@tangle-network/sandbox-cli 0.21.111 → 0.21.113
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.mjs +24 -24
- package/package.json +4 -4
package/dist/index.mjs
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
|
-
import{createRequire as e,findPackageJSON as t}from"node:module";import"dotenv/config";import{ALL_BACKEND_TYPES as n,AuthError as r,GPU_LEASE_PROVIDER_NAMES as i,NetworkError as a,NotFoundError as o,PublicTemplatePublishError as s,QuotaError as c,Sandbox as l,ServerError as u,StateError as d,TimeoutError as f,ValidationError as p,createAgentRunOutcomeTracker as m,createConfidentialSandbox as h,generateAttestationNonce as g,parseBackendType as _,parseSSEStream as v,validateBatchRunRequest as ee}from"@tangle-network/sandbox";import y from"chalk";import te from"ora";import{Command as b}from"commander";import{createHash as x,randomBytes as ne,randomUUID as S}from"node:crypto";import{ProxySecretsSchema as re,agentInteractiveSessionRunRef as C,agentProfileSchema as ie,canonicalAgentProfileDigest as w,canonicalCandidateDigest as ae,modelProvider as oe,parseSeatSpec as se}from"@tangle-network/agent-interface";import*as T from"node:fs";import{chmodSync as ce,constants as le,existsSync as ue,mkdirSync as de,readFileSync as fe,renameSync as pe,writeFileSync as me}from"node:fs";import*as E from"node:path";import{basename as he,dirname as ge,extname as _e,isAbsolute as ve,join as D,relative as ye,resolve as be,sep as xe}from"node:path";import*as Se from"node:os";import{homedir as O,tmpdir as Ce}from"node:os";import{execFile as we,execFileSync as Te,spawn as Ee}from"node:child_process";import{lockSync as De}from"proper-lockfile";import{HubClient as Oe}from"@tangle-network/hub-sdk";import{createInterface as ke}from"node:readline";import{Writable as Ae}from"node:stream";import{buffer as je}from"node:stream/consumers";import{setTimeout as Me}from"node:timers/promises";import{CONTENT_COMPLETION_KEY as Ne,CONTENT_PROMPT_KEY as Pe,CONTENT_TOOL_ARGS_KEY as Fe,CONTENT_TOOL_NAME_KEY as Ie,CONTENT_TOOL_RESULT_KEY as Le,TANGLE_SUBJECT_KEY as Re,asContentField as k,asContentString as ze}from"@tangle-network/agent-core/telemetry";import{execCli as Be,shellQuote as Ve}from"@tangle-network/sdk-cli-runner";import*as A from"node:fs/promises";import{mkdir as He,mkdtemp as Ue,open as We,readFile as Ge,realpath as Ke,writeFile as qe}from"node:fs/promises";import{z as j}from"zod";import{listLocalModels as Je,loadConfig as Ye}from"cli-bridge";import{createMcpServer as Xe}from"@tangle-network/sandbox/agent";import{ensureAgentPreview as Ze,publishAgentPreview as Qe,resolveSelfSandbox as $e}from"@tangle-network/sandbox/preview";import{fileURLToPath as et}from"node:url";import{generatePrivateKey as tt,privateKeyToAccount as nt}from"viem/accounts";import{promisify as rt}from"node:util";import{createPublicClient as it,createWalletClient as at,decodeAbiParameters as ot,decodeEventLog as st,encodeAbiParameters as ct,getAddress as lt,http as ut,isAddress as dt,keccak256 as ft,parseAbi as pt,parseAbiItem as mt,parseAbiParameters as ht,stringToHex as gt,toHex as _t}from"viem";import{tempoModerato as vt}from"viem/chains";import{Actions as yt,withRelay as bt}from"viem/tempo";import xt from"ws";import{createIntelligenceClient as St}from"@tangle-network/sandbox/intelligence";let Ct=!1;function wt(e){Ct=e}function Tt(...e){Ct?console.error(...e):console.log(...e)}function Et(e){return e==null?y.dim(`-`):typeof e==`boolean`?e?y.green(`yes`):y.red(`no`):e instanceof Date?Ot(e):typeof e==`string`&&Dt(e)?Ot(new Date(e)):String(e)}function Dt(e){return/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/.test(e)}function Ot(e){let t=Date.now()-e.getTime();if(t<6e4)return`just now`;if(t<36e5)return`${Math.floor(t/6e4)} min ago`;if(t<864e5){let e=Math.floor(t/36e5);return`${e} hour${e>1?`s`:``} ago`}let n=Math.floor(t/864e5);return`${n} day${n>1?`s`:``} ago`}function kt(e){switch(e){case`running`:return y.green(e);case`pending`:case`provisioning`:return y.yellow(e);case`stopped`:return y.gray(e);case`failed`:case`deleted`:return y.red(e);default:return e}}function M(e,t){let n=t.map(t=>{let n=t.header.length,r=Math.max(...e.map(e=>Et(e[t.key]).length));return t.width??Math.max(n,r)+2}),r=e.map(e=>t.map(t=>t.key===`status`?kt(String(e[t.key])):Et(e[t.key])));It(t.map(e=>e.header),r,n)}function N(e){console.log(JSON.stringify(e,null,2))}function P(e){Tt(y.green(`✓`),e)}function At(e){console.error(y.red(`✗`),e)}function jt(e){Tt(y.yellow(`!`),e)}function F(e){Tt(y.blue(`→`),e)}const Mt=new Set;function I(e){let t=te({text:e,color:`cyan`,isSilent:Ct});return Mt.add(t),t}function Nt(){for(let e of Mt)e.isSpinning&&e.stop();Mt.clear()}function L(e,t=0){let n=` `.repeat(t);for(let[t,r]of Object.entries(e))r!=null&&console.log(`${n}${y.dim(`${t}:`)} ${Et(r)}`)}function Pt(e){let t=`${e.cpuCores} vCPU / ${e.memoryMB} MB / ${e.diskGB} GB`;return e.pool?`${t} (pool: ${e.pool})`:t}function Ft(e){if(console.log(),console.log(y.bold(`Sandbox Details`)),console.log(y.dim(`─`.repeat(40))),L({ID:e.id,Name:e.name,Status:kt(e.status),Resources:e.resources?Pt(e.resources):void 0,Created:e.createdAt,Expires:e.expiresAt}),e.connection){if(console.log(),console.log(y.bold(`Connection`)),console.log(y.dim(`─`.repeat(40))),e.connection.ssh){let{ssh:t}=e.connection,n=process.platform===`win32`?`NUL`:`/dev/null`,r=`ssh -o ProxyCommand="${t.proxyCommand}" -o StrictHostKeyChecking=no -o UserKnownHostsFile=${n} -o GlobalKnownHostsFile=${n} -o LogLevel=ERROR -o ServerAliveInterval=15 -o ServerAliveCountMax=4 -o TCPKeepAlive=yes ${t.username}@localhost -p ${t.port}`;L({SSH:process.platform===`win32`?`$env:TANGLE_SSH_PROXY_AUTH_TOKEN='<token>'; ${r}`:`TANGLE_SSH_PROXY_AUTH_TOKEN='<token>' ${r}`})}e.connection.webTerminalUrl&&L({"Web Terminal":e.connection.webTerminalUrl}),e.connection.runtimeUrl&&L({"API URL":e.connection.runtimeUrl})}console.log()}function It(e,t,n){if(t.length===0){console.log(y.dim(`No items found.`));return}let r=n??e.map((e,n)=>{let r=Math.max(...t.map(e=>String(e[n]??``).length));return Math.max(e.length,r)+2});console.log(e.map((e,t)=>y.bold(e.padEnd(r[t]))).join(``));for(let e of t)console.log(e.map((e,t)=>String(e??``).padEnd(r[t])).join(``))}var R=class extends Error{constructor(e,t,n,r){super(t),this.code=e,this.cause=n,this.fix=r,this.name=`ActionableCliError`}};const Lt=new Set([`AUTH_EXPIRED`,`AUTH_WRONG_AUDIENCE`,`SEAT_NONE_DETECTED`,`SEAT_NOT_LOGGED_IN`,`SEAT_NOT_ENROLLED`,`HUB_NOT_CONNECTED`,`HUB_RECONNECT`,`HUB_APP_NOT_INSTALLED`,`HUB_APPROVAL_REQUIRED`]),Rt=new Set([`GRAPH_INVALID`,`STEP_REF`,`PROFILE_INVALID`,`UNKNOWN_HARNESS`,`HUB_TOOL_UNKNOWN`,`TRIGGER_INVALID`,`WORKFLOW_INPUT_FILE_INVALID`,`VALIDATION_ERROR`]),zt=new Set([`UNKNOWN_COMMAND`,`GRAPH_PARAM_MISSING`,`GRAPH_PARAM_UNKNOWN`,`SEAT_SYNTAX`,`HUB_PROVIDER_UNKNOWN`,`USAGE_INVALID`]),Bt=new Set([`SUBSCRIPTION_REQUIRED`,`MODEL_NOT_FOUND`,`MODEL_PROVIDER_MISMATCH`,`MCP_BLOCKED`,`CLOUD_SEAT_UNSUPPORTED`,`SCHEDULE_AUTHORITY`]);function Vt(e){return typeof e==`object`&&e?e:{}}function z(e){return typeof e==`string`&&e.length>0?e:void 0}function Ht(e){let t=z(e);return t&&/^[a-z0-9][a-z0-9_-]*$/i.test(t)?t:void 0}function Ut(e){let t,n=e;for(let e=0;n instanceof Error&&e<5;e++,n=n.cause){let e=n.message||(n instanceof AggregateError?n.errors.map(e=>e instanceof Error?e.message:String(e)).join(`; `):``),r=z(Vt(n).code);(e||r)&&(t=r?`${r}${e?`: ${e}`:``}`:e)}return t}function Wt(e){return e.code===`credential-refused`&&e.owner===`caller`&&e.providerCode===`subscription_required`?Vt(e.remediation):{}}function Gt(e){let t=Vt(e),n=Array.isArray(t.runtimeFailures)?t.runtimeFailures.map(Vt):[],i=n.find(e=>z(Wt(Vt(e.failure)).fix))??n[0],l=Vt(i?.failure??t.runtimeFailure),u=Wt(l),m=Vt(t.details),h=Ht(t.provider??m.provider??m.providerId),g=Vt(t.fix??m.fix),_=z(t.code)??`CLI_ERROR`,v=z(t.message)??String(e),ee=z(l.cause)??z(t.cause)??z(m.reason)??v,y=`tangle --help`,te=typeof m.providerRetryable==`boolean`?m.providerRetryable:typeof t.retryable==`boolean`?t.retryable:null;if(e instanceof r||_===`HUB_UNAUTHENTICATED`||t.status===401)_=`AUTH_EXPIRED`,v=`Authentication failed`,y=`tangle auth login`;else if([`HUB_CONNECTION_MISSING`,`HUB_CONNECTION_REVOKED`,`HUB_CONNECTION_UNHEALTHY`,`HUB_RECONNECT_REQUIRED`,`CONNECTION_REQUIRED`].includes(_))_=[`HUB_CONNECTION_MISSING`,`CONNECTION_REQUIRED`].includes(_)?`HUB_NOT_CONNECTED`:`HUB_RECONNECT`,y=h?`tangle hub connect ${h}`:`tangle hub connections --json`;else if(_===`HUB_APPROVAL_REQUIRED`){let e=Ht(Vt(m.approval).id);y=e?`tangle hub approvals approve ${e}`:`tangle hub approvals list --json`}else _===`HUB_PROVIDER_REJECTED`?(y=`tangle hub status --json`,m.providerRetryable===!1&&(ee+=`. Change the request before retrying`)):_===`provider_quota_exhausted`||_===`SEAT_LIMIT`?(_=`SEAT_LIMIT`,y=`tangle auth status`,te=!0):e instanceof c?y=`tangle usage --json`:e instanceof a?(_=`NETWORK_UNAVAILABLE`,v=`Network error: ${v}`,ee=Ut(e.cause)??`No response arrived`,y=`tangle auth status --json`,te=!0):e instanceof f?(_=`TIMEOUT`,y=`tangle sandbox list --json`,te=!0):e instanceof p?(_=`VALIDATION_ERROR`,v=`Invalid input`):e instanceof o||e instanceof d?y=`tangle sandbox list --json`:_===`commander.unknownCommand`?(_=`UNKNOWN_COMMAND`,y=v.includes(`'graph'`)?`npm install -g @tangle-network/sandbox-cli@latest`:`tangle --help`):_.startsWith(`commander.`)?_=`USAGE_INVALID`:(_===`ENOENT`||_===`EACCES`)&&(_=`INPUT_UNAVAILABLE`);e instanceof R&&(y=e.fix,te=!1),z(u.fix)&&(_=u.cause===`not_authenticated`?`SEAT_NOT_LOGGED_IN`:`SUBSCRIPTION_REQUIRED`),e instanceof s&&y===`tangle --help`&&(y=`tangle template publish --help`),y=z(u.fix)??z(g.command)??(_===`HUB_NOT_CONNECTED`?void 0:z(t.fixCommand))??y,Lt.has(_)&&y===`tangle --help`&&(y=`tangle auth login`);let b=Vt(t.subject??m.subject??{node:i?.node??t.node,seat:t.seat??u.harness}),x=e instanceof a||e instanceof Error&&`batchCustody`in e?t.batchCustody:void 0;x&&(ee=`Batch acceptance: ${x.acceptance}; retirement receipt ${x.cleanup?.mode===`release`&&x.cleanup.isComplete?`proved`:`unproved`}.`,te=!1,y=`tangle batch run --help`);let ne=z(t.resumeAt??m.resumeAt??m.resetAt);return{code:_,...x?{batchCustody:x}:{},subject:{...z(b.node)?{node:String(b.node)}:{},...z(b.seat)?{seat:String(b.seat)}:{}},what:v,cause:ee,fix:{command:y,...Array.isArray(g.alternatives)&&g.alternatives.every(e=>typeof e==`string`)?{alternatives:g.alternatives}:{},...g.edit===void 0?{}:{edit:g.edit},...z(g.url)?{url:String(g.url)}:{}},retryable:te,...ne&&Number.isFinite(Date.parse(ne))?{resumeAt:ne}:{},...z(t.runId)?{runId:String(t.runId)}:{},...z(t.requestId)?{requestId:String(t.requestId)}:{},...typeof t.status==`number`?{status:t.status}:{},...z(l.code)&&z(l.owner)?{runtimeFailure:{code:String(l.code),owner:String(l.owner),cause:typeof l.cause==`string`?l.cause:ee,...z(l.providerCode)?{providerCode:String(l.providerCode)}:{},...typeof l.providerStatus==`number`?{providerStatus:l.providerStatus}:{},...typeof l.retryAfterMs==`number`?{retryAfterMs:l.retryAfterMs}:{},...Object.keys(u).length?{remediation:u}:{}}}:{},...e instanceof s&&e.job?{job:e.job}:{}}}function Kt(e){let t=[e.subject.node&&`node ${e.subject.node}`,e.subject.seat].filter(Boolean).join(` · `);return`✗ ${`${t?`${t}: `:``}${e.what}${e.status?` (HTTP ${e.status})`:``}`}${e.cause===e.what?``:` — ${e.cause}`}\n → run: ${e.fix.command}`+(e.runtimeFailure?`\n runtime: ${e.runtimeFailure.code} · ${e.runtimeFailure.owner}${e.runtimeFailure.providerCode?` · ${e.runtimeFailure.providerCode}`:``}${e.runtimeFailure.providerStatus===void 0?``:` · HTTP ${e.runtimeFailure.providerStatus}`}${e.runtimeFailure.retryAfterMs===void 0?``:` · retry-after ${e.runtimeFailure.retryAfterMs} ms`}`:``)+(e.fix.alternatives?.map(e=>`\n or: ${e}`).join(``)??``)+(e.resumeAt?`\n resumes ${e.resumeAt}${e.subject.seat?` on ${e.subject.seat}`:``}`:``)}function qt(e){return Kt(Gt(e))}function B(e,t=!1){Nt();let n=Gt(e);t?N({ok:!1,error:n}):console.error(y.red(Kt(n)));let r=1;Lt.has(n.code)?r=77:Rt.has(n.code)?r=65:zt.has(n.code)?r=64:Bt.has(n.code)?r=78:[`SEAT_LIMIT`,`RATE_LIMITED`].includes(n.code)?r=75:[`HARNESS_NOT_INSTALLED`,`MCP_UNREACHABLE`,`NETWORK_UNAVAILABLE`].includes(n.code)?r=69:n.code===`RUN_STOPPED`&&(r=130),process.exit(r)}function Jt(e){if(e.startsWith(`github:`)){let[t,n]=e.slice(7).split(`@`,2),r=t.split(`/`).filter(Boolean);if(r.length<3)throw Error(`invalid github ref "${e}": expected github:<owner>/<repo>/<path>[@<ref>]`);let i=`${r[0]}/${r[1]}`,a=r.slice(2).join(`/`);return{kind:`github`,repository:i,path:a,...n?{ref:n}:{},name:he(a)}}let t;try{t=fe(e,`utf8`)}catch{throw Error(`cannot read skill/tool "${e}": not a readable file and not a github: ref`)}return{kind:`inline`,name:he(e),content:t}}function Yt(e){let t=(e.skills??[]).map(Jt),n=(e.tools??[]).map(Jt),r=t.length>0||n.length>0;if(!(!e.model&&!e.systemPrompt&&!r))return{...e.model?{model:{default:e.model}}:{},...e.systemPrompt?{prompt:{systemPrompt:e.systemPrompt}}:{},...r?{resources:{...t.length>0?{skills:t}:{},...n.length>0?{tools:n}:{}}}:{}}}async function Xt(e){let t;if(e.startsWith(`github:`)){let[n,r]=e.slice(7).split(`@`,2),i=n.split(`/`).filter(Boolean);if(i.length<3)throw Error(`invalid --profile github ref "${e}": expected github:<owner>/<repo>/<path>[@<ref>]`);let a=r??`main`;t=await Qt(`https://raw.githubusercontent.com/${i[0]}/${i[1]}/${a}/${i.slice(2).join(`/`)}`)}else t=/^https?:\/\//.test(e)?await Qt(e):fe(e,`utf8`);let n;try{n=JSON.parse(t)}catch{throw new R(`PROFILE_INVALID`,`Profile '${e}' is invalid`,`Expected a JSON AgentProfile`,`tangle agent profile create --name my-agent --json`)}return Zt(n,e)}function Zt(e,t){let n=ie.safeParse(e);if(!n.success)throw new R(`PROFILE_INVALID`,`Profile '${t}' is invalid`,n.error.issues.map(e=>`${e.path.join(`.`)||`(root)`}: ${e.message}`).join(`; `),`tangle agent profile create --name my-agent --json`);return e}async function Qt(e){let t=await fetch(e);if(!t.ok)throw Error(`failed to fetch ${e} (${t.status})`);return t.text()}async function $t(e){let t=e.profileSource?await Xt(e.profileSource):void 0,n=Yt(e);return t?n?{...t,...n,...n.resources?{resources:{...t.resources,...n.resources}}:{}}:t:n}const en=E.join(Se.homedir(),`.tangle`),tn=E.join(en,`credentials.json`),nn=`tangle-sandbox-cli`,rn=new Int32Array(new SharedArrayBuffer(4)),an=`TANGLE_ALLOW_PLAINTEXT_CREDENTIALS`;var on=class extends Error{constructor(e,t){super(`Credentials file at ${e} is corrupted and cannot be parsed. Inspect or remove it manually before retrying — refusing to overwrite it automatically.`),this.filePath=e,this.name=`CredentialsFileCorruptedError`,t&&(this.cause=t)}},sn=class extends Error{constructor(){super(`Could not store credential in the OS keychain, and the plaintext fallback is not enabled. Install a keychain provider (macOS Keychain or libsecret/secret-tool on Linux), or set ${an}=1 to opt into a plaintext credentials.json with mode 0600.`),this.name=`KeychainUnavailableError`}},cn=class extends Error{constructor(e){super(`Credential storage preflight failed: ${e}`),this.name=`CredentialStorageProbeError`}},ln=class extends Error{constructor(e){super(`Credential storage is busy. Wait a moment and retry.`),this.name=`CredentialsFileLockedError`,e&&(this.cause=e)}};function un(e){let t=gn(e);if(t)return{value:t,source:`keychain`};let n=yn(e);return n?{value:n,source:`file`}:{source:`none`}}function dn(e,t){if(_n(e,t))return xn(e),`keychain`;if(!mn())throw new sn;return bn(e,t),`file`}function fn(){let e=`credential-write-probe:${process.pid}:${S()}`,t=S();if(_n(e,t)){let n=gn(e);if(!vn(e))throw new cn(`the OS keychain accepted a test credential but the CLI could not remove it`);if(n!==t)throw new cn(`the OS keychain accepted a test credential but the CLI could not read it back`);return`keychain`}if(!mn())throw new sn;return Tn(e),`file`}function pn(e){vn(e),xn(e)}function mn(){let e=process.env[an];if(!e)return!1;let t=e.trim().toLowerCase();return t===`1`||t===`true`||t===`yes`}function hn(e,t){let n=process.platform;if(n!==`darwin`&&n!==`linux`)return;let r=n===`darwin`?`security`:`secret-tool`;try{return Te(r,e[n],{encoding:`utf8`,input:t,stdio:[t===void 0?`ignore`:`pipe`,`pipe`,`ignore`],timeout:n===`linux`?1e4:void 0}).trim()}catch{return}}function gn(e){let t=Dn(e);return hn({darwin:[`find-generic-password`,`-s`,nn,`-a`,t,`-w`],linux:[`lookup`,`service`,nn,`account`,t]})}function _n(e,t){let n=Dn(e),r=[`add-generic-password`,`-U`,`-s`,nn,`-a`],i=[`store`,`--label=Tangle Sandbox CLI`,`service`];return hn({darwin:[...r,n,`-w`,t],linux:[...i,nn,`account`,n]},process.platform===`linux`?t:void 0)!==void 0}function vn(e){let t=Dn(e);return hn({darwin:[`delete-generic-password`,`-s`,nn,`-a`,t],linux:[`clear`,`service`,nn,`account`,t]})!==void 0}function yn(e){return Cn()[e]}function bn(e,t){Sn(()=>{let n=Cn();n[e]=t,wn(n)})}function xn(e){return Sn(()=>{let t;try{t=Cn()}catch(e){if(e instanceof on)return!1;throw e}return e in t?(delete t[e],wn(t),yn(e)===void 0):!0})}function Sn(e){En();let t=Date.now()+2e3,n,r;for(;!n;)try{n=De(tn,{realpath:!1,stale:5e3})}catch(e){if(r=e instanceof Error?e:void 0,!e||typeof e!=`object`||!(`code`in e)||e.code!==`ELOCKED`)throw e;if(Date.now()>=t)throw new ln(r);Atomics.wait(rn,0,0,20)}try{return e()}finally{n()}}function Cn(){let e;try{e=T.readFileSync(tn,`utf8`)}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return{};throw e}try{let t=JSON.parse(e);if(typeof t!=`object`||!t||Array.isArray(t))throw new on(tn);let n={};for(let[e,r]of Object.entries(t))typeof r==`string`&&(n[e]=r);return n}catch(e){throw e instanceof on?e:new on(tn,e instanceof Error?e:void 0)}}function wn(e){if(En(),Object.keys(e).length===0){T.existsSync(tn)&&T.unlinkSync(tn);return}let t=`${tn}.${process.pid}.tmp`;T.writeFileSync(t,`${JSON.stringify(e,null,2)}\n`,{mode:384}),T.renameSync(t,tn)}function Tn(e){let t=S(),n=!1,r;try{if(bn(e,t),n=!0,yn(e)!==t)throw new cn(`the credentials file did not return the value just written`)}catch(e){r=e}finally{if(n)try{!xn(e)&&!r&&(r=new cn(`the credentials file accepted a test credential but the CLI could not remove it`))}catch(e){r??=e}}if(r)throw r}function En(){if(!T.existsSync(en)){T.mkdirSync(en,{mode:448,recursive:!0});return}if(process.platform!==`win32`)try{(T.statSync(en).mode&511)!=448&&T.chmodSync(en,448)}catch{}}function Dn(e){return`profile:${e}`}const On=E.join(Se.homedir(),`.tangle`),kn=E.join(On,`config.json`),An=`https://id.tangle.tools`,jn=`https://solve.tangle.tools/api/solve`,Mn=`default`;function Nn(){return{tangleBaseUrl:process.env.TANGLE_BASE_URL,sandboxBaseUrl:process.env.SANDBOX_BASE_URL,hubUrl:process.env.TANGLE_HUB_URL}}function Pn(e,t){let n=zn(t??(e===`solve`?`solve`:void 0));if(e===`solve`){if(n!==`solve`)throw Error(`The solve app cannot use profile '${n}'. Use the reserved 'solve' profile.`);return n}if(e===`sandbox`&&!t&&n===`solve`)return Mn;if(new Set([`solve`]).has(n))throw Error(`The ${e} app cannot use the reserved '${n}' profile. Use the '${e}' profile or choose a custom profile.`);return n}function Fn(){T.existsSync(On)||T.mkdirSync(On,{mode:448,recursive:!0})}function In(e,t){Fn();let n=`${e}.${process.pid}.tmp`;T.writeFileSync(n,t,{mode:384}),T.renameSync(n,e)}function Ln(e){return e.startsWith(`sk_`)||e.startsWith(`sk-tan-`)}function V(){try{if(T.existsSync(kn))return JSON.parse(T.readFileSync(kn,`utf-8`))}catch{}return{}}function Rn(e){let t=fr(V(),e);In(kn,`${JSON.stringify(t,null,2)}\n`)}function zn(e){return pr(e||process.env.TANGLE_PROFILE||process.env.SANDBOX_PROFILE||V().activeProfile||Mn)}function Bn(e){Rn({activeProfile:pr(e)})}function Vn(){return{token:process.env.TANGLE_LINE_TOKEN,baseUrl:process.env.TANGLE_HUB_URL}}function Hn(){return process.env.TANGLE_SANDBOX||V().currentSandbox||void 0}function Un(e){Rn({currentSandbox:e})}function Wn(){let e=V();delete e.currentSandbox,In(kn,`${JSON.stringify(e,null,2)}\n`)}function Gn(){let e=V().deviceId;if(e&&/^[A-Za-z0-9_.-]{1,64}$/.test(e))return e;let t=Se.hostname().replace(/[^A-Za-z0-9_.-]/g,`-`).replace(/^-+|-+$/g,``).slice(0,32),n=ne(4).toString(`hex`),r=`${t?`${t}-`:`device-`}${n}`;return Rn({deviceId:r}),r}function Kn(e){let t=e||Hn();if(!t)throw Error("No sandbox specified. Pass it positionally, set a default with `tangle use <id>`, pass `--box <id>`, or set TANGLE_SANDBOX.");return t}function qn(){let e=V(),t=zn(),n=new Set([Mn,...Object.keys(e.profiles??{})]);return e.activeProfile&&n.add(pr(e.activeProfile)),[...n].map(e=>{let n=un(e).source;return{name:e,active:e===t,hasApiKey:n!==`none`,baseUrl:nr(void 0,e),apiKeySource:n}}).sort((e,t)=>e.name.localeCompare(t.name))}function Jn(e){let t=zn(e);return{name:t,active:t===zn(),baseUrl:nr(void 0,t),credentialSource:un(t).source}}function Yn(e,t){let n=pr(e),r=V(),i=dr(n,r),a={},o=t.baseUrl??i.baseUrl;o&&(a.baseUrl=o);let s=t.activeTeamId??i.activeTeamId;s&&(a.activeTeamId=s);let c=t.activeTeamName??i.activeTeamName;c&&(a.activeTeamName=c);let l={...r.profiles??{}};a.baseUrl||a.activeTeamId||a.activeTeamName?l[n]=a:delete l[n];let u;return t.apiKey&&(u=dn(n,t.apiKey)),Rn({profiles:Object.keys(l).length>0?l:{}}),u}function Xn(e){let t=zn(e),n={...V().profiles??{}},r=n[t];if(r){let e={...r};e.baseUrl||e.activeTeamId||e.activeTeamName?n[t]=e:delete n[t]}Rn({profiles:n}),pn(t)}function Zn(){let e=process.env.TANGLE_API_KEY_FILE;if(e){let t=T.readFileSync(e,`utf8`).trim();if(!t.startsWith(`sk-tan-`))throw Error(`Invalid sandbox credential file`);return t}return process.env.TANGLE_API_KEY}function Qn(e,t){let n=Pn(`sandbox`,t);return e||Zn()||un(n).value}function $n(e,t){return e||(process.env.TANGLE_SOLVE_API_KEY?process.env.TANGLE_SOLVE_API_KEY:un(Pn(`solve`,t)).value)}function er(e,t){let n=Pn(`sandbox`,t);return e?`flag`:process.env.TANGLE_API_KEY_FILE||process.env.TANGLE_API_KEY?`env`:un(n).source}function tr(e,t){return e?`flag`:process.env.TANGLE_SOLVE_API_KEY?`env`:un(Pn(`solve`,t)).source}function nr(e,t){if(e)return e;let n=process.env.TANGLE_BASE_URL||process.env.SANDBOX_BASE_URL;if(n)return n;let r=zn(t),i=V(),a=dr(r,i);return a.baseUrl?a.baseUrl:(r===Mn||r===`sandbox`)&&i.baseUrl?i.baseUrl:`https://sandbox.tangle.tools`}function rr(e){if(e)return e.replace(/\/v1\/hub\/?$/,``)}function ir(e){return e?.trim().replace(/\/+$/,``)||void 0}function ar(e){return ir(e?.flag)??ir(rr(ir(process.env.TANGLE_HUB_URL)))??ir(process.env.TANGLE_PLATFORM_URL)??ir(e?.cachedPlatformUrl?.())??An}function or(e){let t=ir(e)??ir(process.env.TANGLE_SOLVE_API_URL);if(t&&t!==jn)throw Error(`Solve credentials may only be sent to ${jn}`);return jn}function sr(e){let t=ir(e);if(t&&t!==An)throw Error(`Solve credentials may only be sent to ${An}`);return An}function H(e){let t=Pn(`sandbox`,e.profile),n=Qn(e.apiKey,t);if(!n)throw Error(`No API key found for profile '${t}'. Set TANGLE_API_KEY or run: tangle auth login${t===Mn?``:` --profile ${t}`}`);return{apiKey:n,baseUrl:nr(e.baseUrl,t),timeout:e.timeout??3e4,profile:t,...cr(t)}}function cr(e){let t=V(),n=dr(zn(e),t);return{activeTeamId:n.activeTeamId,activeTeamName:n.activeTeamName}}function lr(e,t){Yn(zn(t),{activeTeamId:e.id,activeTeamName:e.name})}function ur(e){let t=zn(e),n=V(),r={...n.profiles??{}},i={baseUrl:dr(t,n).baseUrl};i.baseUrl?r[t]=i:delete r[t],Rn({profiles:r})}function dr(e,t=V()){let n=pr(e);return{...n===Mn?{baseUrl:t.baseUrl,activeTeamId:t.profiles?.[Mn]?.activeTeamId,activeTeamName:t.profiles?.[Mn]?.activeTeamName}:{},...t.profiles?.[n]??{}}}function fr(e,t){let n=t.profiles===void 0?{...e.profiles??{}}:Object.fromEntries(Object.entries(t.profiles).filter(([,e])=>!!(e.apiKey||e.baseUrl||e.activeTeamId||e.activeTeamName)));return{...e,...t,profiles:Object.keys(n).length>0?n:void 0}}function pr(e){let t=e.trim().toLowerCase();if(!t)throw Error(`Profile name cannot be empty`);if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw Error(`Profile names may only contain lowercase letters, numbers, dots, underscores, and hyphens`);return t}let mr=null,hr=null;function U(e){if(!e&&mr)return mr;let t=e??H({});return(!mr||!hr||hr.apiKey!==t.apiKey||hr.baseUrl!==t.baseUrl||hr.timeout!==t.timeout)&&(mr=new l({apiKey:t.apiKey,baseUrl:t.baseUrl,timeoutMs:t.timeout}),hr=t),mr}function gr(){mr=null,hr=null}function W(e){let t=H({apiKey:e.apiKey,baseUrl:e.baseUrl});return{context:t,client:U(t)}}async function _r(e,t){let n=t.trim();if(n.length===0)throw Error(`Connection reference is empty.`);if(n.startsWith(`hubconn_`))return n;let{connections:r}=await e.connections.list();return vr(r,n)}function vr(e,t){let n=t.trim();if(n.length===0)throw Error(`Connection reference is empty.`);let r=e.find(e=>e.id===n);if(r)return r.id;let i=n.indexOf(`:`),a=(i===-1?n:n.slice(0,i)).trim().toLowerCase(),o=i===-1?null:n.slice(i+1).trim(),s=e.filter(e=>e.status!==`revoked`&&e.providerId.toLowerCase()===a);if(o&&o.length>0){let e=o.toLowerCase();s=s.filter(t=>(t.accountDisplay??``).toLowerCase()===e||t.displayName.toLowerCase()===e)}if(s.length===1)return s[0].id;throw s.length===0?Error(`No hub connection matches "${t}". List your connections with \`tangle hub connections\`.`):Error(yr(t,s))}function yr(e,t){let n=t.map(e=>`- ${e.id} (provider: ${e.providerId}, account: ${e.accountDisplay??e.displayName})`).join(`
|
|
1
|
+
import{createRequire as e,findPackageJSON as t}from"node:module";import"dotenv/config";import{ALL_BACKEND_TYPES as n,AuthError as r,GPU_LEASE_PROVIDER_NAMES as i,NetworkError as a,NotFoundError as o,PublicTemplatePublishError as s,QuotaError as c,Sandbox as l,ServerError as u,StateError as d,TimeoutError as f,ValidationError as p,createAgentRunOutcomeTracker as m,createConfidentialSandbox as h,generateAttestationNonce as g,parseBackendType as _,parseSSEStream as v,validateBatchRunRequest as ee}from"@tangle-network/sandbox";import y from"chalk";import te from"ora";import{Command as b}from"commander";import{createHash as x,randomBytes as ne,randomUUID as S}from"node:crypto";import{ProxySecretsSchema as re,agentInteractiveSessionRunRef as C,agentProfileSchema as ie,canonicalAgentProfileDigest as w,canonicalCandidateDigest as ae,modelProvider as oe,parseSeatSpec as se}from"@tangle-network/agent-interface";import*as T from"node:fs";import{chmodSync as ce,constants as le,existsSync as ue,mkdirSync as de,readFileSync as fe,renameSync as pe,writeFileSync as me}from"node:fs";import*as E from"node:path";import{basename as he,dirname as ge,extname as _e,isAbsolute as ve,join as D,relative as ye,resolve as be,sep as xe}from"node:path";import*as Se from"node:os";import{homedir as O,tmpdir as Ce}from"node:os";import{execFile as we,execFileSync as Te,spawn as Ee}from"node:child_process";import{lockSync as De}from"proper-lockfile";import{HubClient as Oe}from"@tangle-network/hub-sdk";import{createInterface as ke}from"node:readline";import{Writable as Ae}from"node:stream";import{buffer as je}from"node:stream/consumers";import{setTimeout as Me}from"node:timers/promises";import{CONTENT_COMPLETION_KEY as Ne,CONTENT_PROMPT_KEY as Pe,CONTENT_TOOL_ARGS_KEY as Fe,CONTENT_TOOL_NAME_KEY as Ie,CONTENT_TOOL_RESULT_KEY as Le,TANGLE_SUBJECT_KEY as Re,asContentField as k,asContentString as ze}from"@tangle-network/agent-core/telemetry";import{execCli as Be,shellQuote as Ve}from"@tangle-network/sdk-cli-runner";import*as A from"node:fs/promises";import{mkdir as He,mkdtemp as Ue,open as We,readFile as Ge,realpath as Ke,writeFile as qe}from"node:fs/promises";import{z as j}from"zod";import{listLocalModels as Je,loadConfig as Ye}from"cli-bridge";import{createMcpServer as Xe}from"@tangle-network/sandbox/agent";import{ensureAgentPreview as Ze,publishAgentPreview as Qe,resolveSelfSandbox as $e}from"@tangle-network/sandbox/preview";import{fileURLToPath as et}from"node:url";import{generatePrivateKey as tt,privateKeyToAccount as nt}from"viem/accounts";import{promisify as rt}from"node:util";import{createPublicClient as it,createWalletClient as at,decodeAbiParameters as ot,decodeEventLog as st,encodeAbiParameters as ct,getAddress as lt,http as ut,isAddress as dt,keccak256 as ft,parseAbi as pt,parseAbiItem as mt,parseAbiParameters as ht,stringToHex as gt,toHex as _t}from"viem";import{tempoModerato as vt}from"viem/chains";import{Actions as yt,withRelay as bt}from"viem/tempo";import xt from"ws";import{createIntelligenceClient as St}from"@tangle-network/sandbox/intelligence";let Ct=!1;function wt(e){Ct=e}function Tt(...e){Ct?console.error(...e):console.log(...e)}function Et(e){return e==null?y.dim(`-`):typeof e==`boolean`?e?y.green(`yes`):y.red(`no`):e instanceof Date?Ot(e):typeof e==`string`&&Dt(e)?Ot(new Date(e)):String(e)}function Dt(e){return/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/.test(e)}function Ot(e){let t=Date.now()-e.getTime();if(t<6e4)return`just now`;if(t<36e5)return`${Math.floor(t/6e4)} min ago`;if(t<864e5){let e=Math.floor(t/36e5);return`${e} hour${e>1?`s`:``} ago`}let n=Math.floor(t/864e5);return`${n} day${n>1?`s`:``} ago`}function kt(e){switch(e){case`running`:return y.green(e);case`pending`:case`provisioning`:return y.yellow(e);case`stopped`:return y.gray(e);case`failed`:case`deleted`:return y.red(e);default:return e}}function M(e,t){let n=t.map(t=>{let n=t.header.length,r=Math.max(...e.map(e=>Et(e[t.key]).length));return t.width??Math.max(n,r)+2}),r=e.map(e=>t.map(t=>t.key===`status`?kt(String(e[t.key])):Et(e[t.key])));It(t.map(e=>e.header),r,n)}function N(e){console.log(JSON.stringify(e,null,2))}function P(e){Tt(y.green(`✓`),e)}function At(e){console.error(y.red(`✗`),e)}function jt(e){Tt(y.yellow(`!`),e)}function F(e){Tt(y.blue(`→`),e)}const Mt=new Set;function I(e){let t=te({text:e,color:`cyan`,isSilent:Ct});return Mt.add(t),t}function Nt(){for(let e of Mt)e.isSpinning&&e.stop();Mt.clear()}function L(e,t=0){let n=` `.repeat(t);for(let[t,r]of Object.entries(e))r!=null&&console.log(`${n}${y.dim(`${t}:`)} ${Et(r)}`)}function Pt(e){let t=`${e.cpuCores} vCPU / ${e.memoryMB} MB / ${e.diskGB} GB`;return e.pool?`${t} (pool: ${e.pool})`:t}function Ft(e){if(console.log(),console.log(y.bold(`Sandbox Details`)),console.log(y.dim(`─`.repeat(40))),L({ID:e.id,Name:e.name,Status:kt(e.status),Resources:e.resources?Pt(e.resources):void 0,Created:e.createdAt,Expires:e.expiresAt}),e.connection){if(console.log(),console.log(y.bold(`Connection`)),console.log(y.dim(`─`.repeat(40))),e.connection.ssh){let{ssh:t}=e.connection,n=process.platform===`win32`?`NUL`:`/dev/null`,r=`ssh -o ProxyCommand="${t.proxyCommand}" -o StrictHostKeyChecking=no -o UserKnownHostsFile=${n} -o GlobalKnownHostsFile=${n} -o LogLevel=ERROR -o ServerAliveInterval=15 -o ServerAliveCountMax=4 -o TCPKeepAlive=yes ${t.username}@localhost -p ${t.port}`;L({SSH:process.platform===`win32`?`$env:TANGLE_SSH_PROXY_AUTH_TOKEN='<token>'; ${r}`:`TANGLE_SSH_PROXY_AUTH_TOKEN='<token>' ${r}`})}e.connection.webTerminalUrl&&L({"Web Terminal":e.connection.webTerminalUrl}),e.connection.runtimeUrl&&L({"API URL":e.connection.runtimeUrl})}console.log()}function It(e,t,n){if(t.length===0){console.log(y.dim(`No items found.`));return}let r=n??e.map((e,n)=>{let r=Math.max(...t.map(e=>String(e[n]??``).length));return Math.max(e.length,r)+2});console.log(e.map((e,t)=>y.bold(e.padEnd(r[t]))).join(``));for(let e of t)console.log(e.map((e,t)=>String(e??``).padEnd(r[t])).join(``))}var R=class extends Error{constructor(e,t,n,r){super(t),this.code=e,this.cause=n,this.fix=r,this.name=`ActionableCliError`}};const Lt=new Set([`AUTH_EXPIRED`,`AUTH_WRONG_AUDIENCE`,`SEAT_NONE_DETECTED`,`SEAT_NOT_LOGGED_IN`,`SEAT_NOT_ENROLLED`,`HUB_NOT_CONNECTED`,`HUB_RECONNECT`,`HUB_APP_NOT_INSTALLED`,`HUB_APPROVAL_REQUIRED`]),Rt=new Set([`GRAPH_INVALID`,`STEP_REF`,`PROFILE_INVALID`,`UNKNOWN_HARNESS`,`HUB_TOOL_UNKNOWN`,`TRIGGER_INVALID`,`WORKFLOW_INPUT_FILE_INVALID`,`VALIDATION_ERROR`]),zt=new Set([`UNKNOWN_COMMAND`,`GRAPH_PARAM_MISSING`,`GRAPH_PARAM_UNKNOWN`,`SEAT_SYNTAX`,`HUB_PROVIDER_UNKNOWN`,`USAGE_INVALID`]),Bt=new Set([`SUBSCRIPTION_REQUIRED`,`MODEL_NOT_FOUND`,`MODEL_PROVIDER_MISMATCH`,`MCP_BLOCKED`,`CLOUD_SEAT_UNSUPPORTED`,`SCHEDULE_AUTHORITY`]);function Vt(e){return typeof e==`object`&&e?e:{}}function z(e){return typeof e==`string`&&e.length>0?e:void 0}function Ht(e){let t=z(e);return t&&/^[a-z0-9][a-z0-9_-]*$/i.test(t)?t:void 0}function Ut(e){let t,n=e;for(let e=0;n instanceof Error&&e<5;e++,n=n.cause){let e=n.message||(n instanceof AggregateError?n.errors.map(e=>e instanceof Error?e.message:String(e)).join(`; `):``),r=z(Vt(n).code);(e||r)&&(t=r?`${r}${e?`: ${e}`:``}`:e)}return t}function Wt(e){return e.code===`credential-refused`&&e.owner===`caller`&&e.providerCode===`subscription_required`?Vt(e.remediation):{}}function Gt(e){let t=Vt(e),n=Array.isArray(t.runtimeFailures)?t.runtimeFailures.map(Vt):[],i=n.find(e=>z(Wt(Vt(e.failure)).fix))??n[0],l=Vt(i?.failure??t.runtimeFailure),u=Wt(l),m=Vt(t.details),h=Ht(t.provider??m.provider??m.providerId),g=Vt(t.fix??m.fix),_=z(t.code)??`CLI_ERROR`,v=z(t.message)??String(e),ee=z(l.cause)??z(t.cause)??z(m.reason)??v,y=`tangle --help`,te=typeof m.providerRetryable==`boolean`?m.providerRetryable:typeof t.retryable==`boolean`?t.retryable:null;if(e instanceof r||_===`HUB_UNAUTHENTICATED`||t.status===401)_=`AUTH_EXPIRED`,v=`Authentication failed`,y=`tangle auth login`;else if([`HUB_CONNECTION_MISSING`,`HUB_CONNECTION_REVOKED`,`HUB_CONNECTION_UNHEALTHY`,`HUB_RECONNECT_REQUIRED`,`CONNECTION_REQUIRED`].includes(_))_=[`HUB_CONNECTION_MISSING`,`CONNECTION_REQUIRED`].includes(_)?`HUB_NOT_CONNECTED`:`HUB_RECONNECT`,y=h?`tangle hub connect ${h}`:`tangle hub connections --json`;else if(_===`HUB_APPROVAL_REQUIRED`){let e=Ht(Vt(m.approval).id);y=e?`tangle hub approvals approve ${e}`:`tangle hub approvals list --json`}else _===`HUB_PROVIDER_REJECTED`?(y=`tangle hub status --json`,m.providerRetryable===!1&&(ee+=`. Change the request before retrying`)):_===`provider_quota_exhausted`||_===`SEAT_LIMIT`?(_=`SEAT_LIMIT`,y=`tangle auth status`,te=!0):e instanceof c?y=`tangle usage --json`:e instanceof a?(_=`NETWORK_UNAVAILABLE`,v=`Network error: ${v}`,ee=Ut(e.cause)??`No response arrived`,y=`tangle auth status --json`):e instanceof f?(_=`TIMEOUT`,y=`tangle sandbox list --json`):e instanceof p?(_=`VALIDATION_ERROR`,v=`Invalid input`):e instanceof o||e instanceof d?y=`tangle sandbox list --json`:_===`commander.unknownCommand`?(_=`UNKNOWN_COMMAND`,y=v.includes(`'graph'`)?`npm install -g @tangle-network/sandbox-cli@latest`:`tangle --help`):_.startsWith(`commander.`)?_=`USAGE_INVALID`:(_===`ENOENT`||_===`EACCES`)&&(_=`INPUT_UNAVAILABLE`);e instanceof R&&(y=e.fix,te=!1),z(u.fix)&&(_=u.cause===`not_authenticated`?`SEAT_NOT_LOGGED_IN`:`SUBSCRIPTION_REQUIRED`),e instanceof s&&y===`tangle --help`&&(y=`tangle template publish --help`),y=z(u.fix)??z(g.command)??(_===`HUB_NOT_CONNECTED`?void 0:z(t.fixCommand))??y,Lt.has(_)&&y===`tangle --help`&&(y=`tangle auth login`);let b=Vt(t.subject??m.subject??{node:i?.node??t.node,seat:t.seat??u.harness}),x=e instanceof a||e instanceof Error&&`batchCustody`in e?t.batchCustody:void 0;x&&(ee=`Batch acceptance: ${x.acceptance}; retirement receipt ${x.cleanup?.mode===`release`&&x.cleanup.isComplete?`proved`:`unproved`}.`,te=!1,y=`tangle batch run --help`);let ne=z(t.resumeAt??m.resumeAt??m.resetAt);return{code:_,...x?{batchCustody:x}:{},catalogCode:z(t.catalogCode),message:z(t.nextStep)&&z(t.message),nextStep:z(t.nextStep),subject:{...z(b.node)?{node:String(b.node)}:{},...z(b.seat)?{seat:String(b.seat)}:{}},what:v,cause:ee,fix:{command:y,...Array.isArray(g.alternatives)&&g.alternatives.every(e=>typeof e==`string`)?{alternatives:g.alternatives}:{},...g.edit===void 0?{}:{edit:g.edit},...z(g.url)?{url:String(g.url)}:{}},retryable:te,...ne&&Number.isFinite(Date.parse(ne))?{resumeAt:ne}:{},...z(t.runId)?{runId:String(t.runId)}:{},...z(t.requestId)?{requestId:String(t.requestId)}:{},...typeof t.status==`number`?{status:t.status}:{},...z(l.code)&&z(l.owner)?{runtimeFailure:{code:String(l.code),owner:String(l.owner),cause:typeof l.cause==`string`?l.cause:ee,...z(l.providerCode)?{providerCode:String(l.providerCode)}:{},...typeof l.providerStatus==`number`?{providerStatus:l.providerStatus}:{},...typeof l.retryAfterMs==`number`?{retryAfterMs:l.retryAfterMs}:{},...Object.keys(u).length?{remediation:u}:{}}}:{},...e instanceof s&&e.job?{job:e.job}:{}}}function Kt(e){let t=[e.subject.node&&`node ${e.subject.node}`,e.subject.seat].filter(Boolean).join(` · `);return`✗ ${`${t?`${t}: `:``}${e.what}${e.status?` (HTTP ${e.status})`:``}`}${e.cause===e.what?``:` — ${e.cause}`}${e.nextStep?`\n → next: ${e.nextStep}`:``}\n → run: ${e.fix.command}`+(e.runtimeFailure?`\n runtime: ${e.runtimeFailure.code} · ${e.runtimeFailure.owner}${e.runtimeFailure.providerCode?` · ${e.runtimeFailure.providerCode}`:``}${e.runtimeFailure.providerStatus===void 0?``:` · HTTP ${e.runtimeFailure.providerStatus}`}${e.runtimeFailure.retryAfterMs===void 0?``:` · retry-after ${e.runtimeFailure.retryAfterMs} ms`}`:``)+(e.fix.alternatives?.map(e=>`\n or: ${e}`).join(``)??``)+(e.resumeAt?`\n resumes ${e.resumeAt}${e.subject.seat?` on ${e.subject.seat}`:``}`:``)}function qt(e){return Kt(Gt(e))}function B(e,t=!1){Nt();let n=Gt(e);t?N({ok:!1,error:n}):console.error(y.red(Kt(n)));let r=1;Lt.has(n.code)?r=77:Rt.has(n.code)?r=65:zt.has(n.code)?r=64:Bt.has(n.code)?r=78:[`SEAT_LIMIT`,`RATE_LIMITED`].includes(n.code)?r=75:[`HARNESS_NOT_INSTALLED`,`MCP_UNREACHABLE`,`NETWORK_UNAVAILABLE`].includes(n.code)?r=69:n.code===`RUN_STOPPED`&&(r=130),process.exit(r)}function Jt(e){if(e.startsWith(`github:`)){let[t,n]=e.slice(7).split(`@`,2),r=t.split(`/`).filter(Boolean);if(r.length<3)throw Error(`invalid github ref "${e}": expected github:<owner>/<repo>/<path>[@<ref>]`);let i=`${r[0]}/${r[1]}`,a=r.slice(2).join(`/`);return{kind:`github`,repository:i,path:a,...n?{ref:n}:{},name:he(a)}}let t;try{t=fe(e,`utf8`)}catch{throw Error(`cannot read skill/tool "${e}": not a readable file and not a github: ref`)}return{kind:`inline`,name:he(e),content:t}}function Yt(e){let t=(e.skills??[]).map(Jt),n=(e.tools??[]).map(Jt),r=t.length>0||n.length>0;if(!(!e.model&&!e.systemPrompt&&!r))return{...e.model?{model:{default:e.model}}:{},...e.systemPrompt?{prompt:{systemPrompt:e.systemPrompt}}:{},...r?{resources:{...t.length>0?{skills:t}:{},...n.length>0?{tools:n}:{}}}:{}}}async function Xt(e){let t;if(e.startsWith(`github:`)){let[n,r]=e.slice(7).split(`@`,2),i=n.split(`/`).filter(Boolean);if(i.length<3)throw Error(`invalid --profile github ref "${e}": expected github:<owner>/<repo>/<path>[@<ref>]`);let a=r??`main`;t=await Qt(`https://raw.githubusercontent.com/${i[0]}/${i[1]}/${a}/${i.slice(2).join(`/`)}`)}else t=/^https?:\/\//.test(e)?await Qt(e):fe(e,`utf8`);let n;try{n=JSON.parse(t)}catch{throw new R(`PROFILE_INVALID`,`Profile '${e}' is invalid`,`Expected a JSON AgentProfile`,`tangle agent profile create --name my-agent --json`)}return Zt(n,e)}function Zt(e,t){let n=ie.safeParse(e);if(!n.success)throw new R(`PROFILE_INVALID`,`Profile '${t}' is invalid`,n.error.issues.map(e=>`${e.path.join(`.`)||`(root)`}: ${e.message}`).join(`; `),`tangle agent profile create --name my-agent --json`);return e}async function Qt(e){let t=await fetch(e);if(!t.ok)throw Error(`failed to fetch ${e} (${t.status})`);return t.text()}async function $t(e){let t=e.profileSource?await Xt(e.profileSource):void 0,n=Yt(e);return t?n?{...t,...n,...n.resources?{resources:{...t.resources,...n.resources}}:{}}:t:n}const en=E.join(Se.homedir(),`.tangle`),tn=E.join(en,`credentials.json`),nn=`tangle-sandbox-cli`,rn=new Int32Array(new SharedArrayBuffer(4)),an=`TANGLE_ALLOW_PLAINTEXT_CREDENTIALS`;var on=class extends Error{constructor(e,t){super(`Credentials file at ${e} is corrupted and cannot be parsed. Inspect or remove it manually before retrying — refusing to overwrite it automatically.`),this.filePath=e,this.name=`CredentialsFileCorruptedError`,t&&(this.cause=t)}},sn=class extends Error{constructor(){super(`Could not store credential in the OS keychain, and the plaintext fallback is not enabled. Install a keychain provider (macOS Keychain or libsecret/secret-tool on Linux), or set ${an}=1 to opt into a plaintext credentials.json with mode 0600.`),this.name=`KeychainUnavailableError`}},cn=class extends Error{constructor(e){super(`Credential storage preflight failed: ${e}`),this.name=`CredentialStorageProbeError`}},ln=class extends Error{constructor(e){super(`Credential storage is busy. Wait a moment and retry.`),this.name=`CredentialsFileLockedError`,e&&(this.cause=e)}};function un(e){let t=gn(e);if(t)return{value:t,source:`keychain`};let n=yn(e);return n?{value:n,source:`file`}:{source:`none`}}function dn(e,t){if(_n(e,t))return xn(e),`keychain`;if(!mn())throw new sn;return bn(e,t),`file`}function fn(){let e=`credential-write-probe:${process.pid}:${S()}`,t=S();if(_n(e,t)){let n=gn(e);if(!vn(e))throw new cn(`the OS keychain accepted a test credential but the CLI could not remove it`);if(n!==t)throw new cn(`the OS keychain accepted a test credential but the CLI could not read it back`);return`keychain`}if(!mn())throw new sn;return Tn(e),`file`}function pn(e){vn(e),xn(e)}function mn(){let e=process.env[an];if(!e)return!1;let t=e.trim().toLowerCase();return t===`1`||t===`true`||t===`yes`}function hn(e,t){let n=process.platform;if(n!==`darwin`&&n!==`linux`)return;let r=n===`darwin`?`security`:`secret-tool`;try{return Te(r,e[n],{encoding:`utf8`,input:t,stdio:[t===void 0?`ignore`:`pipe`,`pipe`,`ignore`],timeout:n===`linux`?1e4:void 0}).trim()}catch{return}}function gn(e){let t=Dn(e);return hn({darwin:[`find-generic-password`,`-s`,nn,`-a`,t,`-w`],linux:[`lookup`,`service`,nn,`account`,t]})}function _n(e,t){let n=Dn(e),r=[`add-generic-password`,`-U`,`-s`,nn,`-a`],i=[`store`,`--label=Tangle Sandbox CLI`,`service`];return hn({darwin:[...r,n,`-w`,t],linux:[...i,nn,`account`,n]},process.platform===`linux`?t:void 0)!==void 0}function vn(e){let t=Dn(e);return hn({darwin:[`delete-generic-password`,`-s`,nn,`-a`,t],linux:[`clear`,`service`,nn,`account`,t]})!==void 0}function yn(e){return Cn()[e]}function bn(e,t){Sn(()=>{let n=Cn();n[e]=t,wn(n)})}function xn(e){return Sn(()=>{let t;try{t=Cn()}catch(e){if(e instanceof on)return!1;throw e}return e in t?(delete t[e],wn(t),yn(e)===void 0):!0})}function Sn(e){En();let t=Date.now()+2e3,n,r;for(;!n;)try{n=De(tn,{realpath:!1,stale:5e3})}catch(e){if(r=e instanceof Error?e:void 0,!e||typeof e!=`object`||!(`code`in e)||e.code!==`ELOCKED`)throw e;if(Date.now()>=t)throw new ln(r);Atomics.wait(rn,0,0,20)}try{return e()}finally{n()}}function Cn(){let e;try{e=T.readFileSync(tn,`utf8`)}catch(e){if(e instanceof Error&&`code`in e&&e.code===`ENOENT`)return{};throw e}try{let t=JSON.parse(e);if(typeof t!=`object`||!t||Array.isArray(t))throw new on(tn);let n={};for(let[e,r]of Object.entries(t))typeof r==`string`&&(n[e]=r);return n}catch(e){throw e instanceof on?e:new on(tn,e instanceof Error?e:void 0)}}function wn(e){if(En(),Object.keys(e).length===0){T.existsSync(tn)&&T.unlinkSync(tn);return}let t=`${tn}.${process.pid}.tmp`;T.writeFileSync(t,`${JSON.stringify(e,null,2)}\n`,{mode:384}),T.renameSync(t,tn)}function Tn(e){let t=S(),n=!1,r;try{if(bn(e,t),n=!0,yn(e)!==t)throw new cn(`the credentials file did not return the value just written`)}catch(e){r=e}finally{if(n)try{!xn(e)&&!r&&(r=new cn(`the credentials file accepted a test credential but the CLI could not remove it`))}catch(e){r??=e}}if(r)throw r}function En(){if(!T.existsSync(en)){T.mkdirSync(en,{mode:448,recursive:!0});return}if(process.platform!==`win32`)try{(T.statSync(en).mode&511)!=448&&T.chmodSync(en,448)}catch{}}function Dn(e){return`profile:${e}`}const On=E.join(Se.homedir(),`.tangle`),kn=E.join(On,`config.json`),An=`https://id.tangle.tools`,jn=`https://solve.tangle.tools/api/solve`,Mn=`default`;function Nn(){return{tangleBaseUrl:process.env.TANGLE_BASE_URL,sandboxBaseUrl:process.env.SANDBOX_BASE_URL,hubUrl:process.env.TANGLE_HUB_URL}}function Pn(e,t){let n=Bn(t??(e===`solve`?`solve`:void 0));if(e===`solve`){if(n!==`solve`)throw Error(`The solve app cannot use profile '${n}'. Use the reserved 'solve' profile.`);return n}if(e===`sandbox`&&!t&&n===`solve`)return Mn;if(new Set([`solve`]).has(n))throw Error(`The ${e} app cannot use the reserved '${n}' profile. Use the '${e}' profile or choose a custom profile.`);return n}function Fn(){T.existsSync(On)||T.mkdirSync(On,{mode:448,recursive:!0})}function In(e,t){Fn();let n=`${e}.${process.pid}.tmp`;T.writeFileSync(n,t,{mode:384}),T.renameSync(n,e)}function Ln(e){return e.startsWith(`sk_`)||e.startsWith(`sk-tan-`)}function Rn(){try{if(T.existsSync(kn))return JSON.parse(T.readFileSync(kn,`utf-8`))}catch{}return{}}function zn(e){let t=pr(Rn(),e);In(kn,`${JSON.stringify(t,null,2)}\n`)}function Bn(e){return mr(e||process.env.TANGLE_PROFILE||process.env.SANDBOX_PROFILE||Rn().activeProfile||Mn)}function Vn(e){zn({activeProfile:mr(e)})}function Hn(){return{token:process.env.TANGLE_LINE_TOKEN,baseUrl:process.env.TANGLE_HUB_URL}}function Un(){return process.env.TANGLE_SANDBOX||Rn().currentSandbox||void 0}function Wn(e){zn({currentSandbox:e})}function Gn(){let e=Rn();delete e.currentSandbox,In(kn,`${JSON.stringify(e,null,2)}\n`)}function Kn(){let e=Rn().deviceId;if(e&&/^[A-Za-z0-9_.-]{1,64}$/.test(e))return e;let t=Se.hostname().replace(/[^A-Za-z0-9_.-]/g,`-`).replace(/^-+|-+$/g,``).slice(0,32),n=ne(4).toString(`hex`),r=`${t?`${t}-`:`device-`}${n}`;return zn({deviceId:r}),r}function qn(e){let t=e||Un();if(!t)throw Error("No sandbox specified. Pass it positionally, set a default with `tangle use <id>`, pass `--box <id>`, or set TANGLE_SANDBOX.");return t}function Jn(){let e=Rn(),t=Bn(),n=new Set([Mn,...Object.keys(e.profiles??{})]);return e.activeProfile&&n.add(mr(e.activeProfile)),[...n].map(e=>{let n=un(e).source;return{name:e,active:e===t,hasApiKey:n!==`none`,baseUrl:rr(void 0,e),apiKeySource:n}}).sort((e,t)=>e.name.localeCompare(t.name))}function Yn(e){let t=Bn(e);return{name:t,active:t===Bn(),baseUrl:rr(void 0,t),credentialSource:un(t).source}}function Xn(e,t){let n=mr(e),r=Rn(),i=fr(n,r),a={},o=t.baseUrl??i.baseUrl;o&&(a.baseUrl=o);let s=t.activeTeamId??i.activeTeamId;s&&(a.activeTeamId=s);let c=t.activeTeamName??i.activeTeamName;c&&(a.activeTeamName=c);let l={...r.profiles??{}};a.baseUrl||a.activeTeamId||a.activeTeamName?l[n]=a:delete l[n];let u;return t.apiKey&&(u=dn(n,t.apiKey)),zn({profiles:Object.keys(l).length>0?l:{}}),u}function Zn(e){let t=Bn(e),n={...Rn().profiles??{}},r=n[t];if(r){let e={...r};e.baseUrl||e.activeTeamId||e.activeTeamName?n[t]=e:delete n[t]}zn({profiles:n}),pn(t)}function Qn(){let e=process.env.TANGLE_API_KEY_FILE;if(e){let t=T.readFileSync(e,`utf8`).trim();if(!t.startsWith(`sk-tan-`))throw Error(`Invalid sandbox credential file`);return t}return process.env.TANGLE_API_KEY}function $n(e,t){let n=Pn(`sandbox`,t);return e||Qn()||un(n).value}function er(e,t){return e||(process.env.TANGLE_SOLVE_API_KEY?process.env.TANGLE_SOLVE_API_KEY:un(Pn(`solve`,t)).value)}function tr(e,t){let n=Pn(`sandbox`,t);return e?`flag`:process.env.TANGLE_API_KEY_FILE||process.env.TANGLE_API_KEY?`env`:un(n).source}function nr(e,t){return e?`flag`:process.env.TANGLE_SOLVE_API_KEY?`env`:un(Pn(`solve`,t)).source}function rr(e,t){if(e)return e;let n=process.env.TANGLE_BASE_URL||process.env.SANDBOX_BASE_URL;if(n)return n;let r=Bn(t),i=Rn(),a=fr(r,i);return a.baseUrl?a.baseUrl:(r===Mn||r===`sandbox`)&&i.baseUrl?i.baseUrl:`https://sandbox.tangle.tools`}function ir(e){if(e)return e.replace(/\/v1\/hub\/?$/,``)}function ar(e){return e?.trim().replace(/\/+$/,``)||void 0}function or(e){return ar(e?.flag)??ar(ir(ar(process.env.TANGLE_HUB_URL)))??ar(process.env.TANGLE_PLATFORM_URL)??ar(e?.cachedPlatformUrl?.())??An}function sr(e){let t=ar(e)??ar(process.env.TANGLE_SOLVE_API_URL);if(t&&t!==jn)throw Error(`Solve credentials may only be sent to ${jn}`);return jn}function cr(e){let t=ar(e);if(t&&t!==An)throw Error(`Solve credentials may only be sent to ${An}`);return An}function V(e){let t=Pn(`sandbox`,e.profile),n=$n(e.apiKey,t);if(!n)throw Error(`No API key found for profile '${t}'. Set TANGLE_API_KEY or run: tangle auth login${t===Mn?``:` --profile ${t}`}`);return{apiKey:n,baseUrl:rr(e.baseUrl,t),timeout:e.timeout??3e4,profile:t,...lr(t)}}function lr(e){let t=Rn(),n=fr(Bn(e),t);return{activeTeamId:n.activeTeamId,activeTeamName:n.activeTeamName}}function ur(e,t){Xn(Bn(t),{activeTeamId:e.id,activeTeamName:e.name})}function dr(e){let t=Bn(e),n=Rn(),r={...n.profiles??{}},i={baseUrl:fr(t,n).baseUrl};i.baseUrl?r[t]=i:delete r[t],zn({profiles:r})}function fr(e,t=Rn()){let n=mr(e);return{...n===Mn?{baseUrl:t.baseUrl,activeTeamId:t.profiles?.[Mn]?.activeTeamId,activeTeamName:t.profiles?.[Mn]?.activeTeamName}:{},...t.profiles?.[n]??{}}}function pr(e,t){let n=t.profiles===void 0?{...e.profiles??{}}:Object.fromEntries(Object.entries(t.profiles).filter(([,e])=>!!(e.apiKey||e.baseUrl||e.activeTeamId||e.activeTeamName)));return{...e,...t,profiles:Object.keys(n).length>0?n:void 0}}function mr(e){let t=e.trim().toLowerCase();if(!t)throw Error(`Profile name cannot be empty`);if(!/^[a-z0-9][a-z0-9._-]*$/.test(t))throw Error(`Profile names may only contain lowercase letters, numbers, dots, underscores, and hyphens`);return t}let hr=null,gr=null;function H(e){if(!e&&hr)return hr;let t=e??V({});return(!hr||!gr||gr.apiKey!==t.apiKey||gr.baseUrl!==t.baseUrl||gr.timeout!==t.timeout)&&(hr=new l({apiKey:t.apiKey,baseUrl:t.baseUrl,timeoutMs:t.timeout}),gr=t),hr}function _r(){hr=null,gr=null}function U(e){let t=V({apiKey:e.apiKey,baseUrl:e.baseUrl});return{context:t,client:H(t)}}async function vr(e,t){let n=t.trim();if(n.length===0)throw Error(`Connection reference is empty.`);if(n.startsWith(`hubconn_`))return n;let{connections:r}=await e.connections.list();return yr(r,n)}function yr(e,t){let n=t.trim();if(n.length===0)throw Error(`Connection reference is empty.`);let r=e.find(e=>e.id===n);if(r)return r.id;let i=n.indexOf(`:`),a=(i===-1?n:n.slice(0,i)).trim().toLowerCase(),o=i===-1?null:n.slice(i+1).trim(),s=e.filter(e=>e.status!==`revoked`&&e.providerId.toLowerCase()===a);if(o&&o.length>0){let e=o.toLowerCase();s=s.filter(t=>(t.accountDisplay??``).toLowerCase()===e||t.displayName.toLowerCase()===e)}if(s.length===1)return s[0].id;throw s.length===0?Error(`No hub connection matches "${t}". List your connections with \`tangle hub connections\`.`):Error(br(t,s))}function br(e,t){let n=t.map(e=>`- ${e.id} (provider: ${e.providerId}, account: ${e.accountDisplay??e.displayName})`).join(`
|
|
2
2
|
`);return`Hub connection reference is ambiguous: "${e}" matches ${t.length} connections. Use a connection id or provider:account instead.
