,`--max-lifetime`),...e.idleTimeout?{idleTimeoutSeconds:K(e.idleTimeout,`--idle-timeout`)}:{}}}function va(e,t,n){let r={};for(let i of e){let[e,...a]=i.split(`=`);if(!e||a.length===0)throw Error(`${t} expects ${n} values in KEY=VALUE format`);r[e]=a.join(`=`)}return r}function K(e,t){if(!/^\d+$/.test(e))throw Error(`${t} must be a positive integer`);let n=Number.parseInt(e,10);if(Number.isNaN(n)||n<1)throw Error(`${t} must be a positive integer`);return n}function ya(e,t){if(ma.includes(e))return e;throw Error(`${t} must be one of ${ma.join(`, `)}`)}function ba(e){let t=e.trim().toLowerCase();if(/^[a-z0-9][a-z0-9._-]*$/.test(t))return t;throw Error(`--accelerator-kind must contain only letters, numbers, dots, underscores, or hyphens`)}function xa(e,t){if(!/^(?:\d+|\d+\.\d+|\.\d+)$/.test(e))throw Error(`${t} must be a positive number`);let n=Number.parseFloat(e);if(!Number.isFinite(n)||n<=0)throw Error(`${t} must be a positive number`);return n}const Sa=[`list`,`create`,`delete`,`exec`,`prompt`,`read`,`write`];function Ca(){let e=new t(`fleet`).description(`Manage sandbox fleets`);return e.command(`create`).description(`Create a sandbox fleet`).option(`--fleet-id <id>`,`Stable fleet id (generated when omitted)`).option(`--count <n>`,`Number of worker machines`,`1`).option(`--image <env>`,`Environment/image for each machine`).option(`--cpu <cores>`,`CPU cores per machine`).option(`--memory <mb>`,`Memory in MB per machine`).option(`--disk <gb>`,`Disk in GB per machine`).option(`--accelerator-kind <kind>`,`Accelerator kind per machine, for example nvidia-l4 or nvidia-h100`).option(`--accelerator-count <count>`,`Accelerator devices per machine`).option(`--accelerator-memory <mb>`,`Minimum accelerator memory in MB per machine`).option(`--gpu-provider <provider>`,`GPU cloud provider per machine; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for each GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum spend per machine GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum GPU lease lifetime per machine in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy each GPU lease after this many idle seconds`).option(`--driver <type>`,`Infrastructure driver type`).option(`--backend <id>`,`Agent backend type`).option(`--workspace <mode>`,`Workspace mode: isolated | shared`,`isolated`).option(`--max-spend-usd <n>`,`Fleet spend cap in USD (policy)`).option(`--max-lifetime <s>`,`Max machine lifetime in seconds (policy)`).option(`--spec <file.json>`,`Path to a JSON file describing the fleet (overrides synthesized machines)`).option(`--coordinator`,`Create a coordinator + workers fleet (routes to createWithCoordinator)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=D(w({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=N(`Creating fleet...`);n.start();let r=e.coordinator?await t.fleets.createWithCoordinator(Da(e)):await t.fleets.create(Ea(e));n.stop();let i=ja(r.machines);e.json?k({fleetId:r.fleetId,machines:i}):(A(`Fleet created: ${r.fleetId}`),O(i,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}]))}catch(e){R(e)}}),e.command(`list <fleet-id>`).description(`List the machines of one fleet (fleet id is required)`).option(`--status <status>`,`Filter machines by status`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D(w({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=N(`Fetching fleet...`);r.start();let i=await n.fleets.list({fleetId:e,status:t.status});r.stop();let a=ja(i.machines);t.json?k({fleetId:i.fleetId,machines:a}):O(a,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}])}catch(e){R(e)}}),e.command(`get <fleet-id>`).description(`Show one fleet's manifest (server record)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D(w({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=N(`Fetching manifest...`);r.start();let i=await n.fleets.manifest(e);r.stop(),t.json?k(i):(P({"Fleet ID":i.fleetId??i.id,Machines:i.machines.length,"Workspace mode":i.workspace?.mode,"Workspace status":i.workspace?.status,"Max lifetime (s)":i.policy?.maxLifetimeSeconds,"Max spend (USD)":i.policy?.maxSpendUsd,Created:i.createdAt,Updated:i.updatedAt}),O(i.machines.map(e=>({machineId:e.machineId,sandboxId:e.sandboxId,role:e.role,status:e.status})),[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`role`,header:`Role`,width:14},{key:`status`,header:`Status`,width:14}]))}catch(e){R(e)}}),e.command(`delete <fleet-id>`).description(`Delete a fleet's machine sandboxes and its record`).option(`--continue-on-error`,`Keep deleting remaining machines if one delete fails`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D(w({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=N(`Deleting fleet...`);r.start(),await n.fleets.delete(e,{continueOnError:t.continueOnError}),r.stop(),t.json?k({success:!0,fleetId:e}):A(`Fleet deleted: ${e}`)}catch(e){R(e)}}),e.command(`reap`).description(`TTL cleanup of all expired fleets (fleet-wide)`).option(`--dry-run`,`Report what would be reaped without deleting`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=D(w({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=N(`Reaping expired fleets...`);n.start();let r=await t.fleets.reapExpired({dryRun:e.dryRun});n.stop(),e.json?k(r):(P({"Dry run":r.dryRun,Expired:r.expired,Deleted:r.deleted}),O(r.fleets.map(e=>({fleetId:e.fleetId,expiredAt:e.expiredAt,deleted:e.deleted})),[{key:`fleetId`,header:`Fleet`,width:24},{key:`expiredAt`,header:`Expired`,width:18},{key:`deleted`,header:`Deleted`,width:10}]))}catch(e){R(e)}}),e.command(`reconcile`).description(`Drop fleet records whose underlying sandboxes vanished`).option(`--dry-run`,`Report orphans without removing them`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=D(w({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=N(`Reconciling fleets...`);n.start();let r=await t.fleets.reconcile({dryRun:e.dryRun});n.stop(),e.json?k(r):(P({"Dry run":r.dryRun,Checked:r.checked,Orphaned:r.orphaned,Removed:r.removed}),O(r.machines.map(e=>({fleetId:e.fleetId,machineId:e.machineId,sandboxId:e.sandboxId,removed:e.removed})),[{key:`fleetId`,header:`Fleet`,width:24},{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`removed`,header:`Removed`,width:10}]))}catch(e){R(e)}}),e.addCommand(wa()),e.command(`exec <fleet-id> <command>`).description(`Run a shell command across the fleet's machines`).option(`--machine <id...>`,`Restrict to a subset of machine ids (default: all)`).option(`--cwd <dir>`,`Working directory for the command`).option(`--timeout <ms>`,`Per-machine timeout in milliseconds`).option(`--max-concurrent <n>`,`Max concurrent dispatches`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D(w({apiKey:n.apiKey,baseUrl:n.baseUrl})),i=N(`Dispatching command...`);i.start();let a=await(await r.fleets.list({fleetId:e})).dispatchExecDetailed(t,{machines:n.machine,cwd:n.cwd,timeoutMs:n.timeout?Number(n.timeout):void 0,maxConcurrent:n.maxConcurrent?Number(n.maxConcurrent):void 0});if(i.stop(),n.json)k(a);else{O(a.results.map(e=>({machineId:e.machineId,ok:e.ok,exitCode:e.result?.exitCode,durationMs:e.durationMs})),[{key:`machineId`,header:`Machine`,width:20},{key:`ok`,header:`OK`,width:6},{key:`exitCode`,header:`Exit`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14}]);for(let e of a.results){let t=e.result?.stdout,n=e.result?.stderr;t&&(console.log(`\n[${e.machineId}] stdout:`),console.log(t)),n&&(console.log(`\n[${e.machineId}] stderr:`),console.log(n)),e.error&&console.log(`\n[${e.machineId}] error: ${e.error.message}`)}}a.results.some(e=>e.ok===!1)&&(process.exitCode=1)}catch(e){R(e)}}),e.command(`capabilities`).description(`List fleet drivers and their supported features`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=D(w({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=N(`Fetching capabilities...`);n.start();let r=await t.fleets.capabilities();n.stop(),e.json?k(r):O(r.drivers.map(e=>({driverType:e.driverType,sharedWorkspace:e.sharedWorkspace,accelerators:e.accelerators,queueTimings:e.queueTimings})),[{key:`driverType`,header:`Driver`,width:16},{key:`sharedWorkspace`,header:`Shared WS`,width:12},{key:`accelerators`,header:`Accel`,width:8},{key:`queueTimings`,header:`Queue`,width:8}])}catch(e){R(e)}}),e.command(`usage <fleet-id>`).description(`Show fleet usage and reliability insights`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D(w({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=N(`Fetching usage...`);r.start();let i=await n.fleets.usage(e);if(r.stop(),t.json)k(i);else if(P({"Fleet ID":i.usage.fleetId,Status:i.usage.status,Machines:i.usage.machineCount,Running:i.usage.runningMachines,Failed:i.usage.failedMachines,"Runtime (ms)":i.usage.meteredUsage?.runtimeMs,"Reliability score":i.insights.reliabilityScore,"Failure rate":i.insights.failureRate}),i.insights.recommendedActions.length>0){console.log(`
-Recommended actions:`);for(let e of i.insights.recommendedActions)console.log(`  - ${e}`)}}catch(e){R(e)}}),e.command(`cost <fleet-id>`).description(`Show the fleet's cost estimate`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D(w({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=N(`Estimating cost...`);r.start();let i=await n.fleets.cost(e);r.stop(),t.json?k(i):P({Plan:i.plan,Currency:i.currency,"Hourly (USD)":i.hourlyUsd,"Max lifetime (s)":i.maxLifetimeSeconds,"Estimated max lifetime (USD)":i.estimatedMaxLifetimeUsd,Machines:i.requestedResources.machines,"Total CPU":i.requestedResources.totalCpu,"Total memory (MB)":i.requestedResources.totalMemoryMb})}catch(e){R(e)}}),e.command(`token <fleet-id>`).description(`Mint a scoped fleet bearer token (treated as a secret)`).option(`--action <a...>`,`Allowed actions: list create delete exec prompt read write`).option(`--ttl-minutes <n>`,`Token lifetime in minutes`).option(`--json`,`Output as JSON (only path that prints the full token)`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D(w({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=N(`Minting fleet token...`);r.start();let i=await n.fleets.createToken(e,{actions:Ma(t.action),ttlMinutes:t.ttlMinutes?Number(t.ttlMinutes):void 0});r.stop(),t.json?k(i):(P({"Fleet ID":i.fleetId,Token:Na(i.token),"Expires at":new Date(i.expiresAt).toISOString(),Actions:i.actions.join(`, `)}),console.log(`
-Re-run with --json to print the full token value.`))}catch(e){R(e)}}),e}function wa(){let e=new t(`workspace`).description(`Manage a fleet's shared workspace`);return e.command(`snapshot <fleet-id>`).description(`Snapshot the fleet's shared workspace`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D(w({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=N(`Creating workspace snapshot...`);r.start();let i=await n.fleets.createWorkspaceSnapshot(e);r.stop(),t.json?k(i):A(`Workspace snapshot created: ${i.snapshotId??i.id}`)}catch(e){R(e)}}),e.command(`restore <fleet-id> <snapshot-id>`).description(`Restore the fleet's shared workspace from a snapshot`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D(w({apiKey:n.apiKey,baseUrl:n.baseUrl})),i=N(`Restoring workspace...`);i.start();let a=await r.fleets.restoreWorkspaceSnapshot(e,t);i.stop(),n.json?k(a):A(`Workspace restored from ${a.snapshotId??t}`)}catch(e){R(e)}}),e.command(`reconcile <fleet-id>`).description(`Re-mount the shared workspace on all fleet machines`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D(w({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=N(`Reconciling workspace...`);r.start();let i=await n.fleets.reconcileWorkspace(e);r.stop(),t.json?k(i):(P({"Fleet ID":i.fleetId,Checked:i.checked,"Orphaned mounts":i.orphanedMounts}),O(i.machines.map(e=>({machineId:e.machineId,sandboxId:e.sandboxId,mounted:e.mounted})),[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`mounted`,header:`Mounted`,width:10}]))}catch(e){R(e)}}),e}function Ta(e){if(e.spec){let t=JSON.parse(u(e.spec,`utf8`));return{base:{fleetId:e.fleetId,defaults:t.defaults,policy:t.policy,workspace:t.workspace,metadata:t.metadata},machines:t.machines??[]}}let t=Oa(e),n=ka(e,!!t?.accelerator),r={...e.image?{environment:e.image}:{},...t?{resources:t}:{},...e.driver?{driver:{type:e.driver}}:{},...n?{gpuLease:n}:{},...e.backend?{backend:{type:e.backend}}:{}},i=Aa(e),a=Math.max(1,Number(e.count)||1),o=Array.from({length:a},(e,t)=>({machineId:`worker-${t+1}`}));return{base:{fleetId:e.fleetId,defaults:Object.keys(r).length>0?r:void 0,policy:i,workspace:{mode:e.workspace}},machines:o}}function Ea(e){let{base:t,machines:n}=Ta(e);return{...t,machines:n}}function Da(e){let{base:t,machines:n}=Ta(e);return{...t,workers:n}}function Oa(e){let t={};if(e.cpu&&(t.cpuCores=Number(e.cpu)),e.memory&&(t.memoryMB=Number(e.memory)),e.disk&&(t.diskGB=Number(e.disk)),e.acceleratorKind)t.accelerator=ha({kind:e.acceleratorKind,count:e.acceleratorCount,memory:e.acceleratorMemory});else if(e.acceleratorCount||e.acceleratorMemory)throw Error(`--accelerator-count and --accelerator-memory require --accelerator-kind`);return Object.keys(t).length>0?t:void 0}function ka(e,t){return ga({provider:e.gpuProvider,image:e.gpuWorkerImage,env:e.gpuEnv,maxSpendUsd:e.gpuMaxSpendUsd,maxLifetime:e.gpuMaxLifetime,idleTimeout:e.gpuIdleTimeout},t,`Fleet GPU lease flags require --accelerator-kind`)}function Aa(e){let t={};return e.maxSpendUsd&&(t.maxSpendUsd=Number(e.maxSpendUsd)),e.maxLifetime&&(t.maxLifetimeSeconds=Number(e.maxLifetime)),Object.keys(t).length>0?t:void 0}function ja(e){return[...e.entries()].map(([e,t])=>({machineId:e,sandboxId:t.id,status:t.status}))}function Ma(e){if(!(!e||e.length===0)){for(let t of e)if(!Sa.includes(t))throw Error(`Invalid token action '${t}'. Allowed: ${Sa.join(`, `)}`);return e}}function Na(e){return e.length<=12?`****`:`${e.slice(0,6)}...${e.slice(-4)} (masked — use --json for full value)`}function Pa(){let e=new t(`fs`).description(`File system operations on sandboxes`);return q(e.command(`upload`).description(`Upload a file to a sandbox`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<local-path>`,`Local file path`).argument(`<remote-path>`,`Remote destination path`).option(`--json`,`Output as JSON`)).action(async(e,t,n,r)=>{try{let{context:i,client:a}=J(r),s=await B(a,i,e);if(s=await V(s),!o.existsSync(t))throw Error(`Local file not found: ${t}`);let c=o.statSync(t),l=Date.now();console.log(`Uploading ${t} to ${n}...`),await s.fs.upload(t,n,{onProgress:e=>{let t=e.percentage.toFixed(1);process.stdout.write(`\rProgress: ${t}% (${e.bytesUploaded}/${e.totalBytes} bytes)`)}});let u=Date.now()-l;console.log(``),r.json?I({success:!0,localPath:t,remotePath:n,size:c.size,durationMs:u}):console.log(`✓ Uploaded ${c.size} bytes in ${u}ms`)}catch(e){F(e,r.json)}}),q(e.command(`download`).description(`Download a file from a sandbox`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<remote-path>`,`Remote file path`).argument(`<local-path>`,`Local destination path`).option(`--json`,`Output as JSON`)).action(async(e,t,n,r)=>{try{let{context:i,client:a}=J(r),s=await B(a,i,e);s=await V(s);let c=Date.now();console.log(`Downloading ${t} to ${n}...`),await s.fs.download(t,n,{onProgress:e=>{let t=e.percentage.toFixed(1);process.stdout.write(`\rProgress: ${t}% (${e.bytesDownloaded}/${e.totalBytes} bytes)`)}});let l=Date.now()-c,u=o.statSync(n);console.log(``),r.json?I({success:!0,remotePath:t,localPath:n,size:u.size,durationMs:l}):console.log(`✓ Downloaded ${u.size} bytes in ${l}ms`)}catch(e){F(e,r.json)}}),q(e.command(`ls`).description(`List directory contents`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`[path]`,`Directory path`,`.`).option(`-l, --long`,`Show detailed information`).option(`-a, --all`,`Include hidden files`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await B(i,r,e);a=await V(a);let o=await a.fs.list(t.startsWith(`/`)?t:`/${t}`,{all:n.all,long:n.long});if(n.json)I(o);else if(n.long)L([`Mode`,`Owner`,`Group`,`Size`,`Modified`,`Name`],o.map(e=>{let t=e.isDir?`d`:e.isSymlink?`l`:`-`,n=Fa(e.permissions),r=e.isDir?`<DIR>`:Ia(e.size),i=e.modTime.toLocaleDateString();return[t+n,e.owner,e.group,r,i,e.name]}));else{let e=o.map(e=>e.isDir?`${e.name}/`:e.name);console.log(e.join(`  `))}}catch(e){F(e,n.json)}}),q(e.command(`stat`).description(`Get file or directory information`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to file or directory`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await B(i,r,e);a=await V(a);let o=await a.fs.stat(t.startsWith(`/`)?t:`/${t}`);n.json?I(o):(console.log(`  File: ${o.name}`),console.log(`  Path: ${o.path}`),console.log(`  Size: ${Ia(o.size)} (${o.size} bytes)`),console.log(`  Type: ${o.isDir?`directory`:o.isSymlink?`symlink`:`file`}`),console.log(`  Mode: ${Fa(o.permissions)} (${o.permissions.toString(8)})`),console.log(`  Owner: ${o.owner}`),console.log(`  Group: ${o.group}`),console.log(`  Modified: ${o.modTime.toISOString()}`),console.log(`  Accessed: ${o.accessTime.toISOString()}`))}catch(e){F(e,n.json)}}),q(e.command(`cat`).description(`Print file contents`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to file`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await B(i,r,e);a=await V(a);let o=await a.read(t.startsWith(`/`)?t:`/${t}`);n.json?I({path:t,content:o}):console.log(o)}catch(e){F(e,n.json)}}),q(e.command(`rm`).description(`Delete a file or directory`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to delete`).option(`-r, --recursive`,`Delete directories recursively`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await B(i,r,e);a=await V(a),await a.fs.delete(t.startsWith(`/`)?t:`/${t}`,{recursive:n.recursive}),n.json?I({success:!0,path:t,deleted:!0}):console.log(`✓ Deleted: ${t}`)}catch(e){F(e,n.json)}}),q(e.command(`mkdir`).description(`Create a directory`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Directory path to create`).option(`-p, --parents`,`Create parent directories as needed`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await B(i,r,e);a=await V(a),await a.fs.mkdir(t.startsWith(`/`)?t:`/${t}`,{recursive:n.parents}),n.json?I({success:!0,path:t,created:!0}):console.log(`✓ Created: ${t}`)}catch(e){F(e,n.json)}}),q(e.command(`exists`).description(`Check if a path exists`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to check`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=J(n),a=await B(i,r,e);a=await V(a);let o=await a.fs.exists(t.startsWith(`/`)?t:`/${t}`);n.json?I({path:t,exists:o}):(console.log(o?`exists`:`not found`),process.exit(+!o))}catch(e){F(e,n.json)}}),e}function Fa(e){let t=[`r`,`w`,`x`],n=``;for(let r=2;r>=0;r--){let i=r*3;for(let r=0;r<3;r++)n+=e>>i+(2-r)&1?t[r]:`-`}return n}function Ia(e){let t=[`B`,`KB`,`MB`,`GB`,`TB`],n=e,r=0;for(;n>=1024&&r<t.length-1;)n/=1024,r++;return r===0?`${n}${t[r]}`:`${n.toFixed(1)}${t[r]}`}function q(e){return e.option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`)}function J(e){let t=w({apiKey:e.apiKey,baseUrl:e.baseUrl});return{context:t,client:D(t)}}function La(){let e=new t(`git`).description(`Git operations in a sandbox workspace`);return e.command(`status`).description(`Show git repository status`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Fetching status...`);t.json||i.start();let a=await B(r,n,e);a=await V(a);let o=await a.git.status();if(i.stop(),t.json)k(o);else{if(console.log(`Branch:    ${o.branch}`),console.log(`HEAD:      ${o.head.slice(0,7)}`),console.log(`Dirty:     ${o.isDirty?`yes`:`no`}`),o.ahead&&console.log(`Ahead:     ${o.ahead}`),o.behind&&console.log(`Behind:    ${o.behind}`),o.staged.length>0){console.log(`\nStaged (${o.staged.length}):`);for(let e of o.staged)console.log(`  + ${e}`)}if(o.modified.length>0){console.log(`\nModified (${o.modified.length}):`);for(let e of o.modified)console.log(`  M ${e}`)}if(o.untracked.length>0){console.log(`\nUntracked (${o.untracked.length}):`);for(let e of o.untracked)console.log(`  ? ${e}`)}}}catch(e){R(e)}}),e.command(`log`).description(`Show commit log`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`-n, --limit <count>`,`Max commits to show`,`10`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Fetching log...`);t.json||i.start();let a=await B(r,n,e);a=await V(a);let o=await a.git.log(Number.parseInt(t.limit,10));if(i.stop(),t.json)k(o);else if(o.length===0)console.log(`No commits found`);else for(let e of o)console.log(`${e.shortSha} ${e.message.split(`
-`)[0]} (${e.author}, ${e.date.toLocaleDateString()})`)}catch(e){R(e)}}),e.command(`diff`).description(`Show diff`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--ref <ref>`,`Ref to diff against`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Fetching diff...`);t.json||i.start();let a=await B(r,n,e);a=await V(a);let o=await a.git.diff(t.ref);i.stop(),t.json?k(o):o.raw?console.log(o.raw):console.log(`${o.additions} additions, ${o.deletions} deletions across ${o.files.length} files`)}catch(e){R(e)}}),e.command(`add`).description(`Stage files`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<paths...>`,`Paths to stage`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=await B(D(r),r,e);i=await V(i),await i.git.add(t),A(`Staged: ${t.join(`, `)}`)}catch(e){R(e)}}),e.command(`commit`).description(`Create a commit`).argument(`<id-or-name>`,`Sandbox ID or name`).requiredOption(`-m, --message <msg>`,`Commit message`).option(`--amend`,`Amend the previous commit`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=await B(D(n),n,e);r=await V(r);let i=await r.git.commit(t.message,{amend:t.amend});t.json?k(i):A(`Committed: ${i.shortSha} ${i.message}`)}catch(e){R(e)}}),e.command(`push`).description(`Push to remote`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--force`,`Force push`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Pushing...`);i.start();let a=await B(r,n,e);a=await V(a),await a.git.push({force:t.force}),i.stop(),A(`Pushed to remote`)}catch(e){R(e)}}),e.command(`pull`).description(`Pull from remote`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--rebase`,`Rebase instead of merge`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Pulling...`);i.start();let a=await B(r,n,e);a=await V(a),await a.git.pull({rebase:t.rebase}),i.stop(),A(`Pulled from remote`)}catch(e){R(e)}}),e.command(`branches`).description(`List branches`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Fetching branches...`);t.json||i.start();let a=await B(r,n,e);a=await V(a);let o=await a.git.branches();i.stop(),t.json?k(o):o.length===0?console.log(`No branches found`):L([`Name`,`Current`,`Remote`],o.map(e=>[e.name,e.current?`* `:`  `,e.upstream??`-`]))}catch(e){R(e)}}),e.command(`checkout`).description(`Checkout a branch or ref`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<ref>`,`Branch name or ref`).option(`-b, --create`,`Create a new branch`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=await B(D(r),r,e);i=await V(i),await i.git.checkout(t,{create:n.create}),A(`Checked out: ${t}${n.create?` (new)`:``}`)}catch(e){R(e)}}),e}function Ra(){let e=new t(`hub`).description(`Discover and run Tangle Hub tools`);e.option(`--json`,`Output as JSON`),e.hook(`preAction`,(e,t)=>{Ba(t)}),e.command(`connect`).description(`Connect a provider account`).argument(`provider`,`Provider to connect`).option(`--no-browser`,`Print the authorization URL instead of opening it`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await(await z(t)).connections.start(e,{cli:!0});if(t.json){k(ro(n));return}no(n,t.browser===!1?!1:await ir(n.redirectUrl))}catch(e){Y(e,t)}});let n=new t(`connections`).description(`List Hub provider connections`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await(await z(e)).connections.list();if(e.json){k(t);return}to(t.connections)}catch(t){Y(t,e)}});n.command(`revoke <connection-id>`).description(`Revoke a Hub provider connection`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await z(t),r=await Ut(n,e);if(!t.force&&!await H(`Revoke Hub connection ${r}? `)){M(`Revoke cancelled.`);return}let i=await n.connections.revoke(r);if(t.json){k(i);return}M(`Revoked Hub connection ${i.connection.id}.`)}catch(e){Y(e,t)}}),e.addCommand(n);let r=new t(`permissions`).description(`Manage Hub action permissions`);r.command(`list`).description(`List Hub permissions for a connection`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{if(!e.connection)throw Error(`--connection is required.`);let t=await z(e),n=await Ut(t,e.connection),r=await t.permissions.list(n);if(e.json){k(r);return}Xa(r.policies)}catch(t){Y(t,e)}}),r.command(`set`).description(`Set Hub permission for one action`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).requiredOption(`--action <path>`,`Executor action path`).requiredOption(`--decision <allow|ask|deny>`,`Permission decision`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{if(!e.connection)throw Error(`--connection is required.`);if(!e.action)throw Error(`--action is required.`);let t=Za(e.decision),n=await z(e),r=await Ut(n,e.connection),i=await n.permissions.set({connectionId:r,actionPath:e.action,decision:t});if(e.json){k(i);return}Xa([i.policy])}catch(t){Y(t,e)}}),r.command(`revert-writes`).description("Revoke a bulk `--allow-writes` grant for a connection (deletes only the auto-granted write rows; manual permissions are untouched)").requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{if(!e.connection)throw Error(`--connection is required.`);let t=await z(e),n=await Ut(t,e.connection),r=await t.permissions.revertWrites(n);if(e.json){k(r);return}M(`Reverted ${r.reverted} write permission${r.reverted===1?``:`s`} for connection ${r.connectionId}.`)}catch(t){Y(t,e)}}),e.addCommand(r);let i=new t(`approvals`).description(`List and resolve Hub execution approvals`);i.command(`list`).description(`List pending Hub execution approvals`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await(await z(e)).approvals.list();if(e.json){k(t);return}Ga(t.approvals)}catch(t){Y(t,e)}}),i.command(`approve`).description(`Approve a pending Hub execution approval`).argument(`approval-id`,`Hub approval ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{Wa(e),Ka(await(await z(t)).approvals.approve(e),t.json===!0)}catch(e){Y(e,t)}}),i.command(`deny`).description(`Deny a pending Hub execution approval`).argument(`approval-id`,`Hub approval ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{Wa(e),Ka(await(await z(t)).approvals.deny(e),t.json===!0)}catch(e){Y(e,t)}}),e.addCommand(i);let a=new t(`tools`).description(`Discover Hub tools`);return a.command(`sources`).description(`List Hub tool sources`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await(await z(e)).tools.sources();if(e.json){k(t);return}Qa(t.sources)}catch(t){Y(t,e)}}),a.command(`describe`).description(`Describe a Hub tool`).argument(`path`,`Executor tool path`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await(await z(t)).tools.describe(e);if(t.json){k(n);return}$a(n.tool)}catch(e){Y(e,t)}}),a.command(`search`).description(`Search Hub tools`).argument(`<query...>`,`Search query`).option(`--provider <provider>`,`Filter by provider/source ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await(await z(t)).tools.search(e.join(` `),{provider:t.provider});if(t.json){k(n);return}Ya(n.tools)}catch(e){Y(e,t)}}),e.addCommand(a),e.addCommand(za(`call`)),e.addCommand(za(`exec`)),e.command(`resume`).description(`Resolve a Hub approval created by a paused execution`).argument(`approval-id`,`Hub approval ID from HUB_APPROVAL_REQUIRED`).option(`--accept`,`Approve the execution approval`).option(`--decline`,`Deny the execution approval`).option(`--cancel`,`Unsupported for approval-backed Hub resume`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{if(Wa(e),t.cancel)throw Error(`Hub approval resume does not support --cancel. Use --decline to deny the approval.`);if(t.accept&&t.decline)throw Error(`Choose only one of --accept or --decline.`);if(!t.accept&&!t.decline)throw Error(`Choose --accept to approve or --decline to deny the Hub approval.`);let n=await z(t);Ka(t.decline?await n.approvals.deny(e):await n.approvals.approve(e),t.json===!0)}catch(e){Y(e,t)}}),e.command(`status`).description(`Show Hub auth and connection status`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await(await z(e)).status();if(e.json){k(t);return}io(t)}catch(t){Y(t,e)}}),e}function za(e){return new t(e).description(`Execute a Hub tool`).argument(`<args...>`,`Tool path tokens followed by JSON input`).option(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--auto-approve`,`Approve a HUB_APPROVAL_REQUIRED execution and retry once`).option(`--approve`,`Alias for --auto-approve`).option(`--no-hub-key`,`Do not auto-mint a platform Hub key; use the stored credential as-is`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let{args:n,approve:r}=Ua(e,t),{path:i,input:a}=Ja(n),o=await z(t),s=t.connection?await Ut(o,t.connection):void 0;k((await o.tools.invoke(i,a,{connectionId:s,approve:r})).result)}catch(e){Y(e,t)}})}function Ba(e){if(!Va(e,`json`)||e.getOptionValue(`json`)!==void 0)return;let t=e.parent;for(;t;){let n=t.getOptionValue(`json`);if(n!==void 0){e.setOptionValue(`json`,n);return}t=t.parent}}function Va(e,t){return e.options.some(e=>e.attributeName()===t)}function Ha(e){return e.json===!0}function Y(e,t){return Ha(t)?R(e,!0):R(e)}function Ua(e,t){let n=t.autoApprove;return{args:e.filter(e=>e!==`--approve`&&e!==`--auto-approve`),approve:t.approve===!0||n===!0||e.includes(`--approve`)||e.includes(`--auto-approve`)}}function Wa(e){if(!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`Hub approval ID must contain only letters, numbers, underscores, and dashes.`)}function Ga(e){O(e.map(e=>({id:e.id,provider:e.providerId,action:e.actionPath,connection:e.connectionId,status:e.status,expires:e.expiresAt})),[{key:`id`,header:`ID`},{key:`provider`,header:`Provider`},{key:`action`,header:`Action`},{key:`connection`,header:`Connection`},{key:`status`,header:`Status`},{key:`expires`,header:`Expires`}])}function Ka(e,t){if(t){k(qa(e));return}M(`Hub approval ${e.approval.id} ${e.approval.status}.`),e.capabilityToken&&M("Capability token minted. Re-run the original command with `--approve` to execute automatically.")}function qa(e){return{approval:e.approval,...e.capabilityToken?{capabilityToken:{tokenId:e.capabilityToken.tokenId,expiresAt:e.capabilityToken.expiresAt}}:{}}}function Ja(e){if(e.length<2)throw Error(`Usage: tangle hub call <path> <json-input>`);let t=e.at(-1);if(t===void 0)throw Error(`Usage: tangle hub call <path> <json-input>`);try{return{path:e.slice(0,-1).join(`.`),input:JSON.parse(t)}}catch{throw Error(`Hub call input must be valid JSON.`)}}function Ya(e){O(e.map(e=>({path:e.path,provider:e.providerId??e.requiredConnectionProviderId,title:e.title,description:e.description,connection:eo(e),policy:e.policyState})),[{key:`path`,header:`Path`},{key:`provider`,header:`Provider`},{key:`title`,header:`Title`},{key:`description`,header:`Description`},{key:`connection`,header:`Connection`},{key:`policy`,header:`Policy`}])}function Xa(e){O(e.map(e=>({connection:e.connectionId,provider:e.providerId,action:e.actionPath,decision:e.decision,updated:e.updatedAt})),[{key:`connection`,header:`Connection`},{key:`provider`,header:`Provider`},{key:`action`,header:`Action`},{key:`decision`,header:`Decision`},{key:`updated`,header:`Updated`}])}function Za(e){if(e===`allow`||e===`ask`||e===`deny`)return e;throw Error(`--decision must be one of: allow, ask, deny.`)}function Qa(e){O(e.map(e=>({source:e.sourceId,provider:e.displayName,tools:e.toolCount,connection:e.connectionStatus,health:e.health,configured:e.configured})),[{key:`source`,header:`Source`},{key:`provider`,header:`Provider`},{key:`tools`,header:`Tools`},{key:`connection`,header:`Connection`},{key:`health`,header:`Health`},{key:`configured`,header:`Configured`}])}function $a(e){P({Path:e.path,Provider:e.providerId??e.requiredConnectionProviderId,Title:e.title,Description:e.description,Connection:eo(e),Policy:e.policyState}),e.inputSchema!==void 0&&(M(`Input schema`),console.log(JSON.stringify(e.inputSchema,null,2))),e.outputSchema!==void 0&&(M(`Output schema`),console.log(JSON.stringify(e.outputSchema,null,2)))}function eo(e){if(e.connectionRequired===!1)return`not required`;if(e.connectionStatus)return e.connectionStatus}function to(e){O(e.map(e=>({id:e.id,provider:e.providerId,account:e.accountDisplay??e.displayName,scopes:e.scopes.join(`, `),status:e.status,health:e.health,lastUsed:e.lastUsedAt})),[{key:`id`,header:`ID`},{key:`provider`,header:`Provider`},{key:`account`,header:`Account`},{key:`scopes`,header:`Scopes`},{key:`status`,header:`Status`},{key:`health`,header:`Health`},{key:`lastUsed`,header:`Last Used`}])}function no(e,t){t?M(`Opened browser to connect ${e.provider}.`):(M(`Open this URL to connect ${e.provider}:`),console.log(e.redirectUrl)),M("Finish authorization in the browser, then rerun `tangle hub status`.")}function ro(e){return{provider:e.provider,redirectUrl:e.redirectUrl,expiresAt:e.expiresAt,scopes:e.scopes,cli:e.cli}}function io(e){let{principal:t,connections:n}=e;M(`Hub status`),P({Principal:t.kind,"User ID":t.userId,"API Key ID":t.apiKeyId,"Sandbox ID":t.sandboxId,"Connected Providers":n.connectedProviderCount,"Unhealthy Providers":n.unhealthyProviderCount}),n.unhealthyProviderCount>0&&M(`Some providers require reconnect.`)}function ao(){let e=new t(`intelligence`).description(`Create and inspect trace intelligence reports`);return e.command(`connect [agent]`).alias(`connect-agent`).description(`Connect local agent CLIs to Tangle Intelligence`).option(`--api-key <key>`,`Intelligence ingest API key`).option(`--endpoint <url>`,`OTLP endpoint base`,kr).option(`--workspace <path>`,`Workspace to write hook files into`,`.`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`,`local`).option(`--dry-run`,`Print planned writes without changing files`).option(`--hook-command <command>`,`Command native hooks should run`,`tangle intelligence hook`).option(`--no-smoke`,`Skip the install smoke trace`).option(`--json`,`Output as JSON`).action(async(e,t)=>{try{let n=e??`local`;Pr(n);let r=so(t.apiKey),i=await zr({selection:n,workspace:t.workspace,apiKey:r,endpoint:t.endpoint,serviceName:t.serviceName??Ir(t.workspace),environment:t.environment,smoke:t.smoke,dryRun:!!t.dryRun,hookCommand:t.hookCommand}),a={configPath:i.configPath,agents:i.agents,nativeAgents:i.nativeAgents,manual:i.manual,written:i.written,smokeTraceId:i.smokeTraceId};if(t.json){k(a);return}P({Config:i.configPath,Agents:i.agents.join(`, `),"Native Hooks":i.nativeAgents.join(`, `)||void 0,"Manual Setup":i.manual.length?i.manual.map(e=>`${e.label}: ${e.reason}`).join(` `):void 0,Files:i.written.join(`, `),"Smoke Trace":i.smokeTraceId})}catch(e){R(e)}}),e.command(`doctor`).description(`Check whether your agent traces carry CONTENT or are metadata-only`).option(`--api-key <key>`,`Intelligence ingest API key`).option(`--endpoint <url>`,`OTLP endpoint base`,kr).option(`--json`,`Output as JSON`).action(async e=>{try{let t=Rr(),n=await Wr({endpoint:e.endpoint===`https://intelligence.tangle.tools/v1/otlp`?t?.endpoint??`https://intelligence.tangle.tools/v1/otlp`:e.endpoint,apiKey:so(e.apiKey??t?.apiKey)});e.json?k(n):oo(n),n.contentSeen||(process.exitCode=1)}catch(e){R(e)}}),e.command(`hook`).description(`Emit one local agent hook event to Tangle Intelligence`).requiredOption(`--agent <agent>`,`Agent surface`).requiredOption(`--event <event>`,`Hook event name`).option(`--payload <json>`,`Hook payload JSON`).option(`--api-key <key>`,`Intelligence ingest API key`).option(`--endpoint <url>`,`OTLP endpoint base`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`).option(`--session-id <id>`,`Session id override`).option(`--dry-run`,`Build the OTLP request without sending it`).option(`--non-blocking`,`Do not fail the parent agent process`).option(`--json`,`Output as JSON`).action(async e=>{try{let t=co(e.agent),n=Rr(),r={agent:t,event:e.event,endpoint:e.endpoint??n?.endpoint??`https://intelligence.tangle.tools/v1/otlp`,apiKey:so(e.apiKey??n?.apiKey),serviceName:e.serviceName??n?.serviceName??Ir(process.cwd()),environment:e.environment??n?.environment??`local`,sessionId:e.sessionId,payload:e.payload===void 0?await uo():lo(e.payload)};if(e.dryRun){let n=Vr(r);if(e.json){k(n);return}P({Trace:n.traceId,Agent:t,Event:e.event});return}let i=await Hr(r);if(e.json){k({traceId:i});return}P({Trace:i,Agent:t,Event:e.event})}catch(t){if(e.nonBlocking){let n=t instanceof Error?t.message:String(t);e.json?k({ok:!1,error:n}):console.error(`Tangle Intelligence hook skipped: ${n}`);return}R(t)}}),e.command(`sandbox <sandbox-id>`).description(`Create an intelligence report for one sandbox`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{await fo({type:`sandbox`,id:e},t)}),e.command(`fleet <fleet-id>`).description(`Create an intelligence report for a sandbox fleet`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{await fo({type:`fleet`,id:e},t)}),e.command(`create`).description(`Create a trace intelligence report`).requiredOption(`--subject-type <type>`,`sandbox | fleet`).requiredOption(`--subject-id <id>`,`Subject identifier`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{await fo({type:mo(e.subjectType),id:e.subjectId},e)}),e.command(`get <job-id>`).description(`Get an intelligence report`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D(w({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=t.json?null:N(`Fetching intelligence report...`);r?.start();let i=await n.intelligence.getReport(e);if(r?.stop(),t.json){k(i);return}po(i)}catch(e){R(e)}}),e.command(`list`).description(`List intelligence reports`).option(`--subject-type <type>`,`sandbox | fleet`).option(`--subject-id <id>`,`Subject identifier`).option(`--limit <count>`,`Maximum reports to return`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=D(w({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=e.json?null:N(`Fetching intelligence reports...`);n?.start();let r=await t.intelligence.listReports({subjectType:e.subjectType===void 0?void 0:mo(e.subjectType),subjectId:e.subjectId,limit:e.limit===void 0?void 0:_o(e.limit)});if(n?.stop(),e.json){k(r);return}O(r.map(e=>({jobId:e.jobId,subject:`${e.subject.type}:${e.subject.id}`,mode:e.mode,status:e.status,cost:`$${e.billing.costUsd.toFixed(2)}`,updatedAt:e.updatedAt})),[{key:`jobId`,header:`Job`,width:20},{key:`subject`,header:`Subject`,width:28},{key:`mode`,header:`Mode`,width:15},{key:`status`,header:`Status`,width:14},{key:`cost`,header:`Cost`,width:10},{key:`updatedAt`,header:`Updated`,width:18}])}catch(e){R(e)}}),e}function oo(e){P({Status:e.contentSeen?`content flowing`:e.tracesSeen?`metadata-only — a content gate is missing`:`no traces yet`,"Traces seen":e.tracesSeen?`yes`:`no`,"Content seen":e.contentSeen?`yes`:`no`,"Last seen":e.lastSeenAt??`never`,Window:`${e.windowDays}d`});let t=Object.entries(e.byAgent);t.length>0&&(console.log(),O(t.map(([e,t])=>({agent:e,traces:t.tracesSeen?`yes`:`no`,content:t.contentSeen?`yes`:`no`})),[{key:`agent`,header:`Agent`,width:18},{key:`traces`,header:`Traces`,width:10},{key:`content`,header:`Content`,width:10}]))}function so(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??process.env.TANGLE_API_KEY;if(!t)throw Error(`--api-key, TANGLE_INTELLIGENCE_API_KEY, or TANGLE_API_KEY is required`);return t}function co(e){if(Fr(e))return e;throw Error(`agent must be a known Tangle Intelligence agent surface`)}function lo(e){try{return JSON.parse(e)}catch(e){throw Error(`--payload must be JSON: ${e instanceof Error?e.message:String(e)}`)}}async function uo(){if(process.stdin.isTTY)return;let e=``;for await(let t of process.stdin)if(e+=typeof t==`string`?t:t.toString(`utf8`),e.length>65536)throw Error(`hook payload exceeds 65536 bytes`);let t=e.trim();if(t)try{return JSON.parse(t)}catch{return{body:t.slice(0,4096)}}}async function fo(e,t){try{let n=ho(t.mode),r=vo(t.metadata),i=t.maxUsd===void 0?void 0:go(t.maxUsd);if(n===`agentic`&&i===void 0)throw Error(`Agentic intelligence reports require --max-usd`);let a=D(w({apiKey:t.apiKey,baseUrl:t.baseUrl})),o=t.json?null:N(`Creating intelligence report...`);o?.start();let s=await a.intelligence.createReport({subject:e,mode:n,...i===void 0?{}:{budget:{billTo:`customer`,maxUsd:i}},...r===void 0?{}:{metadata:r}});if(o?.stop(),t.json){k(s);return}po(s)}catch(e){R(e)}}function po(e){P({Job:e.jobId,Subject:`${e.subject.type}:${e.subject.id}`,Mode:e.mode,Status:e.status,"Billed To":e.billing.billedTo,Cost:`$${e.billing.costUsd.toFixed(2)}`,Budget:e.billing.budgetMaxUsd===void 0?void 0:`$${e.billing.budgetMaxUsd.toFixed(2)}`,Updated:e.updatedAt}),e.result!==null&&(console.log(),k(e.result))}function mo(e){if(e===`sandbox`||e===`fleet`)return e;throw Error(`subject type must be sandbox or fleet`)}function ho(e){if(e===`deterministic`||e===`agentic`)return e;throw Error(`mode must be deterministic or agentic`)}function go(e){let t=Number(e);if(!Number.isFinite(t)||t<0)throw Error(`--max-usd must be a non-negative number`);return t}function _o(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function vo(e){if(e===void 0)return;let t=JSON.parse(e);if(!t||typeof t!=`object`||Array.isArray(t))throw Error(`--metadata must be a JSON object`);return t}const yo=[`router`,`sandbox`,`blueprint-agent`,`evals`,`agent-builder`];function bo(e){return(e?.trim()||process.env.TANGLE_PLATFORM_URL?.trim()||`https://id.tangle.tools`).replace(/\/+$/,``)}async function xo(e,t,n={}){let r=new Headers(n.headers);r.set(`Authorization`,`Bearer ${t}`),n.body&&!r.has(`content-type`)&&r.set(`content-type`,`application/json`);let i=await fetch(e,{...n,headers:r});if(n.expected!==void 0&&i.status!==n.expected){let t=await i.text().catch(()=>``),n=t?`: ${t.slice(0,400)}`:``;throw Error(`Platform request to ${e} returned ${i.status}${n}`)}return i}const So=[`ID`,`Prefix`,`Name`,`Product`,`Created`,`Last used`,`Expires`];function Co(e){return[e.id,e.keyPrefix??``,e.name,e.product??`all`,e.createdAt,e.lastUsedAt??`—`,e.expiresAt??`—`]}function wo(){let e=new t(`keys`).description(`Manage sk-tan-* API keys on id.tangle.tools`);return e.command(`list`).description(`List your active API keys`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key (overrides configured credentials)`).option(`--base-url <url>`,`Sandbox API base URL (not platform URL)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async e=>{try{let t=w({apiKey:e.apiKey,baseUrl:e.baseUrl}),n=await(await xo(`${bo(e.platformUrl)}/v1/keys`,t.apiKey,{expected:200})).json();if(e.json){k(n);return}L(So,n.data.map(Co))}catch(e){R(e)}}),e.command(`create`).description(`Create a new API key`).argument(`<name>`,`Human-readable name for the key`).option(`--product <product>`,`Restrict the key to one product (${yo.join(`|`)}). Omit for all products.`).option(`--budget-usd <amount>`,`Hard budget cap in USD`).option(`--rpm-limit <limit>`,`Requests-per-minute cap`).option(`--expires-in-days <days>`,`Expire the key after N days (integer)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key (overrides configured credentials)`).option(`--base-url <url>`,`Sandbox API base URL (not platform URL)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(e,t)=>{try{if(t.product!==void 0&&!yo.includes(t.product))throw Error(`Invalid --product. Expected one of ${yo.join(`, `)}`);let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=bo(t.platformUrl),i=t.expiresInDays===void 0?void 0:new Date(Date.now()+Number.parseInt(t.expiresInDays,10)*24*60*60*1e3).toISOString(),a=N(`Creating API key...`);a.start();let o=await xo(`${r}/v1/keys`,n.apiKey,{method:`POST`,expected:201,body:JSON.stringify({name:e,product:t.product,budgetUsd:t.budgetUsd?Number.parseFloat(t.budgetUsd):void 0,rpmLimit:t.rpmLimit?Number.parseInt(t.rpmLimit,10):void 0,expiresAt:i})});a.stop();let s=await o.json();if(t.json){k(s);return}A(`API key created: ${s.data.prefix}…`),M(`Copy this key now — it will never be shown again:\n${s.data.key}`)}catch(e){R(e)}}),e.command(`revoke`).description(`Revoke an API key`).argument(`<keyId>`,"Key ID (from `tcloud keys list`)").option(`--yes`,`Skip the confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key (overrides configured credentials)`).option(`--base-url <url>`,`Sandbox API base URL (not platform URL)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=bo(t.platformUrl);if(!t.yes&&!await H(`Revoke key ${e}? Any service still using it will start to fail.`)){M(`Aborted.`);return}let i=await(await xo(`${r}/v1/keys/${encodeURIComponent(e)}`,n.apiKey,{method:`DELETE`,expected:200})).json();if(t.json){k(i);return}A(`Revoked ${e}`)}catch(e){R(e)}}),e}function To(){let e=new t(`mcp`).description(`Model Context Protocol bridge commands.`);return e.command(`serve <id-or-name>`).description(`Run a local MCP server (stdio) backed by the given sandbox (ID or name). Pipe its stdio from an MCP client config to expose sandbox tools.`).option(`-s, --session <id>`,`Session id for kernel scoping`,`mcp-local`).option(`--name <name>`,`MCP server name reported to clients`,`tangle-sandbox`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=await B(D(n),n,e),i;try{i=(await import(`@modelcontextprotocol/sdk/server/stdio.js`)).StdioServerTransport}catch{throw Error("`@modelcontextprotocol/sdk` is not installed in this environment. Install it with: pnpm add -g @modelcontextprotocol/sdk (or as a dev dep in the project running this command).")}let{connect:a,close:o}=await De(r,{sessionId:t.session,name:t.name});await a(new i),process.stdin.resume(),process.stdin.on(`end`,()=>{o().finally(()=>process.exit(0))});for(let e of[`SIGINT`,`SIGTERM`])process.on(e,()=>{o().finally(()=>process.exit(0))})}catch(e){R(e)}}),e}function Eo(){let e=new t(`permissions`).description(`Manage sandbox user permissions`);return e.command(`list <sandboxId-or-name>`).description(`List all users in a sandbox`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Fetching users...`);i.start();let a=await(await B(r,n,e)).permissions.list();i.stop(),t.json?k(a):O(a.map(e=>({userId:e.userId,username:e.username,role:e.role,homeDir:e.homeDir,createdAt:e.createdAt.toISOString().split(`T`)[0]})),[{key:`userId`,header:`User ID`,width:20},{key:`username`,header:`Username`,width:16},{key:`role`,header:`Role`,width:12},{key:`homeDir`,header:`Home Directory`,width:24},{key:`createdAt`,header:`Created`,width:16}])}catch(e){R(e)}}),e.command(`get <sandboxId-or-name> <userId>`).description(`Get details for a specific user`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=D(r),a=N(`Fetching user...`);a.start();let o=await(await B(i,r,e)).permissions.get(t);if(a.stop(),!o)throw Error(`User ${t} not found in sandbox ${e}`);n.json?k(o):(M(`User: ${o.userId}`),M(`  Username: ${o.username}`),M(`  Role: ${o.role}`),M(`  Home: ${o.homeDir}`),M(`  SSH Keys: ${o.sshKeys.length}`),M(`  Created: ${o.createdAt.toISOString()}`))}catch(e){R(e)}}),e.command(`add <sandboxId-or-name>`).description(`Add a user to a sandbox`).requiredOption(`--user-id <id>`,`User ID (from your auth system)`).option(`--username <name>`,`Preferred username`).option(`--role <role>`,`Permission level (owner, admin, developer, viewer)`,`developer`).option(`--ssh-key <key>`,`SSH public key for access`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Adding user...`);i.start();let a=await(await B(r,n,e)).permissions.add({userId:t.userId,username:t.username,role:t.role,sshKeys:t.sshKey?[t.sshKey]:void 0});i.stop(),t.json?k(a):(A(`User ${a.userId} added as ${a.role}`),M(`  Username: ${a.username}`),M(`  Home: ${a.homeDir}`))}catch(e){R(e)}}),e.command(`update <sandboxId-or-name> <userId>`).description(`Update a user's permissions`).option(`--role <role>`,`New permission level (owner, admin, developer, viewer)`).option(`--add-ssh-key <key>`,`Add SSH public key`).option(`--remove-ssh-key <key>`,`Remove SSH public key`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=D(r),a=N(`Updating user...`);a.start();let o=await(await B(i,r,e)).permissions.update(t,{role:n.role,addSshKeys:n.addSshKey?[n.addSshKey]:void 0,removeSshKeys:n.removeSshKey?[n.removeSshKey]:void 0});a.stop(),n.json?k(o):(A(`User ${t} updated`),M(`  Role: ${o.role}`),M(`  SSH Keys: ${o.sshKeys.length}`))}catch(e){R(e)}}),e.command(`remove <sandboxId-or-name> <userId>`).description(`Remove a user from a sandbox`).option(`--preserve-home`,`Keep user's home directory`).option(`-f, --force`,`Skip confirmation`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{if(!n.force){let e=(await import(`node:readline`)).createInterface({input:process.stdin,output:process.stdout});if(!await new Promise(n=>{e.question(`Remove user ${t} from sandbox? [y/N] `,t=>{e.close(),n(t.toLowerCase()===`y`)})})){M(`Cancelled.`);return}}let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=D(r),a=N(`Removing user...`);a.start(),await(await B(i,r,e)).permissions.remove(t,{preserveHomeDir:n.preserveHome}),a.stop(),A(`User ${t} removed from sandbox ${e}`)}catch(e){R(e)}}),e.command(`policies <sandboxId-or-name> <userId>`).description(`Get access policies for a user`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=D(r),a=N(`Fetching policies...`);a.start();let o=await(await B(i,r,e)).permissions.getAccessPolicies(t);a.stop(),n.json?k(o):o.length===0?M(`No access policies configured`):O(o.map(e=>({pattern:e.pattern,permission:e.permission,priority:e.priority??0})),[{key:`pattern`,header:`Pattern`,width:30},{key:`permission`,header:`Permission`,width:12},{key:`priority`,header:`Priority`,width:10}])}catch(e){R(e)}}),e.command(`check <sandboxId-or-name> <userId> <path> <action>`).description(`Check if a user can perform an action on a path`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r,i)=>{try{if(![`read`,`write`,`execute`].includes(r))throw Error(`Action must be: read, write, or execute`);let a=w({apiKey:i.apiKey,baseUrl:i.baseUrl}),o=D(a),s=N(`Checking access...`);s.start();let c=await(await B(o,a,e)).permissions.checkAccess(t,n,r);s.stop(),c?A(`✓ User ${t} CAN ${r} ${n}`):M(`✗ User ${t} CANNOT ${r} ${n}`)}catch(e){R(e)}}),e}function Do(){let e=new t(`preview`).description(`Manage sandbox preview links`);return e.command(`list`).alias(`ls`).description(`List active preview links for a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Fetching preview links...`);t.json||i.start();let a=await(await B(r,n,e)).previewLinks.list();i.stop(),t.json?k(a):a.length===0?console.log(`No preview links found`):L([`Preview ID`,`Port`,`URL`,`Status`],a.map(e=>[e.previewId.slice(0,12),String(e.port),e.url,e.status]))}catch(e){R(e)}}),e.command(`create`).description(`Create a preview link for a port`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<port>`,`Port number to preview`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=D(r),a=N(`Creating preview for port ${t}...`);n.json||a.start();let o=await(await B(i,r,e)).previewLinks.create(Number.parseInt(t,10));a.stop(),n.json?k(o):(A(`Preview created: ${o.url}`),console.log(`Preview ID: ${o.previewId}`))}catch(e){R(e)}}),e.command(`remove`).alias(`rm`).description(`Remove a preview link`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<preview-id>`,`Preview link ID (from 'preview list')`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=D(r),a=N(`Removing preview...`);n.json||a.start(),await(await B(i,r,e)).previewLinks.remove(t),a.stop(),n.json?k({success:!0,previewId:t}):A(`Preview removed: ${t}`)}catch(e){R(e)}}),e}function Oo(){let e=new t(`process`).description(`Manage processes in a sandbox`);return e.command(`spawn`).description(`Spawn a process without blocking (returns PID)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command>`,`Command to execute`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`).option(`--blocking`,`Wait for completion (default: false)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=D(r),a={};if(n.env)for(let e of n.env){let[t,...n]=e.split(`=`);t&&n.length>0&&(a[t]=n.join(`=`))}let o=N(`Spawning: ${t}`);n.json||o.start();let s=await B(i,r,e);if(s=await V(s),n.blocking){let e=await s.exec(t,{cwd:n.cwd,env:Object.keys(a).length>0?a:void 0,timeoutMs:n.timeout?Number.parseInt(n.timeout,10):void 0});o.stop(),n.json?k(e):(e.stdout&&globalThis.process.stdout.write(e.stdout),e.stderr&&globalThis.process.stderr.write(e.stderr),e.exitCode!==0&&globalThis.process.exit(e.exitCode))}else{let r=await s.process.spawn(t,{cwd:n.cwd,env:Object.keys(a).length>0?a:void 0,timeoutMs:n.timeout?Number.parseInt(n.timeout,10):void 0});o.stop(),n.json?k({pid:r.pid,command:r.command}):(console.log(`Process started with PID: ${r.pid}`),console.log(`Use 'tangle process logs ${e} ${r.pid}' to view output`))}}catch(e){R(e)}}),e.command(`list`).alias(`ls`).description(`List all processes in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--running`,`Show only running processes`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Fetching processes...`);t.json||i.start();let a=await B(r,n,e);a=await V(a);let o=await a.process.list();t.running&&(o=o.filter(e=>e.running)),i.stop(),t.json?k(o):o.length===0?console.log(`No processes found`):L([`PID`,`Command`,`Status`,`Exit Code`,`Started`],o.map(e=>[String(e.pid),e.command.length>40?`${e.command.slice(0,37)}...`:e.command,e.running?`running`:`exited`,String(e.exitCode),e.startedAt.toLocaleString()]))}catch(e){R(e)}}),e.command(`get`).description(`Get detailed info about a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=D(r),a=N(`Fetching process info...`);n.json||a.start();let o=await B(i,r,e);o=await V(o);let s=await o.process.get(Number.parseInt(t,10));if(a.stop(),!s){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}let c=await s.status();n.json?k(c):(console.log(`PID:        ${c.pid}`),console.log(`Command:    ${c.command}`),console.log(`CWD:        ${c.cwd||`(default)`}`),console.log(`Status:     ${c.running?`running`:`exited`}`),console.log(`Exit Code:  ${c.exitCode}`),c.exitSignal&&console.log(`Signal:     ${c.exitSignal}`),console.log(`Started:    ${c.startedAt.toLocaleString()}`),c.exitedAt&&console.log(`Exited:     ${c.exitedAt.toLocaleString()}`))}catch(e){R(e)}}),e.command(`kill`).description(`Kill a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`-s, --signal <signal>`,`Signal to send (SIGTERM, SIGKILL, etc.)`,`SIGTERM`).option(`--tree`,`Also kill descendants of the tracked process`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=D(r),a=N(`Sending ${n.signal} to PID ${t}...`);n.json||a.start();let o=await B(i,r,e);o=await V(o);let s=await o.process.get(Number.parseInt(t,10));if(!s){a.stop(),console.error(`Process ${t} not found`),globalThis.process.exit(1);return}n.tree?await s.kill(n.signal,{tree:!0}):await s.kill(n.signal),a.stop(),n.json?k({pid:Number.parseInt(t,10),signal:n.signal,...n.tree===!0?{tree:!0}:{},killed:!0}):console.log(n.tree?`Sent ${n.signal} to process tree ${t}`:`Sent ${n.signal} to process ${t}`)}catch(e){R(e)}}),e.command(`logs`).description(`Stream buffered and live process logs until the process exits`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`--stdout-only`,`Only show stdout`).option(`--stderr-only`,`Only show stderr`).option(`--json`,`Output as JSON lines`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=await B(D(r),r,e);i=await V(i);let a=await i.process.get(Number.parseInt(t,10));if(!a){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}for await(let e of a.logs())n.stdoutOnly&&e.type!==`stdout`||n.stderrOnly&&e.type!==`stderr`||(n.json?console.log(JSON.stringify(e)):e.type===`stdout`?globalThis.process.stdout.write(e.data):globalThis.process.stderr.write(e.data))}catch(e){R(e)}}),e.command(`run-code`).description(`Execute Python code directly`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<code>`,`Python code to execute`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=D(r),a={};if(n.env)for(let e of n.env){let[t,...n]=e.split(`=`);t&&n.length>0&&(a[t]=n.join(`=`))}let o=N(`Executing Python code...`);n.json||o.start();let s=await B(i,r,e);s=await V(s);let c=await s.process.runCode(t,{cwd:n.cwd,env:Object.keys(a).length>0?a:void 0,timeoutMs:n.timeout?Number.parseInt(n.timeout,10):void 0});o.stop(),n.json?k(c):(c.stdout&&globalThis.process.stdout.write(c.stdout),c.stderr&&globalThis.process.stderr.write(c.stderr),c.exitCode!==0&&globalThis.process.exit(c.exitCode))}catch(e){R(e)}}),e}const ko=[`python`,`node`,`typescript`,`bash`];function Ao(e){switch(ne(e).toLowerCase()){case`.py`:return`python`;case`.js`:case`.mjs`:case`.cjs`:return`node`;case`.ts`:case`.tsx`:return`typescript`;case`.sh`:case`.bash`:return`bash`;default:return}}async function jo(e){if(e===`-`){let e=[];for await(let t of process.stdin)e.push(typeof t==`string`?Buffer.from(t):t);return Buffer.concat(e).toString(`utf8`)}return await Oe(re(e),`utf8`)}async function Mo(e,t,n=jo){let r=t?ko.find(e=>e===t)??(()=>{throw Error(`unknown --lang ${t}: must be one of ${ko.join(`, `)}`)})():void 0;if(!e||e===`-`){if(!r)throw Error(`reading from stdin requires --lang. Example: tangle run <id> -l python -`);return{language:r,source:await n(`-`)}}let i=Ao(e);return{language:r??i??(()=>{throw Error(`cannot infer language from "${e}". Pass it explicitly: tangle run <id> -l <python|node|typescript|bash> ${e}`)})(),source:await n(e)}}function No(e){return m(me(),`tangle-run-images`,e)}function Po(){return new t(`run`).description(`Run code in a persistent kernel inside a sandbox. Variables persist across calls in the same --session.`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`[file]`,`Path to source file. Language is inferred from extension. Use - for stdin (requires --lang).`).option(`-l, --lang <lang>`,`Force language: ${ko.join(` | `)}. Required for stdin.`).option(`-s, --session <id>`,`Session id for kernel scoping`).option(`-t, --timeout <ms>`,`Per-call timeout in ms (0 disables)`,`60000`).option(`--save-images <dir>`,`Write image results into this directory (default: $TMPDIR/tangle-run-images/<sandbox>/).`).option(`--no-save-images`,`Don't write image results to disk; print summary only`).option(`--json`,`Output the full CodeExecutionResult as JSON`).action(async(e,t,n)=>{try{let{language:r,source:i}=await Mo(t,n.lang),o=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),s=await B(D(o),o,e);s=await V(s);let c=N(`Running ${r} (${i.length}b)…`);n.json||c.start();let u=await s.runCode(r,i,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10)});if(c.stop(),n.json){k(u),u.exitCode!==0&&process.exit(u.exitCode);return}u.stdout&&process.stdout.write(u.stdout),u.stderr&&process.stderr.write(u.stderr);let d=0;for(let t of u.results)if(t.type===`image`)if(n.saveImages!==!1){let r=typeof n.saveImages==`string`?n.saveImages:No(e);l(r,{recursive:!0});let i=`${r}/${Date.now()}-${d}.${t.format}`;f(i,Buffer.from(t.data,`base64`)),process.stderr.write(a.green(`✓ image → ${i}\n`)),d++}else process.stderr.write(a.gray(`[image: ${t.format}, ${t.data.length}b base64]\n`));else if(t.type===`dataframe`){let e=t.columns.map(e=>`${e.name}:${e.dtype}`).join(` | `);process.stderr.write(a.gray(`[dataframe ${t.rows.length}×${t.columns.length}${t.truncated?` (truncated)`:``}]\n`)),process.stderr.write(`${e}\n`);for(let e of t.rows.slice(0,20))process.stderr.write(`${e.map(e=>String(e)).join(` | `)}\n`);t.rows.length>20&&process.stderr.write(a.gray(`… ${t.rows.length-20} more rows\n`))}else t.type===`json`?(process.stderr.write(a.gray(`[json] `)),process.stderr.write(`${JSON.stringify(t.value,null,2)}\n`)):t.type===`html`?process.stderr.write(a.gray(`[html ${t.value.length}b]\n`)):t.type===`error`?(process.stderr.write(a.red(`✗ ${t.name}: ${t.message}\n`)),t.traceback&&process.stderr.write(`${t.traceback}\n`)):t.type===`text`&&process.stderr.write(`${t.value}\n`);u.error&&(process.stderr.write(a.red(`\n✗ ${u.error.name}: ${u.error.message}\n`)),u.error.traceback&&process.stderr.write(`${u.error.traceback}\n`)),u.exitCode!==0&&process.exit(u.exitCode)}catch(e){R(e)}})}function Fo(e){return`${e.name} (${e.id})`}async function Io(e,t){if(t.startsWith(`team_`))return e.teams.get(t);let n=(await e.teams.list()).filter(e=>e.name.toLowerCase()===t.toLowerCase());if(n.length===0)throw Error(`Team not found: ${t}`);if(n.length>1)throw Error(`Team name is ambiguous: ${t}. Use a team id instead.`);return n[0]}async function X(e,t,n){if(t)return Io(e,t);let r=Pt(n);if(!r.activeTeamId)throw Error("No active team. Run `tangle team switch <team>` or pass `--team <team>`.");return e.teams.get(r.activeTeamId)}function Lo(e,t){Ft({id:e.id,name:e.name},t)}function Ro(e){It(e)}const zo=[{flag:`--git-token`,guidance:`Use --git-token-env <NAME> or --git-token-stdin so the secret never appears in argv (visible to other processes via /proc/<pid>/cmdline) or in shell history.`},{flag:`--storage-secret-access-key`,guidance:`Use --storage-secret-access-key-env <NAME> or --storage-secret-access-key-stdin so the secret never appears in argv (visible to other processes via /proc/<pid>/cmdline) or in shell history.`},{flag:`--backend-api-key`,guidance:`Use --backend-api-key-env <NAME> or --backend-api-key-stdin so the BYOK secret never appears in argv (visible to other processes via /proc/<pid>/cmdline) or in shell history.`}];function Bo(e){for(let{flag:t,guidance:n}of zo){let r=`${t}=`;if(e.some(e=>e===t||e.startsWith(r)))throw Error(`Refusing to read secret from ${t} on the command line. ${n}`)}}async function Vo(e){let t=typeof e.envVarName==`string`&&e.envVarName.length>0?e.envVarName:null,n=!!e.fromStdin;if(t&&n)throw Error(`Pass either ${e.flagPrefix}-env or ${e.flagPrefix}-stdin, not both`);if(t){let n=process.env[t];if(!n||n.length===0)throw Error(`${e.flagPrefix}-env points at ${t}, but that environment variable is empty or unset`);return n}if(n){let t=await kn();if(t.length===0)throw Error(`${e.flagPrefix}-stdin received empty input on stdin`);return t}}function Ho(e){let t=e.split(`/`);return t.length>=2?{provider:t[0],model:t.slice(1).join(`/`)}:{model:e}}function Uo(){let e=new t(`sandbox`).description(`Manage sandboxes`);e.command(`create`).description(`Create a new sandbox`).option(`-n, --name <name>`,`Sandbox name`).option(`-e, --environment <environment>`,`Environment name (e.g. universal, node, python)`).option(`-i, --image <image>`,`Alias for --environment (deprecated)`).option(`--bare`,`Create a bare sandbox without the agent runtime`).option(`--ssh`,`Enable SSH access`).option(`--ssh-key <key>`,`SSH public key for authentication`).option(`--ssh-keys <names...>`,`Stored SSH key names or IDs for authentication`).option(`--ssh-key-file <paths...>`,`SSH public key file paths for authentication`).option(`--web-terminal`,`Enable web terminal`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`--secret <names...>`,`Secrets to inject as environment variables`).option(`--metadata <entries...>`,`Metadata entries (KEY=VALUE or KEY=JSON)`).option(`--cpu <cores>`,`CPU cores`,`2`).option(`--memory <mb>`,`Memory in MB`,`4096`).option(`--disk <gb>`,`Disk size in GB`,`20`).option(`--accelerator-kind <kind>`,`Accelerator kind, for example nvidia-h100 or amd-mi300x`).option(`--accelerator-count <count>`,`Accelerator device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum accelerator memory in MB`).option(`--gpu-provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum customer spend for the create-time GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum create-time GPU lease lifetime in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy the create-time GPU lease after this many idle seconds`).option(`--lifetime <seconds>`,`Max wall-clock lifetime before the sandbox is deleted (default 3600 = 1h). Raise it for long sessions, e.g. --lifetime 7200`,`3600`).option(`--idle-timeout <seconds>`,"Idle time before the sandbox is stopped — not deleted (default 900 = 15m). Resume it later with `tangle sandbox resume <id-or-name>`, or it auto-resumes on next use. Raise it for demos, e.g. --idle-timeout 3600",`900`).option(`--from-snapshot <id>`,`Create the sandbox from a snapshot`).option(`--public-template <id-or-slug>`,`Create the sandbox from a published public template`).option(`--public-template-version <id>`,`Pin creation to a specific published public-template version`).option(`--team <team>`,`Create in a team by id or name`).option(`--personal`,`Create a personal sandbox even when a team is active`).option(`--port <ports...>`,`Ports to expose at creation time`).option(`--git-url <url>`,`Git repository URL to clone during provisioning`).option(`--git-ref <ref>`,`Git branch, tag, or commit to checkout`).option(`--git-depth <depth>`,`Git clone depth`).option(`--git-sparse <paths...>`,`Sparse checkout paths`).option(`--git-token-env <name>`,`Name of an environment variable containing the Git HTTPS auth token`).option(`--git-token-stdin`,`Read the Git HTTPS auth token from stdin`).option(`--git-token <token>`,`[removed] use --git-token-env or --git-token-stdin`).option(`--tool <specs...>`,`Tool versions to preinstall (NAME=VERSION)`).option(`--storage-type <type>`,`BYOS3 storage type (s3, gcs, r2)`).option(`--storage-bucket <name>`,`BYOS3 bucket name`).option(`--storage-endpoint <url>`,`BYOS3 endpoint URL`).option(`--storage-region <region>`,`BYOS3 region`).option(`--storage-prefix <prefix>`,`BYOS3 path prefix`).option(`--storage-access-key-id <id>`,`BYOS3 access key ID`).option(`--storage-secret-access-key-env <name>`,`Name of an environment variable containing the BYOS3 secret access key`).option(`--storage-secret-access-key-stdin`,`Read the BYOS3 secret access key from stdin`).option(`--storage-secret-access-key <key>`,`[removed] use --storage-secret-access-key-env or --storage-secret-access-key-stdin`).option(`--default-role <role>`,`Default permission role (owner, admin, developer, viewer)`).option(`--initial-user <specs...>`,`Initial users (USER_ID or USER_ID:ROLE)`).option(`--multi-user`,`Enable multi-user permissions at creation`).option(`--driver <type>`,`Infrastructure driver (docker, firecracker, host-agent, tangle)`).option(`--driver-criu`,`Enable CRIU checkpointing (firecracker only)`).option(`--driver-region <region>`,`Preferred region for host-agent driver`).option(`--backend <type>`,`Backend agent type (opencode, claude-code, codex, cursor, amp)`).option(`--backend-profile <name>`,`Backend profile name`).option(`--backend-model <model>`,`Model override (format: provider/model)`).option(`--backend-api-key-env <name>`,`Name of an environment variable containing the BYOK backend API key`).option(`--backend-api-key-stdin`,`Read the BYOK backend API key from stdin`).option(`--backend-api-key <key>`,`[removed] use --backend-api-key-env or --backend-api-key-stdin`).option(`--tee <type>`,`Require a TEE backend (any, tdx, nitro, sev-snp, phala-dstack)`).option(`--sealed`,`Request TEE sealed-secret support`).option(`--attestation-nonce <hex|auto>`,`Deploy-time attestation nonce; use auto to generate one`).option(`--attestation-refresh`,`Generate a fresh deploy-time attestation nonce when --tee is set`).option(`--require-attestation`,`Fail unless TEE attestation evidence is returned`).option(`--block-network`,`Block all outbound network traffic`).option(`--allow-list <cidrs>`,`CIDR allowlist for outbound traffic (comma-separated)`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`--timeout <ms>`,`HTTP timeout in milliseconds`,`30000`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{Bo(process.argv);let t=await Vo({envVarName:e.gitTokenEnv,fromStdin:e.gitTokenStdin,flagPrefix:`--git-token`}),n=await Vo({envVarName:e.storageSecretAccessKeyEnv,fromStdin:e.storageSecretAccessKeyStdin,flagPrefix:`--storage-secret-access-key`}),r=await Vo({envVarName:e.backendApiKeyEnv,fromStdin:e.backendApiKeyStdin,flagPrefix:`--backend-api-key`}),i=w({apiKey:e.apiKey,baseUrl:e.baseUrl,timeout:e.timeout?Number.parseInt(e.timeout,10):void 0}),a=D(i),o=N(`Creating sandbox...`);o.start();let s=await Zo({client:a,explicitTeam:e.team,personal:e.personal,activeTeamId:i.activeTeamId}),c={};if(e.env)for(let t of e.env){let[e,...n]=t.split(`=`);e&&n.length>0&&(c[e]=n.join(`=`))}let l=e.tool?va(e.tool,`--tool`,`tool spec`):void 0,d=e.metadata?Go(e.metadata):void 0,f=Jo(e,t),p=Yo(e,n),ee=Xo(e),te=e.port?qo(e.port,`--port`):void 0,ne=e.acceleratorKind?ha({kind:String(e.acceleratorKind),count:String(e.acceleratorCount),memory:typeof e.acceleratorMemory==`string`?e.acceleratorMemory:void 0}):void 0,m=ga({provider:typeof e.gpuProvider==`string`?e.gpuProvider:void 0,image:typeof e.gpuWorkerImage==`string`?e.gpuWorkerImage:void 0,env:Array.isArray(e.gpuEnv)?e.gpuEnv:void 0,maxSpendUsd:typeof e.gpuMaxSpendUsd==`string`?e.gpuMaxSpendUsd:void 0,maxLifetime:typeof e.gpuMaxLifetime==`string`?e.gpuMaxLifetime:void 0,idleTimeout:typeof e.gpuIdleTimeout==`string`?e.gpuIdleTimeout:void 0},!!ne,`Create-time GPU lease flags require --accelerator-kind`),re=e.driver?{type:e.driver,enableCriu:e.driverCriu||void 0,preferredRegion:e.driverRegion}:void 0,ie=e.backend||e.backendProfile||e.backendModel?{type:e.backend??`opencode`,profile:e.backendProfile,model:e.backendModel||r?{...e.backendModel?Ho(e.backendModel):{},apiKey:r}:void 0}:void 0,h=e.blockNetwork||e.allowList||te?{blockOutbound:e.blockNetwork||void 0,allowList:e.allowList?e.allowList.split(`,`).map(e=>e.trim()):void 0,ports:te}:void 0,ae=[...e.sshKey?[e.sshKey]:[],...(e.sshKeyFile??[]).map(e=>u(e,`utf8`).trim())],oe={name:e.name,environment:e.environment??e.image,bare:e.bare||void 0,sshEnabled:e.ssh||!!e.sshKey||ae.length>0||!!e.sshKeys?.length,sshPublicKeys:ae.length>0?ae:void 0,sshKeyIds:e.sshKeys,webTerminalEnabled:e.webTerminal,env:Object.keys(c).length>0?c:void 0,git:f,tools:l,resources:{cpuCores:Number.parseInt(e.cpu,10),memoryMB:Number.parseInt(e.memory,10),diskGB:Number.parseInt(e.disk,10),accelerator:ne},gpuLease:m,maxLifetimeSeconds:Number.parseInt(e.lifetime,10),idleTimeoutSeconds:Number.parseInt(e.idleTimeout,10),storage:p,fromSnapshot:e.fromSnapshot,publicTemplateId:e.publicTemplate,publicTemplateVersionId:e.publicTemplateVersion,teamId:s,secrets:e.secret,metadata:d,driver:re,backend:ie,permissions:ee,network:h},g=e.tee?{tee:e.tee,sealed:e.sealed||void 0,attestationRefresh:e.attestationRefresh||e.attestationNonce===`auto`||void 0}:void 0,_=g?await le(a,{...oe,confidential:g,attestationNonce:e.attestationNonce??(e.attestationRefresh?`auto`:void 0),requireAttestation:e.requireAttestation??!0}):void 0,v=_?.sandbox??await a.create(oe);e.wait&&(o.text=`Waiting for sandbox to start...`,await v.waitFor(`running`,{timeoutMs:12e4}),await v.refresh()),o.stop(),e.json?k({id:v.id,name:v.name,status:v.status,createdAt:v.createdAt,expiresAt:v.expiresAt,connection:Wo(v.connection),teamId:s,gpuLease:v.gpuLease,confidential:g,attestation:_?.attestation,attestationNonce:_?.attestationNonce}):(A(`Sandbox created: ${v.id}`),nn({id:v.id,name:v.name,status:v.status,createdAt:v.createdAt?.toISOString(),expiresAt:v.expiresAt?.toISOString(),connection:v.connection}),s&&console.log(`Team: ${s}`),v.gpuLease&&(console.log(`GPU lease: ${v.gpuLease.id}`),ns(v.gpuLease)),g&&(console.log(`TEE: ${g.tee}`),console.log(`Attestation: ${_?.attestation?`present`:`not returned`}`),_?.attestationNonce&&console.log(`Attestation nonce: ${_.attestationNonce}`)))}catch(e){R(e)}}),e.command(`attestation <id-or-name>`).description(`Fetch TEE attestation evidence for a sandbox`).option(`--nonce <hex|auto>`,`Nonce to bind into a fresh attestation report; use auto to generate one`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=t.nonce===`auto`?ue():t.nonce,a=N(`Fetching TEE attestation...`);a.start();let o=await(await B(r,n,e)).getTeeAttestation(i?{attestationNonce:i}:void 0);a.stop(),t.json?k(o):(A(`Attestation fetched for ${e}`),console.log(`TEE type: ${o.attestation.tee_type}`),console.log(`Evidence bytes: ${o.attestation.evidence.length}`),console.log(`Measurement bytes: ${o.attestation.measurement.length}`),console.log(`Timestamp: ${o.attestation.timestamp}`),o.attestationNonce&&console.log(`Nonce: ${o.attestationNonce}`))}catch(e){R(e)}}),e.command(`list`).description(`List all sandboxes`).option(`-s, --status <status>`,`Filter by status (running, stopped, all)`).option(`-l, --limit <n>`,`Limit results`,`50`).option(`--team <team>`,`List sandboxes for a team by id or name`).option(`--personal`,`List personal sandboxes`).option(`--all-scopes`,`List personal and team sandboxes`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=w({apiKey:e.apiKey,baseUrl:e.baseUrl}),n=D(t),r=N(`Fetching sandboxes...`);r.start();let i=await Qo({client:n,explicitTeam:e.team,personal:e.personal,allScopes:e.allScopes,activeTeamId:t.activeTeamId}),a=await n.list({status:e.status===`all`?void 0:e.status,limit:Number.parseInt(e.limit,10),scope:i});r.stop(),e.json?k(a):O(a.map(e=>({id:e.id,status:e.status,createdAt:e.createdAt,name:e.name??``})),[{key:`id`,header:`ID`,width:24},{key:`status`,header:`Status`,width:14},{key:`createdAt`,header:`Created`,width:16},{key:`name`,header:`Name`,width:20}])}catch(e){R(e)}}),e.command(`get <id-or-name>`).description(`Get sandbox details`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Fetching sandbox...`);i.start();let a=await B(r,n,e);i.stop(),t.json?k(a):nn({id:a.id,name:a.name,status:a.status,createdAt:a.createdAt?.toISOString(),expiresAt:a.expiresAt?.toISOString(),connection:a.connection})}catch(e){R(e)}}),e.command(`delete <id-or-name>`).description(`Delete a sandbox`).option(`-f, --force`,`Skip confirmation`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{if(!t.force){let t=(await import(`node:readline`)).createInterface({input:process.stdin,output:process.stdout});if(!await new Promise(n=>{t.question(`Delete sandbox ${e}? [y/N] `,e=>{t.close(),n(e.toLowerCase()===`y`)})})){M(`Cancelled.`);return}}let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Deleting sandbox...`);i.start(),await(await B(r,n,e)).delete(),i.stop(),A(`Sandbox ${e} deleted.`)}catch(e){R(e)}}),e.command(`stop <id-or-name>`).description(`Stop a running sandbox`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Stopping sandbox...`);i.start(),await(await B(r,n,e)).stop(),i.stop(),A(`Sandbox ${e} stopped.`)}catch(e){R(e)}}),e.command(`resume <id-or-name>`).description(`Resume a stopped sandbox`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`-t, --timeout <ms>`,`Resume timeout in milliseconds; a cold resume re-provisions the sandbox, so this defaults higher than other commands (default 120000)`,`120000`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=Number.parseInt(t.timeout,10);if(!Number.isFinite(n)||n<=0)throw Error(`--timeout must be a positive number of milliseconds`);let r=w({apiKey:t.apiKey,baseUrl:t.baseUrl,timeout:n}),i=D(r),a=N(`Resuming sandbox...`);a.start();let o=await B(i,r,e);await o.resume({timeoutMs:n}),t.wait&&(a.text=`Waiting for sandbox to start...`,await o.waitFor(`running`,{timeoutMs:n})),a.stop(),A(`Sandbox ${o.id} resumed.`)}catch(e){R(e)}});let n=e.command(`gpu`).description(`Manage on-demand GPU leases for a sandbox`);return n.command(`attach <id-or-name>`).description(`Attach a temporary GPU worker to a sandbox`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum GPU memory in MB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Attaching GPU lease...`);i.start();let a=await(await B(r,n,e)).gpu.attach(_a(t));i.stop(),t.json?k(a):(A(`GPU lease attached: ${a.id}`),ns(a))}catch(e){R(e)}}),n.command(`run <id-or-name> <command...>`).description(`Attach a temporary GPU, run a command, then destroy it`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum GPU memory in MB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker and command (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{let r,i,a,o;try{let a=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),o=await B(D(a),a,e),s=N(`Attaching GPU lease...`);s.start(),r=await o.gpu.attach(_a(n)),s.stop();let c=N(`Running GPU command...`);c.start(),i=await o.gpu.exec(r.id,{command:t.join(` `),timeoutMs:n.timeout?K(String(n.timeout),`--timeout`):void 0,cwd:n.cwd,env:n.env?va(n.env,`--env`,`env`):void 0}),c.stop(),n.json||rs(i)}catch(e){a=e}finally{if(r)try{let t=w({apiKey:n.apiKey,baseUrl:n.baseUrl});r=await(await B(D(t),t,e)).gpu.detach(r.id)}catch(e){o=e}}if(a){R(a),o&&R(o);return}if(o){R(o);return}n.json?k({lease:r,result:i}):r&&A(`GPU lease detached: ${r.id}`);let s=i?.result.exitCode;s&&s!==0&&(process.exitCode=s)}),n.command(`list <id-or-name>`).description(`List GPU leases attached to a sandbox`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Fetching GPU leases...`);i.start();let a=await(await B(r,n,e)).gpu.list();i.stop(),t.json?k(a):a.length===0?M(`No GPU leases attached.`):O(a.map(e=>({id:e.id,status:e.status,provider:e.provider,accelerator:`${e.accelerator.kind}x${e.accelerator.count}`,customerUsdHr:e.customerPricePerHourUsd??``})),[{key:`id`,header:`ID`,width:28},{key:`status`,header:`Status`,width:12},{key:`provider`,header:`Provider`,width:12},{key:`accelerator`,header:`GPU`,width:24},{key:`customerUsdHr`,header:`$/hr`,width:10}])}catch(e){R(e)}}),n.command(`exec <id-or-name> <lease-id> <command...>`).description(`Run a command on an attached GPU lease`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=w({apiKey:r.apiKey,baseUrl:r.baseUrl}),a=D(i),o=N(`Running GPU command...`);o.start();let s=await(await B(a,i,e)).gpu.exec(t,{command:n.join(` `),timeoutMs:r.timeout?K(String(r.timeout),`--timeout`):void 0,cwd:r.cwd,env:r.env?va(r.env,`--env`,`env`):void 0});o.stop(),r.json?k(s):rs(s)}catch(e){R(e)}}),n.command(`detach <id-or-name> <lease-id>`).description(`Detach and destroy a GPU lease`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=D(r),a=N(`Detaching GPU lease...`);a.start();let o=await(await B(i,r,e)).gpu.detach(t);a.stop(),n.json?k(o):(A(`GPU lease detached: ${o.id}`),ns(o))}catch(e){R(e)}}),e.command(`network <id-or-name>`).description(`Update network configuration for a sandbox`).option(`--block-outbound`,`Block all outbound network traffic`).option(`--allow-list <cidrs>`,`CIDR allowlist for outbound traffic (comma-separated)`).option(`--clear`,`Clear all network restrictions (allow all traffic)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Updating network configuration...`);i.start();let a=await B(r,n,e);if(t.clear)await a.network.update({blockOutbound:!1,allowList:[]});else if(t.blockOutbound)await a.network.update({blockOutbound:!0});else if(t.allowList){let e=t.allowList.split(`,`).map(e=>e.trim());await a.network.update({allowList:e})}else{i.stop();let e=await a.network.getConfig();t.json?k(e):(M(`Network Configuration:`),e.blockOutbound?M(`  Block Outbound: true (all outbound traffic blocked)`):e.allowList&&e.allowList.length>0?M(`  Allow List: ${e.allowList.join(`, `)}`):M(`  No restrictions (all traffic allowed)`),e.ports&&e.ports.length>0&&M(`  Exposed Ports: ${e.ports.join(`, `)}`));return}i.stop();let o=await a.network.getConfig();t.json?k(o):(A(`Network configuration updated.`),o.blockOutbound?M(`  Block Outbound: true`):o.allowList&&o.allowList.length>0?M(`  Allow List: ${o.allowList.join(`, `)}`):M(`  All traffic allowed`))}catch(e){R(e)}}),e.command(`expose <id-or-name>`).description(`Expose a port and get a public URL`).option(`-p, --port <port>`,`Port to expose`,`8000`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=Number.parseInt(t.port,10);if(Number.isNaN(i)||i<1||i>65535)throw Error(`Port must be a number between 1 and 65535`);let a=N(`Exposing port ${i}...`);a.start();let o=await(await B(r,n,e)).network.exposePort(i);a.stop(),t.json?k({port:i,url:o}):(A(`Port ${i} exposed.`),M(`  URL: ${o}`))}catch(e){R(e)}}),e.command(`urls <id-or-name>`).description(`List exposed port URLs for a sandbox`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Fetching exposed URLs...`);i.start();let a=await(await B(r,n,e)).network.listUrls();if(i.stop(),t.json)k(a);else{let e=Object.entries(a);if(e.length===0)M(`No ports exposed.`);else{M(`Exposed Ports:`);for(let[t,n]of e)M(`  ${t}: ${n}`)}}}catch(e){R(e)}}),e}function Wo(e){return!e||e.authToken===void 0?e:{...e,authToken:`[REDACTED]`}}function Go(e){let t={};for(let n of e){let[e,...r]=n.split(`=`);if(!e||r.length===0)throw Error(`--metadata expects values in KEY=VALUE or KEY=JSON format`);t[e]=Ko(r.join(`=`))}return t}function Ko(e){try{return JSON.parse(e)}catch{return e}}function qo(e,t){return e.map(e=>{let n=Number.parseInt(e,10);if(Number.isNaN(n)||n<1||n>65535)throw Error(`${t} values must be integers between 1 and 65535`);return n})}function Jo(e,t){if(!(!e.gitUrl&&!e.gitRef&&!e.gitDepth&&!e.gitSparse&&!t)){if(!e.gitUrl||typeof e.gitUrl!=`string`)throw Error(`--git-url is required when using git provisioning options`);return{url:e.gitUrl,ref:typeof e.gitRef==`string`?e.gitRef:void 0,depth:typeof e.gitDepth==`string`?K(e.gitDepth,`--git-depth`):void 0,sparse:Array.isArray(e.gitSparse)?e.gitSparse:void 0,auth:t?{token:t}:void 0}}}function Yo(e,t){if(!(!e.storageType&&!e.storageBucket&&!e.storageEndpoint&&!e.storageRegion&&!e.storagePrefix&&!e.storageAccessKeyId&&!t)){if(typeof e.storageType!=`string`||typeof e.storageBucket!=`string`||typeof e.storageAccessKeyId!=`string`||!t)throw Error(`Storage config requires --storage-type, --storage-bucket, --storage-access-key-id, and one of --storage-secret-access-key-env / --storage-secret-access-key-stdin`);return{type:ts(e.storageType),bucket:e.storageBucket,endpoint:typeof e.storageEndpoint==`string`?e.storageEndpoint:void 0,region:typeof e.storageRegion==`string`?e.storageRegion:void 0,prefix:typeof e.storagePrefix==`string`?e.storagePrefix:void 0,credentials:{accessKeyId:e.storageAccessKeyId,secretAccessKey:t}}}}function Xo(e){let t=Array.isArray(e.initialUser)?e.initialUser.map($o):void 0,n=typeof e.defaultRole==`string`?es(e.defaultRole):void 0,r=e.multiUser?!0:void 0;if(!(!n&&!t&&!r))return{defaultRole:n,initialUsers:t,multiUser:r}}async function Zo(e){if(e.explicitTeam&&e.personal)throw Error(`--team and --personal cannot be used together`);if(!e.personal)return e.explicitTeam?(await Io(e.client,e.explicitTeam)).id:e.activeTeamId}async function Qo(e){if([!!e.explicitTeam,!!e.personal,!!e.allScopes].filter(Boolean).length>1)throw Error(`--team, --personal, and --all-scopes are mutually exclusive`);if(e.allScopes)return`all`;if(e.personal)return`personal`;if(e.explicitTeam)return`team:${(await Io(e.client,e.explicitTeam)).id}`;if(e.activeTeamId)return`team:${e.activeTeamId}`}function $o(e){let[t,n]=e.split(`:`);if(!t)throw Error(`--initial-user expects USER_ID or USER_ID:ROLE`);return{userId:t,role:n?es(n):void 0}}function es(e){if(e===`owner`||e===`admin`||e===`developer`||e===`viewer`)return e;throw Error(`--default-role and --initial-user roles must be one of owner, admin, developer, viewer`)}function ts(e){if(e===`s3`||e===`gcs`||e===`r2`)return e;throw Error(`--storage-type must be one of s3, gcs, or r2`)}function ns(e){M(`  Status: ${e.status}`),M(`  Provider: ${e.provider}`),M(`  GPU: ${e.accelerator.kind} x ${e.accelerator.count}`),e.customerPricePerHourUsd!==void 0&&M(`  Customer price: $${e.customerPricePerHourUsd}/hr`),e.estimatedCustomerCostUsd!==void 0&&M(`  Max estimate: $${e.estimatedCustomerCostUsd}`),e.billing&&(M(`  Billed seconds: ${e.billing.seconds}`),M(`  Customer cost: $${e.billing.customerCostUsd}`))}function rs(e){e.result.stdout&&process.stdout.write(e.result.stdout),e.result.stderr&&process.stderr.write(e.result.stderr),M(`Exit code: ${e.result.exitCode}`)}function is(){return new t(`search`).description(`Search for text patterns in sandbox files (ripgrep)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pattern>`,`Search pattern (regex)`).option(`-g, --glob <pattern>`,`File glob filter (e.g. '**/*.ts')`).option(`-n, --max-results <count>`,`Max results to return`).option(`-i, --ignore-case`,`Case-insensitive search`).option(`--json`,`Output as JSON lines`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=D(r),a=N(`Searching...`);n.json||a.start();let o=await B(i,r,e),s=0,c=n.maxResults?Number.parseInt(n.maxResults,10):void 0,l={};n.glob&&(l.glob=n.glob),n.ignoreCase&&(l.ignoreCase=!0),c&&(l.maxResults=c);for await(let e of o.search(t,l))if(s===0&&a.stop(),s++,n.json?console.log(JSON.stringify(e)):console.log(`${e.path}:${e.line}:${e.column??0}: ${e.text}`),c&&s>=c)break;a.stop(),s===0&&!n.json&&console.log(`No matches found`)}catch(e){R(e)}})}function as(){let e=new t(`secret`).description(`Manage secrets`);return e.command(`create`).description(`Create a new secret`).argument(`<name>`,`Secret name (e.g., HF_TOKEN, AWS_ACCESS_KEY)`).argument(`[value]`,`Secret value`).option(`--value-stdin`,`Read secret value from stdin`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D(w({apiKey:n.apiKey,baseUrl:n.baseUrl})),i=await os({value:t,valueStdin:n.valueStdin,prompt:`Enter value for secret '${e}': `}),a=N(`Creating secret...`);a.start();let o=await r.secrets.create(e,i);a.stop(),n.json?k({name:o.name,createdAt:o.createdAt.toISOString(),updatedAt:o.updatedAt.toISOString()}):(A(`Secret created: ${o.name}`),M(`Use --secrets ${o.name} when creating a sandbox to inject it as an environment variable.`))}catch(e){R(e)}}),e.command(`list`).description(`List all secrets`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=D(w({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=N(`Fetching secrets...`);n.start();let r=await t.secrets.list();n.stop(),e.json?k(r.map(e=>({name:e.name,createdAt:e.createdAt.toISOString(),updatedAt:e.updatedAt.toISOString()}))):r.length===0?(M(`No secrets found.`),M(`Use 'tangle secret create <name> [value]' to create one.`)):L([`Name`,`Created At`,`Updated At`],r.map(e=>[e.name,e.createdAt.toLocaleString(),e.updatedAt.toLocaleString()]))}catch(e){R(e)}}),e.command(`show`).description(`Show a secret value (requires --reveal to print plaintext)`).argument(`<name>`,`Secret name`).option(`--reveal`,`Print the plaintext secret value to stdout. Without this flag the command exits with a redaction notice.`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{if(!t.reveal){process.stderr.write(`Refusing to print secret '${e}' as plaintext. Re-run with --reveal to confirm and write the value to stdout.