|
|
3
|
-
`+n}function
|
|
4
|
-
`)}`}function
|
|
3
|
+
`+n}function xr(e,t){return[...t,e]}async function Sr(e,t){let n=e.map(e=>{let t=e.trim(),n=t.indexOf(`:`);return n===-1?{raw:e,ref:null,tail:null}:{raw:e,ref:t.slice(0,n).trim(),tail:t.slice(n+1)}});if(!n.some(e=>e.ref!==null&&e.ref!==`*`&&!e.ref.startsWith(`hubconn_`)))return[...e];let{connections:r}=await(await t()).connections.list();return n.map(e=>e.ref===null||e.ref===`*`||e.ref.startsWith(`hubconn_`)?e.raw:`${yr(r,e.ref)}:${e.tail}`)}function Cr(e){let t=new Map,n=[];for(let r of e){let e=r.trim(),i=e.indexOf(`:`);if(i===-1)throw Error(`Invalid --connection "${r}": expected <connectionId>:<capability>[,<capability>]. List connection ids with \`tangle hub connections\` and capability paths with \`tangle hub tools search <keyword>\`.`);let a=e.slice(0,i).trim();if(a.length===0)throw Error(`Invalid --connection "${r}": connection id is empty. Use <connectionId>:<capability> — list ids with \`tangle hub connections\`.`);let o=e.slice(i+1).split(`,`).map(e=>e.trim()).filter(e=>e.length>0);if(o.length===0)throw Error(`Invalid --connection "${r}": grant at least one capability, e.g. ${a}:gmail.messages.list. Discover paths with \`tangle hub tools search <keyword>\`.`);if(o.includes(`*`)&&o.length>1)throw Error(`Invalid --connection "${r}": "*" grants all capabilities and can't be combined with specific paths. Use <connectionId>:* alone, or list explicit paths.`);if(a===`*`&&!(o.length===1&&o[0]===`*`))throw Error(`Invalid --connection "${r}": a "*" connection is only valid as "*:*" (all connections, all capabilities). Name a connection id for specific paths.`);let s=t.get(a);s===void 0&&(s=new Set,t.set(a,s),n.push(a));for(let e of o)s.add(e)}return n.map(e=>{let n=t.get(e),r=n?[...n]:[];if(r.includes(`*`)&&r.length>1)throw Error(`Invalid --connection for "${e}": "*" can't be combined with specific capability paths across repeated --connection flags.`);return{connectionId:e,capabilities:r}})}function wr(e,t){return x(`sha256`).update(`${e}\0${t}`).digest(`hex`).slice(0,32)}function Tr(e){return`${e}:hub`}function Er(e){let{value:t}=un(Tr(e));if(!t)return null;try{let e=JSON.parse(t);if(typeof e.key==`string`&&typeof e.expiresAt==`string`&&typeof e.platformUrl==`string`&&typeof e.sessionFingerprint==`string`)return{key:e.key,expiresAt:e.expiresAt,platformUrl:e.platformUrl,sessionFingerprint:e.sessionFingerprint}}catch{}return null}function Dr(e,t){try{dn(Tr(e),JSON.stringify(t))}catch{}}async function Or(e,t,n,r){let i=`${e.replace(/\/+$/,``)}/auth/cli/hub-key`,a;try{a=await fetch(i,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${t}`},body:JSON.stringify({device_id:n}),signal:r})}catch(e){throw Error(`Could not reach ${i} to mint a platform key: ${e instanceof Error?e.message:String(e)}`)}let o=await a.text(),s;try{s=JSON.parse(o)}catch{s=null}if(!a.ok||!s?.success){let e=typeof s?.error?.message==`string`?s.error.message:`HTTP ${a.status}`;throw Error(`Platform key minting failed: ${e}. Your sandbox session may have expired — run \`tangle auth login\`.`)}let c=s.data;if(typeof c?.api_key!=`string`||typeof c?.expires_at!=`string`||typeof c?.platform_url!=`string`)throw Error(`Platform key minting returned an unexpected response shape.`);return{key:c.api_key,expiresAt:c.expires_at,platformUrl:c.platform_url}}var kr=class{cache;fingerprint;constructor(e,t,n,r,i){this.profile=e,this.sandboxBaseUrl=t,this.sessionToken=n,this.deviceId=r,this.signal=i,this.fingerprint=wr(t,n);let a=Er(e);this.cache=a&&a.sessionFingerprint===this.fingerprint?a:null}isFresh(e){return e!==null&&Date.parse(e.expiresAt)-Date.now()>6e4}async ensure(e=!1){if(this.signal?.throwIfAborted(),!e&&this.isFresh(this.cache))return this.cache;let t={...await Or(this.sandboxBaseUrl,this.sessionToken,this.deviceId,this.signal),sessionFingerprint:this.fingerprint};return this.cache=t,Dr(this.profile,t),t}};function Ar(e){if(!e)return!1;let t=e.trim().toLowerCase();return t===`1`||t===`true`||t===`yes`}function jr(e,t){return or({flag:e.baseUrl,...e.useCachedPlatformUrl?{cachedPlatformUrl:()=>Er(t)?.platformUrl}:{}})}function Mr(e,t){let n=Pn(`sandbox`,e.profile),r=$n(e.apiKey,n),i=tr(e.apiKey,n),a=e.allowHubCapabilityToken&&process.env.TANGLE_HUB_CAPABILITY_TOKEN?.trim()||void 0;if(a&&i===`env`)throw Error(`Set exactly one of TANGLE_API_KEY or TANGLE_HUB_CAPABILITY_TOKEN, not both`);let o=i===`flag`&&r?r:a??r;if(!o)throw Error(`No API key found for profile '${n}'. Set TANGLE_API_KEY or run: tangle auth login${n===`default`?``:` --profile ${n}`}`);return(i===`flag`||i===`env`)&&r||a||o.startsWith(`sk-tan-`)||t?{kind:`static`,apiKey:o,baseUrl:jr(e,n)}:{kind:`managed`,profile:n,sandboxBaseUrl:rr(e.sandboxBaseUrl,n),sessionToken:o,deviceId:Kn(),baseUrlOverride:e.baseUrl}}async function Nr(e={}){let t=Mr(e,e.hubKey===!1||Ar(process.env.TANGLE_SKIP_HUB_KEY));if(t.kind===`static`)return{token:t.apiKey,baseUrl:t.baseUrl,minted:!1};let n=new kr(t.profile,t.sandboxBaseUrl,t.sessionToken,t.deviceId,e.signal),r=await n.ensure();return{token:r.key,baseUrl:t.baseUrlOverride??r.platformUrl,refresh:async()=>(await n.ensure(!0)).key,minted:!0}}async function Pr(e,t,n={}){let r=e=>{let r=new Headers(n.headers);return r.set(`Authorization`,`Bearer ${e}`),fetch(t,{...n,headers:r})},i=await r(e.token);return i.status!==401||!e.refresh?i:r(await e.refresh())}async function Fr(e={}){let t;try{t=await Nr(e)}catch(e){return{reachable:!1,reason:e instanceof Error?e.message:String(e),refused:!0}}try{let e=await Pr(t,`${t.baseUrl.replace(/\/+$/,``)}/v1/plans/current`);if(e.ok)return{reachable:!0,baseUrl:t.baseUrl};let n=e.status===401||e.status===403;return{reachable:!1,baseUrl:t.baseUrl,reason:n?`the platform refused this credential (HTTP ${e.status})`:`the platform answered HTTP ${e.status}`,refused:n}}catch(e){return{reachable:!1,baseUrl:t.baseUrl,reason:`could not reach ${t.baseUrl}: ${e instanceof Error?e.message:String(e)}`,refused:!1}}}async function Ir(e){let t=e.signal,n=t?(e,n)=>{let r=n?.signal??(e instanceof Request?e.signal:void 0);return fetch(e,{...n,signal:r?AbortSignal.any([r,t]):t})}:fetch.bind(globalThis),r=Mr(e,e.hubKey===!1||Ar(process.env.TANGLE_SKIP_HUB_KEY));if(r.kind===`static`){let t=!e.apiKey&&process.env.TANGLE_API_KEY_FILE&&!process.env.TANGLE_HUB_CAPABILITY_TOKEN;return new Oe({baseUrl:r.baseUrl,fetch:n,authHeaders:()=>({Authorization:`Bearer ${t?Qn():r.apiKey}`})})}let i=new kr(r.profile,r.sandboxBaseUrl,r.sessionToken,r.deviceId,e.signal),a=await i.ensure();return new Oe({baseUrl:r.baseUrlOverride??a.platformUrl,authHeaders:async()=>({Authorization:`Bearer ${(await i.ensure()).key}`}),fetch:async(e,t)=>{let r=await n(e,t);if(r.status!==401)return r;let a=await i.ensure(!0),o=new Headers(t?.headers);return o.set(`Authorization`,`Bearer ${a.key}`),n(e,{...t,headers:o})}})}function Lr(e={}){return Ir(e)}function W(e={}){return Ir({...e,useCachedPlatformUrl:!0,allowHubCapabilityToken:!0})}function Rr(e,t){return`Sandbox name is ambiguous: ${e}. Use a sandbox id instead.\n${t.map(e=>`- ${e.id} (status: ${e.status}, created: ${e.createdAt.toISOString()})`).join(`
|
|
4
|
+
`)}`}function zr(e){return e.activeTeamId?`team:${e.activeTeamId}`:void 0}async function G(e,t,n,r={}){if(!r.nameOnly){let t=await e.get(n);if(t)return t;if(Vr(n))throw Error(`Sandbox not found: ${n}`)}let i=(await e.list({scope:zr(t)})).filter(e=>e.name?.toLowerCase()===n.toLowerCase());if(i.length===0)throw Error(`Sandbox not found: ${n}`);if(i.length>1)throw Error(Rr(n,i));return i[0]}const Br=/^sandbox-(?:(?:(?:[a-z][a-z0-9-]*)-)?(?:[a-f0-9]{12}|[a-f0-9]{8}-[a-f0-9]{3})|l[0-9a-z]{1,8}-[0-9a-f]{8})(?:-branch-[a-z0-9]+-[0-9]+)*$/;function Vr(e){return Br.test(e)}async function Hr(e,t,n,r={}){try{return(await(await G(e,t,n,{nameOnly:r.name})).delete()).outcome}catch(e){if(!(e instanceof Error&&e.message===`Sandbox not found: ${n}`)||r.name||!r.retryCleanup&&!Vr(n))throw e}let i=await e.fetch(`/v1/sandboxes/${encodeURIComponent(n)}`,{method:`DELETE`});if(i.ok){let e=await i.json().catch(()=>({}));return e.outcome===`destroyed`||e.outcome===`already_absent`?e.outcome:`unknown`}let a=(await i.text()).trim();throw Error(`Sandbox cleanup failed for ${n} (HTTP ${i.status})${a?`: ${a}`:``}`)}async function K(e,t){if(e.status!==`stopped`)return e;let n=t?.resumeTimeoutMs??12e4;F(`Sandbox ${e.id} is stopped. Resuming...`);try{await e.resume({timeoutMs:n}),await e.waitFor(`running`,{timeoutMs:n})}catch(t){let r=t instanceof Error?t.message:String(t);throw Error(`Failed to resume sandbox ${e.id}: ${r}. Run \`tangle sandbox resume ${e.id} --timeout ${n}\` and retry.`)}return e}const Ur=[`anthropic`,`openai`,`vercel-ai`,`mastra`,`mcp-local`,`claude-desktop`,`cursor`,`zed`];function Wr(e,t,n){switch(e){case`anthropic`:return`// pnpm add @anthropic-ai/sdk @tangle-network/sandbox
|
|
5
5
|
import Anthropic from "@anthropic-ai/sdk";
|
|
6
6
|
import { Sandbox } from "@tangle-network/sandbox";
|
|
7
7
|
import { anthropicTools } from "@tangle-network/sandbox/agent";
|
|
@@ -121,36 +121,36 @@ await connect(new StdioServerTransport());`;case`claude-desktop`:return`// Add t
|
|
|
121
121
|
}
|
|
122
122
|
}
|
|
123
123
|
}
|
|
124
|
-
}`}}function
|
|
125
|
-
`)}}async function
|
|
126
|
-
`),Error(t?`No answer on stdin. Pass ${t} to skip the confirmation.`:`No answer on stdin.`);return[`y`,`yes`].includes(n.toLowerCase())}async function Yr(e,t){let n=await Kr(`${e}${t?` [${t}]`:``}: `);if(n===void 0)throw Error(`No answer on stdin.`);return n||t||``}async function Xr(e,t=`secret`){if(process.stdin.isTTY)throw Error(e?`${e} reads ${t} from stdin, but stdin is a terminal; pipe it in`:`Cannot read ${t} from stdin when stdin is a TTY`);return(await je(process.stdin)).toString(`utf8`).replace(/\r?\n$/,``)}function Zr(){let e=new b(`profile`).description(`Create, inspect, and validate portable agent profiles`);return e.command(`create [output]`).description(`Create a profile — interactively (a wizard), or fully via flags`).option(`--name <name>`,`Profile name (when set, skips the wizard)`).option(`--description <text>`,`Profile description`).option(`--model <model>`,`Model (provider/model)`).option(`--system-prompt <text>`,`System prompt`).option(`--skills <ref...>`,`Skill refs: local path or github:<owner>/<repo>/<path>[@<ref>]`).option(`--tools <ref...>`,`Tool refs: local path or github:<owner>/<repo>/<path>[@<ref>]`).option(`--harness <name>`,`Harness hint shown in the run command`).action(async(e,t)=>{let n=t.name,r=t.description,i=t.harness,a=t.model,o=t.systemPrompt,s=t.skills??[],c=t.tools??[];if(!n&&process.stdin.isTTY&&(n=await Yr(`Profile name`,`my-agent`),r=await Yr(`Description (optional)`)||void 0,i=await Yr(`Harness`,`claude-code`)||void 0,a=await Yr(`Model (optional, provider/model)`)||void 0,o=await Yr(`System prompt (optional)`)||void 0,s=await Qr(`Skill ref (local path or github:..., blank to finish)`),c=await Qr(`Tool ref (blank to finish)`)),!n)throw Error(process.stdin.isTTY?`Profile name is required.`:"`agent profile create` needs at least --name in a non-interactive shell (no TTY to prompt). Pass --name <name> (and optionally --model/--skills/--tools/--system-prompt).");let l=Yt({model:a,systemPrompt:o,skills:s,tools:c}),u=Zt({...n?{name:n}:{},...r?{description:r}:{},...l??{},...i?{harness:i}:{}},`new profile`);if(t.json){N(u);return}let d=e??`agent-profile.json`;me(d,`${JSON.stringify(u,null,2)}\n`),F(`Wrote ${d}`),F(`Run it: tangle agent prompt <box> --profile ${d}${i?` --harness ${i}`:``}`)}),e.command(`show <source>`).description(`Load and print a profile (local path, https URL, or github:owner/repo/path[@ref])`).action(async e=>{try{N(await Xt(e))}catch(e){B(e,!0)}}),e.command(`validate <source>`).description(`Validate a profile against the canonical AgentProfile schema`).action(async(e,t)=>{let n=await Xt(e),r=typeof n.name==`string`?n.name:`(unnamed)`;t.json?N({ok:!0,name:r}):F(`Profile valid: "${r}"`)}),e}async function Qr(e){let t=[];for(;;){let n=await Yr(e);if(!n)break;t.push(n)}return t}function $r(e){return([process.env.SANDBOX_WEB_URL,process.env.TANGLE_SANDBOX_WEB_URL].map(e=>e?.trim()).find(e=>!!e)??e).replace(/\/+$/,``)}function ei(e,t){if(process.exitCode=1,e.status===`blocked_on_approval`){console.error(y.yellow(`⚠ Blocked on a hub approval.`));let t=e.approval?.approvalId;console.error(t?`Approve it: tangle hub approvals approve ${t}`:"Approve the pending request (`tangle hub approvals`), then re-run.");return}if(e.status===`awaiting_question`){console.error(y.yellow(`⚠ Agent is awaiting an answer to a question.`)),console.error(`Re-run with --interactive to answer it, or answer programmatically via box.session(<id>).answer(<questionId>, { ... }).`);return}if(e.status===`awaiting_interaction`){console.error(y.yellow(`⚠ Agent is awaiting a response.`)),console.error(`Open an interactive session, or answer the canonical interaction through the Sandbox SDK.`);return}if(e.status===`awaiting_plan_decision`){console.error(y.yellow(`⚠ Agent is awaiting a plan decision.`)),console.error(`Approve or reject the pending plan before continuing.`);return}console.error(y.red(`✗ ${e.error&&e.error.length>0?e.error:t}`))}function ti(e){let t=e.part;if(t?.type===`text`)return t.text??t.content??void 0}function ni(e){return e.finalText??e.response??e.output??e.content??e.text??void 0}function ri(e){if(!e.result.success){ei(e.result,`Agent run failed`);return}let t=Date.now()-e.startedAt,n=e.tokenUsage,r=[`${t}ms`,n?.inputTokens===void 0?void 0:`${n.inputTokens} in`,n?.outputTokens===void 0?void 0:`${n.outputTokens} out`].filter(e=>!!e);console.log(y.green(`✓ Done`),y.dim(`(${r.join(`, `)})`))}async function ii(e,t,n=!0){let r=``,i,a=m(),o=e=>{if(e.startsWith(r)){let t=e.slice(r.length);t&&n&&process.stdout.write(t)}else n&&process.stdout.write(e);r=e};try{for await(let t of e)switch(a.observe(t),t.type){case`token`:{let e=t.data?.value;typeof e==`string`&&(n&&process.stdout.write(e),r+=e);break}case`message.part.updated`:{let e=ti(t.data);typeof e==`string`&&e.length>0&&o(e);break}case`raw`:break;case`result`:i=t.data;break}}catch(e){a.observe({type:`error`,data:{message:e instanceof Error?e.message:String(e)}})}if(r.length===0&&i){let e=ni(i);typeof e==`string`&&e.length>0&&(n&&process.stdout.write(e),r=e)}return{outcome:{result:a.finish(),startedAt:t,tokenUsage:i?.tokenUsage},resultData:i,printed:r.length,...r.length>0?{response:r}:{}}}function ai(e){let t=Sr(e??[]);if(t.length!==0)return{profile:{connections:t}}}function oi(e,t,n,r,i,a){let o={...r??{},harness:n,...i?{model:{...r?.model??{},default:i}}:{}},s={profile:o,requestedProfileDigest:w(o),initialPrompt:a};return{...s,run:C({provider:`tangle-sandbox`,environmentId:e,sessionId:t,executionId:`interactive-execution-${t}`},s)}}async function si(e){let t=Sr(e.connection??[]);if(t.length===0)throw Error(`--allow-writes needs at least one --connection to grant writes for.`);if(t.some(e=>e.connectionId===`*`))throw Error("--allow-writes needs explicit --connection ids; the `*:*` wildcard can't be bulk-granted. Grant per connection, e.g. --connection conn_x:* --allow-writes.");let n=await G({hubKey:e.hubKey});for(let r of t){let t=await n.permissions.allowWrites(r.connectionId);e.json||F(`Allowed ${t.writeActions} write action${t.writeActions===1?``:`s`} for connection ${r.connectionId} (${t.granted} newly granted).`)}e.json||F(`Revert anytime: ${t.map(e=>`tangle hub permissions revert-writes --connection ${e.connectionId}`).join(` · `)}`)}async function ci(e){!e.connection||e.connection.length===0||(e.connection=await xr(e.connection,()=>G({hubKey:e.hubKey})))}async function li(e,t){let n=process.stdin,r=process.stdout,i=null,a=!1,o=!1,s,c=new Promise(e=>{s=e}),l=()=>{try{n.setRawMode(!1)}catch{}n.pause()},u=()=>{a||(a=!0,l(),n.off(`data`,p),process.off(`SIGWINCH`,f),process.off(`SIGINT`,d),process.off(`SIGTERM`,d),process.off(`exit`,l),s())},d=e=>{(i?.close()??Promise.resolve()).finally(()=>{u(),process.exit(e===`SIGTERM`?143:130)})},f=()=>{i?.isOpen&&i.resize(r.columns||80,r.rows||24)},p=e=>{if(!i)return;let t=e.indexOf(29);if(t===-1){i.write(e);return}t>0&&i.write(e.subarray(0,t)),i.close().finally(u)};if(i=await e.attach({cols:r.columns||80,rows:r.rows||24,handlers:{onData:e=>{r.write(Buffer.from(e.buffer,e.byteOffset,e.byteLength))},onExit:e=>{o=!0;let t=e.exitCode===void 0?``:` (code ${e.exitCode})`;r.write(`\r\n[interactive session exited${t}]\r\n`),i?.close().finally(u)},onError:e=>{r.write(`\r\n[terminal stream error: ${e.message}]\r\n`)},onClose:()=>u()}}),n.setRawMode(!0),n.resume(),n.on(`data`,p),process.on(`SIGWINCH`,f),process.on(`SIGINT`,d),process.on(`SIGTERM`,d),process.on(`exit`,l),await c,console.log(),o){F(`Interactive session ended.`);return}F(`Detached — the session keeps running.`),L({"Watch & drive":t})}function ui(){let e=new b(`agent`).description(`Interact with AI agent`);return e.command(`prompt <idOrMessage> [message]`).description("Send a single prompt to the agent. With one arg it's the prompt and the box comes from `tangle use` / --box / TANGLE_SANDBOX; with two it's <id> <message>.").option(`--box <id>`,`Target sandbox (overrides the active one)`).option(`--session <id>`,`Continue existing session`).option(`--model <model>`,`Model to use`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`,`300000`).option(`--stream`,`Stream response in real-time`).option(`--interactive`,`Spawn the harness's interactive TUI in the sandbox, inject this prompt, and print a link to watch + drive the live session in the browser (omit for the default headless run)`).option(`--harness <name>`,`Harness that executes this run (claude-code, codex, kimi-code, opencode, pi, amp, hermes). Defaults to the sandbox's configured backend. The box ships all harnesses, so this is a per-run choice.`).option(`--profile <source>`,`Agent profile to run: a local JSON path, an https URL, or github:<owner>/<repo>/<path>[@<ref>]`).option(`--skills <ref...>`,`Attach skills (repeatable): a local file path, or github:<owner>/<repo>/<path>[@<ref>] to pull from a repo`).option(`--tools <ref...>`,`Attach tools (repeatable): a local file path, or github:<owner>/<repo>/<path>[@<ref>]`).option(`--system-prompt <text>`,`Override the agent's system prompt for this run`).option(`--connection <spec>`,"Grant a hub connection to the agent as MCP tools (repeatable). The connection is a connection id or a provider name. Modes: <connection>:<cap1>,<cap2> (least privilege, recommended), <connection>:* (all of one connection), or *:* (all connections). List connections with `tangle hub connections`; paths with `tangle hub tools search <keyword>`.",br,[]).option(`--allow-writes`,"Pre-approve every WRITE action of each granted --connection so the agent can write unattended (reads are already allowed; destructive actions still prompt). Revert with `tangle hub permissions revert-writes`.").option(`--no-hub-key`,`Do not auto-mint a platform Hub key for --allow-writes; use the stored credential as-is`).action(async(e,t,n)=>{let r=t===void 0?e:t,i=t===void 0?Kn(n.box):e,{context:a,client:o}=W(n),s=await $t({profileSource:n.profile,systemPrompt:n.systemPrompt,skills:n.skills,tools:n.tools});await ci(n);let c=ai(n.connection);n.allowWrites&&await si(n);let l=s||c?{...s,...c?.profile}:void 0,u=n.harness,d=l||u||n.model?{...u?{type:u}:{},...l?{profile:l}:{},...n.model?{model:{model:n.model}}:{}}:void 0,f=await K(o,a,i);if(f=await q(f),n.interactive){let e=n.session??`int-${S()}`,t=u??(await f.backend.status()).type,o=oi(i,e,t,l,n.model,r),s=f.session(e).interactive(),c=I(`Starting interactive ${t} session...`);c.start();let d;try{d=await s.start(o)}finally{c.stop()}let p=d.ref.preparationReceipt.harness,m=d.state===`running`?d.streamUrl:void 0,h=`${$r(a.baseUrl)}/dashboard/sandbox/${encodeURIComponent(i)}?interactive=${encodeURIComponent(d.ref.run.sessionId)}`;if(n.json){N({state:d.state,sessionId:d.ref.run.sessionId,harness:p,...m?{streamUrl:m}:{},webUrl:h});return}if(F(`Interactive ${p} session ${d.state}.`),console.log(),L({...d.state===`running`?{"Watch & drive":h}:{},Session:d.ref.run.sessionId}),console.log(),d.state===`exited`){F(`The initial prompt completed with reason: ${d.reason}.`);return}F(`Open the link to watch the agent and type to take over.`),process.stdin.isTTY===!0&&process.stdout.isTTY===!0&&(console.log(),F(`Attaching to the live session — press Ctrl-] to detach.`),await li(s,h));return}if(n.stream){n.json||(F(`Streaming response...`),console.log());let e=Date.now(),t=await ii(f.streamPrompt(r,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10),...d?{backend:d}:{}}),e,!n.json);n.json?(N({...t.outcome.result,...t.response?{response:t.response}:{},...t.outcome.tokenUsage?{tokenUsage:t.outcome.tokenUsage}:{},durationMs:Date.now()-e}),t.outcome.result.success||(process.exitCode=1)):(t.printed>0&&console.log(),ri(t.outcome))}else{let e=I(`Processing prompt...`);e.start();let t=await f.prompt(r,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10),...d?{backend:d}:{}});e.stop(),n.json?(N(t),t.success===!1&&(process.exitCode=1)):t.success===!1?ei(t,`Agent prompt failed`):(console.log(t.response),console.log(),L({Duration:`${t.durationMs}ms`,"Input Tokens":t.usage?.inputTokens,"Output Tokens":t.usage?.outputTokens}))}}),e.addCommand(Gr()),e.addCommand(Zr()),e}async function di(e){let t=e.timeoutMs??1e4,n=e.baseUrl.replace(/\/$/,``),i=`${n}/v1/account/me`;try{let n=await fetch(i,{headers:{Accept:`application/json`,Authorization:`Bearer ${e.apiKey}`},signal:AbortSignal.timeout(t)});if(!n.ok){let e=await pi(n);throw n.status===401||n.status===403?new r(e||`Invalid API key`):n.status>=500?new u(e||`Sandbox API returned an unexpected error`,{status:n.status}):Error(e||`Credential validation failed with status ${n.status}`)}let a=await n.json();if(!a.success||!a.data)throw Error(`Sandbox API returned an invalid account response`);return{customerId:a.data.customer_id,billingOwnerId:typeof a.data.billing_owner_id==`string`?a.data.billing_owner_id:void 0,apiKeyId:typeof a.data.api_key_id==`string`||a.data.api_key_id===null?a.data.api_key_id:void 0,billingDelegationAuthorized:typeof a.data.billing_delegation_authorized==`boolean`?a.data.billing_delegation_authorized:void 0,email:a.data.email,name:a.data.name,tier:a.data.tier,createdAt:a.data.created_at}}catch(e){throw e instanceof r||e instanceof u||e instanceof f?e:e instanceof Error&&e.name===`AbortError`?new f(`Timed out validating credentials against ${n}`,{timeoutMs:t}):e instanceof Error&&!(e instanceof TypeError)?e:new a(`Failed to reach ${n}`,{cause:fi(e)})}}function fi(e){return e instanceof Error?e:void 0}async function pi(e){let t=await e.text();if(t)try{let e=JSON.parse(t);return e.error?.message??e.message??t}catch{return t}}function mi(e){return e.replace(/&/g,`&`).replace(/</g,`<`).replace(/>/g,`>`).replace(/"/g,`"`).replace(/'/g,`'`)}function hi(e){if(!_i(e.hostHeader))return{kind:`host-mismatch`};let t;try{t=new URL(e.requestUrl??`/`,`http://127.0.0.1`)}catch{return{kind:`not-found`}}if(t.pathname!==`/callback`)return{kind:`not-found`};if(t.searchParams.get(`state`)!==e.expectedState)return{kind:`state-mismatch`};let n=t.searchParams.get(`error`);if(n)return{kind:`error`,reason:n};let r=t.searchParams.get(`grant_token`);return r?{kind:`ok`,token:r}:{kind:`missing-token`}}async function gi(e){e.signal?.throwIfAborted();let t=e.timeoutMs??12e4,n=e.baseUrl.replace(/\/$/,``),r=await import(`node:http`),i=ne(32).toString(`hex`),a=null,o=null,s=new Promise((e,t)=>{a=e,o=t}),c=r.createServer((e,t)=>{try{let n=hi({hostHeader:e.headers.host,requestUrl:e.url,expectedState:i});switch(n.kind){case`host-mismatch`:t.writeHead(421,{"content-type":`text/plain; charset=utf-8`}),t.end(`Misdirected request`);return;case`not-found`:t.writeHead(404,{"content-type":`text/plain; charset=utf-8`}),t.end(`Not found`);return;case`state-mismatch`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(xi(`State mismatch — refusing login`)),o?.(Error(`Browser login state mismatch — refusing potentially hijacked callback`));return;case`error`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(xi(n.reason)),o?.(Error(`Browser login failed: ${n.reason}`));return;case`missing-token`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(xi(null)),o?.(Error(`Browser login did not return a grant token`));return;case`ok`:t.writeHead(200,{"content-type":`text/html; charset=utf-8`}),t.end(xi(null)),a?.(n.token);return}}catch(e){o?.(e instanceof Error?e:Error(`Browser login callback failed`))}});await new Promise((e,t)=>{c.once(`error`,t),c.listen(0,`127.0.0.1`,()=>e())});try{let r=c.address();if(!r||typeof r==`string`)throw Error(`Failed to bind local callback server`);let a=new URL(`http://127.0.0.1:${r.port}/callback`);a.searchParams.set(`state`,i);let o=new URL(`${n}/auth/cli/login`);o.searchParams.set(`callback_url`,a.toString()),e.provider&&o.searchParams.set(`provider`,e.provider);let l=await bi(o.toString());e.onLoginUrl?.({loginUrl:o.toString(),browserOpened:l});let u=await yi({baseUrl:n,grantToken:await vi(s,t,e.signal),timeoutMs:t,signal:e.signal});return{apiKey:u.apiKey,email:u.email,name:u.name,tier:u.tier}}finally{e.signal?.aborted&&c.closeAllConnections(),await new Promise((e,t)=>{c.close(n=>{if(n){t(n);return}e()})}).catch(()=>void 0)}}function _i(e){if(!e)return!1;let t=e.toLowerCase().match(/^(\[[^\]]+\]|[^:]+)(?::\d+)?$/);if(!t)return!1;let n=t[1];return n===`127.0.0.1`||n===`localhost`||n===`[::1]`}async function vi(e,t,n){let r=new AbortController;try{return await Promise.race([e,Me(t,void 0,{signal:AbortSignal.any([r.signal,...n?[n]:[]])}).then(()=>{throw new f(`Timed out waiting for browser login to complete`,{timeoutMs:t})})])}finally{r.abort()}}async function yi(e){let t=await fetch(`${e.baseUrl}/auth/cli/exchange`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify({grant_token:e.grantToken}),signal:AbortSignal.any([AbortSignal.timeout(e.timeoutMs),...e.signal?[e.signal]:[]])}).catch(t=>{throw new a(`Failed to reach ${e.baseUrl}`,{cause:t instanceof Error?t:void 0})}),n=await t.json().catch(()=>null);if(!t.ok||!n?.success||!n.data?.api_key)throw Error(n?.error?.message||`Failed to exchange browser login grant`);return{apiKey:n.data.api_key,email:n.data.email,name:n.data.name,tier:n.data.tier}}async function bi(e){let{spawn:t}=await import(`node:child_process`),n=process.platform===`darwin`?[`open`,e]:process.platform===`win32`?[`cmd`,`/c`,`start`,``,e]:[`xdg-open`,e];return await new Promise(e=>{let r=t(n[0],n.slice(1),{detached:!0,stdio:`ignore`});r.once(`error`,()=>e(!1)),r.once(`spawn`,()=>{r.unref(),e(!0)})})}function xi(e){return`<!doctype html>
|
|
124
|
+
}`}}function Gr(e){return{anthropic:`Anthropic Messages API (Claude)`,openai:`OpenAI Chat Completions (function calling)`,"vercel-ai":`Vercel AI SDK (generateText / streamText)`,mastra:`Mastra agent framework`,"mcp-local":`Local MCP server bridge (stdio)`,"claude-desktop":`Claude Desktop config (uses local MCP)`,cursor:`Cursor config (uses local MCP)`,zed:`Zed config (uses local MCP)`}[e]}function Kr(){return new b(`connect`).description(`Print a copy-paste SDK integration snippet for one of: ${Ur.join(`, `)} (to stream a local agent's telemetry to Intelligence, see 'tangle connect')`).argument(`<framework>`,Ur.join(` | `)).option(`-i, --sandbox <id>`,`Sandbox ID to embed in the snippet`,`<SANDBOX_ID>`).option(`-s, --session <id>`,`Session ID to embed in the snippet`,`default`).action((e,t)=>{Ur.includes(e)||(console.error(y.red(`unknown framework: ${e}`),`\nsupported: ${Ur.join(`, `)}`),process.exit(2));let n=e;process.stdout.write(y.cyan(`# ${Gr(n)}\n\n`)),process.stdout.write(`${Wr(n,t.sandbox,t.session)}\n`)})}async function qr(e,t=!1){let n=t?new Ae({write(e,t,n){n()}}):process.stderr,r=ke({input:process.stdin,output:n,...t?{terminal:!0}:{}});t&&process.stderr.write(e);try{return await new Promise(n=>{r.once(`close`,()=>n(void 0)),r.question(t?``:e,e=>{n(e.trim()),r.close()})})}finally{r.close(),t&&process.stderr.write(`
|
|
125
|
+
`)}}async function Jr(e){let t=await qr(e,!0);if(t===void 0)throw Error(`No answer on stdin.`);return t}async function Yr(e,t){let n=await qr(e);if(n===void 0)throw process.stderr.write(`
|
|
126
|
+
`),Error(t?`No answer on stdin. Pass ${t} to skip the confirmation.`:`No answer on stdin.`);return[`y`,`yes`].includes(n.toLowerCase())}async function Xr(e,t){let n=await qr(`${e}${t?` [${t}]`:``}: `);if(n===void 0)throw Error(`No answer on stdin.`);return n||t||``}async function Zr(e,t=`secret`){if(process.stdin.isTTY)throw Error(e?`${e} reads ${t} from stdin, but stdin is a terminal; pipe it in`:`Cannot read ${t} from stdin when stdin is a TTY`);return(await je(process.stdin)).toString(`utf8`).replace(/\r?\n$/,``)}function Qr(){let e=new b(`profile`).description(`Create, inspect, and validate portable agent profiles`);return e.command(`create [output]`).description(`Create a profile — interactively (a wizard), or fully via flags`).option(`--name <name>`,`Profile name (when set, skips the wizard)`).option(`--description <text>`,`Profile description`).option(`--model <model>`,`Model (provider/model)`).option(`--system-prompt <text>`,`System prompt`).option(`--skills <ref...>`,`Skill refs: local path or github:<owner>/<repo>/<path>[@<ref>]`).option(`--tools <ref...>`,`Tool refs: local path or github:<owner>/<repo>/<path>[@<ref>]`).option(`--harness <name>`,`Harness hint shown in the run command`).action(async(e,t)=>{let n=t.name,r=t.description,i=t.harness,a=t.model,o=t.systemPrompt,s=t.skills??[],c=t.tools??[];if(!n&&process.stdin.isTTY&&(n=await Xr(`Profile name`,`my-agent`),r=await Xr(`Description (optional)`)||void 0,i=await Xr(`Harness`,`claude-code`)||void 0,a=await Xr(`Model (optional, provider/model)`)||void 0,o=await Xr(`System prompt (optional)`)||void 0,s=await $r(`Skill ref (local path or github:..., blank to finish)`),c=await $r(`Tool ref (blank to finish)`)),!n)throw Error(process.stdin.isTTY?`Profile name is required.`:"`agent profile create` needs at least --name in a non-interactive shell (no TTY to prompt). Pass --name <name> (and optionally --model/--skills/--tools/--system-prompt).");let l=Yt({model:a,systemPrompt:o,skills:s,tools:c}),u=Zt({...n?{name:n}:{},...r?{description:r}:{},...l??{},...i?{harness:i}:{}},`new profile`);if(t.json){N(u);return}let d=e??`agent-profile.json`;me(d,`${JSON.stringify(u,null,2)}\n`),F(`Wrote ${d}`),F(`Run it: tangle agent prompt <box> --profile ${d}${i?` --harness ${i}`:``}`)}),e.command(`show <source>`).description(`Load and print a profile (local path, https URL, or github:owner/repo/path[@ref])`).action(async e=>{try{N(await Xt(e))}catch(e){B(e,!0)}}),e.command(`validate <source>`).description(`Validate a profile against the canonical AgentProfile schema`).action(async(e,t)=>{let n=await Xt(e),r=typeof n.name==`string`?n.name:`(unnamed)`;t.json?N({ok:!0,name:r}):F(`Profile valid: "${r}"`)}),e}async function $r(e){let t=[];for(;;){let n=await Xr(e);if(!n)break;t.push(n)}return t}function ei(e){return([process.env.SANDBOX_WEB_URL,process.env.TANGLE_SANDBOX_WEB_URL].map(e=>e?.trim()).find(e=>!!e)??e).replace(/\/+$/,``)}function ti(e,t){if(process.exitCode=1,e.status===`blocked_on_approval`){console.error(y.yellow(`⚠ Blocked on a hub approval.`));let t=e.approval?.approvalId;console.error(t?`Approve it: tangle hub approvals approve ${t}`:"Approve the pending request (`tangle hub approvals`), then re-run.");return}if(e.status===`awaiting_question`){console.error(y.yellow(`⚠ Agent is awaiting an answer to a question.`)),console.error(`Re-run with --interactive to answer it, or answer programmatically via box.session(<id>).answer(<questionId>, { ... }).`);return}if(e.status===`awaiting_interaction`){console.error(y.yellow(`⚠ Agent is awaiting a response.`)),console.error(`Open an interactive session, or answer the canonical interaction through the Sandbox SDK.`);return}if(e.status===`awaiting_plan_decision`){console.error(y.yellow(`⚠ Agent is awaiting a plan decision.`)),console.error(`Approve or reject the pending plan before continuing.`);return}console.error(y.red(`✗ ${e.error&&e.error.length>0?e.error:t}`))}function ni(e){let t=e.part;if(t?.type===`text`)return t.text??t.content??void 0}function ri(e){return e.finalText??e.response??e.output??e.content??e.text??void 0}function ii(e){if(!e.result.success){ti(e.result,`Agent run failed`);return}let t=Date.now()-e.startedAt,n=e.tokenUsage,r=[`${t}ms`,n?.inputTokens===void 0?void 0:`${n.inputTokens} in`,n?.outputTokens===void 0?void 0:`${n.outputTokens} out`].filter(e=>!!e);console.log(y.green(`✓ Done`),y.dim(`(${r.join(`, `)})`))}async function ai(e,t,n=!0){let r=``,i,a=m(),o=e=>{if(e.startsWith(r)){let t=e.slice(r.length);t&&n&&process.stdout.write(t)}else n&&process.stdout.write(e);r=e};try{for await(let t of e)switch(a.observe(t),t.type){case`token`:{let e=t.data?.value;typeof e==`string`&&(n&&process.stdout.write(e),r+=e);break}case`message.part.updated`:{let e=ni(t.data);typeof e==`string`&&e.length>0&&o(e);break}case`raw`:break;case`result`:i=t.data;break}}catch(e){a.observe({type:`error`,data:{message:e instanceof Error?e.message:String(e)}})}if(r.length===0&&i){let e=ri(i);typeof e==`string`&&e.length>0&&(n&&process.stdout.write(e),r=e)}return{outcome:{result:a.finish(),startedAt:t,tokenUsage:i?.tokenUsage},resultData:i,printed:r.length,...r.length>0?{response:r}:{}}}function oi(e){let t=Cr(e??[]);if(t.length!==0)return{profile:{connections:t}}}function si(e,t,n,r,i,a){let o={...r??{},harness:n,...i?{model:{...r?.model??{},default:i}}:{}},s={profile:o,requestedProfileDigest:w(o),initialPrompt:a};return{...s,run:C({provider:`tangle-sandbox`,environmentId:e,sessionId:t,executionId:`interactive-execution-${t}`},s)}}async function ci(e){let t=Cr(e.connection??[]);if(t.length===0)throw Error(`--allow-writes needs at least one --connection to grant writes for.`);if(t.some(e=>e.connectionId===`*`))throw Error("--allow-writes needs explicit --connection ids; the `*:*` wildcard can't be bulk-granted. Grant per connection, e.g. --connection conn_x:* --allow-writes.");let n=await W({hubKey:e.hubKey});for(let r of t){let t=await n.permissions.allowWrites(r.connectionId);e.json||F(`Allowed ${t.writeActions} write action${t.writeActions===1?``:`s`} for connection ${r.connectionId} (${t.granted} newly granted).`)}e.json||F(`Revert anytime: ${t.map(e=>`tangle hub permissions revert-writes --connection ${e.connectionId}`).join(` · `)}`)}async function li(e){!e.connection||e.connection.length===0||(e.connection=await Sr(e.connection,()=>W({hubKey:e.hubKey})))}async function ui(e,t){let n=process.stdin,r=process.stdout,i=null,a=!1,o=!1,s,c=new Promise(e=>{s=e}),l=()=>{try{n.setRawMode(!1)}catch{}n.pause()},u=()=>{a||(a=!0,l(),n.off(`data`,p),process.off(`SIGWINCH`,f),process.off(`SIGINT`,d),process.off(`SIGTERM`,d),process.off(`exit`,l),s())},d=e=>{(i?.close()??Promise.resolve()).finally(()=>{u(),process.exit(e===`SIGTERM`?143:130)})},f=()=>{i?.isOpen&&i.resize(r.columns||80,r.rows||24)},p=e=>{if(!i)return;let t=e.indexOf(29);if(t===-1){i.write(e);return}t>0&&i.write(e.subarray(0,t)),i.close().finally(u)};if(i=await e.attach({cols:r.columns||80,rows:r.rows||24,handlers:{onData:e=>{r.write(Buffer.from(e.buffer,e.byteOffset,e.byteLength))},onExit:e=>{o=!0;let t=e.exitCode===void 0?``:` (code ${e.exitCode})`;r.write(`\r\n[interactive session exited${t}]\r\n`),i?.close().finally(u)},onError:e=>{r.write(`\r\n[terminal stream error: ${e.message}]\r\n`)},onClose:()=>u()}}),n.setRawMode(!0),n.resume(),n.on(`data`,p),process.on(`SIGWINCH`,f),process.on(`SIGINT`,d),process.on(`SIGTERM`,d),process.on(`exit`,l),await c,console.log(),o){F(`Interactive session ended.`);return}F(`Detached — the session keeps running.`),L({"Watch & drive":t})}function di(){let e=new b(`agent`).description(`Interact with AI agent`);return e.command(`prompt <idOrMessage> [message]`).description("Send a single prompt to the agent. With one arg it's the prompt and the box comes from `tangle use` / --box / TANGLE_SANDBOX; with two it's <id> <message>.").option(`--box <id>`,`Target sandbox (overrides the active one)`).option(`--session <id>`,`Continue existing session`).option(`--model <model>`,`Model to use`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`,`300000`).option(`--stream`,`Stream response in real-time`).option(`--interactive`,`Spawn the harness's interactive TUI in the sandbox, inject this prompt, and print a link to watch + drive the live session in the browser (omit for the default headless run)`).option(`--harness <name>`,`Harness that executes this run (claude-code, codex, kimi-code, opencode, pi, amp, hermes). Defaults to the sandbox's configured backend. The box ships all harnesses, so this is a per-run choice.`).option(`--profile <source>`,`Agent profile to run: a local JSON path, an https URL, or github:<owner>/<repo>/<path>[@<ref>]`).option(`--skills <ref...>`,`Attach skills (repeatable): a local file path, or github:<owner>/<repo>/<path>[@<ref>] to pull from a repo`).option(`--tools <ref...>`,`Attach tools (repeatable): a local file path, or github:<owner>/<repo>/<path>[@<ref>]`).option(`--system-prompt <text>`,`Override the agent's system prompt for this run`).option(`--connection <spec>`,"Grant a hub connection to the agent as MCP tools (repeatable). The connection is a connection id or a provider name. Modes: <connection>:<cap1>,<cap2> (least privilege, recommended), <connection>:* (all of one connection), or *:* (all connections). List connections with `tangle hub connections`; paths with `tangle hub tools search <keyword>`.",xr,[]).option(`--allow-writes`,"Pre-approve every WRITE action of each granted --connection so the agent can write unattended (reads are already allowed; destructive actions still prompt). Revert with `tangle hub permissions revert-writes`.").option(`--no-hub-key`,`Do not auto-mint a platform Hub key for --allow-writes; use the stored credential as-is`).action(async(e,t,n)=>{let r=t===void 0?e:t,i=t===void 0?qn(n.box):e,{context:a,client:o}=U(n),s=await $t({profileSource:n.profile,systemPrompt:n.systemPrompt,skills:n.skills,tools:n.tools});await li(n);let c=oi(n.connection);n.allowWrites&&await ci(n);let l=s||c?{...s,...c?.profile}:void 0,u=n.harness,d=l||u||n.model?{...u?{type:u}:{},...l?{profile:l}:{},...n.model?{model:{model:n.model}}:{}}:void 0,f=await G(o,a,i);if(f=await K(f),n.interactive){let e=n.session??`int-${S()}`,t=u??(await f.backend.status()).type,o=si(i,e,t,l,n.model,r),s=f.session(e).interactive(),c=I(`Starting interactive ${t} session...`);c.start();let d;try{d=await s.start(o)}finally{c.stop()}let p=d.ref.preparationReceipt.harness,m=d.state===`running`?d.streamUrl:void 0,h=`${ei(a.baseUrl)}/dashboard/sandbox/${encodeURIComponent(i)}?interactive=${encodeURIComponent(d.ref.run.sessionId)}`;if(n.json){N({state:d.state,sessionId:d.ref.run.sessionId,harness:p,...m?{streamUrl:m}:{},webUrl:h});return}if(F(`Interactive ${p} session ${d.state}.`),console.log(),L({...d.state===`running`?{"Watch & drive":h}:{},Session:d.ref.run.sessionId}),console.log(),d.state===`exited`){F(`The initial prompt completed with reason: ${d.reason}.`);return}F(`Open the link to watch the agent and type to take over.`),process.stdin.isTTY===!0&&process.stdout.isTTY===!0&&(console.log(),F(`Attaching to the live session — press Ctrl-] to detach.`),await ui(s,h));return}if(n.stream){n.json||(F(`Streaming response...`),console.log());let e=Date.now(),t=await ai(f.streamPrompt(r,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10),...d?{backend:d}:{}}),e,!n.json);n.json?(N({...t.outcome.result,...t.response?{response:t.response}:{},...t.outcome.tokenUsage?{tokenUsage:t.outcome.tokenUsage}:{},durationMs:Date.now()-e}),t.outcome.result.success||(process.exitCode=1)):(t.printed>0&&console.log(),ii(t.outcome))}else{let e=I(`Processing prompt...`);e.start();let t=await f.prompt(r,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10),...d?{backend:d}:{}});e.stop(),n.json?(N(t),t.success===!1&&(process.exitCode=1)):t.success===!1?ti(t,`Agent prompt failed`):(console.log(t.response),console.log(),L({Duration:`${t.durationMs}ms`,"Input Tokens":t.usage?.inputTokens,"Output Tokens":t.usage?.outputTokens}))}}),e.addCommand(Kr()),e.addCommand(Qr()),e}async function fi(e){let t=e.timeoutMs??1e4,n=e.baseUrl.replace(/\/$/,``),i=`${n}/v1/account/me`;try{let n=await fetch(i,{headers:{Accept:`application/json`,Authorization:`Bearer ${e.apiKey}`},signal:AbortSignal.timeout(t)});if(!n.ok){let e=await mi(n);throw n.status===401||n.status===403?new r(e||`Invalid API key`):n.status>=500?new u(e||`Sandbox API returned an unexpected error`,{status:n.status}):Error(e||`Credential validation failed with status ${n.status}`)}let a=await n.json();if(!a.success||!a.data)throw Error(`Sandbox API returned an invalid account response`);return{customerId:a.data.customer_id,billingOwnerId:typeof a.data.billing_owner_id==`string`?a.data.billing_owner_id:void 0,apiKeyId:typeof a.data.api_key_id==`string`||a.data.api_key_id===null?a.data.api_key_id:void 0,billingDelegationAuthorized:typeof a.data.billing_delegation_authorized==`boolean`?a.data.billing_delegation_authorized:void 0,email:a.data.email,name:a.data.name,tier:a.data.tier,createdAt:a.data.created_at}}catch(e){throw e instanceof r||e instanceof u||e instanceof f?e:e instanceof Error&&e.name===`AbortError`?new f(`Timed out validating credentials against ${n}`,{timeoutMs:t}):e instanceof Error&&!(e instanceof TypeError)?e:new a(`Failed to reach ${n}`,{cause:pi(e)})}}function pi(e){return e instanceof Error?e:void 0}async function mi(e){let t=await e.text();if(t)try{let e=JSON.parse(t);return e.error?.message??e.message??t}catch{return t}}function hi(e){return e.replace(/&/g,`&`).replace(/</g,`<`).replace(/>/g,`>`).replace(/"/g,`"`).replace(/'/g,`'`)}function gi(e){if(!vi(e.hostHeader))return{kind:`host-mismatch`};let t;try{t=new URL(e.requestUrl??`/`,`http://127.0.0.1`)}catch{return{kind:`not-found`}}if(t.pathname!==`/callback`)return{kind:`not-found`};if(t.searchParams.get(`state`)!==e.expectedState)return{kind:`state-mismatch`};let n=t.searchParams.get(`error`);if(n)return{kind:`error`,reason:n};let r=t.searchParams.get(`grant_token`);return r?{kind:`ok`,token:r}:{kind:`missing-token`}}async function _i(e){e.signal?.throwIfAborted();let t=e.timeoutMs??12e4,n=e.baseUrl.replace(/\/$/,``),r=await import(`node:http`),i=ne(32).toString(`hex`),a=null,o=null,s=new Promise((e,t)=>{a=e,o=t}),c=r.createServer((e,t)=>{try{let n=gi({hostHeader:e.headers.host,requestUrl:e.url,expectedState:i});switch(n.kind){case`host-mismatch`:t.writeHead(421,{"content-type":`text/plain; charset=utf-8`}),t.end(`Misdirected request`);return;case`not-found`:t.writeHead(404,{"content-type":`text/plain; charset=utf-8`}),t.end(`Not found`);return;case`state-mismatch`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(Si(`State mismatch — refusing login`)),o?.(Error(`Browser login state mismatch — refusing potentially hijacked callback`));return;case`error`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(Si(n.reason)),o?.(Error(`Browser login failed: ${n.reason}`));return;case`missing-token`:t.writeHead(400,{"content-type":`text/html; charset=utf-8`}),t.end(Si(null)),o?.(Error(`Browser login did not return a grant token`));return;case`ok`:t.writeHead(200,{"content-type":`text/html; charset=utf-8`}),t.end(Si(null)),a?.(n.token);return}}catch(e){o?.(e instanceof Error?e:Error(`Browser login callback failed`))}});await new Promise((e,t)=>{c.once(`error`,t),c.listen(0,`127.0.0.1`,()=>e())});try{let r=c.address();if(!r||typeof r==`string`)throw Error(`Failed to bind local callback server`);let a=new URL(`http://127.0.0.1:${r.port}/callback`);a.searchParams.set(`state`,i);let o=new URL(`${n}/auth/cli/login`);o.searchParams.set(`callback_url`,a.toString()),e.provider&&o.searchParams.set(`provider`,e.provider);let l=await xi(o.toString());e.onLoginUrl?.({loginUrl:o.toString(),browserOpened:l});let u=await bi({baseUrl:n,grantToken:await yi(s,t,e.signal),timeoutMs:t,signal:e.signal});return{apiKey:u.apiKey,email:u.email,name:u.name,tier:u.tier}}finally{e.signal?.aborted&&c.closeAllConnections(),await new Promise((e,t)=>{c.close(n=>{if(n){t(n);return}e()})}).catch(()=>void 0)}}function vi(e){if(!e)return!1;let t=e.toLowerCase().match(/^(\[[^\]]+\]|[^:]+)(?::\d+)?$/);if(!t)return!1;let n=t[1];return n===`127.0.0.1`||n===`localhost`||n===`[::1]`}async function yi(e,t,n){let r=new AbortController;try{return await Promise.race([e,Me(t,void 0,{signal:AbortSignal.any([r.signal,...n?[n]:[]])}).then(()=>{throw new f(`Timed out waiting for browser login to complete`,{timeoutMs:t})})])}finally{r.abort()}}async function bi(e){let t=await fetch(`${e.baseUrl}/auth/cli/exchange`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify({grant_token:e.grantToken}),signal:AbortSignal.any([AbortSignal.timeout(e.timeoutMs),...e.signal?[e.signal]:[]])}).catch(t=>{throw new a(`Failed to reach ${e.baseUrl}`,{cause:t instanceof Error?t:void 0})}),n=await t.json().catch(()=>null);if(!t.ok||!n?.success||!n.data?.api_key)throw Error(n?.error?.message||`Failed to exchange browser login grant`);return{apiKey:n.data.api_key,email:n.data.email,name:n.data.name,tier:n.data.tier}}async function xi(e){let{spawn:t}=await import(`node:child_process`),n=process.platform===`darwin`?[`open`,e]:process.platform===`win32`?[`cmd`,`/c`,`start`,``,e]:[`xdg-open`,e];return await new Promise(e=>{let r=t(n[0],n.slice(1),{detached:!0,stdio:`ignore`});r.once(`error`,()=>e(!1)),r.once(`spawn`,()=>{r.unref(),e(!0)})})}function Si(e){return`<!doctype html>
|
|
127
127
|
<html lang="en">
|
|
128
128
|
<head>
|
|
129
129
|
<meta charset="utf-8" />
|
|
130
130
|
<title>Sandbox CLI Login</title>
|
|
131
131
|
</head>
|
|
132
132
|
<body>
|
|
133
|
-
<p>${e?`Sandbox CLI login failed: ${
|
|
133
|
+
<p>${e?`Sandbox CLI login failed: ${hi(e)}`:`Sandbox CLI login complete. You can close this window.`}</p>
|
|
134
134
|
</body>
|
|
135
|
-
</html>`}const Si=15*6e4,Ci=`sandbox`;function wi(e){return Number.isFinite(e)&&e>0?e:Si}async function Ti(e){let t=e.timeoutMs??Si,n=Date.now(),r=await Ei({baseUrl:e.baseUrl,app:e.app??Ci,timeoutMs:t,provider:e.provider});for(e.onInstructions?.({userCode:r.user_code,verificationUrl:r.verification_uri,verificationUrlComplete:r.verification_uri_complete,expiresIn:r.expires_in,intervalSeconds:r.interval});;){if(Date.now()-n>t)throw new f(`Timed out waiting for device authorization to complete`,{timeoutMs:t});let i=await Di({baseUrl:e.baseUrl,app:e.app??Ci,deviceCode:r.device_code,timeoutMs:t});if(i.status===`approved`)return i.data;let a=i.intervalSeconds*1e3;await new Promise(e=>setTimeout(e,a))}}async function Ei(e){let t=wi(e.timeoutMs),n=e.app!==Ci,r=await fetch(`${Oi(e.baseUrl)}${n?`/cross-site/device/start`:`/auth/cli/device/start`}`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify(n?{app:e.app,...e.provider?{provider:e.provider}:{}}:e.provider?{provider:e.provider}:{}),signal:AbortSignal.timeout(t)}).catch(t=>{throw new a(`Failed to reach ${e.baseUrl}`,{cause:t instanceof Error?t:void 0})}),i=await r.json().catch(()=>null);if(!r.ok||!i?.success||!i.data?.device_code)throw Error(i?.error?.message||`Failed to start device login`);return i.data}async function Di(e){let t=wi(e.timeoutMs),n=e.app!==Ci,r=await fetch(`${Oi(e.baseUrl)}${n?`/cross-site/device/poll`:`/auth/cli/device/poll`}`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify(n?{app:e.app,device_code:e.deviceCode}:{device_code:e.deviceCode}),signal:AbortSignal.timeout(t)}).catch(t=>{throw new a(`Failed to reach ${e.baseUrl}`,{cause:t instanceof Error?t:void 0})}),i=await r.json().catch(()=>null);if(r.status===428&&i?.error?.code===`AUTHORIZATION_PENDING`)return{status:`pending`,intervalSeconds:typeof i.data?.interval==`number`&&i.data.interval>0?i.data.interval:5};if(!r.ok||!i?.success||!i.data?.api_key||!i.data.email)throw Error(i?.error?.message||`Failed to complete device authorization`);return{status:`approved`,data:{apiKey:i.data.api_key,email:i.data.email,name:i.data.name,tier:i.data.tier}}}function Oi(e){return e.replace(/\/$/,``)}async function ki(e){let t=e.apiKey,n=Li(e.app??`sandbox`),r=Ri(n,e.profile),i=Ii(e.provider),a=n===`solve`?sr(e.baseUrl):nr(e.baseUrl,r),o=e.browser!==!1,s=(t,i)=>{Ni({profile:r,apiKey:t,baseUrl:e.baseUrl?a:void 0,activate:n===`sandbox`}),gr(),P(`Authenticated`),L({Profile:r,Email:i.email,Tier:i.tier,"Base URL":a}),F(Pi)};if(t&&!Ln(t)){At(`Invalid API key format. Keys should start with 'sk_' or 'sk-tan-'.`),process.exit(1);return}if(fn(),!t){let t=o&&n===`sandbox`,r=I(t?`Starting browser login...`:`Starting device login...`);r.start();let c;try{c=t?await gi({baseUrl:a,provider:i,signal:e.signal,onLoginUrl:({loginUrl:e,browserOpened:t})=>{r.stop(),F(t?`Browser login opened.`:`Open this URL to continue browser login:`),console.log(e)}}):await Ti({baseUrl:a,app:n,provider:i,onInstructions:({userCode:e,verificationUrl:t,verificationUrlComplete:i})=>{r.stop(),F(`Complete login in a browser on any device:`),L({"Verification URL":t,"Verification URL (prefilled)":i,"Device Code":e}),n===`solve`&&o&&bi(i)}})}finally{r.stop()}s(c.apiKey,c);return}let c=I(`Validating credentials...`);c.start();let l=await di({apiKey:t,baseUrl:a});c.stop(),s(t,l)}function Ai(){let e=new b(`auth`).description(`Manage authentication`);return e.command(`login`).description(`Authenticate with browser login, device code, or an API key`).option(`--no-browser`,`Use device-code login instead of opening a browser`).option(`--profile <name>`,`Profile name`).option(`--provider <provider>`,`Identity provider (github, google, microsoft)`).option(`--app <app>`,`Product to authorize (sandbox or solve)`,`sandbox`).action(ki),e.command(`logout`).description(`Remove stored credentials`).option(`--profile <name>`,`Profile name`).option(`--app <app>`,`Product credentials to remove (sandbox or solve)`,`sandbox`).action(e=>{let t=Ri(Li(e.app),e.profile);Xn(t),gr(),P(`Logged out successfully.`),F(`Credentials removed for profile '${t}'.`)}),e.command(`status`).description(`Show current authentication status`).option(`--profile <name>`,`Profile name`).option(`--app <app>`,`Product credentials to check (sandbox or solve)`,`sandbox`).action(async e=>{let t=Li(e.app),n=Ri(t,e.profile),i=t===`solve`?$n(e.apiKey,n):Qn(e.apiKey,n),a=t===`solve`?sr(e.baseUrl):nr(e.baseUrl,n),o=t===`solve`?tr(e.apiKey,n):er(e.apiKey,n);if(!i){if(e.json){N({authenticated:!1,reason:`missing_credentials`,profile:n,baseUrl:a,credentialSource:null});return}At(`Not authenticated`),F(`Run 'tangle auth login --profile ${n}' to authenticate.`),process.exit(1)}let s=e.json?null:I(`Checking credentials...`);s?.start();try{let r=await di({apiKey:i,baseUrl:a}),c=t===`solve`?null:await Pr({...e.apiKey===void 0?{}:{apiKey:e.apiKey},...e.profile===void 0?{}:{profile:e.profile},sandboxBaseUrl:a});s?.stop();let l=c!==null&&!c.reachable&&c.refused,u=!l,d=c!==null&&!c.reachable&&!c.refused;if(e.json){N({authenticated:u,profile:n,baseUrl:a,credentialSource:o,account:r,...c?{sandbox:{authenticated:!0},platform:c}:{}}),u||process.exit(1);return}l?jt(`Authenticated for sandbox only`):d?jt(`Authenticated — the platform is unreachable right now`):P(`Authenticated`),L({Profile:n,Credentials:`configured`,"Base URL":a,Source:Mi(o),Email:r.email,Tier:r.tier,...c?{Platform:c.reachable?`reachable (${c.baseUrl})`:`UNREACHABLE — ${c.reason}`}:{}}),d&&F(`Platform commands (keys, workflows, hub) will not work until the platform answers again. The stored credential is not the cause and does not need replacing.`),u||(F("Platform commands (keys, workflows, hub) will not work until this resolves. Set TANGLE_API_KEY to a key you minted in the console, or run `tangle auth login` again."),process.exit(1))}catch(t){s?.stop(),e.json&&(N({authenticated:!1,profile:n,baseUrl:a,credentialSource:o,error:t instanceof Error?t.message:String(t)}),process.exit(1)),t instanceof r?At(`Stored credentials are invalid.`):jt(`Stored credentials found, but validation could not complete.`),L({Profile:n,Credentials:`configured`,"Base URL":a,Source:Mi(o),Error:t instanceof Error?t.message:String(t)}),process.exit(1)}}),e.addCommand(ji()),e}function ji(){let e=new b(`profiles`).description(`Manage CLI profiles`);return e.command(`list`).description(`List configured profiles`).action(e=>{let t=qn();if(e.json){N(t);return}if(t.length===0){F(`No profiles found.`);return}It([`Profile`,`Active`,`Base URL`,`Credentials`,`Source`],t.map(e=>[e.name,e.active?`yes`:`no`,e.baseUrl,e.hasApiKey?`configured`:`none`,e.apiKeySource]))}),e.command(`use <name>`).description(`Set the active profile`).action(e=>{Bn(e);let t=Jn(e);P(`Active profile set to '${t.name}'.`),L({"Base URL":t.baseUrl,Credentials:t.credentialSource===`none`?`missing`:`configured`})}),e.command(`current`).description(`Show the active profile`).action(e=>{let t=Jn();if(e.json){N({name:t.name,active:t.active,baseUrl:t.baseUrl,credentialSource:t.credentialSource});return}L({Profile:t.name,"Base URL":t.baseUrl,Credentials:t.credentialSource===`none`?`missing`:`configured`,Source:Mi(t.credentialSource)})}),e}function Mi(e){switch(e){case`flag`:return`command flag`;case`env`:return`environment`;case`keychain`:return`OS keychain`;case`file`:return`credentials file`;default:return`unknown`}}function Ni(e){let t=Yn(e.profile,{apiKey:e.apiKey,...e.baseUrl?{baseUrl:e.baseUrl}:{}});e.activate!==!1&&Bn(e.profile),Rn(e.baseUrl&&e.profile===`default`?{baseUrl:e.baseUrl}:{}),Pi=Fi(e.profile,t)}let Pi=`Credentials updated.`;function Fi(e,t){return t===`keychain`?e===`default`?`API key saved to the OS keychain for the default profile`:`API key saved to the OS keychain for profile '${e}'`:t===`file`?e===`default`?`API key saved to ~/.tangle/credentials.json for the default profile`:`API key saved to ~/.tangle/credentials.json for profile '${e}'`:`Profile '${e}' updated.`}function Ii(e){if(e===void 0||e===`github`||e===`google`||e===`microsoft`)return e;throw Error(`--provider must be one of: github, google, microsoft`)}function Li(e){if(e===void 0||e===`sandbox`||e===`solve`)return e??`sandbox`;throw Error(`--app must be one of: sandbox, solve`)}function Ri(e,t){return Pn(e,t)}function zi(){let e=new b(`backend`).description(`Manage sandbox AI agent backend`);return e.command(`status <sandboxId-or-name>`).description(`Get backend agent status`).action(async(e,t)=>{let{context:n,client:r}=W(t),i=I(`Fetching backend status...`);i.start();let a=await(await K(r,n,e)).backend.status();i.stop(),t.json?N(a):(F(`Backend Type: ${a.type}`),F(`Status: ${a.status}`),a.version&&F(`Version: ${a.version}`),a.error&&F(`Error: ${a.error}`),a.capabilities&&F(`Capabilities: ${JSON.stringify(a.capabilities)}`))}),e.command(`configure <sandboxId-or-name>`).description(`Update backend configuration`).option(`--model <model>`,`Model id (e.g. provider/model)`).action(async(e,t)=>{let{context:n,client:r}=W(t),i=I(`Updating backend config...`);i.start();let a=await K(r,n,e),o=t.model?{model:t.model}:{};await a.backend.updateConfig(o),i.stop(),P(`Backend configuration updated`),t.json&&N(o)}),e.command(`mcp-status <sandboxId-or-name>`).description(`Get status of MCP servers`).action(async(e,t)=>{let{context:n,client:r}=W(t),i=I(`Fetching MCP status...`);i.start();let a=await(await K(r,n,e)).backend.getMcpStatus();if(i.stop(),t.json)N(a);else{let e=Object.entries(a);e.length===0?F(`No MCP servers configured`):M(e.map(([e,t])=>{let n=t;return{name:e,status:n.status,error:n.error??``}}),[{key:`name`,header:`Name`,width:24},{key:`status`,header:`Status`,width:12},{key:`error`,header:`Error`,width:40}])}}),e.command(`restart <sandboxId-or-name>`).description(`Restart the backend agent`).action(async(e,t)=>{let{context:n,client:r}=W(t),i=I(`Restarting backend...`);i.start(),await(await K(r,n,e)).backend.restart(),i.stop(),P(`Backend restarted`)}),e}function Bi(e){let t=e.indexOf(`=`);if(t<=0)throw Error(`Invalid --task "${e}": expected format id=message (e.g. t1=summarize README)`);let n=e.slice(0,t).trim(),r=e.slice(t+1).trim();if(!n||!r)throw Error(`Invalid --task "${e}": id and message must be non-empty`);return{id:n,message:r}}function Vi(e){let t;try{t=JSON.parse(e)}catch(e){throw Error(`--tasks file is not valid JSON: ${e.message}`)}let n=Array.isArray(t)?t:t?.tasks;if(!Array.isArray(n))throw Error(`--tasks file must contain an array or an object with a "tasks" array`);return n.map((e,t)=>{if(!e||typeof e!=`object`)throw Error(`--tasks[${t}] must be an object`);let n=e,r=typeof n.id==`string`?n.id.trim():``,i=typeof n.message==`string`?n.message:``;if(!r)throw Error(`--tasks[${t}].id must be a non-empty string`);if(!i.trim())throw Error(`--tasks[${t}].message must be a non-empty string`);let a={id:r,message:i};if(n.context!==void 0&&(typeof n.context!=`object`||n.context===null||Array.isArray(n.context)))throw Error(`--tasks[${t}].context must be a JSON object`);if(n.context!==void 0&&(a.context=n.context),n.timeoutMs!==void 0&&(!Number.isInteger(n.timeoutMs)||n.timeoutMs<=0))throw Error(`--tasks[${t}].timeoutMs must be a positive integer`);return n.timeoutMs!==void 0&&(a.timeoutMs=n.timeoutMs),a})}function Hi(e){let t=e.readFile??(e=>fe(e,`utf8`)),n=[];e.file&&n.push(...Vi(t(e.file)));for(let t of e.inline??[])n.push(Bi(t));if(n.length===0)throw Error(`No tasks provided. Use --tasks <file> and/or --task id=message.`);let r=new Set;for(let e of n){if(r.has(e.id))throw Error(`Duplicate task id: ${e.id}`);r.add(e.id)}return n}const Ui=/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;function Wi(e){let t=e.trim(),n=t.indexOf(`/`);if(n<=0||n===t.length-1)throw Error(`--model must be in the form provider/model (got "${e}")`);return{provider:t.slice(0,n),model:t.slice(n+1)}}function Gi(e){let t=e.indexOf(`=`);if(t<=0||t===e.length-1)throw Error(`Invalid --backend "${e}": expected format id=type (e.g. primary=opencode)`);let n=e.slice(0,t).trim(),r=e.slice(t+1).trim();if(!Ui.test(n))throw Error(`Invalid backend id "${n}": use 1-128 letters, numbers, dots, underscores, or hyphens, starting with a letter or number`);if(!r||r.includes(`=`))throw Error(`Invalid --backend "${e}": type must be a non-empty backend name`);return{id:n,type:r}}function Ki(e,t){if(!e||e.length===0)throw Error(`No backends provided. Use --backend id=type or --request <file>.`);let n=e.map(Gi),r=new Set;for(let e of n){if(r.has(e.id))throw Error(`Duplicate backend id: ${e.id}`);r.add(e.id)}if(t&&n.length!==1)throw Error(`--model requires exactly one backend; use a profile to configure models for multiple backends`);return t&&(n[0]={...n[0],model:Wi(t)}),n}function qi(e){let t;try{t=JSON.parse(e)}catch(e){throw Error(`--request file is not valid JSON: ${e.message}`)}try{return ee(t)}catch(e){throw Error(`--request file is not a valid batch request: ${e.message}`)}}function Ji(e,t,n){return n?`${e} [${t}]`:e}function Yi(e){let t=new Map;for(let n of e)t.set(n.taskId,(t.get(n.taskId)??0)+1);return new Set([...t.entries()].filter(([,e])=>e>1).map(([e])=>e))}function Xi(){let e=new b(`batch`).description(`Run multiple agent tasks in parallel across sandboxes`);return e.command(`run`).description(`Execute a batch of tasks. Provide tasks via --tasks <file.json> and/or repeated --task id=message flags.`).option(`--tasks <file>`,`Path to a JSON file with an array of tasks (or {tasks: [...]})`).option(`--request <file>`,`Path to a complete batch request JSON file`).option(`--task <id=message>`,`Inline task, id=message. Repeatable.`,(e,t=[])=>[...t,e],[]).option(`--stream`,`Stream per-task events as they arrive`).option(`-t, --timeout <ms>`,`Per-task timeout in milliseconds`,`300000`).option(`--persistent`,`Keep sandboxes alive after completion`,!1).option(`--reuse-key <key>`,`Stable workspace identity required by --persistent`).option(`--replay-only`,`Rejoin existing keyed work; refuse missing custody`).option(`--idempotency-key <key>`,`Retry identity; keyed runs continue after disconnect`).option(`--backend <id=type>`,`Backend identity and type. Required and repeatable without --request.`,(e,t=[])=>[...t,e],[]).option(`--model <provider/model>`,`Model override when exactly one backend is selected`).action(async(e,t)=>{let n=new AbortController,r=!1,i=()=>{r||(r=!0,F(`Cancel requested — stopping stream...`),n.abort())};process.on(`SIGINT`,i),process.on(`SIGTERM`,i);try{let r;if(e.request){let n=[`tasks`,`task`,`backend`,`model`,`timeout`,`persistent`,`reuseKey`].filter(e=>t.getOptionValueSource(e)===`cli`);if(n.length>0){let e={reuseKey:`reuse-key`};throw Error(`--request cannot be combined with ${n.map(t=>`--${e[t]??t}`).join(`, `)}`)}r=qi(fe(e.request,`utf8`))}else{let t=Hi({file:e.tasks,inline:e.task}),n=Ki(e.backend,e.model),i=Number(e.timeout);if(!Number.isInteger(i)||i<=0)throw Error(`--timeout must be a positive integer number of milliseconds`);let a=!!e.persistent;if(a&&!e.reuseKey)throw Error(`--persistent requires --reuse-key`);if(!a&&e.reuseKey)throw Error(`--reuse-key requires --persistent`);r=ee({tasks:t,timeoutMs:i,backends:n,...a?{persistent:!0,reuseKey:e.reuseKey}:{persistent:!1}})}let{tasks:i,backends:a}=r,{client:o}=W(e),s={signal:n.signal,replayOnly:!!e.replayOnly,...e.idempotencyKey?{idempotencyKey:e.idempotencyKey}:{}},c;if(e.stream){let t=e.json?console.error:console.log;F(`Streaming batch of ${i.length} task(s)...`),t();let n=o.streamBatch(r,s),l=a.length>1;for(;;){let e=await n.next();if(e.done){c=e.value;break}let r=e.value;switch(r.type){case`batch.started`:{let e=r.data;F(`Batch started (${e.taskCount} tasks, ${e.backendCount} backends)`);break}case`task.started`:{let e=r.data;t(y.dim(`→ ${Ji(e.taskId,e.backendId,l)} started`));break}case`task.retry`:{let e=r.data;t(y.yellow(`↻ ${Ji(e.taskId,e.backendId,l)} retry ${e.attempt}: ${e.error}`));break}case`task.completed`:{let e=r.data;t(y.green(`✓ ${Ji(e.taskId,e.backendId,l)} completed in ${e.durationMs}ms`+(e.retries?` (${e.retries} retries)`:``)));break}case`task.failed`:{let e=r.data;t(y.red(`✗ ${Ji(e.taskId,e.backendId,l)} failed: ${e.error}`));break}}}t()}else F(`Running batch of ${i.length} task(s)...`),c=await o.runBatch(r,s),e.json||console.log();if(e.json)N(c);else if(L({"Total tasks":c.totalTasks,"Total backends":c.totalBackends,"Total executions":c.totalExecutions,Succeeded:c.totalSuccess,Failed:c.totalFailure,"Total retries":c.totalRetries,"Success rate":`${c.successRate.toFixed(1)}%`}),!e.stream&&c.results.length>0){let e=Yi(c.results);console.log(),console.log(y.bold(`Task Results`)),console.log(y.dim(`─`.repeat(40)));for(let t of c.results){let n=t.success?y.green(`✓`):y.red(`✗`),r=t.success?t.usage.inputTokens+t.usage.outputTokens:0,i=r>0?` • ${r} tokens`:``;console.log(`${n} ${Ji(t.taskId,t.backendId,e.has(t.taskId))} ${y.dim(`(${t.durationMs}ms, ${t.retries} retries${i})`)}`),t.success||console.log(y.red(` ${t.error}`))}}c.totalFailure>0&&(process.exitCode=1)}catch(t){let n=t instanceof Error&&`batchCustody`in t?t.batchCustody:void 0;if(n?.acceptance===`accepted`&&!(n.cleanup?.mode===`release`&&n.cleanup.isComplete)&&F(`Batch accepted; retirement receipt unproved.`),r){console.log(),F(`Batch cancelled.`),e.json&&t instanceof Error&&`batchCustody`in t&&N({ok:!1,batchCustody:t.batchCustody}),process.exitCode=130;return}B(t,e.json)}finally{process.off(`SIGINT`,i),process.off(`SIGTERM`,i)}}),e}function Zi(){let e=new b(`branch`).description(`Branch a running sandbox into copy-on-write children`);return e.command(`create <sandbox-id-or-name>`).description(`Branch a running sandbox into N copy-on-write children`).option(`--count <n>`,`Number of children to create`,`1`).option(`--idempotency-key <key>`,`Retry identity: the same key and count replays the first fan-out and creates no second one`).action(async(e,t)=>{let n=Number.parseInt(t.count,10);if(!Number.isInteger(n)||n<1)throw Error(`--count must be an integer >= 1 (got ${t.count})`);let{context:r,client:i}=W(t),a=I(`Branching into ${n} child(ren)...`);a.start();let o=await K(i,r,e),s=await o.fork(n,{...t.idempotencyKey?{idempotencyKey:t.idempotencyKey}:{}}),c=s.children;a.stop(),t.json?N({children:c.map(e=>({sandboxId:e.id})),requestedCount:s.requestedCount,materializedCount:s.materializedCount,complete:s.complete,...s.idempotency?{idempotency:s.idempotency}:{}}):(s.complete?P(`Branched ${c.length} child(ren) from ${o.id}`):jt(`Branched ${s.materializedCount} of ${s.requestedCount} requested child(ren) from ${o.id}`),s.idempotency?.outcome===`replayed`&&F(`Replayed an earlier fan-out under this key; created none.`),M(c.map(e=>({sandboxId:e.id})),[{key:`sandboxId`,header:`Child Sandbox`,width:28}]))}),e}const Qi=[`codex`,`claude-code`,`nanoclaw`,`kimi-code`,`opencode`,`pi`,`openclaw`,`hermes`],$i=`https://intelligence.tangle.tools/v1/otlp`,ea=[`codex`,`claude-code`],ta=[`codex`,`claude-code`,`nanoclaw`],na=[`SessionStart`,`UserPromptSubmit`,`PreToolUse`,`PostToolUse`,`Stop`],ra={codex:{kind:`native`,surface:`codex`,label:`Codex`,buildFiles:_a},"claude-code":{kind:`native`,surface:`claude-code`,label:`Claude Code`,buildFiles:va},nanoclaw:{kind:`native`,surface:`nanoclaw`,label:`NanoClaw`,buildFiles:va},"kimi-code":{kind:`manual`,surface:`kimi-code`,label:`Kimi Code`,reason:`Kimi Code loads hooks through an explicit config file, so use standard OTLP env wiring until the native config adapter is verified.`},opencode:{kind:`manual`,surface:`opencode`,label:`OpenCode`,reason:`OpenCode hooks run as plugins; use standard OTLP env wiring until the native plugin adapter is verified.`},pi:{kind:`manual`,surface:`pi`,label:`Pi`,reason:`Pi hooks run through TypeScript extensions; use standard OTLP env wiring until the native extension adapter is verified.`},openclaw:{kind:`manual`,surface:`openclaw`,label:`OpenClaw`,reason:`OpenClaw project hooks require user opt-in; use standard OTLP env wiring until the hook toggle and adapter are verified.`},hermes:{kind:`manual`,surface:`hermes`,label:`Hermes`,reason:`Hermes project plugins require explicit enablement; use standard OTLP env wiring until the plugin adapter is verified.`}};function ia(e){let t=e.split(`,`).map(e=>e.trim()).filter(Boolean).flatMap(e=>ga(e));return t.length===0?[...ea]:ja(t)}function aa(e){return Object.hasOwn(ra,e)}function oa(e=process.cwd()){return he(be(e))||`agent-workspace`}function sa(){return D(O(),`.tangle`,`intelligence.json`)}function ca(e=sa()){if(!ue(e))return null;let t=Oa(e),n=Ma(t,`apiKey`),r=Ma(t,`endpoint`),i=Ma(t,`serviceName`),a=Ma(t,`environment`);if(!n||!r||!i||!a)throw Error(`${e} is missing apiKey, endpoint, serviceName, or environment`);return{apiKey:n,endpoint:r,serviceName:i,environment:a}}async function la(e){let t=be(e.workspace),n=sa(),r=ia(e.selection),i=[],a=[],o=[],s={apiKey:e.apiKey,endpoint:ha(e.endpoint),serviceName:e.serviceName,environment:e.environment};e.dryRun||Ta(n,s),o.push(n);for(let n of r){let r=ra[n];if(r.kind===`manual`){a.push({agent:r.surface,label:r.label,reason:r.reason});continue}i.push(r.surface);let s=t=>ua(e.hookCommand,r.surface,t);for(let n of r.buildFiles(s)){let r=D(t,n.relPath);if(e.dryRun){o.push(r);continue}Da(r,JSON.parse(n.content),n.mode),o.push(r)}}return!e.smoke||e.dryRun?{configPath:n,written:o,agents:r,nativeAgents:i,manual:a}:{configPath:n,written:o,agents:r,nativeAgents:i,manual:a,smokeTraceId:await fa({agent:i[0]??r[0]??`codex`,event:`install.smoke`,endpoint:s.endpoint,apiKey:s.apiKey,serviceName:s.serviceName,environment:s.environment,sessionId:`install-smoke-${Date.now()}`,payload:{source:`tangle intelligence connect`}})}}function ua(e,t,n){return`${e.trim()} --agent ${t} --event ${n} --non-blocking`}function da(e){let t=BigInt(Date.now())*1000000n,n=Pa(16),r=Pa(8),i=e.sessionId??ya(e.payload),a={"service.name":e.serviceName,"deployment.environment":e.environment,"tangle.agent.surface":e.agent,"tangle.agent.hook.event":e.event,"tangle.agent.hook.source":`local-hook`,...ba(e.payload)};return i&&(a[`session.id`]=i,a[`gen_ai.conversation.id`]=i,a[`tangle.sessionId`]=i),{body:{resourceSpans:[{resource:{attributes:[Fa(`service.name`,e.serviceName),Fa(`deployment.environment`,e.environment),Fa(`tangle.agent.surface`,e.agent)]},scopeSpans:[{scope:{name:`tangle.intelligence.agent-hook`,version:`1.0.0`},spans:[{traceId:n,spanId:r,name:`agent.${e.agent}.${e.event}`,kind:1,startTimeUnixNano:t.toString(),endTimeUnixNano:(t+1000000n).toString(),attributes:Object.entries(a).map(([e,t])=>Fa(e,t)),status:{code:1}}]}]}]},traceId:n}}async function fa(e){let{body:t,traceId:n}=da(e),r=await fetch(`${ha(e.endpoint)}/v1/traces`,{method:`POST`,headers:{Authorization:`Bearer ${e.apiKey}`,"Content-Type":`application/json`},body:JSON.stringify(t)});if(!r.ok){let e=await r.text().catch(()=>``);throw Error(`OTLP smoke ingest failed: ${r.status}${e?` ${e}`:``}`)}return n}function pa(e){return ha(e).replace(/\/v1\/otlp$/,``).replace(/\/+$/,``)}async function ma(e){let t=`${pa(e.endpoint)}/v1/onboarding/status`,n=await fetch(t,{headers:{Authorization:`Bearer ${e.apiKey}`},signal:e.timeoutMs&&e.timeoutMs>0?AbortSignal.timeout(e.timeoutMs):void 0});if(!n.ok){let e=await n.text().catch(()=>``);throw Error(`onboarding status request failed: ${n.status}${e?` ${e}`:``}`)}let r=await n.json();return{tracesSeen:!!r.tracesSeen,contentSeen:!!r.contentSeen,lastSeenAt:typeof r.lastSeenAt==`string`?r.lastSeenAt:null,windowDays:typeof r.windowDays==`number`?r.windowDays:7,byAgent:r.byAgent&&typeof r.byAgent==`object`?r.byAgent:{}}}function ha(e){let t=e.trim().replace(/\/+$/,``);return t.endsWith(`/v1/traces`)?t.slice(0,-10):t.endsWith(`/v1/logs`)?t.slice(0,-8):t}function ga(e){switch(e){case`local`:case`both`:return[...ea];case`all`:return[...ta];case`claude`:return[`claude-code`];case`kimi`:return[`kimi-code`];default:if(aa(e))return[e];throw Error(`agent must be one of: local, all, both, ${Qi.join(`, `)}`)}}function _a(e){let t=Object.fromEntries(na.map(t=>[t,[{command:e(t),timeoutMs:3e3,blocking:!1,matcher:`*`}]]));return[{relPath:`.codex/hooks.json`,content:JSON.stringify({hooks:t},null,2)}]}function va(e){let t=Object.fromEntries(na.map(t=>[t,[{matcher:`*`,hooks:[{type:`command`,command:e(t),timeout:3}]}]]));return[{relPath:`.claude/settings.json`,content:JSON.stringify({hooks:t},null,2)}]}function ya(e){return Sa(e,[`session.id`,`sessionId`,`session_id`,`conversationId`,`conversation_id`,`threadId`,`thread_id`,`transcriptId`,`transcript_id`])||process.env.TANGLE_SESSION_ID||process.env.CODEX_THREAD_ID||process.env.CLAUDE_SESSION_ID||process.env.OPENCODE_SESSION_ID}function ba(e){let t={},n=xa(e,[`tool.name`,`toolName`,`tool_name`,`tool`]),r=xa(e,[`command`,`cmd`,`shell_command`,`shellCommand`]),i=xa(e,[`tool.input`,`toolInput`,`tool_input`,`input`,`arguments`,`args`]),a=xa(e,[`tool.output`,`toolOutput`,`tool_output`,`output`,`result`]),o=xa(e,[`tool.exit_code`,`exitCode`,`exit_code`,`status`]),s=xa(e,[`tool.error.message`,`errorMessage`,`error_message`,`error`]);return n&&(t[`tool.name`]=n),r&&(t[`process.command`]=r),i&&(t[`tool.input.summary`]=i),a&&(t[`tool.output.summary`]=a),o&&(t[`tool.exit_code`]=o),s&&(t[`tool.error.message`]=s),t}function xa(e,t){let n=Ca(e,t);if(n===void 0)return null;if(typeof n==`string`)return wa(n);if(typeof n==`number`||typeof n==`boolean`||typeof n==`bigint`)return String(n);try{return wa(JSON.stringify(n))}catch{return null}}function Sa(e,t){let n=Ca(e,t);return typeof n==`string`&&n.length>0?n:void 0}function Ca(e,t){if(typeof e!=`object`||!e)return;let n=[e],r=new Set;for(;n.length;){let e=n.pop();if(typeof e!=`object`||!e||r.has(e))continue;r.add(e);let i=e;for(let e of t){let t=i[e];if(t!=null&&t!==``)return t}for(let e of Object.values(i))typeof e==`object`&&e&&n.push(e)}}function wa(e){return e.length>4096?`${e.slice(0,4093)}...`:e}function Ta(e,t){Ea(e,`${JSON.stringify(t,null,2)}\n`)}function Ea(e,t){de(ge(e),{mode:448,recursive:!0});let n=`${e}.${process.pid}.tmp`;me(n,t,{mode:384}),pe(n,e)}function Da(e,t,n){de(ge(e),{recursive:!0});let r=ka(Oa(e),t);me(e,`${JSON.stringify(r,null,2)}\n`,{mode:n??420})}function Oa(e){if(!ue(e))return{};let t=JSON.parse(fe(e,`utf8`));if(!Na(t))throw Error(`${e} must contain a JSON object`);return t}function ka(e,t){let n={...e};for(let[e,r]of Object.entries(t)){let t=n[e];Na(t)&&Na(r)?n[e]=ka(t,r):Array.isArray(t)&&Array.isArray(r)?n[e]=Aa([...t,...r]):n[e]=r}return n}function Aa(e){let t=new Set,n=[];for(let r of e){let e=JSON.stringify(r);t.has(e)||(t.add(e),n.push(r))}return n}function ja(e){return[...new Set(e)]}function Ma(e,t){let n=e[t];return typeof n==`string`&&n.length>0?n:void 0}function Na(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&(Object.getPrototypeOf(e)===Object.prototype||Object.getPrototypeOf(e)===null)}function Pa(e){return ne(e).toString(`hex`)}function Fa(e,t){return{key:e,value:{stringValue:t}}}const Ia=`tangle.opencode-exporter`,La=16384;function Ra(e){return e.length<=La?e:`${e.slice(0,La-1)}…`}function J(e,t){return{key:e,value:{stringValue:t}}}function za(e){if(!e||typeof e!=`object`)return null;let t=e,n=k(t.type);return n?{type:n,properties:t.properties&&typeof t.properties==`object`?t.properties:void 0}:null}function Ba(e,t){let n=[J(`event.name`,e),J(`gen_ai.system`,`opencode`),J(`service.name`,`opencode`)];return t&&(n.push(J(`session.id`,t)),n.push(J(`gen_ai.conversation.id`,t))),n}function Va(e){if(!e)return null;let t=e.part,n=e.info;return k(t?.sessionID)??k(n?.sessionID)??k(e.sessionID)??null}function Ha(e,t){let n=k(e.role)??k(e.info?.role);if(n)return n.toLowerCase();let r=k(e.messageID),i=t?.(r)??null;return i?i.toLowerCase():null}function Ua(e,t,n){let r=[],i=Va(e.properties),a=(n,r)=>({timeUnixNano:t,severityNumber:9,severityText:`INFO`,...n===null?{}:{body:{stringValue:Ra(n)}},attributes:[...Ba(e.type,i),...r]});if(e.type===`message.part.updated`){let t=e.properties?.part;if(!t)return r;let i=k(t.type);if(i===`text`||i===`reasoning`){let e=k(t.text);if(e){let i=Ha(t,n)===`user`?Pe:Ne;r.push(a(e,[J(i,Ra(e))]))}return r}if(i===`tool`){let e=k(t.tool),n=t.state,i=ze(n?.input),o=ze(n?.output),s=k(n?.error)??(typeof n?.error==`object`&&n?.error!==null?ze(n.error):null);if(e||i){let t=[];e&&t.push(J(Ie,e)),i&&t.push(J(Fe,Ra(i))),r.push(a(null,t))}let c=o??s;if(c){let t=[J(Le,Ra(c))];e&&t.push(J(Ie,e)),r.push(a(c,t))}return r}return r}if(e.type===`session.next.text.delta`||e.type===`session.next.text.ended`){let t=e.properties??{},n=k(t.text)??(e.type===`session.next.text.delta`?k(t.delta):null);return n&&r.push(a(n,[J(Ne,Ra(n))])),r}return r}function Wa(e=process.env.OTEL_RESOURCE_ATTRIBUTES){if(!e)return null;for(let t of e.split(`,`)){let e=t.indexOf(`=`);if(e===-1||t.slice(0,e).trim()!==Re)continue;let n=t.slice(e+1).trim();if(n.length>0)return n}return null}function Ga(e,t){if(e.length===0)return null;let n=[J(`service.name`,`opencode`),J(`gen_ai.system`,`opencode`),J(`telemetry.sdk.name`,Ia)];return t&&t.trim().length>0&&n.push(J(Re,t.trim())),{resourceLogs:[{resource:{attributes:n},scopeLogs:[{scope:{name:Ia,version:`1.0.0`},logRecords:e}]}]}}function Ka(e){return(e??process.env.OPENCODE_BASE_URL??`http://127.0.0.1:4096`).replace(/\/+$/,``)}async function qa(e){let t=ha(e.endpoint),n=await(e.fetchImpl??fetch)(`${t}/v1/logs`,{method:`POST`,headers:{Authorization:`Bearer ${e.apiKey}`,"Content-Type":`application/json`},body:JSON.stringify(e.request),signal:e.timeoutMs&&e.timeoutMs>0?AbortSignal.timeout(e.timeoutMs):void 0});if(!n.ok){let e=await n.text().catch(()=>``);throw Error(`OpenCode OTLP logs ingest failed: ${n.status}${e?` ${e}`:``}`)}}var Ja=class extends Error{partial;constructor(e,t){let n=e instanceof Error?e.message:String(e);super(n),this.name=`OpencodeExporterError`,this.partial=t,e instanceof Error&&(this.cause=e)}};function Ya(){return(BigInt(Date.now())*1000000n).toString()}async function Xa(e){let t=Ka(e.opencodeBaseUrl),n=e.nowUnixNano??Ya,r=e.fetchImpl??fetch,i=e.subjectKey===void 0?Wa():e.subjectKey,a=await r(`${t}/event`,{headers:{Accept:`text/event-stream`},signal:e.signal});if(!a.ok){let e=await a.text().catch(()=>``);throw Error(`OpenCode event subscribe failed: ${a.status} at ${t}/event${e?` ${e}`:``}. Is OpenCode running with 'opencode serve'?`)}if(!a.body)throw Error(`OpenCode event stream at ${t}/event returned no body — cannot subscribe`);let o={eventsSeen:0,contentEventsExported:0,recordsExported:0},s=new Map,c=e=>e?s.get(e)??null:null;try{for await(let t of v(a.body,{signal:e.signal})){o.eventsSeen++;let a=za(t.data);if(!a)continue;if(a.type===`message.updated`){let e=a.properties?.info,t=k(e?.id),n=k(e?.role);t&&n&&s.set(t,n);continue}let l=Ua(a,n(),c),u=Ga(l,i);u&&(await qa({endpoint:e.endpoint,apiKey:e.apiKey,request:u,timeoutMs:e.postTimeoutMs,fetchImpl:r}),o.contentEventsExported++,o.recordsExported+=l.length,e.onExport?.({eventType:a.type,records:l.length}))}}catch(e){if(e instanceof Error&&(e.name===`AbortError`||e.message.toLowerCase().includes(`abort`)))return o;throw new Ja(e,o)}return o}function Za(e,t){let n=Number(e);if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} must be a positive integer`);return n}const Qa=[`claude-code`,`codex`,`opencode`,`openclaw`,`hermes`,`nanoclaw`],$a={"claude-code":`Claude Code`,codex:`Codex`,opencode:`OpenCode`,openclaw:`OpenClaw`,hermes:`Hermes`,nanoclaw:`NanoClaw`};function eo(e){return Qa.includes(e)}function to(e){return ue(e)?fe(e,`utf8`):``}function no(e,t){de(ge(e),{recursive:!0});let n=`${e}.${process.pid}.tmp`;me(n,t,{mode:384}),ce(n,384),pe(n,e)}const ro=`# >>> tangle intelligence (claude-code) >>>`,io=`# <<< tangle intelligence (claude-code) <<<`,ao={full:[{key:`OTEL_LOG_USER_PROMPTS`,comment:`the user/task prompt text`},{key:`OTEL_LOG_TOOL_DETAILS`,comment:`tool arguments`},{key:`OTEL_LOG_TOOL_CONTENT`,comment:`full tool input+output bodies`},{key:`OTEL_LOG_RAW_API_BODIES`,comment:`full prompt+completion JSON (richest)`}],prompts:[{key:`OTEL_LOG_USER_PROMPTS`,comment:`the user/task prompt text`},{key:`OTEL_LOG_TOOL_DETAILS`,comment:`tool arguments`}],metadata:[]};function oo(e,t){return t===`env`?e:/\s/.test(e)?`"${e}"`:e}function so(e,t){let n=t===`shell`?`export `:t===`dockerfile`?`ENV `:``,r=[];for(let i of e){if(i.kind===`blank`){t===`shell`&&r.push(``);continue}if(i.kind===`comment`){t===`shell`&&r.push(`# ${i.text}`);continue}let e=t===`shell`&&i.comment?` # ${i.comment}`:``;r.push(`${n}${i.key}=${oo(i.value,t)}${e}`)}return r.join(`
|
|
136
|
-
`)}function
|
|
137
|
-
`)}function
|
|
135
|
+
</html>`}const Ci=15*6e4,wi=`sandbox`;function Ti(e){return Number.isFinite(e)&&e>0?e:Ci}async function Ei(e){let t=e.timeoutMs??Ci,n=Date.now(),r=await Di({baseUrl:e.baseUrl,app:e.app??wi,timeoutMs:t,provider:e.provider});for(e.onInstructions?.({userCode:r.user_code,verificationUrl:r.verification_uri,verificationUrlComplete:r.verification_uri_complete,expiresIn:r.expires_in,intervalSeconds:r.interval});;){if(Date.now()-n>t)throw new f(`Timed out waiting for device authorization to complete`,{timeoutMs:t});let i=await Oi({baseUrl:e.baseUrl,app:e.app??wi,deviceCode:r.device_code,timeoutMs:t});if(i.status===`approved`)return i.data;let a=i.intervalSeconds*1e3;await new Promise(e=>setTimeout(e,a))}}async function Di(e){let t=Ti(e.timeoutMs),n=e.app!==wi,r=await fetch(`${ki(e.baseUrl)}${n?`/cross-site/device/start`:`/auth/cli/device/start`}`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify(n?{app:e.app,...e.provider?{provider:e.provider}:{}}:e.provider?{provider:e.provider}:{}),signal:AbortSignal.timeout(t)}).catch(t=>{throw new a(`Failed to reach ${e.baseUrl}`,{cause:t instanceof Error?t:void 0})}),i=await r.json().catch(()=>null);if(!r.ok||!i?.success||!i.data?.device_code)throw Error(i?.error?.message||`Failed to start device login`);return i.data}async function Oi(e){let t=Ti(e.timeoutMs),n=e.app!==wi,r=await fetch(`${ki(e.baseUrl)}${n?`/cross-site/device/poll`:`/auth/cli/device/poll`}`,{method:`POST`,headers:{Accept:`application/json`,"Content-Type":`application/json`},body:JSON.stringify(n?{app:e.app,device_code:e.deviceCode}:{device_code:e.deviceCode}),signal:AbortSignal.timeout(t)}).catch(t=>{throw new a(`Failed to reach ${e.baseUrl}`,{cause:t instanceof Error?t:void 0})}),i=await r.json().catch(()=>null);if(r.status===428&&i?.error?.code===`AUTHORIZATION_PENDING`)return{status:`pending`,intervalSeconds:typeof i.data?.interval==`number`&&i.data.interval>0?i.data.interval:5};if(!r.ok||!i?.success||!i.data?.api_key||!i.data.email)throw Error(i?.error?.message||`Failed to complete device authorization`);return{status:`approved`,data:{apiKey:i.data.api_key,email:i.data.email,name:i.data.name,tier:i.data.tier}}}function ki(e){return e.replace(/\/$/,``)}async function Ai(e){let t=e.apiKey,n=Ri(e.app??`sandbox`),r=zi(n,e.profile),i=Li(e.provider),a=n===`solve`?cr(e.baseUrl):rr(e.baseUrl,r),o=e.browser!==!1,s=(t,i)=>{Pi({profile:r,apiKey:t,baseUrl:e.baseUrl?a:void 0,activate:n===`sandbox`}),_r(),P(`Authenticated`),L({Profile:r,Email:i.email,Tier:i.tier,"Base URL":a}),F(Fi)};if(t&&!Ln(t)){At(`Invalid API key format. Keys should start with 'sk_' or 'sk-tan-'.`),process.exit(1);return}if(fn(),!t){let t=o&&n===`sandbox`,r=I(t?`Starting browser login...`:`Starting device login...`);r.start();let c;try{c=t?await _i({baseUrl:a,provider:i,signal:e.signal,onLoginUrl:({loginUrl:e,browserOpened:t})=>{r.stop(),F(t?`Browser login opened.`:`Open this URL to continue browser login:`),console.log(e)}}):await Ei({baseUrl:a,app:n,provider:i,onInstructions:({userCode:e,verificationUrl:t,verificationUrlComplete:i})=>{r.stop(),F(`Complete login in a browser on any device:`),L({"Verification URL":t,"Verification URL (prefilled)":i,"Device Code":e}),n===`solve`&&o&&xi(i)}})}finally{r.stop()}s(c.apiKey,c);return}let c=I(`Validating credentials...`);c.start();let l=await fi({apiKey:t,baseUrl:a});c.stop(),s(t,l)}function ji(){let e=new b(`auth`).description(`Manage authentication`);return e.command(`login`).description(`Authenticate with browser login, device code, or an API key`).option(`--no-browser`,`Use device-code login instead of opening a browser`).option(`--profile <name>`,`Profile name`).option(`--provider <provider>`,`Identity provider (github, google, microsoft)`).option(`--app <app>`,`Product to authorize (sandbox or solve)`,`sandbox`).action(Ai),e.command(`logout`).description(`Remove stored credentials`).option(`--profile <name>`,`Profile name`).option(`--app <app>`,`Product credentials to remove (sandbox or solve)`,`sandbox`).action(e=>{let t=zi(Ri(e.app),e.profile);Zn(t),_r(),P(`Logged out successfully.`),F(`Credentials removed for profile '${t}'.`)}),e.command(`status`).description(`Show current authentication status`).option(`--profile <name>`,`Profile name`).option(`--app <app>`,`Product credentials to check (sandbox or solve)`,`sandbox`).action(async e=>{let t=Ri(e.app),n=zi(t,e.profile),i=t===`solve`?er(e.apiKey,n):$n(e.apiKey,n),a=t===`solve`?cr(e.baseUrl):rr(e.baseUrl,n),o=t===`solve`?nr(e.apiKey,n):tr(e.apiKey,n);if(!i){if(e.json){N({authenticated:!1,reason:`missing_credentials`,profile:n,baseUrl:a,credentialSource:null});return}At(`Not authenticated`),F(`Run 'tangle auth login --profile ${n}' to authenticate.`),process.exit(1)}let s=e.json?null:I(`Checking credentials...`);s?.start();try{let r=await fi({apiKey:i,baseUrl:a}),c=t===`solve`?null:await Fr({...e.apiKey===void 0?{}:{apiKey:e.apiKey},...e.profile===void 0?{}:{profile:e.profile},sandboxBaseUrl:a});s?.stop();let l=c!==null&&!c.reachable&&c.refused,u=!l,d=c!==null&&!c.reachable&&!c.refused;if(e.json){N({authenticated:u,profile:n,baseUrl:a,credentialSource:o,account:r,...c?{sandbox:{authenticated:!0},platform:c}:{}}),u||process.exit(1);return}l?jt(`Authenticated for sandbox only`):d?jt(`Authenticated — the platform is unreachable right now`):P(`Authenticated`),L({Profile:n,Credentials:`configured`,"Base URL":a,Source:Ni(o),Email:r.email,Tier:r.tier,...c?{Platform:c.reachable?`reachable (${c.baseUrl})`:`UNREACHABLE — ${c.reason}`}:{}}),d&&F(`Platform commands (keys, workflows, hub) will not work until the platform answers again. The stored credential is not the cause and does not need replacing.`),u||(F("Platform commands (keys, workflows, hub) will not work until this resolves. Set TANGLE_API_KEY to a key you minted in the console, or run `tangle auth login` again."),process.exit(1))}catch(t){s?.stop(),e.json&&(N({authenticated:!1,profile:n,baseUrl:a,credentialSource:o,error:t instanceof Error?t.message:String(t)}),process.exit(1)),t instanceof r?At(`Stored credentials are invalid.`):jt(`Stored credentials found, but validation could not complete.`),L({Profile:n,Credentials:`configured`,"Base URL":a,Source:Ni(o),Error:t instanceof Error?t.message:String(t)}),process.exit(1)}}),e.addCommand(Mi()),e}function Mi(){let e=new b(`profiles`).description(`Manage CLI profiles`);return e.command(`list`).description(`List configured profiles`).action(e=>{let t=Jn();if(e.json){N(t);return}if(t.length===0){F(`No profiles found.`);return}It([`Profile`,`Active`,`Base URL`,`Credentials`,`Source`],t.map(e=>[e.name,e.active?`yes`:`no`,e.baseUrl,e.hasApiKey?`configured`:`none`,e.apiKeySource]))}),e.command(`use <name>`).description(`Set the active profile`).action(e=>{Vn(e);let t=Yn(e);P(`Active profile set to '${t.name}'.`),L({"Base URL":t.baseUrl,Credentials:t.credentialSource===`none`?`missing`:`configured`})}),e.command(`current`).description(`Show the active profile`).action(e=>{let t=Yn();if(e.json){N({name:t.name,active:t.active,baseUrl:t.baseUrl,credentialSource:t.credentialSource});return}L({Profile:t.name,"Base URL":t.baseUrl,Credentials:t.credentialSource===`none`?`missing`:`configured`,Source:Ni(t.credentialSource)})}),e}function Ni(e){switch(e){case`flag`:return`command flag`;case`env`:return`environment`;case`keychain`:return`OS keychain`;case`file`:return`credentials file`;default:return`unknown`}}function Pi(e){let t=Xn(e.profile,{apiKey:e.apiKey,...e.baseUrl?{baseUrl:e.baseUrl}:{}});e.activate!==!1&&Vn(e.profile),zn(e.baseUrl&&e.profile===`default`?{baseUrl:e.baseUrl}:{}),Fi=Ii(e.profile,t)}let Fi=`Credentials updated.`;function Ii(e,t){return t===`keychain`?e===`default`?`API key saved to the OS keychain for the default profile`:`API key saved to the OS keychain for profile '${e}'`:t===`file`?e===`default`?`API key saved to ~/.tangle/credentials.json for the default profile`:`API key saved to ~/.tangle/credentials.json for profile '${e}'`:`Profile '${e}' updated.`}function Li(e){if(e===void 0||e===`github`||e===`google`||e===`microsoft`)return e;throw Error(`--provider must be one of: github, google, microsoft`)}function Ri(e){if(e===void 0||e===`sandbox`||e===`solve`)return e??`sandbox`;throw Error(`--app must be one of: sandbox, solve`)}function zi(e,t){return Pn(e,t)}function Bi(){let e=new b(`backend`).description(`Manage sandbox AI agent backend`);return e.command(`status <sandboxId-or-name>`).description(`Get backend agent status`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Fetching backend status...`);i.start();let a=await(await G(r,n,e)).backend.status();i.stop(),t.json?N(a):(F(`Backend Type: ${a.type}`),F(`Status: ${a.status}`),a.version&&F(`Version: ${a.version}`),a.error&&F(`Error: ${a.error}`),a.capabilities&&F(`Capabilities: ${JSON.stringify(a.capabilities)}`))}),e.command(`configure <sandboxId-or-name>`).description(`Update backend configuration`).option(`--model <model>`,`Model id (e.g. provider/model)`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Updating backend config...`);i.start();let a=await G(r,n,e),o=t.model?{model:t.model}:{};await a.backend.updateConfig(o),i.stop(),P(`Backend configuration updated`),t.json&&N(o)}),e.command(`mcp-status <sandboxId-or-name>`).description(`Get status of MCP servers`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Fetching MCP status...`);i.start();let a=await(await G(r,n,e)).backend.getMcpStatus();if(i.stop(),t.json)N(a);else{let e=Object.entries(a);e.length===0?F(`No MCP servers configured`):M(e.map(([e,t])=>{let n=t;return{name:e,status:n.status,error:n.error??``}}),[{key:`name`,header:`Name`,width:24},{key:`status`,header:`Status`,width:12},{key:`error`,header:`Error`,width:40}])}}),e.command(`restart <sandboxId-or-name>`).description(`Restart the backend agent`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Restarting backend...`);i.start(),await(await G(r,n,e)).backend.restart(),i.stop(),P(`Backend restarted`)}),e}function Vi(e){let t=e.indexOf(`=`);if(t<=0)throw Error(`Invalid --task "${e}": expected format id=message (e.g. t1=summarize README)`);let n=e.slice(0,t).trim(),r=e.slice(t+1).trim();if(!n||!r)throw Error(`Invalid --task "${e}": id and message must be non-empty`);return{id:n,message:r}}function Hi(e){let t;try{t=JSON.parse(e)}catch(e){throw Error(`--tasks file is not valid JSON: ${e.message}`)}let n=Array.isArray(t)?t:t?.tasks;if(!Array.isArray(n))throw Error(`--tasks file must contain an array or an object with a "tasks" array`);return n.map((e,t)=>{if(!e||typeof e!=`object`)throw Error(`--tasks[${t}] must be an object`);let n=e,r=typeof n.id==`string`?n.id.trim():``,i=typeof n.message==`string`?n.message:``;if(!r)throw Error(`--tasks[${t}].id must be a non-empty string`);if(!i.trim())throw Error(`--tasks[${t}].message must be a non-empty string`);let a={id:r,message:i};if(n.context!==void 0&&(typeof n.context!=`object`||n.context===null||Array.isArray(n.context)))throw Error(`--tasks[${t}].context must be a JSON object`);if(n.context!==void 0&&(a.context=n.context),n.timeoutMs!==void 0&&(!Number.isInteger(n.timeoutMs)||n.timeoutMs<=0))throw Error(`--tasks[${t}].timeoutMs must be a positive integer`);return n.timeoutMs!==void 0&&(a.timeoutMs=n.timeoutMs),a})}function Ui(e){let t=e.readFile??(e=>fe(e,`utf8`)),n=[];e.file&&n.push(...Hi(t(e.file)));for(let t of e.inline??[])n.push(Vi(t));if(n.length===0)throw Error(`No tasks provided. Use --tasks <file> and/or --task id=message.`);let r=new Set;for(let e of n){if(r.has(e.id))throw Error(`Duplicate task id: ${e.id}`);r.add(e.id)}return n}const Wi=/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;function Gi(e){let t=e.trim(),n=t.indexOf(`/`);if(n<=0||n===t.length-1)throw Error(`--model must be in the form provider/model (got "${e}")`);return{provider:t.slice(0,n),model:t.slice(n+1)}}function Ki(e){let t=e.indexOf(`=`);if(t<=0||t===e.length-1)throw Error(`Invalid --backend "${e}": expected format id=type (e.g. primary=opencode)`);let n=e.slice(0,t).trim(),r=e.slice(t+1).trim();if(!Wi.test(n))throw Error(`Invalid backend id "${n}": use 1-128 letters, numbers, dots, underscores, or hyphens, starting with a letter or number`);if(!r||r.includes(`=`))throw Error(`Invalid --backend "${e}": type must be a non-empty backend name`);return{id:n,type:r}}function qi(e,t){if(!e||e.length===0)throw Error(`No backends provided. Use --backend id=type or --request <file>.`);let n=e.map(Ki),r=new Set;for(let e of n){if(r.has(e.id))throw Error(`Duplicate backend id: ${e.id}`);r.add(e.id)}if(t&&n.length!==1)throw Error(`--model requires exactly one backend; use a profile to configure models for multiple backends`);return t&&(n[0]={...n[0],model:Gi(t)}),n}function Ji(e){let t;try{t=JSON.parse(e)}catch(e){throw Error(`--request file is not valid JSON: ${e.message}`)}try{return ee(t)}catch(e){throw Error(`--request file is not a valid batch request: ${e.message}`)}}function Yi(e,t,n){return n?`${e} [${t}]`:e}function Xi(e){let t=new Map;for(let n of e)t.set(n.taskId,(t.get(n.taskId)??0)+1);return new Set([...t.entries()].filter(([,e])=>e>1).map(([e])=>e))}function Zi(){let e=new b(`batch`).description(`Run multiple agent tasks in parallel across sandboxes`);return e.command(`run`).description(`Execute a batch of tasks. Provide tasks via --tasks <file.json> and/or repeated --task id=message flags.`).option(`--tasks <file>`,`Path to a JSON file with an array of tasks (or {tasks: [...]})`).option(`--request <file>`,`Path to a complete batch request JSON file`).option(`--task <id=message>`,`Inline task, id=message. Repeatable.`,(e,t=[])=>[...t,e],[]).option(`--stream`,`Stream per-task events as they arrive`).option(`-t, --timeout <ms>`,`Per-task timeout in milliseconds`,`300000`).option(`--persistent`,`Keep sandboxes alive after completion`,!1).option(`--reuse-key <key>`,`Stable workspace identity required by --persistent`).option(`--replay-only`,`Rejoin existing keyed work; refuse missing custody`).option(`--idempotency-key <key>`,`Retry identity; keyed runs continue after disconnect`).option(`--backend <id=type>`,`Backend identity and type. Required and repeatable without --request.`,(e,t=[])=>[...t,e],[]).option(`--model <provider/model>`,`Model override when exactly one backend is selected`).action(async(e,t)=>{let n=new AbortController,r=!1,i=()=>{r||(r=!0,F(`Cancel requested — stopping stream...`),n.abort())};process.on(`SIGINT`,i),process.on(`SIGTERM`,i);try{let r;if(e.request){let n=[`tasks`,`task`,`backend`,`model`,`timeout`,`persistent`,`reuseKey`].filter(e=>t.getOptionValueSource(e)===`cli`);if(n.length>0){let e={reuseKey:`reuse-key`};throw Error(`--request cannot be combined with ${n.map(t=>`--${e[t]??t}`).join(`, `)}`)}r=Ji(fe(e.request,`utf8`))}else{let t=Ui({file:e.tasks,inline:e.task}),n=qi(e.backend,e.model),i=Number(e.timeout);if(!Number.isInteger(i)||i<=0)throw Error(`--timeout must be a positive integer number of milliseconds`);let a=!!e.persistent;if(a&&!e.reuseKey)throw Error(`--persistent requires --reuse-key`);if(!a&&e.reuseKey)throw Error(`--reuse-key requires --persistent`);r=ee({tasks:t,timeoutMs:i,backends:n,...a?{persistent:!0,reuseKey:e.reuseKey}:{persistent:!1}})}let{tasks:i,backends:a}=r,{client:o}=U(e),s={signal:n.signal,replayOnly:!!e.replayOnly,...e.idempotencyKey?{idempotencyKey:e.idempotencyKey}:{}},c;if(e.stream){let t=e.json?console.error:console.log;F(`Streaming batch of ${i.length} task(s)...`),t();let n=o.streamBatch(r,s),l=a.length>1;for(;;){let e=await n.next();if(e.done){c=e.value;break}let r=e.value;switch(r.type){case`batch.started`:{let e=r.data;F(`Batch started (${e.taskCount} tasks, ${e.backendCount} backends)`);break}case`task.started`:{let e=r.data;t(y.dim(`→ ${Yi(e.taskId,e.backendId,l)} started`));break}case`task.retry`:{let e=r.data;t(y.yellow(`↻ ${Yi(e.taskId,e.backendId,l)} retry ${e.attempt}: ${e.error}`));break}case`task.completed`:{let e=r.data;t(y.green(`✓ ${Yi(e.taskId,e.backendId,l)} completed in ${e.durationMs}ms`+(e.retries?` (${e.retries} retries)`:``)));break}case`task.failed`:{let e=r.data;t(y.red(`✗ ${Yi(e.taskId,e.backendId,l)} failed: ${e.error}`));break}}}t()}else F(`Running batch of ${i.length} task(s)...