-`),process.exitCode=1;return}let n=D(w({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=N(`Fetching secret...`);r.start();let i=await n.secrets.get(e);r.stop(),process.stderr.write(`WARNING: secret '${e}' is being printed in plaintext. Avoid storing this output in shell history, screenshots, or logs.
-`),t.json?k({name:e,value:i}):console.log(i)}catch(e){R(e)}}),e.command(`update`).description(`Update a secret value`).argument(`<name>`,`Secret name`).argument(`[value]`,`New secret value`).option(`--value-stdin`,`Read secret value from stdin`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D(w({apiKey:n.apiKey,baseUrl:n.baseUrl})),i=await os({value:t,valueStdin:n.valueStdin,prompt:`Enter new value for secret '${e}': `}),a=N(`Updating secret...`);a.start();let o=await r.secrets.update(e,i);a.stop(),n.json?k({name:o.name,createdAt:o.createdAt.toISOString(),updatedAt:o.updatedAt.toISOString()}):A(`Secret updated: ${o.name}`)}catch(e){R(e)}}),e.command(`delete`).description(`Delete a secret`).argument(`<name>`,`Secret name`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D(w({apiKey:t.apiKey,baseUrl:t.baseUrl}));if(!t.force&&!await H(`Are you sure you want to delete secret '${e}'? This cannot be undone. (y/N) `)){M(`Cancelled.`);return}let r=N(`Deleting secret...`);r.start(),await n.secrets.delete(e),r.stop(),t.json?k({success:!0,deleted:e}):A(`Secret deleted: ${e}`)}catch(e){R(e)}}),e}async function os(e){if(e.value!==void 0&&e.valueStdin)throw Error(`Provide either a secret value argument or --value-stdin, not both`);if(e.value!==void 0){if(e.value.length===0)throw Error(`Secret value cannot be empty`);return e.value}if(e.valueStdin){let e=await kn();if(e.length===0)throw Error(`Secret value from stdin cannot be empty`);return e}let t=await On(e.prompt);if(t.length===0)throw Error(`Secret value cannot be empty`);return t}function ss(){let e=new t(`skill`).description(`Print paths to shipped skill documentation`);return e.command(`path`).description(`Print the absolute path to the SKILL.md shipped with this CLI`).action(()=>{let e=p.dirname(ke(import.meta.url)),t=p.resolve(e,`..`,`SKILL.md`);console.log(t)}),e}function cs(){let e=new t(`snapshot`).description(`Manage snapshots`);return e.command(`create <sandbox-id-or-name>`).description(`Create a snapshot of a sandbox`).option(`--tags <tags...>`,`Tags for the snapshot`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Creating snapshot...`);i.start();let a=await(await B(r,n,e)).snapshot({tags:t.tags});i.stop(),t.json?k(a):(A(`Snapshot created: ${a.snapshotId}`),console.log(`Size: ${ls(a.sizeBytes??0)}`))}catch(e){R(e)}}),e.command(`list <sandbox-id-or-name>`).description(`List snapshots for a sandbox`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Fetching snapshots...`);i.start();let a=await(await B(r,n,e)).listSnapshots();i.stop(),t.json?k(a):O(a.map(e=>({...e,size:ls(e.sizeBytes??0)})),[{key:`snapshotId`,header:`ID`,width:24},{key:`createdAt`,header:`Created`,width:16},{key:`size`,header:`Size`,width:12},{key:`sandboxId`,header:`Sandbox`,width:20}])}catch(e){R(e)}}),e.command(`restore <sandbox-id> <snapshot-id>`).description(`Create a new sandbox from a snapshot`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D(w({apiKey:n.apiKey,baseUrl:n.baseUrl})),i=N(`Restoring from snapshot...`);i.start();let a=await r.create({fromSnapshot:t,fromSandboxId:e});await a.waitFor(`running`,{timeoutMs:12e4}),i.stop(),n.json?k({sandboxId:a.id,restoredFrom:t,status:a.status}):(A(`New sandbox created: ${a.id}`),console.log(`Source snapshot: ${t}`))}catch(e){R(e)}}),e.command(`revert <sandbox-id-or-name> <snapshot-id>`).description(`Revert an existing sandbox to a snapshot`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=D(r),a=N(`Reverting sandbox to snapshot...`);a.start();let o=await B(i,r,e),s=await o.revertToSnapshot(t);await o.refresh(),a.stop(),n.json?k({sandboxId:o.id,snapshotId:s.snapshotId,status:o.status}):(A(`Sandbox reverted: ${o.id}`),console.log(`Source snapshot: ${s.snapshotId}`))}catch(e){R(e)}}),e.command(`delete <sandbox-id-or-name> <snapshot-id>`).description(`Delete a sandbox snapshot`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=D(r),a=N(`Deleting snapshot...`);a.start(),await(await B(i,r,e)).deleteSnapshot(t),a.stop(),n.json?k({success:!0,sandboxId:e,snapshotId:t}):A(`Snapshot deleted: ${t}`)}catch(e){R(e)}}),e}function ls(e){if(e===0)return`0 B`;let t=1024,n=[`B`,`KB`,`MB`,`GB`,`TB`],r=Math.floor(Math.log(e)/Math.log(t));return`${Number.parseFloat((e/t**r).toFixed(1))} ${n[r]}`}function us(e,t){return`tangle ssh-proxy ${e.replace(/\/+$/,``)}/v1/sidecar-proxy/${t}/ssh`}function ds(e){return/^[A-Za-z0-9_/:=@%+.,-]+$/.test(e)?e:`'${e.replace(/'/g,`'"'"'`)}'`}function fs(e){return`'${e.replace(/'/g,`''`)}'`}function ps(e){return e===`win32`?`NUL`:`/dev/null`}function ms(e,t){return t===`win32`?`$env:TANGLE_SSH_PROXY_AUTH_TOKEN=${fs(`<token>`)}; ssh ${e.map(fs).join(` `)}`:`TANGLE_SSH_PROXY_AUTH_TOKEN=${ds(`<token>`)} ssh ${e.map(ds).join(` `)}`}function hs(e){return e.connection!==void 0&&!e.connection.ssh}function gs(){j(`SSH is not enabled for this sandbox.`),M(`Create a sandbox with --ssh to enable SSH access.`),process.exit(1)}function _s(e,t=[],n=process.platform){let r=ps(n);return[`-o`,`ProxyCommand=${e.proxyCommand}`,`-o`,`StrictHostKeyChecking=no`,`-o`,`UserKnownHostsFile=${r}`,`-o`,`GlobalKnownHostsFile=${r}`,`-o`,`LogLevel=ERROR`,`-o`,`ServerAliveInterval=15`,`-o`,`ServerAliveCountMax=4`,`-o`,`TCPKeepAlive=yes`,`${e.username}@localhost`,`-p`,String(e.port),...t]}function vs(){return new t(`ssh`).description(`Open SSH session to a sandbox`).argument(`<ref>`,`Sandbox ID or name`).argument(`[sshArgs...]`,`Extra args passed through to ssh`).option(`-i, --identity-file <path>`,`Private key file to pass to ssh`).option(`--print`,`Print SSH command instead of connecting`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).allowUnknownOption(!0).action(async(e,t,n)=>{try{let r=w({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=D(r),a=N(`Getting SSH credentials...`);a.start();let o=await B(i,r,e);if(hs(o)){a.stop(),gs();return}o=await V(o);let s=await o.ssh();if(a.stop(),!s){gs();return}let c={...s,proxyCommand:us(r.baseUrl,o.id)};if(!r.apiKey)throw Error(`SSH proxy requires API key auth. Set TANGLE_API_KEY or pass --api-key.`);let l=_s(c,[...n.identityFile?[`-i`,n.identityFile,`-o`,`IdentitiesOnly=yes`]:[],...t]);if(n.print){console.log(ms(l,process.platform));return}M(`Connecting via tunnel...`);let u=ge(`ssh`,l,{stdio:`inherit`,env:{...process.env,TANGLE_SSH_PROXY_AUTH_TOKEN:r.apiKey}});u.on(`error`,e=>{e.code===`ENOENT`&&(j(`SSH client not found. Please install OpenSSH.`),process.exit(1)),R(e)}),u.on(`exit`,e=>{process.exit(e??0)})}catch(e){R(e)}})}function ys(){let e=new t(`ssh-keys`).description(`Manage SSH keys`);return e.command(`list`).description(`List SSH keys`).option(`--json`,`Output as JSON`).action(async e=>{let t=N(`Fetching SSH keys...`);try{t.start();let n=await D(w(e)).sshKeys.list();t.stop(),e.json?k({sshKeys:n}):n.length===0?M(`No SSH keys found.`):L([`Name`,`Type`,`Fingerprint`,`Created`],n.map(e=>[e.name,e.keyType,e.fingerprint,e.createdAt.toLocaleString()]))}catch(e){t.stop(),R(e)}}),e.command(`add`).description(`Add SSH key`).argument(`<name>`,`SSH key name`).requiredOption(`--key-file <path>`,`Public key file path`).option(`--json`,`Output as JSON`).action(async(e,t)=>{let n=N(`Adding SSH key...`);try{let r=u(t.keyFile,`utf8`).trim();n.start();let i=await D(w(t)).sshKeys.create(e,r);n.stop(),t.json?k({sshKey:i}):A(`Added SSH key ${i.name} (${i.fingerprint})`)}catch(e){n.stop(),R(e)}}),e.command(`delete`).description(`Delete SSH key`).argument(`<name>`,`SSH key name or ID`).action(async(e,t)=>{let n=N(`Deleting SSH key...`);try{n.start(),await D(w(t)).sshKeys.delete(e),n.stop(),A(`Deleted SSH key ${e}`)}catch(e){n.stop(),R(e)}}),e}function bs(e,t=1){process.stderr.write(`${e}\n`),process.exit(t)}function xs(){return new t(`ssh-proxy`).description(`SSH proxy helper — pipes stdin/stdout to WebSocket`).argument(`<sidecar-url>`,`Sidecar WebSocket URL`).action(async e=>{let t=process.env.TANGLE_SSH_PROXY_AUTH_TOKEN;t||bs(`TANGLE_SSH_PROXY_AUTH_TOKEN not set`);let n=new Ae(new URL(e.replace(/^http/,`ws`)),{headers:{Authorization:`Bearer ${t}`},perMessageDeflate:!1}),r;function i(){r&&=(clearInterval(r),void 0)}n.on(`open`,()=>{r=setInterval(()=>{n.readyState===Ae.OPEN&&n.ping()},15e3),r.unref?.(),process.stdin.on(`data`,e=>{n.readyState===Ae.OPEN&&n.send(e,{binary:!0,compress:!1})}),process.stdin.on(`end`,()=>n.close(1e3))}),n.on(`message`,e=>{let t=Buffer.isBuffer(e)?e:Array.isArray(e)?Buffer.concat(e):Buffer.from(e);process.stdout.write(t)}),n.on(`error`,e=>{i(),bs(`WebSocket error: ${e.message}`)}),n.on(`close`,e=>{i(),process.exit(e===1e3?0:1)}),process.stdin.on(`error`,()=>n.close())})}const Ss=[`claude-code`,`opencode`,`codex`,`kimi-code`],Cs=[`project`,`read-only`],ws={min:1,max:15},Ts=process.env.TANGLE_ROUTER_URL??`https://router.tangle.tools/v1`;function Es(e){let t=e.harness??`claude-code`;if(!Ss.includes(t))throw Error(`Unknown --harness '${t}'. Supported: ${Ss.join(`, `)}.`);let n=e.tokenScope??`project`;if(!Cs.includes(n))throw Error(`Unknown --token-scope '${n}'. Supported: ${Cs.join(`, `)}.`);let r=Ds(e.maxTokens,2e5,`--max-tokens`),i=Ds(e.maxIterations,50,`--max-iterations`),a=Ds(e.tokenTtl,10,`--token-ttl`);if(a<ws.min||a>ws.max)throw Error(`--token-ttl ${a} out of range; the SDK clamps to [${ws.min}, ${ws.max}] minutes.`);let o=e.maxWorkers===void 0?void 0:Ds(e.maxWorkers,0,`--max-workers`);return{harness:t,...e.model?{model:e.model}:{},maxTokens:r,maxIterations:i,tokenScope:n,tokenTtl:a,...o===void 0?{}:{maxWorkers:o}}}function Ds(e,t,n){if(e===void 0)return t;let r=Number.parseInt(e,10);if(!Number.isFinite(r)||r<=0)throw Error(`${n} must be a positive integer, got '${e}'.`);return r}function Os(e){let t={maxTokens:e.maxTokens,maxIterations:e.maxIterations};return e.maxWorkers===void 0?{budget:t}:{budget:t,perWorker:{maxTokens:Math.max(1,Math.floor(e.maxTokens/e.maxWorkers)),maxIterations:Math.max(1,Math.floor(e.maxIterations/e.maxWorkers))}}}function ks(e){let{client:t,scope:n,ttlMinutes:r,onScope:i}=e,a={async create(e){let a=await t.create(As(e)),o={scope:n,ttlMinutes:r},s=await a.mintScopedToken(o);return i({id:a.id,scope:s.scope,expiresAt:s.expiresAt,status:`spawned`}),a}};return typeof t.criuStatus==`function`&&(a.criuStatus=t.criuStatus.bind(t)),a}function As(e){if(!e?.env)return e;let{TANGLE_API_KEY:t,SANDBOX_API_KEY:n,...r}=e.env;return{...e,env:r}}function js(e){if(e.kind===`no-winner`)return{text:``,tokenUsage:{input:0,output:0},costUsd:0,status:`no-winner (${e.reason})`};let t=e.out;return{text:typeof t==`string`?t:Ms(t)?t.content:JSON.stringify(t),tokenUsage:{input:e.spentTotal.tokens.input,output:e.spentTotal.tokens.output},costUsd:e.spentTotal.usd,status:`winner`}}function Ms(e){return typeof e==`object`&&!!e&&typeof e.content==`string`}const Ns={makeClient:e=>D(w({apiKey:e.apiKey,baseUrl:e.baseUrl})),resolveRouter:e=>({routerBaseUrl:Ts,routerKey:w({apiKey:e.apiKey}).apiKey,model:e.model}),supervise:je};async function Ps(e,t,n,r=Ns){let a=r.makeClient({apiKey:n.apiKey,baseUrl:n.baseUrl}),{budget:o,perWorker:s}=Os(t),c=[],l=ks({client:a,scope:t.tokenScope,ttlMinutes:t.tokenTtl,onScope:e=>{if(c.push(e),!n.json){let n=`ttl ${t.tokenTtl}m`;M(`worker ${e.id} [${e.scope} token ${n}] spawned`)}}}),u=Me({backend:`sandbox`,harness:t.harness,sandboxClient:l,maxIterations:1}),d={name:`supervisor`,...t.model?{model:t.model}:{}},f=r.resolveRouter({apiKey:n.apiKey,model:t.model??`deepseek-v4-flash`}),p=js(await r.supervise(d,{goal:e},{budget:o,makeWorkerAgent:u,router:f,...s?{perWorker:s}:{},...t.model?{allowedModels:[t.model]}:{},runId:`supervise-${i()}`})),ee=p.status===`winner`?`settled`:`failed`;for(let e of c)e.status=ee,n.json||M(`worker ${e.id} [${e.scope} token ttl ${t.tokenTtl}m] settled (${e.status})`);return{task:e,result:p.text,workers:c,tokenUsage:p.tokenUsage,costUsd:p.costUsd,status:p.status}}function Fs(){let e=new t(`supervise`);return e.description(`Run a budget-conserving supervisor that spawns isolated sandbox workers to deliver a task. Each worker box mints a short-lived scoped token instead of receiving the root API key.`).argument(`<task>`,`What the supervisor should accomplish`).option(`--harness <name>`,`Worker harness (${Ss.join(` | `)})`,`claude-code`).option(`--model <id>`,`Model for the supervisor + workers`).option(`--max-tokens <n>`,`Conserved token budget for the whole run`,`200000`).option(`--max-iterations <n>`,`Conserved iteration budget for the whole run`,`50`).option(`--token-scope <scope>`,`Per-worker token scope (${Cs.join(` | `)})`,`project`).option(`--token-ttl <min>`,`Per-worker token TTL in minutes (SDK clamps to [1, 15])`,`10`).option(`--max-workers <n>`,`Bound the fanout; each worker reserves floor(max-tokens / n) tokens and floor(max-iterations / n) iterations`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=Es({harness:t.harness,model:t.model,maxTokens:t.maxTokens,maxIterations:t.maxIterations,tokenScope:t.tokenScope,tokenTtl:t.tokenTtl,maxWorkers:t.maxWorkers});t.json||(M(`Supervising: ${e}`),M(`harness=${n.harness} budget=${n.maxTokens}tok/${n.maxIterations}it scope=${n.tokenScope} ttl=${n.tokenTtl}m`),console.log());let r=await Ps(e,n,{apiKey:t.apiKey,baseUrl:t.baseUrl,json:t.json});if(t.json){k(r),r.status!==`winner`&&(process.exitCode=1);return}if(console.log(),r.status!==`winner`)throw Error(`Supervisor finished without a winner: ${r.status}`);console.log(r.result),console.log(),P({"Input Tokens":r.tokenUsage.input,"Output Tokens":r.tokenUsage.output,Cost:`$${r.costUsd.toFixed(4)}`})}catch(e){R(e,t.json)}}),e}function Is(){let e=new t(`team`).description(`Manage teams`);return e.command(`list`).description(`List teams for the current account`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async e=>{try{let t=w(e),n=D(t),r=e.json?null:N(`Fetching teams...`);r?.start();let i=await n.teams.list();if(r?.stop(),e.json){k({teams:i,activeTeamId:t.activeTeamId??null});return}O(i.map(e=>({active:e.id===t.activeTeamId,id:e.id,name:e.name,role:e.currentUserRole,members:e.memberCount})),[{key:`active`,header:`Active`,width:8},{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:24},{key:`role`,header:`Role`,width:10},{key:`members`,header:`Members`,width:10}])}catch(e){R(e)}}),e.command(`create <name>`).description(`Create a team`).option(`--org-id <id>`,`External organization id`).option(`--no-switch`,`Do not set the new team as active`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=w(t),r=D(n),i=t.json?null:N(`Creating team...`);i?.start();let a=await r.teams.create({name:e,orgId:t.orgId});if(t.switch&&Lo(a,n.profile),i?.stop(),t.json){k({team:a,active:!!t.switch});return}A(`Team created: ${Fo(a)}`),t.switch&&A(`Active team set to ${a.name}`)}catch(e){R(e)}}),e.command(`switch <team>`).description(`Set the active team for the current profile`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=w(t),r=await Io(D(n),e);if(Lo(r,n.profile),t.json){k({team:r,activeTeamId:r.id});return}A(`Active team set to ${Fo(r)}`)}catch(e){R(e)}}),e.command(`current`).description(`Show the active team for the current profile`).option(`--json`,`Output as JSON`).option(`--profile <profile>`,`Credential profile`).action(e=>{try{let t=Pt(e.profile);if(e.json){k(t.activeTeamId?t:{activeTeamId:null});return}if(!t.activeTeamId){console.log(`No active team.`);return}P({ID:t.activeTeamId,Name:t.activeTeamName})}catch(e){R(e)}}),e.command(`clear`).description(`Clear the active team for the current profile`).option(`--json`,`Output as JSON`).option(`--profile <profile>`,`Credential profile`).action(e=>{try{if(Ro(e.profile),e.json){k({activeTeamId:null});return}A(`Active team cleared.`)}catch(e){R(e)}}),e.command(`members [team]`).description(`List team members`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=w(t),r=D(n),i=await X(r,e,n.profile),a=await r.teams.listMembers(i.id);if(t.json){k({team:i,members:a});return}O(a.map(e=>({id:e.id,email:e.customerEmail,role:e.role,status:e.status,joinedAt:e.joinedAt})),[{key:`id`,header:`ID`,width:36},{key:`email`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:10},{key:`joinedAt`,header:`Joined`,width:16}])}catch(e){R(e)}}),e.command(`update-member <member-id>`).description(`Update a team member role`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).requiredOption(`--role <role>`,`Role: admin, member, viewer`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=w(t),r=D(n),i=await X(r,t.team,n.profile),a=Ls(t.role),o=await r.teams.updateMember(i.id,e,{role:a});if(t.json){k({team:i,member:o});return}A(`Member updated: ${o.customerEmail}`),P({Team:i.name,Role:o.role,Status:o.status})}catch(e){R(e)}}),e.command(`invite <email>`).description(`Invite a user to a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--role <role>`,`Role: admin, member, viewer`,`member`).option(`--ttl-hours <hours>`,`Invitation lifetime in hours`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=w(t),r=D(n),i=await X(r,t.team,n.profile),a=Ls(t.role),o=await r.teams.invite(i.id,{email:e,role:a,ttlHours:t.ttlHours?Number.parseInt(t.ttlHours,10):void 0});if(t.json){k({team:i,invitation:o});return}A(`Invitation created for ${o.email}`),P({Team:i.name,Role:o.role,Expires:o.expiresAt,"Invitation ID":o.id}),A(`Re-run with --json to retrieve the invitation token for sharing.`)}catch(e){R(e)}}),e.command(`leave [team]`).description(`Leave a team as the current user`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=w(t),r=D(n),i=await X(r,e,n.profile);if(!t.force&&!t.json&&!await H(`Leave team '${i.name}'? (y/N) `))return;if(await r.teams.leave(i.id),n.activeTeamId===i.id&&Ro(n.profile),t.json){k({success:!0,teamId:i.id});return}A(`Left team: ${i.name}`)}catch(e){R(e)}}),e.command(`transfer <new-owner-customer-id> [team]`).description(`Transfer team ownership to another active member`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t,n)=>{try{let r=w(n),i=D(r),a=await X(i,t,r.profile);if(!n.force&&!n.json&&!await H(`Transfer ownership of '${a.name}' to ${e}? This cannot be undone without the new owner's cooperation. (y/N) `))return;if(await i.teams.transferOwnership(a.id,e),n.json){k({success:!0,teamId:a.id,newOwnerCustomerId:e});return}A(`Ownership transferred for ${a.name}`)}catch(e){R(e)}}),e.addCommand(Rs()),e.addCommand(zs()),e.command(`invitations [team]`).description(`List pending and historical team invitations`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=w(t),r=D(n),i=await X(r,e,n.profile),a=await r.teams.listInvitations(i.id);if(t.json){k({team:i,invitations:a});return}O(a.map(e=>({id:e.id,email:e.email,role:e.role,status:e.status,expiresAt:e.expiresAt})),[{key:`id`,header:`ID`,width:38},{key:`email`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:12},{key:`expiresAt`,header:`Expires`,width:16}])}catch(e){R(e)}}),e.command(`accept <token>`).description(`Accept a team invitation`).option(`--no-switch`,`Do not set the accepted team as active`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=w(t),r=D(n),i=await r.teams.acceptInvitation(e),a=t.switch===!1?null:await r.teams.get(i.teamId);if(a&&Lo(a,n.profile),t.json){k({member:i,activeTeamId:a?.id??null});return}A(`Invitation accepted for team ${i.teamId}`),a&&A(`Active team set to ${a.name}`)}catch(e){R(e)}}),e.command(`revoke-invitation <invitation-id>`).description(`Revoke a pending team invitation`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{if(await D(w(t)).teams.revokeInvitation(e),t.json){k({success:!0,invitationId:e});return}A(`Invitation revoked: ${e}`)}catch(e){R(e)}}),e.command(`remove-member <member-id>`).description(`Remove a member from a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=w(t),r=D(n),i=await X(r,t.team,n.profile);if(await r.teams.removeMember(i.id,e),t.json){k({success:!0,teamId:i.id,memberId:e});return}A(`Member removed: ${e}`)}catch(e){R(e)}}),e}function Ls(e){if(e===`admin`||e===`member`||e===`viewer`)return e;throw Error(`Role must be one of: admin, member, viewer`)}function Rs(){let e=new t(`secret`).description(`Manage team secrets`);return e.command(`list [team]`).description(`List team secret names`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=w(t),r=D(n),i=await X(r,e,n.profile),a=await r.teams.listSecrets(i.id);if(t.json){k({team:i,secrets:a});return}O(a.map(e=>({name:e.name,updatedAt:e.updatedAt,updatedBy:e.updatedBy})),[{key:`name`,header:`Name`,width:28},{key:`updatedAt`,header:`Updated`,width:24},{key:`updatedBy`,header:`Updated By`,width:28}])}catch(e){R(e)}}),e.command(`set <name> [value]`).description(`Create or replace a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--value-stdin`,`Read secret value from stdin`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t,n)=>{try{let r=w(n),i=D(r),a=await X(i,n.team,r.profile),o=await Bs({value:t,valueStdin:n.valueStdin,prompt:`Enter value for team secret '${e}': `}),s=await i.teams.upsertSecret(a.id,e,o);if(n.json){k({team:a,secret:s});return}A(`Team secret saved: ${s.name}`)}catch(e){R(e)}}),e.command(`delete <name>`).description(`Delete a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=w(t),r=D(n),i=await X(r,t.team,n.profile);if(!t.force&&!t.json&&!await H(`Delete team secret '${e}' from '${i.name}'? (y/N) `))return;if(await r.teams.deleteSecret(i.id,e),t.json){k({success:!0,teamId:i.id,name:e});return}A(`Team secret deleted: ${e}`)}catch(e){R(e)}}),e.command(`reveal <name>`).description(`Reveal a team secret value`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=w(t),r=D(n),i=await X(r,t.team,n.profile),a=await r.teams.revealSecret(i.id,e);if(t.json){k({teamId:i.id,...a});return}console.log(a.value)}catch(e){R(e)}}),e}function zs(){let e=new t(`templates`).description(`Manage team golden-path templates`);return e.command(`list [team]`).description(`List a team's golden-path templates`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=w(t),r=D(n),i=await X(r,e,n.profile),a=await r.teams.listTemplates(i.id);if(t.json){k({team:i,templates:a});return}if(a.length===0){console.log(`No templates yet for ${i.name}.`);return}O(a.map(e=>({id:e.id,name:e.name,environment:e.environment,snapshot:`${e.snapshotId.slice(0,12)}…`,updated:e.updatedAt})),[{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:28},{key:`environment`,header:`Env`,width:14},{key:`snapshot`,header:`Snapshot`,width:16},{key:`updated`,header:`Updated`,width:24}])}catch(e){R(e)}}),e.command(`create <name> <snapshot-id>`).description(`Create a golden-path template from a snapshot`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`-d, --description <description>`,`Human-readable description shown in the dashboard`).option(`-e, --environment <environment>`,`Default environment to apply (defaults to 'universal')`).option(`--config <json>`,`Optional JSON config object merged into sandboxes created from this template`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t,n)=>{try{let r=w(n),i=D(r),a=await X(i,n.team,r.profile),o;if(n.config)try{let e=JSON.parse(n.config);if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`--config must be a JSON object`);o=e}catch(e){throw Error(`--config is not valid JSON: ${e instanceof Error?e.message:String(e)}`)}let s=await i.teams.createTemplate(a.id,{name:e,snapshotId:t,description:n.description,environment:n.environment,config:o});if(n.json){k({team:a,template:s});return}A(`Team template created: ${s.name} (${s.id})`)}catch(e){R(e)}}),e.command(`delete <template-id>`).description(`Delete a team golden-path template`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=w(t),r=D(n),i=await X(r,t.team,n.profile);if(!t.force&&!t.json&&!await H(`Delete template '${e}' from '${i.name}'? (y/N) `))return;if(await r.teams.deleteTemplate(i.id,e),t.json){k({success:!0,teamId:i.id,templateId:e});return}A(`Team template deleted: ${e}`)}catch(e){R(e)}}),e}async function Bs(e){if(e.value!==void 0&&e.valueStdin)throw Error(`Provide either a secret value argument or --value-stdin, not both`);if(e.value!==void 0){if(e.value.length===0)throw Error(`Secret value cannot be empty`);return e.value}if(e.valueStdin){let e=await kn();if(e.length===0)throw Error(`Secret value from stdin cannot be empty`);return e}let t=await On(e.prompt);if(t.length===0)throw Error(`Secret value cannot be empty`);return t}function Vs(){let e=new t(`template`).description(`Manage published public templates`);return e.command(`list`).option(`-q, --query <query>`,`Search query`).option(`--tag <tag>`,`Filter by tag`).option(`--featured`,`Show featured templates only`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=D(w(e)),n=e.featured?await t.publicTemplates.featured():await t.publicTemplates.list({query:e.query,tag:e.tag});if(e.json){k({templates:n});return}O(n.map(e=>({slug:e.slug,name:e.name,forks:e.forkCount,sandboxes:e.sandboxCount,updated:e.updatedAt})),[{key:`slug`,header:`Slug`,width:28},{key:`name`,header:`Name`,width:28},{key:`forks`,header:`Forks`,width:8},{key:`sandboxes`,header:`Sandboxes`,width:12},{key:`updated`,header:`Updated`,width:24}])}catch(e){R(e)}}),e.command(`get <id-or-slug>`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await D(w(t)).publicTemplates.get(e);if(t.json){k({template:n});return}k(n)}catch(e){R(e)}}),e.command(`versions <id-or-slug>`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await D(w(t)).publicTemplates.versions(e);if(t.json){k({versions:n});return}O(n.map(e=>({...e})),[{key:`id`,header:`Version ID`,width:38},{key:`versionNumber`,header:`Version`,width:8},{key:`snapshotId`,header:`Snapshot`,width:20},{key:`createdAt`,header:`Created`,width:24}])}catch(e){R(e)}}),e.command(`publish <name> <snapshot-id> <sandbox-id>`).option(`--slug <slug>`,`Stable public slug`).option(`-d, --description <description>`,`Template description`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).option(`--team-id <id>`,`Publish under a team`).option(`--forked-from <id>`,`Fork source template id`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=await D(w(r)).publicTemplates.publish({name:e,slug:r.slug,description:r.description,snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes,teamId:r.teamId,forkedFromTemplateId:r.forkedFrom});if(r.json){k({template:i});return}A(`Published template: ${i.slug}`)}catch(e){R(e)}}),e.command(`publish-version <id-or-slug> <snapshot-id> <sandbox-id>`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=await D(w(r)).publicTemplates.publishVersion(e,{snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes});if(r.json){k({version:i});return}A(`Published template version: ${i.id}`)}catch(e){R(e)}}),e}function Hs(){let e=new t(`tools`).description(`Manage language runtimes and tools in a sandbox (via mise)`);return e.command(`list`).alias(`ls`).description(`List installed tools in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=w({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=D(n),i=N(`Fetching tools...`);t.json||i.start();let a=await(await B(r,n,e)).tools.list();i.stop(),t.json?k(a):a.length===0?console.log(`No tools installed`):L([`Tool`,`Version`,`Active`],a.map(e=>[e.name,e.version,e.active?`yes`:`no`]))}catch(e){R(e)}}),e.command(`install`).description(`Install a tool version`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<tool>`,`Tool name (e.g. node, python, go)`).argument(`<version>`,`Version to install (e.g. 20, 3.12, latest)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=w({apiKey:r.apiKey,baseUrl:r.baseUrl}),a=D(i),o=N(`Installing ${t}@${n}...`);r.json||o.start(),await(await B(a,i,e)).tools.install(t,n),o.stop(),r.json?k({tool:t,version:n,installed:!0}):A(`Installed ${t}@${n}`)}catch(e){R(e)}}),e.command(`use`).description(`Activate a tool version for the current session`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<tool>`,`Tool name`).argument(`<version>`,`Version to activate`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=w({apiKey:r.apiKey,baseUrl:r.baseUrl});await(await B(D(i),i,e)).tools.use(t,n),A(`Activated ${t}@${n}`)}catch(e){R(e)}}),e.command(`run`).description(`Run a command with a specific tool`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<tool>`,`Tool name`).argument(`<args...>`,`Command arguments`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=w({apiKey:r.apiKey,baseUrl:r.baseUrl}),a=D(i),o=N(`Running ${t} ${n.join(` `)}...`);r.json||o.start();let s=await(await B(a,i,e)).tools.run(t,n);o.stop(),r.json?k(s):(s.stdout&&process.stdout.write(s.stdout),s.stderr&&process.stderr.write(s.stderr),s.exitCode!==0&&process.exit(s.exitCode))}catch(e){R(e)}}),e}function Us(){let e=new t(`traces`).description(`Read hosted agent traces, spans, and eval-runs from Tangle Intelligence`);return e.command(`list`).description(`List trace summaries (one row per trace), newest first`).option(`--from <iso>`,`ISO-8601 lower bound on received time (inclusive)`).option(`--to <iso>`,`ISO-8601 upper bound on received time (inclusive)`).option(`--model <model>`,`Exact model match (any span carried this model)`).option(`--run <runId>`,`Exact run id match`).option(`--status <status>`,`ERROR | OK`).option(`-q, --query <text>`,`Substring over span name`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size (clamped server-side to [1, 200])`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Intelligence API base URL`).action(async e=>{try{let t={from:e.from,to:e.to,model:e.model,runId:e.run,status:e.status===void 0?void 0:ec(e.status),q:e.query,cursor:e.cursor,limit:e.limit===void 0?void 0:ac(e.limit)},n=Gs(e),r=e.json?null:N(`Fetching traces...`);r?.start();let i=await n.listTraces(t);if(r?.stop(),e.json)return k(i);Js(i.items),Qs(i.nextCursor)}catch(t){qs(t,e)}}),e.command(`get <traceId>`).description(`Show one trace's spans. Streams NDJSON to stdout with --ndjson.`).option(`--ndjson`,`Stream the full span set as NDJSON to stdout`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Spans per page`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Intelligence API base URL`).action(async(e,t)=>{try{let n=Gs(t);if(t.ndjson){await Ks(n,e);return}let r=t.json?null:N(`Fetching trace spans...`);r?.start();let i=await n.getTraceSpans(e,{cursor:t.cursor,limit:t.limit===void 0?void 0:ac(t.limit)});if(r?.stop(),t.json)return k(i);Ys(i.items),i.truncated&&P({Spans:`${i.items.length} of ${i.total} (truncated)`}),Qs(i.nextCursor)}catch(e){qs(e,t)}}),e.addCommand(Ws()),e}function Ws(){let e=new t(`runs`).description(`Read eval-runs pivoted off the trace surface`);return e.command(`list`).description(`List eval-runs, newest first`).option(`--status <status>`,`Run status filter`).option(`--gate <decision>`,`Promotion-gate decision filter`).option(`--label <key:value>`,`Match over the run's labels`).option(`--from <iso>`,`ISO-8601 lower bound on received time`).option(`--to <iso>`,`ISO-8601 upper bound on received time`).option(`-q, --query <text>`,`Substring over run dir`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Intelligence API base URL`).action(async e=>{try{let t={status:e.status===void 0?void 0:nc(e.status),gate:e.gate===void 0?void 0:ic(e.gate),label:e.label,from:e.from,to:e.to,q:e.query,cursor:e.cursor,limit:e.limit===void 0?void 0:ac(e.limit)},n=Gs(e),r=e.json?null:N(`Fetching runs...`);r?.start();let i=await n.listRuns(t);if(r?.stop(),e.json)return k(i);Xs(i.items),Qs(i.nextCursor)}catch(t){qs(t,e)}}),e.command(`get <runId>`).description(`Show a single eval-run`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Intelligence API base URL`).action(async(e,t)=>{try{let n=Gs(t),r=t.json?null:N(`Fetching run...`);r?.start();let i=await n.getRun(e);if(r?.stop(),t.json)return k(i);Zs(i)}catch(e){qs(e,t)}}),e}function Gs(e){let t=C(e.apiKey);if(!t)throw Error(`No API key found. Set TANGLE_API_KEY or run: tangle auth login`);return Ne({apiKey:t,baseUrl:e.baseUrl??process.env.TANGLE_INTELLIGENCE_BASE_URL})}async function Ks(e,t){let n=(await e.exportTraceSpansNdjson(t)).getReader();try{for(;;){let{value:e,done:t}=await n.read();if(t)break;e&&process.stdout.write(Buffer.from(e))}}finally{n.releaseLock()}}function qs(e,t){return R(e,t.json===!0)}function Js(e){O(e.map(e=>({traceId:e.traceId,root:e.rootName??`-`,model:e.model??`-`,spans:e.spanCount,errors:e.errorCount,durationMs:e.durationMs,cost:$s(e.costUsd)})),[{key:`traceId`,header:`Trace`,width:36},{key:`root`,header:`Root`,width:24},{key:`model`,header:`Model`,width:22},{key:`spans`,header:`Spans`,width:8},{key:`errors`,header:`Errors`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14},{key:`cost`,header:`Cost`,width:10}])}function Ys(e){O(e.map(e=>({spanId:e.id,name:e.name,model:e.model??`-`,status:e.statusCode??`-`,cost:e.costUsd===null?`-`:`$${e.costUsd}`})),[{key:`spanId`,header:`Span`,width:40},{key:`name`,header:`Name`,width:28},{key:`model`,header:`Model`,width:22},{key:`status`,header:`Status`,width:10},{key:`cost`,header:`Cost`,width:12}])}function Xs(e){O(e.map(e=>({runId:e.id,status:e.status,gate:e.gateDecision??`-`,cost:e.totalCostUsd===null?`-`:`$${e.totalCostUsd}`,receivedAt:e.receivedAt})),[{key:`runId`,header:`Run`,width:24},{key:`status`,header:`Status`,width:22},{key:`gate`,header:`Gate`,width:18},{key:`cost`,header:`Cost`,width:12},{key:`receivedAt`,header:`Received`,width:18}])}function Zs(e){P({Run:e.id,Status:e.status,Gate:e.gateDecision??void 0,"Run Dir":e.runDir??void 0,Cost:e.totalCostUsd===null?void 0:`$${e.totalCostUsd}`,Duration:e.totalDurationMs===null?void 0:`${e.totalDurationMs}ms`,"Holdout Lift":e.holdoutLift??void 0,Received:e.receivedAt})}function Qs(e){e&&P({"Next page":`--cursor ${e}`})}function $s(e){return e===null?`-`:`$${e.toFixed(4)}`}function ec(e){if(e===`ERROR`||e===`OK`)return e;throw Error(`--status must be ERROR or OK`)}const tc=[`started`,`baseline-complete`,`generation-complete`,`gate-decided`,`finished`,`errored`];function nc(e){let t=tc.find(t=>t===e);if(t)return t;throw Error(`--status must be one of ${tc.join(`, `)}`)}const rc=[`ship`,`hold`,`need_more_work`,`model_ceiling`,`arch_ceiling`];function ic(e){let t=rc.find(t=>t===e);if(t)return t;throw Error(`--gate must be one of ${rc.join(`, `)}`)}function ac(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function oc(){return new t(`usage`).description(`Show account usage and billing information`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=D(w({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=e.json?null:N(`Fetching usage...`);n?.start();let[r,i]=await Promise.all([t.usage(),t.subscription().catch(()=>null)]);n?.stop(),e.json?k({...r,subscription:i}):(console.log(),console.log(`Account Usage`),console.log(`─`.repeat(40)),P({"Active Sandboxes":r.activeSandboxes,"Total Sandboxes":r.totalSandboxes,"Compute Minutes":sc(r.computeMinutes),"GPU Seconds":r.gpuSeconds,"GPU Spend":cc(r.gpuCostUsd)}),i&&(console.log(),console.log(`Subscription`),console.log(`─`.repeat(40)),P({Plan:i.plan,Status:i.status,"Credits Available":cc(i.creditsAvailableUsd),"Credits Used":cc(i.creditsUsedUsd),"Monthly Balance":cc(i.monthlyBalanceUsd)})),console.log(),console.log(`Billing Period`),console.log(`─`.repeat(40)),P({Start:r.periodStart.toLocaleDateString(),End:r.periodEnd.toLocaleDateString()}),console.log())}catch(e){R(e)}})}function sc(e){if(e===void 0)return`-`;if(e<60)return`${e} min`;let t=Math.floor(e/60),n=e%60;return n===0?`${t} hr`:`${t} hr ${n} min`}function cc(e){return e<0?`-$${(-e).toFixed(2)}`:`$${e.toFixed(2)}`}function lc(){return new t(`use`).description(`Set or show the active sandbox (used when a command omits the id)`).argument(`[id]`,`Sandbox id to make active`).option(`--clear`,`Clear the active sandbox`).action((e,t)=>{try{if(t.clear){wt(),M(`Cleared the active sandbox.`);return}if(e){Ct(e),M(`Active sandbox set to ${e}. Commands now default to it; override with --box or TANGLE_SANDBOX.`);return}let n=St();M(n?`Active sandbox: ${n}`:"No active sandbox. Set one with `tangle use <id>`.")}catch(e){R(e)}})}const uc=1e3;function dc(){let e=new t(`workflows`).description(`Create and manage Tangle workflows`);return e.option(`--json`,`Output as JSON`),e.hook(`preAction`,(e,t)=>{mc(t)}),e.command(`list`).description(`List your workflows`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await Z(e).workflows.list();if(e.json)return k(t);gc(t)}catch(t){Q(t,e)}}),e.command(`get`).description(`Show a workflow's definition and compiled triggers`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await Z(t).workflows.get(e);if(t.json)return k(n);_c(n)}catch(e){Q(e,t)}}),e.command(`create`).description(`Create a workflow from a YAML file`).argument(`<file>`,`Path to the workflow YAML`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=pc(e),r=await Z(t).workflows.create(n);if(t.json)return k(r);M(`Created workflow ${r.id} (${r.name}).`),_c(r)}catch(e){Q(e,t)}}),e.command(`update`).description(`Replace a workflow's definition from a YAML file`).argument(`<id>`,`Workflow ID`).argument(`<file>`,`Path to the workflow YAML`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=pc(t),i=await Z(n).workflows.update(e,r);if(n.json)return k(i);M(`Updated workflow ${i.id} (${i.name}).`),_c(i)}catch(e){Q(e,n)}}),e.command(`delete`).description(`Delete a workflow and its triggers`).argument(`<id>`,`Workflow ID`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{if(!t.force&&!await H(`Delete workflow ${e}? `)){M(`Delete cancelled.`);return}if(await Z(t).workflows.delete(e),t.json)return k({deleted:!0,id:e});M(`Deleted workflow ${e}.`)}catch(e){Q(e,t)}}),e.command(`validate`).description(`Validate a workflow YAML file without saving it`).argument(`<file>`,`Path to the workflow YAML`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=pc(e),r=await Z(t).workflows.validate(n);if(t.json)return k(r);if(r.valid)M(`Valid: ${r.name} (${r.actionCount} action(s), ${r.triggerCount} trigger(s)).`);else{M(`Invalid workflow:`);for(let e of r.errors)console.log(`  ${e.path}: ${e.message}`);process.exitCode=1}}catch(e){Q(e,t)}}),e.command(`schema`).description(`Print the JSON Schema for the workflow YAML`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{k(await Z(e).workflows.schema())}catch(t){Q(t,e)}}),e.command(`run`).description(`Trigger an immediate run of a workflow`).argument(`<id>`,`Workflow ID`).option(`--input <key=value>`,`Trigger input as key=value (e.g. pull_request.number=123). Repeatable.`,vc,[]).option(`--wait`,`Wait for the run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=yc(t.input),r=t.timeout===void 0?void 0:Ei(t.timeout,`--timeout`),i=t.pollInterval===void 0?void 0:Ei(t.pollInterval,`--poll-interval`),a=Z(t),{runId:o}=await a.workflows.run(e,n);if(!t.wait){if(t.json)return k({runId:o});M(`Started run ${o} for workflow ${e}.`),M(`Inspect it with: tangle workflows run-detail ${e} ${o}`);return}let s=t.json?null:N(`Waiting for run ${o} to finish...`).start(),c;try{c=await a.workflows.waitForRun(e,o,{...r===void 0?{}:{timeoutMs:r},...i===void 0?{}:{pollIntervalMs:i}})}finally{s?.stop()}if(c.status===`failed`&&(process.exitCode=1),t.json)return k(c);xc(c)}catch(e){Q(e,t)}}),e.command(`runs`).description(`List a workflow's run history (newest first)`).argument(`<id>`,`Workflow ID`).option(`--limit <n>`,`Runs per page (1-100)`).option(`--cursor <cursor>`,`Pagination cursor from a previous page`).option(`--all`,`Fetch every page, not just the first`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=Z(t),r=t.limit===void 0?void 0:Ei(t.limit,`--limit`);if(t.all){let i=[],a=t.cursor,o=0,s=null;for(;;){let c=await n.workflows.listRuns(e,{...r===void 0?{}:{limit:r},...a===void 0?{}:{cursor:a}});if(i.push(...c.runs),o+=1,!c.nextCursor)break;if(o>=uc){s=c.nextCursor,t.json||M(`Stopped after ${uc} pages (${i.length} runs); more may exist — resume with --cursor ${c.nextCursor}`);break}a=c.nextCursor}if(t.json)return k({runs:i,nextCursor:s});bc(i);return}let i=await n.workflows.listRuns(e,{...r===void 0?{}:{limit:r},...t.cursor===void 0?{}:{cursor:t.cursor}});if(t.json)return k(i);bc(i.runs),i.nextCursor&&M(`More runs available — next page: --cursor ${i.nextCursor}`)}catch(e){Q(e,t)}}),e.command(`run-detail`).description(`Show a single run's detail (per-action output and errors)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=await Z(n).workflows.getRun(e,t);if(n.json)return k(r);xc(r)}catch(e){Q(e,n)}}),e.command(`cancel`).description(`Cancel a queued or in-progress run`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=await Z(n).workflows.cancel(e,t);if(n.json)return k(r);Sc(r)}catch(e){Q(e,n)}}),e.command(`events`).description(`Tail a run's live progress events until it finishes`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).option(`--json`,`Emit each event as a JSON line`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=Z(n);for await(let i of r.workflows.watchRun(e,t))n.json?console.log(JSON.stringify(i)):Cc(i),i.type===`run.done`&&i.status===`failed`&&(process.exitCode=1)}catch(e){Q(e,n)}}),e.command(`enable`).description(`Enable a workflow so its triggers and manual runs fire`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{await fc(e,!0,t)}),e.command(`disable`).description(`Disable a workflow (pause its triggers and manual runs)`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{await fc(e,!1,t)}),e}async function fc(e,t,n){try{let r=await Z(n).workflows.setEnabled(e,t);if(n.json)return k(r);M(`${t?`Enabled`:`Disabled`} workflow ${r.id}.`),_c(r)}catch(e){Q(e,n)}}function pc(e){try{return u(e,`utf8`)}catch(t){throw Error(`Could not read workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function Z(e){let t=w({apiKey:C(e.apiKey),baseUrl:e.baseUrl??Nt(process.env.TANGLE_HUB_URL)});return new _e({baseUrl:t.baseUrl,apiKey:t.apiKey})}function mc(e){if(!hc(e,`json`)||e.getOptionValue(`json`)!==void 0)return;let t=e.parent;for(;t;){let n=t.getOptionValue(`json`);if(n!==void 0){e.setOptionValue(`json`,n);return}t=t.parent}}function hc(e,t){return e.options.some(e=>e.attributeName()===t)}function Q(e,t){return R(e,t.json===!0)}function gc(e){O(e.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,issues:e.validationErrors.length,updated:e.updatedAt})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`issues`,header:`Issues`},{key:`updated`,header:`Updated`}])}function _c(e){if(P({ID:e.id,Name:e.name,Description:e.description??``,Enabled:e.enabled?`yes`:`no`,Actions:e.actions.length}),e.triggers&&e.triggers.length>0&&(M(`Triggers`),wc(e.triggers)),e.validationErrors.length>0){M(`Validation issues`);for(let t of e.validationErrors)console.log(`  ${t.path}: ${t.message}`)}}function vc(e,t){return[...t,e]}function yc(e){if(!e||e.length===0)return;let t={};for(let n of e){let e=n.indexOf(`=`);if(e<=0)throw Error(`Invalid --input "${n}": expected key=value (e.g. pull_request.number=123)`);t[n.slice(0,e)]=n.slice(e+1)}return t}function bc(e){O(e.map(e=>({id:e.id,status:e.status,attempts:e.attempts,created:e.createdAt,completed:e.completedAt??``})),[{key:`id`,header:`Run ID`},{key:`status`,header:`Status`},{key:`attempts`,header:`Attempts`},{key:`created`,header:`Created`},{key:`completed`,header:`Completed`}])}function xc(e){P({"Run ID":e.id,Workflow:e.workflowId,Status:e.status,Error:e.error??``,Attempts:e.attempts,Created:e.createdAt,Started:e.startedAt??``,Completed:e.completedAt??``}),e.actionResults.length>0&&(M(`Actions`),O(e.actionResults.map(e=>({index:e.index,kind:e.kind,status:e.status,error:e.error??``,cost:e.costUsd??``})),[{key:`index`,header:`#`},{key:`kind`,header:`Kind`},{key:`status`,header:`Status`},{key:`error`,header:`Error`},{key:`cost`,header:`Cost (USD)`}]))}function Sc(e){if(e.status===`cancelled`){M(`Cancelled run ${e.runId}.`);return}if(e.signalled){M(`Cancelling run ${e.runId} — signalled the worker; it will stop shortly.`);return}M(`Requested cancellation of run ${e.runId}, but couldn't confirm it — the run may have just finished, or it's running on another instance and will stop on its own.`)}function Cc(e){switch(e.type){case`snapshot`:M(`snapshot: ${e.run.status} (${e.run.actionResults.length} action(s))`);break;case`action.started`:console.log(`→ action[${e.index}] ${e.kind} started`);break;case`action.finished`:{let t=e.status===`succeeded`?`✓`:e.status===`skipped`?`⊘`:`✗`;console.log(`${t} action[${e.index}] ${e.kind} ${e.status}${e.error?`: ${e.error}`:``}`);break}case`iteration.started`:console.log(`  · action[${e.actionIndex}] iteration ${e.iterationIndex} started`);break;case`iteration.ended`:console.log(`  · action[${e.actionIndex}] iteration ${e.iterationIndex} ${e.status}`);break;case`token`:typeof e.delta==`string`&&process.stdout.write(e.delta);break;case`ping`:break;case`run.done`:console.log(`\nrun.done: ${e.status}${e.error?`: ${e.error}`:``}`);break;case`run.waiting`:console.log(`\nrun.waiting: parked on a human decision (${e.decisionId}) — resolve it to resume`);break}}function wc(e){O(e.map(e=>({id:e.id,kind:e.kind,enabled:e.enabled?`yes`:`no`,detail:e.kind===`schedule`?`${e.cron??``} (${e.timezone??``})`:`${e.provider??``}:${e.eventFilter?.event??``}${e.eventFilter?.action?`.${e.eventFilter.action}`:``}`})),[{key:`id`,header:`ID`},{key:`kind`,header:`Kind`},{key:`enabled`,header:`Enabled`},{key:`detail`,header:`Detail`}])}function Tc(e){let t={...Ec(e)??{},...e.optsWithGlobals()};for(let n of e.options){let r=n.attributeName();e.getOptionValue(r)===void 0&&t[r]!==void 0&&e.setOptionValue(r,t[r])}}function Ec(e){let t=e;for(;t?.parent;)t=t.parent;return t?t.opts():void 0}const Dc=e(import.meta.url)(`../package.json`),$=new t;$.name(`tangle`).description(`CLI for Tangle Sandbox operations`).version(Dc.version??`0.0.0`).option(`--api-key <key>`,`API key (or set TANGLE_API_KEY)`).option(`--base-url <url>`,`API base URL`),$.hook(`preAction`,(e,t)=>{Tc(t)}),$.addCommand(pr()),$.addCommand(Uo()),$.addCommand(lc()),$.addCommand(as()),$.addCommand(wo()),$.addCommand(pa()),$.addCommand(vs()),$.addCommand(ys()),$.addCommand(xs()),$.addCommand(Yn()),$.addCommand(cs()),$.addCommand(Ca()),$.addCommand(oc()),$.addCommand(Is()),$.addCommand(Vs()),$.addCommand(Eo()),$.addCommand(br()),$.addCommand(Er()),$.addCommand(Oo()),$.addCommand(Pa()),$.addCommand(La()),$.addCommand(Ra()),$.addCommand(dc()),$.addCommand(fa()),$.addCommand(Hs()),$.addCommand(is()),$.addCommand(ss()),$.addCommand(Dr()),$.addCommand(Do()),$.addCommand(ao()),$.addCommand(Qi()),$.addCommand($i()),$.addCommand(Po()),$.addCommand(To()),$.addCommand(Us()),$.addCommand(Fs()),$.parseAsync(process.argv).catch(e=>{console.error(`Fatal error:`,e.message),process.exit(1)});export{};