`),c=await o.runBatch(r,s),e.json||console.log();if(e.json)N(c);else if(L({"Total tasks":c.totalTasks,"Total backends":c.totalBackends,"Total executions":c.totalExecutions,Succeeded:c.totalSuccess,Failed:c.totalFailure,"Total retries":c.totalRetries,"Success rate":`${c.successRate.toFixed(1)}%`}),!e.stream&&c.results.length>0){let e=Xi(c.results);console.log(),console.log(y.bold(`Task Results`)),console.log(y.dim(`─`.repeat(40)));for(let t of c.results){let n=t.success?y.green(`✓`):y.red(`✗`),r=t.success?t.usage.inputTokens+t.usage.outputTokens:0,i=r>0?` • ${r} tokens`:``;console.log(`${n} ${Yi(t.taskId,t.backendId,e.has(t.taskId))} ${y.dim(`(${t.durationMs}ms, ${t.retries} retries${i})`)}`),t.success||console.log(y.red(` ${t.error}`))}}c.totalFailure>0&&(process.exitCode=1)}catch(t){let n=t instanceof Error&&`batchCustody`in t?t.batchCustody:void 0;if(n?.acceptance===`accepted`&&!(n.cleanup?.mode===`release`&&n.cleanup.isComplete)&&F(`Batch accepted; retirement receipt unproved.`),r){console.log(),F(`Batch cancelled.`),e.json&&t instanceof Error&&`batchCustody`in t&&N({ok:!1,batchCustody:t.batchCustody}),process.exitCode=130;return}B(t,e.json)}finally{process.off(`SIGINT`,i),process.off(`SIGTERM`,i)}}),e}function Qi(){let e=new b(`branch`).description(`Branch a running sandbox into copy-on-write children`);return e.command(`create <sandbox-id-or-name>`).description(`Branch a running sandbox into N copy-on-write children`).option(`--count <n>`,`Number of children to create`,`1`).option(`--idempotency-key <key>`,`Retry identity: the same key and count replays the first fan-out and creates no second one`).action(async(e,t)=>{let n=Number.parseInt(t.count,10);if(!Number.isInteger(n)||n<1)throw Error(`--count must be an integer >= 1 (got ${t.count})`);let{context:r,client:i}=U(t),a=I(`Branching into ${n} child(ren)...`);a.start();let o=await G(i,r,e),s=await o.fork(n,{...t.idempotencyKey?{idempotencyKey:t.idempotencyKey}:{}}),c=s.children;a.stop(),t.json?N({children:c.map(e=>({sandboxId:e.id})),requestedCount:s.requestedCount,materializedCount:s.materializedCount,complete:s.complete,...s.idempotency?{idempotency:s.idempotency}:{}}):(s.complete?P(`Branched ${c.length} child(ren) from ${o.id}`):jt(`Branched ${s.materializedCount} of ${s.requestedCount} requested child(ren) from ${o.id}`),s.idempotency?.outcome===`replayed`&&F(`Replayed an earlier fan-out under this key; created none.`),M(c.map(e=>({sandboxId:e.id})),[{key:`sandboxId`,header:`Child Sandbox`,width:28}]))}),e}const $i=[`codex`,`claude-code`,`nanoclaw`,`kimi-code`,`opencode`,`pi`,`openclaw`,`hermes`],ea=`https://intelligence.tangle.tools/v1/otlp`,ta=[`codex`,`claude-code`],na=[`codex`,`claude-code`,`nanoclaw`],ra=[`SessionStart`,`UserPromptSubmit`,`PreToolUse`,`PostToolUse`,`Stop`],ia={codex:{kind:`native`,surface:`codex`,label:`Codex`,buildFiles:va},"claude-code":{kind:`native`,surface:`claude-code`,label:`Claude Code`,buildFiles:ya},nanoclaw:{kind:`native`,surface:`nanoclaw`,label:`NanoClaw`,buildFiles:ya},"kimi-code":{kind:`manual`,surface:`kimi-code`,label:`Kimi Code`,reason:`Kimi Code loads hooks through an explicit config file, so use standard OTLP env wiring until the native config adapter is verified.`},opencode:{kind:`manual`,surface:`opencode`,label:`OpenCode`,reason:`OpenCode hooks run as plugins; use standard OTLP env wiring until the native plugin adapter is verified.`},pi:{kind:`manual`,surface:`pi`,label:`Pi`,reason:`Pi hooks run through TypeScript extensions; use standard OTLP env wiring until the native extension adapter is verified.`},openclaw:{kind:`manual`,surface:`openclaw`,label:`OpenClaw`,reason:`OpenClaw project hooks require user opt-in; use standard OTLP env wiring until the hook toggle and adapter are verified.`},hermes:{kind:`manual`,surface:`hermes`,label:`Hermes`,reason:`Hermes project plugins require explicit enablement; use standard OTLP env wiring until the plugin adapter is verified.`}};function aa(e){let t=e.split(`,`).map(e=>e.trim()).filter(Boolean).flatMap(e=>_a(e));return t.length===0?[...ta]:Ma(t)}function oa(e){return Object.hasOwn(ia,e)}function sa(e=process.cwd()){return he(be(e))||`agent-workspace`}function ca(){return D(O(),`.tangle`,`intelligence.json`)}function la(e=ca()){if(!ue(e))return null;let t=ka(e),n=Na(t,`apiKey`),r=Na(t,`endpoint`),i=Na(t,`serviceName`),a=Na(t,`environment`);if(!n||!r||!i||!a)throw Error(`${e} is missing apiKey, endpoint, serviceName, or environment`);return{apiKey:n,endpoint:r,serviceName:i,environment:a}}async function ua(e){let t=be(e.workspace),n=ca(),r=aa(e.selection),i=[],a=[],o=[],s={apiKey:e.apiKey,endpoint:ga(e.endpoint),serviceName:e.serviceName,environment:e.environment};e.dryRun||Ea(n,s),o.push(n);for(let n of r){let r=ia[n];if(r.kind===`manual`){a.push({agent:r.surface,label:r.label,reason:r.reason});continue}i.push(r.surface);let s=t=>da(e.hookCommand,r.surface,t);for(let n of r.buildFiles(s)){let r=D(t,n.relPath);if(e.dryRun){o.push(r);continue}Oa(r,JSON.parse(n.content),n.mode),o.push(r)}}return!e.smoke||e.dryRun?{configPath:n,written:o,agents:r,nativeAgents:i,manual:a}:{configPath:n,written:o,agents:r,nativeAgents:i,manual:a,smokeTraceId:await pa({agent:i[0]??r[0]??`codex`,event:`install.smoke`,endpoint:s.endpoint,apiKey:s.apiKey,serviceName:s.serviceName,environment:s.environment,sessionId:`install-smoke-${Date.now()}`,payload:{source:`tangle intelligence connect`}})}}function da(e,t,n){return`${e.trim()} --agent ${t} --event ${n} --non-blocking`}function fa(e){let t=BigInt(Date.now())*1000000n,n=Fa(16),r=Fa(8),i=e.sessionId??ba(e.payload),a={"service.name":e.serviceName,"deployment.environment":e.environment,"tangle.agent.surface":e.agent,"tangle.agent.hook.event":e.event,"tangle.agent.hook.source":`local-hook`,...xa(e.payload)};return i&&(a[`session.id`]=i,a[`gen_ai.conversation.id`]=i,a[`tangle.sessionId`]=i),{body:{resourceSpans:[{resource:{attributes:[Ia(`service.name`,e.serviceName),Ia(`deployment.environment`,e.environment),Ia(`tangle.agent.surface`,e.agent)]},scopeSpans:[{scope:{name:`tangle.intelligence.agent-hook`,version:`1.0.0`},spans:[{traceId:n,spanId:r,name:`agent.${e.agent}.${e.event}`,kind:1,startTimeUnixNano:t.toString(),endTimeUnixNano:(t+1000000n).toString(),attributes:Object.entries(a).map(([e,t])=>Ia(e,t)),status:{code:1}}]}]}]},traceId:n}}async function pa(e){let{body:t,traceId:n}=fa(e),r=await fetch(`${ga(e.endpoint)}/v1/traces`,{method:`POST`,headers:{Authorization:`Bearer ${e.apiKey}`,"Content-Type":`application/json`},body:JSON.stringify(t)});if(!r.ok){let e=await r.text().catch(()=>``);throw Error(`OTLP smoke ingest failed: ${r.status}${e?` ${e}`:``}`)}return n}function ma(e){return ga(e).replace(/\/v1\/otlp$/,``).replace(/\/+$/,``)}async function ha(e){let t=`${ma(e.endpoint)}/v1/onboarding/status`,n=await fetch(t,{headers:{Authorization:`Bearer ${e.apiKey}`},signal:e.timeoutMs&&e.timeoutMs>0?AbortSignal.timeout(e.timeoutMs):void 0});if(!n.ok){let e=await n.text().catch(()=>``);throw Error(`onboarding status request failed: ${n.status}${e?` ${e}`:``}`)}let r=await n.json();return{tracesSeen:!!r.tracesSeen,contentSeen:!!r.contentSeen,lastSeenAt:typeof r.lastSeenAt==`string`?r.lastSeenAt:null,windowDays:typeof r.windowDays==`number`?r.windowDays:7,byAgent:r.byAgent&&typeof r.byAgent==`object`?r.byAgent:{}}}function ga(e){let t=e.trim().replace(/\/+$/,``);return t.endsWith(`/v1/traces`)?t.slice(0,-10):t.endsWith(`/v1/logs`)?t.slice(0,-8):t}function _a(e){switch(e){case`local`:case`both`:return[...ta];case`all`:return[...na];case`claude`:return[`claude-code`];case`kimi`:return[`kimi-code`];default:if(oa(e))return[e];throw Error(`agent must be one of: local, all, both, ${$i.join(`, `)}`)}}function va(e){let t=Object.fromEntries(ra.map(t=>[t,[{command:e(t),timeoutMs:3e3,blocking:!1,matcher:`*`}]]));return[{relPath:`.codex/hooks.json`,content:JSON.stringify({hooks:t},null,2)}]}function ya(e){let t=Object.fromEntries(ra.map(t=>[t,[{matcher:`*`,hooks:[{type:`command`,command:e(t),timeout:3}]}]]));return[{relPath:`.claude/settings.json`,content:JSON.stringify({hooks:t},null,2)}]}function ba(e){return Ca(e,[`session.id`,`sessionId`,`session_id`,`conversationId`,`conversation_id`,`threadId`,`thread_id`,`transcriptId`,`transcript_id`])||process.env.TANGLE_SESSION_ID||process.env.CODEX_THREAD_ID||process.env.CLAUDE_SESSION_ID||process.env.OPENCODE_SESSION_ID}function xa(e){let t={},n=Sa(e,[`tool.name`,`toolName`,`tool_name`,`tool`]),r=Sa(e,[`command`,`cmd`,`shell_command`,`shellCommand`]),i=Sa(e,[`tool.input`,`toolInput`,`tool_input`,`input`,`arguments`,`args`]),a=Sa(e,[`tool.output`,`toolOutput`,`tool_output`,`output`,`result`]),o=Sa(e,[`tool.exit_code`,`exitCode`,`exit_code`,`status`]),s=Sa(e,[`tool.error.message`,`errorMessage`,`error_message`,`error`]);return n&&(t[`tool.name`]=n),r&&(t[`process.command`]=r),i&&(t[`tool.input.summary`]=i),a&&(t[`tool.output.summary`]=a),o&&(t[`tool.exit_code`]=o),s&&(t[`tool.error.message`]=s),t}function Sa(e,t){let n=wa(e,t);if(n===void 0)return null;if(typeof n==`string`)return Ta(n);if(typeof n==`number`||typeof n==`boolean`||typeof n==`bigint`)return String(n);try{return Ta(JSON.stringify(n))}catch{return null}}function Ca(e,t){let n=wa(e,t);return typeof n==`string`&&n.length>0?n:void 0}function wa(e,t){if(typeof e!=`object`||!e)return;let n=[e],r=new Set;for(;n.length;){let e=n.pop();if(typeof e!=`object`||!e||r.has(e))continue;r.add(e);let i=e;for(let e of t){let t=i[e];if(t!=null&&t!==``)return t}for(let e of Object.values(i))typeof e==`object`&&e&&n.push(e)}}function Ta(e){return e.length>4096?`${e.slice(0,4093)}...`:e}function Ea(e,t){Da(e,`${JSON.stringify(t,null,2)}\n`)}function Da(e,t){de(ge(e),{mode:448,recursive:!0});let n=`${e}.${process.pid}.tmp`;me(n,t,{mode:384}),pe(n,e)}function Oa(e,t,n){de(ge(e),{recursive:!0});let r=Aa(ka(e),t);me(e,`${JSON.stringify(r,null,2)}\n`,{mode:n??420})}function ka(e){if(!ue(e))return{};let t=JSON.parse(fe(e,`utf8`));if(!Pa(t))throw Error(`${e} must contain a JSON object`);return t}function Aa(e,t){let n={...e};for(let[e,r]of Object.entries(t)){let t=n[e];Pa(t)&&Pa(r)?n[e]=Aa(t,r):Array.isArray(t)&&Array.isArray(r)?n[e]=ja([...t,...r]):n[e]=r}return n}function ja(e){let t=new Set,n=[];for(let r of e){let e=JSON.stringify(r);t.has(e)||(t.add(e),n.push(r))}return n}function Ma(e){return[...new Set(e)]}function Na(e,t){let n=e[t];return typeof n==`string`&&n.length>0?n:void 0}function Pa(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&(Object.getPrototypeOf(e)===Object.prototype||Object.getPrototypeOf(e)===null)}function Fa(e){return ne(e).toString(`hex`)}function Ia(e,t){return{key:e,value:{stringValue:t}}}const La=`tangle.opencode-exporter`,Ra=16384;function za(e){return e.length<=Ra?e:`${e.slice(0,Ra-1)}…`}function q(e,t){return{key:e,value:{stringValue:t}}}function Ba(e){if(!e||typeof e!=`object`)return null;let t=e,n=k(t.type);return n?{type:n,properties:t.properties&&typeof t.properties==`object`?t.properties:void 0}:null}function Va(e,t){let n=[q(`event.name`,e),q(`gen_ai.system`,`opencode`),q(`service.name`,`opencode`)];return t&&(n.push(q(`session.id`,t)),n.push(q(`gen_ai.conversation.id`,t))),n}function Ha(e){if(!e)return null;let t=e.part,n=e.info;return k(t?.sessionID)??k(n?.sessionID)??k(e.sessionID)??null}function Ua(e,t){let n=k(e.role)??k(e.info?.role);if(n)return n.toLowerCase();let r=k(e.messageID),i=t?.(r)??null;return i?i.toLowerCase():null}function Wa(e,t,n){let r=[],i=Ha(e.properties),a=(n,r)=>({timeUnixNano:t,severityNumber:9,severityText:`INFO`,...n===null?{}:{body:{stringValue:za(n)}},attributes:[...Va(e.type,i),...r]});if(e.type===`message.part.updated`){let t=e.properties?.part;if(!t)return r;let i=k(t.type);if(i===`text`||i===`reasoning`){let e=k(t.text);if(e){let i=Ua(t,n)===`user`?Pe:Ne;r.push(a(e,[q(i,za(e))]))}return r}if(i===`tool`){let e=k(t.tool),n=t.state,i=ze(n?.input),o=ze(n?.output),s=k(n?.error)??(typeof n?.error==`object`&&n?.error!==null?ze(n.error):null);if(e||i){let t=[];e&&t.push(q(Ie,e)),i&&t.push(q(Fe,za(i))),r.push(a(null,t))}let c=o??s;if(c){let t=[q(Le,za(c))];e&&t.push(q(Ie,e)),r.push(a(c,t))}return r}return r}if(e.type===`session.next.text.delta`||e.type===`session.next.text.ended`){let t=e.properties??{},n=k(t.text)??(e.type===`session.next.text.delta`?k(t.delta):null);return n&&r.push(a(n,[q(Ne,za(n))])),r}return r}function Ga(e=process.env.OTEL_RESOURCE_ATTRIBUTES){if(!e)return null;for(let t of e.split(`,`)){let e=t.indexOf(`=`);if(e===-1||t.slice(0,e).trim()!==Re)continue;let n=t.slice(e+1).trim();if(n.length>0)return n}return null}function Ka(e,t){if(e.length===0)return null;let n=[q(`service.name`,`opencode`),q(`gen_ai.system`,`opencode`),q(`telemetry.sdk.name`,La)];return t&&t.trim().length>0&&n.push(q(Re,t.trim())),{resourceLogs:[{resource:{attributes:n},scopeLogs:[{scope:{name:La,version:`1.0.0`},logRecords:e}]}]}}function qa(e){return(e??process.env.OPENCODE_BASE_URL??`http://127.0.0.1:4096`).replace(/\/+$/,``)}async function Ja(e){let t=ga(e.endpoint),n=await(e.fetchImpl??fetch)(`${t}/v1/logs`,{method:`POST`,headers:{Authorization:`Bearer ${e.apiKey}`,"Content-Type":`application/json`},body:JSON.stringify(e.request),signal:e.timeoutMs&&e.timeoutMs>0?AbortSignal.timeout(e.timeoutMs):void 0});if(!n.ok){let e=await n.text().catch(()=>``);throw Error(`OpenCode OTLP logs ingest failed: ${n.status}${e?` ${e}`:``}`)}}var Ya=class extends Error{partial;constructor(e,t){let n=e instanceof Error?e.message:String(e);super(n),this.name=`OpencodeExporterError`,this.partial=t,e instanceof Error&&(this.cause=e)}};function Xa(){return(BigInt(Date.now())*1000000n).toString()}async function Za(e){let t=qa(e.opencodeBaseUrl),n=e.nowUnixNano??Xa,r=e.fetchImpl??fetch,i=e.subjectKey===void 0?Ga():e.subjectKey,a=await r(`${t}/event`,{headers:{Accept:`text/event-stream`},signal:e.signal});if(!a.ok){let e=await a.text().catch(()=>``);throw Error(`OpenCode event subscribe failed: ${a.status} at ${t}/event${e?` ${e}`:``}. Is OpenCode running with 'opencode serve'?`)}if(!a.body)throw Error(`OpenCode event stream at ${t}/event returned no body — cannot subscribe`);let o={eventsSeen:0,contentEventsExported:0,recordsExported:0},s=new Map,c=e=>e?s.get(e)??null:null;try{for await(let t of v(a.body,{signal:e.signal})){o.eventsSeen++;let a=Ba(t.data);if(!a)continue;if(a.type===`message.updated`){let e=a.properties?.info,t=k(e?.id),n=k(e?.role);t&&n&&s.set(t,n);continue}let l=Wa(a,n(),c),u=Ka(l,i);u&&(await Ja({endpoint:e.endpoint,apiKey:e.apiKey,request:u,timeoutMs:e.postTimeoutMs,fetchImpl:r}),o.contentEventsExported++,o.recordsExported+=l.length,e.onExport?.({eventType:a.type,records:l.length}))}}catch(e){if(e instanceof Error&&(e.name===`AbortError`||e.message.toLowerCase().includes(`abort`)))return o;throw new Ya(e,o)}return o}function Qa(e,t){let n=Number(e);if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} must be a positive integer`);return n}const $a=[`claude-code`,`codex`,`opencode`,`openclaw`,`hermes`,`nanoclaw`],eo={"claude-code":`Claude Code`,codex:`Codex`,opencode:`OpenCode`,openclaw:`OpenClaw`,hermes:`Hermes`,nanoclaw:`NanoClaw`};function to(e){return $a.includes(e)}function no(e){return ue(e)?fe(e,`utf8`):``}function ro(e,t){de(ge(e),{recursive:!0});let n=`${e}.${process.pid}.tmp`;me(n,t,{mode:384}),ce(n,384),pe(n,e)}const io=`# >>> tangle intelligence (claude-code) >>>`,ao=`# <<< tangle intelligence (claude-code) <<<`,oo={full:[{key:`OTEL_LOG_USER_PROMPTS`,comment:`the user/task prompt text`},{key:`OTEL_LOG_TOOL_DETAILS`,comment:`tool arguments`},{key:`OTEL_LOG_TOOL_CONTENT`,comment:`full tool input+output bodies`},{key:`OTEL_LOG_RAW_API_BODIES`,comment:`full prompt+completion JSON (richest)`}],prompts:[{key:`OTEL_LOG_USER_PROMPTS`,comment:`the user/task prompt text`},{key:`OTEL_LOG_TOOL_DETAILS`,comment:`tool arguments`}],metadata:[]};function so(e,t){return t===`env`?e:/\s/.test(e)?`"${e}"`:e}function co(e,t){let n=t===`shell`?`export `:t===`dockerfile`?`ENV `:``,r=[];for(let i of e){if(i.kind===`blank`){t===`shell`&&r.push(``);continue}if(i.kind===`comment`){t===`shell`&&r.push(`# ${i.text}`);continue}let e=t===`shell`&&i.comment?` # ${i.comment}`:``;r.push(`${n}${i.key}=${so(i.value,t)}${e}`)}return r.join(`
|
|
136
|
+
`)}function lo(e){let t=ga(e.endpoint),n=e.apiKey??"${TANGLE_API_KEY}",r=e.content??`full`,i=e.format??`shell`,a=[{kind:`comment`,text:`Enable + point Claude Code at Tangle (JSON protocol — matches our adapter)`},{kind:`set`,key:`CLAUDE_CODE_ENABLE_TELEMETRY`,value:`1`},{kind:`set`,key:`OTEL_EXPORTER_OTLP_PROTOCOL`,value:`http/json`},{kind:`set`,key:`OTEL_EXPORTER_OTLP_ENDPOINT`,value:t},{kind:`set`,key:`OTEL_EXPORTER_OTLP_HEADERS`,value:`Authorization=Bearer ${n}`}];e.projectKey?a.push({kind:`blank`},{kind:`comment`,text:`Groups your runs into a project so Tangle can roll up + automate per-project:`},{kind:`set`,key:`OTEL_RESOURCE_ATTRIBUTES`,value:`tangle.subject.key=${e.projectKey}`}):a.push({kind:`blank`},{kind:`comment`,text:`Label this project so Tangle rolls up + automates per-project (pick your own):`},{kind:`comment`,text:` export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=<your project>`}),a.push({kind:`blank`},{kind:`comment`,text:`CONTENT rides LOG EVENTS, so the logs exporter is MANDATORY.`},{kind:`set`,key:`OTEL_LOGS_EXPORTER`,value:`otlp`,comment:`required for prompt/completion/tool content`},{kind:`set`,key:`OTEL_METRICS_EXPORTER`,value:`otlp`,comment:`tokens / cost`},{kind:`set`,key:`OTEL_TRACES_EXPORTER`,value:`otlp`,comment:`spans (beta)`},{kind:`blank`});let o=oo[r];if(o.length===0)a.push({kind:`comment`,text:`Content gates intentionally OFF (metadata-only: tokens, durations, tool names — no prompt/completion/tool bodies).`});else{a.push({kind:`comment`,text:`THE CONTENT GATES (all default OFF):`});for(let e of o)a.push({kind:`set`,key:e.key,value:`1`,comment:e.comment})}return co(a,i)}function uo(e){return[io,lo(e),ao].join(`
|
|
137
|
+
`)}function fo(e,t){let n=e.indexOf(io);if(n!==-1){let r=e.indexOf(ao,n);if(r===-1)throw Error(`shell rc has a '${io}' marker without its closing '${ao}' — fix it by hand and re-run`);let i=r+43,a=`${e.slice(0,n)}${t}${e.slice(i)}`;return{contents:a,changed:a!==e}}return{contents:`${e.length===0?``:po(e)}${t}\n`,changed:!0}}function po(e){return e.endsWith(`
|
|
138
138
|
|
|
139
139
|
`)?e:e.endsWith(`
|
|
140
|
-
`)?`${e}\n`:`${e}\n\n`}function
|
|
141
|
-
`))
|
|
142
|
-
`)}function
|
|
143
|
-
`)}\n`,changed:!0};let i=
|
|
144
|
-
`)?e:`${e}\n`}function To(e){let t=D(O(),`.codex`,`config.toml`),{contents:n,changed:r}=So(to(t),{endpoint:e.endpoint,apiKey:e.apiKey});if(!e.write){console.log(n.trimEnd());return}if(!r){P(`${t} already has the Tangle [otel] block — nothing to change.`);return}no(t,n),P(`Merged the Tangle [otel] block into ${t}.`),F("Codex emits content on the logs signal (codex.* events). Set TANGLE_API_KEY in your env before running if you kept the ${TANGLE_API_KEY} reference."),F(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=${e.projectKey??`<your project>`} before running codex.`)}function Eo(e){switch(e){case`claude-code`:return`Claude Code: set OTEL_LOGS_EXPORTER=otlp and the four OTEL_LOG_* gates (OTEL_LOG_USER_PROMPTS, OTEL_LOG_TOOL_DETAILS, OTEL_LOG_TOOL_CONTENT, OTEL_LOG_RAW_API_BODIES).`;case`codex`:return`Codex: set log_user_prompt = true in [otel] (default false redacts content).`;case`opencode`:return`OpenCode: a standalone install emits nothing without the tangle-opencode-exporter shim; inside a Tangle sandbox it is already instrumented.`;case`openclaw`:case`hermes`:case`nanoclaw`:return`${$a[e]}: no native OTLP exporter and no standalone server to subscribe to — run it inside a Tangle sandbox, where the sidecar adapter exports its content with gen_ai.system=${e}. A bare standalone install emits metadata only.`}}async function Do(e){let t=Date.now()+e.timeoutSeconds*1e3,n=3e3,r=Math.min(e.timeoutSeconds*1e3,1e4),i=I(`Checking whether content is flowing…`);i.start();let a;try{for(;;){try{a=await ma({endpoint:e.endpoint,apiKey:e.apiKey,timeoutMs:r})}catch(e){if(Date.now()>=t)throw e;await ko(n);continue}if(a.contentSeen||Date.now()>=t)break;await ko(n)}}finally{i.stop()}if(!a)throw Error(`onboarding status check returned no result`);Oo(a,e.agent),a.contentSeen||(process.exitCode=1)}function Oo(e,t){if(e.contentSeen){P(`Content flowing — Tangle Intelligence can analyze this feed.`),L({"Last seen":e.lastSeenAt??`just now`,Window:`${e.windowDays}d`});return}if(e.tracesSeen){jt(`Metadata-only — traces are arriving but carry no content. You missed a content gate.`);let n=t?[t]:Object.keys(e.byAgent).filter(eo),r=n.length>0?n:Qa;for(let n of r){let r=e.byAgent[n];(t||!r||r.tracesSeen&&!r.contentSeen)&&F(Eo(n))}return}jt(`No traces yet for your tenant. Run your agent once on a real task, then re-run --verify.`),t&&F(Eo(t))}function ko(e){return new Promise(t=>setTimeout(t,e))}function Ao(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??Qn(void 0);if(!t)throw Error(`No Tangle API key found. Pass --api-key, set TANGLE_API_KEY, or run: tangle auth login`);return t}function jo(){return new b(`connect`).description(`Connect a local coding agent's telemetry to Tangle Intelligence, content on (for SDK integration snippets, see 'tangle agent connect')`).argument(`[agent]`,`claude-code | codex | opencode | openclaw | hermes | nanoclaw`).option(`--endpoint <url>`,`OTLP endpoint base`,$i).option(`-p, --project <key>`,`Project label (tangle.subject.key) to group runs; omit to set it yourself`).option(`--rc <path>`,`Shell rc file to append the Claude Code env block to`).option(`--no-write`,`Print the config instead of writing files (Claude Code / Codex)`).option(`--inline-key`,"Embed the resolved API key literally in the config (default: keep ${TANGLE_API_KEY})").option(`--verify`,`Poll onboarding status and report whether CONTENT is flowing`).option(`--timeout <seconds>`,`Verify poll timeout in seconds`,`120`).option(`--run`,`OpenCode only: run the content exporter against a live OpenCode server until interrupted`).option(`--opencode-url <url>`,`OpenCode server base URL for --run (or set OPENCODE_BASE_URL)`).option(`--format <kind>`,`Claude Code output: shell (export block) | env (.env / docker --env-file) | dockerfile (ENV lines). env/dockerfile are the cron/container path — printed to stdout, no shell-rc edit, no TTY`,`shell`).option(`--content <tier>`,`Claude Code content tier: full (everything) | prompts (task+prompts+tool-args) | metadata (telemetry on, content off)`,`full`).action(async(e,t)=>{let n=ha(t.endpoint);if(t.run){if((e?No(e):`opencode`)!==`opencode`)throw Error(`--run is OpenCode-only: it runs the content exporter against a live OpenCode server. Other agents export natively once configured.`);await Lo({endpoint:n,apiKey:Ao(t.apiKey),opencodeUrl:t.opencodeUrl});return}if(t.verify){await Do({endpoint:n,apiKey:Ao(t.apiKey),agent:e?No(e):void 0,timeoutSeconds:Za(t.timeout,`--timeout`)});return}let r=e?No(e):await Po(),i=t.inlineKey?Ao(t.apiKey):void 0;r===`claude-code`?await go({endpoint:n,apiKey:i,projectKey:t.project,rcPath:t.rc,write:t.write!==!1,content:ho(t.content),format:mo(t.format)}):r===`codex`?To({endpoint:n,apiKey:i,projectKey:t.project,write:t.write!==!1}):r===`opencode`?Fo({endpoint:n}):Io(r,{endpoint:n}),console.log(),F(`Run your agent on a real task, then verify content is flowing: tangle connect ${r} --verify`)})}function Mo(){return new b(`opencode-exporter`).description(`Export a running OpenCode's content to Tangle Intelligence (standalone shim)`).option(`--endpoint <url>`,`OTLP endpoint base`,$i).option(`--opencode-url <url>`,`OpenCode server base URL (or set OPENCODE_BASE_URL)`).action(async e=>{await Lo({endpoint:ha(e.endpoint),apiKey:Ao(e.apiKey),opencodeUrl:e.opencodeUrl})})}function No(e){if(eo(e))return e;throw Error(`Unknown agent '${e}'. Choose one of: ${Qa.join(`, `)}`)}async function Po(){if(!process.stdin.isTTY)throw Error(`Specify an agent: tangle connect <${Qa.join(`|`)}>`);console.log(`Which coding agent are you connecting?`),Qa.forEach((e,t)=>{console.log(` ${t+1}) ${$a[e]} (${e})`)});let e=await Yr(`Enter a number or name`,`1`);return Qa[Number.parseInt(e,10)-1]||No(e.trim())}function Fo(e){let t=ha(e.endpoint);jt(`OpenCode has no native OTel exporter, so a standalone install emits nothing without a shim.`),console.log(),L({"Inside a Tangle sandbox":`already instrumented — our adapter exports OpenCode's event-stream content. Nothing to do.`,Standalone:`run 'tangle connect opencode --run' alongside a running OpenCode, exporting to ${t}.`}),console.log(),F(`Start OpenCode in server mode ('opencode serve'), then in another terminal run: tangle connect opencode --run`),F(`The exporter subscribes to OpenCode's SSE event bus and exports content-bearing OTLP (prompt/completion/tool content) to Tangle. Verify with: tangle connect opencode --verify`),F(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=my-project before starting the exporter.`)}function Io(e,t){let n=ha(t.endpoint),r=$a[e];jt(`${r} has no native OTel exporter, so a standalone install emits nothing without instrumentation.`),console.log(),L({"Inside a Tangle sandbox":`already instrumented — the sidecar adapter exports ${r}'s prompt/completion/tool content (gen_ai.system=${e}) to ${n}. Nothing to do.`,Standalone:`${r} exposes no OTLP and no event-bus server; run it inside a Tangle sandbox to capture content.`}),console.log(),F(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=my-project before starting ${r}.`),F(`Verify content is flowing: tangle connect ${e} --verify`)}async function Lo(e){let t=Ka(e.opencodeUrl),n=new AbortController,r=()=>n.abort();process.on(`SIGINT`,r),process.on(`SIGTERM`,r),F(`Subscribing to OpenCode at ${t} — exporting content to Tangle.`),F(`Run OpenCode tasks now. Press Ctrl-C to stop.`),console.log();let i=0,a;try{a=await Xa({endpoint:e.endpoint,apiKey:e.apiKey,opencodeBaseUrl:t,signal:n.signal,onExport:({eventType:e,records:t})=>{i+=t,F(`exported ${t} record(s) from ${e} (total ${i})`)}})}catch(e){if(e instanceof Ja){let{recordsExported:t,contentEventsExported:n}=e.partial;console.log(),jt(`Exporter failed after exporting ${t} content record(s) from ${n} event(s): ${e.message}`)}throw e}finally{process.off(`SIGINT`,r),process.off(`SIGTERM`,r)}if(console.log(),a.contentEventsExported===0){jt(`Saw ${a.eventsSeen} event(s) but none carried content. Run a real OpenCode task (a prompt that produces text or a tool call), then re-run.`);return}P(`Exported ${a.recordsExported} content record(s) from ${a.contentEventsExported} event(s).`),F(`Verify it landed: tangle connect opencode --verify`)}function Ro(){let e=new b(`environments`).alias(`env`).description(`Manage sandbox environments`);return e.command(`list`).alias(`ls`).description(`List available environments`).action(async e=>{let{client:t}=W(e),n=I(`Fetching environments...`);e.json||n.start();let r=await t.environments.list();n.stop(),e.json?N(r):r.length===0?console.log(`No environments found`):It([`ID`,`Description`,`Version`],r.map(e=>[e.id,e.description??``,e.version]))}),e.command(`get`).description(`Get environment details`).argument(`<id>`,`Environment ID`).action(async(e,t)=>{let{client:n}=W(t),r=I(`Fetching environment...`);t.json||r.start();let i=await n.environments.get(e);if(r.stop(),!i){console.error(`Environment not found: ${e}`),process.exit(1);return}t.json?N(i):(console.log(`ID: ${i.id}`),console.log(`Description: ${i.description??`-`}`),console.log(`Version: ${i.version}`),i.base&&console.log(`Base: ${i.base}`))}),e}function zo(e){let t=e.memory?Go(e.memory,`--accelerator-memory`):void 0;return{kind:qo(e.kind),count:e.count?Go(e.count,`--accelerator-count`):1,...t===void 0?{}:{memoryMB:t}}}function Bo(e,t,n){let r=!!(e.provider||e.image||e.env||e.maxSpendUsd||e.maxLifetime||e.idleTimeout);if(!t&&r)throw Error(n);if(t){if(!e.maxSpendUsd||!e.maxLifetime)throw Error(`--accelerator-kind requires --gpu-max-spend-usd and --gpu-max-lifetime`);return{...e.provider?{provider:Ko(e.provider,`--gpu-provider`)}:{},...e.image?{image:e.image}:{},...e.env?{env:Wo(e.env,`--gpu-env`,`GPU env`)}:{},maxSpendUsd:Jo(e.maxSpendUsd,`--gpu-max-spend-usd`),maxLifetimeSeconds:Go(e.maxLifetime,`--gpu-max-lifetime`),...e.idleTimeout?{idleTimeoutSeconds:Go(e.idleTimeout,`--gpu-idle-timeout`)}:{}}}}function Vo(e){return{...e.provider?{provider:Ko(e.provider,`GPU provider`)}:{},accelerator:zo({kind:e.acceleratorKind,count:e.acceleratorCount,memory:e.acceleratorMemory}),...e.image?{image:e.image}:{},...e.env?{env:Wo(e.env,`--env`,`env`)}:{},maxSpendUsd:Jo(e.maxSpendUsd,`--max-spend-usd`),maxLifetimeSeconds:Go(e.maxLifetime,`--max-lifetime`),...e.idleTimeout?{idleTimeoutSeconds:Go(e.idleTimeout,`--idle-timeout`)}:{}}}function Ho(e){return e.length===1?e[0]:e.map(Ve).join(` `)}function Uo(e){return{timeoutMs:e.timeout?Go(String(e.timeout),`--timeout`):void 0,env:e.env?Wo(e.env,`--env`,`env`):void 0}}function Wo(e,t,n){let r={};for(let i of e){let[e,...a]=i.split(`=`);if(!e||a.length===0)throw Error(`${t} expects ${n} values in KEY=VALUE format`);r[e]=a.join(`=`)}return r}function Go(e,t){if(!/^\d+$/.test(e))throw Error(`${t} must be a positive integer`);let n=Number.parseInt(e,10);if(Number.isNaN(n)||n<1)throw Error(`${t} must be a positive integer`);return n}function Ko(e,t){if(i.includes(e))return e;throw Error(`${t} must be one of ${i.join(`, `)}`)}function qo(e){let t=e.trim().toLowerCase();if(/^[a-z0-9][a-z0-9._-]*$/.test(t))return t;throw Error(`--accelerator-kind must contain only letters, numbers, dots, underscores, or hyphens`)}function Jo(e,t){if(!/^(?:\d+|\d+\.\d+|\.\d+)$/.test(e))throw Error(`${t} must be a positive number`);let n=Number.parseFloat(e);if(!Number.isFinite(n)||n<=0)throw Error(`${t} must be a positive number`);return n}function Yo(){return new b(`exec`).description(`Execute a command in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command...>`,`Command and arguments, or one shell script`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`,`60000`).allowUnknownOption(!0).action(async(e,t,n)=>{try{let{context:r,client:i}=W(n),a=Ho(t),o=Wo(n.env??[],`--env`,`env`),s=I(`Executing: ${a}`);n.json||s.start();let c=await K(i,r,e);c=await q(c);let l=await c.exec(a,{cwd:n.cwd,env:Object.keys(o).length>0?o:void 0,timeoutMs:Number.parseInt(n.timeout,10)});s.stop(),n.json?N(l):(l.stdout&&process.stdout.write(l.stdout),l.stderr&&process.stderr.write(l.stderr)),l.exitCode!==0&&(process.exitCode=l.exitCode)}catch(e){if(e instanceof a){let t=`Exec transport lost before command status was confirmed. Remote command status is unknown. Original error: ${e.message}. For long-running commands, use \`tangle process spawn\`, \`tangle process logs\`, and \`tangle process kill --tree\`.`;return B(Error(t,{cause:e}))}B(e)}})}function Xo(e){e.command(`capabilities`).description(`List fleet drivers and their supported features`).action(async e=>{let{client:t}=W(e),n=I(`Fetching capabilities...`);n.start();let r=await t.fleets.capabilities();n.stop(),e.json?N(r):M(r.drivers,[{key:`driverType`,header:`Driver`,width:16},{key:`sharedWorkspace`,header:`Shared WS`,width:12},{key:`accelerators`,header:`Accel`,width:8},{key:`queueTimings`,header:`Queue`,width:8}])}),e.command(`usage <fleet-id>`).description(`Show fleet usage and reliability insights`).action(async(e,t)=>{let{client:n}=W(t),r=I(`Fetching usage...`);r.start();let i=await n.fleets.usage(e);if(r.stop(),t.json)N(i);else if(L({"Fleet ID":i.usage.fleetId,Status:i.usage.status,Machines:i.usage.machineCount,Running:i.usage.runningMachines,Failed:i.usage.failedMachines,"Runtime (ms)":i.usage.meteredUsage?.runtimeMs,"Reliability score":i.insights.reliabilityScore,"Failure rate":i.insights.failureRate}),i.insights.recommendedActions.length>0){console.log(`
|
|
145
|
-
Recommended actions:`);for(let e of i.insights.recommendedActions)console.log(` - ${e}`)}}),e.command(`cost <fleet-id>`).description(`Show the fleet's cost estimate`).action(async(e,t)=>{let{client:n}=W(t),r=I(`Estimating cost...`);r.start();let i=await n.fleets.cost(e);r.stop(),t.json?N(i):L({Plan:i.plan,Currency:i.currency,"Hourly (USD)":i.hourlyUsd,"Max lifetime (s)":i.maxLifetimeSeconds,"Estimated max lifetime (USD)":i.estimatedMaxLifetimeUsd,Machines:i.requestedResources.machines,"Total CPU":i.requestedResources.totalCpu,"Total memory (MB)":i.requestedResources.totalMemoryMb})})}function Zo(e){return[...e.entries()].map(([e,t])=>({machineId:e,sandboxId:t.id,status:t.status}))}function Qo(e){e.command(`list <fleet-id>`).description(`List the machines of one fleet (fleet id is required)`).option(`--status <status>`,`Filter machines by status`).action(async(e,t)=>{let{client:n}=W(t),r=I(`Fetching fleet...`);r.start();let i=await n.fleets.list({fleetId:e,status:t.status});r.stop();let a=Zo(i.machines);t.json?N({fleetId:i.fleetId,machines:a}):M(a,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}])}),e.command(`get <fleet-id>`).description(`Show one fleet's manifest (server record)`).action(async(e,t)=>{let{client:n}=W(t),r=I(`Fetching manifest...`);r.start();let i=await n.fleets.manifest(e);r.stop(),t.json?N(i):(L({"Fleet ID":i.fleetId??i.id,Machines:i.machines.length,"Workspace mode":i.workspace?.mode,"Workspace status":i.workspace?.status,"Max lifetime (s)":i.policy?.maxLifetimeSeconds,"Max spend (USD)":i.policy?.maxSpendUsd,Created:i.createdAt,Updated:i.updatedAt}),M(i.machines,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`role`,header:`Role`,width:14},{key:`status`,header:`Status`,width:14}]))}),e.command(`delete <fleet-id>`).description(`Delete a fleet's machine sandboxes and its record`).option(`--continue-on-error`,`Keep deleting remaining machines if one delete fails`).action(async(e,t)=>{let{client:n}=W(t),r=I(`Deleting fleet...`);r.start(),await n.fleets.delete(e,{continueOnError:t.continueOnError}),r.stop(),t.json?N({success:!0,fleetId:e}):P(`Fleet deleted: ${e}`)}),e.command(`reap`).description(`TTL cleanup of all expired fleets (fleet-wide)`).option(`--dry-run`,`Report what would be reaped without deleting`).action(async e=>{let{client:t}=W(e),n=I(`Reaping expired fleets...`);n.start();let r=await t.fleets.reapExpired({dryRun:e.dryRun});n.stop(),e.json?N(r):(L({"Dry run":r.dryRun,Expired:r.expired,Deleted:r.deleted}),M(r.fleets,[{key:`fleetId`,header:`Fleet`,width:24},{key:`expiredAt`,header:`Expired`,width:18},{key:`deleted`,header:`Deleted`,width:10}]))}),e.command(`reconcile`).description(`Drop fleet records whose underlying sandboxes vanished`).option(`--dry-run`,`Report orphans without removing them`).action(async e=>{let{client:t}=W(e),n=I(`Reconciling fleets...`);n.start();let r=await t.fleets.reconcile({dryRun:e.dryRun});n.stop(),e.json?N(r):(L({"Dry run":r.dryRun,Checked:r.checked,Orphaned:r.orphaned,Removed:r.removed}),M(r.machines,[{key:`fleetId`,header:`Fleet`,width:24},{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`removed`,header:`Removed`,width:10}]))})}function $o(e){if(e.spec){let t=JSON.parse(fe(e.spec,`utf8`));return{base:{fleetId:e.fleetId,defaults:t.defaults,policy:t.policy,workspace:t.workspace,metadata:t.metadata},machines:t.machines??[]}}let t=ns(e),n=rs(e,!!t?.accelerator),r={...e.environment?{environment:e.environment}:{},...t?{resources:t}:{},...e.driver?{driver:{type:e.driver}}:{},...n?{gpuLease:n}:{},...e.backend?{backend:{type:e.backend}}:{}},i=is(e),a=Math.max(1,Number(e.count)||1),o=Array.from({length:a},(e,t)=>({machineId:`worker-${t+1}`}));return{base:{fleetId:e.fleetId,defaults:Object.keys(r).length>0?r:void 0,policy:i,workspace:{mode:e.workspace}},machines:o}}function es(e){let{base:t,machines:n}=$o(e);return{...t,machines:n}}function ts(e){let{base:t,machines:n}=$o(e);return{...t,workers:n}}function ns(e){let t={};if(e.cpu&&(t.cpuCores=Number(e.cpu)),e.memory&&(t.memoryMB=Number(e.memory)),e.disk&&(t.diskGB=Number(e.disk)),e.acceleratorKind)t.accelerator=zo({kind:e.acceleratorKind,count:e.acceleratorCount,memory:e.acceleratorMemory});else if(e.acceleratorCount||e.acceleratorMemory)throw Error(`--accelerator-count and --accelerator-memory require --accelerator-kind`);return Object.keys(t).length>0?t:void 0}function rs(e,t){return Bo({provider:e.gpuProvider,image:e.gpuWorkerImage,env:e.gpuEnv,maxSpendUsd:e.gpuMaxSpendUsd,maxLifetime:e.gpuMaxLifetime,idleTimeout:e.gpuIdleTimeout},t,`Fleet GPU lease flags require --accelerator-kind`)}function is(e){let t={};return e.maxSpendUsd&&(t.maxSpendUsd=Number(e.maxSpendUsd)),e.maxLifetime&&(t.maxLifetimeSeconds=Number(e.maxLifetime)),Object.keys(t).length>0?t:void 0}function as(e){e.command(`create`).description(`Create a sandbox fleet`).option(`--fleet-id <id>`,`Stable fleet id (generated when omitted)`).option(`--count <n>`,`Number of worker machines`,`1`).option(`--environment <environment>`,`Named environment, container image, or built image ID for each machine`).option(`--cpu <cores>`,`CPU cores per machine`).option(`--memory <mb>`,`Memory in MB per machine`).option(`--disk <gb>`,`Disk in GB per machine`).option(`--accelerator-kind <kind>`,`Accelerator kind per machine, for example nvidia-l4 or nvidia-h100`).option(`--accelerator-count <count>`,`Accelerator devices per machine`).option(`--accelerator-memory <mb>`,`Minimum accelerator memory in MB per machine`).option(`--gpu-provider <provider>`,`GPU cloud provider per machine; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for each GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum spend per machine GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum GPU lease lifetime per machine in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy each GPU lease after this many idle seconds`).option(`--driver <type>`,`Infrastructure driver type`).option(`--backend <id>`,`Agent backend type`).option(`--workspace <mode>`,`Workspace mode: isolated (no driver supports shared yet)`,`isolated`).option(`--max-spend-usd <n>`,`Fleet spend cap in USD (policy)`).option(`--max-lifetime <s>`,`Max machine lifetime in seconds (policy)`).option(`--spec <file.json>`,`Path to a JSON file describing the fleet (overrides synthesized machines)`).option(`--coordinator`,`Create a coordinator + workers fleet (routes to createWithCoordinator)`).action(async e=>{let{client:t}=W(e),n=I(`Creating fleet...`);n.start();let r=e.coordinator?await t.fleets.createWithCoordinator(ts(e)):await t.fleets.create(es(e));n.stop();let i=Zo(r.machines);e.json?N({fleetId:r.fleetId,machines:i}):(P(`Fleet created: ${r.fleetId}`),M(i,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}]))})}function os(e){e.command(`exec <fleet-id> <command>`).description(`Run a shell command across the fleet's machines`).option(`--machine <id...>`,`Restrict to a subset of machine ids (default: all)`).option(`--cwd <dir>`,`Working directory for the command`).option(`--timeout <ms>`,`Per-machine timeout in milliseconds`).option(`--max-concurrent <n>`,`Max concurrent dispatches`).action(async(e,t,n)=>{let{client:r}=W(n),i=I(`Dispatching command...`);i.start();let a=await(await r.fleets.list({fleetId:e})).dispatchExecDetailed(t,{machines:n.machine,cwd:n.cwd,timeoutMs:n.timeout?Number(n.timeout):void 0,maxConcurrent:n.maxConcurrent?Number(n.maxConcurrent):void 0});if(i.stop(),n.json)N(a);else{M(a.results.map(e=>({machineId:e.machineId,ok:e.ok,exitCode:e.result?.exitCode,durationMs:e.durationMs})),[{key:`machineId`,header:`Machine`,width:20},{key:`ok`,header:`OK`,width:6},{key:`exitCode`,header:`Exit`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14}]);for(let e of a.results){let t=e.result?.stdout,n=e.result?.stderr;t&&(console.log(`\n[${e.machineId}] stdout:`),console.log(t)),n&&(console.log(`\n[${e.machineId}] stderr:`),console.log(n)),e.error&&console.log(`\n[${e.machineId}] error: ${e.error.message}`)}}a.results.some(e=>e.ok===!1)&&(process.exitCode=1)}),e.command(`run [prompt]`).description(`Create a fleet of agents, run one turn on every agent, print each result, then delete the fleet`).requiredOption(`--agents <n|file>`,`Number of agents, or a JSON file with an array of agent specs (agentId, harness, model, profile or { profileId, revision }, task)`).option(`--placement <mode>`,`auto (pack by sandbox memory), dedicated (one sandbox per agent), or a number of agents per sandbox`,`auto`).option(`--model <id>`,`Model every agent runs, e.g. gpt-4.1-mini`).option(`--memory <mb>`,`Memory in MB per sandbox; auto placement packs by it`).option(`--environment <environment>`,`Environment for each sandbox`).option(`--max-spend-usd <usd>`,`Budget for the fleet in USD, enforced by the Platform on the fleet's own key`).option(`--timeout <ms>`,`Per-agent turn timeout in milliseconds`).option(`--fleet-id <id>`,`Stable fleet id (generated when omitted)`).option(`--parent-fleet <id>`,`Fleet that spawns this one; its cap must cover this cap`).option(`--parent-agent <id>`,`Agent of --parent-fleet that spawns this one`).option(`--keep`,`Keep the fleet after the run instead of deleting it`).action(async(e,t)=>{let n=/^\d+$/.test(t.agents)?Number(t.agents):JSON.parse(fe(t.agents,`utf8`));if(!Array.isArray(n)&&e===void 0)throw Error(`A prompt is required unless --agents names a file whose agents carry tasks`);let{client:r}=W(t);if(!!t.parentFleet!=!!t.parentAgent)throw Error(`--parent-fleet and --parent-agent go together`);let i=t.placement===`auto`||t.placement===`dedicated`?t.placement:{agentsPerSandbox:Number(t.placement)},a=t.maxSpendUsd?Number(t.maxSpendUsd):void 0,o=I(`Creating fleet...`);o.start();let s=Date.now(),c=await r.fleets.create({fleetId:t.fleetId,agents:n,placement:i,defaults:{...t.environment?{environment:t.environment}:{},...t.memory?{resources:{memoryMB:Number(t.memory)}}:{},...t.model?{backend:{type:`opencode`,model:{model:t.model}}}:{}},...a===void 0?{}:{budgetUsd:a},...t.parentFleet?{parent:{fleetId:t.parentFleet,agentId:t.parentAgent}}:{}}),l=Date.now()-s;o.stop(),t.json||P(`Fleet ${c.fleetId}: ${c.agents.length} agents on ${c.machines.size} sandboxes in ${l} ms`);let u=[],d;try{for await(let n of c.run(e,{timeoutMs:t.timeout?Number(t.timeout):void 0})){if(n.type===`agent.finished`&&!t.json){let e=n.result;console.log(`[${e.agentId}] ${e.harness??`default`}/${e.model??`default`} ${e.status} ${e.durationMs}ms ${e.costUsd===void 0?`no cost reported`:`$${e.costUsd.toFixed(5)}`} ${e.result?.response??e.error??``}`)}n.type===`fleet.finished`&&(u=n.results,d=n.spend)}}finally{t.keep||await c.delete({continueOnError:!0})}t.json?N({fleetId:c.fleetId,createMs:l,sandboxes:c.machines.size,results:u,spend:d,deleted:!t.keep}):L({fleetId:c.fleetId,completed:u.filter(e=>e.status===`completed`).length,agents:u.length,spend:JSON.stringify(d),deleted:!t.keep}),u.some(e=>e.status!==`completed`)&&(process.exitCode=1)}),e.command(`cancel <fleet-id>`).description(`Interrupt every agent of a fleet and cancel its child fleets; sandboxes keep running`).action(async(e,t)=>{let{client:n}=W(t),r=await(await n.fleets.list({fleetId:e})).cancel();t.json?N({fleetId:e,...r}):P(`Fleet ${e}: interrupted ${r.interrupted} agents, cancelled ${r.children} child fleets`)})}const ss=[`list`,`create`,`delete`,`exec`,`prompt`,`read`,`write`];function cs(e){if(!(!e||e.length===0)){for(let t of e)if(!ss.includes(t))throw Error(`Invalid token action '${t}'. Allowed: ${ss.join(`, `)}`);return e}}function ls(e){return e.length<=12?`****`:`${e.slice(0,6)}...${e.slice(-4)} (masked — use --json for full value)`}function us(e){e.command(`token <fleet-id>`).description(`Mint a scoped fleet bearer token (treated as a secret)`).option(`--action <a...>`,`Allowed actions: list create delete exec prompt read write (prompt grants nothing since fleet prompt dispatch was removed)`).option(`--ttl-minutes <n>`,`Token lifetime in minutes`).action(async(e,t)=>{let{client:n}=W(t),r=I(`Minting fleet token...`);r.start();let i=await n.fleets.createToken(e,{actions:cs(t.action),ttlMinutes:t.ttlMinutes?Number(t.ttlMinutes):void 0});r.stop(),t.json?N(i):(L({"Fleet ID":i.fleetId,Token:ls(i.token),"Expires at":new Date(i.expiresAt).toISOString(),Actions:i.actions.join(`, `)}),console.log(`
|
|
146
|
-
Re-run with --json to print the full token value.`))})}function
|
|
147
|
-
`)[0]} (${e.author}, ${e.date.toLocaleDateString()})`)}),e.command(`diff`).description(`Show diff`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--ref <ref>`,`Ref to diff against`).action(async(e,t)=>{let{context:n,client:r}=
|
|
148
|
-
`)};e||(process.once(`SIGINT`,a),process.once(`SIGTERM`,a));try{return i.throwIfAborted(),await t(i)}catch(e){if(!i.aborted||e instanceof R&&e.code===`RUN_STOPPED`)throw e;let t=new R(`RUN_STOPPED`,`Command interrupted`,`A stop request ended this execution`,n);throw e instanceof Error&&`runId`in e&&typeof e.runId==`string`&&Object.assign(t,{runId:e.runId}),t}finally{e||(process.off(`SIGINT`,a),process.off(`SIGTERM`,a))}}const
|
|
140
|
+
`)?`${e}\n`:`${e}\n\n`}function mo(){let e=process.env.SHELL??``;return e.includes(`zsh`)?D(O(),`.zshrc`):e.includes(`bash`)?D(O(),`.bashrc`):D(O(),`.zshrc`)}function ho(e){if(e===`shell`||e===`env`||e===`dockerfile`)return e;throw Error(`--format must be one of: shell, env, dockerfile (got '${e}')`)}function go(e){if(e===`full`||e===`prompts`||e===`metadata`)return e;throw Error(`--content must be one of: full, prompts, metadata (got '${e}')`)}async function _o(e){let t=lo({endpoint:e.endpoint,apiKey:e.apiKey,projectKey:e.projectKey,content:e.content,format:e.format});if(console.log(t),e.format!==`shell`){console.log(),F(e.format===`env`?"Cron/container path: feed these to your service env (.env, `docker run --env-file`, k8s envFrom). No shell-rc edit, no TTY needed.":`Dockerfile path: paste these ENV lines into your image. No shell-rc edit, no TTY needed.`);return}if(console.log(),F(`Privacy tiers: --content full ships the whole conversation; --content prompts keeps task, prompts, and tool args only; --content metadata turns content off (telemetry still flows). Secrets are scrubbed server-side regardless.`),!e.write)return;let n=e.rcPath??mo(),r=process.stdin.isTTY?await Xr(`Append this idempotent block to ${n}? (y/N)`,`n`):`n`;if(r.toLowerCase()!==`y`&&r.toLowerCase()!==`yes`){console.log(),F(`Not writing. To append later: tangle connect claude-code --rc ${n}`);return}let i=uo({endpoint:e.endpoint,apiKey:e.apiKey,projectKey:e.projectKey,content:e.content,format:e.format}),{contents:a,changed:o}=fo(no(n),i);if(!o){console.log(),P(`Already present in ${n} — nothing to change.`);return}ro(n,a),console.log(),P(`Wrote Tangle Intelligence env block to ${n}.`),F(`Reload your shell (e.g. 'source ${n}') before running the agent.`)}function vo(e){let t=[],n={header:null,body:[]};for(let r of e.split(`
|
|
141
|
+
`))yo(r)?(t.push(n),n={header:r.trim(),body:[]}):n.body.push(r);return t.push(n),t.length>1&&t[0].header===null&&t[0].body.every(e=>e.trim()===``)&&t.shift(),t}function yo(e){let t=e.trim();return t.startsWith(`[`)&&t.endsWith(`]`)&&!t.includes(`=`)||t.startsWith(`[[`)&&t.endsWith(`]]`)}function bo(e){let t=[];for(let n of e)n.header!==null&&t.push(n.header),t.push(...n.body);return t.join(`
|
|
142
|
+
`)}function xo(e){return[{key:`environment`,line:`environment = "prod"`},{key:`log_user_prompt`,line:`log_user_prompt = true`},{key:`exporter`,line:`exporter = { otlp-http = { endpoint = "${ga(e.endpoint)}/v1/logs", protocol = "json", headers = { "Authorization" = "Bearer ${e.apiKey??"${TANGLE_API_KEY}"}" } } }`}]}function So(e){let t=e.trim();if(t===``||t.startsWith(`#`))return null;let n=t.indexOf(`=`);if(n===-1)return null;let r=t.slice(0,n).trim();return/^[A-Za-z0-9_-]+$/.test(r)?r:null}function Co(e,t){let n=xo(t),r=new Set(n.map(e=>e.key));if(e.trim()===``)return{contents:`${[`[otel]`,...n.map(e=>e.line)].join(`