+`)?`${e}\n`:`${e}\n\n`}function qa(e){let t=[],n={header:null,body:[]};for(let r of e.split(`
+`))Ja(r)?(t.push(n),n={header:r.trim(),body:[]}):n.body.push(r);return t.push(n),t.length>1&&t[0].header===null&&t[0].body.every(e=>e.trim()===``)&&t.shift(),t}function Ja(e){let t=e.trim();return t.startsWith(`[`)&&t.endsWith(`]`)&&!t.includes(`=`)||t.startsWith(`[[`)&&t.endsWith(`]]`)}function Ya(e){let t=[];for(let n of e)n.header!==null&&t.push(n.header),t.push(...n.body);return t.join(`
+`)}function Xa(e){return[{key:`environment`,line:`environment = "prod"`},{key:`log_user_prompt`,line:`log_user_prompt = true`},{key:`exporter`,line:`exporter = { otlp-http = { endpoint = "${V(e.endpoint)}/v1/logs", protocol = "json", headers = { "Authorization" = "Bearer ${e.apiKey??"${TANGLE_API_KEY}"}" } } }`}]}function Za(e){let t=e.trim();if(t===``||t.startsWith(`#`))return null;let n=t.indexOf(`=`);if(n===-1)return null;let r=t.slice(0,n).trim();return/^[A-Za-z0-9_-]+$/.test(r)?r:null}function Qa(e,t){let n=Xa(t),r=new Set(n.map(e=>e.key));if(e.trim()===``)return{contents:`${[`[otel]`,...n.map(e=>e.line)].join(`
+`)}\n`,changed:!0};let i=qa(e),a=i.find(e=>e.header===`[otel]`);if(!a){let t={header:`[otel]`,body:n.map(e=>e.line)},r=i[i.length-1];r&&!$a(r)&&r.body.push(``),i.push(t);let a=eo(Ya(i));return{contents:a,changed:a!==eo(e)}}let o=a.body.filter(e=>{let t=Za(e);return t===null||!r.has(t)}),s=[];for(;o.length>0&&o[o.length-1].trim()===``;)s.unshift(o.pop());a.body=[...o,...n.map(e=>e.line),...s];let c=eo(Ya(i));return{contents:c,changed:c!==eo(e)}}function $a(e){return e.body.length>0&&e.body[e.body.length-1].trim()===``}function eo(e){return e.endsWith(`
+`)?e:`${e}\n`}function to(e){switch(e){case`claude-code`:return`Claude Code: set OTEL_LOGS_EXPORTER=otlp and the four OTEL_LOG_* gates (OTEL_LOG_USER_PROMPTS, OTEL_LOG_TOOL_DETAILS, OTEL_LOG_TOOL_CONTENT, OTEL_LOG_RAW_API_BODIES).`;case`codex`:return`Codex: set log_user_prompt = true in [otel] (default false redacts content).`;case`opencode`:return`OpenCode: a standalone install emits nothing without the tangle-opencode-exporter shim; inside a Tangle sandbox it is already instrumented.`;case`openclaw`:case`hermes`:case`nanoclaw`:return`${Fa[e]}: no native OTLP exporter and no standalone server to subscribe to — run it inside a Tangle sandbox, where the sidecar adapter exports its content with gen_ai.system=${e}. A bare standalone install emits metadata only.`}}function no(){let e=process.env.SHELL??``;return e.includes(`zsh`)?me(_e(),`.zshrc`):e.includes(`bash`)?me(_e(),`.bashrc`):me(_e(),`.zshrc`)}function ro(e){return se(e)?x(e,`utf8`):``}function io(e,t){ce(fe(e),{recursive:!0});let n=`${e}.${process.pid}.tmp`;ue(n,t,{mode:384}),oe(n,384),le(n,e)}function ao(){return new t(`connect`).description(`Connect a local coding agent's telemetry to Tangle Intelligence, content on (for SDK integration snippets, see 'tangle agent connect')`).argument(`[agent]`,`claude-code | codex | opencode | openclaw | hermes | nanoclaw`).option(`--api-key <key>`,`Tangle API key (or set TANGLE_API_KEY)`).option(`--endpoint <url>`,`OTLP endpoint base`,Li).option(`-p, --project <key>`,`Project label (tangle.subject.key) to group runs; omit to set it yourself`).option(`--rc <path>`,`Shell rc file to append the Claude Code env block to`).option(`--no-write`,`Print the config instead of writing files (Claude Code / Codex)`).option(`--inline-key`,"Embed the resolved API key literally in the config (default: keep ${TANGLE_API_KEY})").option(`--verify`,`Poll onboarding status and report whether CONTENT is flowing`).option(`--timeout <seconds>`,`Verify poll timeout in seconds`,`120`).option(`--run`,`OpenCode only: run the content exporter against a live OpenCode server until interrupted`).option(`--opencode-url <url>`,`OpenCode server base URL for --run (or set OPENCODE_BASE_URL)`).option(`--format <kind>`,`Claude Code output: shell (export block) | env (.env / docker --env-file) | dockerfile (ENV lines). env/dockerfile are the cron/container path — printed to stdout, no shell-rc edit, no TTY`,`shell`).option(`--content <tier>`,`Claude Code content tier: full (everything) | prompts (task+prompts+tool-args) | metadata (telemetry on, content off)`,`full`).action(async(e,t)=>{try{let n=V(t.endpoint);if(t.run){if((e?so(e):`opencode`)!==`opencode`)throw Error(`--run is OpenCode-only: it runs the content exporter against a live OpenCode server. Other agents export natively once configured.`);await go({endpoint:n,apiKey:za(t.apiKey),opencodeUrl:t.opencodeUrl});return}if(t.verify){await _o({endpoint:n,apiKey:za(t.apiKey),agent:e?so(e):void 0,timeoutSeconds:U(t.timeout,`--timeout`)});return}let r=e?so(e):await uo(),i=t.inlineKey?za(t.apiKey):void 0;r===`claude-code`?await fo({endpoint:n,apiKey:i,projectKey:t.project,rcPath:t.rc,write:t.write!==!1,content:lo(t.content),format:co(t.format)}):r===`codex`?po({endpoint:n,apiKey:i,projectKey:t.project,write:t.write!==!1}):r===`opencode`?mo({endpoint:n}):ho(r,{endpoint:n}),console.log(),N(`Run your agent on a real task, then verify content is flowing: tangle connect ${r} --verify`)}catch(e){L(e)}})}function oo(){return new t(`opencode-exporter`).description(`Export a running OpenCode's content to Tangle Intelligence (standalone shim)`).option(`--api-key <key>`,`Tangle API key (or set TANGLE_API_KEY)`).option(`--endpoint <url>`,`OTLP endpoint base`,Li).option(`--opencode-url <url>`,`OpenCode server base URL (or set OPENCODE_BASE_URL)`).action(async e=>{try{await go({endpoint:V(e.endpoint),apiKey:za(e.apiKey),opencodeUrl:e.opencodeUrl})}catch(e){L(e)}})}function so(e){if(Ra(e))return e;throw Error(`Unknown agent '${e}'. Choose one of: ${Pa.join(`, `)}`)}function co(e){if(e===`shell`||e===`env`||e===`dockerfile`)return e;throw Error(`--format must be one of: shell, env, dockerfile (got '${e}')`)}function lo(e){if(e===`full`||e===`prompts`||e===`metadata`)return e;throw Error(`--content must be one of: full, prompts, metadata (got '${e}')`)}async function uo(){if(!process.stdin.isTTY)throw Error(`Specify an agent: tangle connect <${Pa.join(`|`)}>`);console.log(`Which coding agent are you connecting?`),Pa.forEach((e,t)=>{console.log(`  ${t+1}) ${Fa[e]} (${e})`)});let e=await Fr(`Enter a number or name`,`1`);return Pa[Number.parseInt(e,10)-1]||so(e.trim())}async function fo(e){let t=Ua({endpoint:e.endpoint,apiKey:e.apiKey,projectKey:e.projectKey,content:e.content,format:e.format});if(console.log(t),e.format!==`shell`){console.log(),N(e.format===`env`?"Cron/container path: feed these to your service env (.env, `docker run --env-file`, k8s envFrom). No shell-rc edit, no TTY needed.":`Dockerfile path: paste these ENV lines into your image. No shell-rc edit, no TTY needed.`);return}if(console.log(),N(`Privacy tiers: --content full ships the whole conversation; --content prompts keeps task, prompts, and tool args only; --content metadata turns content off (telemetry still flows). Secrets are scrubbed server-side regardless.`),!e.write)return;let n=e.rcPath??no(),r=process.stdin.isTTY?await Fr(`Append this idempotent block to ${n}? (y/N)`,`n`):`n`;if(r.toLowerCase()!==`y`&&r.toLowerCase()!==`yes`){console.log(),N(`Not writing. To append later: tangle connect claude-code --rc ${n}`);return}let i=Wa({endpoint:e.endpoint,apiKey:e.apiKey,projectKey:e.projectKey,content:e.content,format:e.format}),{contents:a,changed:o}=Ga(ro(n),i);if(!o){console.log(),j(`Already present in ${n} — nothing to change.`);return}io(n,a),console.log(),j(`Wrote Tangle Intelligence env block to ${n}.`),N(`Reload your shell (e.g. 'source ${n}') before running the agent.`)}function po(e){let t=me(_e(),`.codex`,`config.toml`),{contents:n,changed:r}=Qa(ro(t),{endpoint:e.endpoint,apiKey:e.apiKey});if(!e.write){console.log(n.trimEnd());return}if(!r){j(`${t} already has the Tangle [otel] block — nothing to change.`);return}io(t,n),j(`Merged the Tangle [otel] block into ${t}.`),N("Codex emits content on the logs signal (codex.* events). Set TANGLE_API_KEY in your env before running if you kept the ${TANGLE_API_KEY} reference."),N(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=${e.projectKey??`<your project>`} before running codex.`)}function mo(e){let t=V(e.endpoint);M(`OpenCode has no native OTel exporter, so a standalone install emits nothing without a shim.`),console.log(),F({"Inside a Tangle sandbox":`already instrumented — our adapter exports OpenCode's event-stream content. Nothing to do.`,Standalone:`run 'tangle connect opencode --run' alongside a running OpenCode, exporting to ${t}.`}),console.log(),N(`Start OpenCode in server mode ('opencode serve'), then in another terminal run: tangle connect opencode --run`),N(`The exporter subscribes to OpenCode's SSE event bus and exports content-bearing OTLP (prompt/completion/tool content) to Tangle. Verify with: tangle connect opencode --verify`),N(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=my-project before starting the exporter.`)}function ho(e,t){let n=V(t.endpoint),r=Fa[e];M(`${r} has no native OTel exporter, so a standalone install emits nothing without instrumentation.`),console.log(),F({"Inside a Tangle sandbox":`already instrumented — the sidecar adapter exports ${r}'s prompt/completion/tool content (gen_ai.system=${e}) to ${n}. Nothing to do.`,Standalone:`${r} exposes no OTLP and no event-bus server; run it inside a Tangle sandbox to capture content.`}),console.log(),N(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=my-project before starting ${r}.`),N(`Verify content is flowing: tangle connect ${e} --verify`)}async function go(e){let t=ka(e.opencodeUrl),n=new AbortController,r=()=>n.abort();process.on(`SIGINT`,r),process.on(`SIGTERM`,r),N(`Subscribing to OpenCode at ${t} — exporting content to Tangle.`),N(`Run OpenCode tasks now. Press Ctrl-C to stop.`),console.log();let i=0,a;try{a=await Na({endpoint:e.endpoint,apiKey:e.apiKey,opencodeBaseUrl:t,signal:n.signal,onExport:({eventType:e,records:t})=>{i+=t,N(`exported ${t} record(s) from ${e} (total ${i})`)}})}catch(e){if(e instanceof ja){let{recordsExported:t,contentEventsExported:n}=e.partial;console.log(),M(`Exporter failed after exporting ${t} content record(s) from ${n} event(s): ${e.message}`)}throw e}finally{process.off(`SIGINT`,r),process.off(`SIGTERM`,r)}if(console.log(),a.contentEventsExported===0){M(`Saw ${a.eventsSeen} event(s) but none carried content. Run a real OpenCode task (a prompt that produces text or a tool call), then re-run.`);return}j(`Exported ${a.recordsExported} content record(s) from ${a.contentEventsExported} event(s).`),N(`Verify it landed: tangle connect opencode --verify`)}async function _o(e){let t=Date.now()+e.timeoutSeconds*1e3,n=3e3,r=Math.min(e.timeoutSeconds*1e3,1e4),i=P(`Checking whether content is flowing…`);i.start();let a;try{for(;;){try{a=await Qi({endpoint:e.endpoint,apiKey:e.apiKey,timeoutMs:r})}catch(e){if(Date.now()>=t)throw e;await yo(n);continue}if(a.contentSeen||Date.now()>=t)break;await yo(n)}}finally{i.stop()}if(!a)throw Error(`onboarding status check returned no result`);vo(a,e.agent),a.contentSeen||(process.exitCode=1)}function vo(e,t){if(e.contentSeen){j(`Content flowing — Tangle Intelligence can analyze this feed.`),F({"Last seen":e.lastSeenAt??`just now`,Window:`${e.windowDays}d`});return}if(e.tracesSeen){M(`Metadata-only — traces are arriving but carry no content. You missed a content gate.`);let n=t?[t]:Object.keys(e.byAgent).filter(Ra),r=n.length>0?n:Pa;for(let n of r){let r=e.byAgent[n];(t||!r||r.tracesSeen&&!r.contentSeen)&&N(to(n))}return}M(`No traces yet for your tenant. Run your agent once on a real task, then re-run --verify.`),t&&N(to(t))}function yo(e){return new Promise(t=>setTimeout(t,e))}function bo(){let e=new t(`environments`).alias(`env`).description(`Manage sandbox environments`);return e.command(`list`).alias(`ls`).description(`List available environments`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=O(D({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=P(`Fetching environments...`);e.json||n.start();let r=await t.environments.list();n.stop(),e.json?A(r):r.length===0?console.log(`No environments found`):I([`ID`,`Description`,`Version`],r.map(e=>[e.id,e.description??``,e.version]))}catch(e){L(e)}}),e.command(`get`).description(`Get environment details`).argument(`<id>`,`Environment ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=O(D({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=P(`Fetching environment...`);t.json||r.start();let i=await n.environments.get(e);if(r.stop(),!i){console.error(`Environment not found: ${e}`),process.exit(1);return}t.json?A(i):(console.log(`ID:          ${i.id}`),console.log(`Description: ${i.description??`-`}`),console.log(`Version:     ${i.version}`),i.base&&console.log(`Base:        ${i.base}`))}catch(e){L(e)}}),e}function xo(){return new t(`exec`).description(`Execute a command in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command...>`,`Command to execute`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`,`60000`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=O(r),a=t.join(` `),o={};if(n.env)for(let e of n.env){let[t,...n]=e.split(`=`);t&&n.length>0&&(o[t]=n.join(`=`))}let s=P(`Executing: ${a}`);n.json||s.start();let c=await z(i,r,e);c=await B(c);let l=await c.exec(a,{cwd:n.cwd,env:Object.keys(o).length>0?o:void 0,timeoutMs:Number.parseInt(n.timeout,10)});s.stop(),n.json?A(l):(l.stdout&&process.stdout.write(l.stdout),l.stderr&&process.stderr.write(l.stderr),l.exitCode!==0&&process.exit(l.exitCode))}catch(e){if(e instanceof u){let t=`Exec transport lost before command status was confirmed. Remote command status is unknown. Original error: ${e.message}. For long-running commands, use \`tangle process spawn\`, \`tangle process logs\`, and \`tangle process kill --tree\`.`;return L(Error(t,{cause:e}))}L(e)}})}const So=[`runpod`,`vast-ai`,`lambda-labs`,`tensordock`,`paperspace`,`aws`,`gcp`,`azure`,`crusoe`,`fluidstack`];function Co(e){let t=e.memory?W(e.memory,`--accelerator-memory`):void 0;return{kind:Oo(e.kind),count:e.count?W(e.count,`--accelerator-count`):1,...t===void 0?{}:{memoryMB:t}}}function wo(e,t,n){let r=!!(e.provider||e.image||e.env||e.maxSpendUsd||e.maxLifetime||e.idleTimeout);if(!t&&r)throw Error(n);if(t){if(!e.maxSpendUsd||!e.maxLifetime)throw Error(`--accelerator-kind requires --gpu-max-spend-usd and --gpu-max-lifetime`);return{...e.provider?{provider:Do(e.provider,`--gpu-provider`)}:{},...e.image?{image:e.image}:{},...e.env?{env:Eo(e.env,`--gpu-env`,`GPU env`)}:{},maxSpendUsd:ko(e.maxSpendUsd,`--gpu-max-spend-usd`),maxLifetimeSeconds:W(e.maxLifetime,`--gpu-max-lifetime`),...e.idleTimeout?{idleTimeoutSeconds:W(e.idleTimeout,`--gpu-idle-timeout`)}:{}}}}function To(e){return{...e.provider?{provider:Do(e.provider,`GPU provider`)}:{},accelerator:Co({kind:e.acceleratorKind,count:e.acceleratorCount,memory:e.acceleratorMemory}),...e.image?{image:e.image}:{},...e.env?{env:Eo(e.env,`--env`,`env`)}:{},maxSpendUsd:ko(e.maxSpendUsd,`--max-spend-usd`),maxLifetimeSeconds:W(e.maxLifetime,`--max-lifetime`),...e.idleTimeout?{idleTimeoutSeconds:W(e.idleTimeout,`--idle-timeout`)}:{}}}function Eo(e,t,n){let r={};for(let i of e){let[e,...a]=i.split(`=`);if(!e||a.length===0)throw Error(`${t} expects ${n} values in KEY=VALUE format`);r[e]=a.join(`=`)}return r}function W(e,t){if(!/^\d+$/.test(e))throw Error(`${t} must be a positive integer`);let n=Number.parseInt(e,10);if(Number.isNaN(n)||n<1)throw Error(`${t} must be a positive integer`);return n}function Do(e,t){if(So.includes(e))return e;throw Error(`${t} must be one of ${So.join(`, `)}`)}function Oo(e){let t=e.trim().toLowerCase();if(/^[a-z0-9][a-z0-9._-]*$/.test(t))return t;throw Error(`--accelerator-kind must contain only letters, numbers, dots, underscores, or hyphens`)}function ko(e,t){if(!/^(?:\d+|\d+\.\d+|\.\d+)$/.test(e))throw Error(`${t} must be a positive number`);let n=Number.parseFloat(e);if(!Number.isFinite(n)||n<=0)throw Error(`${t} must be a positive number`);return n}const Ao=[`list`,`create`,`delete`,`exec`,`prompt`,`read`,`write`];function jo(){let e=new t(`fleet`).description(`Manage sandbox fleets`);return e.command(`create`).description(`Create a sandbox fleet`).option(`--fleet-id <id>`,`Stable fleet id (generated when omitted)`).option(`--count <n>`,`Number of worker machines`,`1`).option(`--environment <environment>`,`Named environment, container image, or built image ID for each machine`).option(`--cpu <cores>`,`CPU cores per machine`).option(`--memory <mb>`,`Memory in MB per machine`).option(`--disk <gb>`,`Disk in GB per machine`).option(`--accelerator-kind <kind>`,`Accelerator kind per machine, for example nvidia-l4 or nvidia-h100`).option(`--accelerator-count <count>`,`Accelerator devices per machine`).option(`--accelerator-memory <mb>`,`Minimum accelerator memory in MB per machine`).option(`--gpu-provider <provider>`,`GPU cloud provider per machine; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for each GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum spend per machine GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum GPU lease lifetime per machine in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy each GPU lease after this many idle seconds`).option(`--driver <type>`,`Infrastructure driver type`).option(`--backend <id>`,`Agent backend type`).option(`--workspace <mode>`,`Workspace mode: isolated | shared`,`isolated`).option(`--max-spend-usd <n>`,`Fleet spend cap in USD (policy)`).option(`--max-lifetime <s>`,`Max machine lifetime in seconds (policy)`).option(`--spec <file.json>`,`Path to a JSON file describing the fleet (overrides synthesized machines)`).option(`--coordinator`,`Create a coordinator + workers fleet (routes to createWithCoordinator)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=O(D({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=P(`Creating fleet...`);n.start();let r=e.coordinator?await t.fleets.createWithCoordinator(Fo(e)):await t.fleets.create(Po(e));n.stop();let i=zo(r.machines);e.json?A({fleetId:r.fleetId,machines:i}):(j(`Fleet created: ${r.fleetId}`),k(i,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}]))}catch(e){L(e)}}),e.command(`list <fleet-id>`).description(`List the machines of one fleet (fleet id is required)`).option(`--status <status>`,`Filter machines by status`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=O(D({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=P(`Fetching fleet...`);r.start();let i=await n.fleets.list({fleetId:e,status:t.status});r.stop();let a=zo(i.machines);t.json?A({fleetId:i.fleetId,machines:a}):k(a,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}])}catch(e){L(e)}}),e.command(`get <fleet-id>`).description(`Show one fleet's manifest (server record)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=O(D({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=P(`Fetching manifest...`);r.start();let i=await n.fleets.manifest(e);r.stop(),t.json?A(i):(F({"Fleet ID":i.fleetId??i.id,Machines:i.machines.length,"Workspace mode":i.workspace?.mode,"Workspace status":i.workspace?.status,"Max lifetime (s)":i.policy?.maxLifetimeSeconds,"Max spend (USD)":i.policy?.maxSpendUsd,Created:i.createdAt,Updated:i.updatedAt}),k(i.machines.map(e=>({machineId:e.machineId,sandboxId:e.sandboxId,role:e.role,status:e.status})),[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`role`,header:`Role`,width:14},{key:`status`,header:`Status`,width:14}]))}catch(e){L(e)}}),e.command(`delete <fleet-id>`).description(`Delete a fleet's machine sandboxes and its record`).option(`--continue-on-error`,`Keep deleting remaining machines if one delete fails`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=O(D({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=P(`Deleting fleet...`);r.start(),await n.fleets.delete(e,{continueOnError:t.continueOnError}),r.stop(),t.json?A({success:!0,fleetId:e}):j(`Fleet deleted: ${e}`)}catch(e){L(e)}}),e.command(`reap`).description(`TTL cleanup of all expired fleets (fleet-wide)`).option(`--dry-run`,`Report what would be reaped without deleting`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=O(D({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=P(`Reaping expired fleets...`);n.start();let r=await t.fleets.reapExpired({dryRun:e.dryRun});n.stop(),e.json?A(r):(F({"Dry run":r.dryRun,Expired:r.expired,Deleted:r.deleted}),k(r.fleets.map(e=>({fleetId:e.fleetId,expiredAt:e.expiredAt,deleted:e.deleted})),[{key:`fleetId`,header:`Fleet`,width:24},{key:`expiredAt`,header:`Expired`,width:18},{key:`deleted`,header:`Deleted`,width:10}]))}catch(e){L(e)}}),e.command(`reconcile`).description(`Drop fleet records whose underlying sandboxes vanished`).option(`--dry-run`,`Report orphans without removing them`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=O(D({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=P(`Reconciling fleets...`);n.start();let r=await t.fleets.reconcile({dryRun:e.dryRun});n.stop(),e.json?A(r):(F({"Dry run":r.dryRun,Checked:r.checked,Orphaned:r.orphaned,Removed:r.removed}),k(r.machines.map(e=>({fleetId:e.fleetId,machineId:e.machineId,sandboxId:e.sandboxId,removed:e.removed})),[{key:`fleetId`,header:`Fleet`,width:24},{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`removed`,header:`Removed`,width:10}]))}catch(e){L(e)}}),e.addCommand(Mo()),e.command(`exec <fleet-id> <command>`).description(`Run a shell command across the fleet's machines`).option(`--machine <id...>`,`Restrict to a subset of machine ids (default: all)`).option(`--cwd <dir>`,`Working directory for the command`).option(`--timeout <ms>`,`Per-machine timeout in milliseconds`).option(`--max-concurrent <n>`,`Max concurrent dispatches`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=O(D({apiKey:n.apiKey,baseUrl:n.baseUrl})),i=P(`Dispatching command...`);i.start();let a=await(await r.fleets.list({fleetId:e})).dispatchExecDetailed(t,{machines:n.machine,cwd:n.cwd,timeoutMs:n.timeout?Number(n.timeout):void 0,maxConcurrent:n.maxConcurrent?Number(n.maxConcurrent):void 0});if(i.stop(),n.json)A(a);else{k(a.results.map(e=>({machineId:e.machineId,ok:e.ok,exitCode:e.result?.exitCode,durationMs:e.durationMs})),[{key:`machineId`,header:`Machine`,width:20},{key:`ok`,header:`OK`,width:6},{key:`exitCode`,header:`Exit`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14}]);for(let e of a.results){let t=e.result?.stdout,n=e.result?.stderr;t&&(console.log(`\n[${e.machineId}] stdout:`),console.log(t)),n&&(console.log(`\n[${e.machineId}] stderr:`),console.log(n)),e.error&&console.log(`\n[${e.machineId}] error: ${e.error.message}`)}}a.results.some(e=>e.ok===!1)&&(process.exitCode=1)}catch(e){L(e)}}),e.command(`capabilities`).description(`List fleet drivers and their supported features`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=O(D({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=P(`Fetching capabilities...`);n.start();let r=await t.fleets.capabilities();n.stop(),e.json?A(r):k(r.drivers.map(e=>({driverType:e.driverType,sharedWorkspace:e.sharedWorkspace,accelerators:e.accelerators,queueTimings:e.queueTimings})),[{key:`driverType`,header:`Driver`,width:16},{key:`sharedWorkspace`,header:`Shared WS`,width:12},{key:`accelerators`,header:`Accel`,width:8},{key:`queueTimings`,header:`Queue`,width:8}])}catch(e){L(e)}}),e.command(`usage <fleet-id>`).description(`Show fleet usage and reliability insights`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=O(D({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=P(`Fetching usage...`);r.start();let i=await n.fleets.usage(e);if(r.stop(),t.json)A(i);else if(F({"Fleet ID":i.usage.fleetId,Status:i.usage.status,Machines:i.usage.machineCount,Running:i.usage.runningMachines,Failed:i.usage.failedMachines,"Runtime (ms)":i.usage.meteredUsage?.runtimeMs,"Reliability score":i.insights.reliabilityScore,"Failure rate":i.insights.failureRate}),i.insights.recommendedActions.length>0){console.log(`
+Recommended actions:`);for(let e of i.insights.recommendedActions)console.log(`  - ${e}`)}}catch(e){L(e)}}),e.command(`cost <fleet-id>`).description(`Show the fleet's cost estimate`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=O(D({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=P(`Estimating cost...`);r.start();let i=await n.fleets.cost(e);r.stop(),t.json?A(i):F({Plan:i.plan,Currency:i.currency,"Hourly (USD)":i.hourlyUsd,"Max lifetime (s)":i.maxLifetimeSeconds,"Estimated max lifetime (USD)":i.estimatedMaxLifetimeUsd,Machines:i.requestedResources.machines,"Total CPU":i.requestedResources.totalCpu,"Total memory (MB)":i.requestedResources.totalMemoryMb})}catch(e){L(e)}}),e.command(`token <fleet-id>`).description(`Mint a scoped fleet bearer token (treated as a secret)`).option(`--action <a...>`,`Allowed actions: list create delete exec prompt read write`).option(`--ttl-minutes <n>`,`Token lifetime in minutes`).option(`--json`,`Output as JSON (only path that prints the full token)`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=O(D({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=P(`Minting fleet token...`);r.start();let i=await n.fleets.createToken(e,{actions:Bo(t.action),ttlMinutes:t.ttlMinutes?Number(t.ttlMinutes):void 0});r.stop(),t.json?A(i):(F({"Fleet ID":i.fleetId,Token:Vo(i.token),"Expires at":new Date(i.expiresAt).toISOString(),Actions:i.actions.join(`, `)}),console.log(`
+Re-run with --json to print the full token value.`))}catch(e){L(e)}}),e}function Mo(){let e=new t(`workspace`).description(`Manage a fleet's shared workspace`);return e.command(`snapshot <fleet-id>`).description(`Snapshot the fleet's shared workspace`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=O(D({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=P(`Creating workspace snapshot...`);r.start();let i=await n.fleets.createWorkspaceSnapshot(e);r.stop(),t.json?A(i):j(`Workspace snapshot created: ${i.snapshotId??i.id}`)}catch(e){L(e)}}),e.command(`restore <fleet-id> <snapshot-id>`).description(`Restore the fleet's shared workspace from a snapshot`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=O(D({apiKey:n.apiKey,baseUrl:n.baseUrl})),i=P(`Restoring workspace...`);i.start();let a=await r.fleets.restoreWorkspaceSnapshot(e,t);i.stop(),n.json?A(a):j(`Workspace restored from ${a.snapshotId??t}`)}catch(e){L(e)}}),e.command(`reconcile <fleet-id>`).description(`Re-mount the shared workspace on all fleet machines`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=O(D({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=P(`Reconciling workspace...`);r.start();let i=await n.fleets.reconcileWorkspace(e);r.stop(),t.json?A(i):(F({"Fleet ID":i.fleetId,Checked:i.checked,"Orphaned mounts":i.orphanedMounts}),k(i.machines.map(e=>({machineId:e.machineId,sandboxId:e.sandboxId,mounted:e.mounted})),[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`mounted`,header:`Mounted`,width:10}]))}catch(e){L(e)}}),e}function No(e){if(e.spec){let t=JSON.parse(x(e.spec,`utf8`));return{base:{fleetId:e.fleetId,defaults:t.defaults,policy:t.policy,workspace:t.workspace,metadata:t.metadata},machines:t.machines??[]}}let t=Io(e),n=Lo(e,!!t?.accelerator),r={...e.environment?{environment:e.environment}:{},...t?{resources:t}:{},...e.driver?{driver:{type:e.driver}}:{},...n?{gpuLease:n}:{},...e.backend?{backend:{type:e.backend}}:{}},i=Ro(e),a=Math.max(1,Number(e.count)||1),o=Array.from({length:a},(e,t)=>({machineId:`worker-${t+1}`}));return{base:{fleetId:e.fleetId,defaults:Object.keys(r).length>0?r:void 0,policy:i,workspace:{mode:e.workspace}},machines:o}}function Po(e){let{base:t,machines:n}=No(e);return{...t,machines:n}}function Fo(e){let{base:t,machines:n}=No(e);return{...t,workers:n}}function Io(e){let t={};if(e.cpu&&(t.cpuCores=Number(e.cpu)),e.memory&&(t.memoryMB=Number(e.memory)),e.disk&&(t.diskGB=Number(e.disk)),e.acceleratorKind)t.accelerator=Co({kind:e.acceleratorKind,count:e.acceleratorCount,memory:e.acceleratorMemory});else if(e.acceleratorCount||e.acceleratorMemory)throw Error(`--accelerator-count and --accelerator-memory require --accelerator-kind`);return Object.keys(t).length>0?t:void 0}function Lo(e,t){return wo({provider:e.gpuProvider,image:e.gpuWorkerImage,env:e.gpuEnv,maxSpendUsd:e.gpuMaxSpendUsd,maxLifetime:e.gpuMaxLifetime,idleTimeout:e.gpuIdleTimeout},t,`Fleet GPU lease flags require --accelerator-kind`)}function Ro(e){let t={};return e.maxSpendUsd&&(t.maxSpendUsd=Number(e.maxSpendUsd)),e.maxLifetime&&(t.maxLifetimeSeconds=Number(e.maxLifetime)),Object.keys(t).length>0?t:void 0}function zo(e){return[...e.entries()].map(([e,t])=>({machineId:e,sandboxId:t.id,status:t.status}))}function Bo(e){if(!(!e||e.length===0)){for(let t of e)if(!Ao.includes(t))throw Error(`Invalid token action '${t}'. Allowed: ${Ao.join(`, `)}`);return e}}function Vo(e){return e.length<=12?`****`:`${e.slice(0,6)}...${e.slice(-4)} (masked — use --json for full value)`}function Ho(){let e=new t(`fs`).description(`File system operations on sandboxes`);return Go(e.command(`upload`).description(`Upload a file to a sandbox`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<local-path>`,`Local file path`).argument(`<remote-path>`,`Remote destination path`).option(`--json`,`Output as JSON`)).action(async(e,t,n,r)=>{try{let{context:i,client:a}=Ko(r),o=await z(a,i,e);if(o=await B(o),!b.existsSync(t))throw Error(`Local file not found: ${t}`);let s=b.statSync(t),c=Date.now();console.log(`Uploading ${t} to ${n}...`),await o.fs.upload(t,n,{onProgress:e=>{let t=e.percentage.toFixed(1);process.stdout.write(`\rProgress: ${t}% (${e.bytesUploaded}/${e.totalBytes} bytes)`)}});let l=Date.now()-c;console.log(``),r.json?$n({success:!0,localPath:t,remotePath:n,size:s.size,durationMs:l}):console.log(`✓ Uploaded ${s.size} bytes in ${l}ms`)}catch(e){Qn(e,r.json)}}),Go(e.command(`download`).description(`Download a file from a sandbox`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<remote-path>`,`Remote file path`).argument(`<local-path>`,`Local destination path`).option(`--json`,`Output as JSON`)).action(async(e,t,n,r)=>{try{let{context:i,client:a}=Ko(r),o=await z(a,i,e);o=await B(o);let s=Date.now();console.log(`Downloading ${t} to ${n}...`),await o.fs.download(t,n,{onProgress:e=>{let t=e.percentage.toFixed(1);process.stdout.write(`\rProgress: ${t}% (${e.bytesDownloaded}/${e.totalBytes} bytes)`)}});let c=Date.now()-s,l=b.statSync(n);console.log(``),r.json?$n({success:!0,remotePath:t,localPath:n,size:l.size,durationMs:c}):console.log(`✓ Downloaded ${l.size} bytes in ${c}ms`)}catch(e){Qn(e,r.json)}}),Go(e.command(`ls`).description(`List directory contents`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`[path]`,`Directory path`,`.`).option(`-l, --long`,`Show detailed information`).option(`-a, --all`,`Include hidden files`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=Ko(n),a=await z(i,r,e);a=await B(a);let o=await a.fs.list(t,{all:n.all,long:n.long});if(n.json)$n(o);else if(n.long)I([`Mode`,`Owner`,`Group`,`Size`,`Modified`,`Name`],o.map(e=>{let t=e.isDir?`d`:e.isSymlink?`l`:`-`,n=Uo(e.permissions),r=e.isDir?`<DIR>`:Wo(e.size),i=e.modTime.toLocaleDateString();return[t+n,e.owner,e.group,r,i,e.name]}));else{let e=o.map(e=>e.isDir?`${e.name}/`:e.name);console.log(e.join(`  `))}}catch(e){Qn(e,n.json)}}),Go(e.command(`stat`).description(`Get file or directory information`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to file or directory`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=Ko(n),a=await z(i,r,e);a=await B(a);let o=await a.fs.stat(t);n.json?$n(o):(console.log(`  File: ${o.name}`),console.log(`  Path: ${o.path}`),console.log(`  Size: ${Wo(o.size)} (${o.size} bytes)`),console.log(`  Type: ${o.isDir?`directory`:o.isSymlink?`symlink`:`file`}`),console.log(`  Mode: ${Uo(o.permissions)} (${o.permissions.toString(8)})`),console.log(`  Owner: ${o.owner}`),console.log(`  Group: ${o.group}`),console.log(`  Modified: ${o.modTime.toISOString()}`),console.log(`  Accessed: ${o.accessTime.toISOString()}`))}catch(e){Qn(e,n.json)}}),Go(e.command(`cat`).description(`Print file contents`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to file`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=Ko(n),a=await z(i,r,e);a=await B(a);let o=await a.read(t);n.json?$n({path:t,content:o}):console.log(o)}catch(e){Qn(e,n.json)}}),Go(e.command(`rm`).description(`Delete a file or directory`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to delete`).option(`-r, --recursive`,`Delete directories recursively`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=Ko(n),a=await z(i,r,e);a=await B(a),await a.fs.delete(t,{recursive:n.recursive}),n.json?$n({success:!0,path:t,deleted:!0}):console.log(`✓ Deleted: ${t}`)}catch(e){Qn(e,n.json)}}),Go(e.command(`mkdir`).description(`Create a directory`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Directory path to create`).option(`-p, --parents`,`Create parent directories as needed`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=Ko(n),a=await z(i,r,e);a=await B(a),await a.fs.mkdir(t,{recursive:n.parents}),n.json?$n({success:!0,path:t,created:!0}):console.log(`✓ Created: ${t}`)}catch(e){Qn(e,n.json)}}),Go(e.command(`exists`).description(`Check if a path exists`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to check`).option(`--json`,`Output as JSON`)).action(async(e,t,n)=>{try{let{context:r,client:i}=Ko(n),a=await z(i,r,e);a=await B(a);let o=await a.fs.exists(t);n.json?$n({path:t,exists:o}):(console.log(o?`exists`:`not found`),process.exit(+!o))}catch(e){Qn(e,n.json)}}),e}function Uo(e){let t=[`r`,`w`,`x`],n=``;for(let r=2;r>=0;r--){let i=r*3;for(let r=0;r<3;r++)n+=e>>i+(2-r)&1?t[r]:`-`}return n}function Wo(e){let t=[`B`,`KB`,`MB`,`GB`,`TB`],n=e,r=0;for(;n>=1024&&r<t.length-1;)n/=1024,r++;return r===0?`${n}${t[r]}`:`${n.toFixed(1)}${t[r]}`}function Go(e){return e.option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`)}function Ko(e){let t=D({apiKey:e.apiKey,baseUrl:e.baseUrl});return{context:t,client:O(t)}}function qo(){let e=new t(`git`).description(`Git operations in a sandbox workspace`);return e.command(`status`).description(`Show git repository status`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Fetching status...`);t.json||i.start();let a=await z(r,n,e);a=await B(a);let o=await a.git.status();if(i.stop(),t.json)A(o);else if(!o.isRepo)console.log(`No git repository in the sandbox workspace.`);else{if(console.log(`Branch:    ${o.branch??`unknown`}`),console.log(`HEAD:      ${o.head.slice(0,7)||`(no commits)`}`),console.log(`Dirty:     ${o.isDirty?`yes`:`no`}`),o.ahead&&console.log(`Ahead:     ${o.ahead}`),o.behind&&console.log(`Behind:    ${o.behind}`),o.staged.length>0){console.log(`\nStaged (${o.staged.length}):`);for(let e of o.staged)console.log(`  + ${e}`)}if(o.modified.length>0){console.log(`\nModified (${o.modified.length}):`);for(let e of o.modified)console.log(`  M ${e}`)}if(o.untracked.length>0){console.log(`\nUntracked (${o.untracked.length}):`);for(let e of o.untracked)console.log(`  ? ${e}`)}}}catch(e){L(e)}}),e.command(`log`).description(`Show commit log`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`-n, --limit <count>`,`Max commits to show`,`10`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Fetching log...`);t.json||i.start();let a=await z(r,n,e);a=await B(a);let o=await a.git.log(Number.parseInt(t.limit,10));if(i.stop(),t.json)A(o);else if(o.length===0)console.log(`No commits found`);else for(let e of o)console.log(`${e.shortSha} ${e.message.split(`
+`)[0]} (${e.author}, ${e.date.toLocaleDateString()})`)}catch(e){L(e)}}),e.command(`diff`).description(`Show diff`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--ref <ref>`,`Ref to diff against`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Fetching diff...`);t.json||i.start();let a=await z(r,n,e);a=await B(a);let o=await a.git.diff(t.ref);i.stop(),t.json?A(o):o.raw?console.log(o.raw):console.log(`${o.additions} additions, ${o.deletions} deletions across ${o.files.length} files`)}catch(e){L(e)}}),e.command(`add`).description(`Stage files`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<paths...>`,`Paths to stage`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=await z(O(r),r,e);i=await B(i),await i.git.add(t),j(`Staged: ${t.join(`, `)}`)}catch(e){L(e)}}),e.command(`commit`).description(`Create a commit`).argument(`<id-or-name>`,`Sandbox ID or name`).requiredOption(`-m, --message <msg>`,`Commit message`).option(`--amend`,`Amend the previous commit`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=await z(O(n),n,e);r=await B(r);let i=await r.git.commit(t.message,{amend:t.amend});t.json?A(i):j(`Committed: ${i.shortSha} ${i.message}`)}catch(e){L(e)}}),e.command(`push`).description(`Push to remote`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--force`,`Force push`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Pushing...`);i.start();let a=await z(r,n,e);a=await B(a),await a.git.push({force:t.force}),i.stop(),j(`Pushed to remote`)}catch(e){L(e)}}),e.command(`pull`).description(`Pull from remote`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--rebase`,`Rebase instead of merge`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Pulling...`);i.start();let a=await z(r,n,e);a=await B(a),await a.git.pull({rebase:t.rebase}),i.stop(),j(`Pulled from remote`)}catch(e){L(e)}}),e.command(`branches`).description(`List branches`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Fetching branches...`);t.json||i.start();let a=await z(r,n,e);a=await B(a);let o=await a.git.branches();i.stop(),t.json?A(o):o.length===0?console.log(`No branches found`):I([`Name`,`Current`,`Remote`],o.map(e=>[e.name,e.current?`* `:`  `,e.upstream??`-`]))}catch(e){L(e)}}),e.command(`checkout`).description(`Checkout a branch or ref`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<ref>`,`Branch name or ref`).option(`-b, --create`,`Create a new branch`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=await z(O(r),r,e);i=await B(i),await i.git.checkout(t,{create:n.create}),j(`Checked out: ${t}${n.create?` (new)`:``}`)}catch(e){L(e)}}),e}function Jo(){let e=new t(`hub`).description(`Discover and run Tangle Hub tools`);e.option(`--json`,`Output as JSON`),e.hook(`preAction`,(e,t)=>{Xo(t)}),e.command(`connect`).description(`Connect a provider account`).argument(`provider`,`Provider to connect`).option(`--no-browser`,`Print the authorization URL instead of opening it`).option(`--parameter <key=value>`,`Provider-specific OAuth value. Repeatable.`,fs,[]).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=ps(t.parameter),r=await(await R(t)).connections.start(e,{cli:!0,connectionParameters:n});if(t.json){A(hs(r));return}ms(r,t.browser===!1?!1:await ai(r.redirectUrl))}catch(e){G(e,t)}});let n=new t(`connections`).description(`List Hub provider connections`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await(await R(e)).connections.list();if(e.json){A(t);return}ds(t.connections)}catch(t){G(t,e)}});n.command(`revoke <connection-id>`).description(`Revoke a Hub provider connection`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await R(t),r=await Ln(n,e);if(!t.force&&!await Pr(`Revoke Hub connection ${r}? `)){N(`Revoke cancelled.`);return}let i=await n.connections.revoke(r);if(t.json){A(i);return}N(`Revoked Hub connection ${i.connection.id}.`)}catch(e){G(e,t)}}),e.addCommand(n);let r=new t(`permissions`).description(`Manage Hub action permissions`);r.command(`list`).description(`List Hub permissions for a connection`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{if(!e.connection)throw Error(`--connection is required.`);let t=await R(e),n=await Ln(t,e.connection),r=await t.permissions.list(n);if(e.json){A(r);return}os(r.policies)}catch(t){G(t,e)}}),r.command(`set`).description(`Set Hub permission for one action`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).requiredOption(`--action <path>`,`Executor action path`).requiredOption(`--decision <allow|ask|deny>`,`Permission decision`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{if(!e.connection)throw Error(`--connection is required.`);if(!e.action)throw Error(`--action is required.`);let t=ss(e.decision),n=await R(e),r=await Ln(n,e.connection),i=await n.permissions.set({connectionId:r,actionPath:e.action,decision:t});if(e.json){A(i);return}os([i.policy])}catch(t){G(t,e)}}),r.command(`revert-writes`).description("Revoke a bulk `--allow-writes` grant for a connection (deletes only the auto-granted write rows; manual permissions are untouched)").requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{if(!e.connection)throw Error(`--connection is required.`);let t=await R(e),n=await Ln(t,e.connection),r=await t.permissions.revertWrites(n);if(e.json){A(r);return}N(`Reverted ${r.reverted} write permission${r.reverted===1?``:`s`} for connection ${r.connectionId}.`)}catch(t){G(t,e)}}),e.addCommand(r);let i=new t(`approvals`).description(`List and resolve Hub execution approvals`);i.command(`list`).description(`List pending Hub execution approvals`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await(await R(e)).approvals.list();if(e.json){A(t);return}ts(t.approvals)}catch(t){G(t,e)}}),i.command(`approve`).description(`Approve a pending Hub execution approval`).argument(`approval-id`,`Hub approval ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{es(e),ns(await(await R(t)).approvals.approve(e),t.json===!0)}catch(e){G(e,t)}}),i.command(`deny`).description(`Deny a pending Hub execution approval`).argument(`approval-id`,`Hub approval ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{es(e),ns(await(await R(t)).approvals.deny(e),t.json===!0)}catch(e){G(e,t)}}),e.addCommand(i);let a=new t(`tools`).description(`Discover Hub tools`);return a.command(`sources`).description(`List Hub tool sources`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await(await R(e)).tools.sources();if(e.json){A(t);return}cs(t.sources)}catch(t){G(t,e)}}),a.command(`describe`).description(`Describe a Hub tool`).argument(`path`,`Executor tool path`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await(await R(t)).tools.describe(e);if(t.json){A(n);return}ls(n.tool)}catch(e){G(e,t)}}),a.command(`search`).description(`Search Hub tools`).argument(`<query...>`,`Search query`).option(`--provider <provider>`,`Filter by provider/source ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await(await R(t)).tools.search(e.join(` `),{provider:t.provider});if(t.json){A(n);return}as(n.tools)}catch(e){G(e,t)}}),e.addCommand(a),e.addCommand(Yo(`call`)),e.addCommand(Yo(`exec`)),e.command(`resume`).description(`Resolve a Hub approval created by a paused execution`).argument(`approval-id`,`Hub approval ID from HUB_APPROVAL_REQUIRED`).option(`--accept`,`Approve the execution approval`).option(`--decline`,`Deny the execution approval`).option(`--cancel`,`Unsupported for approval-backed Hub resume`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{if(es(e),t.cancel)throw Error(`Hub approval resume does not support --cancel. Use --decline to deny the approval.`);if(t.accept&&t.decline)throw Error(`Choose only one of --accept or --decline.`);if(!t.accept&&!t.decline)throw Error(`Choose --accept to approve or --decline to deny the Hub approval.`);let n=await R(t);ns(t.decline?await n.approvals.deny(e):await n.approvals.approve(e),t.json===!0)}catch(e){G(e,t)}}),e.command(`status`).description(`Show Hub auth and connection status`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await(await R(e)).status();if(e.json){A(t);return}gs(t)}catch(t){G(t,e)}}),e}function Yo(e){return new t(e).description(`Execute a Hub tool`).argument(`<args...>`,`Tool path tokens followed by JSON input`).option(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--auto-approve`,`Approve a HUB_APPROVAL_REQUIRED execution and retry once`).option(`--approve`,`Alias for --auto-approve`).option(`--no-hub-key`,`Do not auto-mint a platform Hub key; use the stored credential as-is`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let{args:n,approve:r}=$o(e,t),{path:i,input:a}=is(n),o=await R(t),s=t.connection?await Ln(o,t.connection):void 0;A((await o.tools.invoke(i,a,{connectionId:s,approve:r})).result)}catch(e){G(e,t)}})}function Xo(e){if(!Zo(e,`json`)||e.getOptionValue(`json`)!==void 0)return;let t=e.parent;for(;t;){let n=t.getOptionValue(`json`);if(n!==void 0){e.setOptionValue(`json`,n);return}t=t.parent}}function Zo(e,t){return e.options.some(e=>e.attributeName()===t)}function Qo(e){return e.json===!0}function G(e,t){return Qo(t)?L(e,!0):L(e)}function $o(e,t){let n=t.autoApprove;return{args:e.filter(e=>e!==`--approve`&&e!==`--auto-approve`),approve:t.approve===!0||n===!0||e.includes(`--approve`)||e.includes(`--auto-approve`)}}function es(e){if(!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`Hub approval ID must contain only letters, numbers, underscores, and dashes.`)}function ts(e){k(e.map(e=>({id:e.id,provider:e.providerId,action:e.actionPath,connection:e.connectionId,status:e.status,expires:e.expiresAt})),[{key:`id`,header:`ID`},{key:`provider`,header:`Provider`},{key:`action`,header:`Action`},{key:`connection`,header:`Connection`},{key:`status`,header:`Status`},{key:`expires`,header:`Expires`}])}function ns(e,t){if(t){A(rs(e));return}N(`Hub approval ${e.approval.id} ${e.approval.status}.`),e.capabilityToken&&N("Capability token minted. Re-run the original command with `--approve` to execute automatically.")}function rs(e){return{approval:e.approval,...e.capabilityToken?{capabilityToken:{tokenId:e.capabilityToken.tokenId,expiresAt:e.capabilityToken.expiresAt}}:{}}}function is(e){if(e.length<2)throw Error(`Usage: tangle hub call <path> <json-input>`);let t=e.at(-1);if(t===void 0)throw Error(`Usage: tangle hub call <path> <json-input>`);try{return{path:e.slice(0,-1).join(`.`),input:JSON.parse(t)}}catch{throw Error(`Hub call input must be valid JSON.`)}}function as(e){k(e.map(e=>({path:e.path,provider:e.providerId??e.requiredConnectionProviderId,title:e.title,description:e.description,connection:us(e),policy:e.policyState})),[{key:`path`,header:`Path`},{key:`provider`,header:`Provider`},{key:`title`,header:`Title`},{key:`description`,header:`Description`},{key:`connection`,header:`Connection`},{key:`policy`,header:`Policy`}])}function os(e){k(e.map(e=>({connection:e.connectionId,provider:e.providerId,action:e.actionPath,decision:e.decision,updated:e.updatedAt})),[{key:`connection`,header:`Connection`},{key:`provider`,header:`Provider`},{key:`action`,header:`Action`},{key:`decision`,header:`Decision`},{key:`updated`,header:`Updated`}])}function ss(e){if(e===`allow`||e===`ask`||e===`deny`)return e;throw Error(`--decision must be one of: allow, ask, deny.`)}function cs(e){k(e.map(e=>({source:e.sourceId,provider:e.displayName,tools:e.toolCount,connection:e.connectionStatus,health:e.health,configured:e.configured})),[{key:`source`,header:`Source`},{key:`provider`,header:`Provider`},{key:`tools`,header:`Tools`},{key:`connection`,header:`Connection`},{key:`health`,header:`Health`},{key:`configured`,header:`Configured`}])}function ls(e){F({Path:e.path,Provider:e.providerId??e.requiredConnectionProviderId,Title:e.title,Description:e.description,Connection:us(e),Policy:e.policyState}),e.inputSchema!==void 0&&(N(`Input schema`),console.log(JSON.stringify(e.inputSchema,null,2))),e.outputSchema!==void 0&&(N(`Output schema`),console.log(JSON.stringify(e.outputSchema,null,2)))}function us(e){if(e.connectionRequired===!1)return`not required`;if(e.connectionStatus)return e.connectionStatus}function ds(e){k(e.map(e=>({id:e.id,provider:e.providerId,account:e.accountDisplay??e.displayName,scopes:e.scopes.join(`, `),status:e.status,health:e.health,lastUsed:e.lastUsedAt})),[{key:`id`,header:`ID`},{key:`provider`,header:`Provider`},{key:`account`,header:`Account`},{key:`scopes`,header:`Scopes`},{key:`status`,header:`Status`},{key:`health`,header:`Health`},{key:`lastUsed`,header:`Last Used`}])}function fs(e,t){return[...t,e]}function ps(e){if(!e||e.length===0)return;let t={};for(let n of e){let e=n.indexOf(`=`);if(e<=0||e===n.length-1)throw Error(`Invalid --parameter "${n}": expected key=value (for example subdomain=acme)`);let r=n.slice(0,e);if(Object.hasOwn(t,r))throw Error(`Duplicate --parameter key "${r}".`);t[r]=n.slice(e+1)}return t}function ms(e,t){t?N(`Opened browser to connect ${e.provider}.`):(N(`Open this URL to connect ${e.provider}:`),console.log(e.redirectUrl)),N("Finish authorization in the browser, then rerun `tangle hub status`.")}function hs(e){return{provider:e.provider,redirectUrl:e.redirectUrl,expiresAt:e.expiresAt,scopes:e.scopes,cli:e.cli}}function gs(e){let{principal:t,connections:n}=e;N(`Hub status`),F({Principal:t.kind,"User ID":t.userId,"API Key ID":t.apiKeyId,"Sandbox ID":t.sandboxId,"Connected Providers":n.connectedProviderCount,"Unhealthy Providers":n.unhealthyProviderCount}),n.unhealthyProviderCount>0&&N(`Some providers require reconnect.`)}function _s(){let e=new t(`intelligence`).description(`Create and inspect trace intelligence reports`);return e.command(`connect [agent]`).alias(`connect-agent`).description(`Connect local agent CLIs to Tangle Intelligence`).option(`--api-key <key>`,`Intelligence ingest API key`).option(`--endpoint <url>`,`OTLP endpoint base`,Li).option(`--workspace <path>`,`Workspace to write hook files into`,`.`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`,`local`).option(`--dry-run`,`Print planned writes without changing files`).option(`--hook-command <command>`,`Command native hooks should run`,`tangle intelligence hook`).option(`--no-smoke`,`Skip the install smoke trace`).option(`--json`,`Output as JSON`).action(async(e,t)=>{try{let n=e??`local`;Hi(n);let r=ys(t.apiKey),i=await qi({selection:n,workspace:t.workspace,apiKey:r,endpoint:t.endpoint,serviceName:t.serviceName??Wi(t.workspace),environment:t.environment,smoke:t.smoke,dryRun:!!t.dryRun,hookCommand:t.hookCommand}),a={configPath:i.configPath,agents:i.agents,nativeAgents:i.nativeAgents,manual:i.manual,written:i.written,smokeTraceId:i.smokeTraceId};if(t.json){A(a);return}F({Config:i.configPath,Agents:i.agents.join(`, `),"Native Hooks":i.nativeAgents.join(`, `)||void 0,"Manual Setup":i.manual.length?i.manual.map(e=>`${e.label}: ${e.reason}`).join(` `):void 0,Files:i.written.join(`, `),"Smoke Trace":i.smokeTraceId})}catch(e){L(e)}}),e.command(`doctor`).description(`Check whether your agent traces carry CONTENT or are metadata-only`).option(`--api-key <key>`,`Intelligence ingest API key`).option(`--endpoint <url>`,`OTLP endpoint base`,Li).option(`--json`,`Output as JSON`).action(async e=>{try{let t=Ki(),n=await Qi({endpoint:e.endpoint===`https://intelligence.tangle.tools/v1/otlp`?t?.endpoint??`https://intelligence.tangle.tools/v1/otlp`:e.endpoint,apiKey:ys(e.apiKey??t?.apiKey)});e.json?A(n):vs(n),n.contentSeen||(process.exitCode=1)}catch(e){L(e)}}),e.command(`hook`).description(`Emit one local agent hook event to Tangle Intelligence`).requiredOption(`--agent <agent>`,`Agent surface`).requiredOption(`--event <event>`,`Hook event name`).option(`--payload <json>`,`Hook payload JSON`).option(`--api-key <key>`,`Intelligence ingest API key`).option(`--endpoint <url>`,`OTLP endpoint base`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`).option(`--session-id <id>`,`Session id override`).option(`--dry-run`,`Build the OTLP request without sending it`).option(`--non-blocking`,`Do not fail the parent agent process`).option(`--json`,`Output as JSON`).action(async e=>{try{let t=bs(e.agent),n=Ki(),r={agent:t,event:e.event,endpoint:e.endpoint??n?.endpoint??`https://intelligence.tangle.tools/v1/otlp`,apiKey:ys(e.apiKey??n?.apiKey),serviceName:e.serviceName??n?.serviceName??Wi(process.cwd()),environment:e.environment??n?.environment??`local`,sessionId:e.sessionId,payload:e.payload===void 0?await Ss():xs(e.payload)};if(e.dryRun){let n=Yi(r);if(e.json){A(n);return}F({Trace:n.traceId,Agent:t,Event:e.event});return}let i=await Xi(r);if(e.json){A({traceId:i});return}F({Trace:i,Agent:t,Event:e.event})}catch(t){if(e.nonBlocking){let n=t instanceof Error?t.message:String(t);e.json?A({ok:!1,error:n}):console.error(`Tangle Intelligence hook skipped: ${n}`);return}L(t)}}),e.command(`sandbox <sandbox-id>`).description(`Create an intelligence report for one sandbox`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{await Cs({type:`sandbox`,id:e},t)}),e.command(`fleet <fleet-id>`).description(`Create an intelligence report for a sandbox fleet`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{await Cs({type:`fleet`,id:e},t)}),e.command(`create`).description(`Create a trace intelligence report`).requiredOption(`--subject-type <type>`,`sandbox | fleet`).requiredOption(`--subject-id <id>`,`Subject identifier`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{await Cs({type:Ts(e.subjectType),id:e.subjectId},e)}),e.command(`get <job-id>`).description(`Get an intelligence report`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=O(D({apiKey:t.apiKey,baseUrl:t.baseUrl})),r=t.json?null:P(`Fetching intelligence report...`);r?.start();let i=await n.intelligence.getReport(e);if(r?.stop(),t.json){A(i);return}ws(i)}catch(e){L(e)}}),e.command(`list`).description(`List intelligence reports`).option(`--subject-type <type>`,`sandbox | fleet`).option(`--subject-id <id>`,`Subject identifier`).option(`--limit <count>`,`Maximum reports to return`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=O(D({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=e.json?null:P(`Fetching intelligence reports...`);n?.start();let r=await t.intelligence.listReports({subjectType:e.subjectType===void 0?void 0:Ts(e.subjectType),subjectId:e.subjectId,limit:e.limit===void 0?void 0:Os(e.limit)});if(n?.stop(),e.json){A(r);return}k(r.map(e=>({jobId:e.jobId,subject:`${e.subject.type}:${e.subject.id}`,mode:e.mode,status:e.status,cost:`$${e.billing.costUsd.toFixed(2)}`,updatedAt:e.updatedAt})),[{key:`jobId`,header:`Job`,width:20},{key:`subject`,header:`Subject`,width:28},{key:`mode`,header:`Mode`,width:15},{key:`status`,header:`Status`,width:14},{key:`cost`,header:`Cost`,width:10},{key:`updatedAt`,header:`Updated`,width:18}])}catch(e){L(e)}}),e}function vs(e){F({Status:e.contentSeen?`content flowing`:e.tracesSeen?`metadata-only — a content gate is missing`:`no traces yet`,"Traces seen":e.tracesSeen?`yes`:`no`,"Content seen":e.contentSeen?`yes`:`no`,"Last seen":e.lastSeenAt??`never`,Window:`${e.windowDays}d`});let t=Object.entries(e.byAgent);t.length>0&&(console.log(),k(t.map(([e,t])=>({agent:e,traces:t.tracesSeen?`yes`:`no`,content:t.contentSeen?`yes`:`no`})),[{key:`agent`,header:`Agent`,width:18},{key:`traces`,header:`Traces`,width:10},{key:`content`,header:`Content`,width:10}]))}function ys(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??process.env.TANGLE_API_KEY;if(!t)throw Error(`--api-key, TANGLE_INTELLIGENCE_API_KEY, or TANGLE_API_KEY is required`);return t}function bs(e){if(Ui(e))return e;throw Error(`agent must be a known Tangle Intelligence agent surface`)}function xs(e){try{return JSON.parse(e)}catch(e){throw Error(`--payload must be JSON: ${e instanceof Error?e.message:String(e)}`)}}async function Ss(){if(process.stdin.isTTY)return;let e=``;for await(let t of process.stdin)if(e+=typeof t==`string`?t:t.toString(`utf8`),e.length>65536)throw Error(`hook payload exceeds 65536 bytes`);let t=e.trim();if(t)try{return JSON.parse(t)}catch{return{body:t.slice(0,4096)}}}async function Cs(e,t){try{let n=Es(t.mode),r=ks(t.metadata),i=t.maxUsd===void 0?void 0:Ds(t.maxUsd);if(n===`agentic`&&i===void 0)throw Error(`Agentic intelligence reports require --max-usd`);let a=O(D({apiKey:t.apiKey,baseUrl:t.baseUrl})),o=t.json?null:P(`Creating intelligence report...`);o?.start();let s=await a.intelligence.createReport({subject:e,mode:n,...i===void 0?{}:{budget:{billTo:`customer`,maxUsd:i}},...r===void 0?{}:{metadata:r}});if(o?.stop(),t.json){A(s);return}ws(s)}catch(e){L(e)}}function ws(e){F({Job:e.jobId,Subject:`${e.subject.type}:${e.subject.id}`,Mode:e.mode,Status:e.status,"Billed To":e.billing.billedTo,Cost:`$${e.billing.costUsd.toFixed(2)}`,Budget:e.billing.budgetMaxUsd===void 0?void 0:`$${e.billing.budgetMaxUsd.toFixed(2)}`,Updated:e.updatedAt}),e.result!==null&&(console.log(),A(e.result))}function Ts(e){if(e===`sandbox`||e===`fleet`)return e;throw Error(`subject type must be sandbox or fleet`)}function Es(e){if(e===`deterministic`||e===`agentic`)return e;throw Error(`mode must be deterministic or agentic`)}function Ds(e){let t=Number(e);if(!Number.isFinite(t)||t<0)throw Error(`--max-usd must be a non-negative number`);return t}function Os(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function ks(e){if(e===void 0)return;let t=JSON.parse(e);if(!t||typeof t!=`object`||Array.isArray(t))throw Error(`--metadata must be a JSON object`);return t}const As=[`router`,`sandbox`,`blueprint-agent`,`evals`,`agent-builder`];function js(e){if(e.minted)throw Error("This command needs a key you minted yourself. A browser login is exchanged for a short-lived key the platform will not accept for key management. Set TANGLE_API_KEY, run `tangle auth login --api-key sk-tan-…`, or mint the key in the web console. `tangle keys list` works from the login alone.")}async function Ms(e,t,n={}){let r=new Headers(n.headers);n.body&&!r.has(`content-type`)&&r.set(`content-type`,`application/json`);let i=await yr(e,t,{...n,headers:r});if(n.expected!==void 0&&i.status!==n.expected)throw Error(await Ns(i,t));return i}async function Ns(e,t){let n=await e.text().catch(()=>``),r;try{let e=JSON.parse(n),t=typeof e?.error==`string`?e.error:e?.error?.message;typeof t==`string`&&t.trim()&&(r=t)}catch{}if(r)return`${r} (HTTP ${e.status})`;let i=n?`: ${n.slice(0,400)}`:``;return`Platform request to ${t} returned ${e.status}${i}`}const Ps=[`ID`,`Prefix`,`Name`,`Product`,`Created`,`Last used`,`Expires`];function Fs(e){return[e.id,e.keyPrefix??``,e.name,e.product??`all`,e.createdAt,e.lastUsedAt??`—`,e.expiresAt??`—`]}function Is(){let e=new t(`keys`).description(`Manage sk-tan-* API keys on id.tangle.tools`);return e.command(`list`).description(`List your active API keys`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key (overrides configured credentials)`).option(`--base-url <url>`,`Sandbox API base URL (not platform URL)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async e=>{try{let t=await vr({...e.apiKey===void 0?{}:{apiKey:e.apiKey},...e.platformUrl===void 0?{}:{baseUrl:e.platformUrl},...e.baseUrl===void 0?{}:{sandboxBaseUrl:e.baseUrl}}),n=t.baseUrl,r=await(await Ms(t,`${n}/v1/keys`,{expected:200})).json();if(e.json){A(r);return}I(Ps,r.data.map(Fs))}catch(e){L(e)}}),e.command(`create`).description(`Create a new API key`).argument(`<name>`,`Human-readable name for the key`).option(`--product <product>`,`Restrict the key to one product (${As.join(`|`)}). Omit for all products.`).option(`--budget-usd <amount>`,`Hard budget cap in USD`).option(`--rpm-limit <limit>`,`Requests-per-minute cap`).option(`--expires-in-days <days>`,`Expire the key after N days (integer)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key (overrides configured credentials)`).option(`--base-url <url>`,`Sandbox API base URL (not platform URL)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(e,t)=>{try{if(t.product!==void 0&&!As.includes(t.product))throw Error(`Invalid --product. Expected one of ${As.join(`, `)}`);let n=await vr({...t.apiKey===void 0?{}:{apiKey:t.apiKey},...t.platformUrl===void 0?{}:{baseUrl:t.platformUrl},...t.baseUrl===void 0?{}:{sandboxBaseUrl:t.baseUrl}});js(n);let r=n.baseUrl,i=t.expiresInDays===void 0?void 0:new Date(Date.now()+Number.parseInt(t.expiresInDays,10)*24*60*60*1e3).toISOString(),a=P(`Creating API key...`);a.start();let o=await Ms(n,`${r}/v1/keys`,{method:`POST`,expected:201,body:JSON.stringify({name:e,product:t.product,budgetUsd:t.budgetUsd?Number.parseFloat(t.budgetUsd):void 0,rpmLimit:t.rpmLimit?Number.parseInt(t.rpmLimit,10):void 0,expiresAt:i})});a.stop();let s=await o.json();if(t.json){A(s);return}j(`API key created: ${s.data.prefix}…`),N(`Copy this key now — it will never be shown again:\n${s.data.key}`)}catch(e){L(e)}}),e.command(`revoke`).description(`Revoke an API key`).argument(`<keyId>`,"Key ID (from `tcloud keys list`)").option(`--yes`,`Skip the confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key (overrides configured credentials)`).option(`--base-url <url>`,`Sandbox API base URL (not platform URL)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(e,t)=>{try{let n=await vr({...t.apiKey===void 0?{}:{apiKey:t.apiKey},...t.platformUrl===void 0?{}:{baseUrl:t.platformUrl},...t.baseUrl===void 0?{}:{sandboxBaseUrl:t.baseUrl}});js(n);let r=n.baseUrl;if(!t.yes&&!await Pr(`Revoke key ${e}? Any service still using it will start to fail.`)){N(`Aborted.`);return}let i=await(await Ms(n,`${r}/v1/keys/${encodeURIComponent(e)}`,{method:`DELETE`,expected:200})).json();if(t.json){A(i);return}j(`Revoked ${e}`)}catch(e){L(e)}}),e}function Ls(){let e=new t(`mcp`).description(`Model Context Protocol bridge commands.`);return e.command(`serve <id-or-name>`).description(`Run a local MCP server (stdio) backed by the given sandbox (ID or name). Pipe its stdio from an MCP client config to expose sandbox tools.`).option(`-s, --session <id>`,`Session id for kernel scoping`,`mcp-local`).option(`--name <name>`,`MCP server name reported to clients`,`tangle-sandbox`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=await z(O(n),n,e),i;try{i=(await import(`@modelcontextprotocol/sdk/server/stdio.js`)).StdioServerTransport}catch{throw Error("`@modelcontextprotocol/sdk` is not installed in this environment. Install it with: pnpm add -g @modelcontextprotocol/sdk (or as a dev dep in the project running this command).")}let{connect:a,close:o}=await Ne(r,{sessionId:t.session,name:t.name});await a(new i),process.stdin.resume(),process.stdin.on(`end`,()=>{o().finally(()=>process.exit(0))});for(let e of[`SIGINT`,`SIGTERM`])process.on(e,()=>{o().finally(()=>process.exit(0))})}catch(e){L(e)}}),e}function Rs(){let e=new t(`permissions`).description(`Manage sandbox user permissions`);return e.command(`list <sandboxId-or-name>`).description(`List all users in a sandbox`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Fetching users...`);i.start();let a=await(await z(r,n,e)).permissions.list();i.stop(),t.json?A(a):k(a.map(e=>({userId:e.userId,username:e.username,role:e.role,homeDir:e.homeDir,createdAt:e.createdAt.toISOString().split(`T`)[0]})),[{key:`userId`,header:`User ID`,width:20},{key:`username`,header:`Username`,width:16},{key:`role`,header:`Role`,width:12},{key:`homeDir`,header:`Home Directory`,width:24},{key:`createdAt`,header:`Created`,width:16}])}catch(e){L(e)}}),e.command(`get <sandboxId-or-name> <userId>`).description(`Get details for a specific user`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=O(r),a=P(`Fetching user...`);a.start();let o=await(await z(i,r,e)).permissions.get(t);if(a.stop(),!o)throw Error(`User ${t} not found in sandbox ${e}`);n.json?A(o):(N(`User: ${o.userId}`),N(`  Username: ${o.username}`),N(`  Role: ${o.role}`),N(`  Home: ${o.homeDir}`),N(`  SSH Keys: ${o.sshKeys.length}`),N(`  Created: ${o.createdAt.toISOString()}`))}catch(e){L(e)}}),e.command(`add <sandboxId-or-name>`).description(`Add a user to a sandbox`).requiredOption(`--user-id <id>`,`User ID (from your auth system)`).option(`--username <name>`,`Preferred username`).option(`--role <role>`,`Permission level (owner, admin, developer, viewer)`,`developer`).option(`--ssh-key <key>`,`SSH public key for access`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Adding user...`);i.start();let a=await(await z(r,n,e)).permissions.add({userId:t.userId,username:t.username,role:t.role,sshKeys:t.sshKey?[t.sshKey]:void 0});i.stop(),t.json?A(a):(j(`User ${a.userId} added as ${a.role}`),N(`  Username: ${a.username}`),N(`  Home: ${a.homeDir}`))}catch(e){L(e)}}),e.command(`update <sandboxId-or-name> <userId>`).description(`Update a user's permissions`).option(`--role <role>`,`New permission level (owner, admin, developer, viewer)`).option(`--add-ssh-key <key>`,`Add SSH public key`).option(`--remove-ssh-key <key>`,`Remove SSH public key`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=O(r),a=P(`Updating user...`);a.start();let o=await(await z(i,r,e)).permissions.update(t,{role:n.role,addSshKeys:n.addSshKey?[n.addSshKey]:void 0,removeSshKeys:n.removeSshKey?[n.removeSshKey]:void 0});a.stop(),n.json?A(o):(j(`User ${t} updated`),N(`  Role: ${o.role}`),N(`  SSH Keys: ${o.sshKeys.length}`))}catch(e){L(e)}}),e.command(`remove <sandboxId-or-name> <userId>`).description(`Remove a user from a sandbox`).option(`--preserve-home`,`Keep user's home directory`).option(`-f, --force`,`Skip confirmation`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{if(!n.force){let e=(await import(`node:readline`)).createInterface({input:process.stdin,output:process.stdout});if(!await new Promise(n=>{e.question(`Remove user ${t} from sandbox? [y/N] `,t=>{e.close(),n(t.toLowerCase()===`y`)})})){N(`Cancelled.`);return}}let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=O(r),a=P(`Removing user...`);a.start(),await(await z(i,r,e)).permissions.remove(t,{preserveHomeDir:n.preserveHome}),a.stop(),j(`User ${t} removed from sandbox ${e}`)}catch(e){L(e)}}),e.command(`policies <sandboxId-or-name> <userId>`).description(`Get access policies for a user`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=O(r),a=P(`Fetching policies...`);a.start();let o=await(await z(i,r,e)).permissions.getAccessPolicies(t);a.stop(),n.json?A(o):o.length===0?N(`No access policies configured`):k(o.map(e=>({pattern:e.pattern,permission:e.permission,priority:e.priority??0})),[{key:`pattern`,header:`Pattern`,width:30},{key:`permission`,header:`Permission`,width:12},{key:`priority`,header:`Priority`,width:10}])}catch(e){L(e)}}),e.command(`check <sandboxId-or-name> <userId> <path> <action>`).description(`Check if a user can perform an action on a path`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r,i)=>{try{if(![`read`,`write`,`execute`].includes(r))throw Error(`Action must be: read, write, or execute`);let a=D({apiKey:i.apiKey,baseUrl:i.baseUrl}),o=O(a),s=P(`Checking access...`);s.start();let c=await(await z(o,a,e)).permissions.checkAccess(t,n,r);s.stop(),c?j(`✓ User ${t} CAN ${r} ${n}`):N(`✗ User ${t} CANNOT ${r} ${n}`)}catch(e){L(e)}}),e}function zs(){let e=new t(`preview`).description(`Manage sandbox preview links`);return e.command(`list`).alias(`ls`).description(`List active preview links for a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Fetching preview links...`);t.json||i.start();let a=await(await z(r,n,e)).previewLinks.list();i.stop(),t.json?A(a):a.length===0?console.log(`No preview links found`):I([`Preview ID`,`Port`,`URL`,`Status`],a.map(e=>[e.previewId.slice(0,12),String(e.port),e.url,e.status]))}catch(e){L(e)}}),e.command(`create`).description(`Create a preview link for a port`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<port>`,`Port number to preview`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=O(r),a=P(`Creating preview for port ${t}...`);n.json||a.start();let o=await(await z(i,r,e)).previewLinks.create(Number.parseInt(t,10));a.stop(),n.json?A(o):(j(`Preview created: ${o.url}`),console.log(`Preview ID: ${o.previewId}`))}catch(e){L(e)}}),e.command(`remove`).alias(`rm`).description(`Remove a preview link`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<preview-id>`,`Preview link ID (from 'preview list')`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=O(r),a=P(`Removing preview...`);n.json||a.start(),await(await z(i,r,e)).previewLinks.remove(t),a.stop(),n.json?A({success:!0,previewId:t}):j(`Preview removed: ${t}`)}catch(e){L(e)}}),e}function Bs(){let e=new t(`process`).description(`Manage processes in a sandbox`);return e.command(`spawn`).description(`Spawn a process without blocking (returns PID)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command>`,`Command to execute`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`).option(`--blocking`,`Wait for completion (default: false)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=O(r),a={};if(n.env)for(let e of n.env){let[t,...n]=e.split(`=`);t&&n.length>0&&(a[t]=n.join(`=`))}let o=P(`Spawning: ${t}`);n.json||o.start();let s=await z(i,r,e);if(s=await B(s),n.blocking){let e=await s.exec(t,{cwd:n.cwd,env:Object.keys(a).length>0?a:void 0,timeoutMs:n.timeout?Number.parseInt(n.timeout,10):void 0});o.stop(),n.json?A(e):(e.stdout&&globalThis.process.stdout.write(e.stdout),e.stderr&&globalThis.process.stderr.write(e.stderr),e.exitCode!==0&&globalThis.process.exit(e.exitCode))}else{let r=await s.process.spawn(t,{cwd:n.cwd,env:Object.keys(a).length>0?a:void 0,timeoutMs:n.timeout?Number.parseInt(n.timeout,10):void 0});o.stop(),n.json?A({pid:r.pid,command:r.command}):(console.log(`Process started with PID: ${r.pid}`),console.log(`Use 'tangle process logs ${e} ${r.pid}' to view output`))}}catch(e){L(e)}}),e.command(`list`).alias(`ls`).description(`List all processes in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--running`,`Show only running processes`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Fetching processes...`);t.json||i.start();let a=await z(r,n,e);a=await B(a);let o=await a.process.list();t.running&&(o=o.filter(e=>e.running)),i.stop(),t.json?A(o):o.length===0?console.log(`No processes found`):I([`PID`,`Command`,`Status`,`Exit Code`,`Started`],o.map(e=>[String(e.pid),e.command.length>40?`${e.command.slice(0,37)}...`:e.command,e.running?`running`:`exited`,String(e.exitCode),e.startedAt.toLocaleString()]))}catch(e){L(e)}}),e.command(`get`).description(`Get detailed info about a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=O(r),a=P(`Fetching process info...`);n.json||a.start();let o=await z(i,r,e);o=await B(o);let s=await o.process.get(Number.parseInt(t,10));if(a.stop(),!s){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}let c=await s.status();n.json?A(c):(console.log(`PID:        ${c.pid}`),console.log(`Command:    ${c.command}`),console.log(`CWD:        ${c.cwd||`(default)`}`),console.log(`Status:     ${c.running?`running`:`exited`}`),console.log(`Exit Code:  ${c.exitCode}`),c.exitSignal&&console.log(`Signal:     ${c.exitSignal}`),console.log(`Started:    ${c.startedAt.toLocaleString()}`),c.exitedAt&&console.log(`Exited:     ${c.exitedAt.toLocaleString()}`))}catch(e){L(e)}}),e.command(`kill`).description(`Kill a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`-s, --signal <signal>`,`Signal to send (SIGTERM, SIGKILL, etc.)`,`SIGTERM`).option(`--tree`,`Also kill descendants of the tracked process`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=O(r),a=P(`Sending ${n.signal} to PID ${t}...`);n.json||a.start();let o=await z(i,r,e);o=await B(o);let s=await o.process.get(Number.parseInt(t,10));if(!s){a.stop(),console.error(`Process ${t} not found`),globalThis.process.exit(1);return}n.tree?await s.kill(n.signal,{tree:!0}):await s.kill(n.signal),a.stop(),n.json?A({pid:Number.parseInt(t,10),signal:n.signal,...n.tree===!0?{tree:!0}:{},killed:!0}):console.log(n.tree?`Sent ${n.signal} to process tree ${t}`:`Sent ${n.signal} to process ${t}`)}catch(e){L(e)}}),e.command(`logs`).description(`Stream buffered and live process logs until the process exits`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`--stdout-only`,`Only show stdout`).option(`--stderr-only`,`Only show stderr`).option(`--json`,`Output as JSON lines`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=await z(O(r),r,e);i=await B(i);let a=await i.process.get(Number.parseInt(t,10));if(!a){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}for await(let e of a.logs())n.stdoutOnly&&e.type!==`stdout`||n.stderrOnly&&e.type!==`stderr`||(n.json?console.log(JSON.stringify(e)):e.type===`stdout`?globalThis.process.stdout.write(e.data):globalThis.process.stderr.write(e.data))}catch(e){L(e)}}),e}const Vs=[`python`,`node`,`typescript`,`bash`];function Hs(e){switch(pe(e).toLowerCase()){case`.py`:return`python`;case`.js`:case`.mjs`:case`.cjs`:return`node`;case`.ts`:case`.tsx`:return`typescript`;case`.sh`:case`.bash`:return`bash`;default:return}}async function Us(e){if(e===`-`){let e=[];for await(let t of process.stdin)e.push(typeof t==`string`?Buffer.from(t):t);return Buffer.concat(e).toString(`utf8`)}return await Pe(he(e),`utf8`)}async function Ws(e,t,n=Us){let r=t?Vs.find(e=>e===t)??(()=>{throw Error(`unknown --lang ${t}: must be one of ${Vs.join(`, `)}`)})():void 0;if(!e||e===`-`){if(!r)throw Error(`reading from stdin requires --lang. Example: tangle run <id> -l python -`);return{language:r,source:await n(`-`)}}let i=Hs(e);return{language:r??i??(()=>{throw Error(`cannot infer language from "${e}". Pass it explicitly: tangle run <id> -l <python|node|typescript|bash> ${e}`)})(),source:await n(e)}}function Gs(e){return me(ve(),`tangle-run-images`,e)}function Ks(){return new t(`run`).description(`Run code in a persistent kernel inside a sandbox. Variables persist across calls in the same --session.`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`[file]`,`Path to source file. Language is inferred from extension. Use - for stdin (requires --lang).`).option(`-l, --lang <lang>`,`Force language: ${Vs.join(` | `)}. Required for stdin.`).option(`-s, --session <id>`,`Session id for kernel scoping`).option(`-t, --timeout <ms>`,`Per-call timeout in ms (0 disables)`,`60000`).option(`--save-images <dir>`,`Write image results into this directory (default: $TMPDIR/tangle-run-images/<sandbox>/).`).option(`--no-save-images`,`Don't write image results to disk; print summary only`).option(`--json`,`Output the full CodeExecutionResult as JSON`).action(async(e,t,n)=>{try{let{language:r,source:i}=await Ws(t,n.lang),a=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),o=await z(O(a),a,e);o=await B(o);let s=P(`Running ${r} (${i.length}b)…`);n.json||s.start();let c=await o.runCode(r,i,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10)});if(s.stop(),n.json){A(c),c.exitCode!==0&&process.exit(c.exitCode);return}c.stdout&&process.stdout.write(c.stdout),c.stderr&&process.stderr.write(c.stderr);let l=0;for(let t of c.results)if(t.type===`image`)if(n.saveImages!==!1){let r=typeof n.saveImages==`string`?n.saveImages:Gs(e);ce(r,{recursive:!0});let i=`${r}/${Date.now()}-${l}.${t.format}`;ue(i,Buffer.from(t.data,`base64`)),process.stderr.write(y.green(`✓ image → ${i}\n`)),l++}else process.stderr.write(y.gray(`[image: ${t.format}, ${t.data.length}b base64]\n`));else if(t.type===`dataframe`){let e=t.columns.map(e=>`${e.name}:${e.dtype}`).join(` | `);process.stderr.write(y.gray(`[dataframe ${t.rows.length}×${t.columns.length}${t.truncated?` (truncated)`:``}]\n`)),process.stderr.write(`${e}\n`);for(let e of t.rows.slice(0,20))process.stderr.write(`${e.map(e=>String(e)).join(` | `)}\n`);t.rows.length>20&&process.stderr.write(y.gray(`… ${t.rows.length-20} more rows\n`))}else t.type===`json`?(process.stderr.write(y.gray(`[json] `)),process.stderr.write(`${JSON.stringify(t.value,null,2)}\n`)):t.type===`html`?process.stderr.write(y.gray(`[html ${t.value.length}b]\n`)):t.type===`error`?(process.stderr.write(y.red(`✗ ${t.name}: ${t.message}\n`)),t.traceback&&process.stderr.write(`${t.traceback}\n`)):t.type===`text`&&process.stderr.write(`${t.value}\n`);c.error&&(process.stderr.write(y.red(`\n✗ ${c.error.name}: ${c.error.message}\n`)),c.error.traceback&&process.stderr.write(`${c.error.traceback}\n`)),c.exitCode!==0&&process.exit(c.exitCode)}catch(e){L(e)}})}function qs(e){return`${e.name} (${e.id})`}async function Js(e,t){if(t.startsWith(`team_`))return e.teams.get(t);let n=(await e.teams.list()).filter(e=>e.name.toLowerCase()===t.toLowerCase());if(n.length===0)throw Error(`Team not found: ${t}`);if(n.length>1)throw Error(`Team name is ambiguous: ${t}. Use a team id instead.`);return n[0]}async function K(e,t,n){if(t)return Js(e,t);let r=En(n);if(!r.activeTeamId)throw Error("No active team. Run `tangle team switch <team>` or pass `--team <team>`.");return e.teams.get(r.activeTeamId)}function Ys(e,t){Dn({id:e.id,name:e.name},t)}function Xs(e){On(e)}async function Zs(e){let t=typeof e.envVarName==`string`&&e.envVarName.length>0?e.envVarName:null,n=!!e.fromStdin;if(t&&n)throw Error(`Pass either ${e.flagPrefix}-env or ${e.flagPrefix}-stdin, not both`);if(t){let n=process.env[t];if(!n||n.length===0)throw Error(`${e.flagPrefix}-env points at ${t}, but that environment variable is empty or unset`);return n}if(n){let t=await Ir();if(t.length===0)throw Error(`${e.flagPrefix}-stdin received empty input on stdin`);return t}}function Qs(e,t){let n={};return e.cpu!==void 0&&(n.cpuCores=W(e.cpu,`--cpu`)),e.memory!==void 0&&(n.memoryMB=W(e.memory,`--memory`)),e.disk!==void 0&&(n.diskGB=W(e.disk,`--disk`)),t&&(n.accelerator=t),Object.keys(n).length>0?n:void 0}function $s(e){let t=e.split(`/`);return t.length>=2?{provider:t[0],model:t.slice(1).join(`/`)}:{model:e}}function ec(){let e=new t(`sandbox`).description(`Manage sandboxes`);e.command(`create`).description(`Create a new sandbox`).option(`-n, --name <name>`,`Sandbox name`).option(`-e, --environment <environment>`,`Named environment, container image, or built image ID`).option(`--bare`,`Create a bare sandbox without the agent runtime`).option(`--ssh`,`Enable SSH access`).option(`--ssh-key <key>`,`SSH public key for authentication`).option(`--ssh-keys <names...