|
|
143
|
+
`)}\n`,changed:!0};let i=vo(e),a=i.find(e=>e.header===`[otel]`);if(!a){let t={header:`[otel]`,body:n.map(e=>e.line)},r=i[i.length-1];r&&!wo(r)&&r.body.push(``),i.push(t);let a=To(bo(i));return{contents:a,changed:a!==To(e)}}let o=a.body.filter(e=>{let t=So(e);return t===null||!r.has(t)}),s=[];for(;o.length>0&&o[o.length-1].trim()===``;)s.unshift(o.pop());a.body=[...o,...n.map(e=>e.line),...s];let c=To(bo(i));return{contents:c,changed:c!==To(e)}}function wo(e){return e.body.length>0&&e.body[e.body.length-1].trim()===``}function To(e){return e.endsWith(`
|
|
144
|
+
`)?e:`${e}\n`}function Eo(e){let t=D(O(),`.codex`,`config.toml`),{contents:n,changed:r}=Co(no(t),{endpoint:e.endpoint,apiKey:e.apiKey});if(!e.write){console.log(n.trimEnd());return}if(!r){P(`${t} already has the Tangle [otel] block — nothing to change.`);return}ro(t,n),P(`Merged the Tangle [otel] block into ${t}.`),F("Codex emits content on the logs signal (codex.* events). Set TANGLE_API_KEY in your env before running if you kept the ${TANGLE_API_KEY} reference."),F(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=${e.projectKey??`<your project>`} before running codex.`)}function Do(e){switch(e){case`claude-code`:return`Claude Code: set OTEL_LOGS_EXPORTER=otlp and the four OTEL_LOG_* gates (OTEL_LOG_USER_PROMPTS, OTEL_LOG_TOOL_DETAILS, OTEL_LOG_TOOL_CONTENT, OTEL_LOG_RAW_API_BODIES).`;case`codex`:return`Codex: set log_user_prompt = true in [otel] (default false redacts content).`;case`opencode`:return`OpenCode: a standalone install emits nothing without the tangle-opencode-exporter shim; inside a Tangle sandbox it is already instrumented.`;case`openclaw`:case`hermes`:case`nanoclaw`:return`${eo[e]}: no native OTLP exporter and no standalone server to subscribe to — run it inside a Tangle sandbox, where the sidecar adapter exports its content with gen_ai.system=${e}. A bare standalone install emits metadata only.`}}async function Oo(e){let t=Date.now()+e.timeoutSeconds*1e3,n=3e3,r=Math.min(e.timeoutSeconds*1e3,1e4),i=I(`Checking whether content is flowing…`);i.start();let a;try{for(;;){try{a=await ha({endpoint:e.endpoint,apiKey:e.apiKey,timeoutMs:r})}catch(e){if(Date.now()>=t)throw e;await Ao(n);continue}if(a.contentSeen||Date.now()>=t)break;await Ao(n)}}finally{i.stop()}if(!a)throw Error(`onboarding status check returned no result`);ko(a,e.agent),a.contentSeen||(process.exitCode=1)}function ko(e,t){if(e.contentSeen){P(`Content flowing — Tangle Intelligence can analyze this feed.`),L({"Last seen":e.lastSeenAt??`just now`,Window:`${e.windowDays}d`});return}if(e.tracesSeen){jt(`Metadata-only — traces are arriving but carry no content. You missed a content gate.`);let n=t?[t]:Object.keys(e.byAgent).filter(to),r=n.length>0?n:$a;for(let n of r){let r=e.byAgent[n];(t||!r||r.tracesSeen&&!r.contentSeen)&&F(Do(n))}return}jt(`No traces yet for your tenant. Run your agent once on a real task, then re-run --verify.`),t&&F(Do(t))}function Ao(e){return new Promise(t=>setTimeout(t,e))}function jo(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??$n(void 0);if(!t)throw Error(`No Tangle API key found. Pass --api-key, set TANGLE_API_KEY, or run: tangle auth login`);return t}function Mo(){return new b(`connect`).description(`Connect a local coding agent's telemetry to Tangle Intelligence, content on (for SDK integration snippets, see 'tangle agent connect')`).argument(`[agent]`,`claude-code | codex | opencode | openclaw | hermes | nanoclaw`).option(`--endpoint <url>`,`OTLP endpoint base`,ea).option(`-p, --project <key>`,`Project label (tangle.subject.key) to group runs; omit to set it yourself`).option(`--rc <path>`,`Shell rc file to append the Claude Code env block to`).option(`--no-write`,`Print the config instead of writing files (Claude Code / Codex)`).option(`--inline-key`,"Embed the resolved API key literally in the config (default: keep ${TANGLE_API_KEY})").option(`--verify`,`Poll onboarding status and report whether CONTENT is flowing`).option(`--timeout <seconds>`,`Verify poll timeout in seconds`,`120`).option(`--run`,`OpenCode only: run the content exporter against a live OpenCode server until interrupted`).option(`--opencode-url <url>`,`OpenCode server base URL for --run (or set OPENCODE_BASE_URL)`).option(`--format <kind>`,`Claude Code output: shell (export block) | env (.env / docker --env-file) | dockerfile (ENV lines). env/dockerfile are the cron/container path — printed to stdout, no shell-rc edit, no TTY`,`shell`).option(`--content <tier>`,`Claude Code content tier: full (everything) | prompts (task+prompts+tool-args) | metadata (telemetry on, content off)`,`full`).action(async(e,t)=>{let n=ga(t.endpoint);if(t.run){if((e?Po(e):`opencode`)!==`opencode`)throw Error(`--run is OpenCode-only: it runs the content exporter against a live OpenCode server. Other agents export natively once configured.`);await Ro({endpoint:n,apiKey:jo(t.apiKey),opencodeUrl:t.opencodeUrl});return}if(t.verify){await Oo({endpoint:n,apiKey:jo(t.apiKey),agent:e?Po(e):void 0,timeoutSeconds:Qa(t.timeout,`--timeout`)});return}let r=e?Po(e):await Fo(),i=t.inlineKey?jo(t.apiKey):void 0;r===`claude-code`?await _o({endpoint:n,apiKey:i,projectKey:t.project,rcPath:t.rc,write:t.write!==!1,content:go(t.content),format:ho(t.format)}):r===`codex`?Eo({endpoint:n,apiKey:i,projectKey:t.project,write:t.write!==!1}):r===`opencode`?Io({endpoint:n}):Lo(r,{endpoint:n}),console.log(),F(`Run your agent on a real task, then verify content is flowing: tangle connect ${r} --verify`)})}function No(){return new b(`opencode-exporter`).description(`Export a running OpenCode's content to Tangle Intelligence (standalone shim)`).option(`--endpoint <url>`,`OTLP endpoint base`,ea).option(`--opencode-url <url>`,`OpenCode server base URL (or set OPENCODE_BASE_URL)`).action(async e=>{await Ro({endpoint:ga(e.endpoint),apiKey:jo(e.apiKey),opencodeUrl:e.opencodeUrl})})}function Po(e){if(to(e))return e;throw Error(`Unknown agent '${e}'. Choose one of: ${$a.join(`, `)}`)}async function Fo(){if(!process.stdin.isTTY)throw Error(`Specify an agent: tangle connect <${$a.join(`|`)}>`);console.log(`Which coding agent are you connecting?`),$a.forEach((e,t)=>{console.log(` ${t+1}) ${eo[e]} (${e})`)});let e=await Xr(`Enter a number or name`,`1`);return $a[Number.parseInt(e,10)-1]||Po(e.trim())}function Io(e){let t=ga(e.endpoint);jt(`OpenCode has no native OTel exporter, so a standalone install emits nothing without a shim.`),console.log(),L({"Inside a Tangle sandbox":`already instrumented — our adapter exports OpenCode's event-stream content. Nothing to do.`,Standalone:`run 'tangle connect opencode --run' alongside a running OpenCode, exporting to ${t}.`}),console.log(),F(`Start OpenCode in server mode ('opencode serve'), then in another terminal run: tangle connect opencode --run`),F(`The exporter subscribes to OpenCode's SSE event bus and exports content-bearing OTLP (prompt/completion/tool content) to Tangle. Verify with: tangle connect opencode --verify`),F(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=my-project before starting the exporter.`)}function Lo(e,t){let n=ga(t.endpoint),r=eo[e];jt(`${r} has no native OTel exporter, so a standalone install emits nothing without instrumentation.`),console.log(),L({"Inside a Tangle sandbox":`already instrumented — the sidecar adapter exports ${r}'s prompt/completion/tool content (gen_ai.system=${e}) to ${n}. Nothing to do.`,Standalone:`${r} exposes no OTLP and no event-bus server; run it inside a Tangle sandbox to capture content.`}),console.log(),F(`Label this project so Tangle rolls up + automates per-project: export OTEL_RESOURCE_ATTRIBUTES=tangle.subject.key=my-project before starting ${r}.`),F(`Verify content is flowing: tangle connect ${e} --verify`)}async function Ro(e){let t=qa(e.opencodeUrl),n=new AbortController,r=()=>n.abort();process.on(`SIGINT`,r),process.on(`SIGTERM`,r),F(`Subscribing to OpenCode at ${t} — exporting content to Tangle.`),F(`Run OpenCode tasks now. Press Ctrl-C to stop.`),console.log();let i=0,a;try{a=await Za({endpoint:e.endpoint,apiKey:e.apiKey,opencodeBaseUrl:t,signal:n.signal,onExport:({eventType:e,records:t})=>{i+=t,F(`exported ${t} record(s) from ${e} (total ${i})`)}})}catch(e){if(e instanceof Ya){let{recordsExported:t,contentEventsExported:n}=e.partial;console.log(),jt(`Exporter failed after exporting ${t} content record(s) from ${n} event(s): ${e.message}`)}throw e}finally{process.off(`SIGINT`,r),process.off(`SIGTERM`,r)}if(console.log(),a.contentEventsExported===0){jt(`Saw ${a.eventsSeen} event(s) but none carried content. Run a real OpenCode task (a prompt that produces text or a tool call), then re-run.`);return}P(`Exported ${a.recordsExported} content record(s) from ${a.contentEventsExported} event(s).`),F(`Verify it landed: tangle connect opencode --verify`)}function zo(){let e=new b(`environments`).alias(`env`).description(`Manage sandbox environments`);return e.command(`list`).alias(`ls`).description(`List available environments`).action(async e=>{let{client:t}=U(e),n=I(`Fetching environments...`);e.json||n.start();let r=await t.environments.list();n.stop(),e.json?N(r):r.length===0?console.log(`No environments found`):It([`ID`,`Description`,`Version`],r.map(e=>[e.id,e.description??``,e.version]))}),e.command(`get`).description(`Get environment details`).argument(`<id>`,`Environment ID`).action(async(e,t)=>{let{client:n}=U(t),r=I(`Fetching environment...`);t.json||r.start();let i=await n.environments.get(e);if(r.stop(),!i){console.error(`Environment not found: ${e}`),process.exit(1);return}t.json?N(i):(console.log(`ID: ${i.id}`),console.log(`Description: ${i.description??`-`}`),console.log(`Version: ${i.version}`),i.base&&console.log(`Base: ${i.base}`))}),e}function Bo(e){let t=e.memory?Ko(e.memory,`--accelerator-memory`):void 0;return{kind:Jo(e.kind),count:e.count?Ko(e.count,`--accelerator-count`):1,...t===void 0?{}:{memoryMB:t}}}function Vo(e,t,n){let r=!!(e.provider||e.image||e.env||e.maxSpendUsd||e.maxLifetime||e.idleTimeout);if(!t&&r)throw Error(n);if(t){if(!e.maxSpendUsd||!e.maxLifetime)throw Error(`--accelerator-kind requires --gpu-max-spend-usd and --gpu-max-lifetime`);return{...e.provider?{provider:qo(e.provider,`--gpu-provider`)}:{},...e.image?{image:e.image}:{},...e.env?{env:Go(e.env,`--gpu-env`,`GPU env`)}:{},maxSpendUsd:Yo(e.maxSpendUsd,`--gpu-max-spend-usd`),maxLifetimeSeconds:Ko(e.maxLifetime,`--gpu-max-lifetime`),...e.idleTimeout?{idleTimeoutSeconds:Ko(e.idleTimeout,`--gpu-idle-timeout`)}:{}}}}function Ho(e){return{...e.provider?{provider:qo(e.provider,`GPU provider`)}:{},accelerator:Bo({kind:e.acceleratorKind,count:e.acceleratorCount,memory:e.acceleratorMemory}),...e.image?{image:e.image}:{},...e.env?{env:Go(e.env,`--env`,`env`)}:{},maxSpendUsd:Yo(e.maxSpendUsd,`--max-spend-usd`),maxLifetimeSeconds:Ko(e.maxLifetime,`--max-lifetime`),...e.idleTimeout?{idleTimeoutSeconds:Ko(e.idleTimeout,`--idle-timeout`)}:{}}}function Uo(e){return e.length===1?e[0]:e.map(Ve).join(` `)}function Wo(e){return{timeoutMs:e.timeout?Ko(String(e.timeout),`--timeout`):void 0,env:e.env?Go(e.env,`--env`,`env`):void 0}}function Go(e,t,n){let r={};for(let i of e){let[e,...a]=i.split(`=`);if(!e||a.length===0)throw Error(`${t} expects ${n} values in KEY=VALUE format`);r[e]=a.join(`=`)}return r}function Ko(e,t){if(!/^\d+$/.test(e))throw Error(`${t} must be a positive integer`);let n=Number.parseInt(e,10);if(Number.isNaN(n)||n<1)throw Error(`${t} must be a positive integer`);return n}function qo(e,t){if(i.includes(e))return e;throw Error(`${t} must be one of ${i.join(`, `)}`)}function Jo(e){let t=e.trim().toLowerCase();if(/^[a-z0-9][a-z0-9._-]*$/.test(t))return t;throw Error(`--accelerator-kind must contain only letters, numbers, dots, underscores, or hyphens`)}function Yo(e,t){if(!/^(?:\d+|\d+\.\d+|\.\d+)$/.test(e))throw Error(`${t} must be a positive number`);let n=Number.parseFloat(e);if(!Number.isFinite(n)||n<=0)throw Error(`${t} must be a positive number`);return n}function Xo(){return new b(`exec`).description(`Execute a command in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command...>`,`Command and arguments, or one shell script`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`,`60000`).allowUnknownOption(!0).action(async(e,t,n)=>{try{let{context:r,client:i}=U(n),a=Uo(t),o=Go(n.env??[],`--env`,`env`),s=I(`Executing: ${a}`);n.json||s.start();let c=await G(i,r,e);c=await K(c);let l=await c.exec(a,{cwd:n.cwd,env:Object.keys(o).length>0?o:void 0,timeoutMs:Number.parseInt(n.timeout,10)});s.stop(),n.json?N(l):(l.stdout&&process.stdout.write(l.stdout),l.stderr&&process.stderr.write(l.stderr)),l.exitCode!==0&&(process.exitCode=l.exitCode)}catch(e){if(e instanceof a){let t=`Exec transport lost before command status was confirmed. Remote command status is unknown. Original error: ${e.message}. For long-running commands, use \`tangle process spawn\`, \`tangle process logs\`, and \`tangle process kill --tree\`.`;return B(Error(t,{cause:e}))}B(e)}})}function Zo(e){e.command(`capabilities`).description(`List fleet drivers and their supported features`).action(async e=>{let{client:t}=U(e),n=I(`Fetching capabilities...`);n.start();let r=await t.fleets.capabilities();n.stop(),e.json?N(r):M(r.drivers,[{key:`driverType`,header:`Driver`,width:16},{key:`sharedWorkspace`,header:`Shared WS`,width:12},{key:`accelerators`,header:`Accel`,width:8},{key:`queueTimings`,header:`Queue`,width:8}])}),e.command(`usage <fleet-id>`).description(`Show fleet usage and reliability insights`).action(async(e,t)=>{let{client:n}=U(t),r=I(`Fetching usage...`);r.start();let i=await n.fleets.usage(e);if(r.stop(),t.json)N(i);else if(L({"Fleet ID":i.usage.fleetId,Status:i.usage.status,Machines:i.usage.machineCount,Running:i.usage.runningMachines,Failed:i.usage.failedMachines,"Runtime (ms)":i.usage.meteredUsage?.runtimeMs,"Reliability score":i.insights.reliabilityScore,"Failure rate":i.insights.failureRate}),i.insights.recommendedActions.length>0){console.log(`
|
|
145
|
+
Recommended actions:`);for(let e of i.insights.recommendedActions)console.log(` - ${e}`)}}),e.command(`cost <fleet-id>`).description(`Show the fleet's cost estimate`).action(async(e,t)=>{let{client:n}=U(t),r=I(`Estimating cost...`);r.start();let i=await n.fleets.cost(e);r.stop(),t.json?N(i):L({Plan:i.plan,Currency:i.currency,"Hourly (USD)":i.hourlyUsd,"Max lifetime (s)":i.maxLifetimeSeconds,"Estimated max lifetime (USD)":i.estimatedMaxLifetimeUsd,Machines:i.requestedResources.machines,"Total CPU":i.requestedResources.totalCpu,"Total memory (MB)":i.requestedResources.totalMemoryMb})})}function Qo(e){return[...e.entries()].map(([e,t])=>({machineId:e,sandboxId:t.id,status:t.status}))}function $o(e){e.command(`list <fleet-id>`).description(`List the machines of one fleet (fleet id is required)`).option(`--status <status>`,`Filter machines by status`).action(async(e,t)=>{let{client:n}=U(t),r=I(`Fetching fleet...`);r.start();let i=await n.fleets.list({fleetId:e,status:t.status});r.stop();let a=Qo(i.machines);t.json?N({fleetId:i.fleetId,machines:a}):M(a,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}])}),e.command(`get <fleet-id>`).description(`Show one fleet's manifest (server record)`).action(async(e,t)=>{let{client:n}=U(t),r=I(`Fetching manifest...`);r.start();let i=await n.fleets.manifest(e);r.stop(),t.json?N(i):(L({"Fleet ID":i.fleetId??i.id,Machines:i.machines.length,"Workspace mode":i.workspace?.mode,"Workspace status":i.workspace?.status,"Max lifetime (s)":i.policy?.maxLifetimeSeconds,"Max spend (USD)":i.policy?.maxSpendUsd,Created:i.createdAt,Updated:i.updatedAt}),M(i.machines,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`role`,header:`Role`,width:14},{key:`status`,header:`Status`,width:14}]))}),e.command(`delete <fleet-id>`).description(`Delete a fleet's machine sandboxes and its record`).option(`--continue-on-error`,`Keep deleting remaining machines if one delete fails`).action(async(e,t)=>{let{client:n}=U(t),r=I(`Deleting fleet...`);r.start(),await n.fleets.delete(e,{continueOnError:t.continueOnError}),r.stop(),t.json?N({success:!0,fleetId:e}):P(`Fleet deleted: ${e}`)}),e.command(`reap`).description(`TTL cleanup of all expired fleets (fleet-wide)`).option(`--dry-run`,`Report what would be reaped without deleting`).action(async e=>{let{client:t}=U(e),n=I(`Reaping expired fleets...`);n.start();let r=await t.fleets.reapExpired({dryRun:e.dryRun});n.stop(),e.json?N(r):(L({"Dry run":r.dryRun,Expired:r.expired,Deleted:r.deleted}),M(r.fleets,[{key:`fleetId`,header:`Fleet`,width:24},{key:`expiredAt`,header:`Expired`,width:18},{key:`deleted`,header:`Deleted`,width:10}]))}),e.command(`reconcile`).description(`Drop fleet records whose underlying sandboxes vanished`).option(`--dry-run`,`Report orphans without removing them`).action(async e=>{let{client:t}=U(e),n=I(`Reconciling fleets...`);n.start();let r=await t.fleets.reconcile({dryRun:e.dryRun});n.stop(),e.json?N(r):(L({"Dry run":r.dryRun,Checked:r.checked,Orphaned:r.orphaned,Removed:r.removed}),M(r.machines,[{key:`fleetId`,header:`Fleet`,width:24},{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`removed`,header:`Removed`,width:10}]))})}function es(e){if(e.spec){let t=JSON.parse(fe(e.spec,`utf8`));return{base:{fleetId:e.fleetId,defaults:t.defaults,policy:t.policy,workspace:t.workspace,metadata:t.metadata},machines:t.machines??[]}}let t=rs(e),n=is(e,!!t?.accelerator),r={...e.environment?{environment:e.environment}:{},...t?{resources:t}:{},...e.driver?{driver:{type:e.driver}}:{},...n?{gpuLease:n}:{},...e.backend?{backend:{type:e.backend}}:{}},i=as(e),a=Math.max(1,Number(e.count)||1),o=Array.from({length:a},(e,t)=>({machineId:`worker-${t+1}`}));return{base:{fleetId:e.fleetId,defaults:Object.keys(r).length>0?r:void 0,policy:i,workspace:{mode:e.workspace}},machines:o}}function ts(e){let{base:t,machines:n}=es(e);return{...t,machines:n}}function ns(e){let{base:t,machines:n}=es(e);return{...t,workers:n}}function rs(e){let t={};if(e.cpu&&(t.cpuCores=Number(e.cpu)),e.memory&&(t.memoryMB=Number(e.memory)),e.disk&&(t.diskGB=Number(e.disk)),e.acceleratorKind)t.accelerator=Bo({kind:e.acceleratorKind,count:e.acceleratorCount,memory:e.acceleratorMemory});else if(e.acceleratorCount||e.acceleratorMemory)throw Error(`--accelerator-count and --accelerator-memory require --accelerator-kind`);return Object.keys(t).length>0?t:void 0}function is(e,t){return Vo({provider:e.gpuProvider,image:e.gpuWorkerImage,env:e.gpuEnv,maxSpendUsd:e.gpuMaxSpendUsd,maxLifetime:e.gpuMaxLifetime,idleTimeout:e.gpuIdleTimeout},t,`Fleet GPU lease flags require --accelerator-kind`)}function as(e){let t={};return e.maxSpendUsd&&(t.maxSpendUsd=Number(e.maxSpendUsd)),e.maxLifetime&&(t.maxLifetimeSeconds=Number(e.maxLifetime)),Object.keys(t).length>0?t:void 0}function os(e){e.command(`create`).description(`Create a sandbox fleet`).option(`--fleet-id <id>`,`Stable fleet id (generated when omitted)`).option(`--count <n>`,`Number of worker machines`,`1`).option(`--environment <environment>`,`Named environment, container image, or built image ID for each machine`).option(`--cpu <cores>`,`CPU cores per machine`).option(`--memory <mb>`,`Memory in MB per machine`).option(`--disk <gb>`,`Disk in GB per machine`).option(`--accelerator-kind <kind>`,`Accelerator kind per machine, for example nvidia-l4 or nvidia-h100`).option(`--accelerator-count <count>`,`Accelerator devices per machine`).option(`--accelerator-memory <mb>`,`Minimum accelerator memory in MB per machine`).option(`--gpu-provider <provider>`,`GPU cloud provider per machine; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for each GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum spend per machine GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum GPU lease lifetime per machine in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy each GPU lease after this many idle seconds`).option(`--driver <type>`,`Infrastructure driver type`).option(`--backend <id>`,`Agent backend type`).option(`--workspace <mode>`,`Workspace mode: isolated (no driver supports shared yet)`,`isolated`).option(`--max-spend-usd <n>`,`Fleet spend cap in USD (policy)`).option(`--max-lifetime <s>`,`Max machine lifetime in seconds (policy)`).option(`--spec <file.json>`,`Path to a JSON file describing the fleet (overrides synthesized machines)`).option(`--coordinator`,`Create a coordinator + workers fleet (routes to createWithCoordinator)`).action(async e=>{let{client:t}=U(e),n=I(`Creating fleet...`);n.start();let r=e.coordinator?await t.fleets.createWithCoordinator(ns(e)):await t.fleets.create(ts(e));n.stop();let i=Qo(r.machines);e.json?N({fleetId:r.fleetId,machines:i}):(P(`Fleet created: ${r.fleetId}`),M(i,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`status`,header:`Status`,width:14}]))})}function ss(e){e.command(`exec <fleet-id> <command>`).description(`Run a shell command across the fleet's machines`).option(`--machine <id...>`,`Restrict to a subset of machine ids (default: all)`).option(`--cwd <dir>`,`Working directory for the command`).option(`--timeout <ms>`,`Per-machine timeout in milliseconds`).option(`--max-concurrent <n>`,`Max concurrent dispatches`).action(async(e,t,n)=>{let{client:r}=U(n),i=I(`Dispatching command...`);i.start();let a=await(await r.fleets.list({fleetId:e})).dispatchExecDetailed(t,{machines:n.machine,cwd:n.cwd,timeoutMs:n.timeout?Number(n.timeout):void 0,maxConcurrent:n.maxConcurrent?Number(n.maxConcurrent):void 0});if(i.stop(),n.json)N(a);else{M(a.results.map(e=>({machineId:e.machineId,ok:e.ok,exitCode:e.result?.exitCode,durationMs:e.durationMs})),[{key:`machineId`,header:`Machine`,width:20},{key:`ok`,header:`OK`,width:6},{key:`exitCode`,header:`Exit`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14}]);for(let e of a.results){let t=e.result?.stdout,n=e.result?.stderr;t&&(console.log(`\n[${e.machineId}] stdout:`),console.log(t)),n&&(console.log(`\n[${e.machineId}] stderr:`),console.log(n)),e.error&&console.log(`\n[${e.machineId}] error: ${e.error.message}`)}}a.results.some(e=>e.ok===!1)&&(process.exitCode=1)}),e.command(`run [prompt]`).description(`Create a fleet of agents, run one turn on every agent, print each result, then delete the fleet`).requiredOption(`--agents <n|file>`,`Number of agents, or a JSON file with an array of agent specs (agentId, harness, model, profile or { profileId, revision }, task)`).option(`--placement <mode>`,`auto (pack by sandbox memory), dedicated (one sandbox per agent), or a number of agents per sandbox`,`auto`).option(`--model <id>`,`Model every agent runs, e.g. gpt-4.1-mini`).option(`--memory <mb>`,`Memory in MB per sandbox; auto placement packs by it`).option(`--environment <environment>`,`Environment for each sandbox`).option(`--max-spend-usd <usd>`,`Budget for the fleet in USD, enforced by the Platform on the fleet's own key`).option(`--timeout <ms>`,`Per-agent turn timeout in milliseconds`).option(`--fleet-id <id>`,`Stable fleet id (generated when omitted)`).option(`--parent-fleet <id>`,`Fleet that spawns this one; its cap must cover this cap`).option(`--parent-agent <id>`,`Agent of --parent-fleet that spawns this one`).option(`--keep`,`Keep the fleet after the run instead of deleting it`).action(async(e,t)=>{let n=/^\d+$/.test(t.agents)?Number(t.agents):JSON.parse(fe(t.agents,`utf8`));if(!Array.isArray(n)&&e===void 0)throw Error(`A prompt is required unless --agents names a file whose agents carry tasks`);let{client:r}=U(t);if(!!t.parentFleet!=!!t.parentAgent)throw Error(`--parent-fleet and --parent-agent go together`);let i=t.placement===`auto`||t.placement===`dedicated`?t.placement:{agentsPerSandbox:Number(t.placement)},a=t.maxSpendUsd?Number(t.maxSpendUsd):void 0,o=I(`Creating fleet...`);o.start();let s=Date.now(),c=await r.fleets.create({fleetId:t.fleetId,agents:n,placement:i,defaults:{...t.environment?{environment:t.environment}:{},...t.memory?{resources:{memoryMB:Number(t.memory)}}:{},...t.model?{backend:{type:`opencode`,model:{model:t.model}}}:{}},...a===void 0?{}:{budgetUsd:a},...t.parentFleet?{parent:{fleetId:t.parentFleet,agentId:t.parentAgent}}:{}}),l=Date.now()-s;o.stop(),t.json||P(`Fleet ${c.fleetId}: ${c.agents.length} agents on ${c.machines.size} sandboxes in ${l} ms`);let u=[],d;try{for await(let n of c.run(e,{timeoutMs:t.timeout?Number(t.timeout):void 0})){if(n.type===`agent.finished`&&!t.json){let e=n.result;console.log(`[${e.agentId}] ${e.harness??`default`}/${e.model??`default`} ${e.status} ${e.durationMs}ms ${e.costUsd===void 0?`no cost reported`:`$${e.costUsd.toFixed(5)}`} ${e.result?.response??e.error??``}`)}n.type===`fleet.finished`&&(u=n.results,d=n.spend)}}finally{t.keep||await c.delete({continueOnError:!0})}t.json?N({fleetId:c.fleetId,createMs:l,sandboxes:c.machines.size,results:u,spend:d,deleted:!t.keep}):L({fleetId:c.fleetId,completed:u.filter(e=>e.status===`completed`).length,agents:u.length,spend:JSON.stringify(d),deleted:!t.keep}),u.some(e=>e.status!==`completed`)&&(process.exitCode=1)}),e.command(`cancel <fleet-id>`).description(`Interrupt every agent of a fleet and cancel its child fleets; sandboxes keep running`).action(async(e,t)=>{let{client:n}=U(t),r=await(await n.fleets.list({fleetId:e})).cancel();t.json?N({fleetId:e,...r}):P(`Fleet ${e}: interrupted ${r.interrupted} agents, cancelled ${r.children} child fleets`)})}const cs=[`list`,`create`,`delete`,`exec`,`prompt`,`read`,`write`];function ls(e){if(!(!e||e.length===0)){for(let t of e)if(!cs.includes(t))throw Error(`Invalid token action '${t}'. Allowed: ${cs.join(`, `)}`);return e}}function us(e){return e.length<=12?`****`:`${e.slice(0,6)}...${e.slice(-4)} (masked — use --json for full value)`}function ds(e){e.command(`token <fleet-id>`).description(`Mint a scoped fleet bearer token (treated as a secret)`).option(`--action <a...>`,`Allowed actions: list create delete exec prompt read write (prompt grants nothing since fleet prompt dispatch was removed)`).option(`--ttl-minutes <n>`,`Token lifetime in minutes`).action(async(e,t)=>{let{client:n}=U(t),r=I(`Minting fleet token...`);r.start();let i=await n.fleets.createToken(e,{actions:ls(t.action),ttlMinutes:t.ttlMinutes?Number(t.ttlMinutes):void 0});r.stop(),t.json?N(i):(L({"Fleet ID":i.fleetId,Token:us(i.token),"Expires at":new Date(i.expiresAt).toISOString(),Actions:i.actions.join(`, `)}),console.log(`
|
|
146
|
+
Re-run with --json to print the full token value.`))})}function fs(){let e=new b(`workspace`).description(`Manage a fleet's shared workspace`);return e.command(`snapshot <fleet-id>`).description(`Snapshot the fleet's shared workspace`).action(async(e,t)=>{let{client:n}=U(t),r=I(`Creating workspace snapshot...`);r.start();let i=await n.fleets.createWorkspaceSnapshot(e);r.stop(),t.json?N(i):P(`Workspace snapshot created: ${i.snapshotId??i.id}`)}),e.command(`restore <fleet-id> <snapshot-id>`).description(`Restore the fleet's shared workspace from a snapshot`).action(async(e,t,n)=>{let{client:r}=U(n),i=I(`Restoring workspace...`);i.start();let a=await r.fleets.restoreWorkspaceSnapshot(e,t);i.stop(),n.json?N(a):P(`Workspace restored from ${a.snapshotId??t}`)}),e.command(`reconcile <fleet-id>`).description(`Re-mount the shared workspace on all fleet machines`).action(async(e,t)=>{let{client:n}=U(t),r=I(`Reconciling workspace...`);r.start();let i=await n.fleets.reconcileWorkspace(e);r.stop(),t.json?N(i):(L({"Fleet ID":i.fleetId,Checked:i.checked,"Orphaned mounts":i.orphanedMounts}),M(i.machines,[{key:`machineId`,header:`Machine`,width:20},{key:`sandboxId`,header:`Sandbox`,width:24},{key:`mounted`,header:`Mounted`,width:10}]))}),e}function ps(){let e=new b(`fleet`).description(`Manage sandbox fleets`);return os(e),$o(e),e.addCommand(fs()),ss(e),Zo(e),ds(e),e}function ms(){let e=new b(`fs`).description(`File system operations on sandboxes`);return e.command(`upload`).description(`Upload a file to a sandbox`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<local-path>`,`Local file path`).argument(`<remote-path>`,`Remote destination path`).action(async(e,t,n,r)=>{let{context:i,client:a}=U(r),o=await G(a,i,e);if(o=await K(o),!T.existsSync(t))throw Error(`Local file not found: ${t}`);let s=T.statSync(t),c=Date.now();r.json||console.error(`Uploading ${t} to ${n}...`),await o.fs.upload(t,n,{onProgress:e=>{if(r.json)return;let t=e.percentage.toFixed(1);process.stderr.write(`\rProgress: ${t}% (${e.bytesUploaded}/${e.totalBytes} bytes)`)}});let l=Date.now()-c;r.json||console.error(``),r.json?N({success:!0,localPath:t,remotePath:n,size:s.size,durationMs:l}):console.log(`✓ Uploaded ${s.size} bytes in ${l}ms`)}),e.command(`download`).description(`Download a file from a sandbox`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<remote-path>`,`Remote file path`).argument(`<local-path>`,`Local destination path`).action(async(e,t,n,r)=>{let{context:i,client:a}=U(r),o=await G(a,i,e);o=await K(o);let s=Date.now();r.json||console.error(`Downloading ${t} to ${n}...`),await o.fs.download(t,n,{onProgress:e=>{if(r.json)return;let t=e.percentage.toFixed(1);process.stderr.write(`\rProgress: ${t}% (${e.bytesDownloaded}/${e.totalBytes} bytes)`)}});let c=Date.now()-s,l=T.statSync(n);r.json||console.error(``),r.json?N({success:!0,remotePath:t,localPath:n,size:l.size,durationMs:c}):console.log(`✓ Downloaded ${l.size} bytes in ${c}ms`)}),e.command(`ls`).description(`List directory contents`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`[path]`,`Directory path`,`.`).option(`-l, --long`,`Show detailed information`).option(`-a, --all`,`Include hidden files`).action(async(e,t,n)=>{let{context:r,client:i}=U(n),a=await G(i,r,e);a=await K(a);let o=await a.fs.list(t,{all:n.all,long:n.long});if(n.json)N(o);else if(n.long)It([`Mode`,`Owner`,`Group`,`Size`,`Modified`,`Name`],o.map(e=>{let t=e.isDir?`d`:e.isSymlink?`l`:`-`,n=hs(e.permissions),r=e.isDir?`<DIR>`:gs(e.size),i=e.modTime.toLocaleDateString();return[t+n,e.owner,e.group,r,i,e.name]}));else{let e=o.map(e=>e.isDir?`${e.name}/`:e.name);console.log(e.join(` `))}}),e.command(`stat`).description(`Get file or directory information`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to file or directory`).action(async(e,t,n)=>{let{context:r,client:i}=U(n),a=await G(i,r,e);a=await K(a);let o=await a.fs.stat(t);n.json?N(o):(console.log(` File: ${o.name}`),console.log(` Path: ${o.path}`),console.log(` Size: ${gs(o.size)} (${o.size} bytes)`),console.log(` Type: ${o.isDir?`directory`:o.isSymlink?`symlink`:`file`}`),console.log(` Mode: ${hs(o.permissions)} (${o.permissions.toString(8)})`),console.log(` Owner: ${o.owner}`),console.log(` Group: ${o.group}`),console.log(` Modified: ${o.modTime.toISOString()}`),console.log(` Accessed: ${o.accessTime.toISOString()}`))}),e.command(`cat`).description(`Print file contents`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to file`).action(async(e,t,n)=>{let{context:r,client:i}=U(n),a=await G(i,r,e);a=await K(a);let o=await a.read(t);n.json?N({path:t,content:o}):console.log(o)}),e.command(`rm`).description(`Delete a file or directory`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to delete`).option(`-r, --recursive`,`Delete directories recursively`).action(async(e,t,n)=>{let{context:r,client:i}=U(n),a=await G(i,r,e);a=await K(a),await a.fs.delete(t,{recursive:n.recursive}),n.json?N({success:!0,path:t,deleted:!0}):console.log(`✓ Deleted: ${t}`)}),e.command(`mkdir`).description(`Create a directory`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Directory path to create`).option(`-p, --parents`,`Create parent directories as needed`).action(async(e,t,n)=>{let{context:r,client:i}=U(n),a=await G(i,r,e);a=await K(a),await a.fs.mkdir(t,{recursive:n.parents}),n.json?N({success:!0,path:t,created:!0}):console.log(`✓ Created: ${t}`)}),e.command(`exists`).description(`Check if a path exists`).argument(`<sandbox-id-or-name>`,`Sandbox ID or name`).argument(`<path>`,`Path to check`).action(async(e,t,n)=>{let{context:r,client:i}=U(n),a=await G(i,r,e);a=await K(a);let o=await a.fs.exists(t);n.json?N({path:t,exists:o}):(console.log(o?`exists`:`not found`),process.exit(+!o))}),e}function hs(e){let t=[`r`,`w`,`x`],n=``;for(let r=2;r>=0;r--){let i=r*3;for(let r=0;r<3;r++)n+=e>>i+(2-r)&1?t[r]:`-`}return n}function gs(e){let t=[`B`,`KB`,`MB`,`GB`,`TB`],n=e,r=0;for(;n>=1024&&r<t.length-1;)n/=1024,r++;return r===0?`${n}${t[r]}`:`${n.toFixed(1)}${t[r]}`}function _s(){let e=new b(`git`).description(`Git operations in a sandbox workspace`);return e.command(`status`).description(`Show git repository status`).argument(`<id-or-name>`,`Sandbox ID or name`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Fetching status...`);t.json||i.start();let a=await G(r,n,e);a=await K(a);let o=await a.git.status();if(i.stop(),t.json)N(o);else if(!o.isRepo)console.log(`No git repository in the sandbox workspace.`);else{if(console.log(`Branch: ${o.branch??`unknown`}`),console.log(`HEAD: ${o.head.slice(0,7)||`(no commits)`}`),console.log(`Dirty: ${o.isDirty?`yes`:`no`}`),o.ahead&&console.log(`Ahead: ${o.ahead}`),o.behind&&console.log(`Behind: ${o.behind}`),o.staged.length>0){console.log(`\nStaged (${o.staged.length}):`);for(let e of o.staged)console.log(` + ${e}`)}if(o.modified.length>0){console.log(`\nModified (${o.modified.length}):`);for(let e of o.modified)console.log(` M ${e}`)}if(o.untracked.length>0){console.log(`\nUntracked (${o.untracked.length}):`);for(let e of o.untracked)console.log(` ? ${e}`)}}}),e.command(`log`).description(`Show commit log`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`-n, --limit <count>`,`Max commits to show`,`10`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Fetching log...`);t.json||i.start();let a=await G(r,n,e);a=await K(a);let o=await a.git.log(Number.parseInt(t.limit,10));if(i.stop(),t.json)N(o);else if(o.length===0)console.log(`No commits found`);else for(let e of o)console.log(`${e.shortSha} ${e.message.split(`
|
|
147
|
+
`)[0]} (${e.author}, ${e.date.toLocaleDateString()})`)}),e.command(`diff`).description(`Show diff`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--ref <ref>`,`Ref to diff against`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Fetching diff...`);t.json||i.start();let a=await G(r,n,e);a=await K(a);let o=await a.git.diff(t.ref);i.stop(),t.json?N(o):o.raw?console.log(o.raw):console.log(`${o.additions} additions, ${o.deletions} deletions across ${o.files.length} files`)}),e.command(`add`).description(`Stage files`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<paths...>`,`Paths to stage`).action(async(e,t,n)=>{let{context:r,client:i}=U(n),a=await G(i,r,e);a=await K(a),await a.git.add(t),P(`Staged: ${t.join(`, `)}`)}),e.command(`commit`).description(`Create a commit`).argument(`<id-or-name>`,`Sandbox ID or name`).requiredOption(`-m, --message <msg>`,`Commit message`).option(`--amend`,`Amend the previous commit`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=await G(r,n,e);i=await K(i);let a=await i.git.commit(t.message,{amend:t.amend});t.json?N(a):P(`Committed: ${a.shortSha} ${a.message}`)}),e.command(`push`).description(`Push to remote`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--force`,`Force push`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Pushing...`);i.start();let a=await G(r,n,e);a=await K(a),await a.git.push({force:t.force}),i.stop(),P(`Pushed to remote`)}),e.command(`pull`).description(`Pull from remote`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--rebase`,`Rebase instead of merge`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Pulling...`);i.start();let a=await G(r,n,e);a=await K(a),await a.git.pull({rebase:t.rebase}),i.stop(),P(`Pulled from remote`)}),e.command(`branches`).description(`List branches`).argument(`<id-or-name>`,`Sandbox ID or name`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Fetching branches...`);t.json||i.start();let a=await G(r,n,e);a=await K(a);let o=await a.git.branches();i.stop(),t.json?N(o):o.length===0?console.log(`No branches found`):It([`Name`,`Current`,`Remote`],o.map(e=>[e.name,e.current?`* `:` `,e.upstream??`-`]))}),e.command(`checkout`).description(`Checkout a branch or ref`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<ref>`,`Branch name or ref`).option(`-b, --create`,`Create a new branch`).action(async(e,t,n)=>{let{context:r,client:i}=U(n),a=await G(i,r,e);a=await K(a),await a.git.checkout(t,{create:n.create}),P(`Checked out: ${t}${n.create?` (new)`:``}`)}),e}function vs(e,t=16){if(!Number.isInteger(t)||t<=0||t>64)throw TypeError(`stableHashHex: lengthHex must be in [1, 64] (got ${t})`);let n=typeof e==`string`?e:JSON.stringify(e,(e,t)=>{if(t&&typeof t==`object`&&!Array.isArray(t)){let e={},n=t;for(let t of Object.keys(n).sort())e[t]=n[t];return e}return t});return x(`sha256`).update(n).digest(`hex`).slice(0,t)}Object.freeze([`HS256`]),Object.freeze([`RS256`]);async function ys(e,t,n=`tangle --help`){let r=new AbortController,i=e??r.signal,a=()=>{r.abort(),process.stderr.write(`Stopping…
|
|
148
|
+
`)};e||(process.once(`SIGINT`,a),process.once(`SIGTERM`,a));try{return i.throwIfAborted(),await t(i)}catch(e){if(!i.aborted||e instanceof R&&e.code===`RUN_STOPPED`)throw e;let t=new R(`RUN_STOPPED`,`Command interrupted`,`A stop request ended this execution`,n);throw e instanceof Error&&`runId`in e&&typeof e.runId==`string`&&Object.assign(t,{runId:e.runId}),t}finally{e||(process.off(`SIGINT`,a),process.off(`SIGTERM`,a))}}const bs=j.string().regex(/^[a-f0-9]{64}$/),xs=j.strictObject({version:j.literal(1),runId:j.uuid(),file:j.string().refine(ve),cwd:j.string().refine(ve),sourceDigest:bs,graphDigest:bs,params:j.record(j.string(),j.unknown()),startedAt:j.iso.datetime(),seat:j.string().optional()});function J(e){throw new R(`GRAPH_RESUME_REFUSED`,`The graph run cannot be resumed`,e,`tangle graph run --help`)}async function Ss(e){j.uuid().safeParse(e).success||J(`Use a recorded graph run ID`);let t;try{let n=D(await Ke(D(O(),`.tangle`)),`runs`,e);await Ke(n)!==n&&J(`The run directory redirects elsewhere`),t=await We(D(n,`input.json`),le.O_RDONLY|le.O_NOFOLLOW),(await t.stat()).isFile()||J(`The run input is not a regular file`);let r=xs.parse(JSON.parse(await t.readFile(`utf8`)));return(r.runId!==e||await Ke(r.cwd)!==r.cwd)&&J(`The recorded run or workspace identity changed`),r}catch(e){if(e instanceof R)throw e;return J(`The private recorded run input is missing or invalid`)}finally{await t?.close()}}async function Cs(e,t){await qe(D(e,`input.json`),JSON.stringify(t),{flag:`wx`,mode:384,flush:!0})}function ws(e,t,n,r){e.sourceDigest!==n&&J(`The authored graph source changed`),t.cloud&&J(`A local run cannot move to cloud execution`),Object.entries(r).some(([t,n])=>!Object.hasOwn(e.params,t)||ae(n)!==ae(e.params[t]))&&J(`A recorded graph parameter changed`),t.seat!==void 0&&t.seat!==e.seat&&J(`The recorded graph seat override changed`)}const Ts=`claude,codex,kimi,opencode,gemini,pi`;function Es(e,t){let n;return async(r,{node:i,lastCandidate:a})=>{t.throwIfAborted();let o;try{o=r===void 0?void 0:se(r)}catch(e){throw e instanceof Error&&Object.assign(e,{node:i,seat:r,fixCommand:`tangle graph run --help`}),e}n??=Je({cwd:e,signal:t,config:Ye({...process.env,BRIDGE_BACKENDS:Ts,BRIDGE_SUBSCRIPTIONS_ONLY:`1`})});let s=await n;t.throwIfAborted();let c=e=>e.authentication?.status===`authenticated`&&e.authentication.authMode===`subscription`,l=o?.harness??s.find(e=>e.provider&&c(e))?.backend,u=s.filter(e=>e.backend===l),d=u.filter(c),f=o?u.find(e=>e.id===`${o.harness}/${o.model}`)??d.find(e=>e.provider===o.provider):d.find(e=>e.default)??d.find(e=>e.recommended)??d[0];if(!f||!c(f)){if(a===!1)return;let e=f?.authentication??u[0]?.authentication??(o?void 0:s.find(e=>e.authentication?.fix)?.authentication);throw Object.assign(new R(o?`SEAT_NOT_LOGGED_IN`:`SEAT_NONE_DETECTED`,`Node '${i}' has no available subscription${o?` for ${o.harness}`:``}`,e?`Selected provider: ${e.status} (${e.authMode})`:`No authenticated subscription route was detected`,e?.fix??`tangle graph run --help`),{node:i,seat:r})}let p=o?.harness??se(f.id).harness,m=o?.provider??f.provider,h=o?.model??f.id.slice(p.length+1);if(!m||!h)throw new R(`MODEL_PROVIDER_MISMATCH`,`Node '${i}' has an unresolved model provider`,`Bridge has no configured provider for ${r??p}`,`tangle graph run --help`);return{harness:p,provider:m,model:h,selector:{kind:`all-eligible`},...o?.reasoningEffort===void 0?{}:{reasoningEffort:o.reasoningEffort}}}}function Y(e){return Lr({signal:e.signal,...e.apiKey===void 0?{}:{apiKey:e.apiKey},...e.baseUrl===void 0?{}:{baseUrl:e.baseUrl}})}const Ds=j.object({version:j.literal(1),type:j.enum([`state`,`ack`,`error`,`event`]),requestId:j.string().optional(),operationId:j.string().optional(),command:j.string().optional(),code:j.string().optional(),message:j.string().optional(),result:j.unknown().optional()}).passthrough(),Os=j.object({state:j.object({runConfiguration:j.unknown()}),view:j.object({capabilities:j.record(j.string(),j.object({available:j.boolean(),reason:j.string().optional()}))})}),ks=j.object({status:j.enum([`completed`,`failed`,`cancelled`]),analysis:j.object({id:j.string().min(1)}).passthrough(),source:j.object({runtimeRun:j.unknown()}).passthrough()}).passthrough(),As=`TANGLE_GRAPH_ANALYSIS_SOURCE`;async function js(e,t,n){if(!e.startsWith(`wfrun_`)){let t=D(await Ke(D(O(),`.tangle`)),`runs`,e);if(await Ke(t)!==t)throw new R(`RUN_NOT_FOUND`,`The run directory redirects elsewhere`,`Use the recorded local run directory`,`tangle graph inspect --help`);return{source:`runtime:${e}@${t}`,env:{},schema:j.object({runId:j.literal(e),runDir:j.literal(t)})}}let r={signal:n,...t.apiKey===void 0?{}:{apiKey:t.apiKey},...t.baseUrl===void 0?{}:{baseUrl:t.baseUrl}},i=await Y(r),a=j.object({id:j.literal(e),workflowId:j.string(),revUsed:j.number().int(),execution:j.object({kind:j.literal(`graph`),sourceSha:j.string(),authoredGraphDigest:j.string(),graphDigest:j.string()}),runtime:j.object({snapshot:j.object({supervisors:j.tuple([j.object({id:j.string()})])})})}).parse(await i.workflows.getRun(e,{signal:n})),o=a.runtime.snapshot.supervisors[0];if(!o)throw new R(`BRAID_RPC_FAILED`,`The cloud run has no retained Runtime root`,`Wait for execution evidence before analysis`,`tangle graph inspect ${e}`);let s=await Nr(r);if(new URL(s.baseUrl.replace(/\/+$/,``)).href!==new URL(i.baseUrl.replace(/\/+$/,``)).href)throw new R(`AUTH_REQUIRED`,`The analysis source origin changed`,`Use the same authenticated platform origin`,`tangle auth status --json`);return{source:`runtime:${e}@${As}`,env:{[As]:JSON.stringify({url:`${s.baseUrl.replace(/\/+$/,``)}/v1/workflows/runs/${encodeURIComponent(e)}`,headers:{Authorization:`Bearer ${s.token}`}})},schema:j.object({runId:j.literal(e),remoteEndpointEnv:j.literal(As),checkpoint:j.object({workflowId:j.literal(a.workflowId),runtimeRunId:j.literal(o.id),revUsed:j.literal(a.revUsed),sourceSha:j.literal(a.execution.sourceSha),authoredGraphDigest:j.literal(a.execution.authoredGraphDigest),graphDigest:j.literal(a.execution.graphDigest)})})}}async function Ms(e,t){if(!e.startsWith(`wfrun_`)&&!j.uuid().safeParse(e).success)throw new R(`RUN_NOT_FOUND`,`Use a recorded graph run ID`,`The run identifier is invalid`,`tangle graph inspect --help`);if(!Number.isSafeInteger(t.timeout)||t.timeout<1)throw new R(`INVALID_TIMEOUT`,`Use a positive analysis timeout`,`The timeout must be an integer number of milliseconds`,`tangle graph analyze --help`);let n=t.profile;if(!n?.trim())throw new R(`USAGE_INVALID`,`Select the canonical analysis profile`,`Graph analysis requires an existing canonical AgentProfile reference`,`tangle graph analyze `+e+` --profile <name|path>`);let r=/^(?:\.\.?)[/\\]/.test(n)?be(process.cwd(),n):n;return ys(t.signal,async n=>{let i=await js(e,t,n),a=i.source;return Mc({signal:n,errorRunId:e},async n=>{let o=await n.bridge(),s=await Ue(D(n.runDir,`analysis-`)),c=D(s,`config.json`),l=D(s,`database.key`),u=D(s,`state.sqlite`),d=`connection-owned-graph-bridge`,f=new Date().toISOString();await qe(l,ne(32),{mode:384,flag:`wx`}),await qe(c,JSON.stringify({format:`braid-startup-config`,schemaVersion:2,profile:r,connectionId:d,connections:[{id:d,name:`Graph analysis`,kind:`cli-bridge`,endpoint:o.bridgeUrl,providerOptions:{transport:`local`},createdAt:f,updatedAt:f,lastHealth:{status:`unknown`}}]}),{mode:384,flag:`wx`});let p=n.signal,m=`op-${S()}`,h=`op-${S()}`,g=`${m}:initialize`,_=`${m}:analyze`,v=`${m}:shutdown`,ee={version:1,requestId:g,command:`initialize`,params:{workspace:n.cwd,subscribe:!1}},y={version:1,requestId:_,operationId:m,command:`analyze`,params:{source:a,recipe:`all`,budgetUsd:0,totalTimeoutMs:t.timeout}},te={version:1,requestId:v,operationId:h,command:`shutdown`,params:{mode:`wait`}},b,x,re,C,ie={transform:e=>{let t=Ds.parse(e);return t.type===`error`||t.type===`state`&&t.requestId===g||t.type===`ack`&&[_,v].includes(t.requestId??``)?t:null},onError:e=>{C??=e},onEvent:e=>{e.type===`error`&&(C??=new R(e.code??`BRAID_RPC_FAILED`,`Braid refused graph analysis`,e.message??`The RPC response omitted its cause`,`tangle graph analyze --help`)),e.requestId===g&&e.type===`state`&&(b??=e),e.requestId===_&&e.type===`ack`&&(x??=e),e.requestId===v&&e.type===`ack`&&(re??=e)}},w=await Be({command:process.env.BRAID_BIN??`braid`,args:[`rpc`,`--workspace`,n.cwd,`--config`,c,`--profile`,r,`--database-key-file`,l],cwd:n.cwd,env:{...i.env,BRAID_STATE_PATH:u,BRAID_CLI_BRIDGE_ENDPOINT:o.bridgeUrl,BRAID_CLI_BRIDGE_AUTH:o.bridgeBearer},timeoutMs:t.timeout,signal:p,ownProcessGroup:!0},ie,{stdin:[ee,...t.dryRun?[]:[y],te].map(e=>JSON.stringify(e)).join(`
|
|
149
149
|
`)+`
|
|
150
|
-
`});if(C)throw C;let ae=w.exit;if(!ae.success||!b||!re||re.operationId!==h||re.command!==`shutdown`)throw new R(`BRAID_RPC_FAILED`,`Braid graph analysis did not finish`,ae.spawnError??ae.timeoutDiagnostic??ae.stdinError??ae.processGroupError??ae.captureError??ae.terminateError??(w.stderr||`Exit ${ae.code}, signal ${ae.signal}; complete shutdown acknowledgement: ${!!re}`),`npm install --global @tangle-network/braid`);let oe=
|
|
150
|
+
`});if(C)throw C;let ae=w.exit;if(!ae.success||!b||!re||re.operationId!==h||re.command!==`shutdown`)throw new R(`BRAID_RPC_FAILED`,`Braid graph analysis did not finish`,ae.spawnError??ae.timeoutDiagnostic??ae.stdinError??ae.processGroupError??ae.captureError??ae.terminateError??(w.stderr||`Exit ${ae.code}, signal ${ae.signal}; complete shutdown acknowledgement: ${!!re}`),`npm install --global @tangle-network/braid`);let oe=Os.parse(b),se=oe.view.capabilities[`analysis.recipe`];if(t.dryRun)return{source:a,statePath:u,configuration:oe.state.runConfiguration,capability:se,requestedBudgetUsd:0};if(!x||x.operationId!==m||x.command!==`analyze`)throw Error(`Braid did not acknowledge this analysis operation`);let T=ks.parse(x.result);if(!i.schema.safeParse(T.source.runtimeRun).success)throw new R(`BRAID_RPC_FAILED`,`Braid returned analysis of another source`,`Its saved run or immutable checkpoint identity does not match this request`,`tangle graph inspect ${e}`);return{...T,statePath:u}})},`tangle graph analyze ${e}`)}function Ns(e){e.command(`analyze <run>`).description(`Analyze retained graph evidence through Braid`).addHelpText(`after`,`
|
|
151
151
|
Requires the Braid companion CLI: npm install --global @tangle-network/braid.
|
|
152
152
|
BRAID_BIN may select its installed executable. Select an existing canonical AgentProfile with --profile. Analysis uses the owned subscription-only Bridge.
|
|
153
|
-
`).requiredOption(`--profile <name|path>`,`Use a canonical analysis AgentProfile, distinct from the Tangle account profile`).option(`--dry-run`,`Inspect Braid's selected analysis configuration without dispatch`).option(`--timeout <ms>`,`Bound the analysis process in milliseconds`,Number,3e5).action(async(e,t)=>{let n=await js(e,t);N(n),`status`in n&&n.status!==`completed`&&(process.exitCode=1)})}function Z(e){throw new R(`GRAPH_INVALID`,`Graph creation failed`,e,`tangle graph new --help`)}function Ns(e){return typeof e==`string`&&/^[a-z0-9][a-z0-9-]{0,62}$/i.test(e)}const Ps={maxBarren:2,failures:`verbatim`,panel:`off`,bar:`on`,profile:{id:`graph-new-v1`,opening:`The graph has not passed its outside check.`,plan:`Repair the concrete diagnostics with write_graph, run the saved file and submit the actual evidence.`,rules:`Completion requires a successful host run and unchanged YAML. Retain working graph content when blocked.`,headings:{failures:`Failures`,protected:`Passing checks`,changed:`Changes`,findings:`Findings`,bar:`Acceptance`,plan:`Next`,rules:`Rules`}}};var Fs=class{owned;lastFailure;pending=Promise.resolve();revision=0;sealed=!1;constructor(e,t,n){this.directory=e,this.options=t,this.cwd=n}async digest(e=this.owned){e||Z(`No graph file was saved`);let t=await We(e.file,le.O_RDONLY|le.O_NOFOLLOW);try{let[n,r]=await Promise.all([t.stat(),e.handle.stat()]);return(!n.isFile()||n.dev!==r.dev||n.ino!==r.ino)&&Z(`The owned graph file was replaced`),Oc(await t.readFile())}finally{await t.close()}}enqueue(e){let t=++this.revision,n=this.pending.then(()=>e(t));return this.pending=n.then(()=>void 0,()=>void 0),n}check=()=>this.enqueue(async e=>{let t=this.owned;if(!t?.result)return!1;let{digest:n,result:r}=t,i=await this.digest(t),a=this.revision===e&&this.owned===t&&t.digest===n&&t.result===r&&i===n;return a&&(this.sealed=!0),a});receipt(){this.owned?.result||Z(`No successful graph run was recorded`);let{file:e,digest:t,result:n}=this.owned;return{file:e,digest:t,result:n}}invoke(e,t){return this.sealed&&Z(`The graph is accepted; submit its recorded successful run`),this.enqueue(()=>this.write(e,t)).catch(e=>(this.lastFailure=e,{ok:!1,diagnostic:qt(e)}))}async write(e,t){t.throwIfAborted(),this.lastFailure=void 0;let n=e;(!n||!Ns(n.name)||typeof n.source!=`string`||typeof n.run!=`boolean`||Object.keys(n).some(e=>![`name`,`source`,`run`].includes(e)))&&Z(`Expected only name, source and boolean run`),this.options.name!==void 0&&n.name!==this.options.name&&Z(`The graph name must match --name`),this.owned&&(this.owned.result=void 0);let r=D(this.directory,`${n.name}.yaml`);if(this.owned&&this.owned.file!==r&&Z(`This invocation owns one named graph file`),!this.owned)try{this.owned={file:r,handle:await We(r,le.O_RDWR|le.O_CREAT|le.O_EXCL|le.O_NOFOLLOW,384),digest:Oc(``)}}catch(e){throw e.code===`EEXIST`&&Z(`Graph already exists: ${r}; choose another --name`),e}let i=this.owned;await this.digest()!==i.digest&&Z(`The owned graph was changed`);let a=Buffer.from(n.source);for(let e=0;e<a.length;){let{bytesWritten:t}=await i.handle.write(a,e,a.length-e,e);if(!t)throw Error(`Graph file write made no progress`);e+=t}await i.handle.truncate(a.length),await i.handle.sync(),i.digest=Oc(a);let o={...this.options,param:[]},s={cwd:this.cwd,signal:t,source:n.source},c=await Nc(r,{...o,dryRun:!0},{...s,connectNeeds:!0});if(`graph`in c||Z(`No canonical graph was returned`),c.graph.deliverable.checkRef===`command`&&Z(`Host command checks need a jailed verifier node`),await this.digest()!==i.digest&&Z(`Graph changed during validation`),!n.run)return{file:r,graphDigest:c.graph.digest,validated:!0};let l=await Nc(r,o,{...s,graphDigest:c.graph.digest});return(!(`status`in l)||l.status!==`winner`||l.graphDigest!==c.graph.digest||await this.digest()!==i.digest)&&Z(`The graph must succeed with unchanged YAML`),i.result=l,this.receipt()}async close(){await this.pending,await this.owned?.handle.close()}};async function Is(e,t,n){let{runId:r,runDir:i,cwd:a,bridge:o,signal:s}=e,c=await o(),l=D(await Ke(D(O(),`.tangle`)),`graphs`);(kc(a,l)||kc(l,a))&&Z(`The graph store must be outside the agent workspace; choose another working directory`);try{await He(l,{mode:448})}catch(e){if(e.code!==`EEXIST`)throw e}await Ke(l)!==l&&Z(`The graph store redirects outside its canonical location`);let u=n.seat??V().seat,d=await Ts(a,s)(u,{node:`graph-designer`,cwd:a,signal:s,lastCandidate:!0});d||Z(`No authenticated native subscription is available`);let{graphDesignerProfile:f}=await import(`@tangle-network/agent-runtime/profiles`),{supervisePursuit:p}=await import(`@tangle-network/agent-runtime/durable`),m=f({profile:{name:`graph-designer`,harness:d.harness,model:{provider:d.provider,default:d.model,...d.reasoningEffort===void 0?{}:{reasoningEffort:d.reasoningEffort}},prompt:{instructions:[`You are the sole graph designer. Author a canonical YAML graph for the requested intent, then qualify and run it using write_graph. Its nodes are complete AgentProfiles with a real independent verifier and declarative route/data outside check. Command checks execute on the host and are refused here; put executable verification in the verifier node's normal native tools. Read the supplied skills and preserve the user's task and authority.`,`Call write_graph with name, complete YAML source and run:false to validate; repair its concrete diagnostics, then call it with the identical source and run:true. The graph schema and executor are owned by the installed loader. Supply defaults for parameters needed by the first run. Only a real successful host run of the unchanged saved file passes. Submit that evidence using submit_result; explain concrete blockers using report_blocked.`]},tools:{agent_runtime_coordination_write_graph:!0,agent_runtime_coordination_submit_result:!0,agent_runtime_coordination_read_continuation:!0,agent_runtime_coordination_report_blocked:!0}}}),h=w(m),g=new Fs(l,{...n,seat:u},a),_={maxIterations:6,maxTokens:3e4,deadlineMs:3e5};try{let e=await p(m,{intent:t,name:n.name},{pursuitId:r,runId:r,runDir:i,signal:s,backend:{...c,timeoutMs:_.deadlineMs},budget:_,maxDepth:0,coordination:{authentication:!0,requestTimeoutMs:_.deadlineMs},deliverable:{describe:`The saved graph succeeds with unchanged YAML`,check:g.check,checkState:g.check},continuation:Ps,resolveSupervisorTools:e=>e.runId!==r||e.nodeId!==r||e.depth!==0||e.identity.profileDigest!==h?[]:[{name:`write_graph`,description:`Save, validate and run this graph.`,inputSchema:{type:`object`,properties:{name:{type:`string`},source:{type:`string`},run:{type:`boolean`}},required:[`name`,`source`,`run`],additionalProperties:!1},handler:(t,n)=>((n.nodeId!==e.nodeId||n.ownerId!==e.ownerId||n.runId!==e.runId)&&Z(`Wrong graph tool owner`),g.invoke(t,n.signal))}]});if(e.result.kind===`no-winner`||!await g.check()){if(g.lastFailure)throw g.lastFailure;let t=e.result.kind===`no-winner`?e.result.error?.message??e.result.reason:`The graph file changed after its successful run`;throw Object.assign(new R(`GRAPH_DESIGN_FAILED`,`Graph design did not finish`,t,`tangle graph new --help`),{runId:r,node:`graph-designer`})}return g.receipt()}finally{await g.close()}}function Ls(e){e.command(`new <intent>`).description(`Design, validate and run one portable graph`).option(`--seat <seat>`,`Use harness/model@effort for the designer and graph`).option(`--name <name>`,`Save this graph name`).action(async(e,t)=>{process.env.BRIDGE_JAIL_RW_PATHS?.trim()&&Z(`Remove BRIDGE_JAIL_RW_PATHS before graph new; extra native write roots cannot contain its host store`),t.name!==void 0&&!Ns(t.name)&&Z(`Use letters, numbers and hyphens in --name`);let n=await jc({},n=>Is(n,e,t));t.json?N(n):F(`Created ${n.file} · run ${n.result.runId}`)})}async function Rs(e){if(!Qn(e.apiKey)){if(e.json||e.dryRun||!process.stdin.isTTY)return;await ki({baseUrl:e.sandboxBaseUrl,signal:e.signal})}return G(e)}async function zs(e,t,n){let r=rc(t.parameter),i=n??await Rs(t);if(!i)throw new R(`AUTH_REQUIRED`,`Hub authentication is required`,`No Tangle credential is configured`,`tangle auth login`);let a=await i.connections.start(e,{cli:!0,connectionParameters:r});return t.json?(N(ac(a)),a):(ic(a,t.browser===!1?!1:await bi(a.redirectUrl),t.wait),a)}async function Bs(e,t,n){let r=async()=>{n.signal?.throwIfAborted();let{connections:r}=await e.connections.list(),i=r.filter(e=>e.status===`active`&&e.providerId.toLowerCase()===t.trim().toLowerCase());return i.length?vr(i,t):void 0},i=await r();if(i||n.json||n.dryRun||!process.stdin.isTTY)return i;let a=await zs(t,{...n,wait:!0},e);for(;!i&&Date.now()<Date.parse(a.expiresAt);)await Me(1e3,void 0,{signal:n.signal}),i=await r();return i}function Vs(){let e=new b(`hub`).description(`Discover and run Tangle Hub tools`);e.command(`connect`).description(`Connect a provider account`).argument(`provider`,`Provider to connect`).option(`--no-browser`,`Print the authorization URL instead of opening it`).option(`--parameter <key=value>`,`Provider-specific OAuth value. Repeatable.`,(e,t)=>[...t,e],[]).action(async(e,t)=>{await zs(e,t)});let t=new b(`connections`).description(`List Hub provider connections`).action(async e=>{let t=await(await G(e)).connections.list();if(e.json){N(t);return}nc(t.connections)});t.command(`revoke <connection-id>`).description(`Revoke a Hub provider connection`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=await G(t),r=await _r(n,e);if(!t.force&&!await Jr(`Revoke Hub connection ${r}? `,`--force`)){F(`Revoke cancelled.`);return}let i=await n.connections.revoke(r);if(t.json){N(i);return}F(`Revoked Hub connection ${i.connection.id}.`)}),e.addCommand(t);let n=new b(`permissions`).description(`Manage Hub action permissions`);n.command(`list`).description(`List Hub permissions for a connection`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).action(async e=>{if(!e.connection)throw Error(`--connection is required.`);let t=await G(e),n=await _r(t,e.connection),r=await t.permissions.list(n);if(e.json){N(r);return}Zs(r.policies)}),n.command(`set`).description(`Set Hub permission for one action`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).requiredOption(`--action <path>`,`Executor action path`).requiredOption(`--decision <allow|ask|deny>`,`Permission decision`).action(async e=>{if(!e.connection)throw Error(`--connection is required.`);if(!e.action)throw Error(`--action is required.`);let t=Qs(e.decision),n=await G(e),r=await _r(n,e.connection),i=await n.permissions.set({connectionId:r,actionPath:e.action,decision:t});if(e.json){N(i);return}Zs([i.policy])}),n.command(`revert-writes`).description("Revoke a bulk `--allow-writes` grant for a connection (deletes only the auto-granted write rows; manual permissions are untouched)").requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).action(async e=>{if(!e.connection)throw Error(`--connection is required.`);let t=await G(e),n=await _r(t,e.connection),r=await t.permissions.revertWrites(n);if(e.json){N(r);return}F(`Reverted ${r.reverted} write permission${r.reverted===1?``:`s`} for connection ${r.connectionId}.`)}),e.addCommand(n),e.addCommand(Us());let r=new b(`tools`).description(`Discover Hub tools`);return r.command(`sources`).description(`List Hub tool sources`).action(async e=>{let t=await(await G(e)).tools.sources();if(e.json){N(t);return}$s(t.sources)}),r.command(`describe`).description(`Describe a Hub tool`).argument(`path`,`Executor tool path`).action(async(e,t)=>{let n=await(await G(t)).tools.describe(e);if(t.json){N(n);return}ec(n.tool)}),r.command(`search`).description(`Search Hub tools`).argument(`<query...>`,`Search query`).option(`--provider <provider>`,`Filter by provider/source ID`).action(async(e,t)=>{let n=await(await G(t)).tools.search(e.join(` `),{provider:t.provider});if(t.json){N(n);return}Xs(n.tools)}),e.addCommand(r),e.addCommand(Hs(`call`)),e.addCommand(Hs(`exec`)),e.command(`resume`).description(`Resolve a Hub approval created by a paused execution`).argument(`approval-id`,`Hub approval ID from HUB_APPROVAL_REQUIRED`).option(`--accept`,`Approve the execution approval`).option(`--decline`,`Deny the execution approval`).option(`--cancel`,`Unsupported for approval-backed Hub resume`).action(async(e,t)=>{if(Gs(e),t.cancel)throw Error(`Hub approval resume does not support --cancel. Use --decline to deny the approval.`);if(t.accept&&t.decline)throw Error(`Choose only one of --accept or --decline.`);if(!t.accept&&!t.decline)throw Error(`Choose --accept to approve or --decline to deny the Hub approval.`);let n=await G(t);qs(t.decline?await n.approvals.deny(e):await n.approvals.approve(e),t.json===!0)}),e.command(`status`).description(`Show Hub auth and connection status`).action(async e=>{let t=await(await G(e)).status();if(e.json){N(t);return}oc(t)}),e}function Hs(e){return new b(e).description(`Execute a Hub tool`).argument(`<args...>`,`Tool path tokens followed by JSON input`).option(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--auto-approve`,`Approve a HUB_APPROVAL_REQUIRED execution and retry once`).option(`--approve`,`Alias for --auto-approve`).option(`--no-hub-key`,`Do not auto-mint a platform Hub key; use the stored credential as-is`).action(async(e,t)=>{let{args:n,approve:r}=Ws(e,t),{path:i,input:a}=Ys(n),o=await G(t),s=t.connection?await _r(o,t.connection):void 0;N((await o.tools.invoke(i,a,{connectionId:s,approve:r})).result)})}function Us(){let e=new b(`approvals`).description(`List and resolve Hub execution approvals`);e.command(`list`).description(`List pending Hub execution approvals`).action(async e=>{let t=await(await G(e)).approvals.list();if(e.json){N(t);return}Ks(t.approvals)});for(let t of[`approve`,`deny`])e.command(t).description(`${t===`approve`?`Approve`:`Deny`} a pending Hub execution approval`).argument(`approval-id`,`Hub approval ID`).action(async(e,n)=>{Gs(e),qs(await(await G(n)).approvals[t](e),n.json===!0)});return e}function Ws(e,t){let n=t.autoApprove;return{args:e.filter(e=>e!==`--approve`&&e!==`--auto-approve`),approve:t.approve===!0||n===!0||e.includes(`--approve`)||e.includes(`--auto-approve`)}}function Gs(e){if(!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`Hub approval ID must contain only letters, numbers, underscores, and dashes.`)}function Ks(e){M(e,[{key:`id`,header:`ID`},{key:`providerId`,header:`Provider`},{key:`actionPath`,header:`Action`},{key:`connectionId`,header:`Connection`},{key:`status`,header:`Status`},{key:`expiresAt`,header:`Expires`}])}function qs(e,t){if(t){N(Js(e));return}F(`Hub approval ${e.approval.id} ${e.approval.status}.`),e.capabilityToken&&F("Capability token minted. Re-run the original command with `--approve` to execute automatically.")}function Js(e){return{approval:e.approval,...e.capabilityToken?{capabilityToken:{tokenId:e.capabilityToken.tokenId,expiresAt:e.capabilityToken.expiresAt}}:{}}}function Ys(e){if(e.length<2)throw Error(`Usage: tangle hub call <path> <json-input>`);let t=e[e.length-1];try{return{path:e.slice(0,-1).join(`.`),input:JSON.parse(t)}}catch{throw Error(`Hub call input must be valid JSON.`)}}function Xs(e){M(e.map(e=>({...e,provider:e.providerId??e.requiredConnectionProviderId,connection:tc(e)})),[{key:`path`,header:`Path`},{key:`provider`,header:`Provider`},{key:`title`,header:`Title`},{key:`description`,header:`Description`},{key:`connection`,header:`Connection`},{key:`policyState`,header:`Policy`}])}function Zs(e){M(e,[{key:`connectionId`,header:`Connection`},{key:`providerId`,header:`Provider`},{key:`actionPath`,header:`Action`},{key:`decision`,header:`Decision`},{key:`updatedAt`,header:`Updated`}])}function Qs(e){if(e===`allow`||e===`ask`||e===`deny`)return e;throw Error(`--decision must be one of: allow, ask, deny.`)}function $s(e){M(e,[{key:`sourceId`,header:`Source`},{key:`displayName`,header:`Provider`},{key:`toolCount`,header:`Tools`},{key:`connectionStatus`,header:`Connection`},{key:`health`,header:`Health`},{key:`configured`,header:`Configured`}])}function ec(e){L({Path:e.path,Provider:e.providerId??e.requiredConnectionProviderId,Title:e.title,Description:e.description,Connection:tc(e),Policy:e.policyState}),e.inputSchema!==void 0&&(F(`Input schema`),console.log(JSON.stringify(e.inputSchema,null,2))),e.outputSchema!==void 0&&(F(`Output schema`),console.log(JSON.stringify(e.outputSchema,null,2)))}function tc(e){if(e.connectionRequired===!1)return`not required`;if(e.connectionStatus)return e.connectionStatus}function nc(e){M(e.map(e=>({...e,account:e.accountDisplay??e.displayName,scopes:e.scopes.join(`, `)})),[{key:`id`,header:`ID`},{key:`providerId`,header:`Provider`},{key:`account`,header:`Account`},{key:`scopes`,header:`Scopes`},{key:`status`,header:`Status`},{key:`health`,header:`Health`},{key:`lastUsedAt`,header:`Last Used`}])}function rc(e){if(!e||e.length===0)return;let t={};for(let n of e){let e=n.indexOf(`=`);if(e<=0||e===n.length-1)throw Error(`Invalid --parameter "${n}": expected key=value (for example subdomain=acme)`);let r=n.slice(0,e);if(Object.hasOwn(t,r))throw Error(`Duplicate --parameter key "${r}".`);t[r]=n.slice(e+1)}return t}function ic(e,t,n=!1){t?F(`Opened browser to connect ${e.provider}.`):(F(`Open this URL to connect ${e.provider}:`),console.log(e.redirectUrl)),F(n?`Finish authorization in the browser; this run resumes when connected.`:"Finish authorization in the browser, then rerun `tangle hub status`.")}function ac(e){return{provider:e.provider,redirectUrl:e.redirectUrl,expiresAt:e.expiresAt,scopes:e.scopes,cli:e.cli}}function oc(e){let{principal:t,connections:n}=e;F(`Hub status`),L({Principal:t.kind,"User ID":t.userId,"API Key ID":t.apiKeyId,"Sandbox ID":t.sandboxId,"Connected Providers":n.connectedProviderCount,"Unhealthy Providers":n.unhealthyProviderCount}),n.unhealthyProviderCount>0&&F(`Some providers require reconnect.`)}const sc=[`claude-code`,`opencode`,`codex`,`kimi-code`,`prime`],cc=process.env.TANGLE_ROUTER_URL??`https://router.tangle.tools/v1`;function lc(e){let t=oe(e);if(t)return t;throw Error(`--model '${e}' has no provider. Pass a canonical id, for example 'google/${e}'.`)}function uc(e){let t=e.harness??`claude-code`;if(!sc.includes(t))throw Error(`Unknown --harness '${t}'. Supported: ${sc.join(`, `)}.`);let n=dc(e.maxTokens,2e5,`--max-tokens`),r=dc(e.maxIterations,50,`--max-iterations`),i=e.maxWorkers===void 0?void 0:dc(e.maxWorkers,0,`--max-workers`);return{harness:t,...e.model?{model:e.model}:{},maxTokens:n,maxIterations:r,...i===void 0?{}:{maxWorkers:i}}}function dc(e,t,n){if(e===void 0)return t;let r=Number.parseInt(e,10);if(!Number.isFinite(r)||r<=0)throw Error(`${n} must be a positive integer, got '${e}'.`);return r}function fc(e){let t={maxTokens:e.maxTokens,maxIterations:e.maxIterations};return e.maxWorkers===void 0?{budget:t}:{budget:t,perWorker:{maxTokens:Math.max(1,Math.floor(e.maxTokens/e.maxWorkers)),maxIterations:Math.max(1,Math.floor(e.maxIterations/e.maxWorkers))}}}function pc(e){let t=e.spentTotal,n=e.kind===`no-winner`?``:e.out;return{text:typeof n==`string`?n:typeof n==`object`&&n&&`content`in n&&typeof n.content==`string`?n.content:JSON.stringify(n),tokenUsage:{input:t.tokensKnown===!1?null:t.tokens.input,output:t.tokensKnown===!1?null:t.tokens.output},costUsd:t.usdKnown===!1?null:t.usd,status:e.kind===`no-winner`?`no-winner (${e.reason})`:`winner`}}let mc=null;function hc(){return mc??=import(`@tangle-network/agent-runtime/kernel`).catch(e=>{throw mc=null,e?.code===`ERR_MODULE_NOT_FOUND`?new R(`RUNTIME_UNAVAILABLE`,`Agent Runtime could not be loaded`,e.message,`npm install -g @tangle-network/sandbox-cli@latest`):e}),mc}async function gc(e,t,n){let r=H({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=U(r),{budget:a,perWorker:o}=fc(t),s=[],c={async create(e){let{TANGLE_API_KEY:t,...r}=e?.env??{},a=await i.create(e?.env?{...e,env:r}:e);return s.push({id:a.id,status:`spawned`}),n.json||F(`worker ${a.id} spawned`),a}},l=await hc(),u=l.workerFromBackend({backend:`sandbox`,sandboxClient:c,maxIterations:1}),d=(e,n)=>u({...e,harness:t.harness},n),f={name:`supervisor`,harness:`cli-base`,model:{default:t.model??`gemini-2.5-flash-lite`,provider:t.model?lc(t.model):`google`},tools:{agent_runtime_coordination_spawn_worker:!0,agent_runtime_coordination_observe_agent:!0}},p={routerBaseUrl:cc,routerKey:r.apiKey},m=pc(await l.supervise(f,{goal:e},{budget:a,makeWorkerAgent:d,router:p,...o?{perWorker:o}:{},...t.model?{allowedModels:[t.model]}:{},runId:`supervise-${S()}`})),h=m.status===`winner`?`settled`:`failed`;for(let e of s)e.status=h,n.json||F(`worker ${e.id} settled (${e.status})`);return{task:e,result:m.text,workers:s,tokenUsage:m.tokenUsage,costUsd:m.costUsd,status:m.status}}function _c(){let e=new b(`supervise`);return e.description(`Run a budget-conserving supervisor that spawns isolated sandbox workers to deliver a task.`).argument(`<task>`,`What the supervisor should accomplish`).option(`--harness <name>`,`Worker harness (${sc.join(` | `)})`,`claude-code`).option(`--model <id>`,`Model for the supervisor + workers`).option(`--max-tokens <n>`,`Conserved token budget for the whole run`,`200000`).option(`--max-iterations <n>`,`Conserved iteration budget for the whole run`,`50`).option(`--max-workers <n>`,`Bound the fanout; each worker reserves floor(max-tokens / n) tokens and floor(max-iterations / n) iterations`).action(async(e,t)=>{let n=uc({harness:t.harness,model:t.model,maxTokens:t.maxTokens,maxIterations:t.maxIterations,maxWorkers:t.maxWorkers});t.json||(F(`Supervising: ${e}`),F(`harness=${n.harness} budget=${n.maxTokens}tok/${n.maxIterations}it`),console.log());let r=await gc(e,n,{apiKey:t.apiKey,baseUrl:t.baseUrl,json:t.json});if(t.json){N(r),r.status!==`winner`&&(process.exitCode=1);return}if(console.log(),r.result&&(console.log(r.result),console.log()),L({"Input Tokens":r.tokenUsage.input??`Unavailable`,"Output Tokens":r.tokenUsage.output??`Unavailable`,Cost:r.costUsd===null?`Unavailable`:`$${r.costUsd.toFixed(4)}`}),r.status!==`winner`)throw Error(`Supervisor finished without a winner: ${r.status}`)}),e}const vc=1e3;function yc(e,t){return[...t,e]}function bc(e,t=`input`,n){if(n===void 0&&!e?.length)return;let r={};if(n!==void 0)try{if(r=JSON.parse(fe(n,`utf8`)),!r||typeof r!=`object`||Array.isArray(r)||Object.entries(r).some(([e,t])=>!e.length||typeof t!=`string`))throw Error(`Invalid input map`)}catch{throw new R(`WORKFLOW_INPUT_FILE_INVALID`,`Could not load --input-file '${n}'`,`Expected a readable JSON object with nonempty keys and string values`,`tangle workflows run --help`)}let i=Object.entries(r);for(let n of e??[]){let e=n.indexOf(`=`);if(e<=0)throw Error(`Invalid --${t} "${n}": expected key=value (e.g. pull_request.number=123)`);i.push([n.slice(0,e),n.slice(e+1)])}return Object.fromEntries(i)}function xc(e){M(e.map(e=>({id:e.id,status:e.status,attempts:e.attempts,created:e.createdAt,completed:e.completedAt??``})),[{key:`id`,header:`Run ID`},{key:`status`,header:`Status`},{key:`attempts`,header:`Attempts`},{key:`created`,header:`Created`},{key:`completed`,header:`Completed`}])}function Sc(e){if(L({"Run ID":e.id,Workflow:e.workflowId,Status:e.status,Error:e.error??``,Attempts:e.attempts,Created:e.createdAt,Started:e.startedAt??``,Completed:e.completedAt??``}),e.actionResults.length>0){F(`Actions`);let t=e.actionResults.some(e=>e.nodeId!==void 0||e.visit!==void 0);M(e.actionResults.map(e=>({index:e.index,...t?{node:e.nodeId??``,visit:e.visit??``}:{},kind:e.kind,status:e.status,error:e.error??``,cost:e.costUsd??``})),[{key:`index`,header:`#`},...t?[{key:`node`,header:`Node`},{key:`visit`,header:`Visit`}]:[],{key:`kind`,header:`Kind`},{key:`status`,header:`Status`},{key:`error`,header:`Error`},{key:`cost`,header:`Cost (USD)`}])}e.graph&&(F(`Graph`),L({Nodes:e.graph.nodes.length,Edges:e.graph.edges.length,"Max node visits":e.graph.maxNodeVisits}),M(e.graph.edges.map(e=>({from:e.from,to:e.to,guard:e.when===void 0?``:JSON.stringify(e.when)})),[{key:`from`,header:`From`},{key:`to`,header:`To`},{key:`guard`,header:`Guard`}])),e.edgeVerdicts&&e.edgeVerdicts.length>0&&(F(`Edge verdicts`),M(e.edgeVerdicts.flatMap(e=>Object.entries(e.verdicts).map(([t,n])=>({node:e.nodeId,edge:t,verdict:n?`taken`:`not taken`}))),[{key:`node`,header:`Node`},{key:`edge`,header:`Edge`},{key:`verdict`,header:`Verdict`}]))}function Cc(e){if(e.status===`cancelled`){F(`Cancelled run ${e.runId}.`);return}if(e.signalled){F(`Cancelling run ${e.runId} — signalled the worker; it will stop shortly.`);return}F(`Requested cancellation of run ${e.runId}, but couldn't confirm it — the run may have just finished, or it's running on another instance and will stop on its own.`)}function wc(e){switch(e.type){case`snapshot`:F(`snapshot: ${e.run.status} (${e.run.actionResults.length} action(s))`);break;case`action.started`:console.log(`→ action[${e.index}] ${e.kind} started`);break;case`action.finished`:{let t=e.status===`succeeded`?`✓`:e.status===`skipped`?`⊘`:`✗`;console.log(`${t} action[${e.index}] ${e.kind} ${e.status}${e.error?`: ${e.error}`:``}`);break}case`iteration.started`:console.log(` · action[${e.actionIndex}] iteration ${e.iterationIndex} started`);break;case`iteration.ended`:console.log(` · action[${e.actionIndex}] iteration ${e.iterationIndex} ${e.status}`);break;case`token`:typeof e.delta==`string`&&process.stdout.write(e.delta);break;case`ping`:break;case`run.done`:console.log(`\nrun.done: ${e.status}${e.error?`: ${e.error}`:``}`);break;case`run.waiting`:console.log(`\nrun.waiting: parked on a human decision (${e.decisionId}) — resolve it to resume`);break}}function Tc(e){e.command(`run`).description(`Trigger an immediate run of a workflow`).argument(`<id>`,`Workflow ID`).option(`--input-file <file>`,`Trigger inputs from a flat JSON string map; --input overrides its keys`).option(`--input <key=value>`,`Trigger input as key=value (e.g. pull_request.number=123). Repeatable.`,yc,[]).option(`--wait`,`Wait for the run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).action(async(e,t)=>{let n=bc(t.input,`input`,t.inputFile),r=t.timeout===void 0?void 0:Za(t.timeout,`--timeout`),i=t.pollInterval===void 0?void 0:Za(t.pollInterval,`--poll-interval`),a=await X(t),{runId:o}=await a.workflows.run(e,n);if(!t.wait){if(t.json)return N({runId:o});F(`Started run ${o} for workflow ${e}.`),F(`Inspect it with: tangle workflows run-detail ${e} ${o}`);return}let s=t.json?null:I(`Waiting for run ${o} to finish...`).start(),c;try{c=await a.workflows.waitForRun(e,o,{...r===void 0?{}:{timeoutMs:r},...i===void 0?{}:{pollIntervalMs:i}})}finally{s?.stop()}if(c.status===`failed`&&(process.exitCode=1),t.json)return N(c);Sc(c)}),e.command(`runs`).description(`List a workflow's run history (newest first)`).argument(`<id>`,`Workflow ID`).option(`--limit <n>`,`Runs per page (1-100)`).option(`--cursor <cursor>`,`Pagination cursor from a previous page`).option(`--all`,`Fetch every page, not just the first`).action(async(e,t)=>{let n=await X(t),r=t.limit===void 0?void 0:Za(t.limit,`--limit`);if(t.all){let i=[],a=t.cursor,o=0,s=null;for(;;){let c=await n.workflows.listRuns(e,{...r===void 0?{}:{limit:r},...a===void 0?{}:{cursor:a}});if(i.push(...c.runs),o+=1,!c.nextCursor)break;if(o>=vc){s=c.nextCursor,t.json||F(`Stopped after ${vc} pages (${i.length} runs); more may exist — resume with --cursor ${c.nextCursor}`);break}a=c.nextCursor}if(t.json)return N({runs:i,nextCursor:s});xc(i);return}let i=await n.workflows.listRuns(e,{...r===void 0?{}:{limit:r},...t.cursor===void 0?{}:{cursor:t.cursor}});if(t.json)return N(i);xc(i.runs),i.nextCursor&&F(`More runs available — next page: --cursor ${i.nextCursor}`)}),e.command(`run-detail`).description(`Show a single run's detail (per-action output and errors)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await(await X(n)).workflows.getRun(e,t);if(n.json)return N(r);Sc(r)}),e.command(`cancel`).description(`Cancel a queued or in-progress run`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await(await X(n)).workflows.cancel(e,t);if(n.json)return N(r);Cc(r)}),e.command(`retry`).description(`Re-run a failed or cancelled run (a fresh run with the same trigger context)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID of the failed/cancelled run to retry`).option(`--wait`,`Wait for the new run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).action(async(e,t,n)=>{let r=n.timeout===void 0?void 0:Za(n.timeout,`--timeout`),i=n.pollInterval===void 0?void 0:Za(n.pollInterval,`--poll-interval`),a=await X(n),o=await a.workflows.retryRun(e,t);if(!n.wait){if(n.json)return N(o);F(`Started run ${o.runId} (retry of ${t}).`),F(`Inspect it with: tangle workflows run-detail ${e} ${o.runId}`);return}let s=n.json?null:I(`Waiting for run ${o.runId} to finish...`).start(),c;try{c=await a.workflows.waitForRun(e,o.runId,{...r===void 0?{}:{timeoutMs:r},...i===void 0?{}:{pollIntervalMs:i}})}finally{s?.stop()}if(c.status===`failed`&&(process.exitCode=1),n.json)return N(c);Sc(c)}),e.command(`events`).description(`Tail a run's live progress events until it finishes`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await X(n);for await(let i of r.workflows.watchRun(e,t))n.json?console.log(JSON.stringify(i)):wc(i),i.type===`run.done`&&i.status===`failed`&&(process.exitCode=1)})}const Ec=t(import.meta.url);if(!Ec)throw Error(`Tangle CLI package metadata was not found`);const Dc=ge(Ec),Oc=e=>x(`sha256`).update(e).digest(`hex`);function kc(e,t){let n=ye(e,t);return n!==`..`&&!n.startsWith(`..${xe}`)&&!ve(n)}function Ac(e,t){if(/[\\/]/.test(e)||/\.(yaml|yml|json)$/.test(e))return be(t,e);let n=t;for(;!ue(D(n,`.git`))&&ge(n)!==n;)n=ge(n);ue(D(n,`.git`))||(n=t);let r=[D(n,`.tangle`,`graphs`,`${e}.yaml`),D(O(),`.tangle`,`graphs`,`${e}.yaml`)],i=r.find(ue);if(i)return i;throw new R(`GRAPH_NOT_FOUND`,`Graph '${e}' was not found`,`Looked in ${r.join(` and `)}`,`tangle graph --help`)}async function jc(e,t){return vs(e.signal,async n=>{let r=e.runId??S(),i;try{let a=D(O(),`.tangle`,`runs`,r);await He(a,{recursive:!0,mode:448});let o=await Ke(D(O(),`.tangle`)),s=await Ke(e.cwd??process.cwd()),c=[`runs`,`graph-registry`,`graphs`].some(e=>kc(s,D(o,e))||kc(D(o,e),s))?D(O(),`.tangle`,`workspaces`,r):s;await He(c,{recursive:!0,mode:448});let l;return await t({runId:r,runDir:a,cwd:c,bridge:e=>l??=(async()=>{n.throwIfAborted();let t=ne(32).toString(`hex`),{loadConfig:r,startServer:o}=await import(`cli-bridge`),s=D(Dc,`dist`,`stdio.mjs`),l=r({...process.env,BRIDGE_HOST:`127.0.0.1`,BRIDGE_PORT:`3344`,BRIDGE_BEARER:t,BRIDGE_DATA_DIR:D(a,`bridge`),BRIDGE_BACKENDS:ws,BRIDGE_JAIL_MODE:`fs-jail`,BRIDGE_JAIL_FALLBACK:`deny`,BRIDGE_SUBSCRIPTIONS_ONLY:`1`});e&&l.jailReadablePaths.push(s),i=await o({cwd:c,config:{...l,port:0},handleSignals:!1,quiet:!0,hub:e?{client:e,hash:_s,serverForGrant:e=>{if(!i)throw Error(`Hub host is not ready`);return{transport:`stdio`,command:process.execPath,args:[{kind:`public`,value:s}],env:{TANGLE_HUB_MCP_ENDPOINT:{kind:`public`,value:`${i.url}/hub/mcp/grants/${e}`}}}}}:void 0});let{graphNativeCapture:u}=await import(`./graph-native-CS_TmaCK.mjs`);return{harnessTranscript:u({bridgeUrl:i.url,bridgeBearer:t,cwd:c}),backend:`bridge`,bridgeUrl:i.url,bridgeBearer:t,cwd:c}})(),signal:n})}catch(t){throw t instanceof Error&&Object.assign(t,{runId:e.errorRunId??r}),t}finally{await i?.close()}},e.fix??`tangle graph --help`)}async function Mc(e,t,n,r){let i=await X({...n,signal:r}),a=Oc(t),o=bc(n.param,`param`),s={name:he(e).replace(/\.(yaml|yml|json)$/i,``),...o?{params:o}:{},...n.seat?{seat:n.seat}:{}},c,l;if(n.resume){let e=await i.workflows.getRun(n.resume,{signal:r});e.id!==n.resume&&Y(`The cloud owner returned another run identity`);let t=e.execution;if((t?.kind!==`graph`||t.sourceSha!==a)&&Y(`The authored cloud graph source changed`),Object.entries(o??{}).some(([e,n])=>!Object.hasOwn(t.params,e)||ae(t.params[e])!==ae(n))&&Y(`A recorded cloud graph parameter changed`),n.seat!==void 0&&n.seat!==t.deploy.seat&&Y(`The recorded cloud seat override changed`),n.dryRun)return{run:e};if((e.status===`cancelled`||e.status===`failed`)&&Y(`The cloud run is terminal: ${e.status}`),e.status===`succeeded`)return e.graphResult||Y(`The settled cloud run has no retained Runtime result`),{workflowId:e.workflowId,runId:e.id,sourceDigest:a,result:e.graphResult,replayed:!0,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(e.workflowId)}/runs/${encodeURIComponent(e.id)}`};if(e.recovery?.state===`running`)return{workflowId:e.workflowId,runId:e.id,sourceDigest:a,run:e,attached:!0,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(e.workflowId)}/runs/${encodeURIComponent(e.id)}`};e.recovery?.state!==`queued`&&e.recovery?.state!==`recoverable`&&Y(`The owner has not confirmed recovery eligibility`),c=e.workflowId,l=e.revUsed??Y(`The captured cloud revision is unavailable`)}else{if(n.dryRun)return i.workflows.validate(t,{format:`graph`,deploy:s});let e=await i.workflows.create(t,{format:`graph`,deploy:s});c=e.id,l=e.headRev??Y(`The cloud workflow has no retained revision`)}r.throwIfAborted();let u=await i.workflows.run(c,void 0,{signal:r,sourceSha:a,expectedRev:l,...n.resume?{resumeRunId:n.resume}:{}});return n.resume&&u.runId!==n.resume&&Y(`The cloud owner recovered another run identity`),{...u,workflowId:c,sourceDigest:a,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(c)}/runs/${encodeURIComponent(u.runId)}`}}async function Nc(e,t,n={}){let r=[`tangle graph run`,Ve(e),...t.dryRun?[`--dry-run`]:[],...t.cloud?[`--cloud`]:[],...t.resume?[`--resume`,Ve(t.resume)]:[],...t.seat?[`--seat`,Ve(t.seat)]:[],...t.param.flatMap(e=>[`--param`,Ve(e)])].join(` `);return await vs(n.signal,async i=>{i.throwIfAborted();let a=await Ke(Ac(e,n.cwd??process.cwd())),o=n.source??await Ge(a,`utf8`);if(!t.resume&&t.cloud||t.resume?.startsWith(`wfrun_`))return Mc(a,o,t,i);let s=await hc(),c=Oc(o),l=bc(t.param,`param`)??{},u=t.resume?await xs(t.resume):void 0,d=s.graphRegistry(D(O(),`.tangle`,`graph-registry`)),f;if(u){u.file!==a&&Y(`The recorded graph source path changed`);let e=await s.loadGraph(d,u.graphDigest);e||Y(`The recorded executable graph is unavailable`),f=s.validateStoredGraph(e),Cs(u,t,c,l)}let p={apiKey:t.apiKey,sandboxBaseUrl:t.baseUrl,signal:i,json:t.json,dryRun:t.dryRun&&!n.connectNeeds},m,h=()=>m??=Rs(p),g=new Map,_=e=>{let t=e.trim().toLowerCase(),n=g.get(t)??(async()=>{let e=await h(),n=e&&await Bs(e,t,p);return n?{connectionId:n,capabilities:[`*`]}:void 0})();return g.set(t,n),n},v=async e=>{if(i.throwIfAborted(),u&&f)return{graph:f,params:u.params};let r=await s.loadGraphFile(a,{source:o,seat:t.seat??V().seat,resolveSeat:Ts(e,i),resolveNeed:_,params:l,cwd:e,signal:i});if(i.throwIfAborted(),n.graphDigest&&r.graph.digest!==n.graphDigest)throw new R(`GRAPH_CHANGED`,`The validated graph changed before execution`,`Its compiled graph digest no longer matches validation`,`tangle graph run --help`);return r};return t.dryRun?v(n.cwd??process.cwd()):jc({...n,...u?{runId:u.runId,cwd:u.cwd}:{},signal:i,fix:r},async({runId:e,runDir:n,cwd:r,bridge:o})=>{let l=await v(r),{superviseGraphPursuit:f,readSettleRecord:p}=await import(`@tangle-network/agent-runtime/durable`),m=await s.recordStoredGraphRun(d,l.graph),g=u??{version:1,runId:e,cwd:r,file:a,graphDigest:m.digest,sourceDigest:c,params:l.params,startedAt:new Date().toISOString(),...t.seat===void 0?{}:{seat:t.seat}};u||await Ss(n,g);let _=u?await p(n):void 0;if(_&&_.tree.root!==e&&Y(`The settlement names another run`),_?.kind===`no-winner`&&Y(`The local run is terminal: ${_.reason}`),_)return{runId:e,graphDigest:m.digest,sourceDigest:c,...pc(_),replayed:!0};let ee=s.graphFromStored(m),y=m.nodes.some(e=>e.profile.connections?.length),te=y?await h():void 0;if(y&&!te)throw new R(`AUTH_REQUIRED`,`Hub authentication is required`,`No Tangle credential is configured for this local graph`,`tangle auth login`);let b=await o(te),x=g.startedAt;F(`Run ${e} · ${he(a)} · ${r}`);let ne=await Pc(n);F(`Viewer ${ne.url}`);let S=await f(ee,{pursuitId:m.digest,runDir:n,runId:e,backend:b,resume:!!u,signal:i,profileSecurity:{allowConnections:y,allowLocalMcp:!1,allowHooks:!1,allowedMcpHosts:[]}}).finally(ne.close),re={runId:e,graphDigest:m.digest,sourceDigest:c,...pc(S.result.result)},C=S.result.result,{tokens:ie,tokensKnown:w,iterations:ae,ms:oe}=C.spentTotal;if(await s.recordStoredGraphRun(d,m,{graphDigest:m.digest,evidence:[{kind:`authored-graph`,url:`urn:sha256:${m.digest}`},{kind:`authored-yaml`,url:`urn:sha256:${c}`}],taskDigest:s.taskShapeDigest({graph:he(a),params:l.params}),startedAt:x,finishedAt:new Date().toISOString(),outcome:C.kind===`no-winner`?{kind:`no-winner`,reason:C.reason}:{kind:`delivered`,summary:re.text},cost:{iterations:ae,ms:oe,...w===!1?{}:{tokens:ie.input+ie.output},...re.costUsd===null?{}:{usd:re.costUsd}},traversals:S.result.ledger.length,exhaustedEdges:S.result.exhaustedEdges,source:{kind:`tangle-cli-graph`,id:e}}),C.kind===`no-winner`)throw Object.assign(new R(`GRAPH_RUN_FAILED`,`Graph '${he(a)}' finished without a result`,S.result.ledger.filter(e=>e.outcome===`unpropagated`&&e.reason).pop()?.reason||C.reason,`tangle graph inspect ${e}`),{runId:e,runtimeFailures:[...C.tree.nodes.filter(e=>e.failure).map(e=>({node:e.label,failure:e.failure})),...C.reason===`driver-failed`&&C.error.failure?[{node:`root`,failure:C.error.failure}]:[]]});return re})},r)}async function Pc(e){let{serveTopWeb:t}=await import(`@tangle-network/agent-runtime/tui`),{readGraphSessions:n}=await import(`./graph-native-CS_TmaCK.mjs`);return t({roots:[e],assets:D(Dc,`dist`,`graph-viewer`),readSessions:n})}async function Fc(e,t){if(e.startsWith(`wfrun_`)){let n=await X(t),r=await n.workflows.getRun(e);return t.json?N(r):F(`Run ${e} · ${n.baseUrl}/app/workflows/${encodeURIComponent(r.workflowId)}/runs/${encodeURIComponent(e)}`)}let n=D(O(),`.tangle`,`runs`,e);if(!/^[a-f0-9-]{36}$/i.test(e)||!ue(n))throw new R(`RUN_NOT_FOUND`,`Run '${e}' was not found`,`Use a run ID printed by tangle graph run`,`tangle graph inspect --help`);let{loadTopSnapshot:r}=await import(`@tangle-network/agent-runtime/tui`);if(t.json)return N(await r(process.cwd(),{runDir:n}));F(`Run ${e} · ${(await Pc(n)).url}`)}function Ic(){let e=new b(`graph`).description(`Build and run portable agent graphs`);return Ls(e),Ms(e),e.command(`inspect <run>`).description(`Inspect a live or retained graph run`).action(Fc),e.command(`run <name-or-file>`).description(`Run a saved graph over native subscriptions`).option(`--cloud`,`Run through Tangle's durable cloud workflow owner`).option(`--resume <run>`,`Resume this run's saved graph and durable execution`).option(`--seat <seat>`,`Use harness/model@effort for every node`).option(`--param <key=value>`,`Graph parameter; repeatable`,(e,t)=>[...t,e],[]).option(`--dry-run`,`Validate and print the graph without starting agents`).action(async(e,t)=>{let n=await Nc(e,t);t.json||t.dryRun?N(n):`status`in n?(F(`${n.status} · ${n.runId}`),n.text&&console.log(n.text)):`viewerUrl`in n&&F(`Run ${n.runId} · ${n.viewerUrl}`)}),e}function Lc(){let e=new b(`intelligence`).description(`Create and inspect trace intelligence reports`);return e.command(`connect [agent]`).alias(`connect-agent`).description(`Connect local agent CLIs to Tangle Intelligence`).option(`--endpoint <url>`,`OTLP endpoint base`,$i).option(`--workspace <path>`,`Workspace to write hook files into`,`.`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`,`local`).option(`--dry-run`,`Print planned writes without changing files`).option(`--hook-command <command>`,`Command native hooks should run`,`tangle intelligence hook`).option(`--no-smoke`,`Skip the install smoke trace`).action(async(e,t)=>{let n=e??`local`;ia(n);let r=zc(t.apiKey),i=await la({selection:n,workspace:t.workspace,apiKey:r,endpoint:t.endpoint,serviceName:t.serviceName??oa(t.workspace),environment:t.environment,smoke:t.smoke,dryRun:!!t.dryRun,hookCommand:t.hookCommand}),a={configPath:i.configPath,agents:i.agents,nativeAgents:i.nativeAgents,manual:i.manual,written:i.written,smokeTraceId:i.smokeTraceId};if(t.json){N(a);return}L({Config:i.configPath,Agents:i.agents.join(`, `),"Native Hooks":i.nativeAgents.join(`, `)||void 0,"Manual Setup":i.manual.length?i.manual.map(e=>`${e.label}: ${e.reason}`).join(` `):void 0,Files:i.written.join(`, `),"Smoke Trace":i.smokeTraceId})}),e.command(`doctor`).description(`Check whether your agent traces carry CONTENT or are metadata-only`).option(`--endpoint <url>`,`OTLP endpoint base`,$i).action(async e=>{let t=ca(),n=await ma({endpoint:e.endpoint===`https://intelligence.tangle.tools/v1/otlp`?t?.endpoint??`https://intelligence.tangle.tools/v1/otlp`:e.endpoint,apiKey:zc(e.apiKey??t?.apiKey)});e.json?N(n):Rc(n),n.contentSeen||(process.exitCode=1)}),e.command(`hook`).description(`Emit one local agent hook event to Tangle Intelligence`).requiredOption(`--agent <agent>`,`Agent surface`).requiredOption(`--event <event>`,`Hook event name`).option(`--payload <json>`,`Hook payload JSON`).option(`--endpoint <url>`,`OTLP endpoint base`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`).option(`--session-id <id>`,`Session id override`).option(`--dry-run`,`Build the OTLP request without sending it`).option(`--non-blocking`,`Do not fail the parent agent process`).action(async e=>{try{let t=Bc(e.agent),n=ca(),r={agent:t,event:e.event,endpoint:e.endpoint??n?.endpoint??`https://intelligence.tangle.tools/v1/otlp`,apiKey:zc(e.apiKey??n?.apiKey),serviceName:e.serviceName??n?.serviceName??oa(process.cwd()),environment:e.environment??n?.environment??`local`,sessionId:e.sessionId,payload:e.payload===void 0?await Hc():Vc(e.payload)};if(e.dryRun){let n=da(r);if(e.json){N(n);return}L({Trace:n.traceId,Agent:t,Event:e.event});return}let i=await fa(r);if(e.json){N({traceId:i});return}L({Trace:i,Agent:t,Event:e.event})}catch(t){if(e.nonBlocking){let n=t instanceof Error?t.message:String(t);e.json?N({ok:!1,error:n}):console.error(`Tangle Intelligence hook skipped: ${n}`);return}B(t)}}),e.command(`sandbox <sandbox-id>`).description(`Create an intelligence report for one sandbox`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async(e,t)=>{await Uc({type:`sandbox`,id:e},t)}),e.command(`fleet <fleet-id>`).description(`Create an intelligence report for a sandbox fleet`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async(e,t)=>{await Uc({type:`fleet`,id:e},t)}),e.command(`create`).description(`Create a trace intelligence report`).requiredOption(`--subject-type <type>`,`sandbox | fleet`).requiredOption(`--subject-id <id>`,`Subject identifier`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async e=>{await Uc({type:Gc(e.subjectType),id:e.subjectId},e)}),e.command(`get <job-id>`).description(`Get an intelligence report`).action(async(e,t)=>{let{client:n}=W(t),r=t.json?null:I(`Fetching intelligence report...`);r?.start();let i=await n.intelligence.getReport(e);if(r?.stop(),t.json){N(i);return}Wc(i)}),e.command(`list`).description(`List intelligence reports`).option(`--subject-type <type>`,`sandbox | fleet`).option(`--subject-id <id>`,`Subject identifier`).option(`--limit <count>`,`Maximum reports to return`).action(async e=>{let{client:t}=W(e),n=e.json?null:I(`Fetching intelligence reports...`);n?.start();let r=await t.intelligence.listReports({subjectType:e.subjectType===void 0?void 0:Gc(e.subjectType),subjectId:e.subjectId,limit:e.limit===void 0?void 0:Jc(e.limit)});if(n?.stop(),e.json){N(r);return}M(r.map(e=>({jobId:e.jobId,subject:`${e.subject.type}:${e.subject.id}`,mode:e.mode,status:e.status,cost:`$${e.billing.costUsd.toFixed(2)}`,updatedAt:e.updatedAt})),[{key:`jobId`,header:`Job`,width:20},{key:`subject`,header:`Subject`,width:28},{key:`mode`,header:`Mode`,width:15},{key:`status`,header:`Status`,width:14},{key:`cost`,header:`Cost`,width:10},{key:`updatedAt`,header:`Updated`,width:18}])}),e}function Rc(e){L({Status:e.contentSeen?`content flowing`:e.tracesSeen?`metadata-only — a content gate is missing`:`no traces yet`,"Traces seen":e.tracesSeen?`yes`:`no`,"Content seen":e.contentSeen?`yes`:`no`,"Last seen":e.lastSeenAt??`never`,Window:`${e.windowDays}d`});let t=Object.entries(e.byAgent);t.length>0&&(console.log(),M(t.map(([e,t])=>({agent:e,traces:t.tracesSeen?`yes`:`no`,content:t.contentSeen?`yes`:`no`})),[{key:`agent`,header:`Agent`,width:18},{key:`traces`,header:`Traces`,width:10},{key:`content`,header:`Content`,width:10}]))}function zc(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??process.env.TANGLE_API_KEY;if(!t)throw Error(`--api-key, TANGLE_INTELLIGENCE_API_KEY, or TANGLE_API_KEY is required`);return t}function Bc(e){if(aa(e))return e;throw Error(`agent must be a known Tangle Intelligence agent surface`)}function Vc(e){try{return JSON.parse(e)}catch(e){throw Error(`--payload must be JSON: ${e instanceof Error?e.message:String(e)}`)}}async function Hc(){if(process.stdin.isTTY)return;let e=``;for await(let t of process.stdin)if(e+=typeof t==`string`?t:t.toString(`utf8`),e.length>65536)throw Error(`hook payload exceeds 65536 bytes`);let t=e.trim();if(t)try{return JSON.parse(t)}catch{return{body:t.slice(0,4096)}}}async function Uc(e,t){let n=Kc(t.mode),r=Yc(t.metadata),i=t.maxUsd===void 0?void 0:qc(t.maxUsd);if(n===`agentic`&&i===void 0)throw Error(`Agentic intelligence reports require --max-usd`);let{client:a}=W(t),o=t.json?null:I(`Creating intelligence report...`);o?.start();let s=await a.intelligence.createReport({subject:e,mode:n,...i===void 0?{}:{budget:{billTo:`customer`,maxUsd:i}},...r===void 0?{}:{metadata:r}});if(o?.stop(),t.json){N(s);return}Wc(s)}function Wc(e){L({Job:e.jobId,Subject:`${e.subject.type}:${e.subject.id}`,Mode:e.mode,Status:e.status,"Billed To":e.billing.billedTo,Cost:`$${e.billing.costUsd.toFixed(2)}`,Budget:e.billing.budgetMaxUsd===void 0?void 0:`$${e.billing.budgetMaxUsd.toFixed(2)}`,Updated:e.updatedAt}),e.result!==null&&(console.log(),N(e.result))}function Gc(e){if(e===`sandbox`||e===`fleet`)return e;throw Error(`subject type must be sandbox or fleet`)}function Kc(e){if(e===`deterministic`||e===`agentic`)return e;throw Error(`mode must be deterministic or agentic`)}function qc(e){let t=Number(e);if(!Number.isFinite(t)||t<0)throw Error(`--max-usd must be a non-negative number`);return t}function Jc(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function Yc(e){if(e===void 0)return;let t=JSON.parse(e);if(!t||typeof t!=`object`||Array.isArray(t))throw Error(`--metadata must be a JSON object`);return t}const Xc=[`router`,`sandbox`,`blueprint-agent`,`evals`,`agent-builder`];async function Zc(e,t){let n=await Mr({...e.apiKey===void 0?{}:{apiKey:e.apiKey},...e.platformUrl===void 0?{}:{baseUrl:e.platformUrl},...e.baseUrl===void 0?{}:{sandboxBaseUrl:e.baseUrl}});if(!t||!n.minted)return n;throw Error("This command needs a key you minted yourself. A browser login is exchanged for a short-lived key the platform will not accept for key management. Set TANGLE_API_KEY, run `tangle auth login --api-key sk-tan-…`, or mint the key in the web console. `tangle keys list` works from the login alone.")}async function Qc(e,t,n={}){let r=new Headers(n.headers);n.body&&!r.has(`content-type`)&&r.set(`content-type`,`application/json`);let i=await Nr(e,t,{...n,headers:r});if(n.expected!==void 0&&i.status!==n.expected)throw Error(await $c(i,t));return i}async function $c(e,t){let n=await e.text().catch(()=>``),r;try{let e=JSON.parse(n),t=typeof e?.error==`string`?e.error:e?.error?.message;typeof t==`string`&&t.trim()&&(r=t)}catch{}if(r)return`${r} (HTTP ${e.status})`;let i=n?