>`,`Stored SSH key names or IDs for authentication`).option(`--ssh-key-file <paths...>`,`SSH public key file paths for authentication`).option(`--web-terminal`,`Enable web terminal`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`--secret <names...>`,`Secrets to inject as environment variables`).option(`--metadata <entries...>`,`Metadata entries (KEY=VALUE or KEY=JSON)`).option(`--cpu <cores>`,"CPU cores (omit for the platform default; see `sandbox shapes`)").option(`--memory <mb>`,`Memory in MB (omit for the platform default)`).option(`--disk <gb>`,`Disk size in GB (omit for the platform default)`).option(`--accelerator-kind <kind>`,`Accelerator kind, for example nvidia-h100 or amd-mi300x`).option(`--accelerator-count <count>`,`Accelerator device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum accelerator memory in MB`).option(`--gpu-provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum customer spend for the create-time GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum create-time GPU lease lifetime in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy the create-time GPU lease after this many idle seconds`).option(`--lifetime <seconds>`,`Max wall-clock lifetime before the sandbox is suspended — stopped, not deleted; resume it within the cold window (default 3600 = 1h). Raise it for long sessions, e.g. --lifetime 7200`,`3600`).option(`--idle-timeout <seconds>`,"Idle time before the sandbox is stopped — not deleted (default 900 = 15m). Resume it later with `tangle sandbox resume <id-or-name>`, or it auto-resumes on next use. Raise it for demos, e.g. --idle-timeout 3600",`900`).option(`--from-snapshot <id>`,`Create the sandbox from a snapshot`).option(`--public-template <id-or-slug>`,`Create the sandbox from a published public template`).option(`--public-template-version <id>`,`Pin creation to a specific published public-template version`).option(`--billing-owner <userId>`,`Platform user that pays for the sandbox. The API accepts this only from a first-party service key that is listed as a billing delegate, and refuses such a key that names no payer.`).option(`--team <team>`,`Create in a team by id or name`).option(`--personal`,`Create a personal sandbox even when a team is active`).option(`--git-url <url>`,`Git repository URL to clone during provisioning`).option(`--git-ref <ref>`,`Git branch, tag, or commit to checkout`).option(`--git-depth <depth>`,`Git clone depth`).option(`--git-sparse <paths...>`,`Sparse checkout paths`).option(`--git-token-env <name>`,`Name of an environment variable containing the Git HTTPS auth token`).option(`--git-token-stdin`,`Read the Git HTTPS auth token from stdin`).option(`--storage-type <type>`,`BYOS3 storage type (s3, gcs, r2)`).option(`--storage-bucket <name>`,`BYOS3 bucket name`).option(`--storage-endpoint <url>`,`BYOS3 endpoint URL`).option(`--storage-region <region>`,`BYOS3 region`).option(`--storage-prefix <prefix>`,`BYOS3 path prefix`).option(`--storage-access-key-id <id>`,`BYOS3 access key ID`).option(`--storage-secret-access-key-env <name>`,`Name of an environment variable containing the BYOS3 secret access key`).option(`--storage-secret-access-key-stdin`,`Read the BYOS3 secret access key from stdin`).option(`--driver <type>`,`Infrastructure driver (docker, firecracker, host-agent, tangle)`).option(`--driver-criu`,`Enable CRIU checkpointing (firecracker only)`).option(`--driver-region <region>`,`Preferred region for host-agent driver`).option(`--backend <type>`,`Backend agent type (${c.join(`, `)})`).option(`--backend-model <model>`,`Model override (format: provider/model)`).option(`--backend-api-key-env <name>`,`Name of an environment variable containing the BYOK backend API key`).option(`--backend-api-key-stdin`,`Read the BYOK backend API key from stdin`).option(`--tee <type>`,`Require a TEE backend (any, tdx, nitro, sev-snp, phala-dstack)`).option(`--sealed`,`Request TEE sealed-secret support`).option(`--attestation-nonce <hex|auto>`,`Deploy-time attestation nonce; use auto to generate one`).option(`--attestation-refresh`,`Generate a fresh deploy-time attestation nonce when --tee is set`).option(`--require-attestation`,`Fail unless TEE attestation evidence is returned`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`--timeout <ms>`,`HTTP timeout in milliseconds`,`30000`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await Zs({envVarName:e.gitTokenEnv,fromStdin:e.gitTokenStdin,flagPrefix:`--git-token`}),n=await Zs({envVarName:e.storageSecretAccessKeyEnv,fromStdin:e.storageSecretAccessKeyStdin,flagPrefix:`--storage-secret-access-key`}),r=await Zs({envVarName:e.backendApiKeyEnv,fromStdin:e.backendApiKeyStdin,flagPrefix:`--backend-api-key`}),i=D({apiKey:e.apiKey,baseUrl:e.baseUrl,timeout:e.timeout?Number.parseInt(e.timeout,10):void 0}),a=O(i),o=P(`Creating sandbox...`);o.start();let s=await oc({client:a,explicitTeam:e.team,personal:e.personal,activeTeamId:i.activeTeamId}),c={};if(e.env)for(let t of e.env){let[e,...n]=t.split(`=`);e&&n.length>0&&(c[e]=n.join(`=`))}let l=e.metadata?nc(e.metadata):void 0,u=ic(e,t),d=ac(e,n),f=e.acceleratorKind?Co({kind:String(e.acceleratorKind),count:String(e.acceleratorCount),memory:typeof e.acceleratorMemory==`string`?e.acceleratorMemory:void 0}):void 0,p=wo({provider:typeof e.gpuProvider==`string`?e.gpuProvider:void 0,image:typeof e.gpuWorkerImage==`string`?e.gpuWorkerImage:void 0,env:Array.isArray(e.gpuEnv)?e.gpuEnv:void 0,maxSpendUsd:typeof e.gpuMaxSpendUsd==`string`?e.gpuMaxSpendUsd:void 0,maxLifetime:typeof e.gpuMaxLifetime==`string`?e.gpuMaxLifetime:void 0,idleTimeout:typeof e.gpuIdleTimeout==`string`?e.gpuIdleTimeout:void 0},!!f,`Create-time GPU lease flags require --accelerator-kind`),m=e.driver?{type:e.driver,enableCriu:e.driverCriu||void 0,preferredRegion:e.driverRegion}:void 0,h=e.backend||e.backendModel?{...e.backend?{type:ie(e.backend)}:{},model:e.backendModel||r?{...e.backendModel?$s(e.backendModel):{},apiKey:r}:void 0}:void 0,g=Qs(e,f),_=[...e.sshKey?[e.sshKey]:[],...(e.sshKeyFile??[]).map(e=>x(e,`utf8`).trim())],ee={name:e.name,environment:e.environment,bare:e.bare||void 0,sshEnabled:e.ssh||!!e.sshKey||_.length>0||!!e.sshKeys?.length,sshPublicKeys:_.length>0?_:void 0,sshKeyIds:e.sshKeys,webTerminalEnabled:e.webTerminal,env:Object.keys(c).length>0?c:void 0,git:u,...g?{resources:g}:{},gpuLease:p,maxLifetimeSeconds:Number.parseInt(e.lifetime,10),idleTimeoutSeconds:Number.parseInt(e.idleTimeout,10),storage:d,fromSnapshot:e.fromSnapshot,publicTemplateId:e.publicTemplate,publicTemplateVersionId:e.publicTemplateVersion,teamId:s,...e.billingOwner?{billingOwnerId:e.billingOwner}:{},secrets:e.secret,metadata:l,driver:m,backend:h},te=e.tee?{tee:e.tee,sealed:e.sealed||void 0,attestationRefresh:e.attestationRefresh||e.attestationNonce===`auto`||void 0}:void 0,re=te?await ne(a,{...ee,confidential:te,attestationNonce:e.attestationNonce??(e.attestationRefresh?`auto`:void 0),requireAttestation:e.requireAttestation??!0}):void 0,v=re?.sandbox??await a.create(ee);e.wait&&(o.text=`Waiting for sandbox to start...`,await v.waitFor(`running`,{timeoutMs:12e4}),await v.refresh()),o.stop(),e.json?A({id:v.id,name:v.name,status:v.status,resources:v.resources,createdAt:v.createdAt,expiresAt:v.expiresAt,connection:tc(v.connection),teamId:s,gpuLease:v.gpuLease,confidential:te,attestation:re?.attestation,attestationNonce:re?.attestationNonce}):(j(`Sandbox created: ${v.id}`),Zn({id:v.id,name:v.name,status:v.status,resources:v.resources,createdAt:v.createdAt?.toISOString(),expiresAt:v.expiresAt?.toISOString(),connection:v.connection}),s&&console.log(`Team: ${s}`),v.gpuLease&&(console.log(`GPU lease: ${v.gpuLease.id}`),lc(v.gpuLease)),te&&(console.log(`TEE: ${te.tee}`),console.log(`Attestation: ${re?.attestation?`present`:`not returned`}`),re?.attestationNonce&&console.log(`Attestation nonce: ${re.attestationNonce}`)))}catch(e){L(e)}}),e.command(`attestation <id-or-name>`).description(`Fetch TEE attestation evidence for a sandbox`).option(`--nonce <hex|auto>`,`Nonce to bind into a fresh attestation report; use auto to generate one`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=t.nonce===`auto`?re():t.nonce,a=P(`Fetching TEE attestation...`);a.start();let o=await(await z(r,n,e)).getTeeAttestation(i?{attestationNonce:i}:void 0);a.stop(),t.json?A(o):(j(`Attestation fetched for ${e}`),console.log(`TEE type: ${o.attestation.tee_type}`),console.log(`Evidence bytes: ${o.attestation.evidence.length}`),console.log(`Measurement bytes: ${o.attestation.measurement.length}`),console.log(`Timestamp: ${o.attestation.timestamp}`),o.attestationNonce&&console.log(`Nonce: ${o.attestationNonce}`))}catch(e){L(e)}}),e.command(`list`).description(`List all sandboxes`).option(`-s, --status <status>`,`Filter by status (running, stopped, all)`).option(`-l, --limit <n>`,`Limit results`,`50`).option(`--team <team>`,`List sandboxes for a team by id or name`).option(`--personal`,`List personal sandboxes`).option(`--all-scopes`,`List personal and team sandboxes`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=D({apiKey:e.apiKey,baseUrl:e.baseUrl}),n=O(t),r=P(`Fetching sandboxes...`);r.start();let i=await sc({client:n,explicitTeam:e.team,personal:e.personal,allScopes:e.allScopes,activeTeamId:t.activeTeamId}),a=await n.list({status:e.status===`all`?void 0:e.status,limit:Number.parseInt(e.limit,10),scope:i});r.stop(),e.json?A(a):k(a.map(e=>({id:e.id,status:e.status,createdAt:e.createdAt,name:e.name??``})),[{key:`id`,header:`ID`,width:24},{key:`status`,header:`Status`,width:14},{key:`createdAt`,header:`Created`,width:16},{key:`name`,header:`Name`,width:20}])}catch(e){L(e)}}),e.command(`get <id-or-name>`).description(`Get sandbox details`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Fetching sandbox...`);i.start();let a=await z(r,n,e);i.stop(),t.json?A(a):Zn({id:a.id,name:a.name,status:a.status,resources:a.resources,createdAt:a.createdAt?.toISOString(),expiresAt:a.expiresAt?.toISOString(),connection:a.connection})}catch(e){L(e)}}),e.command(`shapes`).description(`List the named sandbox sizes, the default, and this account's ceiling`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=await O(D({apiKey:e.apiKey,baseUrl:e.baseUrl})).shapes();if(e.json){A(t);return}let n=e=>e.cpuCores<=t.ceiling.cpuCores&&e.memoryMB<=t.ceiling.memoryMB&&e.diskGB<=t.ceiling.diskGB;k(t.presets.map(e=>({name:e.name===t.default?`${e.name} (default)`:e.name,cpu:e.cpuCores,memory:`${e.memoryMB} MB`,disk:`${e.diskGB} GB`,available:n(e)?`yes`:e.name===t.default?`clamped to ceiling`:`above ceiling`})),[{key:`name`,header:`Shape`,width:18},{key:`cpu`,header:`vCPU`,width:6},{key:`memory`,header:`Memory`,width:10},{key:`disk`,header:`Disk`,width:8},{key:`available`,header:`Available`,width:14}]),N(`Ceiling for this account: ${Xn(t.ceiling)}`)}catch(e){L(e)}}),e.command(`delete <id-or-name>`).description(`Delete a sandbox`).option(`-f, --force`,`Skip confirmation`).option(`--name`,`Treat the reference as a sandbox name`).option(`--retry-cleanup`,`Retry server-side cleanup after the sandbox disappeared from get/list`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{if(!t.force){let t=(await import(`node:readline`)).createInterface({input:process.stdin,output:process.stdout});if(!await new Promise(n=>{t.question(`Delete sandbox ${e}? [y/N] `,e=>{t.close(),n(e.toLowerCase()===`y`)})})){N(`Cancelled.`);return}}let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Deleting sandbox...`);i.start();let a=await Or(r,n,e,{retryCleanup:t.retryCleanup,name:t.name});i.stop(),j(a===`already_absent`?`Sandbox ${e} was already gone.`:`Sandbox ${e} deleted.`)}catch(e){L(e)}}),e.command(`stop <id-or-name>`).description(`Stop a running sandbox`).option(`--name`,`Treat the reference as a sandbox name`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Stopping sandbox...`);i.start(),await(await z(r,n,e,{nameOnly:t.name})).stop(),i.stop(),j(`Sandbox ${e} stopped.`)}catch(e){L(e)}}),e.command(`resume <id-or-name>`).description(`Resume a stopped sandbox`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`-t, --timeout <ms>`,`Resume timeout in milliseconds; a cold resume re-provisions the sandbox, so this defaults higher than other commands (default 120000)`,`120000`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=Number.parseInt(t.timeout,10);if(!Number.isFinite(n)||n<=0)throw Error(`--timeout must be a positive number of milliseconds`);let r=D({apiKey:t.apiKey,baseUrl:t.baseUrl,timeout:n}),i=O(r),a=P(`Resuming sandbox...`);a.start();let o=await z(i,r,e);await o.resume({timeoutMs:n}),t.wait&&(a.text=`Waiting for sandbox to start...`,await o.waitFor(`running`,{timeoutMs:n})),a.stop(),j(`Sandbox ${o.id} resumed.`)}catch(e){L(e)}});let n=e.command(`gpu`).description(`Manage on-demand GPU leases for a sandbox`);return n.command(`attach <id-or-name>`).description(`Attach a temporary GPU worker to a sandbox`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum GPU memory in MB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Attaching GPU lease...`);i.start();let a=await(await z(r,n,e)).gpu.attach(To(t));i.stop(),t.json?A(a):(j(`GPU lease attached: ${a.id}`),lc(a))}catch(e){L(e)}}),n.command(`run <id-or-name> <command...>`).description(`Attach a temporary GPU, run a command, then destroy it`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum GPU memory in MB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker and command (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{let r,i,a,o;try{let a=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),o=await z(O(a),a,e),s=P(`Attaching GPU lease...`);s.start(),r=await o.gpu.attach(To(n)),s.stop();let c=P(`Running GPU command...`);c.start(),i=await o.gpu.exec(r.id,{command:t.join(` `),timeoutMs:n.timeout?W(String(n.timeout),`--timeout`):void 0,cwd:n.cwd,env:n.env?Eo(n.env,`--env`,`env`):void 0}),c.stop(),n.json||uc(i)}catch(e){a=e}finally{if(r)try{let t=D({apiKey:n.apiKey,baseUrl:n.baseUrl});r=await(await z(O(t),t,e)).gpu.detach(r.id)}catch(e){o=e}}if(a){L(a),o&&L(o);return}if(o){L(o);return}n.json?A({lease:r,result:i}):r&&j(`GPU lease detached: ${r.id}`);let s=i?.result.exitCode;s&&s!==0&&(process.exitCode=s)}),n.command(`list <id-or-name>`).description(`List GPU leases attached to a sandbox`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Fetching GPU leases...`);i.start();let a=await(await z(r,n,e)).gpu.list();i.stop(),t.json?A(a):a.length===0?N(`No GPU leases attached.`):k(a.map(e=>({id:e.id,status:e.status,provider:e.provider,accelerator:`${e.accelerator.kind}x${e.accelerator.count}`,customerUsdHr:e.customerPricePerHourUsd??``})),[{key:`id`,header:`ID`,width:28},{key:`status`,header:`Status`,width:12},{key:`provider`,header:`Provider`,width:12},{key:`accelerator`,header:`GPU`,width:24},{key:`customerUsdHr`,header:`$/hr`,width:10}])}catch(e){L(e)}}),n.command(`exec <id-or-name> <lease-id> <command...>`).description(`Run a command on an attached GPU lease`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=D({apiKey:r.apiKey,baseUrl:r.baseUrl}),a=O(i),o=P(`Running GPU command...`);o.start();let s=await(await z(a,i,e)).gpu.exec(t,{command:n.join(` `),timeoutMs:r.timeout?W(String(r.timeout),`--timeout`):void 0,cwd:r.cwd,env:r.env?Eo(r.env,`--env`,`env`):void 0});o.stop(),r.json?A(s):uc(s)}catch(e){L(e)}}),n.command(`detach <id-or-name> <lease-id>`).description(`Detach and destroy a GPU lease`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=O(r),a=P(`Detaching GPU lease...`);a.start();let o=await(await z(i,r,e)).gpu.detach(t);a.stop(),n.json?A(o):(j(`GPU lease detached: ${o.id}`),lc(o))}catch(e){L(e)}}),e.command(`network <id-or-name>`).description(`Show runtime network state (exposed ports) for a sandbox. Outbound policy is not settable here — see the outbound flags.`).option(`--block-outbound`,`Unenforceable; the server rejects it. Block outbound traffic with an egress policy of mode "blocked"`).option(`--allow-list <cidrs>`,`Unenforceable; the server rejects it. Egress policy allowlists domains, not CIDRs`).option(`--clear`,`Unenforceable; the server rejects it. There is no per-sandbox outbound restriction here to clear`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Updating network configuration...`);i.start();let a=await z(r,n,e);if(t.clear)await a.network.update({blockOutbound:!1,allowList:[]});else if(t.blockOutbound)await a.network.update({blockOutbound:!0});else if(t.allowList){let e=t.allowList.split(`,`).map(e=>e.trim());await a.network.update({allowList:e})}else{i.stop();let e=await a.network.getConfig();t.json?A(e):(N(`Network Configuration:`),e.ports&&e.ports.length>0?N(`  Exposed Ports: ${e.ports.join(`, `)}`):N(`  No exposed ports`));return}i.stop();let o=await a.network.getConfig();t.json?A(o):(j(`Network configuration updated.`),o.ports&&o.ports.length>0&&N(`  Exposed Ports: ${o.ports.join(`, `)}`))}catch(e){L(e)}}),e.command(`expose <id-or-name>`).description(`Expose a port and get a public URL`).option(`-p, --port <port>`,`Port to expose`,`8000`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=Number.parseInt(t.port,10);if(Number.isNaN(i)||i<1||i>65535)throw Error(`Port must be a number between 1 and 65535`);let a=P(`Exposing port ${i}...`);a.start();let o=await(await z(r,n,e)).network.exposePort(i);a.stop(),t.json?A({port:i,url:o}):(j(`Port ${i} exposed.`),N(`  URL: ${o}`))}catch(e){L(e)}}),e.command(`urls <id-or-name>`).description(`List exposed port URLs for a sandbox`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Fetching exposed URLs...`);i.start();let a=await(await z(r,n,e)).network.listUrls();if(i.stop(),t.json)A(a);else{let e=Object.entries(a);if(e.length===0)N(`No ports exposed.`);else{N(`Exposed Ports:`);for(let[t,n]of e)N(`  ${t}: ${n}`)}}}catch(e){L(e)}}),e}function tc(e){return!e||e.authToken===void 0?e:{...e,authToken:`[REDACTED]`}}function nc(e){let t={};for(let n of e){let[e,...r]=n.split(`=`);if(!e||r.length===0)throw Error(`--metadata expects values in KEY=VALUE or KEY=JSON format`);t[e]=rc(r.join(`=`))}return t}function rc(e){try{return JSON.parse(e)}catch{return e}}function ic(e,t){if(!(!e.gitUrl&&!e.gitRef&&!e.gitDepth&&!e.gitSparse&&!t)){if(!e.gitUrl||typeof e.gitUrl!=`string`)throw Error(`--git-url is required when using git provisioning options`);return{url:e.gitUrl,ref:typeof e.gitRef==`string`?e.gitRef:void 0,depth:typeof e.gitDepth==`string`?W(e.gitDepth,`--git-depth`):void 0,sparse:Array.isArray(e.gitSparse)?e.gitSparse:void 0,auth:t?{token:t}:void 0}}}function ac(e,t){if(!(!e.storageType&&!e.storageBucket&&!e.storageEndpoint&&!e.storageRegion&&!e.storagePrefix&&!e.storageAccessKeyId&&!t)){if(typeof e.storageType!=`string`||typeof e.storageBucket!=`string`||typeof e.storageAccessKeyId!=`string`||!t)throw Error(`Storage config requires --storage-type, --storage-bucket, --storage-access-key-id, and one of --storage-secret-access-key-env / --storage-secret-access-key-stdin`);return{type:cc(e.storageType),bucket:e.storageBucket,endpoint:typeof e.storageEndpoint==`string`?e.storageEndpoint:void 0,region:typeof e.storageRegion==`string`?e.storageRegion:void 0,prefix:typeof e.storagePrefix==`string`?e.storagePrefix:void 0,credentials:{accessKeyId:e.storageAccessKeyId,secretAccessKey:t}}}}async function oc(e){if(e.explicitTeam&&e.personal)throw Error(`--team and --personal cannot be used together`);if(!e.personal)return e.explicitTeam?(await Js(e.client,e.explicitTeam)).id:e.activeTeamId}async function sc(e){if([!!e.explicitTeam,!!e.personal,!!e.allScopes].filter(Boolean).length>1)throw Error(`--team, --personal, and --all-scopes are mutually exclusive`);if(e.allScopes)return`all`;if(e.personal)return`personal`;if(e.explicitTeam)return`team:${(await Js(e.client,e.explicitTeam)).id}`;if(e.activeTeamId)return`team:${e.activeTeamId}`}function cc(e){if(e===`s3`||e===`gcs`||e===`r2`)return e;throw Error(`--storage-type must be one of s3, gcs, or r2`)}function lc(e){N(`  Status: ${e.status}`),N(`  Provider: ${e.provider}`),N(`  GPU: ${e.accelerator.kind} x ${e.accelerator.count}`),e.customerPricePerHourUsd!==void 0&&N(`  Customer price: $${e.customerPricePerHourUsd}/hr`),e.estimatedCustomerCostUsd!==void 0&&N(`  Max estimate: $${e.estimatedCustomerCostUsd}`),e.billing&&(N(`  Billed seconds: ${e.billing.seconds}`),N(`  Customer cost: $${e.billing.customerCostUsd}`))}function uc(e){e.result.stdout&&process.stdout.write(e.result.stdout),e.result.stderr&&process.stderr.write(e.result.stderr),N(`Exit code: ${e.result.exitCode}`)}function dc(){return new t(`search`).description(`Search for text patterns in sandbox files (ripgrep)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pattern>`,`Search pattern (regex)`).option(`-g, --glob <pattern>`,`File glob filter (e.g. '**/*.ts')`).option(`-n, --max-results <count>`,`Max results to return`).option(`-i, --ignore-case`,`Case-insensitive search`).option(`--json`,`Output as JSON lines`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=O(r),a=P(`Searching...`);n.json||a.start();let o=await z(i,r,e),s=0,c=n.maxResults?Number.parseInt(n.maxResults,10):void 0,l={};n.glob&&(l.glob=n.glob),n.ignoreCase&&(l.ignoreCase=!0),c&&(l.maxResults=c);for await(let e of o.search(t,l))if(s===0&&a.stop(),s++,n.json?console.log(JSON.stringify(e)):console.log(`${e.path}:${e.line}:${e.column??0}: ${e.text}`),c&&s>=c)break;a.stop(),s===0&&!n.json&&console.log(`No matches found`)}catch(e){L(e)}})}function fc(){let e=new t(`secret`).description(`Manage secrets`);return e.command(`create`).description(`Create a new secret`).argument(`<name>`,`Secret name (e.g., HF_TOKEN, AWS_ACCESS_KEY)`).argument(`[value]`,`Secret value`).option(`--value-stdin`,`Read secret value from stdin`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=O(D({apiKey:n.apiKey,baseUrl:n.baseUrl})),i=await pc({value:t,valueStdin:n.valueStdin,prompt:`Enter value for secret '${e}': `}),a=P(`Creating secret...`);a.start();let o=await r.secrets.create(e,i);a.stop(),n.json?A({name:o.name,createdAt:o.createdAt.toISOString(),updatedAt:o.updatedAt.toISOString()}):(j(`Secret created: ${o.name}`),N(`Use --secrets ${o.name} when creating a sandbox to inject it as an environment variable.`))}catch(e){L(e)}}),e.command(`list`).description(`List all secrets`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=O(D({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=P(`Fetching secrets...`);n.start();let r=await t.secrets.list();n.stop(),e.json?A(r.map(e=>({name:e.name,createdAt:e.createdAt.toISOString(),updatedAt:e.updatedAt.toISOString()}))):r.length===0?(N(`No secrets found.`),N(`Use 'tangle secret create <name> [value]' to create one.`)):I([`Name`,`Created At`,`Updated At`],r.map(e=>[e.name,e.createdAt.toLocaleString(),e.updatedAt.toLocaleString()]))}catch(e){L(e)}}),e.command(`delete`).description(`Delete a secret`).argument(`<name>`,`Secret name`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=O(D({apiKey:t.apiKey,baseUrl:t.baseUrl}));if(!t.force&&!await Pr(`Are you sure you want to delete secret '${e}'? This cannot be undone. (y/N) `)){N(`Cancelled.`);return}let r=P(`Deleting secret...`);r.start(),await n.secrets.delete(e),r.stop(),t.json?A({success:!0,deleted:e}):j(`Secret deleted: ${e}`)}catch(e){L(e)}}),e}async function pc(e){if(e.value!==void 0&&e.valueStdin)throw Error(`Provide either a secret value argument or --value-stdin, not both`);if(e.value!==void 0){if(e.value.length===0)throw Error(`Secret value cannot be empty`);return e.value}if(e.valueStdin){let e=await Ir();if(e.length===0)throw Error(`Secret value from stdin cannot be empty`);return e}let t=await Nr(e.prompt);if(t.length===0)throw Error(`Secret value cannot be empty`);return t}function mc(){let e=new t(`skill`).description(`Print paths to shipped skill documentation`);return e.command(`path`).description(`Print the absolute path to the SKILL.md shipped with this CLI`).action(()=>{let e=S.dirname(Fe(import.meta.url)),t=S.resolve(e,`..`,`SKILL.md`);console.log(t)}),e}function hc(){let e=new t(`snapshot`).description(`Manage snapshots`);return e.command(`create <sandbox-id-or-name>`).description(`Create a snapshot of a sandbox`).option(`--tags <tags...>`,`Tags for the snapshot`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Creating snapshot...`);i.start();let a=await(await z(r,n,e)).snapshot({tags:t.tags});i.stop(),t.json?A(a):(j(`Snapshot created: ${a.snapshotId}`),console.log(`Size: ${gc(a.sizeBytes??0)}`))}catch(e){L(e)}}),e.command(`list <sandbox-id-or-name>`).description(`List snapshots for a sandbox`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Fetching snapshots...`);i.start();let a=await(await z(r,n,e)).listSnapshots();i.stop(),t.json?A(a):k(a.map(e=>({...e,size:gc(e.sizeBytes??0)})),[{key:`snapshotId`,header:`ID`,width:24},{key:`createdAt`,header:`Created`,width:16},{key:`size`,header:`Size`,width:12},{key:`sandboxId`,header:`Sandbox`,width:20}])}catch(e){L(e)}}),e.command(`restore <sandbox-id> <snapshot-id>`).description(`Create a new sandbox from a snapshot`).option(`--billing-owner <userId>`,`Platform user that pays for the restored sandbox. The API accepts this only from a first-party service key that is listed as a billing delegate, and refuses such a key that names no payer.`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=O(D({apiKey:n.apiKey,baseUrl:n.baseUrl})),i=P(`Restoring from snapshot...`);i.start();let a=await r.create({fromSnapshot:t,fromSandboxId:e,...n.billingOwner?{billingOwnerId:n.billingOwner}:{}});await a.waitFor(`running`,{timeoutMs:12e4}),i.stop(),n.json?A({sandboxId:a.id,restoredFrom:t,status:a.status}):(j(`New sandbox created: ${a.id}`),console.log(`Source snapshot: ${t}`))}catch(e){L(e)}}),e.command(`revert <sandbox-id-or-name> <snapshot-id>`).description(`Revert an existing sandbox to a snapshot`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=O(r),a=P(`Reverting sandbox to snapshot...`);a.start();let o=await z(i,r,e),s=await o.revertToSnapshot(t);await o.refresh(),a.stop(),n.json?A({sandboxId:o.id,snapshotId:s.snapshotId,status:o.status}):(j(`Sandbox reverted: ${o.id}`),console.log(`Source snapshot: ${s.snapshotId}`))}catch(e){L(e)}}),e.command(`delete <sandbox-id-or-name> <snapshot-id>`).description(`Delete a sandbox snapshot`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n)=>{try{let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=O(r),a=P(`Deleting snapshot...`);a.start();let o=await(await z(i,r,e)).deleteSnapshot(t);a.stop(),n.json?A({success:!0,sandboxId:e,snapshotId:t,outcome:o.outcome}):o.outcome===`already_absent`?j(`Snapshot already gone: ${t}`):j(`Snapshot deleted: ${t}`)}catch(e){L(e)}}),e}function gc(e){if(e===0)return`0 B`;let t=1024,n=[`B`,`KB`,`MB`,`GB`,`TB`],r=Math.floor(Math.log(e)/Math.log(t));return`${Number.parseFloat((e/t**r).toFixed(1))} ${n[r]}`}const _c=`solve:device:secp256k1`,vc=/^0x[0-9a-f]{64}$/i;function yc(e){return e&&vc.test(e)?e:void 0}function bc(){let e=Dt(_c),t=yc(e.value);if(!(!t||e.source===`none`))return{account:Le(t),source:e.source}}function xc(){let e=bc();if(e)return e;let t=Ie(),n=Ot(_c,t);return{account:Le(t),source:n}}function Sc(e){try{let t=e.create?xc():bc();if(!t)throw Error("No Solve device signer found. Run `tangle solve account --create`");e.json?A({address:t.account.address,source:t.source}):F({Address:t.account.address,Source:t.source})}catch(e){L(e)}}const Cc=/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;function wc(e){return[...e].some(e=>{let t=e.charCodeAt(0);return t<32||t===127})}function q(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`${t} must be an object`);return e}function Tc(e,t,n=2048){if(typeof e!=`string`||!e.trim()||e.length>n)throw Error(`${t} is missing or invalid`);if(wc(e))throw Error(`${t} contains control characters`);return e.trim()}function Ec(e,t){let n=Tc(e,t,64).toLowerCase();if(!Cc.test(n))throw Error(`${t} must be a 40 or 64 character Git revision`);return n}function Dc(e,t,n=!1){let r=typeof e==`number`&&Number.isSafeInteger(e)?String(e):Tc(e,t,80);if(!/^\d+$/.test(r)||!n&&r===`0`)throw Error(`${t} must be an unsigned integer`);return BigInt(r).toString()}function Oc(e,t){let n=Tc(e,t,2048),r=new URL(n);if(r.protocol!==`https:`&&!(r.protocol===`http:`&&(r.hostname===`localhost`||r.hostname===`127.0.0.1`)))throw Error(`${t} must use HTTPS outside local development`);return n.replace(/\/$/,``)}function kc(e,t){let n=Oc(e,t).replace(/\.git$/,``),r=new URL(n),i=r.pathname.split(`/`).filter(Boolean);if(r.hostname!==`github.com`||r.username||r.password||r.search||r.hash||i.length!==2)throw Error(`${t} must be an HTTPS GitHub repository URL`);return`https://github.com/${i.join(`/`)}`}function Ac(e,t){let n=Tc(e,t,42);if(!Ke(n,{strict:!1}))throw Error(`${t} must be an EVM address`);return We(n)}function jc(e,t){let n=Dc(e,t),r=Number(n);if(!Number.isSafeInteger(r)||r<=0)throw Error(`${t} is out of range`);return r}function J(...e){for(let t of e)if(typeof t==`string`&&t.trim())return t.trim()}function Mc(e){let t=e.trim().replace(/\.git$/,``);return t.startsWith(`git@github.com:`)?`https://github.com/${t.slice(15)}`:t.startsWith(`ssh://git@github.com/`)?`https://github.com/${t.slice(21)}`:t}function Nc(e){if(e===void 0)return;let t=Tc(e,`pull request URL`,2048);if(!/^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/\d+(?:\/[^\s]*)?$/i.test(t))throw Error(`pull request URL must point to a GitHub pull request`);return t}function Pc(e,t){if(!/^https:\/\/[^\s]+$/i.test(e)&&!/^\/(?!\/).*$/.test(e)&&!/^[a-z][a-z0-9+.-]*:[^\s]+$/i.test(e))throw Error(`${t} must be an HTTPS URL or an absolute repository path`);if(e.split(/[?#]/,1)[0].split(`/`).includes(`..`))throw Error(`${t} cannot contain parent-directory segments`);return e}function Fc(e){return Yt(`solve`,e.profile)}function Ic(e){let t=Fc(e),n=gn(void 0,t);if(!n)throw Error(`No Solve credential found for profile '${t}'. Run: tangle auth login --provider github --app solve`);return n}async function Lc(e){let t=wn(e.apiUrl),n=await fetch(`${t}${e.path}`,{method:e.method??`GET`,headers:{Accept:`application/json`,...e.body===void 0?{}:{"Content-Type":`application/json`},Authorization:`Bearer ${Ic(e)}`},...e.body===void 0?{}:{body:JSON.stringify(e.body)},signal:AbortSignal.timeout(3e4)}),r=await n.json().catch(()=>null);if(!n.ok||!r?.success||r.data===void 0)throw Error(r?.error?.message??`Solve API request failed with HTTP ${n.status}`);return r.data}function Rc(e){return Lc({path:`/v1/wallet/challenges`,method:`POST`,apiUrl:e.apiUrl,profile:e.profile,body:{deviceAddress:e.deviceAddress}})}const Y={chainId:42431,rpcUrl:`https://rpc.moderato.tempo.xyz`,sponsorUrl:`https://solve-sponsor-178-104-232-124.sslip.io`,tangleAddress:`0xff137B9C879c47C28ce389e84501925438AB4cdA`,managerAddress:`0x31Aad1051185314EcA5AA1e3607c78c4cb9368e1`,paymentAsset:`0x20C0000000000000000000000000000000000000`,blueprintId:9n,serviceId:7n,competitionId:1n,minStakeWei:0n};function zc(e,t){return e.toLowerCase()===t.toLowerCase()}function Bc(e){if(e.chainId!==Y.chainId)throw Error(`Solve submissions require Tempo Moderato (chain ${Y.chainId}); received ${e.chainId}`);if(e.rpcUrl!==Y.rpcUrl)throw Error(`Solve metadata RPC does not match the trusted deployment`);if(e.sponsorUrl!==Y.sponsorUrl)throw Error(`Solve metadata sponsor does not match the trusted deployment`);if(!zc(e.tangleAddress,Y.tangleAddress))throw Error(`Solve metadata Tangle contract does not match the trusted deployment`);if(!zc(e.managerAddress,Y.managerAddress))throw Error(`Solve metadata competition manager does not match the trusted deployment`);if(!zc(e.paymentAsset,Y.paymentAsset))throw Error(`Solve metadata payment asset does not match the trusted deployment`);if(e.blueprintId!==Y.blueprintId)throw Error(`Solve submissions require blueprint ${Y.blueprintId}; received ${e.blueprintId}`);if(e.serviceId!==Y.serviceId)throw Error(`Solve submissions require service ${Y.serviceId}; received ${e.serviceId}`);if(e.competitionId!==Y.competitionId)throw Error(`Solve submissions require competition ${Y.competitionId}; received ${e.competitionId}`);if(e.minStakeWei!==Y.minStakeWei)throw Error(`Solve submissions require zero stake for the trusted deployment`)}function Vc(e,t){let n=q(t.check??e.check,`competition.participation.check`),r=Tc(n.command,`competition.participation.check.command`,512);if(!Array.isArray(n.args)||n.args.some(e=>typeof e!=`string`))throw Error(`competition.participation.check.args must be an array of strings`);let i=n.args.map(e=>Tc(e,`competition checker argument`,2048)),a=J(n.result_file,n.resultFile),o=n.timeout_ms??n.timeoutMs,s=o===void 0?void 0:jc(o,`competition checker timeout`);return{command:r,args:i,...a?{result_file:a}:{},...s?{timeout_ms:s}:{}}}function Hc(e){if(e.provenance===void 0)return;let t=q(e.provenance,`competition.participation.provenance`);if(t.mode!==`github_pull_request`)throw Error(`competition.participation.provenance.mode is unsupported`);if(t.required!==void 0&&typeof t.required!=`boolean`)throw Error(`competition.participation.provenance.required must be a boolean`);return{mode:`github_pull_request`,required:t.required===!0}}function Uc(e){let t=q(e.chain??e.network??{},`competition.chain`),n=e.rewards&&typeof e.rewards==`object`&&!Array.isArray(e.rewards)?q(e.rewards,`competition.rewards`):{},r=n.minStake&&typeof n.minStake==`object`&&!Array.isArray(n.minStake)?q(n.minStake,`competition.rewards.minStake`).raw:void 0,i=J(t.minStakeWei,t.min_stake_wei,e.minStakeWei,e.min_stake_wei,r),a=t.chainId??t.chain_id??e.chainId??e.chain_id,o=J(t.chainName,t.chain_name,e.chainName,e.chain_name)??`Tempo`,s=J(t.nativeSymbol,t.native_symbol,e.nativeSymbol,e.native_symbol)??`TNT`,c=J(t.rpcUrl,t.rpc_url,e.rpcUrl,e.rpc_url,process.env.TANGLE_SOLVE_RPC_URL),l=J(t.sponsorUrl,t.sponsor_url,e.sponsorUrl,e.sponsor_url,process.env.TANGLE_SOLVE_SPONSOR_URL),u=J(t.tangleAddress,t.tangle_address,t.coreAddress,t.core_address,e.tangleAddress,e.tangle_address,e.coreAddress,e.core_address),d=J(t.managerAddress,t.manager_address,e.managerAddress,e.manager_address),f=J(t.paymentAsset,t.payment_asset,t.servicePaymentAsset,t.service_payment_asset,e.paymentAsset,e.payment_asset,e.servicePaymentAsset,e.service_payment_asset),p=J(t.blueprintId,t.blueprint_id,e.blueprintId,e.blueprint_id),m=J(t.serviceId,t.service_id,e.serviceId,e.service_id),h=J(t.competitionId,t.competition_id,e.competitionId,e.competition_id,e.id);if(!c||!l||!u||!d||!p||!m||!h||!i||a===void 0)throw Error(`Solve competition metadata must include complete Tempo chain configuration`);return{chainId:jc(a,`chain.chainId`),chainName:o,nativeSymbol:s,rpcUrl:Oc(c,`chain.rpcUrl`),sponsorUrl:Oc(l,`chain.sponsorUrl`),tangleAddress:Ac(u,`chain.tangleAddress`),managerAddress:Ac(d,`chain.managerAddress`),paymentAsset:Ac(f??Y.paymentAsset,`chain.paymentAsset`),blueprintId:Dc(p,`chain.blueprintId`),serviceId:Dc(m,`chain.serviceId`),competitionId:Dc(h,`chain.competitionId`,!0),minStakeWei:Dc(i,`chain.minStakeWei`,!0)}}function Wc(e){let t=q(e,`competition`),n=q(t.participation??t.task,`competition.task`),r={...t,participation:{...n,...n.repositoryRevision===void 0&&n.revision!==void 0?{repositoryRevision:n.revision}:{}}},i=r.participation,a=kc(J(r.repository,r.repo_url,i.repository)??``,`competition.repository`),o=Ec(J(r.repositoryRevision,r.repository_revision,i.revision,i.repositoryRevision,i.repository_revision),`competition.repositoryRevision`),s=Tc(r.slug??r.id,`competition.slug`,128),c=Tc(r.name??r.title??s,`competition.name`,256),l=Vc(r,i),u=Hc(i);return{version:1,slug:s,title:c,repository:a,taskRevision:o,checker:l,chain:Uc(r),...u?{provenance:u}:{}}}function Gc(e){return{chainId:e.chain.chainId,chainName:e.chain.chainName,nativeSymbol:e.chain.nativeSymbol,rpcUrl:e.chain.rpcUrl,sponsorUrl:e.chain.sponsorUrl,tangleAddress:e.chain.tangleAddress,managerAddress:e.chain.managerAddress,paymentAsset:e.chain.paymentAsset,blueprintId:BigInt(e.chain.blueprintId),serviceId:BigInt(e.chain.serviceId),competitionId:BigInt(e.chain.competitionId),minStakeWei:BigInt(e.chain.minStakeWei)}}async function Kc(e){let t=q(JSON.parse(await w.readFile(S.join(e,`.tangle-solve.json`),`utf8`)),`.tangle-solve.json`);if(t.version!==1)throw Error(`.tangle-solve.json has an unsupported version`);let n=q(t.checker,`.tangle-solve.json.checker`),r=q(t.chain,`.tangle-solve.json.chain`);return Wc({slug:t.slug,name:t.title,repository:t.repository,repositoryRevision:t.taskRevision,participation:{check:n,provenance:t.provenance},chain:r,competitionId:r.competitionId})}const qc=Re(ye),Jc=`.tangle-solve-run.json`,Yc=`.tangle-solve.json`,Xc=`tangle.solve.manifestSha256`,Zc=new Set([Yc,Jc]),Qc=`upstream`;async function $c(e,t){let n=await qc(`git`,[`-C`,e,...t],{encoding:`utf8`,maxBuffer:1e6});return String(n.stdout).trim()}async function el(e,t){let n=S.resolve(t??process.cwd()),r=await Kc(n);if(e&&e!==r.slug&&e!==r.chain.competitionId)throw Error(`This directory contains '${r.slug}', not '${e}'`);return{root:n,manifest:r}}async function tl(e){let t=S.join(e,Yc),r;try{r=await w.lstat(t)}catch{throw Error(`${Yc} is missing`)}if(r.isSymbolicLink()||!r.isFile())throw Error(`${Yc} must be a regular file`);return n(`sha256`).update(await w.readFile(t)).digest(`hex`)}async function nl(e){let t=await tl(e);return await $c(e,[`config`,`--local`,`--replace-all`,Xc,t]),t}async function rl(e){let t;try{t=await $c(e,[`config`,`--local`,`--get`,Xc])}catch{throw Error(`The local Git metadata has no ${Xc} pin; run tangle solve clone again`)}if(!/^[0-9a-f]{64}$/i.test(t))throw Error(`The local ${Xc} pin is invalid`);if(await tl(e)!==t.toLowerCase())throw Error(`${Yc} changed after clone; run tangle solve clone again`)}async function il(e,t){try{return await $c(e,[`ls-files`,`--error-unmatch`,`--`,t]),!0}catch{return!1}}async function al(e){await rl(e);for(let t of Zc)if(await il(e,t))throw Error(`${t} must remain untracked and local to this Solve workspace`);let t=await qc(`git`,[`-C`,e,`status`,`--porcelain=v1`,`--untracked-files=all`,`--ignored=matching`],{encoding:`utf8`,maxBuffer:1e6});if(String(t.stdout).split(/\r?\n/).filter(Boolean).filter(e=>{let t=e.slice(0,2),n=e.slice(3);return!((t===`??`||t===`!!`)&&Zc.has(n))}).length>0)throw Error(`Commit the candidate before running Solve. Only the local manifest and run record may remain uncommitted.`);return Ec(await $c(e,[`rev-parse`,`HEAD`]),`submission revision`)}async function ol(e,t,n,r={}){let i=await sl(e,t,r);if(i)return{taskRepository:t.repository,taskRevision:t.taskRevision,submissionRepository:i,submissionRevision:n}}async function sl(e,t,n={}){let r;try{r=Mc(await $c(e,[`config`,`--get`,`remote.origin.pushurl`]))}catch{try{r=Mc(await $c(e,[`config`,`--get`,`remote.origin.url`]))}catch{if(n.allowMissing)return;throw Error(`Add your GitHub fork as the 'origin' remote before submitting. The task repository is available as '${Qc}'.`)}}let i=kc(r,`git remote.origin.url`);if(i.toLowerCase()===t.repository.toLowerCase()){if(n.allowMissing)return;throw Error(`The 'origin' remote is the task repository. Add your GitHub fork as 'origin'; keep the task repository as '${Qc}' before submitting.`)}return i}function cl(e,t){return!e||!t?!1:e.taskRepository.toLowerCase()===t.taskRepository.toLowerCase()&&e.taskRevision.toLowerCase()===t.taskRevision.toLowerCase()&&e.submissionRepository.toLowerCase()===t.submissionRepository.toLowerCase()&&e.submissionRevision.toLowerCase()===t.submissionRevision.toLowerCase()}function ll(e,t){return`${e}/commit/${t}`}function ul(e,t,n,r,i={}){let a=e.evidenceRefs.map(e=>Pc(e.trim(),`checker evidence reference`));if(n){if(!t){if(i.allowMissingSource)return{evidence:e.evidence,evidenceRefs:a};throw Error(`Provenance policy requires a submission source`)}let o=Nc(r);if(n.required&&(i.requirePullRequest??!0)&&!o)throw Error(`This competition requires a GitHub pull request`);a.push(ll(t.taskRepository,t.taskRevision),ll(t.submissionRepository,t.submissionRevision),...o?[o]:[])}return{evidence:e.evidence,evidenceRefs:[...new Set(a)]}}async function dl(e,t){let n=`${e}.${process.pid}.tmp`;await w.writeFile(n,`${JSON.stringify(t,null,2)}\n`,{mode:384}),await w.rename(n,e)}async function fl(e){let t=JSON.parse(await w.readFile(S.join(e,Jc),`utf8`));if(t.version!==1||typeof t.competition!=`string`)throw Error(`${Jc} has an unsupported format`);return t}async function pl(e){let t=Nc(e.pullRequest);if(!t)throw Error(`A pull request URL is required`);let n=new URL(t).pathname.split(`/`).filter(Boolean),r=await fetch(`https://api.github.com/repos/${n[0]}/${n[1]}/pulls/${n[3]}`,{headers:{Accept:`application/vnd.github+json`,"User-Agent":`tangle-solve-cli`},signal:AbortSignal.timeout(15e3)}),i=await r.json().catch(()=>null),a=e=>e.replace(/\/$/,``).toLowerCase();if(!r.ok||a(i?.base?.repo?.html_url??``)!==a(e.taskRepository)||i?.head?.sha?.toLowerCase()!==e.submissionRevision.toLowerCase()||a(i?.head?.repo?.html_url??``)!==a(e.submissionRepository))throw Error(`GitHub pull request must target the pinned task repository and contain the current committed submission`)}function ml(e){return{...e.authorization?{authorization:e.authorization}:{},...e.stake?{stake:e.stake}:{},join:e.join,commit:e.commit,reveal:e.reveal,report:e.report,evaluation:e.evaluation}}const hl=Re(ye);function gl(){return`Task source is '${Qc}'. Add your fork as 'origin', commit your candidate, push it, and open a pull request before submitting.`}async function _l(e,t,n){try{let r=q(await Lc({path:`/v1/competitions/${encodeURIComponent(e)}`,apiUrl:n.apiUrl,profile:n.profile}),`competition response`),i=Wc(r.competition??r),a=S.resolve(t??i.slug),o=P(`Cloning ${i.slug}…`);n.json||o.start();try{await hl(`git`,[`clone`,`--no-tags`,`--origin`,Qc,i.repository,a],{encoding:`utf8`,maxBuffer:1e6}),await $c(a,[`checkout`,`--detach`,i.taskRevision]);let e=await $c(a,[`rev-parse`,`HEAD`]);if(e.toLowerCase()!==i.taskRevision.toLowerCase())throw Error(`Pinned checkout resolved to ${e}, expected ${i.taskRevision}`);await dl(S.join(a,`.tangle-solve.json`),i),await nl(a)}finally{o.stop()}n.json?A({competition:i,directory:a}):(j(`Cloned ${i.slug} at ${i.taskRevision.slice(0,12)}`),i.provenance&&N(gl()),N(`Run the pinned checker with: cd ${a} && tangle solve run`))}catch(e){L(e)}}const vl=12e4,yl=Ye(`event JobSubmitted(uint64 indexed serviceId, uint64 indexed callId, uint8 jobIndex, address caller, bytes inputs)`),bl=Ye(`event JobCompleted(uint64 indexed serviceId, uint64 indexed callId)`),xl=Ye(`event JobResultSubmitted(uint64 indexed serviceId, uint64 indexed callId, address indexed operator, bytes result)`),Sl=Ye(`event AggregatedResultSubmitted(uint64 indexed serviceId, uint64 indexed callId, uint256 signerBitmap, bytes output)`),Cl=Ye(`event EvaluationAccepted(uint64 indexed serviceId, uint64 indexed competitionId, address indexed researcher, bytes32 candidateId, bytes32 submissionRefHash, bytes32 evaluationDigest, bytes32 metricsHash, bytes32 evidenceRefsHash)`),wl=[...Je([`function submitJob(uint64 serviceId, uint8 jobIndex, bytes inputs) payable returns (uint64 callId)`,`function getJobEventRate(uint64 blueprintId, uint8 jobIndex) view returns (uint256 rate)`,`function getServicePaymentAsset(uint64 serviceId) view returns (address)`,`function isPermittedCaller(uint64 serviceId, address caller) view returns (bool)`]),yl,bl,xl,Sl],Tl=Je([`function authorizeSelf(uint64 serviceId)`,`function postStake(uint64 serviceId, uint64 competitionId) payable`,`function stakes(uint64 serviceId, uint64 competitionId, address researcher) view returns (uint256)`,`function pendingResults(uint64 serviceId, uint64 jobCallId) view returns (uint8 job, bytes32 outputHash, uint256 signerBitmap, bool exists, bool executed)`,`function executePendingResult(uint64 serviceId, uint64 jobCallId, bytes output)`,`function acceptedCandidates(uint64 serviceId, uint64 competitionId, address researcher, bytes32 candidateId) view returns (bool)`]),El=Je([`function allowance(address owner, address spender) view returns (uint256)`,`function approve(address spender, uint256 amount) returns (bool)`]),Dl=Xe(`uint64 competitionId, uint256 stakeWei`),Ol=Xe(`uint64 competitionId, bytes32 commitment`),kl=Xe(`uint64 competitionId, bytes32 commitment, string artifactRef, bytes32 salt`),Al=Xe(`string artifactRef, bytes32 salt`),jl=Xe(`uint64 competitionId, bytes32 candidateId, string submissionRef, string evidenceJson, string evidenceRefsJson`),Ml=Xe(`string status, string detail`),Nl=/^0x[0-9a-f]{64}$/i;function Pl(e,t){if(e!==t)throw Error(`Tempo RPC returned chain ${e}; expected ${t}`)}function Fl(e,t,n){return{...e,feePayer:!0,nonceKey:t,nonce:n}}function Il(e,t){if(e!==`success`)throw Error(`${t} transaction reverted`)}function Ll(e,t,n,r){if(!Nl.test(t))throw Error(`${n} transaction hash is invalid`);if(typeof e.transactionHash!=`string`||e.transactionHash.toLowerCase()!==t.toLowerCase())throw Error(`${n} receipt hash does not match the saved transaction`);if(Il(e.status??``,n),typeof e.from!=`string`||e.from.toLowerCase()!==r.from.toLowerCase())throw Error(`${n} receipt sender does not match the Solve device`);if(typeof e.to!=`string`||e.to.toLowerCase()!==r.to.toLowerCase())throw Error(`${n} receipt destination does not match the expected contract`)}function Rl(e,t){return e>=t?[]:e>0n?[0n,t]:[t]}function zl(e,t,n=Date.now()){return n>=e+t}function Bl(e,t){return e.filter(e=>e.args?.candidateId?.toLowerCase()===t.toLowerCase()).at(-1)?.transactionHash}function Vl(e,t,n,r,i){for(let a of e.logs)if(a.address.toLowerCase()===t.tangleAddress.toLowerCase())try{let e=He({abi:[yl],eventName:`JobSubmitted`,data:a.data,topics:a.topics});if(e.args.serviceId===t.serviceId&&e.args.jobIndex===n&&e.args.caller.toLowerCase()===r.toLowerCase()&&(!i||e.args.inputs.toLowerCase()===i.toLowerCase()))return e.args.callId}catch{}throw Error(`Tangle did not emit job ${n} for ${r}`)}function Hl(e,t,n,r){for(let i of e.logs)if(i.address.toLowerCase()===t.managerAddress.toLowerCase())try{let e=He({abi:[Cl],eventName:`EvaluationAccepted`,data:i.data,topics:i.topics}).args;if(e.serviceId===t.serviceId&&e.competitionId===t.competitionId&&e.researcher.toLowerCase()===n.address.toLowerCase()&&e.candidateId.toLowerCase()===r.toLowerCase())return!0}catch{}return!1}function Ul(e){if(e.chainId!==$e.id)throw Error(`Solve submissions require Tempo Moderato (chain ${$e.id}); received ${e.chainId}`);if(!e.sponsorUrl)throw Error(`Solve submissions require a Tempo sponsor relay URL; unsponsored writes are disabled`);return{...$e,name:e.chainName,nativeCurrency:{name:e.nativeSymbol,symbol:e.nativeSymbol,decimals:18},rpcUrls:{default:{http:[e.rpcUrl]}}}}async function Wl(e,t){Bc(e);let n=Ul(e),r=ze({chain:n,transport:Ge(e.rpcUrl)});return Pl(await r.getChainId(),e.chainId),await Gl({publicClient:r},e),{publicClient:r,walletClient:Be({account:t,chain:n,transport:tt(Ge(e.rpcUrl),Ge(e.sponsorUrl))}),account:t}}async function Gl(e,t){let n=await e.publicClient.readContract({address:t.tangleAddress,abi:wl,functionName:`getServicePaymentAsset`,args:[t.serviceId]});if(n.toLowerCase()!==t.paymentAsset.toLowerCase())throw Error(`Tempo service payment asset ${n} does not match the trusted Solve asset ${t.paymentAsset}`)}async function Kl(e,t,n){let[r,i]=await Promise.all([e.publicClient.readContract({address:t.tangleAddress,abi:wl,functionName:`getJobEventRate`,args:[t.blueprintId,n]}),e.publicClient.readContract({address:t.tangleAddress,abi:wl,functionName:`getServicePaymentAsset`,args:[t.serviceId]})]);if(i.toLowerCase()!==t.paymentAsset.toLowerCase())throw Error(`Tempo job payment asset ${i} does not match the trusted Solve asset ${t.paymentAsset}`);return{asset:i,amount:r,value:i===`0x0000000000000000000000000000000000000000`?r:0n}}async function ql(e,t,n){return await e.publicClient.readContract({address:t,abi:El,functionName:`allowance`,args:[e.account.address,n.tangleAddress]})}async function Jl(e,t,n,r,i,a){let o=Date.now();for(;!zl(o,a);){if((await e.publicClient.getLogs({address:t.tangleAddress,event:bl,args:{serviceId:t.serviceId,callId:n},fromBlock:r,toBlock:`latest`})).length>0){let a=(await e.publicClient.getLogs({address:t.tangleAddress,event:xl,args:{serviceId:t.serviceId,callId:n},fromBlock:r,toBlock:`latest`}))[0]?.args.result;if(!a)throw Error(`Tangle job ${n} completed without a result`);let[o,s]=Ve(Ml,a);if(o!==i)throw Error(`Tangle job ${n} ${o}: ${s}`);return{status:o,detail:s}}await new Promise(e=>setTimeout(e,1e3))}throw Error(`Tangle job ${n} did not complete within 120 seconds`)}async function Yl(e,t,n,r,i){let a=Date.now();for(;!zl(a,i);){let i=(await e.publicClient.getLogs({address:t.tangleAddress,event:Sl,args:{serviceId:t.serviceId,callId:n},fromBlock:r,toBlock:`latest`}))[0]?.args.output;if(i)return i;await new Promise(e=>setTimeout(e,1e3))}throw Error(`Tangle job ${n} did not produce an aggregate within 120 seconds`)}async function Xl(e,t,n){return!!await e.publicClient.readContract({address:t.managerAddress,abi:Tl,functionName:`acceptedCandidates`,args:[t.serviceId,t.competitionId,e.account.address,n]})}const Zl=BigInt(qe(Ze(`tangle.solve.v1`)));async function Ql(e,t){let n=await et.nonce.getNonce(e.publicClient,{account:e.account.address,nonceKey:Zl});if(n>BigInt(2**53-1))throw Error(`The Solve transaction nonce exceeds the safe range`);return e.walletClient.writeContract(Fl(t,Zl,Number(n)))}async function $l(e,t,n,r){if(!await e.publicClient.readContract({address:t.tangleAddress,abi:wl,functionName:`isPermittedCaller`,args:[t.serviceId,e.account.address]}))try{let i=r??await Ql(e,{address:t.managerAddress,abi:Tl,functionName:`authorizeSelf`,args:[t.serviceId]});if(r||await n?.(`authorization`,i),Ll(await e.publicClient.waitForTransactionReceipt({hash:i}),i,`Authorization`,{from:e.account.address,to:t.managerAddress}),!await e.publicClient.readContract({address:t.tangleAddress,abi:wl,functionName:`isPermittedCaller`,args:[t.serviceId,e.account.address]}))throw Error(`authorization transaction did not add the device`);return i}catch(e){let t=e instanceof Error?e.message:`unknown chain error`;throw Error(`The competition manager did not authorize this device. The deployed manager must expose authorizeSelf(uint64): ${t}`)}}async function eu(e,t,n,r,i=`allowance`,a={}){if(t.amount===0n||t.asset===`0x0000000000000000000000000000000000000000`)return;let o=await ql(e,t.asset,n);for(let s of Rl(o,t.amount)){let o=s===0n?`${i}:reset`:`${i}:approval`,c=a[o];if(c){if(Ll(await e.publicClient.waitForTransactionReceipt({hash:c}),c,s===0n?`ERC-20 allowance reset`:`ERC-20 allowance approval`,{from:e.account.address,to:t.asset}),await ql(e,t.asset,n)!==s)throw Error(`${s===0n?`ERC-20 allowance reset`:`ERC-20 allowance approval`} did not set the expected allowance`);continue}let l=await Ql(e,{address:t.asset,abi:El,functionName:`approve`,args:[n.tangleAddress,s]});await r?.(o,l),Ll(await e.publicClient.waitForTransactionReceipt({hash:l}),l,s===0n?`ERC-20 allowance reset`:`ERC-20 allowance approval`,{from:e.account.address,to:t.asset})}}async function tu(e,t,n,r,i,a=`job:${n}`,o={}){let s=await Kl(e,t,n);await eu(e,s,t,i,`allowance:${a}`,o);let c=o[a],l=c??await Ql(e,{address:t.tangleAddress,abi:wl,functionName:`submitJob`,args:[t.serviceId,n,r],value:s.value});c||await i?.(a,l);let u=await e.publicClient.waitForTransactionReceipt({hash:l});return Ll(u,l,`Job ${n}`,{from:e.account.address,to:t.tangleAddress}),{hash:l,callId:Vl(u,t,n,e.account.address,r),blockNumber:u.blockNumber}}async function nu(e,t,n,r,i,a,o=`job:${n}`,s={}){let c=await tu(e,t,n,r,a,o,s),l=await Jl(e,t,c.callId,c.blockNumber,i,vl);return{...c,acknowledgement:l}}function ru(e,t){return qe(Ue(Al,[e.trim(),t]))}function iu(e){let t=/^submission=(\S+)/.exec(e);if(!t?.[1])throw Error(`COMMIT_CANDIDATE did not return a submission reference`);return t[1]}async function au(e,t,n,r,i){let a=i.resumeTransactions?.evaluation;if(a){let n=await e.publicClient.waitForTransactionReceipt({hash:a});if(Ll(n,a,`Evaluation`,{from:e.account.address,to:t.managerAddress}),!Hl(n,t,e.account,r))throw Error(`Saved evaluation transaction did not emit EvaluationAccepted for this candidate`);return a}let o=Date.now();for(;!zl(o,vl);){if(await Xl(e,t,r)){let i=Bl(await e.publicClient.getLogs({address:t.managerAddress,event:Cl,args:{serviceId:t.serviceId,competitionId:t.competitionId,researcher:e.account.address},fromBlock:n.blockNumber,toBlock:`latest`}),r);if(i)return i;throw Error(`Candidate is already accepted, but its EvaluationAccepted transaction is unavailable`)}let[a,o,,s,c]=await e.publicClient.readContract({address:t.managerAddress,abi:Tl,functionName:`pendingResults`,args:[t.serviceId,n.callId]});if(s&&a!==4)throw Error(`Manager pending result ${n.callId} has unexpected job ${a}`);if(s&&c)throw Error(`Manager executed the report without EvaluationAccepted`);if(s&&!c){if(o.toLowerCase()!==qe(n.output).toLowerCase())throw Error(`Manager pending report output does not match the aggregate`);let a=await Ql(e,{address:t.managerAddress,abi:Tl,functionName:`executePendingResult`,args:[t.serviceId,n.callId,n.output]});await i.onTransaction?.(`evaluation`,a);let s=await e.publicClient.waitForTransactionReceipt({hash:a});if(Ll(s,a,`Evaluation`,{from:e.account.address,to:t.managerAddress}),!Hl(s,t,e.account,r))throw Error(`Evaluation transaction did not emit EvaluationAccepted for this candidate`);return a}await new Promise(e=>setTimeout(e,1e3))}throw Error(`Manager did not emit EvaluationAccepted within 120 seconds`)}async function ou(e,t,n,r={}){if(Bc(e),!/^0x[0-9a-f]{64}$/i.test(n.salt))throw Error(`Reveal salt must be bytes32`);if(!n.artifactRef.trim())throw Error(`Candidate reference is required`);if(!n.evidenceJson.trim()||n.evidenceRefs.length===0)throw Error(`Checker evidence is required`);let i=await Wl(e,t),a=await $l(i,e,r.onTransaction,r.resumeTransactions?.authorization),o,s=await i.publicClient.readContract({address:e.managerAddress,abi:Tl,functionName:`stakes`,args:[e.serviceId,e.competitionId,i.account.address]});s<e.minStakeWei&&(o=await Ql(i,{address:e.managerAddress,abi:Tl,functionName:`postStake`,args:[e.serviceId,e.competitionId],value:e.minStakeWei-s}),await r.onTransaction?.(`stake`,o),Ll(await i.publicClient.waitForTransactionReceipt({hash:o}),o,`Stake`,{from:i.account.address,to:e.managerAddress}));let c=ru(n.artifactRef,n.salt),l=Ue(Dl,[e.competitionId,e.minStakeWei]),u=Ue(Ol,[e.competitionId,c]),d=Ue(kl,[e.competitionId,c,n.artifactRef.trim(),n.salt]),f=await nu(i,e,1,l,`joined`,r.onTransaction,`join`,r.resumeTransactions),p=await nu(i,e,2,u,`committed`,r.onTransaction,`commit`,r.resumeTransactions),m=iu(p.acknowledgement.detail),h=await nu(i,e,3,d,`revealed`,r.onTransaction,`reveal`,r.resumeTransactions),g=await tu(i,e,4,Ue(jl,[e.competitionId,c,m,n.evidenceJson,JSON.stringify(n.evidenceRefs)]),r.onTransaction,`report`,r.resumeTransactions),_=await Yl(i,e,g.callId,g.blockNumber,vl),ee=await au(i,e,{callId:g.callId,output:_,blockNumber:g.blockNumber},c,r);return{address:i.account.address,...a?{authorization:a}:{},...o?{stake:o}:{},join:f.hash,commit:p.hash,reveal:h.hash,report:g.hash,evaluation:ee,candidateId:c,submissionRef:m}}const su=Re(ye),cu=`/usr/bin/bwrap`,lu=[`/usr`,`/bin`,`/sbin`,`/lib`,`/lib64`];function uu(e){return[...e].some(e=>{let t=e.charCodeAt(0);return t<32||t===127})}function du(e,t){if(!e||e.length>2048||uu(e))throw Error(`${t} contains invalid control characters or is too long`)}function X(e,t){let n=t;for(;n<e.length&&/\s/.test(e[n]??``);)n+=1;return n}function fu(e,t){if(e[t]!==`"`)throw Error(`Checker output must be valid JSON`);let n=t+1;for(;n<e.length;){let t=e[n];if(t===`\\`){n+=2;continue}if(t===`"`)return n+1;if((t?.charCodeAt(0)??0)<32)throw Error(`Checker output must be valid JSON`);n+=1}throw Error(`Checker output must be valid JSON`)}function pu(e,t,n){let r=new Set,i=X(e,t+1);if(e[i]===`}`)return i+1;for(;i<e.length;){let t=fu(e,i),a=JSON.parse(e.slice(i,t));if(r.has(a))throw Error(`Checker output must not contain duplicate object keys`);if(r.add(a),i=X(e,t),e[i]!==`:`)throw Error(`Checker output must be valid JSON`);let o=X(e,i+1),s=hu(e,o);if(n?.(a,o,s),i=X(e,s),e[i]===`}`)return i+1;if(e[i]!==`,`)throw Error(`Checker output must be valid JSON`);i=X(e,i+1)}throw Error(`Checker output must be valid JSON`)}function mu(e,t){let n=X(e,t+1);if(e[n]===`]`)return n+1;for(;n<e.length;){if(n=X(e,hu(e,n)),e[n]===`]`)return n+1;if(e[n]!==`,`)throw Error(`Checker output must be valid JSON`);n=X(e,n+1)}throw Error(`Checker output must be valid JSON`)}function hu(e,t){if(e[t]===`"`)return fu(e,t);if(e[t]===`{`)return pu(e,t);if(e[t]===`[`)return mu(e,t);let n=t;for(;n<e.length&&!/[\s,\]}]/.test(e[n]??``);)n+=1;return n}function gu(e){let t=e.trim();if(X(t,hu(t,0))!==t.length)throw Error(`Checker output must be valid JSON`)}function _u(e,t){let n=e.trim();if(n[0]!==`{`)return;let r;return pu(n,0,(e,i,a)=>{e===t&&(r=n.slice(i,a).trim())}),r}function vu(e,t){let n=e.trim(),r=[];return pu(n,0,(e,i,a)=>{if(e===`evidence_refs`)return;let o=e===`candidate_ref`?JSON.stringify(t):n.slice(i,a).trim();r.push(`${JSON.stringify(e)}:${o}`)}),`{${r.join(`,`)}}`}function yu(e){let t;try{t=JSON.parse(e)}catch{throw Error(`Checker output must be one JSON object`)}if(gu(e),!t||typeof t!=`object`||Array.isArray(t))throw Error(`Checker output must be a JSON object`);let n=t,r=n.candidate_ref;if(typeof r!=`string`||!r.trim())throw Error(`Checker output must include candidate_ref`);let i=r.trim(),a=n.evidence_refs;if(!Array.isArray(a)||a.length===0||a.some(e=>typeof e!=`string`||!e.trim()))throw Error(`Checker output must include a non-empty evidence_refs array`);du(i,`candidate_ref`);for(let e of a)du(e.trim(),`evidence_refs`);let o,s;if(n.evidence_json!==void 0){if(!n.evidence_json||typeof n.evidence_json!=`object`||Array.isArray(n.evidence_json))throw Error(`Checker evidence_json must be an object`);o={...n.evidence_json};let t=_u(e,`evidence_json`);if(!t)throw Error(`Checker evidence_json source text is missing`);if(s=t,o.candidate_ref!==i)throw Error(`Checker evidence_json candidate_ref must match candidate_ref`)}else{let{evidence_refs:t,...r}=n;o=r,o.candidate_ref=i,s=vu(e,i)}return{candidateRef:i,evidenceRefs:a.map(e=>e.trim()),evidence:o,evidenceJson:s}}async function bu(e,t,n){let r=n.trim();if(r.startsWith(`{`)&&r.endsWith(`}`)||!t.result_file)return r;let i=await Eu(e),a=S.resolve(i,t.result_file),o=S.relative(i,a);if(o.startsWith(`..`)||S.isAbsolute(o))throw Error(`Checker result_file must stay inside the competition repository`);let s;try{s=await w.lstat(a)}catch{throw Error(`Checker result_file must be an existing regular file inside the competition repository`)}if(s.isSymbolicLink())throw Error(`Checker result_file must not be a symbolic link`);if(!s.isFile())throw Error(`Checker result_file must be an existing regular file inside the competition repository`);let c;try{c=await w.realpath(a)}catch{throw Error(`Checker result_file must resolve to a regular file inside the competition repository`)}let l=S.relative(i,c);if(l.startsWith(`..`)||S.isAbsolute(l))throw Error(`Checker result_file must stay inside the competition repository`);return(await w.readFile(c,`utf8`)).trim()}function xu(e,t){let n=S.relative(e,t);return n===``||!n.startsWith(`..`)&&!S.isAbsolute(n)}function Su(e){return lu.some(t=>xu(t,e))}async function Cu(e,t,n){let r=e.includes(`/`)?[S.resolve(t,e)]:(process.env.PATH??``).split(S.delimiter).filter(Boolean).map(t=>S.join(t,e));for(let i of r){let r;try{r=await w.realpath(i),await w.access(r,w.constants.X_OK)}catch{continue}if(!xu(t,r)&&!Su(r)&&r!==n)throw Error(`Checker executable '${e}' must resolve inside the competition repository or a trusted runtime directory`);return r}throw Error(`Checker executable '${e}' was not found`)}async function wu(e){let t=[];for(let n of e)try{(await w.stat(n)).isDirectory()&&t.push(n)}catch{}return t}async function Tu(e){let t=await w.realpath(ge.homedir());if(e===S.parse(e).root||e===t)throw Error(`Solve checker repository must be a dedicated directory, not the filesystem or home root`)}async function Eu(e){let t=await w.realpath(e);return await Tu(t),t}async function Du(e){let t=S.join(e,`.git`),n;try{n=await w.lstat(t)}catch{return}if(n.isSymbolicLink())throw Error(`Solve checker repository .git must not be a symbolic link`);if(!n.isDirectory()&&!n.isFile())return;let r;try{let t={...process.env};for(let e of[`GIT_DIR`,`GIT_WORK_TREE`,`GIT_INDEX_FILE`,`GIT_OBJECT_DIRECTORY`,`GIT_ALTERNATE_OBJECT_DIRECTORIES`,`GIT_COMMON_DIR`,`GIT_CONFIG_COUNT`,`GIT_CONFIG_PARAMETERS`])delete t[e];let n=await su(`/usr/bin/git`,[`-C`,e,`rev-parse`,`--verify`,`HEAD^{commit}`],{encoding:`utf8`,maxBuffer:1e5,env:{...t,GIT_CONFIG_GLOBAL:`/dev/null`,GIT_CONFIG_SYSTEM:`/dev/null`,GIT_CONFIG_NOSYSTEM:`1`,GIT_TERMINAL_PROMPT:`0`}}),i=String(n.stdout).trim();/^[0-9a-f]{40}$/i.test(i)&&(r=i.toLowerCase())}catch{}return{kind:n.isDirectory()?`directory`:`file`,...r?{commit:r}:{}}}async function Ou(e,t,n){let r=await Eu(e);if(process.platform!==`linux`)throw Error(`Solve checkers require the Linux sandbox runtime (bubblewrap) with network isolation`);try{await w.access(cu,w.constants.X_OK)}catch{throw Error(`Solve checkers require /usr/bin/bwrap; install bubblewrap or run the checker in a Tangle sandbox`)}let i=await Cu(t,r,await w.realpath(process.execPath)),a=await Du(r),o=(await wu(lu)).flatMap(e=>[`--ro-bind`,e,e]),s=xu(r,i)?`/work/${S.relative(r,i)}`:Su(i)?i:`/checker/node`;!xu(r,i)&&!Su(i)&&o.push(`--ro-bind`,i,`/checker/node`);let c=a?.kind===`directory`?[`--tmpfs`,`/work/.git`]:a?.kind===`file`?[`--ro-bind`,`/dev/null`,`/work/.git`]:[];return{executable:cu,args:[`--die-with-parent`,`--new-session`,`--unshare-all`,`--clearenv`,...o,`--proc`,`/proc`,`--dev`,`/dev`,`--tmpfs`,`/tmp`,`--dir`,`/tmp/home`,`--bind`,r,`/work`,...c,`--chdir`,`/work`,`--setenv`,`HOME`,`/tmp/home`,...a?.commit?[`--setenv`,`TANGLE_SOLVE_COMMIT`,a.commit]:[],`--setenv`,`TMPDIR`,`/tmp`,`--setenv`,`PATH`,`/checker:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,`--setenv`,`LANG`,`C.UTF-8`,`--setenv`,`PYTHONDONTWRITEBYTECODE`,`1`,`--setenv`,`XDG_CONFIG_HOME`,`/tmp/home/.config`,`--setenv`,`XDG_CACHE_HOME`,`/tmp/home/.cache`,`--setenv`,`XDG_DATA_HOME`,`/tmp/home/.local/share`,`--setenv`,`GIT_CONFIG_GLOBAL`,`/dev/null`,`--setenv`,`GIT_CONFIG_SYSTEM`,`/dev/null`,`--setenv`,`NPM_CONFIG_USERCONFIG`,`/dev/null`,s,...n]}}async function ku(e,t){if(!t.command||t.command.includes(`/../`)||uu(t.command))throw Error(`The competition checker command is invalid`);if(!Array.isArray(t.args))throw Error(`The competition checker arguments must be an array`);for(let e of t.args)du(e,`Checker argument`);let n=t.timeout_ms??15*6e4;if(!Number.isSafeInteger(n)||n<1e3||n>60*6e4)throw Error(`Checker timeout must be between one second and one hour`);let r=await Eu(e),i;try{let e=await Ou(r,t.command,t.args);i=await su(e.executable,e.args,{cwd:r,timeout:n,maxBuffer:4194304,encoding:`utf8`})}catch(e){let t=e,n=t.stderr?.trim()||t.stdout?.trim()||t.message||`checker failed`;throw Error(`Pinned checker failed: ${n}`)}let a=String(i.stdout),o=String(i.stderr);return{...yu(await bu(r,t,a)),stdout:a,stderr:o}}async function Au(e,t){try{let{root:n,manifest:a}=await el(e,t.directory),o=await al(n),s=a.provenance?await ol(n,a,o,{allowMissing:!0}):void 0,c=xc(),l=P(`Running ${a.title} checker…`);t.json||l.start();let u;try{u=await ku(n,a.checker)}finally{l.stop()}let d=ul(u,s,a.provenance,void 0,{allowMissingSource:!0,requirePullRequest:!1}),f=Qe(r(32)),p=ru(u.candidateRef,f),m={version:1,competition:a.slug,candidateRef:u.candidateRef,evidence:d.evidence,evidenceJson:u.evidenceJson,evidenceRefs:d.evidenceRefs,salt:f,candidateId:p,...s?{source:s}:{},deviceAddress:c.account.address,clientSubmissionId:i(),createdAt:new Date().toISOString()};await dl(S.join(n,`.tangle-solve-run.json`),m),t.json?A({localRun:m}):(j(`Checker output recorded locally for operator evaluation`),F({Competition:a.slug,Candidate:u.candidateRef,"Device address":c.account.address,"Evidence refs":d.evidenceRefs.length}),N("Commit any changes, then run `tangle solve submit` from this directory."),a.provenance&&!s&&N(`Add your GitHub fork as 'origin' before submitting. The task repository is available as '${Qc}'.`))}catch(e){L(e)}}const ju=/^0x[0-9a-f]{64}$/i;async function Mu(e){let t=await Rc({deviceAddress:e.deviceAddress,apiUrl:e.apiUrl,profile:e.profile}),n=await e.signer.signMessage({message:t.message});return{walletChallengeId:t.challengeId,walletSignature:n}}async function Nu(e,t){try{let{root:n,manifest:r}=await el(e,t.directory);Fc({profile:t.profile});let i=await al(n),a=await fl(n);if(a.competition!==r.slug)throw Error(`.tangle-solve-run.json does not match this competition`);if(!ju.test(a.salt)||!ju.test(a.candidateId))throw Error("This run predates durable candidate identity. Run `tangle solve run` again");let o=r.provenance?await ol(n,r,i):void 0;if(r.provenance&&a.source&&!cl(a.source,o))throw Error("The saved run points to a different repository or revision. Keep your fork as 'origin' and run `tangle solve run` again before submitting");let s=bc();if(!s)throw Error("No Solve device signer found. Run `tangle solve run` first");if(s.account.address.toLowerCase()!==a.deviceAddress.toLowerCase())throw Error("The local Solve device account changed after `tangle solve run`; run the checker again");let c=P(`Checking the committed candidate…`);t.json||c.start();let l;try{l=await ku(n,r.checker)}finally{c.stop()}if(l.candidateRef!==a.candidateRef||l.evidenceJson!==a.evidenceJson)throw Error("The committed checker output changed after `tangle solve run`; run the checker again");if(ru(l.candidateRef,a.salt).toLowerCase()!==a.candidateId.toLowerCase())throw Error(`The saved candidate identity does not match the checker output; run the checker again`);let u=Nc(t.prUrl);if(!r.provenance&&u)throw Error(`This competition does not accept GitHub pull request provenance`);if(u){if(!o)throw Error(`A provenance policy is required for a pull request`);await pl({pullRequest:u,taskRepository:o.taskRepository,submissionRepository:o.submissionRepository,submissionRevision:i})}let d=ul(l,o,r.provenance,u,{requirePullRequest:!0}),f={...a,...o?{source:o}:{},chainState:{status:`submitting`,transactions:{...a.chainState?.transactions??{}}}},p=S.join(n,`.tangle-solve-run.json`);await dl(p,f);let m=P(`Submitting candidate to Tempo…`);t.json||m.start();let h;try{h=await ou(Gc(r),s.account,{artifactRef:l.candidateRef,salt:a.salt,evidenceJson:l.evidenceJson,evidenceRefs:d.evidenceRefs},{resumeTransactions:f.chainState?.transactions,onTransaction:async(e,t)=>{f={...f,chainState:{status:`submitting`,transactions:{...f.chainState?.transactions??{},[e]:t}}},await dl(p,f)}})}finally{m.stop()}f={...f,chainReceipt:h,chainState:{status:`accepted`,transactions:{...f.chainState?.transactions??{},...ml(h)}}},await dl(p,f);let g=await Mu({deviceAddress:h.address,signer:s.account,apiUrl:t.apiUrl,profile:t.profile}),_=await Lc({path:`/v1/submissions`,method:`POST`,apiUrl:t.apiUrl,profile:t.profile,body:{competition:r.slug,candidateRef:l.candidateRef,candidateId:h.candidateId,evidenceJson:l.evidenceJson,evidenceRefs:d.evidenceRefs,deviceAddress:h.address,reportTxHash:h.report,evaluationTxHash:h.evaluation,transactions:ml(h),...r.provenance&&o?{source:{...o,...u?{pullRequest:u}:{}}}:{},clientSubmissionId:a.clientSubmissionId,...g,...t.model?{model:t.model}:{},...t.note?{note:t.note}:{}}});t.json?A({..._,transactions:ml(h),candidateId:h.candidateId}):(j(`Submission accepted on Tempo`),F({Competition:r.slug,Candidate:h.candidateId,"Device address":h.address,"Report transaction":h.report,"Evaluation transaction":h.evaluation,"Submission ID":typeof _.id==`string`?_.id:_.submission?.id}))}catch(e){L(e)}}function Pu(){let e=new t(`solve`).description(`Participate in Tangle Solve competitions`);return e.command(`clone <competition>`).description(`Clone the pinned competition repository`).argument(`[directory]`,`Destination directory`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).option(`--json`,`Output JSON`).action(_l),e.command(`run [competition]`).description(`Run the competition checker and record its evidence`).option(`--directory <path>`,`Competition directory (defaults to the current directory)`).option(`--json`,`Output JSON`).action(Au),e.command(`submit [competition]`).description(`Submit checker evidence through the device account and Tempo`).option(`--directory <path>`,`Competition directory (defaults to the current directory)`).option(`--pr-url <url>`,`GitHub pull request containing the submission`).option(`--model <name>`,`Model used to produce the submission`).option(`--note <text>`,`Short note shown with the accepted submission`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).option(`--json`,`Output JSON`).action(Nu),e.command(`account`).description(`Show the local Solve signing account`).option(`--create`,`Create the account if it does not exist`).option(`--json`,`Output JSON`).action(Sc),e}function Fu(e,t){return`tangle ssh-proxy ${e.replace(/\/+$/,``)}/v1/sidecar-proxy/${t}/ssh`}function Iu(e){return/^[A-Za-z0-9_/:=@%+.,-]+$/.test(e)?e:`'${e.replace(/'/g,`'"'"'`)}'`}function Lu(e){return`'${e.replace(/'/g,`''`)}'`}function Ru(e){return e===`win32`?`NUL`:`/dev/null`}function zu(e,t){return t===`win32`?`$env:TANGLE_SSH_PROXY_AUTH_TOKEN=${Lu(`<token>`)}; ssh ${e.map(Lu).join(` `)}`:`TANGLE_SSH_PROXY_AUTH_TOKEN=${Iu(`<token>`)} ssh ${e.map(Iu).join(` `)}`}function Bu(e){return e.connection!==void 0&&!e.connection.ssh}function Vu(){qn(`SSH is not enabled for this sandbox.`),N(`Create a sandbox with --ssh to enable SSH access.`),process.exit(1)}function Hu(e,t=[],n=process.platform){let r=Ru(n);return[`-o`,`ProxyCommand=${e.proxyCommand}`,`-o`,`StrictHostKeyChecking=no`,`-o`,`UserKnownHostsFile=${r}`,`-o`,`GlobalKnownHostsFile=${r}`,`-o`,`LogLevel=ERROR`,`-o`,`ServerAliveInterval=15`,`-o`,`ServerAliveCountMax=4`,`-o`,`TCPKeepAlive=yes`,`${e.username}@localhost`,`-p`,String(e.port),...t]}function Uu(){return new t(`ssh`).description(`Open SSH session to a sandbox`).argument(`<ref>`,`Sandbox ID or name`).argument(`[sshArgs...]`,`Extra args passed through to ssh`).option(`-i, --identity-file <path>`,`Private key file to pass to ssh`).option(`--print`,`Print SSH command instead of connecting`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).allowUnknownOption(!0).action(async(e,t,n)=>{try{let r=D({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=O(r),a=P(`Getting SSH credentials...`);a.start();let o=await z(i,r,e);if(Bu(o)){a.stop(),Vu();return}o=await B(o);let s=await o.ssh();if(a.stop(),!s){Vu();return}let c={...s,proxyCommand:Fu(r.baseUrl,o.id)};if(!r.apiKey)throw Error(`SSH proxy requires API key auth. Set TANGLE_API_KEY or pass --api-key.`);let l=Hu(c,[...n.identityFile?[`-i`,n.identityFile,`-o`,`IdentitiesOnly=yes`]:[],...t]);if(n.print){console.log(zu(l,process.platform));return}N(`Connecting via tunnel...`);let u=xe(`ssh`,l,{stdio:`inherit`,env:{...process.env,TANGLE_SSH_PROXY_AUTH_TOKEN:r.apiKey}});u.on(`error`,e=>{e.code===`ENOENT`&&(qn(`SSH client not found. Please install OpenSSH.`),process.exit(1)),L(e)}),u.on(`exit`,e=>{process.exit(e??0)})}catch(e){L(e)}})}function Wu(){let e=new t(`ssh-keys`).description(`Manage SSH keys`);return e.command(`list`).description(`List SSH keys`).option(`--json`,`Output as JSON`).action(async e=>{let t=P(`Fetching SSH keys...`);try{t.start();let n=await O(D(e)).sshKeys.list();t.stop(),e.json?A({sshKeys:n}):n.length===0?N(`No SSH keys found.`):I([`Name`,`Type`,`Fingerprint`,`Created`],n.map(e=>[e.name,e.keyType,e.fingerprint,e.createdAt.toLocaleString()]))}catch(e){t.stop(),L(e)}}),e.command(`add`).description(`Add SSH key`).argument(`<name>`,`SSH key name`).requiredOption(`--key-file <path>`,`Public key file path`).option(`--json`,`Output as JSON`).action(async(e,t)=>{let n=P(`Adding SSH key...`);try{let r=x(t.keyFile,`utf8`).trim();n.start();let i=await O(D(t)).sshKeys.create(e,r);n.stop(),t.json?A({sshKey:i}):j(`Added SSH key ${i.name} (${i.fingerprint})`)}catch(e){n.stop(),L(e)}}),e.command(`delete`).description(`Delete SSH key`).argument(`<name>`,`SSH key name or ID`).action(async(e,t)=>{let n=P(`Deleting SSH key...`);try{n.start(),await O(D(t)).sshKeys.delete(e),n.stop(),j(`Deleted SSH key ${e}`)}catch(e){n.stop(),L(e)}}),e}function Gu(e,t=1){process.stderr.write(`${e}\n`),process.exit(t)}function Ku(){return new t(`ssh-proxy`).description(`SSH proxy helper that pipes stdin/stdout to WebSocket`).argument(`<runtime-url>`,`Runtime WebSocket URL`).action(async e=>{let t=process.env.TANGLE_SSH_PROXY_AUTH_TOKEN;t||Gu(`TANGLE_SSH_PROXY_AUTH_TOKEN not set`);let n=new nt(new URL(e.replace(/^http/,`ws`)),{headers:{Authorization:`Bearer ${t}`},perMessageDeflate:!1}),r;function i(){r&&=(clearInterval(r),void 0)}n.on(`open`,()=>{r=setInterval(()=>{n.readyState===nt.OPEN&&n.ping()},15e3),r.unref?.(),process.stdin.on(`data`,e=>{n.readyState===nt.OPEN&&n.send(e,{binary:!0,compress:!1})}),process.stdin.on(`end`,()=>n.close(1e3))}),n.on(`message`,e=>{let t=Buffer.isBuffer(e)?e:Array.isArray(e)?Buffer.concat(e):Buffer.from(e);process.stdout.write(t)}),n.on(`error`,e=>{i(),Gu(`WebSocket error: ${e.message}`)}),n.on(`close`,e=>{i(),process.exit(e===1e3?0:1)}),process.stdin.on(`error`,()=>n.close())})}const qu=[`claude-code`,`opencode`,`codex`,`kimi-code`,`prime`],Ju=[`project`,`read-only`],Yu={min:1,max:15},Xu=process.env.TANGLE_ROUTER_URL??`https://router.tangle.tools/v1`;function Zu(e){let t=s(e);if(t)return t;throw Error(`--model '${e}' has no provider. Pass a canonical id, for example 'google/${e}'.`)}function Qu(e,t){return{...e,harness:t}}function $u(e){let t=e.harness??`claude-code`;if(!qu.includes(t))throw Error(`Unknown --harness '${t}'. Supported: ${qu.join(`, `)}.`);let n=e.tokenScope??`project`;if(!Ju.includes(n))throw Error(`Unknown --token-scope '${n}'. Supported: ${Ju.join(`, `)}.`);let r=ed(e.maxTokens,2e5,`--max-tokens`),i=ed(e.maxIterations,50,`--max-iterations`),a=ed(e.tokenTtl,10,`--token-ttl`);if(a<Yu.min||a>Yu.max)throw Error(`--token-ttl ${a} out of range; the SDK clamps to [${Yu.min}, ${Yu.max}] minutes.`);let o=e.maxWorkers===void 0?void 0:ed(e.maxWorkers,0,`--max-workers`);return{harness:t,...e.model?{model:e.model}:{},maxTokens:r,maxIterations:i,tokenScope:n,tokenTtl:a,...o===void 0?{}:{maxWorkers:o}}}function ed(e,t,n){if(e===void 0)return t;let r=Number.parseInt(e,10);if(!Number.isFinite(r)||r<=0)throw Error(`${n} must be a positive integer, got '${e}'.`);return r}function td(e){let t={maxTokens:e.maxTokens,maxIterations:e.maxIterations};return e.maxWorkers===void 0?{budget:t}:{budget:t,perWorker:{maxTokens:Math.max(1,Math.floor(e.maxTokens/e.maxWorkers)),maxIterations:Math.max(1,Math.floor(e.maxIterations/e.maxWorkers))}}}function nd(e){let{client:t,scope:n,ttlMinutes:r,onScope:i}=e,a={async create(e){let a=await t.create(rd(e)),o={scope:n,ttlMinutes:r},s=await a.mintScopedToken(o);return i({id:a.id,scope:s.scope,expiresAt:s.expiresAt,status:`spawned`}),a}};return typeof t.criuStatus==`function`&&(a.criuStatus=t.criuStatus.bind(t)),a}function rd(e){if(!e?.env)return e;let{TANGLE_API_KEY:t,...n}=e.env;return{...e,env:n}}function id(e){let t=e.spentTotal,n={tokenUsage:{input:t.tokensKnown===!1?null:t.tokens.input,output:t.tokensKnown===!1?null:t.tokens.output},costUsd:t.usdKnown===!1?null:t.usd};if(e.kind===`no-winner`)return{text:``,...n,status:`no-winner (${e.reason})`};let r=e.out;return{text:typeof r==`string`?r:ad(r)?r.content:JSON.stringify(r),...n,status:`winner`}}function ad(e){return typeof e==`object`&&!!e&&typeof e.content==`string`}const od={makeClient:e=>O(D({apiKey:e.apiKey,baseUrl:e.baseUrl})),resolveRouter:e=>({routerBaseUrl:Xu,routerKey:D({apiKey:e.apiKey}).apiKey}),supervise:rt};async function sd(e,t,n,r=od){let a=r.makeClient({apiKey:n.apiKey,baseUrl:n.baseUrl}),{budget:o,perWorker:s}=td(t),c=[],l=it({backend:`sandbox`,sandboxClient:nd({client:a,scope:t.tokenScope,ttlMinutes:t.tokenTtl,onScope:e=>{if(c.push(e),!n.json){let n=`ttl ${t.tokenTtl}m`;N(`worker ${e.id} [${e.scope} token ${n}] spawned`)}}}),maxIterations:1}),u=(e,n)=>l(Qu(e,t.harness),n),d={name:`supervisor`,harness:`cli-base`,model:{default:t.model??`gemini-2.5-flash-lite`,provider:t.model?Zu(t.model):`google`}},f=r.resolveRouter({apiKey:n.apiKey}),p=id(await r.supervise(d,{goal:e},{budget:o,makeWorkerAgent:u,router:f,...s?{perWorker:s}:{},...t.model?{allowedModels:[t.model]}:{},runId:`supervise-${i()}`})),m=p.status===`winner`?`settled`:`failed`;for(let e of c)e.status=m,n.json||N(`worker ${e.id} [${e.scope} token ttl ${t.tokenTtl}m] settled (${e.status})`);return{task:e,result:p.text,workers:c,tokenUsage:p.tokenUsage,costUsd:p.costUsd,status:p.status}}function cd(){let e=new t(`supervise`);return e.description(`Run a budget-conserving supervisor that spawns isolated sandbox workers to deliver a task. Each worker box mints a short-lived scoped token instead of receiving the root API key.`).argument(`<task>`,`What the supervisor should accomplish`).option(`--harness <name>`,`Worker harness (${qu.join(` | `)})`,`claude-code`).option(`--model <id>`,`Model for the supervisor + workers`).option(`--max-tokens <n>`,`Conserved token budget for the whole run`,`200000`).option(`--max-iterations <n>`,`Conserved iteration budget for the whole run`,`50`).option(`--token-scope <scope>`,`Per-worker token scope (${Ju.join(` | `)})`,`project`).option(`--token-ttl <min>`,`Per-worker token TTL in minutes (SDK clamps to [1, 15])`,`10`).option(`--max-workers <n>`,`Bound the fanout; each worker reserves floor(max-tokens / n) tokens and floor(max-iterations / n) iterations`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=$u({harness:t.harness,model:t.model,maxTokens:t.maxTokens,maxIterations:t.maxIterations,tokenScope:t.tokenScope,tokenTtl:t.tokenTtl,maxWorkers:t.maxWorkers});t.json||(N(`Supervising: ${e}`),N(`harness=${n.harness} budget=${n.maxTokens}tok/${n.maxIterations}it scope=${n.tokenScope} ttl=${n.tokenTtl}m`),console.log());let r=await sd(e,n,{apiKey:t.apiKey,baseUrl:t.baseUrl,json:t.json});if(t.json){A(r),r.status!==`winner`&&(process.exitCode=1);return}if(console.log(),r.result&&(console.log(r.result),console.log()),F({"Input Tokens":r.tokenUsage.input??`Unavailable`,"Output Tokens":r.tokenUsage.output??`Unavailable`,Cost:r.costUsd===null?`Unavailable`:`$${r.costUsd.toFixed(4)}`}),r.status!==`winner`)throw Error(`Supervisor finished without a winner: ${r.status}`)}catch(e){L(e,t.json)}}),e}function ld(){let e=new t(`team`).description(`Manage teams`);return e.command(`list`).description(`List teams for the current account`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async e=>{try{let t=D(e),n=O(t),r=e.json?null:P(`Fetching teams...`);r?.start();let i=await n.teams.list();if(r?.stop(),e.json){A({teams:i,activeTeamId:t.activeTeamId??null});return}k(i.map(e=>({active:e.id===t.activeTeamId,id:e.id,name:e.name,role:e.currentUserRole,members:e.memberCount})),[{key:`active`,header:`Active`,width:8},{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:24},{key:`role`,header:`Role`,width:10},{key:`members`,header:`Members`,width:10}])}catch(e){L(e)}}),e.command(`create <name>`).description(`Create a team`).option(`--org-id <id>`,`External organization id`).option(`--no-switch`,`Do not set the new team as active`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=D(t),r=O(n),i=t.json?null:P(`Creating team...`);i?.start();let a=await r.teams.create({name:e,orgId:t.orgId});if(t.switch&&Ys(a,n.profile),i?.stop(),t.json){A({team:a,active:!!t.switch});return}j(`Team created: ${qs(a)}`),t.switch&&j(`Active team set to ${a.name}`)}catch(e){L(e)}}),e.command(`switch <team>`).description(`Set the active team for the current profile`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=D(t),r=await Js(O(n),e);if(Ys(r,n.profile),t.json){A({team:r,activeTeamId:r.id});return}j(`Active team set to ${qs(r)}`)}catch(e){L(e)}}),e.command(`current`).description(`Show the active team for the current profile`).option(`--json`,`Output as JSON`).option(`--profile <profile>`,`Credential profile`).action(e=>{try{let t=En(e.profile);if(e.json){A(t.activeTeamId?t:{activeTeamId:null});return}if(!t.activeTeamId){console.log(`No active team.`);return}F({ID:t.activeTeamId,Name:t.activeTeamName})}catch(e){L(e)}}),e.command(`clear`).description(`Clear the active team for the current profile`).option(`--json`,`Output as JSON`).option(`--profile <profile>`,`Credential profile`).action(e=>{try{if(Xs(e.profile),e.json){A({activeTeamId:null});return}j(`Active team cleared.`)}catch(e){L(e)}}),e.command(`members [team]`).description(`List team members`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=D(t),r=O(n),i=await K(r,e,n.profile),a=await r.teams.listMembers(i.id);if(t.json){A({team:i,members:a});return}k(a.map(e=>({id:e.id,email:e.customerEmail,role:e.role,status:e.status,joinedAt:e.joinedAt})),[{key:`id`,header:`ID`,width:36},{key:`email`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:10},{key:`joinedAt`,header:`Joined`,width:16}])}catch(e){L(e)}}),e.command(`update-member <member-id>`).description(`Update a team member role`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).requiredOption(`--role <role>`,`Role: admin, member, viewer`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=D(t),r=O(n),i=await K(r,t.team,n.profile),a=ud(t.role),o=await r.teams.updateMember(i.id,e,{role:a});if(t.json){A({team:i,member:o});return}j(`Member updated: ${o.customerEmail}`),F({Team:i.name,Role:o.role,Status:o.status})}catch(e){L(e)}}),e.command(`invite <email>`).description(`Invite a user to a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--role <role>`,`Role: admin, member, viewer`,`member`).option(`--ttl-hours <hours>`,`Invitation lifetime in hours`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=D(t),r=O(n),i=await K(r,t.team,n.profile),a=ud(t.role),o=await r.teams.invite(i.id,{email:e,role:a,ttlHours:t.ttlHours?Number.parseInt(t.ttlHours,10):void 0});if(t.json){A({team:i,invitation:o});return}j(`Invitation created for ${o.email}`),F({Team:i.name,Role:o.role,Expires:o.expiresAt,"Invitation ID":o.id}),j(`Re-run with --json to retrieve the invitation token for sharing.