`: ${n.slice(0,400)}`:``;return`Platform request to ${t} returned ${e.status}${i}`}const el=[`ID`,`Prefix`,`Name`,`Product`,`Created`,`Last used`,`Expires`];function tl(e){return[e.id,e.keyPrefix??``,e.name,e.product??`all`,e.createdAt,e.lastUsedAt??`—`,e.expiresAt??`—`]}function nl(){let e=new b(`keys`).description(`Manage sk-tan-* API keys on id.tangle.tools`);return e.command(`list`).description(`List your active API keys`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async e=>{let t=await Zc(e,!1),n=t.baseUrl,r=await(await Qc(t,`${n}/v1/keys`,{expected:200})).json();if(e.json){N(r);return}It(el,r.data.map(tl))}),e.command(`create`).description(`Create a new API key`).argument(`<name>`,`Human-readable name for the key`).option(`--product <product>`,`Restrict the key to one product (${Xc.join(`|`)}). Omit for all products.`).option(`--budget-usd <amount>`,`Hard budget cap in USD`).option(`--rpm-limit <limit>`,`Requests-per-minute cap`).option(`--expires-in-days <days>`,`Expire the key after N days (integer)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(e,t)=>{if(t.product!==void 0&&!Xc.includes(t.product))throw Error(`Invalid --product. Expected one of ${Xc.join(`, `)}`);let n=await Zc(t,!0),r=n.baseUrl,i=t.expiresInDays===void 0?void 0:new Date(Date.now()+Number.parseInt(t.expiresInDays,10)*24*60*60*1e3).toISOString(),a=I(`Creating API key...`);a.start();let o=await Qc(n,`${r}/v1/keys`,{method:`POST`,expected:201,body:JSON.stringify({name:e,product:t.product,budgetUsd:t.budgetUsd?Number.parseFloat(t.budgetUsd):void 0,rpmLimit:t.rpmLimit?Number.parseInt(t.rpmLimit,10):void 0,expiresAt:i})});a.stop();let s=await o.json();if(t.json){N(s);return}P(`API key created: ${s.data.prefix}…`),F(`Copy this key now — it will never be shown again:\n${s.data.key}`)}),e.command(`revoke`).description(`Revoke an API key`).argument(`<keyId>`,"Key ID (from `tcloud keys list`)").option(`--yes`,`Skip the confirmation prompt`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(e,t)=>{let n=await Zc(t,!0),r=n.baseUrl;if(!t.yes&&!await Jr(`Revoke key ${e}? Any service still using it will start to fail.`,`--yes`)){F(`Aborted.`);return}let i=await(await Qc(n,`${r}/v1/keys/${encodeURIComponent(e)}`,{method:`DELETE`,expected:200})).json();if(t.json){N(i);return}P(`Revoked ${e}`)}),e}function rl(e){if(Vn().token)throw Error(`A line relay cannot manage numbers or attachments. Use your owner CLI outside the agent box.`);return U(H(e))}function il(e){if(!e.yes)throw Error(`Review the selected line and use --yes to authorize this change. Attaching enables metered agent work.`)}function al(e){if(e===`imessage`||e===`whatsapp`||e===`email`||e===`sms`||e===`voice`||e===`telegram`)return e;throw Error(`--transport must be imessage, whatsapp, email, sms, voice, or telegram`)}function ol(e){return e().catch(B)}async function sl(e){let t=await We(e,`r`);try{if(!(await t.stat()).isFile())throw Error(`Attachment input must be a regular JSON file`);let e=Buffer.alloc(131073),n=0;for(;n<e.length;){let{bytesRead:r}=await t.read(e,n,e.length-n,null);if(r===0)break;n+=r}if(n===e.length)throw Error(`Attachment JSON exceeds 128 KiB`);let r;try{r=JSON.parse(e.subarray(0,n).toString(`utf8`))}catch{throw Error(`Attachment file is not valid JSON`)}if(!r||typeof r!=`object`||Array.isArray(r))throw Error(`Attachment JSON must be an object`);if(Object.hasOwn(r,`number`))throw Error(`Use the line ID argument, not a number field in the attachment file`);return r}finally{await t.close()}}function cl(e){e.command(`providers`).description(`List provider transports supported by this Hub deployment`).action(e=>ol(async()=>{N(await rl(e).lines.providers())})),e.command(`list`).description(`List owned lines, optionally for a saved agent profile or sandbox`).option(`--profile-id <id>`,`Stored profile ID`).option(`--sandbox <id>`,`Existing sandbox ID`).action(e=>ol(async()=>{N(await rl(e).lines.list({profileId:e.profileId,sandboxId:e.sandbox}))})),e.command(`get`).argument(`<line-id>`).description(`Inspect a line and its current attachment`).action((e,t)=>ol(async()=>{N(await rl(t).lines.get(e))})),e.command(`numbers`).argument(`<connection-id>`).description(`Discover owned provider numbers; this does not purchase or reserve a number`).option(`--transport <transport>`,`imessage, whatsapp, or sms`,`imessage`).action((e,t)=>ol(async()=>{let n=al(t.transport);if(n===`email`)throw Error(`Email uses an owned mailbox, not phone inventory`);if(n===`voice`)throw Error(`Voice numbers are listed by ph0ny; provide the owned number ID to lines connect`);if(n===`telegram`)throw Error(`Telegram uses an owned bot, not phone inventory`);N(await rl(t).lines.numbers(e,n))})),e.command(`connect`).argument(`<connection-id>`).description(`Bind an owned number or identity through Hub; no provider rental is purchased`).option(`--transport <transport>`,`imessage, whatsapp, sms, email, voice, or telegram`,`imessage`).option(`--number-id <id>`,`Exact owned provider number ID; required for voice, SMS, WhatsApp and Linq iMessage`).option(`--address <email>`,`Owned mailbox on a verified email domain`).requiredOption(`--reference <reference>`,`Stable client reference; keep it unchanged on retry`).option(`--label <label>`,`Line display name`).option(`--yes`,`Authorize provider webhook configuration and line binding`).action((e,t)=>ol(async()=>{il(t);let n=al(t.transport);if(n!==`email`&&t.address)throw Error(`--address is email-only`);if((n===`email`||n===`telegram`)&&t.numberId)throw Error(`${n} does not take --number-id`);let r={connectionId:e,label:t.label,clientReference:t.reference},i;if(n===`email`)i={...r,transport:n,address:t.address};else if(n===`telegram`)i={...r,transport:n};else if(n===`imessage`)i={...r,transport:n,phoneNumberId:t.numberId};else{if(!t.numberId)throw Error(`${n} requires --number-id`);i={...r,transport:n,phoneNumberId:t.numberId}}N(await rl(t).lines.fromConnection(i))})),e.command(`attach`).argument(`<line-id>`).description(`Attach a saved agent to any sandbox, or use an isolated on-demand member instance`).option(`--file <path>`,`Reviewed native attachment JSON (exclusive with quick-setup flags)`).option(`--profile-id <id>`,`Owner-scoped saved profile; each turn pins its source revision`).option(`--member <address>`,`The one allowed sender: E.164 phone or email`).option(`--sandbox <id>`,`Use an existing sandbox instead of an on-demand instance`).option(`--instance-prefix <prefix>`,`Stable instance namespace; defaults to profile:<profile-id>:`).option(`--tools <mode>`,`chat denies tools; act applies the profile's tools and permissions`).option(`--turns-per-day <count>`,`Per-member daily turn ceiling (default 30)`).option(`--yes`,`Authorize agent execution and spend against your key limits`).action((e,t)=>ol(async()=>{il(t);let n=rl(t),r;if(t.file){if(t.profileId||t.member||t.sandbox||t.instancePrefix||t.tools||t.turnsPerDay)throw Error(`Choose --file or quick-setup flags, not both`);r=await sl(t.file)}else{if(!t.profileId||!t.member)throw Error(`Provide --profile-id and --member, or --file`);if(t.sandbox&&t.instancePrefix)throw Error(`Choose --sandbox or --instance-prefix`);let e=t.tools??`chat`,n=Number(t.turnsPerDay??`30`);if(e!==`chat`&&e!==`act`)throw Error(`--tools must be chat or act`);if(!Number.isSafeInteger(n)||n<1||n>1e4)throw Error(`--turns-per-day must be 1–10000`);if(e===`act`&&t.sandbox)throw Error(`Acting tools require an isolated on-demand instance; omit --sandbox`);r={mode:`personal`,members:[{address:t.member,role:`owner`}],unknownSenders:`reject`,roles:{owner:{context:`own`,tools:e}},respond:{kind:`agent`,profileId:t.profileId,...e===`act`?{rolePolicy:{version:1,roles:{owner:{kind:`general`}},members:{}}}:{}},limits:{turnsPerMemberPerDay:n},...t.sandbox?{sandboxId:t.sandbox}:{instance:{keyPrefix:t.instancePrefix??`profile:${t.profileId}:`,create:{ownerContext:`isolated`,...e===`act`?{egressPolicy:{mode:`strict`,allowDomains:[new URL(ar()).hostname],includeImplicitDomains:!1}}:{}}}}}}if(typeof r.sandboxId==`string`==(r.instance!==void 0))throw Error(`Attachment requires exactly one of sandboxId and instance`);let{sandboxId:i,instance:a,...o}=r,s;if(i){let t=await n.get(i);if(!t)throw Error(`Sandbox not found`);s=await t.lines.attach({...o,number:e})}else{if(!a)throw Error(`Attachment requires an instance`);s=await n.lines.attach({...o,number:e,instance:a})}N(s)}));for(let t of[`detach`,`release`])e.command(t).argument(`<line-id>`).description(t===`detach`?`Stop dispatch; preserve history and provider rental`:`Retire a detached Hub line; does not cancel provider rental`).option(`--yes`,`Authorize this change`).action((e,n)=>ol(async()=>{il(n),N({[t]:await rl(n).lines[t](e)})}));e.command(`threads`).argument(`<line-id>`).description(`List this line's separate participant threads`).action((e,t)=>ol(async()=>{N(await rl(t).lines.threads(e).list())})),e.command(`messages`).argument(`<line-id>`).argument(`<thread-id>`).description(`Read one authorized participant thread`).action((e,t,n)=>ol(async()=>{N(await rl(n).lines.threads(e).messages(t))}))}async function ll(e){let{token:t,baseUrl:n}=Vn();if(t===void 0)return G(e);if(!t.startsWith(`lrc_`)||!n)throw Error(`The line box needs TANGLE_LINE_TOKEN and TANGLE_HUB_URL`);if(e.apiKey||e.baseUrl&&new URL(e.baseUrl).origin!==new URL(n).origin)throw Error(`A line token cannot be sent to another Hub or combined with an API key`);return new Oe({baseUrl:n,authHeaders:()=>({Authorization:`Bearer ${t}`})})}async function ul(e,t){if(t)return t;if(!Vn().token)throw Error(`Provide --line <line-id>`);return(await e.lines.context()).line.id}function dl(e){return e().catch(B)}function fl(){return new b(`context`).description(`Show live line identity, members, consent, reminders and quotas`).action(e=>dl(async()=>{N(await(await ll(e)).lines.context())}))}function pl(){let e=new b(`lines`).description(`Connect, manage, message and schedule on a Hub line`);return e.command(`members`).description(`List names, roles and consent on this line`).option(`--line <line-id>`,`Line ID; inferred in a line box`).action(e=>dl(async()=>{let t=await ll(e);N(await t.lines.members.list(await ul(t,e.line)))})),e.command(`send`).description(`Send to a consenting member through Hub`).argument(`<to-member>`,`Exact member ID for an owner; name, ID, or self in a line box`).argument(`<text>`,`Message text`).option(`--line <line-id>`,`Line ID; inferred in a line box`).option(`--on-behalf-of <member>`,`Verified sender for a member relay`).option(`--not-before <iso-time>`,`Delay delivery until this ISO time`).option(`--idempotency-key <key>`,`Stable key for a retry`).action((e,t,n)=>dl(async()=>{let r=await ll(n),i=await ul(r,n.line);if(!Vn().token){if(n.onBehalfOf)throw Error(`--on-behalf-of is only available inside a line box`);if(!n.idempotencyKey)throw Error(`Owner sends require --idempotency-key so a retry keeps the same message`);if(!(await r.lines.members.list(i)).some(t=>t.id===e))throw Error(`Owner sends require an exact member ID from tangle lines members`);N(await r.lines.send(i,{memberId:e,text:t,idempotencyKey:n.idempotencyKey,...n.notBefore?{notBefore:n.notBefore}:{}}));return}N(await r.lines.send(i,{toMember:e,text:t,...n.onBehalfOf?{onBehalfOf:n.onBehalfOf}:{},...n.notBefore?{notBefore:n.notBefore}:{},...n.idempotencyKey?{idempotencyKey:n.idempotencyKey}:{}}))})),e.command(`remind`).description(`Wake the agent at a future time to write your reminder`).argument(`<text>`,`What to remember`).requiredOption(`--at <iso-time>`,`Future ISO time`).option(`--line <line-id>`,`Line ID; inferred in a line box`).option(`--idempotency-key <key>`,`Stable key for a retry`).action((e,t)=>dl(async()=>{if(!t.at)throw Error(`--at is required`);let n=await ll(t),r=t.idempotencyKey??x(`sha256`).update(JSON.stringify([e,t.at])).digest(`hex`).slice(0,32);N(await n.lines.remind(await ul(n,t.line),{text:e,notBefore:t.at,idempotencyKey:r}))})),cl(e),e}function ml(){let e=new b(`mcp`).description(`Model Context Protocol bridge commands.`);return e.command(`serve <id-or-name>`).description(`Run a local MCP server (stdio) backed by the given sandbox (ID or name). Pipe its stdio from an MCP client config to expose sandbox tools.`).option(`-s, --session <id>`,`Session id for kernel scoping`,`mcp-local`).option(`--name <name>`,`MCP server name reported to clients`,`tangle-sandbox`).action(async(e,t)=>{let n=H({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=await K(U(n),n,e),i;try{i=(await import(`@modelcontextprotocol/sdk/server/stdio.js`)).StdioServerTransport}catch{throw Error("`@modelcontextprotocol/sdk` is not installed in this environment. Install it with: pnpm add -g @modelcontextprotocol/sdk (or as a dev dep in the project running this command).")}let{connect:a,close:o}=await Xe(r,{sessionId:t.session,name:t.name});await a(new i),process.stdin.resume(),process.stdin.on(`end`,()=>{o().finally(()=>process.exit(0))});for(let e of[`SIGINT`,`SIGTERM`])process.on(e,()=>{o().finally(()=>process.exit(0))})}),e}async function hl(e,t){if(t.self&&e)throw Error(`Use --self or an explicit sandbox, not both`);if(!t.self&&!e)throw Error(`Specify a sandbox id/name or --self`);let n=Nn(),r=t.baseUrl||n.tangleBaseUrl||n.sandboxBaseUrl,i=n.hubUrl;if(t.self&&!r&&i&&new URL(i).origin!==`https://id.tangle.tools`)throw Error(`This deployment must set SANDBOX_BASE_URL or pass --base-url for self preview access`);let a=t.self?t.apiKey??Zn():t.apiKey;if(t.self&&!a)throw Error(`Self preview access requires the injected sandbox runtime credential; it never reads saved owner credentials`);let o=H({apiKey:a,baseUrl:r}),s=U(o);return t.self?$e(s):K(s,o,e)}async function gl(e,t,n){let r=I(e);t||r.start();try{return await n()}finally{r.stop()}}function _l(e){return e}function vl(){let e=new b(`preview`).description(`Manage sandbox preview links`);return _l(e.command(`start`).description(`Start/reuse a managed development server and publish its ready preview`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`).option(`--cwd <directory>`,`Project directory in the selected workspace`).option(`--session <session-id>`,`Select the agent's session workspace`).option(`--name <name>`,`App/service label`)).action(async(e,t)=>{let n=await hl(e,t),r=await gl(`Starting managed preview...`,t.json,()=>Ze(n,{cwd:t.cwd,sessionId:t.session,name:t.name}));t.json?N(r):(P(`Preview ready: ${r.url}`),console.log(`Preview ID: ${r.previewId}`))}),_l(e.command(`list`).alias(`ls`).description(`List active preview links for a sandbox`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`)).action(async(e,t)=>{let n=await hl(e,t),r=await gl(`Fetching preview links...`,t.json,()=>n.previewLinks.list());t.json?N(r):r.length===0?console.log(`No preview links found`):It([`App`,`Preview ID`,`Port`,`URL`,`Status`],r.map(e=>[yl(e.metadata),e.previewId.slice(0,12),String(e.port),e.url,e.status]))}),_l(e.command(`publish`).description(`Publish one existing HTTP service; never starts or replaces a process`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`).requiredOption(`--port <port>`,`Existing service port`).option(`--name <name>`,`App/service label`)).action(async(e,t)=>{if(!t.port||!/^\d+$/.test(t.port))throw Error(`An integer service port is required`);let n=await hl(e,t),r=await gl(`Publishing service...`,t.json,()=>Qe(n,{port:Number(t.port),name:t.name}));t.json?N(r):P(`Preview ready: ${r.url}`)}),_l(e.command(`create`).description(`Create a preview link for a port`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<port>`,`Port number to preview`)).action(async(e,t,n)=>{if(!/^\d+$/.test(t)||Number(t)<1||Number(t)>65535)throw Error(`Port must be an integer between 1 and 65535`);let r=await hl(e,n),i=await gl(`Creating preview for port ${t}...`,n.json,()=>r.previewLinks.create(Number(t)));n.json?N(i):(P(`Preview created: ${i.url}`),console.log(`Preview ID: ${i.previewId}`))}),_l(e.command(`remove`).alias(`rm`).description(`Remove a preview link`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<preview-id>`,`Preview link ID (from 'preview list')`)).action(async(e,t,n)=>{let r=await hl(e,n);await gl(`Removing preview...`,n.json,()=>r.previewLinks.remove(t)),n.json?N({success:!0,previewId:t}):P(`Preview removed: ${t}`)}),e}function yl(e){let t=e?.app;if(!t||typeof t!=`object`)return``;let n=`name`in t?t.name:void 0,r=`cwd`in t?t.cwd:void 0;return typeof n==`string`?n:typeof r==`string`?r:``}function bl(){let e=new b(`process`).description(`Manage processes in a sandbox`);return e.command(`spawn`).description(`Spawn a process without blocking (returns PID)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command>`,`Command to execute`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`).option(`--blocking`,`Wait for completion (default: false)`).action(async(e,t,n)=>{let{context:r,client:i}=W(n),a=Wo(n.env??[],`--env`,`env`),o=I(`Spawning: ${t}`);n.json||o.start();let s=await K(i,r,e);if(s=await q(s),n.blocking){let e=await s.exec(t,{cwd:n.cwd,env:Object.keys(a).length>0?a:void 0,timeoutMs:n.timeout?Number.parseInt(n.timeout,10):void 0});o.stop(),n.json?N(e):(e.stdout&&globalThis.process.stdout.write(e.stdout),e.stderr&&globalThis.process.stderr.write(e.stderr),e.exitCode!==0&&globalThis.process.exit(e.exitCode))}else{let r=await s.process.spawn(t,{cwd:n.cwd,env:Object.keys(a).length>0?a:void 0,timeoutMs:n.timeout?Number.parseInt(n.timeout,10):void 0});o.stop(),n.json?N({pid:r.pid,command:r.command}):(console.log(`Process started with PID: ${r.pid}`),console.log(`Use 'tangle process logs ${e} ${r.pid}' to view output`))}}),e.command(`list`).alias(`ls`).description(`List all processes in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--running`,`Show only running processes`).action(async(e,t)=>{let{context:n,client:r}=W(t),i=I(`Fetching processes...`);t.json||i.start();let a=await K(r,n,e);a=await q(a);let o=await a.process.list();t.running&&(o=o.filter(e=>e.running)),i.stop(),t.json?N(o):o.length===0?console.log(`No processes found`):It([`PID`,`Command`,`Status`,`Exit Code`,`Started`],o.map(e=>[String(e.pid),e.command.length>40?`${e.command.slice(0,37)}...`:e.command,e.running?`running`:`exited`,String(e.exitCode),e.startedAt.toLocaleString()]))}),e.command(`get`).description(`Get detailed info about a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).action(async(e,t,n)=>{let{context:r,client:i}=W(n),a=I(`Fetching process info...`);n.json||a.start();let o=await K(i,r,e);o=await q(o);let s=await o.process.get(Number.parseInt(t,10));if(a.stop(),!s){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}let c=await s.status();n.json?N(c):(console.log(`PID: ${c.pid}`),console.log(`Command: ${c.command}`),console.log(`CWD: ${c.cwd||`(default)`}`),console.log(`Status: ${c.running?`running`:`exited`}`),console.log(`Exit Code: ${c.exitCode}`),c.exitSignal&&console.log(`Signal: ${c.exitSignal}`),console.log(`Started: ${c.startedAt.toLocaleString()}`),c.exitedAt&&console.log(`Exited: ${c.exitedAt.toLocaleString()}`))}),e.command(`kill`).description(`Kill a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`-s, --signal <signal>`,`Signal to send (SIGTERM, SIGKILL, etc.)`,`SIGTERM`).option(`--tree`,`Also kill descendants of the tracked process`).action(async(e,t,n)=>{let{context:r,client:i}=W(n),a=I(`Sending ${n.signal} to PID ${t}...`);n.json||a.start();let o=await K(i,r,e);o=await q(o);let s=await o.process.get(Number.parseInt(t,10));if(!s){a.stop(),console.error(`Process ${t} not found`),globalThis.process.exit(1);return}n.tree?await s.kill(n.signal,{tree:!0}):await s.kill(n.signal),a.stop(),n.json?N({pid:Number.parseInt(t,10),signal:n.signal,...n.tree===!0?{tree:!0}:{},killed:!0}):console.log(n.tree?`Sent ${n.signal} to process tree ${t}`:`Sent ${n.signal} to process ${t}`)}),e.command(`logs`).description(`Stream buffered and live process logs until the process exits`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`--stdout-only`,`Only show stdout`).option(`--stderr-only`,`Only show stderr`).action(async(e,t,n)=>{let{context:r,client:i}=W(n),a=await K(i,r,e);a=await q(a);let o=await a.process.get(Number.parseInt(t,10));if(!o){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}for await(let e of o.logs())n.stdoutOnly&&e.type!==`stdout`||n.stderrOnly&&e.type!==`stderr`||(n.json?console.log(JSON.stringify(e)):e.type===`stdout`?globalThis.process.stdout.write(e.data):globalThis.process.stderr.write(e.data))}),e}const xl=[`python`,`node`,`typescript`,`bash`];function Sl(e){switch(_e(e).toLowerCase()){case`.py`:return`python`;case`.js`:case`.mjs`:case`.cjs`:return`node`;case`.ts`:case`.tsx`:return`typescript`;case`.sh`:case`.bash`:return`bash`;default:return}}async function Cl(e){if(e===`-`){let e=[];for await(let t of process.stdin)e.push(typeof t==`string`?Buffer.from(t):t);return Buffer.concat(e).toString(`utf8`)}return await Ge(be(e),`utf8`)}async function wl(e,t,n=Cl){let r=t?xl.find(e=>e===t)??(()=>{throw Error(`unknown --lang ${t}: must be one of ${xl.join(`, `)}`)})():void 0;if(!e||e===`-`){if(!r)throw Error(`reading from stdin requires --lang. Example: tangle run <id> -l python -`);return{language:r,source:await n(`-`)}}let i=Sl(e);return{language:r??i??(()=>{throw Error(`cannot infer language from "${e}". Pass it explicitly: tangle run <id> -l <python|node|typescript|bash> ${e}`)})(),source:await n(e)}}function Tl(e){return D(Ce(),`tangle-run-images`,e)}function El(){return new b(`run`).description(`Run code in a persistent kernel inside a sandbox. Variables persist across calls in the same --session.`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`[file]`,`Path to source file. Language is inferred from extension. Use - for stdin (requires --lang).`).option(`-l, --lang <lang>`,`Force language: ${xl.join(` | `)}. Required for stdin.`).option(`-s, --session <id>`,`Session id for kernel scoping`).option(`-t, --timeout <ms>`,`Per-call timeout in ms (0 disables)`,`60000`).option(`--save-images <dir>`,`Write image results into this directory (default: $TMPDIR/tangle-run-images/<sandbox>/).`).option(`--no-save-images`,`Don't write image results to disk; print summary only`).action(async(e,t,n)=>{let{language:r,source:i}=await wl(t,n.lang),{context:a,client:o}=W(n),s=await K(o,a,e);s=await q(s);let c=I(`Running ${r} (${i.length}b)…`);n.json||c.start();let l=await s.runCode(r,i,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10)});if(c.stop(),n.json){N(l),l.exitCode!==0&&process.exit(l.exitCode);return}l.stdout&&process.stdout.write(l.stdout),l.stderr&&process.stderr.write(l.stderr);let u=0;for(let t of l.results)if(t.type===`image`)if(n.saveImages!==!1){let r=typeof n.saveImages==`string`?n.saveImages:Tl(e);de(r,{recursive:!0});let i=`${r}/${Date.now()}-${u}.${t.format}`;me(i,Buffer.from(t.data,`base64`)),process.stderr.write(y.green(`✓ image → ${i}\n`)),u++}else process.stderr.write(y.gray(`[image: ${t.format}, ${t.data.length}b base64]\n`));else if(t.type===`dataframe`){let e=t.columns.map(e=>`${e.name}:${e.dtype}`).join(` | `);process.stderr.write(y.gray(`[dataframe ${t.rows.length}×${t.columns.length}${t.truncated?` (truncated)`:``}]\n`)),process.stderr.write(`${e}\n`);for(let e of t.rows.slice(0,20))process.stderr.write(`${e.map(e=>String(e)).join(` | `)}\n`);t.rows.length>20&&process.stderr.write(y.gray(`… ${t.rows.length-20} more rows\n`))}else t.type===`json`?(process.stderr.write(y.gray(`[json] `)),process.stderr.write(`${JSON.stringify(t.value,null,2)}\n`)):t.type===`html`?process.stderr.write(y.gray(`[html ${t.value.length}b]\n`)):t.type===`error`?(process.stderr.write(y.red(`✗ ${t.name}: ${t.message}\n`)),t.traceback&&process.stderr.write(`${t.traceback}\n`)):t.type===`text`&&process.stderr.write(`${t.value}\n`);l.error&&(process.stderr.write(y.red(`\n✗ ${l.error.name}: ${l.error.message}\n`)),l.error.traceback&&process.stderr.write(`${l.error.traceback}\n`)),l.exitCode!==0&&process.exit(l.exitCode)})}async function Dl(e,t){let n=await Mr({apiKey:t.apiKey,baseUrl:t.baseUrl??ar()}),r=await fetch(`${n.baseUrl}/v1/agent-profiles/${encodeURIComponent(e)}`,{headers:{authorization:`Bearer ${n.token}`,accept:`application/json`}});if(!r.ok){let t=await r.text().catch(()=>``);throw r.status===404?Error(`profile '${e}' not found in the platform catalog (it may be a built-in, a stored profile you own, or neither — run 'tangle profile list' to see what is available)`):Error(`platform returned ${r.status}: ${t.slice(0,200)}`)}let i=await r.json();if(!i.definition||typeof i.definition!=`object`)throw Error(`profile '${e}' resolved but has no definition — the catalog entry is malformed`);return i.definition}async function Ol(e){let t=typeof e.envVarName==`string`&&e.envVarName.length>0?e.envVarName:null,n=!!e.fromStdin;if(t&&n)throw Error(`Pass either ${e.flagPrefix}-env or ${e.flagPrefix}-stdin, not both`);if(t){let n=process.env[t];if(!n||n.length===0)throw Error(`${e.flagPrefix}-env points at ${t}, but that environment variable is empty or unset`);return n}if(n){let t=await Xr();if(t.length===0)throw Error(`${e.flagPrefix}-stdin received empty input on stdin`);return t}}function kl(e){if(e.secret===void 0)return;let t=e.backend===`claude-code`?`token`:e.backend===`codex`?`bundle`:void 0;if(!t)throw Error(`--cli-auth needs --backend claude-code or --backend codex`);if(e.apiKeyGiven)throw Error(`--cli-auth cannot be combined with --backend-api-key-env or --backend-api-key-stdin`);return{account:`cli`,secretEnv:e.secret,format:t}}function Al(e){if(e!==void 0)return e.map(e=>{if(e.includes(`@`)||e.includes(`:`))throw Error(`--secret ${e}: bare secret names only (box delivery). For proxy custody use --proxy-secret with a canonical binding`);return e})}function jl(e,t){let n={};return e.cpu!==void 0&&(n.cpuCores=Go(e.cpu,`--cpu`)),e.memory!==void 0&&(n.memoryMB=Go(e.memory,`--memory`)),e.disk!==void 0&&(n.diskGB=Go(e.disk,`--disk`)),t&&(n.accelerator=t),Object.keys(n).length>0?n:void 0}function Ml(e){let t=e.split(`/`);return t.length>=2?{provider:t[0],model:t.slice(1).join(`/`)}:{model:e}}function Nl(e){let t={};for(let n of e){let[e,...r]=n.split(`=`);if(!e||r.length===0)throw Error(`--metadata expects values in KEY=VALUE or KEY=JSON format`);t[e]=Pl(r.join(`=`))}return t}function Pl(e){try{return JSON.parse(e)}catch{return e}}function Fl(e,t){if(!(!e.gitUrl&&!e.gitRef&&!e.gitDepth&&!e.gitSparse&&!t)){if(!e.gitUrl||typeof e.gitUrl!=`string`)throw Error(`--git-url is required when using git provisioning options`);return{url:e.gitUrl,ref:typeof e.gitRef==`string`?e.gitRef:void 0,depth:typeof e.gitDepth==`string`?Go(e.gitDepth,`--git-depth`):void 0,sparse:Array.isArray(e.gitSparse)?e.gitSparse:void 0,auth:t?{token:t}:void 0}}}function Il(e,t){if(!(!e.storageType&&!e.storageBucket&&!e.storageEndpoint&&!e.storageRegion&&!e.storagePrefix&&!e.storageAccessKeyId&&!t)){if(typeof e.storageType!=`string`||typeof e.storageBucket!=`string`||typeof e.storageAccessKeyId!=`string`||!t)throw Error(`Storage config requires --storage-type, --storage-bucket, --storage-access-key-id, and one of --storage-secret-access-key-env / --storage-secret-access-key-stdin`);return{type:Ll(e.storageType),bucket:e.storageBucket,endpoint:typeof e.storageEndpoint==`string`?e.storageEndpoint:void 0,region:typeof e.storageRegion==`string`?e.storageRegion:void 0,prefix:typeof e.storagePrefix==`string`?e.storagePrefix:void 0,credentials:{accessKeyId:e.storageAccessKeyId,secretAccessKey:t}}}}function Ll(e){if(e===`s3`||e===`gcs`||e===`r2`)return e;throw Error(`--storage-type must be one of s3, gcs, or r2`)}function Rl(e){if(e===void 0)return;let t=[];for(let n of e){let e=n,r=`--proxy-secret <json>`;if(n.startsWith(`@`)){let t=n.slice(1);r=`--proxy-secret @${t}`;try{e=fe(t,`utf8`)}catch{throw Error(`${r}: file could not be read`)}}let i;try{i=JSON.parse(e)}catch(e){throw Error(`${r}: not valid JSON (${e instanceof Error?e.message:String(e)})`)}if(Array.isArray(i))t.push(...i);else if(typeof i==`object`&&i)t.push(i);else throw Error(`${r}: expected a binding object or an array of bindings`)}let n=re.parse(t);return n.length>0?n:void 0}function zl(e){F(` Status: ${e.status}`),F(` Provider: ${e.provider}`),F(` GPU: ${e.accelerator.kind} x ${e.accelerator.count}`),e.customerPricePerHourUsd!==void 0&&F(` Customer price: $${e.customerPricePerHourUsd}/hr`),e.estimatedCustomerCostUsd!==void 0&&F(` Max estimate: $${e.estimatedCustomerCostUsd}`),e.billing&&(F(` Billed seconds: ${e.billing.seconds}`),F(` Customer cost: $${e.billing.customerCostUsd}`))}function Bl(e){e.result.stdout&&process.stdout.write(e.result.stdout),e.result.stderr&&process.stderr.write(e.result.stderr),F(`Exit code: ${e.result.exitCode}`)}function Vl(e){let t=e.command(`gpu`).description(`Manage on-demand GPU leases for a sandbox`);t.command(`providers <id-or-name>`).description(`List GPU clouds, whether each credential works, and current prices`).option(`--accelerator-kind <kind>`,`Price this GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`).option(`--accelerator-memory <mb>`,`Minimum GPU memory in MB`).action(async(e,t)=>{let{context:n,client:r}=W(t),i=I(`Checking GPU providers...`);i.start();let a=await(await K(r,n,e)).gpu.providers(t.acceleratorKind?{accelerator:zo({kind:t.acceleratorKind,count:t.acceleratorCount,memory:t.acceleratorMemory})}:{});if(i.stop(),t.json){N(a);return}M(a.statuses.map(e=>({provider:e.provider,state:e.state,gpu:e.estimate?.providerInstanceType??``,usdHr:e.estimate?e.estimate.customerPricePerHourUsd.toFixed(4):``,pricing:e.estimate?.pricingSource??``,needs:e.envVars.join(` `)})),[{key:`provider`,header:`Provider`},{key:`state`,header:`State`},{key:`gpu`,header:`GPU`},{key:`usdHr`,header:`$/hr`},{key:`pricing`,header:`Price`},{key:`needs`,header:`Needs`}]);for(let e of a.statuses){let t=e.state===`credential-invalid`?e.credential?.detail:e.estimateError;t&&F(`${e.provider}: ${t}`)}a.usable.length===0&&F(`No GPU provider is usable on this deployment: set the variables in Needs for one provider on the server.`)}),t.command(`attach <id-or-name>`).description(`Attach a temporary GPU worker to a sandbox`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum GPU memory in MB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).action(async(e,t)=>{let{context:n,client:r}=W(t),i=I(`Attaching GPU lease...`);i.start();let a=await(await K(r,n,e)).gpu.attach(Vo(t));i.stop(),t.json?N(a):(P(`GPU lease attached: ${a.id}`),zl(a))}),t.command(`run <id-or-name> <command...>`).description(`Attach a GPU, run a command or script, then destroy it`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum GPU memory in MB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker and command (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).action(async(e,t,n)=>{let r,i,a,o;try{let{context:a,client:o}=W(n),s=await K(o,a,e),c=I(`Attaching GPU lease...`);c.start(),r=await s.gpu.attach(Vo(n)),c.stop();let l=I(`Running GPU command...`);l.start(),i=await s.gpu.exec(r.id,{command:Ho(t),...Uo(n),cwd:n.cwd}),l.stop(),n.json||Bl(i)}catch(e){a=e}finally{if(r)try{let{context:t,client:i}=W(n);r=await(await K(i,t,e)).gpu.detach(r.id)}catch(e){o=e}}if(a){B(a),o&&B(o);return}if(o){B(o);return}n.json?N({lease:r,result:i}):r&&P(`GPU lease detached: ${r.id}`);let s=i?.result.exitCode;s&&s!==0&&(process.exitCode=s)}),t.command(`list <id-or-name>`).description(`List GPU leases attached to a sandbox`).action(async(e,t)=>{let{context:n,client:r}=W(t),i=I(`Fetching GPU leases...`);i.start();let a=await(await K(r,n,e)).gpu.list();i.stop(),t.json?N(a):a.length===0?F(`No GPU leases attached.`):M(a.map(e=>({id:e.id,status:e.status,provider:e.provider,accelerator:`${e.accelerator.kind}x${e.accelerator.count}`,customerUsdHr:e.customerPricePerHourUsd??``})),[{key:`id`,header:`ID`,width:28},{key:`status`,header:`Status`,width:12},{key:`provider`,header:`Provider`,width:12},{key:`accelerator`,header:`GPU`,width:24},{key:`customerUsdHr`,header:`$/hr`,width:10}])}),t.command(`exec <id-or-name> <lease-id> <command...>`).description(`Run a command or script on an attached GPU lease`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).action(async(e,t,n,r)=>{let{context:i,client:a}=W(r),o=I(`Running GPU command...`);o.start();let s=await(await K(a,i,e)).gpu.exec(t,{command:Ho(n),...Uo(r),cwd:r.cwd});o.stop(),r.json?N(s):Bl(s)}),t.command(`detach <id-or-name> <lease-id>`).description(`Detach and destroy a GPU lease`).action(async(e,t,n)=>{let{context:r,client:i}=W(n),a=I(`Detaching GPU lease...`);a.start();let o=await(await K(i,r,e)).gpu.detach(t);a.stop(),n.json?N(o):(P(`GPU lease detached: ${o.id}`),zl(o))})}function Hl(e,t){if(t){N(e);return}if(!e.id){e.kind===`snapshot`&&e.result?.snapshot?P(`Snapshot created: ${e.result.snapshot.snapshotId}`):P(`Sandbox ${e.sandboxId} stopped.`);return}P(`${e.kind===`snapshot`?`Snapshot`:`Stop`} of sandbox ${e.sandboxId} accepted.`),F(`Operation: ${e.id}`),F(`Status: ${e.statusUrl}`)}function Ul(e){return`${e.name} (${e.id})`}async function Wl(e,t){if(t.startsWith(`team_`))return e.teams.get(t);let n=(await e.teams.list()).filter(e=>e.name.toLowerCase()===t.toLowerCase());if(n.length===0)throw Error(`Team not found: ${t}`);if(n.length>1)throw Error(`Team name is ambiguous: ${t}. Use a team id instead.`);return n[0]}async function Gl(e,t,n){if(t)return Wl(e,t);let r=cr(n);if(!r.activeTeamId)throw Error("No active team. Run `tangle team switch <team>` or pass `--team <team>`.");return e.teams.get(r.activeTeamId)}function Kl(e,t){lr({id:e.id,name:e.name},t)}function ql(e){ur(e)}async function Jl(e){if(e.explicitTeam&&e.personal)throw Error(`--team and --personal cannot be used together`);if(!e.personal)return e.explicitTeam?(await Wl(e.client,e.explicitTeam)).id:e.activeTeamId}async function Yl(e){if([!!e.explicitTeam,!!e.personal,!!e.allScopes].filter(Boolean).length>1)throw Error(`--team, --personal, and --all-scopes are mutually exclusive`);if(e.allScopes)return`all`;if(e.personal)return`personal`;if(e.explicitTeam)return`team:${(await Wl(e.client,e.explicitTeam)).id}`;if(e.activeTeamId)return`team:${e.activeTeamId}`}function Xl(e){if(!e)return e;let t={...e};for(let e of[`authToken`,`execToken`])t[e]!==void 0&&(t[e]=`[REDACTED]`);return t}function Zl(e){e.command(`attestation <id-or-name>`).description(`Fetch TEE attestation evidence for a sandbox`).option(`--nonce <hex|auto>`,`Nonce to bind into a fresh attestation report; use auto to generate one`).action(async(e,t)=>{let{context:n,client:r}=W(t),i=t.nonce===`auto`?g():t.nonce,a=I(`Fetching TEE attestation...`);a.start();let o=await(await K(r,n,e)).getTeeAttestation(i?{attestationNonce:i}:void 0);a.stop(),t.json?N(o):(P(`Attestation fetched for ${e}`),console.log(`TEE type: ${o.attestation.tee_type}`),console.log(`Evidence bytes: ${o.attestation.evidence.length}`),console.log(`Measurement bytes: ${o.attestation.measurement.length}`),console.log(`Timestamp: ${o.attestation.timestamp}`),o.attestationNonce&&console.log(`Nonce: ${o.attestationNonce}`))}),e.command(`list`).description(`List all sandboxes`).option(`-s, --status <status>`,`Filter by status (running, stopped, all)`).option(`-l, --limit <n>`,`Limit results`,`50`).option(`--team <team>`,`List sandboxes for a team by id or name`).option(`--personal`,`List personal sandboxes`).option(`--all-scopes`,`List personal and team sandboxes`).action(async e=>{let{context:t,client:n}=W(e),r=I(`Fetching sandboxes...`);r.start();let i=await Yl({client:n,explicitTeam:e.team,personal:e.personal,allScopes:e.allScopes,activeTeamId:t.activeTeamId}),a=await n.list({status:e.status===`all`?void 0:e.status,limit:Number.parseInt(e.limit,10),scope:i});r.stop(),e.json?N(a):M(a.map(e=>({id:e.id,status:e.status,createdAt:e.createdAt,name:e.name??``})),[{key:`id`,header:`ID`,width:24},{key:`status`,header:`Status`,width:14},{key:`createdAt`,header:`Created`,width:16},{key:`name`,header:`Name`,width:20}])}),e.command(`get <id-or-name>`).description(`Get sandbox details`).option(`--profile`,`Show the active agent profile provenance (name, hash, skills)`).action(async(e,t)=>{let{context:n,client:r}=W(t),i=I(`Fetching sandbox...`);i.start();let a=await K(r,n,e);if(i.stop(),t.profile){let e=a.getProfileProvenance?.();e?(F(`Agent profile provenance:`),F(` Base profile: ${e.base.name??`(inline)`} (${e.base.sha256.slice(0,12)}...)`),F(` Effective: ${e.effective.name??`(inline)`} (${e.effective.sha256.slice(0,12)}...)`),F(` Materialized: ${e.materializedAt}`),e.base.sha256!==e.effective.sha256&&F(` ⚠ Profile changed since creation (base ≠ effective)`)):F(`No profile materialized (bare sandbox). Create with --profile <name> to install one.`);return}t.json?N(a):Ft({id:a.id,name:a.name,status:a.status,resources:a.resources,createdAt:a.createdAt?.toISOString(),expiresAt:a.expiresAt?.toISOString(),connection:a.connection})}),e.command(`shapes`).description(`List the named sandbox sizes, the default, and this account's ceiling`).action(async e=>{let{client:t}=W(e),n=await t.shapes();if(e.json){N(n);return}let r=e=>e.cpuCores<=n.ceiling.cpuCores&&e.memoryMB<=n.ceiling.memoryMB&&e.diskGB<=n.ceiling.diskGB;M(n.presets.map(e=>({name:e.name===n.default?`${e.name} (default)`:e.name,cpu:e.cpuCores,memory:`${e.memoryMB} MB`,disk:`${e.diskGB} GB`,available:r(e)?`yes`:e.name===n.default?`clamped to ceiling`:`above ceiling`})),[{key:`name`,header:`Shape`,width:18},{key:`cpu`,header:`vCPU`,width:6},{key:`memory`,header:`Memory`,width:10},{key:`disk`,header:`Disk`,width:8},{key:`available`,header:`Available`,width:14}]),F(`Ceiling for this account: ${Pt(n.ceiling)}`)}),e.command(`delete <id-or-name>`).description(`Delete a sandbox`).option(`-f, --force`,`Skip confirmation`).option(`--name`,`Treat the reference as a sandbox name`).option(`--retry-cleanup`,`Retry server-side cleanup after the sandbox disappeared from get/list`).action(async(e,t)=>{if(!t.force&&!await Jr(`Delete sandbox ${e}? [y/N] `,`--force`)){F(`Cancelled.`);return}let{context:n,client:r}=W(t),i=I(`Deleting sandbox...`);i.start();let a=await Vr(r,n,e,{retryCleanup:t.retryCleanup,name:t.name});i.stop(),P(a===`already_absent`?`Sandbox ${e} was already gone.`:`Sandbox ${e} deleted.`)}),e.command(`stop <id-or-name>`).description(`Stop a running sandbox`).option(`--name`,`Treat the reference as a sandbox name`).option(`--no-wait`,`Return once the stop is accepted and print the operation to poll`).action(async(e,t)=>{let{context:n,client:r}=W(t),i=I(`Stopping sandbox...`);i.start();let a=await K(r,n,e,{nameOnly:t.name});if(t.wait===!1){let e=await a.stop({wait:!1});i.stop(),Hl(e.info,!!t.json);return}await a.stop(),i.stop(),P(`Sandbox ${e} stopped.`)}),e.command(`resume <id-or-name>`).description(`Resume a stopped sandbox`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`-t, --timeout <ms>`,`Resume timeout in milliseconds; a cold resume re-provisions the sandbox, so this defaults higher than other commands (default 120000)`,`120000`).action(async(e,t)=>{let n=Number.parseInt(t.timeout,10);if(!Number.isFinite(n)||n<=0)throw Error(`--timeout must be a positive number of milliseconds`);let r=H({apiKey:t.apiKey,baseUrl:t.baseUrl,timeout:n}),i=U(r),a=I(`Resuming sandbox...`);a.start();let o=await K(i,r,e);await o.resume({timeoutMs:n}),t.wait&&(a.text=`Waiting for sandbox to start...`,await o.waitFor(`running`,{timeoutMs:n})),a.stop(),P(`Sandbox ${o.id} resumed.`)})}function Ql(e){e.command(`create`).description(`Create a new sandbox`).option(`-n, --name <name>`,`Sandbox name`).option(`-e, --environment <environment>`,`Named environment, container image, or built image ID`).option(`--bare`,`Create a bare sandbox without the agent runtime`).option(`--ssh`,`Enable SSH access`).option(`--ssh-key <key>`,`SSH public key for authentication`).option(`--ssh-keys <names...>`,`Stored SSH key names or IDs for authentication`).option(`--ssh-key-file <paths...>`,`SSH public key file paths for authentication`).option(`--web-terminal`,`Enable web terminal`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`--secret <names...>`,`Secrets selected by bare name for box delivery (value in the sandbox env). For proxy custody use --proxy-secret`).option(`--proxy-secret <bindings...>`,`Canonical proxy custody binding(s): one binding as inline JSON, or @file with a JSON array. The value stays at the egress proxy and is redeemed only within the binding's scope (hosts/methods/paths/TTL); the box reads a placeholder. Repeatable`).option(`--metadata <entries...>`,`Metadata entries (KEY=VALUE or KEY=JSON)`).option(`--cpu <cores>`,"CPU cores (omit for the platform default; see `sandbox shapes`)").option(`--memory <mb>`,`Memory in MB (omit for the platform default)`).option(`--disk <gb>`,`Disk size in GB (omit for the platform default)`).option(`--accelerator-kind <kind>`,`Accelerator kind, for example nvidia-h100 or amd-mi300x`).option(`--accelerator-count <count>`,`Accelerator device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum accelerator memory in MB`).option(`--gpu-provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum customer spend for the create-time GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum create-time GPU lease lifetime in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy the create-time GPU lease after this many idle seconds`).option(`--lifetime <seconds>`,`Max wall-clock lifetime before the sandbox is suspended — stopped, not deleted; resume it within the cold window (default 3600 = 1h). Raise it for long sessions, e.g. --lifetime 7200`,`3600`).option(`--idle-timeout <seconds>`,"Idle time before the sandbox is stopped — not deleted (default 900 = 15m). Resume it later with `tangle sandbox resume <id-or-name>`, or it auto-resumes on next use. Raise it for demos, e.g. --idle-timeout 3600",`900`).option(`--from-snapshot <id>`,`Create the sandbox from a snapshot`).option(`--public-template <id-or-slug>`,`Create the sandbox from a published public template`).option(`--public-template-version <id>`,`Pin creation to a specific published public-template version`).option(`--billing-owner <userId>`,`Platform user that pays for the sandbox. The API accepts this only from a first-party service key that is listed as a billing delegate, and refuses such a key that names no payer.`).option(`--team <team>`,`Create in a team by id or name`).option(`--personal`,`Create a personal sandbox even when a team is active`).option(`--git-url <url>`,`Git repository URL to clone during provisioning`).option(`--git-ref <ref>`,`Git branch, tag, or commit to checkout`).option(`--git-depth <depth>`,`Git clone depth`).option(`--git-sparse <paths...>`,`Sparse checkout paths`).option(`--git-token-env <name>`,`Name of an environment variable containing the Git HTTPS auth token`).option(`--git-token-stdin`,`Read the Git HTTPS auth token from stdin`).option(`--storage-type <type>`,`BYOS3 storage type (s3, gcs, r2)`).option(`--storage-bucket <name>`,`BYOS3 bucket name`).option(`--storage-endpoint <url>`,`BYOS3 endpoint URL`).option(`--storage-region <region>`,`BYOS3 region`).option(`--storage-prefix <prefix>`,`BYOS3 path prefix`).option(`--storage-access-key-id <id>`,`BYOS3 access key ID`).option(`--storage-secret-access-key-env <name>`,`Name of an environment variable containing the BYOS3 secret access key`).option(`--storage-secret-access-key-stdin`,`Read the BYOS3 secret access key from stdin`).option(`--driver <type>`,`Infrastructure driver (docker, firecracker, host-agent, tangle)`).option(`--driver-criu`,`Enable CRIU checkpointing (firecracker only)`).option(`--driver-region <region>`,`Preferred region for host-agent driver`).option(`--backend <type>`,`Backend agent type (${n.join(`, `)})`).option(`--backend-model <model>`,`Model override (format: provider/model)`).option(`--backend-api-key-env <name>`,`Name of an environment variable containing the BYOK backend API key`).option(`--backend-api-key-stdin`,`Read the BYOK backend API key from stdin`).option(`--cli-auth <secret>`,"Run --backend claude-code or codex on your own subscription: the stored secret holding a `claude setup-token` token or a Codex auth.json (see `tangle secret create`)").option(`--profile <path>`,`Path to an AgentProfile JSON file to install as the sandbox's backend profile (carries skills, tools, MCP, model). Use with --backend; the profile's inline skills materialize into the harness's native skill directory on first turn`).option(`--profile-stdin`,`Read the AgentProfile JSON from stdin instead of a file (use with --profile)`).option(`--tee <type>`,`Require a TEE backend (any, tdx, nitro, sev-snp, phala-dstack)`).option(`--sealed`,`Request TEE sealed-secret support`).option(`--attestation-nonce <hex|auto>`,`Deploy-time attestation nonce; use auto to generate one`).option(`--attestation-refresh`,`Generate a fresh deploy-time attestation nonce when --tee is set`).option(`--require-attestation`,`Fail unless TEE attestation evidence is returned`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`--timeout <ms>`,`HTTP timeout in milliseconds`,`30000`).action(async e=>{let t=await Ol({envVarName:e.gitTokenEnv,fromStdin:e.gitTokenStdin,flagPrefix:`--git-token`}),n=await Ol({envVarName:e.storageSecretAccessKeyEnv,fromStdin:e.storageSecretAccessKeyStdin,flagPrefix:`--storage-secret-access-key`}),r=await Ol({envVarName:e.backendApiKeyEnv,fromStdin:e.backendApiKeyStdin,flagPrefix:`--backend-api-key`}),i=kl({secret:e.cliAuth,backend:e.backend,apiKeyGiven:r!==void 0}),a;if(e.profileStdin){let e=await Xr(`--profile-stdin`,`the AgentProfile JSON`);try{a=JSON.parse(e)}catch{B(Error(`--profile-stdin: the input is not valid JSON`));return}}else if(e.profile){let t=String(e.profile);if(t.startsWith(`.`)||t.startsWith(`/`)||t.endsWith(`.json`))try{a=JSON.parse(fe(t,`utf8`))}catch(e){B(Error(`--profile ${t}: ${e.message}`));return}else try{a=await Dl(t,e)}catch(e){B(Error(`--profile ${t}: ${e.message}`));return}}let o=H({apiKey:e.apiKey,baseUrl:e.baseUrl,timeout:e.timeout?Number.parseInt(e.timeout,10):void 0}),s=U(o),c=I(`Creating sandbox...`);c.start();let l=await Jl({client:s,explicitTeam:e.team,personal:e.personal,activeTeamId:o.activeTeamId}),u=Wo(e.env??[],`--env`,`env`),d=e.metadata?Nl(e.metadata):void 0,f=Fl(e,t),p=Il(e,n),m=e.acceleratorKind?zo({kind:String(e.acceleratorKind),count:String(e.acceleratorCount),memory:typeof e.acceleratorMemory==`string`?e.acceleratorMemory:void 0}):void 0,g=Bo({provider:typeof e.gpuProvider==`string`?e.gpuProvider:void 0,image:typeof e.gpuWorkerImage==`string`?e.gpuWorkerImage:void 0,env:Array.isArray(e.gpuEnv)?e.gpuEnv:void 0,maxSpendUsd:typeof e.gpuMaxSpendUsd==`string`?e.gpuMaxSpendUsd:void 0,maxLifetime:typeof e.gpuMaxLifetime==`string`?e.gpuMaxLifetime:void 0,idleTimeout:typeof e.gpuIdleTimeout==`string`?e.gpuIdleTimeout:void 0},!!m,`Create-time GPU lease flags require --accelerator-kind`),v=e.driver?{type:e.driver,enableCriu:e.driverCriu||void 0,preferredRegion:e.driverRegion}:void 0,ee=e.backend||e.backendModel||a?{...e.backend?{type:_(e.backend)}:{},...a?{profile:a}:{},model:e.backendModel||r||i?{...e.backendModel?Ml(e.backendModel):{},apiKey:r,...i?{cliAuth:i}:{}}:void 0}:void 0,y=Al(e.secret),te=i?[...new Set([...y??[],i.secretEnv])]:y,b=Rl(e.proxySecret),x=jl(e,m),ne=e.sshKeyFile??(e.ssh&&!e.sshKey&&!e.sshKeys?.length?[$l()]:[]),S=[...e.sshKey?[e.sshKey]:[],...ne.map(e=>fe(e,`utf8`).trim())],re={name:e.name,environment:e.environment,bare:e.bare||void 0,sshEnabled:e.ssh||!!e.sshKey||S.length>0||!!e.sshKeys?.length,sshPublicKeys:S.length>0?S:void 0,sshKeyIds:e.sshKeys,webTerminalEnabled:e.webTerminal,env:Object.keys(u).length>0?u:void 0,git:f,...x?