`)}catch(e){L(e)}}),e.command(`leave [team]`).description(`Leave a team as the current user`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=D(t),r=O(n),i=await K(r,e,n.profile);if(!t.force&&!t.json&&!await Pr(`Leave team '${i.name}'? (y/N) `))return;if(await r.teams.leave(i.id),n.activeTeamId===i.id&&Xs(n.profile),t.json){A({success:!0,teamId:i.id});return}j(`Left team: ${i.name}`)}catch(e){L(e)}}),e.command(`transfer <new-owner-customer-id> [team]`).description(`Transfer team ownership to another active member`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t,n)=>{try{let r=D(n),i=O(r),a=await K(i,t,r.profile);if(!n.force&&!n.json&&!await Pr(`Transfer ownership of '${a.name}' to ${e}? This cannot be undone without the new owner's cooperation. (y/N) `))return;if(await i.teams.transferOwnership(a.id,e),n.json){A({success:!0,teamId:a.id,newOwnerCustomerId:e});return}j(`Ownership transferred for ${a.name}`)}catch(e){L(e)}}),e.addCommand(dd()),e.addCommand(fd()),e.command(`invitations [team]`).description(`List pending and historical team invitations`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=D(t),r=O(n),i=await K(r,e,n.profile),a=await r.teams.listInvitations(i.id);if(t.json){A({team:i,invitations:a});return}k(a.map(e=>({id:e.id,email:e.email,role:e.role,status:e.status,expiresAt:e.expiresAt})),[{key:`id`,header:`ID`,width:38},{key:`email`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:12},{key:`expiresAt`,header:`Expires`,width:16}])}catch(e){L(e)}}),e.command(`accept <token>`).description(`Accept a team invitation`).option(`--no-switch`,`Do not set the accepted team as active`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=D(t),r=O(n),i=await r.teams.acceptInvitation(e),a=t.switch===!1?null:await r.teams.get(i.teamId);if(a&&Ys(a,n.profile),t.json){A({member:i,activeTeamId:a?.id??null});return}j(`Invitation accepted for team ${i.teamId}`),a&&j(`Active team set to ${a.name}`)}catch(e){L(e)}}),e.command(`revoke-invitation <invitation-id>`).description(`Revoke a pending team invitation`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{if(await O(D(t)).teams.revokeInvitation(e),t.json){A({success:!0,invitationId:e});return}j(`Invitation revoked: ${e}`)}catch(e){L(e)}}),e.command(`remove-member <member-id>`).description(`Remove a member from a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=D(t),r=O(n),i=await K(r,t.team,n.profile);if(await r.teams.removeMember(i.id,e),t.json){A({success:!0,teamId:i.id,memberId:e});return}j(`Member removed: ${e}`)}catch(e){L(e)}}),e}function ud(e){if(e===`admin`||e===`member`||e===`viewer`)return e;throw Error(`Role must be one of: admin, member, viewer`)}function dd(){let e=new t(`secret`).description(`Manage team secrets`);return e.command(`list [team]`).description(`List team secret names`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=D(t),r=O(n),i=await K(r,e,n.profile),a=await r.teams.listSecrets(i.id);if(t.json){A({team:i,secrets:a});return}k(a.map(e=>({name:e.name,updatedAt:e.updatedAt,updatedBy:e.updatedBy})),[{key:`name`,header:`Name`,width:28},{key:`updatedAt`,header:`Updated`,width:24},{key:`updatedBy`,header:`Updated By`,width:28}])}catch(e){L(e)}}),e.command(`set <name> [value]`).description(`Create or replace a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--value-stdin`,`Read secret value from stdin`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t,n)=>{try{let r=D(n),i=O(r),a=await K(i,n.team,r.profile),o=await pd({value:t,valueStdin:n.valueStdin,prompt:`Enter value for team secret '${e}': `}),s=await i.teams.upsertSecret(a.id,e,o);if(n.json){A({team:a,secret:s});return}j(`Team secret saved: ${s.name}`)}catch(e){L(e)}}),e.command(`delete <name>`).description(`Delete a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=D(t),r=O(n),i=await K(r,t.team,n.profile);if(!t.force&&!t.json&&!await Pr(`Delete team secret '${e}' from '${i.name}'? (y/N) `))return;if(await r.teams.deleteSecret(i.id,e),t.json){A({success:!0,teamId:i.id,name:e});return}j(`Team secret deleted: ${e}`)}catch(e){L(e)}}),e.command(`reveal <name>`).description(`Reveal a team secret value`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=D(t),r=O(n),i=await K(r,t.team,n.profile),a=await r.teams.revealSecret(i.id,e);if(t.json){A({teamId:i.id,...a});return}console.log(a.value)}catch(e){L(e)}}),e}function fd(){let e=new t(`templates`).description(`Manage team golden-path templates`);return e.command(`list [team]`).description(`List a team's golden-path templates`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=D(t),r=O(n),i=await K(r,e,n.profile),a=await r.teams.listTemplates(i.id);if(t.json){A({team:i,templates:a});return}if(a.length===0){console.log(`No templates yet for ${i.name}.`);return}k(a.map(e=>({id:e.id,name:e.name,environment:e.environment,snapshot:`${e.snapshotId.slice(0,12)}…`,updated:e.updatedAt})),[{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:28},{key:`environment`,header:`Env`,width:14},{key:`snapshot`,header:`Snapshot`,width:16},{key:`updated`,header:`Updated`,width:24}])}catch(e){L(e)}}),e.command(`create <name> <snapshot-id>`).description(`Create a golden-path template from a snapshot`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`-d, --description <description>`,`Human-readable description shown in the dashboard`).option(`-e, --environment <environment>`,`Default environment to apply (defaults to 'universal')`).option(`--config <json>`,`Optional JSON config object merged into sandboxes created from this template`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t,n)=>{try{let r=D(n),i=O(r),a=await K(i,n.team,r.profile),o;if(n.config)try{let e=JSON.parse(n.config);if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`--config must be a JSON object`);o=e}catch(e){throw Error(`--config is not valid JSON: ${e instanceof Error?e.message:String(e)}`)}let s=await i.teams.createTemplate(a.id,{name:e,snapshotId:t,description:n.description,environment:n.environment,config:o});if(n.json){A({team:a,template:s});return}j(`Team template created: ${s.name} (${s.id})`)}catch(e){L(e)}}),e.command(`delete <template-id>`).description(`Delete a team golden-path template`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).option(`--profile <profile>`,`Credential profile`).action(async(e,t)=>{try{let n=D(t),r=O(n),i=await K(r,t.team,n.profile);if(!t.force&&!t.json&&!await Pr(`Delete template '${e}' from '${i.name}'? (y/N) `))return;if(await r.teams.deleteTemplate(i.id,e),t.json){A({success:!0,teamId:i.id,templateId:e});return}j(`Team template deleted: ${e}`)}catch(e){L(e)}}),e}async function pd(e){if(e.value!==void 0&&e.valueStdin)throw Error(`Provide either a secret value argument or --value-stdin, not both`);if(e.value!==void 0){if(e.value.length===0)throw Error(`Secret value cannot be empty`);return e.value}if(e.valueStdin){let e=await Ir();if(e.length===0)throw Error(`Secret value from stdin cannot be empty`);return e}let t=await Nr(e.prompt);if(t.length===0)throw Error(`Secret value cannot be empty`);return t}function md(){let e=new t(`template`).description(`Manage published public templates`);return e.command(`list`).option(`-q, --query <query>`,`Search query`).option(`--tag <tag>`,`Filter by tag`).option(`--featured`,`Show featured templates only`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=O(D(e)),n=e.featured?await t.publicTemplates.featured():await t.publicTemplates.list({query:e.query,tag:e.tag});if(e.json){A({templates:n});return}k(n.map(e=>({slug:e.slug,name:e.name,forks:e.forkCount,sandboxes:e.sandboxCount,updated:e.updatedAt})),[{key:`slug`,header:`Slug`,width:28},{key:`name`,header:`Name`,width:28},{key:`forks`,header:`Forks`,width:8},{key:`sandboxes`,header:`Sandboxes`,width:12},{key:`updated`,header:`Updated`,width:24}])}catch(e){L(e)}}),e.command(`get <id-or-slug>`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await O(D(t)).publicTemplates.get(e);if(t.json){A({template:n});return}A(n)}catch(e){L(e)}}),e.command(`versions <id-or-slug>`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=await O(D(t)).publicTemplates.versions(e);if(t.json){A({versions:n});return}k(n.map(e=>({...e})),[{key:`id`,header:`Version ID`,width:38},{key:`versionNumber`,header:`Version`,width:8},{key:`snapshotId`,header:`Snapshot`,width:20},{key:`createdAt`,header:`Created`,width:24}])}catch(e){L(e)}}),e.command(`publish <name> <snapshot-id> <sandbox-id>`).option(`--slug <slug>`,`Stable public slug`).option(`-d, --description <description>`,`Template description`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).option(`--team-id <id>`,`Publish under a team`).option(`--forked-from <id>`,`Fork source template id`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=await O(D(r)).publicTemplates.publish({name:e,slug:r.slug,description:r.description,snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes,teamId:r.teamId,forkedFromTemplateId:r.forkedFrom});if(r.json){A({template:i});return}j(`Published template: ${i.slug}`)}catch(e){L(e)}}),e.command(`publish-version <id-or-slug> <snapshot-id> <sandbox-id>`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=await O(D(r)).publicTemplates.publishVersion(e,{snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes});if(r.json){A({version:i});return}j(`Published template version: ${i.id}`)}catch(e){L(e)}}),e}function hd(){let e=new t(`tools`).description(`Manage language runtimes and tools in a sandbox (via mise)`);return e.command(`list`).alias(`ls`).description(`List installed tools in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t)=>{try{let n=D({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=O(n),i=P(`Fetching tools...`);t.json||i.start();let a=await(await z(r,n,e)).tools.list();i.stop(),t.json?A(a):a.length===0?console.log(`No tools installed`):I([`Tool`,`Version`,`Active`],a.map(e=>[e.name,e.version,e.active?`yes`:`no`]))}catch(e){L(e)}}),e.command(`install`).description(`Install a tool version`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<tool>`,`Tool name (e.g. node, python, go)`).argument(`<version>`,`Version to install (e.g. 20, 3.12, latest)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=D({apiKey:r.apiKey,baseUrl:r.baseUrl}),a=O(i),o=P(`Installing ${t}@${n}...`);r.json||o.start(),await(await z(a,i,e)).tools.install(t,n),o.stop(),r.json?A({tool:t,version:n,installed:!0}):j(`Installed ${t}@${n}`)}catch(e){L(e)}}),e.command(`use`).description(`Activate a tool version for the current session`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<tool>`,`Tool name`).argument(`<version>`,`Version to activate`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=D({apiKey:r.apiKey,baseUrl:r.baseUrl});await(await z(O(i),i,e)).tools.use(t,n),j(`Activated ${t}@${n}`)}catch(e){L(e)}}),e.command(`run`).description(`Run a command with a specific tool`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<tool>`,`Tool name`).argument(`<args...>`,`Command arguments`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async(e,t,n,r)=>{try{let i=D({apiKey:r.apiKey,baseUrl:r.baseUrl}),a=O(i),o=P(`Running ${t} ${n.join(` `)}...`);r.json||o.start();let s=await(await z(a,i,e)).tools.run(t,n);o.stop(),r.json?A(s):(s.stdout&&process.stdout.write(s.stdout),s.stderr&&process.stderr.write(s.stderr),s.exitCode!==0&&process.exit(s.exitCode))}catch(e){L(e)}}),e}function gd(){let e=new t(`traces`).description(`Read hosted agent traces, spans, and eval-runs from Tangle Intelligence`);return e.command(`list`).description(`List trace summaries (one row per trace), newest first`).option(`--from <iso>`,`ISO-8601 lower bound on received time (inclusive)`).option(`--to <iso>`,`ISO-8601 upper bound on received time (inclusive)`).option(`--model <model>`,`Exact model match (any span carried this model)`).option(`--run <runId>`,`Exact run id match`).option(`--status <status>`,`ERROR | OK`).option(`-q, --query <text>`,`Substring over span name`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size (clamped server-side to [1, 200])`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Intelligence API base URL`).action(async e=>{try{let t={from:e.from,to:e.to,model:e.model,runId:e.run,status:e.status===void 0?void 0:Dd(e.status),q:e.query,cursor:e.cursor,limit:e.limit===void 0?void 0:Md(e.limit)},n=vd(e),r=e.json?null:P(`Fetching traces...`);r?.start();let i=await n.listTraces(t);if(r?.stop(),e.json)return A(i);xd(i.items),Td(i.nextCursor)}catch(t){bd(t,e)}}),e.command(`get <traceId>`).description(`Show one trace's spans. Streams NDJSON to stdout with --ndjson.`).option(`--ndjson`,`Stream the full span set as NDJSON to stdout`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Spans per page`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Intelligence API base URL`).action(async(e,t)=>{try{let n=vd(t);if(t.ndjson){await yd(n,e);return}let r=t.json?null:P(`Fetching trace spans...`);r?.start();let i=await n.getTraceSpans(e,{cursor:t.cursor,limit:t.limit===void 0?void 0:Md(t.limit)});if(r?.stop(),t.json)return A(i);Sd(i.items),i.truncated&&F({Spans:`${i.items.length} of ${i.total} (truncated)`}),Td(i.nextCursor)}catch(e){bd(e,t)}}),e.addCommand(_d()),e}function _d(){let e=new t(`runs`).description(`Read eval-runs pivoted off the trace surface`);return e.command(`list`).description(`List eval-runs, newest first`).option(`--status <status>`,`Run status filter`).option(`--gate <decision>`,`Promotion-gate decision filter`).option(`--label <key:value>`,`Match over the run's labels`).option(`--from <iso>`,`ISO-8601 lower bound on received time`).option(`--to <iso>`,`ISO-8601 upper bound on received time`).option(`-q, --query <text>`,`Substring over run dir`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Intelligence API base URL`).action(async e=>{try{let t={status:e.status===void 0?void 0:kd(e.status),gate:e.gate===void 0?void 0:jd(e.gate),label:e.label,from:e.from,to:e.to,q:e.query,cursor:e.cursor,limit:e.limit===void 0?void 0:Md(e.limit)},n=vd(e),r=e.json?null:P(`Fetching runs...`);r?.start();let i=await n.listRuns(t);if(r?.stop(),e.json)return A(i);Cd(i.items),Td(i.nextCursor)}catch(t){bd(t,e)}}),e.command(`get <runId>`).description(`Show a single eval-run`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Intelligence API base URL`).action(async(e,t)=>{try{let n=vd(t),r=t.json?null:P(`Fetching run...`);r?.start();let i=await n.getRun(e);if(r?.stop(),t.json)return A(i);wd(i)}catch(e){bd(e,t)}}),e}function vd(e){let t=hn(e.apiKey);if(!t)throw Error(`No API key found. Set TANGLE_API_KEY or run: tangle auth login`);return at({apiKey:t,baseUrl:e.baseUrl??process.env.TANGLE_INTELLIGENCE_BASE_URL})}async function yd(e,t){let n=(await e.exportTraceSpansNdjson(t)).getReader();try{for(;;){let{value:e,done:t}=await n.read();if(t)break;e&&process.stdout.write(Buffer.from(e))}}finally{n.releaseLock()}}function bd(e,t){return L(e,t.json===!0)}function xd(e){k(e.map(e=>({traceId:e.traceId,root:e.rootName??`-`,model:e.model??`-`,spans:e.spanCount,errors:e.errorCount,durationMs:e.durationMs,cost:Ed(e.costUsd)})),[{key:`traceId`,header:`Trace`,width:36},{key:`root`,header:`Root`,width:24},{key:`model`,header:`Model`,width:22},{key:`spans`,header:`Spans`,width:8},{key:`errors`,header:`Errors`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14},{key:`cost`,header:`Cost`,width:10}])}function Sd(e){k(e.map(e=>({spanId:e.id,name:e.name,model:e.model??`-`,status:e.statusCode??`-`,cost:e.costUsd===null?`-`:`$${e.costUsd}`})),[{key:`spanId`,header:`Span`,width:40},{key:`name`,header:`Name`,width:28},{key:`model`,header:`Model`,width:22},{key:`status`,header:`Status`,width:10},{key:`cost`,header:`Cost`,width:12}])}function Cd(e){k(e.map(e=>({runId:e.id,status:e.status,gate:e.gateDecision??`-`,cost:e.totalCostUsd===null?`-`:`$${e.totalCostUsd}`,receivedAt:e.receivedAt})),[{key:`runId`,header:`Run`,width:24},{key:`status`,header:`Status`,width:22},{key:`gate`,header:`Gate`,width:18},{key:`cost`,header:`Cost`,width:12},{key:`receivedAt`,header:`Received`,width:18}])}function wd(e){F({Run:e.id,Status:e.status,Gate:e.gateDecision??void 0,"Run Dir":e.runDir??void 0,Cost:e.totalCostUsd===null?void 0:`$${e.totalCostUsd}`,Duration:e.totalDurationMs===null?void 0:`${e.totalDurationMs}ms`,"Holdout Lift":e.holdoutLift??void 0,Received:e.receivedAt})}function Td(e){e&&F({"Next page":`--cursor ${e}`})}function Ed(e){return e===null?`-`:`$${e.toFixed(4)}`}function Dd(e){if(e===`ERROR`||e===`OK`)return e;throw Error(`--status must be ERROR or OK`)}const Od=[`started`,`baseline-complete`,`generation-complete`,`gate-decided`,`finished`,`errored`];function kd(e){let t=Od.find(t=>t===e);if(t)return t;throw Error(`--status must be one of ${Od.join(`, `)}`)}const Ad=[`ship`,`hold`,`need_more_work`,`model_ceiling`,`arch_ceiling`];function jd(e){let t=Ad.find(t=>t===e);if(t)return t;throw Error(`--gate must be one of ${Ad.join(`, `)}`)}function Md(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function Nd(){return new t(`usage`).description(`Show account usage and billing information`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`API base URL`).action(async e=>{try{let t=O(D({apiKey:e.apiKey,baseUrl:e.baseUrl})),n=e.json?null:P(`Fetching usage...`);n?.start();let[r,i]=await Promise.all([t.usage(),t.subscription().catch(()=>null)]);n?.stop(),e.json?A({...r,subscription:i}):(console.log(),console.log(`Account Usage`),console.log(`─`.repeat(40)),F({"Active Sandboxes":r.activeSandboxes,"Total Sandboxes":r.totalSandboxes,"Compute Minutes":Pd(r.computeMinutes),"GPU Seconds":r.gpuSeconds,"GPU Spend":Fd(r.gpuCostUsd)}),i&&(console.log(),console.log(`Subscription`),console.log(`─`.repeat(40)),F({Plan:i.plan,Status:i.status,"Credits Available":Fd(i.creditsAvailableUsd),"Credits Used":Fd(i.creditsUsedUsd),"Monthly Balance":Fd(i.monthlyBalanceUsd)})),console.log(),console.log(`Billing Period`),console.log(`─`.repeat(40)),F({Start:r.periodStart.toLocaleDateString(),End:r.periodEnd.toLocaleDateString()}),console.log())}catch(e){L(e)}})}function Pd(e){if(e===void 0)return`-`;if(e<60)return`${e} min`;let t=Math.floor(e/60),n=e%60;return n===0?`${t} hr`:`${t} hr ${n} min`}function Fd(e){return e<0?`-$${(-e).toFixed(2)}`:`$${e.toFixed(2)}`}function Id(){return new t(`use`).description(`Set or show the active sandbox (used when a command omits the id)`).argument(`[id]`,`Sandbox id to make active`).option(`--clear`,`Clear the active sandbox`).action((e,t)=>{try{if(t.clear){sn(),N(`Cleared the active sandbox.`);return}if(e){on(e),N(`Active sandbox set to ${e}. Commands now default to it; override with --box or TANGLE_SANDBOX.`);return}let n=an();N(n?`Active sandbox: ${n}`:"No active sandbox. Set one with `tangle use <id>`.")}catch(e){L(e)}})}const Ld=1e3;function Rd(){let e=new t(`workflows`).description(`Create and manage Tangle workflows`);e.option(`--json`,`Output as JSON`),e.hook(`preAction`,(e,t)=>{Vd(t)}),e.command(`list`).description(`List your workflows`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async e=>{try{let t=await(await Z(e)).workflows.list();if(e.json)return A(t);Ud(t)}catch(t){Q(t,e)}}),e.command(`fleet`).description(`Fleet overview: every workflow's run tallies over a trailing window, failing-first`).option(`--window <window>`,`Trailing window: 24h, 7d, or 30d`,`7d`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async e=>{try{let t=await(await Z(e)).workflows.fleetInsights({window:e.window});if(e.json)return A(t);Wd(t)}catch(t){Q(t,e)}}),e.command(`get`).description(`Show a workflow's definition and compiled triggers`).argument(`<id>`,`Workflow ID`).option(`--yaml`,`Print only the raw definition YAML (the export path — pipe to a file)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=await(await Z(t)).workflows.get(e);if(t.yaml){if(n.definitionYaml===null)throw Error(`Workflow ${n.id} has no stored definition YAML to export`);process.stdout.write(n.definitionYaml.endsWith(`
+`)?n.definitionYaml:`${n.definitionYaml}\n`);return}if(t.json)return A(n);Gd(n)}catch(e){Q(e,t)}}),e.command(`create`).description(`Create a workflow from a YAML file`).argument(`<file>`,`Path to the workflow YAML`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=Bd(e),r=await(await Z(t)).workflows.create(n);if(t.json)return A(r);N(`Created workflow ${r.id} (${r.name}).`),Gd(r)}catch(e){Q(e,t)}}),e.command(`apply`).description(`Create or update a workflow idempotently, matched by the definition's name`).argument(`<file>`,`Path to the workflow YAML`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=Bd(e),r=await Z(t),i=await r.workflows.validate(n,{structural:!0});if(!i.valid){if(process.exitCode=1,t.json)return A(i);N(`Invalid workflow:`);for(let e of i.errors)console.log(`  ${e.path}: ${e.message}`);return}let a=(await r.workflows.list()).find(e=>e.name===i.name);if(a){let e=await r.workflows.update(a.id,n);if(t.json)return A({action:`updated`,workflow:e});N(`Updated workflow ${e.id} (${e.name}) — matched by name.`),Gd(e);return}let o=await r.workflows.create(n);if(t.json)return A({action:`created`,workflow:o});N(`Created workflow ${o.id} (${o.name}).`),Gd(o)}catch(e){Q(e,t)}}),e.command(`update`).description(`Replace a workflow's definition from a YAML file`).argument(`<id>`,`Workflow ID`).argument(`<file>`,`Path to the workflow YAML`).option(`--note <note>`,`Revision note recorded on the appended revision (why this change)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=Bd(t),i=await(await Z(n)).workflows.update(e,r,{...n.note===void 0?{}:{note:n.note}});if(n.json)return A(i);N(`Updated workflow ${i.id} (${i.name}).`),Gd(i)}catch(e){Q(e,n)}}),e.command(`delete`).description(`Delete a workflow and its triggers`).argument(`<id>`,`Workflow ID`).option(`--force`,`Skip confirmation prompt`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{if(!t.force&&!await Pr(`Delete workflow ${e}? `)){N(`Delete cancelled.`);return}if(await(await Z(t)).workflows.delete(e),t.json)return A({deleted:!0,id:e});N(`Deleted workflow ${e}.`)}catch(e){Q(e,t)}}),e.command(`validate`).description(`Validate a workflow YAML file without saving it`).argument(`<file>`,`Path to the workflow YAML`).option(`--structural`,`CI mode: compile + capability checks only, no connection resolution — the verdict is the same regardless of connected providers`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=Bd(e),r=await(await Z(t)).workflows.validate(n,{...t.structural?{structural:!0}:{}});if(t.json)return A(r);if(r.valid)N(`Valid: ${r.name} (${r.actionCount} action(s), ${r.triggerCount} trigger(s)).`);else{N(`Invalid workflow:`);for(let e of r.errors)console.log(`  ${e.path}: ${e.message}`);process.exitCode=1}}catch(e){Q(e,t)}}),e.command(`schema`).description(`Print the JSON Schema for the workflow YAML`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async e=>{try{A(await(await Z(e)).workflows.schema())}catch(t){Q(t,e)}}),e.command(`run`).description(`Trigger an immediate run of a workflow`).argument(`<id>`,`Workflow ID`).option(`--input <key=value>`,`Trigger input as key=value (e.g. pull_request.number=123). Repeatable.`,Kd,[]).option(`--wait`,`Wait for the run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=qd(t.input),r=t.timeout===void 0?void 0:U(t.timeout,`--timeout`),i=t.pollInterval===void 0?void 0:U(t.pollInterval,`--poll-interval`),a=await Z(t),{runId:o}=await a.workflows.run(e,n);if(!t.wait){if(t.json)return A({runId:o});N(`Started run ${o} for workflow ${e}.`),N(`Inspect it with: tangle workflows run-detail ${e} ${o}`);return}let s=t.json?null:P(`Waiting for run ${o} to finish...`).start(),c;try{c=await a.workflows.waitForRun(e,o,{...r===void 0?{}:{timeoutMs:r},...i===void 0?{}:{pollIntervalMs:i}})}finally{s?.stop()}if(c.status===`failed`&&(process.exitCode=1),t.json)return A(c);Yd(c)}catch(e){Q(e,t)}}),e.command(`runs`).description(`List a workflow's run history (newest first)`).argument(`<id>`,`Workflow ID`).option(`--limit <n>`,`Runs per page (1-100)`).option(`--cursor <cursor>`,`Pagination cursor from a previous page`).option(`--all`,`Fetch every page, not just the first`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=await Z(t),r=t.limit===void 0?void 0:U(t.limit,`--limit`);if(t.all){let i=[],a=t.cursor,o=0,s=null;for(;;){let c=await n.workflows.listRuns(e,{...r===void 0?{}:{limit:r},...a===void 0?{}:{cursor:a}});if(i.push(...c.runs),o+=1,!c.nextCursor)break;if(o>=Ld){s=c.nextCursor,t.json||N(`Stopped after ${Ld} pages (${i.length} runs); more may exist — resume with --cursor ${c.nextCursor}`);break}a=c.nextCursor}if(t.json)return A({runs:i,nextCursor:s});Jd(i);return}let i=await n.workflows.listRuns(e,{...r===void 0?{}:{limit:r},...t.cursor===void 0?{}:{cursor:t.cursor}});if(t.json)return A(i);Jd(i.runs),i.nextCursor&&N(`More runs available — next page: --cursor ${i.nextCursor}`)}catch(e){Q(e,t)}}),e.command(`run-detail`).description(`Show a single run's detail (per-action output and errors)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=await(await Z(n)).workflows.getRun(e,t);if(n.json)return A(r);Yd(r)}catch(e){Q(e,n)}}),e.command(`cancel`).description(`Cancel a queued or in-progress run`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=await(await Z(n)).workflows.cancel(e,t);if(n.json)return A(r);Xd(r)}catch(e){Q(e,n)}}),e.command(`retry`).description(`Re-run a failed or cancelled run (a fresh run with the same trigger context)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID of the failed/cancelled run to retry`).option(`--wait`,`Wait for the new run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=n.timeout===void 0?void 0:U(n.timeout,`--timeout`),i=n.pollInterval===void 0?void 0:U(n.pollInterval,`--poll-interval`),a=await Z(n),o=await a.workflows.retryRun(e,t);if(!n.wait){if(n.json)return A(o);N(`Started run ${o.runId} (retry of ${t}).`),N(`Inspect it with: tangle workflows run-detail ${e} ${o.runId}`);return}let s=n.json?null:P(`Waiting for run ${o.runId} to finish...`).start(),c;try{c=await a.workflows.waitForRun(e,o.runId,{...r===void 0?{}:{timeoutMs:r},...i===void 0?{}:{pollIntervalMs:i}})}finally{s?.stop()}if(c.status===`failed`&&(process.exitCode=1),n.json)return A(c);Yd(c)}catch(e){Q(e,n)}}),e.command(`events`).description(`Tail a run's live progress events until it finishes`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).option(`--json`,`Emit each event as a JSON line`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=await Z(n);for await(let i of r.workflows.watchRun(e,t))n.json?console.log(JSON.stringify(i)):Zd(i),i.type===`run.done`&&i.status===`failed`&&(process.exitCode=1)}catch(e){Q(e,n)}}),e.command(`enable`).description(`Enable a workflow so its triggers and manual runs fire`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{await zd(e,!0,t)}),e.command(`disable`).description(`Disable a workflow (pause its triggers and manual runs)`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{await zd(e,!1,t)}),e.command(`templates`).description(`List the curated starter workflow templates`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async e=>{try{let t=await(await Z(e)).workflows.listTemplates();if(e.json)return A(t);tf(t)}catch(t){Q(t,e)}}),e.command(`init`).description(`Create a workflow from a gallery template and print (or save) its YAML`).argument(`<template-id>`,"Template ID from `workflows templates`").option(`--param <key=value>`,`Template parameter value. Repeatable.`,Kd,[]).option(`--file <out>`,`Write the instantiated workflow YAML to this file instead of stdout`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=qd(t.param,`param`)??{},r=await(await Z(t)).workflows.instantiateTemplate(e,n);if(t.json)return A(r);if(!r.created){N(`Template ${e} needs provider connections before it can run:`);for(let e of r.connectionRequirements)console.log(`  ${e.connected?`✓`:`✗`} ${nf(e,r.connectionRequirements)}`);process.exitCode=1;return}let{workflow:i}=r;if(i.definitionYaml===null)throw Error(`Workflow ${i.id} was created but the server returned no definition YAML`);if(N(`Created workflow ${i.id} (${i.name}).`),t.file){ef(t.file,i.definitionYaml),N(`Wrote ${t.file}.`);return}process.stdout.write(i.definitionYaml.endsWith(`
+`)?i.definitionYaml:`${i.definitionYaml}\n`)}catch(e){Q(e,t)}}),e.command(`revisions`).description(`List a workflow's definition revision history (newest first)`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=await(await Z(t)).workflows.listRevisions(e);if(t.json)return A(n);rf(n)}catch(e){Q(e,t)}}),e.command(`revision`).description(`Show one revision's metadata and definition YAML`).argument(`<id>`,`Workflow ID`).argument(`<rev>`,`Revision number`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=U(t,`<rev>`),i=await(await Z(n)).workflows.getRevision(e,r);if(n.json)return A(i);F({Revision:i.rev,Created:i.createdAt,"Created by":i.createdBy,Source:i.source,Note:i.note??``}),process.stdout.write(i.yaml.endsWith(`
+`)?i.yaml:`${i.yaml}\n`)}catch(e){Q(e,n)}}),e.command(`rollback`).description(`Restore a prior revision's definition as a NEW head revision (re-validated)`).argument(`<id>`,`Workflow ID`).argument(`<rev>`,`Revision number to restore`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=U(t,`<rev>`),i=await(await Z(n)).workflows.rollback(e,r);if(n.json)return A(i);N(`Rolled back workflow ${i.id} to rev ${r}.`),Gd(i)}catch(e){Q(e,n)}});let n=e.command(`kv`).description(`Read and write a workflow's cross-run KV state`);return n.command(`list`).description(`List every KV entry of a workflow`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=await(await Z(t)).workflows.listKv(e);if(t.json)return A(n);af(n.entries)}catch(e){Q(e,t)}}),n.command(`get`).description(`Show one KV entry (value and version)`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=await(await Z(n)).workflows.getKv(e,t);if(n.json)return A(r);of(r)}catch(e){Q(e,n)}}),n.command(`set`).description(`Write a KV entry from a JSON value`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).argument(`<json>`,`Value as JSON (e.g. '{"cursor":123}' or '"abc"')`).option(`--cas <version>`,`Compare-and-swap: write only if the stored version still equals this`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n,r)=>{try{let i=$d(n,`<json>`),a=r.cas===void 0?void 0:U(r.cas,`--cas`),o=await Z(r),s=a===void 0?await o.workflows.putKv(e,t,i):await o.workflows.casKv(e,t,a,i);if(r.json)return A(s);of(s)}catch(e){Q(e,r)}}),n.command(`delete`).description(`Delete a KV entry (idempotent)`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=await(await Z(n)).workflows.deleteKv(e,t);if(n.json)return A(r);N(r.deleted?`Deleted KV entry "${t}" of workflow ${e}.`:`No KV entry "${t}" on workflow ${e}.`)}catch(e){Q(e,n)}}),e.command(`artifacts`).description(`List a run's artifact metadata (never the bytes)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=await(await Z(n)).workflows.listArtifacts(e,t);if(n.json)return A(r);sf(r.artifacts)}catch(e){Q(e,n)}}),e.command(`artifact-download`).description(`Download one run artifact's bytes to a file`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).argument(`<artifactId>`,`Artifact ID`).option(`--out <file>`,`Destination file (defaults to the artifact ID)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n,r)=>{try{let i=await(await Z(r)).workflows.downloadArtifact(e,t,n),a=r.out??n;try{ue(a,i.bytes)}catch(e){throw Error(`Could not write artifact to "${a}": ${e instanceof Error?e.message:String(e)}`)}if(r.json)return A({file:a,contentType:i.contentType,bytes:i.bytes.length});N(`Wrote ${a} (${i.bytes.length} bytes, ${i.contentType}).`)}catch(e){Q(e,r)}}),e.command(`decisions`).description(`List a workflow's pending human decisions`).argument(`<id>`,`Workflow ID`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t)=>{try{let n=(await(await Z(t)).workflows.listPendingDecisions()).decisions.filter(t=>t.workflowId===e);if(t.json)return A({decisions:n});cf(n)}catch(e){Q(e,t)}}),e.command(`decision-resolve`).description(`Answer the decision a run is parked on and resume it`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).requiredOption(`--choice <choice>`,`The option to resolve with (one of the decision's options)`).option(`--json`,`Output as JSON`).option(`--api-key <key>`,`API key`).option(`--base-url <url>`,`Platform control-plane base URL`).action(async(e,t,n)=>{try{let r=await Z(n),i=await r.workflows.getRunDecision(e,t),a=await r.workflows.resolveRunDecision(e,t,{decisionId:i.id,choice:n.choice});if(n.json)return A(a);if(a.resumed){N(`Resolved decision ${a.decisionId} with "${a.choice}" — run ${a.runId} resumed.`);return}N(`Resolved decision ${a.decisionId} with "${a.choice}", but run ${a.runId} had already finished — nothing to resume.`)}catch(e){Q(e,n)}}),e}async function zd(e,t,n){try{let r=await(await Z(n)).workflows.setEnabled(e,t);if(n.json)return A(r);N(`${t?`Enabled`:`Disabled`} workflow ${r.id}.`),Gd(r)}catch(e){Q(e,n)}}function Bd(e){try{return x(e,`utf8`)}catch(t){throw Error(`Could not read workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function Z(e){return Sr({...e.apiKey===void 0?{}:{apiKey:e.apiKey},...e.baseUrl===void 0?{}:{baseUrl:e.baseUrl}})}function Vd(e){if(!Hd(e,`json`)||e.getOptionValue(`json`)!==void 0)return;let t=e.parent;for(;t;){let n=t.getOptionValue(`json`);if(n!==void 0){e.setOptionValue(`json`,n);return}t=t.parent}}function Hd(e,t){return e.options.some(e=>e.attributeName()===t)}function Q(e,t){return L(e,t.json===!0)}function Ud(e){k(e.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,issues:e.validationErrors.length,updated:e.updatedAt})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`issues`,header:`Issues`},{key:`updated`,header:`Updated`}])}function Wd(e){let t=e.workflows.filter(e=>e.failed>0).length,n=e.workflows.filter(e=>e.failed===0&&e.waiting>0).length,r=e.workflows.filter(e=>e.failed===0&&e.waiting===0&&e.runsInWindow>0).length;N(`${t} failing · ${n} waiting · ${r} healthy · ${e.workflows.length} total over ${e.window}`),k(e.workflows.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,runs:e.runsInWindow,failed:e.failed,waiting:e.waiting,success:e.successRate===null?`—`:`${Math.round(e.successRate*100)}%`,lastRun:e.lastRunStatus??`—`,lastRunAt:e.lastRunAt??`—`})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`runs`,header:`Runs`},{key:`failed`,header:`Failed`},{key:`waiting`,header:`Waiting`},{key:`success`,header:`Success`},{key:`lastRun`,header:`Last Run`},{key:`lastRunAt`,header:`Last Run At`}])}function Gd(e){if(F({ID:e.id,Name:e.name,Description:e.description??``,Enabled:e.enabled?`yes`:`no`,Actions:e.actions.length}),e.triggers&&e.triggers.length>0&&(N(`Triggers`),Qd(e.triggers)),e.validationErrors.length>0){N(`Validation issues`);for(let t of e.validationErrors)console.log(`  ${t.path}: ${t.message}`)}}function Kd(e,t){return[...t,e]}function qd(e,t=`input`){if(!e||e.length===0)return;let n={};for(let r of e){let e=r.indexOf(`=`);if(e<=0)throw Error(`Invalid --${t} "${r}": expected key=value (e.g. pull_request.number=123)`);n[r.slice(0,e)]=r.slice(e+1)}return n}function Jd(e){k(e.map(e=>({id:e.id,status:e.status,attempts:e.attempts,created:e.createdAt,completed:e.completedAt??``})),[{key:`id`,header:`Run ID`},{key:`status`,header:`Status`},{key:`attempts`,header:`Attempts`},{key:`created`,header:`Created`},{key:`completed`,header:`Completed`}])}function Yd(e){if(F({"Run ID":e.id,Workflow:e.workflowId,Status:e.status,Error:e.error??``,Attempts:e.attempts,Created:e.createdAt,Started:e.startedAt??``,Completed:e.completedAt??``}),e.actionResults.length>0){N(`Actions`);let t=e.actionResults.some(e=>e.nodeId!==void 0||e.visit!==void 0);k(e.actionResults.map(e=>({index:e.index,...t?{node:e.nodeId??``,visit:e.visit??``}:{},kind:e.kind,status:e.status,error:e.error??``,cost:e.costUsd??``})),[{key:`index`,header:`#`},...t?[{key:`node`,header:`Node`},{key:`visit`,header:`Visit`}]:[],{key:`kind`,header:`Kind`},{key:`status`,header:`Status`},{key:`error`,header:`Error`},{key:`cost`,header:`Cost (USD)`}])}e.graph&&(N(`Graph`),F({Nodes:e.graph.nodes.length,Edges:e.graph.edges.length,"Max node visits":e.graph.maxNodeVisits}),k(e.graph.edges.map(e=>({from:e.from,to:e.to,guard:e.when===void 0?``:JSON.stringify(e.when)})),[{key:`from`,header:`From`},{key:`to`,header:`To`},{key:`guard`,header:`Guard`}])),e.edgeVerdicts&&e.edgeVerdicts.length>0&&(N(`Edge verdicts`),k(e.edgeVerdicts.flatMap(e=>Object.entries(e.verdicts).map(([t,n])=>({node:e.nodeId,edge:t,verdict:n?`taken`:`not taken`}))),[{key:`node`,header:`Node`},{key:`edge`,header:`Edge`},{key:`verdict`,header:`Verdict`}]))}function Xd(e){if(e.status===`cancelled`){N(`Cancelled run ${e.runId}.`);return}if(e.signalled){N(`Cancelling run ${e.runId} — signalled the worker; it will stop shortly.`);return}N(`Requested cancellation of run ${e.runId}, but couldn't confirm it — the run may have just finished, or it's running on another instance and will stop on its own.`)}function Zd(e){switch(e.type){case`snapshot`:N(`snapshot: ${e.run.status} (${e.run.actionResults.length} action(s))`);break;case`action.started`:console.log(`→ action[${e.index}] ${e.kind} started`);break;case`action.finished`:{let t=e.status===`succeeded`?`✓`:e.status===`skipped`?`⊘`:`✗`;console.log(`${t} action[${e.index}] ${e.kind} ${e.status}${e.error?`: ${e.error}`:``}`);break}case`iteration.started`:console.log(`  · action[${e.actionIndex}] iteration ${e.iterationIndex} started`);break;case`iteration.ended`:console.log(`  · action[${e.actionIndex}] iteration ${e.iterationIndex} ${e.status}`);break;case`token`:typeof e.delta==`string`&&process.stdout.write(e.delta);break;case`ping`:break;case`run.done`:console.log(`\nrun.done: ${e.status}${e.error?`: ${e.error}`:``}`);break;case`run.waiting`:console.log(`\nrun.waiting: parked on a human decision (${e.decisionId}) — resolve it to resume`);break}}function Qd(e){k(e.map(e=>({id:e.id,kind:e.kind,enabled:e.enabled?`yes`:`no`,detail:e.kind===`schedule`?`${e.cron??``} (${e.timezone??``})`:`${e.provider??``}:${e.eventFilter?.event??``}${e.eventFilter?.action?`.${e.eventFilter.action}`:``}`})),[{key:`id`,header:`ID`},{key:`kind`,header:`Kind`},{key:`enabled`,header:`Enabled`},{key:`detail`,header:`Detail`}])}function $d(e,t){try{return JSON.parse(e)}catch{throw Error(`Invalid ${t}: not valid JSON`)}}function ef(e,t){try{ue(e,t,`utf8`)}catch(t){throw Error(`Could not write workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function tf(e){k(e.map(e=>({id:e.id,name:e.name,category:e.category,providers:e.providers.join(`, `),summary:e.summary})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`category`,header:`Category`},{key:`providers`,header:`Providers`},{key:`summary`,header:`Summary`}])}function nf(e,t){let n=e.kind===`github_app`,r=n?`${e.provider} (App installation)`:e.provider,i=e.connectUrl?` — ${n?`install`:`connect`}: ${e.connectUrl}`:``,a=e.prerequisite;return`${r}${i}${a&&t.some(e=>e.provider===a.provider&&e.kind===a.kind&&!e.connected)?` (after connecting ${a.provider})`:``}`}function rf(e){k(e.map(e=>({rev:e.rev,created:e.createdAt,by:e.createdBy,source:e.source,note:e.note??``})),[{key:`rev`,header:`Rev`},{key:`created`,header:`Created`},{key:`by`,header:`Created By`},{key:`source`,header:`Source`},{key:`note`,header:`Note`}])}function af(e){k(e.map(e=>({key:e.key,version:e.version,updated:e.updatedAt})),[{key:`key`,header:`Key`},{key:`version`,header:`Version`},{key:`updated`,header:`Updated`}])}function of(e){F({Key:e.key,Version:e.version,Updated:e.updatedAt}),N(`Value`),A(e.value)}function sf(e){k(e.map(e=>({id:e.id,node:e.nodeId,name:e.name,type:e.contentType,bytes:e.byteSize,created:e.createdAt})),[{key:`id`,header:`ID`},{key:`node`,header:`Node`},{key:`name`,header:`Name`},{key:`type`,header:`Content Type`},{key:`bytes`,header:`Bytes`},{key:`created`,header:`Created`}])}function cf(e){k(e.map(e=>({id:e.id,run:e.runId,title:e.title,options:e.options.join(`, `),requested:e.requestedAt,expires:e.expiresAt??``})),[{key:`id`,header:`ID`},{key:`run`,header:`Run`},{key:`title`,header:`Title`},{key:`options`,header:`Options`},{key:`requested`,header:`Requested`},{key:`expires`,header:`Expires`}])}function lf(e){let t={...uf(e)??{},...e.optsWithGlobals()};for(let n of e.options){let r=n.attributeName();e.getOptionValue(r)===void 0&&t[r]!==void 0&&e.setOptionValue(r,t[r])}}function uf(e){let t=e;for(;t?.parent;)t=t.parent;return t?t.opts():void 0}const df=e(import.meta.url)(`../package.json`),$=new t;$.name(`tangle`).description(`CLI for Tangle Sandbox operations`).version(df.version??`0.0.0`).option(`--api-key <key>`,`API key (or set TANGLE_API_KEY)`).option(`--base-url <url>`,`API base URL`),$.hook(`preAction`,(e,t)=>{lf(t)}),$.addCommand(hi()),$.addCommand(ec()),$.addCommand(Id()),$.addCommand(fc()),$.addCommand(Is()),$.addCommand(xo()),$.addCommand(Uu()),$.addCommand(Wu()),$.addCommand(Ku()),$.addCommand(Xr()),$.addCommand(hc()),$.addCommand(jo()),$.addCommand(Nd()),$.addCommand(ld()),$.addCommand(md()),$.addCommand(Rs()),$.addCommand(Ci()),$.addCommand(Pi()),$.addCommand(Bs()),$.addCommand(Ho()),$.addCommand(qo()),$.addCommand(Jo()),$.addCommand(Rd()),$.addCommand(bo()),$.addCommand(hd()),$.addCommand(dc()),$.addCommand(Pu()),$.addCommand(mc()),$.addCommand(Fi()),$.addCommand(zs()),$.addCommand(_s()),$.addCommand(ao()),$.addCommand(oo()),$.addCommand(Ks()),$.addCommand(Ls()),$.addCommand(gd()),$.addCommand(cd()),$.parseAsync(process.argv).catch(e=>{console.error(`Fatal error:`,e.message),process.exit(1)});export{};