{resources:x}:{},gpuLease:g,maxLifetimeSeconds:Number.parseInt(e.lifetime,10),idleTimeoutSeconds:Number.parseInt(e.idleTimeout,10),storage:p,fromSnapshot:e.fromSnapshot,publicTemplateId:e.publicTemplate,publicTemplateVersionId:e.publicTemplateVersion,teamId:l,...e.billingOwner?{billingOwnerId:e.billingOwner}:{},secrets:te,...b?{proxySecrets:b}:{},metadata:d,driver:v,backend:ee},C=e.tee?{tee:e.tee,sealed:e.sealed||void 0,attestationRefresh:e.attestationRefresh||e.attestationNonce===`auto`||void 0}:void 0,ie=C?await h(s,{...re,confidential:C,attestationNonce:e.attestationNonce??(e.attestationRefresh?`auto`:void 0),requireAttestation:e.requireAttestation??!0}):void 0,w=ie?.sandbox??await s.create(re);e.wait&&(c.text=`Waiting for sandbox to start...`,await w.waitFor(`running`,{timeoutMs:12e4}),await w.refresh()),c.stop(),e.json?N({id:w.id,name:w.name,status:w.status,resources:w.resources,createdAt:w.createdAt,expiresAt:w.expiresAt,connection:Xl(w.connection),teamId:l,gpuLease:w.gpuLease,confidential:C,attestation:ie?.attestation,attestationNonce:ie?.attestationNonce}):(P(`Sandbox created: ${w.id}`),Ft({id:w.id,name:w.name,status:w.status,resources:w.resources,createdAt:w.createdAt?.toISOString(),expiresAt:w.expiresAt?.toISOString(),connection:w.connection}),l&&console.log(`Team: ${l}`),w.gpuLease&&(console.log(`GPU lease: ${w.gpuLease.id}`),zl(w.gpuLease)),C&&(console.log(`TEE: ${C.tee}`),console.log(`Attestation: ${ie?.attestation?`present`:`not returned`}`),ie?.attestationNonce&&console.log(`Attestation nonce: ${ie.attestationNonce}`)))})}function $l(){let e=[`id_ed25519`,`id_ecdsa`,`id_rsa`].map(e=>`${O()}/.ssh/${e}.pub`),t=e.find(e=>ue(e));if(!t)throw Error(`--ssh needs a public key and found none at ${e.join(`, `)}. Run ssh-keygen -t ed25519, or pass --ssh-key-file.`);return t}function eu(e){e.command(`network <id-or-name>`).description(`Show runtime network state (exposed ports) for a sandbox. Outbound policy is the sandbox's egress policy.`).action(async(e,t)=>{let{context:n,client:r}=W(t),i=I(`Updating network configuration...`);i.start();let a=await K(r,n,e);i.stop();let o=await a.network.getConfig();t.json?N(o):(F(`Network Configuration:`),o.ports&&o.ports.length>0?F(` Exposed Ports: ${o.ports.join(`, `)}`):F(` No exposed ports`))}),e.command(`expose <id-or-name>`).description(`Expose a port and get a public URL`).option(`-p, --port <port>`,`Port to expose`,`8000`).action(async(e,t)=>{let{context:n,client:r}=W(t),i=Number.parseInt(t.port,10);if(Number.isNaN(i)||i<1||i>65535)throw Error(`Port must be a number between 1 and 65535`);let a=I(`Exposing port ${i}...`);a.start();let o=await(await K(r,n,e)).network.exposePort(i);a.stop(),t.json?N({port:i,url:o}):(P(`Port ${i} exposed.`),F(` URL: ${o}`))}),e.command(`urls <id-or-name>`).description(`List exposed port URLs for a sandbox`).action(async(e,t)=>{let{context:n,client:r}=W(t),i=I(`Fetching exposed URLs...`);i.start();let a=await(await K(r,n,e)).network.listUrls();if(i.stop(),t.json)N(a);else{let e=Object.entries(a);if(e.length===0)F(`No ports exposed.`);else{F(`Exposed Ports:`);for(let[t,n]of e)F(` ${t}: ${n}`)}}})}function tu(){let e=new b(`sandbox`).description(`Manage sandboxes`);return Ql(e),Zl(e),Vl(e),eu(e),e}function nu(){return new b(`search`).description(`Search for text patterns in sandbox files (ripgrep)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pattern>`,`Search pattern (regex)`).option(`-g, --glob <pattern>`,`File glob filter (e.g. '**/*.ts')`).option(`-n, --max-results <count>`,`Max results to return`).option(`-i, --ignore-case`,`Case-insensitive search`).action(async(e,t,n)=>{let{context:r,client:i}=W(n),a=I(`Searching...`);n.json||a.start();let o=await K(i,r,e),s=0,c=n.maxResults?Number.parseInt(n.maxResults,10):void 0,l={};n.glob&&(l.glob=n.glob),n.ignoreCase&&(l.ignoreCase=!0),c&&(l.maxResults=c);for await(let e of o.search(t,l))if(s===0&&a.stop(),s++,n.json?console.log(JSON.stringify(e)):console.log(`${e.path}:${e.line}:${e.column??0}: ${e.text}`),c&&s>=c)break;a.stop(),s===0&&!n.json&&console.log(`No matches found`)})}function ru(){let e=new b(`secret`).description(`Manage secrets`);return e.command(`create`).description(`Create a new secret`).argument(`<name>`,`Secret name (e.g., HF_TOKEN, AWS_ACCESS_KEY)`).argument(`[value]`,`Secret value`).option(`--value-stdin`,`Read secret value from stdin`).action(async(e,t,n)=>{let r=await W(n).client.secrets.create(e,await iu({value:t,valueStdin:n.valueStdin,prompt:`Enter value for secret '${e}': `}));n.json?N(r):(P(`Secret created: ${r.name}`),F(`Use --secret ${r.name} when creating a sandbox to select it for delivery.`))}),e.command(`list`).description(`List all secrets`).action(async e=>{let t=await W(e).client.secrets.list();e.json?N(t):t.length===0?(F(`No secrets found.`),F(`Use 'tangle secret create <name> [value]' to create one.`)):It([`Name`,`Created At`,`Updated At`],t.map(e=>[e.name,e.createdAt.toLocaleString(),e.updatedAt.toLocaleString()]))}),e.command(`delete`).description(`Delete a secret`).argument(`<name>`,`Secret name`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=W(t).client;if(!t.force&&!await Jr(`Are you sure you want to delete secret '${e}'? This cannot be undone. (y/N) `,`--force`)){F(`Cancelled.`);return}await n.secrets.delete(e),t.json?N({success:!0,deleted:e}):P(`Secret deleted: ${e}`)}),e}async function iu(e){if(e.value!==void 0&&e.valueStdin)throw Error(`Provide either a secret value argument or --value-stdin, not both`);let t=e.value??(e.valueStdin?await Xr():await qr(e.prompt));if(!t.length)throw Error(e.valueStdin?`Secret value from stdin cannot be empty`:`Secret value cannot be empty`);return t}function au(){let e=new b(`skill`).description(`Print paths to shipped skill documentation`);return e.command(`path`).description(`Print the absolute path to the SKILL.md shipped with this CLI`).action(()=>{let e=E.dirname(et(import.meta.url)),t=E.resolve(e,`..`,`SKILL.md`);console.log(t)}),e}function ou(){let e=new b(`snapshot`).description(`Manage snapshots`);return e.command(`create <sandbox-id-or-name>`).description(`Create a snapshot of a sandbox`).option(`--tags <tags...>`,`Tags for the snapshot`).option(`--no-wait`,`Return once the snapshot is accepted and print the operation to poll`).action(async(e,t)=>{let{context:n,client:r}=W(t),i=I(`Creating snapshot...`);i.start();let a=await K(r,n,e);if(t.wait===!1){let e=await a.snapshot({tags:t.tags,wait:!1});i.stop(),Hl(e.info,!!t.json);return}let o=await a.snapshot({tags:t.tags});i.stop(),t.json?N(o):(P(`Snapshot created: ${o.snapshotId}`),console.log(`Size: ${su(o.sizeBytes??0)}`))}),e.command(`list <sandbox-id-or-name>`).description(`List snapshots for a sandbox`).action(async(e,t)=>{let{context:n,client:r}=W(t),i=I(`Fetching snapshots...`);i.start();let a=await(await K(r,n,e)).listSnapshots();i.stop(),t.json?N(a):M(a.map(e=>({...e,size:su(e.sizeBytes??0)})),[{key:`snapshotId`,header:`ID`,width:24},{key:`createdAt`,header:`Created`,width:16},{key:`size`,header:`Size`,width:12},{key:`sandboxId`,header:`Sandbox`,width:20}])}),e.command(`restore <sandbox-id> <snapshot-id>`).description(`Create a new sandbox from a snapshot`).option(`--billing-owner <userId>`,`Platform user that pays for the restored sandbox. The API accepts this only from a first-party service key that is listed as a billing delegate, and refuses such a key that names no payer.`).action(async(e,t,n)=>{let{client:r}=W(n),i=I(`Restoring from snapshot...`);i.start();let a=await r.create({fromSnapshot:t,fromSandboxId:e,...n.billingOwner?{billingOwnerId:n.billingOwner}:{}});await a.waitFor(`running`,{timeoutMs:12e4}),i.stop(),n.json?N({sandboxId:a.id,restoredFrom:t,status:a.status}):(P(`New sandbox created: ${a.id}`),console.log(`Source snapshot: ${t}`))}),e.command(`revert <sandbox-id-or-name> <snapshot-id>`).description(`Revert an existing sandbox to a snapshot`).action(async(e,t,n)=>{let{context:r,client:i}=W(n),a=I(`Reverting sandbox to snapshot...`);a.start();let o=await K(i,r,e),s=await o.revertToSnapshot(t);await o.refresh(),a.stop(),n.json?N({sandboxId:o.id,snapshotId:s.snapshotId,status:o.status}):(P(`Sandbox reverted: ${o.id}`),console.log(`Source snapshot: ${s.snapshotId}`))}),e.command(`delete <sandbox-id-or-name> <snapshot-id>`).description(`Delete a sandbox snapshot`).action(async(e,t,n)=>{let{context:r,client:i}=W(n),a=I(`Deleting snapshot...`);a.start();let o=await(await K(i,r,e)).deleteSnapshot(t);a.stop(),n.json?N({success:!0,sandboxId:e,snapshotId:t,outcome:o.outcome}):o.outcome===`already_absent`?P(`Snapshot already gone: ${t}`):P(`Snapshot deleted: ${t}`)}),e}function su(e){if(e===0)return`0 B`;let t=1024,n=[`B`,`KB`,`MB`,`GB`,`TB`],r=Math.floor(Math.log(e)/Math.log(t));return`${Number.parseFloat((e/t**r).toFixed(1))} ${n[r]}`}const cu=`solve:device:secp256k1`,lu=/^0x[0-9a-f]{64}$/i;function uu(e){return e&&lu.test(e)?e:void 0}function du(){let e=un(cu),t=uu(e.value);if(!(!t||e.source===`none`))return{account:nt(t),source:e.source}}function fu(){let e=du();if(e)return e;let t=tt(),n=dn(cu,t);return{account:nt(t),source:n}}function pu(e){let t=uu(un(cu).value);if(!t||nt(t).address!==e.account.address)throw Error(`The local Solve device key changed; it was not retired`);let n=`${cu}:retired:${e.account.address.toLowerCase()}`;if(dn(n,t),un(n).value!==t)throw Error(`The revoked device key could not be retired safely`);return pn(cu),n}function mu(e){let t=e.create?fu():du();if(!t)throw Error("No Solve device signer found. Run `tangle solve account --create`");e.json?N({address:t.account.address,source:t.source}):L({Address:t.account.address,Source:t.source})}const hu=/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;function gu(e){return[...e].some(e=>{let t=e.charCodeAt(0);return t<32||t===127})}function _u(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`${t} must be an object`);return e}function vu(e,t,n=2048){if(typeof e!=`string`||!e.trim()||e.length>n)throw Error(`${t} is missing or invalid`);if(gu(e))throw Error(`${t} contains control characters`);return e.trim()}function yu(e,t){let n=vu(e,t,64).toLowerCase();if(!hu.test(n))throw Error(`${t} must be a 40 or 64 character Git revision`);return n}function bu(e,t,n=!1){let r=typeof e==`number`&&Number.isSafeInteger(e)?String(e):vu(e,t,80);if(!/^\d+$/.test(r)||!n&&r===`0`)throw Error(`${t} must be an unsigned integer`);return BigInt(r).toString()}function xu(e,t){let n=vu(e,t,2048),r=new URL(n);if(r.protocol!==`https:`&&!(r.protocol===`http:`&&(r.hostname===`localhost`||r.hostname===`127.0.0.1`)))throw Error(`${t} must use HTTPS outside local development`);return n.replace(/\/$/,``)}function Su(e,t){let n=xu(e,t).replace(/\.git$/,``),r=new URL(n),i=r.pathname.split(`/`).filter(Boolean);if(r.hostname!==`github.com`||r.username||r.password||r.search||r.hash||i.length!==2)throw Error(`${t} must be an HTTPS GitHub repository URL`);return`https://github.com/${i.join(`/`)}`}function Cu(e,t){let n=vu(e,t,42);if(!dt(n,{strict:!1}))throw Error(`${t} must be an EVM address`);return lt(n)}function wu(e,t){let n=bu(e,t),r=Number(n);if(!Number.isSafeInteger(r)||r<=0)throw Error(`${t} is out of range`);return r}function Tu(...e){for(let t of e)if(typeof t==`string`&&t.trim())return t.trim()}function Eu(e){let t=e.trim().replace(/\.git$/,``);return t.startsWith(`git@github.com:`)?`https://github.com/${t.slice(15)}`:t.startsWith(`ssh://git@github.com/`)?`https://github.com/${t.slice(21)}`:t}function Du(e){if(e===void 0)return;let t=vu(e,`pull request URL`,2048);if(!/^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/\d+(?:\/[^\s]*)?$/i.test(t))throw Error(`pull request URL must point to a GitHub pull request`);return t}function Ou(e,t){if(!/^https:\/\/[^\s]+$/i.test(e)&&!/^\/(?!\/).*$/.test(e)&&!/^[a-z][a-z0-9+.-]*:[^\s]+$/i.test(e))throw Error(`${t} must be an HTTPS URL or an absolute repository path`);if(e.split(/[?#]/,1)[0].split(`/`).includes(`..`))throw Error(`${t} cannot contain parent-directory segments`);return e}function ku(e){return Pn(`solve`,e.profile)}function Au(e){let t=ku(e),n=$n(void 0,t);if(!n)throw Error(`No Solve credential found for profile '${t}'. Run: tangle auth login --provider github --app solve`);return n}async function ju(e){let t=or(e.apiUrl),n=await fetch(`${t}${e.path}`,{method:e.method??`GET`,headers:{Accept:`application/json`,...e.body===void 0?{}:{"Content-Type":`application/json`},Authorization:`Bearer ${Au(e)}`},...e.body===void 0?{}:{body:JSON.stringify(e.body)},signal:AbortSignal.timeout(3e4)}),r=await n.json().catch(()=>null);if(!n.ok||!r?.success||r.data===void 0){let e=r?.error?.message??`Solve API request failed with HTTP ${n.status}`;throw Error(r?.error?.code?`${r.error.code}: ${e}`:e)}return r.data}function Mu(e){return ju({path:`/v1/wallet/challenges`,method:`POST`,apiUrl:e.apiUrl,profile:e.profile,body:{deviceAddress:e.deviceAddress,...e.purpose?{purpose:e.purpose}:{}}})}function Nu(e){return ju({path:`/v1/devices`,apiUrl:e.apiUrl,profile:e.profile})}function Pu(e){return ju({path:`/v1/devices/revoke`,method:`POST`,apiUrl:e.apiUrl,profile:e.profile,body:{deviceAddress:e.deviceAddress,...e.reason?{reason:e.reason}:{},...e.challengeId&&e.signature?{challengeId:e.challengeId,signature:e.signature}:{}}})}const Q={chainId:42431,rpcUrl:`https://rpc.moderato.tempo.xyz`,sponsorUrl:`https://drew-gtr-pro.taild10bfc.ts.net/solve-sponsor`,tangleAddress:`0xff137B9C879c47C28ce389e84501925438AB4cdA`,managerAddress:`0x5271732F893B622ac6793d6DBA5B2626CCa4EA14`,paymentAsset:`0x20C0000000000000000000000000000000000000`,blueprintId:15n,serviceId:9n,competitionId:1n,minStakeWei:0n};function Fu(e,t){return e.toLowerCase()===t.toLowerCase()}function Iu(e){if(e.chainId!==Q.chainId)throw Error(`Solve submissions require Tempo Moderato (chain ${Q.chainId}); received ${e.chainId}`);if(e.rpcUrl!==Q.rpcUrl)throw Error(`Solve metadata RPC does not match the trusted deployment`);if(e.sponsorUrl!==Q.sponsorUrl)throw Error(`Solve metadata sponsor does not match the trusted deployment`);if(!Fu(e.tangleAddress,Q.tangleAddress))throw Error(`Solve metadata Tangle contract does not match the trusted deployment`);if(!Fu(e.managerAddress,Q.managerAddress))throw Error(`Solve metadata competition manager does not match the trusted deployment`);if(!Fu(e.paymentAsset,Q.paymentAsset))throw Error(`Solve metadata payment asset does not match the trusted deployment`);if(e.blueprintId!==Q.blueprintId)throw Error(`Solve submissions require blueprint ${Q.blueprintId}; received ${e.blueprintId}`);if(e.serviceId!==Q.serviceId)throw Error(`Solve submissions require service ${Q.serviceId}; received ${e.serviceId}`);if(e.competitionId!==Q.competitionId)throw Error(`Solve submissions require competition ${Q.competitionId}; received ${e.competitionId}`);if(e.minStakeWei!==Q.minStakeWei)throw Error(`Solve submissions require zero stake for the trusted deployment`)}function Lu(e,t){let n=_u(t.check??e.check,`competition.participation.check`),r=vu(n.command,`competition.participation.check.command`,512);if(!Array.isArray(n.args)||n.args.some(e=>typeof e!=`string`))throw Error(`competition.participation.check.args must be an array of strings`);let i=n.args.map(e=>vu(e,`competition checker argument`,2048)),a=Tu(n.result_file,n.resultFile),o=n.timeout_ms??n.timeoutMs,s=o===void 0?void 0:wu(o,`competition checker timeout`);return{command:r,args:i,...a?{result_file:a}:{},...s?{timeout_ms:s}:{}}}function Ru(e){if(e.provenance===void 0)return;let t=_u(e.provenance,`competition.participation.provenance`);if(t.mode!==`github_pull_request`)throw Error(`competition.participation.provenance.mode is unsupported`);if(t.required!==void 0&&typeof t.required!=`boolean`)throw Error(`competition.participation.provenance.required must be a boolean`);return{mode:`github_pull_request`,required:t.required===!0}}function zu(e){let t=_u(e.chain??e.network??{},`competition.chain`),n=e.rewards&&typeof e.rewards==`object`&&!Array.isArray(e.rewards)?_u(e.rewards,`competition.rewards`):{},r=n.minStake&&typeof n.minStake==`object`&&!Array.isArray(n.minStake)?_u(n.minStake,`competition.rewards.minStake`).raw:void 0,i=Tu(t.minStakeWei,t.min_stake_wei,e.minStakeWei,e.min_stake_wei,r),a=t.chainId??t.chain_id??e.chainId??e.chain_id,o=Tu(t.chainName,t.chain_name,e.chainName,e.chain_name)??`Tempo`,s=Tu(t.nativeSymbol,t.native_symbol,e.nativeSymbol,e.native_symbol)??`TNT`,c=Tu(t.rpcUrl,t.rpc_url,e.rpcUrl,e.rpc_url,process.env.TANGLE_SOLVE_RPC_URL),l=Tu(t.sponsorUrl,t.sponsor_url,e.sponsorUrl,e.sponsor_url,process.env.TANGLE_SOLVE_SPONSOR_URL),u=Tu(t.tangleAddress,t.tangle_address,t.coreAddress,t.core_address,e.tangleAddress,e.tangle_address,e.coreAddress,e.core_address),d=Tu(t.managerAddress,t.manager_address,e.managerAddress,e.manager_address),f=Tu(t.paymentAsset,t.payment_asset,t.servicePaymentAsset,t.service_payment_asset,e.paymentAsset,e.payment_asset,e.servicePaymentAsset,e.service_payment_asset),p=Tu(t.blueprintId,t.blueprint_id,e.blueprintId,e.blueprint_id),m=Tu(t.serviceId,t.service_id,e.serviceId,e.service_id),h=Tu(t.competitionId,t.competition_id,e.competitionId,e.competition_id,e.id);if(!c||!l||!u||!d||!p||!m||!h||!i||a===void 0)throw Error(`Solve competition metadata must include complete Tempo chain configuration`);return{chainId:wu(a,`chain.chainId`),chainName:o,nativeSymbol:s,rpcUrl:xu(c,`chain.rpcUrl`),sponsorUrl:xu(l,`chain.sponsorUrl`),tangleAddress:Cu(u,`chain.tangleAddress`),managerAddress:Cu(d,`chain.managerAddress`),paymentAsset:Cu(f??Q.paymentAsset,`chain.paymentAsset`),blueprintId:bu(p,`chain.blueprintId`),serviceId:bu(m,`chain.serviceId`),competitionId:bu(h,`chain.competitionId`,!0),minStakeWei:bu(i,`chain.minStakeWei`,!0)}}function Bu(e){let t=_u(e,`competition`),n=_u(t.participation??t.task,`competition.task`),r={...t,participation:{...n,...n.repositoryRevision===void 0&&n.revision!==void 0?{repositoryRevision:n.revision}:{}}},i=r.participation,a=Su(Tu(r.repository,r.repo_url,i.repository)??``,`competition.repository`),o=yu(Tu(r.repositoryRevision,r.repository_revision,i.revision,i.repositoryRevision,i.repository_revision),`competition.repositoryRevision`),s=vu(r.slug??r.id,`competition.slug`,128),c=vu(r.name??r.title??s,`competition.name`,256),l=Lu(r,i),u=Ru(i);return{version:1,slug:s,title:c,repository:a,taskRevision:o,checker:l,chain:zu(r),...u?{provenance:u}:{}}}function Vu(e){return{chainId:e.chain.chainId,chainName:e.chain.chainName,nativeSymbol:e.chain.nativeSymbol,rpcUrl:e.chain.rpcUrl,sponsorUrl:e.chain.sponsorUrl,tangleAddress:e.chain.tangleAddress,managerAddress:e.chain.managerAddress,paymentAsset:e.chain.paymentAsset,blueprintId:BigInt(e.chain.blueprintId),serviceId:BigInt(e.chain.serviceId),competitionId:BigInt(e.chain.competitionId),minStakeWei:BigInt(e.chain.minStakeWei)}}async function Hu(e){let t=_u(JSON.parse(await A.readFile(E.join(e,`.tangle-solve.json`),`utf8`)),`.tangle-solve.json`);if(t.version!==1)throw Error(`.tangle-solve.json has an unsupported version`);let n=_u(t.checker,`.tangle-solve.json.checker`),r=_u(t.chain,`.tangle-solve.json.chain`);return Bu({slug:t.slug,name:t.title,repository:t.repository,repositoryRevision:t.taskRevision,participation:{check:n,provenance:t.provenance},chain:r,competitionId:r.competitionId})}const Uu=rt(we),Wu=`.tangle-solve-run.json`,Gu=`.tangle-solve.json`,Ku=`tangle.solve.manifestSha256`,qu=new Set([Gu,Wu]),Ju=`upstream`;async function Yu(e,t){let n=await Uu(`git`,[`-C`,e,...t],{encoding:`utf8`,maxBuffer:1e6});return String(n.stdout).trim()}async function Xu(e,t){let n=E.resolve(t??process.cwd()),r=await Hu(n);if(e&&e!==r.slug&&e!==r.chain.competitionId)throw Error(`This directory contains '${r.slug}', not '${e}'`);return{root:n,manifest:r}}async function Zu(e){let t=E.join(e,Gu),n;try{n=await A.lstat(t)}catch{throw Error(`${Gu} is missing`)}if(n.isSymbolicLink()||!n.isFile())throw Error(`${Gu} must be a regular file`);return x(`sha256`).update(await A.readFile(t)).digest(`hex`)}async function Qu(e){let t=await Zu(e);return await Yu(e,[`config`,`--local`,`--replace-all`,Ku,t]),t}async function $u(e){let t;try{t=await Yu(e,[`config`,`--local`,`--get`,Ku])}catch{throw Error(`The local Git metadata has no ${Ku} pin; run tangle solve clone again`)}if(!/^[0-9a-f]{64}$/i.test(t))throw Error(`The local ${Ku} pin is invalid`);if(await Zu(e)!==t.toLowerCase())throw Error(`${Gu} changed after clone; run tangle solve clone again`)}async function ed(e,t){try{return await Yu(e,[`ls-files`,`--error-unmatch`,`--`,t]),!0}catch{return!1}}async function td(e){await $u(e);for(let t of qu)if(await ed(e,t))throw Error(`${t} must remain untracked and local to this Solve workspace`);let t=await Uu(`git`,[`-C`,e,`status`,`--porcelain=v1`,`--untracked-files=all`,`--ignored=matching`],{encoding:`utf8`,maxBuffer:1e6});if(String(t.stdout).split(/\r?\n/).filter(Boolean).filter(e=>{let t=e.slice(0,2),n=e.slice(3);return!((t===`??`||t===`!!`)&&qu.has(n))}).length>0)throw Error(`Commit the candidate before running Solve. Only the local manifest and run record may remain uncommitted.`);return yu(await Yu(e,[`rev-parse`,`HEAD`]),`submission revision`)}async function nd(e,t,n,r={}){let i=await rd(e,t,r);if(i)return{taskRepository:t.repository,taskRevision:t.taskRevision,submissionRepository:i,submissionRevision:n}}async function rd(e,t,n={}){let r;try{r=Eu(await Yu(e,[`config`,`--get`,`remote.origin.pushurl`]))}catch{try{r=Eu(await Yu(e,[`config`,`--get`,`remote.origin.url`]))}catch{if(n.allowMissing)return;throw Error(`Add your GitHub fork as the 'origin' remote before submitting. The task repository is available as '${Ju}'.`)}}let i=Su(r,`git remote.origin.url`);if(i.toLowerCase()===t.repository.toLowerCase()){if(n.allowMissing)return;throw Error(`The 'origin' remote is the task repository. Add your GitHub fork as 'origin'; keep the task repository as '${Ju}' before submitting.`)}return i}function id(e,t){return!e||!t?!1:e.taskRepository.toLowerCase()===t.taskRepository.toLowerCase()&&e.taskRevision.toLowerCase()===t.taskRevision.toLowerCase()&&e.submissionRepository.toLowerCase()===t.submissionRepository.toLowerCase()&&e.submissionRevision.toLowerCase()===t.submissionRevision.toLowerCase()}function ad(e,t){return`${e}/commit/${t}`}function od(e,t,n,r,i={}){let a=e.evidenceRefs.map(e=>Ou(e.trim(),`checker evidence reference`));if(n){if(!t){if(i.allowMissingSource)return{evidence:e.evidence,evidenceRefs:a};throw Error(`Provenance policy requires a submission source`)}let o=Du(r);if(n.required&&(i.requirePullRequest??!0)&&!o)throw Error(`This competition requires a GitHub pull request`);a.push(ad(t.taskRepository,t.taskRevision),ad(t.submissionRepository,t.submissionRevision),...o?[o]:[])}return{evidence:e.evidence,evidenceRefs:[...new Set(a)]}}async function sd(e,t){let n=`${e}.${process.pid}.tmp`;await A.writeFile(n,`${JSON.stringify(t,null,2)}\n`,{mode:384}),await A.rename(n,e)}async function cd(e){let t=JSON.parse(await A.readFile(E.join(e,Wu),`utf8`));if(t.version!==1||typeof t.competition!=`string`)throw Error(`${Wu} has an unsupported format`);return t}async function ld(e){let t=Du(e.pullRequest);if(!t)throw Error(`A pull request URL is required`);let n=new URL(t).pathname.split(`/`).filter(Boolean),r=await fetch(`https://api.github.com/repos/${n[0]}/${n[1]}/pulls/${n[3]}`,{headers:{Accept:`application/vnd.github+json`,"User-Agent":`tangle-solve-cli`},signal:AbortSignal.timeout(15e3)}),i=await r.json().catch(()=>null),a=e=>e.replace(/\/$/,``).toLowerCase();if(!r.ok||a(i?.base?.repo?.html_url??``)!==a(e.taskRepository)||i?.head?.sha?.toLowerCase()!==e.submissionRevision.toLowerCase()||a(i?.head?.repo?.html_url??``)!==a(e.submissionRepository))throw Error(`GitHub pull request must target the pinned task repository and contain the current committed submission`)}function ud(e){return{...e.authorization?{authorization:e.authorization}:{},...e.stake?{stake:e.stake}:{},join:e.join,commit:e.commit,reveal:e.reveal,report:e.report,evaluation:e.evaluation}}const dd=rt(we);function fd(){return`Task source is '${Ju}'. Add your fork as 'origin', commit your candidate, push it, and open a pull request before submitting.`}async function pd(e,t,n){try{let r=_u(await ju({path:`/v1/competitions/${encodeURIComponent(e)}`,apiUrl:n.apiUrl,profile:n.profile}),`competition response`),i=Bu(r.competition??r),a=E.resolve(t??i.slug),o=I(`Cloning ${i.slug}…`);n.json||o.start();try{await dd(`git`,[`clone`,`--no-tags`,`--origin`,Ju,i.repository,a],{encoding:`utf8`,maxBuffer:1e6}),await Yu(a,[`checkout`,`--detach`,i.taskRevision]);let e=await Yu(a,[`rev-parse`,`HEAD`]);if(e.toLowerCase()!==i.taskRevision.toLowerCase())throw Error(`Pinned checkout resolved to ${e}, expected ${i.taskRevision}`);await sd(E.join(a,`.tangle-solve.json`),i),await Qu(a)}finally{o.stop()}n.json?N({competition:i,directory:a}):(P(`Cloned ${i.slug} at ${i.taskRevision.slice(0,12)}`),i.provenance&&F(fd()),F(`Run the pinned checker with: cd ${a} && tangle solve run`))}catch(e){B(e)}}const md=12e4,hd=mt(`event JobSubmitted(uint64 indexed serviceId, uint64 indexed callId, uint8 jobIndex, address caller, bytes inputs)`),gd=mt(`event JobCompleted(uint64 indexed serviceId, uint64 indexed callId)`),_d=mt(`event JobResultSubmitted(uint64 indexed serviceId, uint64 indexed callId, address indexed operator, bytes result)`),vd=mt(`event AggregatedResultSubmitted(uint64 indexed serviceId, uint64 indexed callId, uint256 signerBitmap, bytes output)`),yd=mt(`event EvaluationAccepted(uint64 indexed serviceId, uint64 indexed competitionId, address indexed researcher, bytes32 candidateId, bytes32 submissionRefHash, bytes32 evaluationDigest, bytes32 metricsHash, bytes32 evidenceRefsHash)`),bd=[...pt([`function submitJob(uint64 serviceId, uint8 jobIndex, bytes inputs) payable returns (uint64 callId)`,`function getJobEventRate(uint64 blueprintId, uint8 jobIndex) view returns (uint256 rate)`,`function getServicePaymentAsset(uint64 serviceId) view returns (address)`,`function isPermittedCaller(uint64 serviceId, address caller) view returns (bool)`]),hd,gd,_d,vd],xd=pt([`function authorizeSelf(uint64 serviceId)`,`function revokeSelf(uint64 serviceId)`,`function isDeviceRevoked(address device) view returns (bool)`,`function postStake(uint64 serviceId, uint64 competitionId) payable`,`function stakes(uint64 serviceId, uint64 competitionId, address researcher) view returns (uint256)`,`function pendingResults(uint64 serviceId, uint64 jobCallId) view returns (uint8 job, bytes32 outputHash, uint256 signerBitmap, bool exists, bool executed)`,`function executePendingResult(uint64 serviceId, uint64 jobCallId, bytes output)`,`function acceptedCandidates(uint64 serviceId, uint64 competitionId, address researcher, bytes32 candidateId) view returns (bool)`]),Sd=pt([`function allowance(address owner, address spender) view returns (uint256)`,`function approve(address spender, uint256 amount) returns (bool)`]),Cd=ht(`uint64 competitionId, uint256 stakeWei`),wd=ht(`uint64 competitionId, bytes32 commitment`),Td=ht(`uint64 competitionId, bytes32 commitment, string artifactRef, bytes32 salt`),Ed=ht(`string artifactRef, bytes32 salt`),Dd=ht(`uint64 competitionId, bytes32 candidateId, string submissionRef, string evidenceJson, string evidenceRefsJson`),Od=ht(`string status, string detail`),kd=/^0x[0-9a-f]{64}$/i;function Ad(e,t){if(e!==t)throw Error(`Tempo RPC returned chain ${e}; expected ${t}`)}function jd(e,t,n){return{...e,feePayer:!0,nonceKey:t,nonce:n}}function Md(e,t){if(e!==`success`)throw Error(`${t} transaction reverted`)}function Nd(e,t,n,r){if(!kd.test(t))throw Error(`${n} transaction hash is invalid`);if(typeof e.transactionHash!=`string`||e.transactionHash.toLowerCase()!==t.toLowerCase())throw Error(`${n} receipt hash does not match the saved transaction`);if(Md(e.status??``,n),typeof e.from!=`string`||e.from.toLowerCase()!==r.from.toLowerCase())throw Error(`${n} receipt sender does not match the Solve device`);if(typeof e.to!=`string`||e.to.toLowerCase()!==r.to.toLowerCase())throw Error(`${n} receipt destination does not match the expected contract`)}function Pd(e,t){return e>=t?[]:e>0n?[0n,t]:[t]}function Fd(e,t,n=Date.now()){return n>=e+t}function Id(e,t){return e.filter(e=>e.args?.candidateId?.toLowerCase()===t.toLowerCase()).at(-1)?.transactionHash}function Ld(e,t,n,r,i){for(let a of e.logs)if(a.address.toLowerCase()===t.tangleAddress.toLowerCase())try{let e=st({abi:[hd],eventName:`JobSubmitted`,data:a.data,topics:a.topics});if(e.args.serviceId===t.serviceId&&e.args.jobIndex===n&&e.args.caller.toLowerCase()===r.toLowerCase()&&(!i||e.args.inputs.toLowerCase()===i.toLowerCase()))return e.args.callId}catch{}throw Error(`Tangle did not emit job ${n} for ${r}`)}function Rd(e,t,n,r){for(let i of e.logs)if(i.address.toLowerCase()===t.managerAddress.toLowerCase())try{let e=st({abi:[yd],eventName:`EvaluationAccepted`,data:i.data,topics:i.topics}).args;if(e.serviceId===t.serviceId&&e.competitionId===t.competitionId&&e.researcher.toLowerCase()===n.address.toLowerCase()&&e.candidateId.toLowerCase()===r.toLowerCase())return!0}catch{}return!1}function zd(e){if(e.chainId!==vt.id)throw Error(`Solve submissions require Tempo Moderato (chain ${vt.id}); received ${e.chainId}`);if(!e.sponsorUrl)throw Error(`Solve submissions require a Tempo sponsor relay URL; unsponsored writes are disabled`);return{...vt,name:e.chainName,nativeCurrency:{name:e.nativeSymbol,symbol:e.nativeSymbol,decimals:18},rpcUrls:{default:{http:[e.rpcUrl]}}}}async function Bd(e,t){Iu(e);let n=zd(e),r=it({chain:n,transport:ut(e.rpcUrl)});return Ad(await r.getChainId(),e.chainId),await Vd({publicClient:r},e),{publicClient:r,walletClient:at({account:t,chain:n,transport:bt(ut(e.rpcUrl),ut(e.sponsorUrl))}),account:t}}async function Vd(e,t){let n=await e.publicClient.readContract({address:t.tangleAddress,abi:bd,functionName:`getServicePaymentAsset`,args:[t.serviceId]});if(n.toLowerCase()!==t.paymentAsset.toLowerCase())throw Error(`Tempo service payment asset ${n} does not match the trusted Solve asset ${t.paymentAsset}`)}async function Hd(e,t,n){let[r,i]=await Promise.all([e.publicClient.readContract({address:t.tangleAddress,abi:bd,functionName:`getJobEventRate`,args:[t.blueprintId,n]}),e.publicClient.readContract({address:t.tangleAddress,abi:bd,functionName:`getServicePaymentAsset`,args:[t.serviceId]})]);if(i.toLowerCase()!==t.paymentAsset.toLowerCase())throw Error(`Tempo job payment asset ${i} does not match the trusted Solve asset ${t.paymentAsset}`);return{asset:i,amount:r,value:i===`0x0000000000000000000000000000000000000000`?r:0n}}async function Ud(e,t,n){return await e.publicClient.readContract({address:t,abi:Sd,functionName:`allowance`,args:[e.account.address,n.tangleAddress]})}async function Wd(e,t,n,r,i,a){let o=Date.now();for(;!Fd(o,a);){if((await e.publicClient.getLogs({address:t.tangleAddress,event:gd,args:{serviceId:t.serviceId,callId:n},fromBlock:r,toBlock:`latest`})).length>0){let a=(await e.publicClient.getLogs({address:t.tangleAddress,event:_d,args:{serviceId:t.serviceId,callId:n},fromBlock:r,toBlock:`latest`}))[0]?.args.result;if(!a)throw Error(`Tangle job ${n} completed without a result`);let[o,s]=ot(Od,a);if(o!==i)throw Error(`Tangle job ${n} ${o}: ${s}`);return{status:o,detail:s}}await new Promise(e=>setTimeout(e,1e3))}throw Error(`Tangle job ${n} did not complete within 120 seconds`)}async function Gd(e,t,n,r,i){let a=Date.now();for(;!Fd(a,i);){let i=(await e.publicClient.getLogs({address:t.tangleAddress,event:vd,args:{serviceId:t.serviceId,callId:n},fromBlock:r,toBlock:`latest`}))[0]?.args.output;if(i)return i;await new Promise(e=>setTimeout(e,1e3))}throw Error(`Tangle job ${n} did not produce an aggregate within 120 seconds`)}async function Kd(e,t,n){return!!await e.publicClient.readContract({address:t.managerAddress,abi:xd,functionName:`acceptedCandidates`,args:[t.serviceId,t.competitionId,e.account.address,n]})}const qd=BigInt(ft(gt(`tangle.solve.v1`)));async function Jd(e,t){let n=await yt.nonce.getNonce(e.publicClient,{account:e.account.address,nonceKey:qd});if(n>BigInt(2**53-1))throw Error(`The Solve transaction nonce exceeds the safe range`);return e.walletClient.writeContract(jd(t,qd,Number(n)))}async function Yd(e,t,n,r){if(!await e.publicClient.readContract({address:t.tangleAddress,abi:bd,functionName:`isPermittedCaller`,args:[t.serviceId,e.account.address]}))try{let i=r??await Jd(e,{address:t.managerAddress,abi:xd,functionName:`authorizeSelf`,args:[t.serviceId]});if(r||await n?.(`authorization`,i),Nd(await e.publicClient.waitForTransactionReceipt({hash:i}),i,`Authorization`,{from:e.account.address,to:t.managerAddress}),!await e.publicClient.readContract({address:t.tangleAddress,abi:bd,functionName:`isPermittedCaller`,args:[t.serviceId,e.account.address]}))throw Error(`authorization transaction did not add the device`);return i}catch(e){let t=e instanceof Error?e.message:`unknown chain error`;throw Error(`The competition manager did not authorize this device. The deployed manager must expose authorizeSelf(uint64): ${t}`)}}async function Xd(e,t){let n=await Jd(e,{address:t.managerAddress,abi:xd,functionName:`revokeSelf`,args:[t.serviceId]});return Nd(await e.publicClient.waitForTransactionReceipt({hash:n}),n,`Revocation`,{from:e.account.address,to:t.managerAddress}),n}async function Zd(e,t,n,r,i=`allowance`,a={}){if(t.amount===0n||t.asset===`0x0000000000000000000000000000000000000000`)return;let o=await Ud(e,t.asset,n);for(let s of Pd(o,t.amount)){let o=s===0n?`${i}:reset`:`${i}:approval`,c=a[o];if(c){if(Nd(await e.publicClient.waitForTransactionReceipt({hash:c}),c,s===0n?`ERC-20 allowance reset`:`ERC-20 allowance approval`,{from:e.account.address,to:t.asset}),await Ud(e,t.asset,n)!==s)throw Error(`${s===0n?`ERC-20 allowance reset`:`ERC-20 allowance approval`} did not set the expected allowance`);continue}let l=await Jd(e,{address:t.asset,abi:Sd,functionName:`approve`,args:[n.tangleAddress,s]});await r?.(o,l),Nd(await e.publicClient.waitForTransactionReceipt({hash:l}),l,s===0n?`ERC-20 allowance reset`:`ERC-20 allowance approval`,{from:e.account.address,to:t.asset})}}async function Qd(e,t,n,r,i,a=`job:${n}`,o={}){let s=await Hd(e,t,n);await Zd(e,s,t,i,`allowance:${a}`,o);let c=o[a],l=c??await Jd(e,{address:t.tangleAddress,abi:bd,functionName:`submitJob`,args:[t.serviceId,n,r],value:s.value});c||await i?.(a,l);let u=await e.publicClient.waitForTransactionReceipt({hash:l});return Nd(u,l,`Job ${n}`,{from:e.account.address,to:t.tangleAddress}),{hash:l,callId:Ld(u,t,n,e.account.address,r),blockNumber:u.blockNumber}}async function $d(e,t,n,r,i,a,o=`job:${n}`,s={}){let c=await Qd(e,t,n,r,a,o,s),l=await Wd(e,t,c.callId,c.blockNumber,i,md);return{...c,acknowledgement:l}}const ef={...Q,chainName:`Tempo Moderato`,nativeSymbol:`TNT`},tf={async read(e){let t=it({chain:vt,transport:ut(ef.rpcUrl,{timeout:15e3})}),n=e=>e.catch(()=>null),r=await Promise.all(e.map(async e=>{let[r,i]=await Promise.all([n(t.readContract({address:ef.tangleAddress,abi:bd,functionName:`isPermittedCaller`,args:[ef.serviceId,e]})),n(t.readContract({address:ef.managerAddress,abi:xd,functionName:`isDeviceRevoked`,args:[e]}))]);return[e.toLowerCase(),{permitted:r,revoked:i}]}));return new Map(r)},async revokeSelf(e){return Xd(await Bd(ef,e),ef)}},nf={permitted:null,revoked:null};function rf(e){return e.revoked?`revoked`:e.permitted===null?`unknown`:e.permitted?`permitted`:`not permitted`}async function af(e,t=tf){try{let{devices:n}=await Nu({apiUrl:e.apiUrl,profile:e.profile}),r=du()?.account.address.toLowerCase(),i=n.map(e=>({...e,local:e.address===r,status:e.revokedAt?`revoked`:`active`}));r&&!i.some(e=>e.local)&&i.push({address:r,local:!0,status:`unbound`,boundAt:null,lastUsedAt:null,revokedAt:null,revocationMethod:null,revocationReason:null});let a=await t.read(i.map(e=>lt(e.address))),o=i.map(e=>({...e,onChain:a.get(e.address)??nf}));if(e.json){N({serviceId:ef.serviceId.toString(),devices:o});return}It([`Address`,`Status`,`Local`,`Service ${ef.serviceId}`,`Last used`,`Revoked`],o.map(e=>[e.address,e.status,e.local?`yes`:``,rf(e.onChain),e.lastUsedAt??``,e.revokedAt?`${e.revokedAt} (${e.revocationMethod})`:``]))}catch(t){B(t,e.json)}}async function of(e,t,n=tf){try{if(!dt(e))throw Error(`${e} is not an EVM address`);let r=lt(e),i=du(),a=i?.account.address===r;if(!t.yes){if(!process.stdin.isTTY)throw Error(`Revoking a device is permanent. Re-run with --yes to confirm`);if(!await Jr(`Permanently revoke Solve device ${r}${a?` (this machine's device)`:``}? [y/N] `,`--yes`)){F(`Revocation cancelled`);return}}let o;if(i&&a){let e=await Mu({deviceAddress:r,purpose:`revoke`,apiUrl:t.apiUrl,profile:t.profile});o={challengeId:e.challengeId,signature:await i.account.signMessage({message:e.message})}}let s=await Pu({deviceAddress:r,reason:t.reason,...o,apiUrl:t.apiUrl,profile:t.profile}),c=r.toLowerCase(),l=(await n.read([r])).get(c)??nf,u;if(i&&a&&!l.revoked){try{u=await n.revokeSelf(i.account)}catch(e){let t=e instanceof Error?e.message:String(e);throw Error(`The Solve API revoked ${r}, but the on-chain revocation failed and the local key was kept: ${t}. Run the command again to retry`)}l=(await n.read([r])).get(c)??nf}let d=i&&a&&l.revoked?pu(i):void 0;if(t.json){N({...s,serviceId:ef.serviceId.toString(),onChain:l,...u?{revocationTransaction:u}:{},localKeyRetired:!!d});return}P(s.alreadyRevoked?`${r} was already revoked in the Solve API`:`Revoked ${r}; the Solve API refuses its signatures`),u&&P(`Revoked on Tempo in ${u}; service ${ef.serviceId} refuses its jobs`),d&&F("The local device key was moved aside because its address may still hold stake or rewards. Run `tangle solve account --create` for a new device"),!a&&l.permitted&&jt(`The device can still submit jobs to service ${ef.serviceId}. Only its key, or the Solve blueprint owner, can revoke it on chain`)}catch(e){B(e,t.json)}}function sf(e,t){return ft(ct(Ed,[e.trim(),t]))}function cf(e){let t=/^submission=(\S+)/.exec(e);if(!t?.[1])throw Error(`COMMIT_CANDIDATE did not return a submission reference`);return t[1]}async function lf(e,t,n,r,i){let a=i.resumeTransactions?.evaluation;if(a){let n=await e.publicClient.waitForTransactionReceipt({hash:a});if(Nd(n,a,`Evaluation`,{from:e.account.address,to:t.managerAddress}),!Rd(n,t,e.account,r))throw Error(`Saved evaluation transaction did not emit EvaluationAccepted for this candidate`);return a}let o=Date.now();for(;!Fd(o,md);){if(await Kd(e,t,r)){let i=Id(await e.publicClient.getLogs({address:t.managerAddress,event:yd,args:{serviceId:t.serviceId,competitionId:t.competitionId,researcher:e.account.address},fromBlock:n.blockNumber,toBlock:`latest`}),r);if(i)return i;throw Error(`Candidate is already accepted, but its EvaluationAccepted transaction is unavailable`)}let[a,o,,s,c]=await e.publicClient.readContract({address:t.managerAddress,abi:xd,functionName:`pendingResults`,args:[t.serviceId,n.callId]});if(s&&a!==4)throw Error(`Manager pending result ${n.callId} has unexpected job ${a}`);if(s&&c)throw Error(`Manager executed the report without EvaluationAccepted`);if(s&&!c){if(o.toLowerCase()!==ft(n.output).toLowerCase())throw Error(`Manager pending report output does not match the aggregate`);let a=await Jd(e,{address:t.managerAddress,abi:xd,functionName:`executePendingResult`,args:[t.serviceId,n.callId,n.output]});await i.onTransaction?.(`evaluation`,a);let s=await e.publicClient.waitForTransactionReceipt({hash:a});if(Nd(s,a,`Evaluation`,{from:e.account.address,to:t.managerAddress}),!Rd(s,t,e.account,r))throw Error(`Evaluation transaction did not emit EvaluationAccepted for this candidate`);return a}await new Promise(e=>setTimeout(e,1e3))}throw Error(`Manager did not emit EvaluationAccepted within 120 seconds`)}async function uf(e,t,n,r={}){if(Iu(e),!/^0x[0-9a-f]{64}$/i.test(n.salt))throw Error(`Reveal salt must be bytes32`);if(!n.artifactRef.trim())throw Error(`Candidate reference is required`);if(!n.evidenceJson.trim()||n.evidenceRefs.length===0)throw Error(`Checker evidence is required`);let i=await Bd(e,t),a=await Yd(i,e,r.onTransaction,r.resumeTransactions?.authorization),o,s=await i.publicClient.readContract({address:e.managerAddress,abi:xd,functionName:`stakes`,args:[e.serviceId,e.competitionId,i.account.address]});s<e.minStakeWei&&(o=await Jd(i,{address:e.managerAddress,abi:xd,functionName:`postStake`,args:[e.serviceId,e.competitionId],value:e.minStakeWei-s}),await r.onTransaction?.(`stake`,o),Nd(await i.publicClient.waitForTransactionReceipt({hash:o}),o,`Stake`,{from:i.account.address,to:e.managerAddress}));let c=sf(n.artifactRef,n.salt),l=ct(Cd,[e.competitionId,e.minStakeWei]),u=ct(wd,[e.competitionId,c]),d=ct(Td,[e.competitionId,c,n.artifactRef.trim(),n.salt]),f=await $d(i,e,1,l,`joined`,r.onTransaction,`join`,r.resumeTransactions),p=await $d(i,e,2,u,`committed`,r.onTransaction,`commit`,r.resumeTransactions),m=cf(p.acknowledgement.detail),h=await $d(i,e,3,d,`revealed`,r.onTransaction,`reveal`,r.resumeTransactions),g=await Qd(i,e,4,ct(Dd,[e.competitionId,c,m,n.evidenceJson,JSON.stringify(n.evidenceRefs)]),r.onTransaction,`report`,r.resumeTransactions),_=await Gd(i,e,g.callId,g.blockNumber,md),v=await lf(i,e,{callId:g.callId,output:_,blockNumber:g.blockNumber},c,r);return{address:i.account.address,...a?{authorization:a}:{},...o?{stake:o}:{},join:f.hash,commit:p.hash,reveal:h.hash,report:g.hash,evaluation:v,candidateId:c,submissionRef:m}}const df=rt(we),ff=`/usr/bin/bwrap`,pf=[`/usr`,`/bin`,`/sbin`,`/lib`,`/lib64`];function mf(e){return[...e].some(e=>{let t=e.charCodeAt(0);return t<32||t===127})}function hf(e,t){if(!e||e.length>2048||mf(e))throw Error(`${t} contains invalid control characters or is too long`)}function gf(e,t){let n=t;for(;n<e.length&&/\s/.test(e[n]??``);)n+=1;return n}function _f(e,t){if(e[t]!==`"`)throw Error(`Checker output must be valid JSON`);let n=t+1;for(;n<e.length;){let t=e[n];if(t===`\\`){n+=2;continue}if(t===`"`)return n+1;if((t?.charCodeAt(0)??0)<32)throw Error(`Checker output must be valid JSON`);n+=1}throw Error(`Checker output must be valid JSON`)}function vf(e,t,n){let r=new Set,i=gf(e,t+1);if(e[i]===`}`)return i+1;for(;i<e.length;){let t=_f(e,i),a=JSON.parse(e.slice(i,t));if(r.has(a))throw Error(`Checker output must not contain duplicate object keys`);if(r.add(a),i=gf(e,t),e[i]!==`:`)throw Error(`Checker output must be valid JSON`);let o=gf(e,i+1),s=bf(e,o);if(n?.(a,o,s),i=gf(e,s),e[i]===`}`)return i+1;if(e[i]!==`,`)throw Error(`Checker output must be valid JSON`);i=gf(e,i+1)}throw Error(`Checker output must be valid JSON`)}function yf(e,t){let n=gf(e,t+1);if(e[n]===`]`)return n+1;for(;n<e.length;){if(n=gf(e,bf(e,n)),e[n]===`]`)return n+1;if(e[n]!==`,`)throw Error(`Checker output must be valid JSON`);n=gf(e,n+1)}throw Error(`Checker output must be valid JSON`)}function bf(e,t){if(e[t]===`"`)return _f(e,t);if(e[t]===`{`)return vf(e,t);if(e[t]===`[`)return yf(e,t);let n=t;for(;n<e.length&&!/[\s,\]}]/.test(e[n]??``);)n+=1;return n}function xf(e){let t=e.trim();if(gf(t,bf(t,0))!==t.length)throw Error(`Checker output must be valid JSON`)}function Sf(e,t){let n=e.trim();if(n[0]!==`{`)return;let r;return vf(n,0,(e,i,a)=>{e===t&&(r=n.slice(i,a).trim())}),r}function Cf(e){let t;try{t=JSON.parse(e)}catch{throw Error(`Checker output must be one JSON object`)}if(xf(e),!t||typeof t!=`object`||Array.isArray(t))throw Error(`Checker output must be a JSON object`);let n=t,r=n.candidate_ref;if(typeof r!=`string`||!r.trim())throw Error(`Checker output must include candidate_ref`);let i=r.trim(),a=n.evidence_refs;if(!Array.isArray(a)||a.length===0||a.some(e=>typeof e!=`string`||!e.trim()))throw Error(`Checker output must include a non-empty evidence_refs array`);hf(i,`candidate_ref`);for(let e of a)hf(e.trim(),`evidence_refs`);if(!n.evidence_json||typeof n.evidence_json!=`object`||Array.isArray(n.evidence_json))throw Error(`Checker output must include an evidence_json object`);let o={...n.evidence_json},s=Sf(e,`evidence_json`);if(!s)throw Error(`Checker evidence_json source text is missing`);if(o.candidate_ref!==i)throw Error(`Checker evidence_json candidate_ref must match candidate_ref`);return{candidateRef:i,evidenceRefs:a.map(e=>e.trim()),evidence:o,evidenceJson:s}}async function wf(e,t,n){let r=n.trim();if(r.startsWith(`{`)&&r.endsWith(`}`)||!t.result_file)return r;let i=await Af(e),a=E.resolve(i,t.result_file),o=E.relative(i,a);if(o.startsWith(`..`)||E.isAbsolute(o))throw Error(`Checker result_file must stay inside the competition repository`);let s;try{s=await A.lstat(a)}catch{throw Error(`Checker result_file must be an existing regular file inside the competition repository`)}if(s.isSymbolicLink())throw Error(`Checker result_file must not be a symbolic link`);if(!s.isFile())throw Error(`Checker result_file must be an existing regular file inside the competition repository`);let c;try{c=await A.realpath(a)}catch{throw Error(`Checker result_file must resolve to a regular file inside the competition repository`)}let l=E.relative(i,c);if(l.startsWith(`..`)||E.isAbsolute(l))throw Error(`Checker result_file must stay inside the competition repository`);return(await A.readFile(c,`utf8`)).trim()}function Tf(e,t){let n=E.relative(e,t);return n===``||!n.startsWith(`..`)&&!E.isAbsolute(n)}function Ef(e){return pf.some(t=>Tf(t,e))}async function Df(e,t,n){let r=e.includes(`/`)?[E.resolve(t,e)]:(process.env.PATH??``).split(E.delimiter).filter(Boolean).map(t=>E.join(t,e));for(let i of r){let r;try{r=await A.realpath(i),await A.access(r,A.constants.X_OK)}catch{continue}if(!Tf(t,r)&&!Ef(r)&&r!==n)throw Error(`Checker executable '${e}' must resolve inside the competition repository or a trusted runtime directory`);return r}throw Error(`Checker executable '${e}' was not found`)}async function Of(e){let t=[];for(let n of e)try{(await A.stat(n)).isDirectory()&&t.push(n)}catch{}return t}async function kf(e){let t=await A.realpath(Se.homedir());if(e===E.parse(e).root||e===t)throw Error(`Solve checker repository must be a dedicated directory, not the filesystem or home root`)}async function Af(e){let t=await A.realpath(e);return await kf(t),t}async function jf(e){let t=E.join(e,`.git`),n;try{n=await A.lstat(t)}catch{return}if(n.isSymbolicLink())throw Error(`Solve checker repository .git must not be a symbolic link`);if(!n.isDirectory()&&!n.isFile())return;let r;try{let t={...process.env};for(let e of[`GIT_DIR`,`GIT_WORK_TREE`,`GIT_INDEX_FILE`,`GIT_OBJECT_DIRECTORY`,`GIT_ALTERNATE_OBJECT_DIRECTORIES`,`GIT_COMMON_DIR`,`GIT_CONFIG_COUNT`,`GIT_CONFIG_PARAMETERS`])delete t[e];let n=await df(`/usr/bin/git`,[`-C`,e,`rev-parse`,`--verify`,`HEAD^{commit}`],{encoding:`utf8`,maxBuffer:1e5,env:{...t,GIT_CONFIG_GLOBAL:`/dev/null`,GIT_CONFIG_SYSTEM:`/dev/null`,GIT_CONFIG_NOSYSTEM:`1`,GIT_TERMINAL_PROMPT:`0`}}),i=String(n.stdout).trim();/^[0-9a-f]{40}$/i.test(i)&&(r=i.toLowerCase())}catch{}return{kind:n.isDirectory()?`directory`:`file`,...r?{commit:r}:{}}}async function Mf(e,t,n){let r=await Af(e);if(process.platform!==`linux`)throw Error(`Solve checkers require the Linux sandbox runtime (bubblewrap) with network isolation`);try{await A.access(ff,A.constants.X_OK)}catch{throw Error(`Solve checkers require /usr/bin/bwrap; install bubblewrap or run the checker in a Tangle sandbox`)}let i=await Df(t,r,await A.realpath(process.execPath)),a=await jf(r),o=(await Of(pf)).flatMap(e=>[`--ro-bind`,e,e]),s=Tf(r,i)?`/work/${E.relative(r,i)}`:Ef(i)?i:`/checker/node`;!Tf(r,i)&&!Ef(i)&&o.push(`--ro-bind`,i,`/checker/node`);let c=a?.kind===`directory`?[`--tmpfs`,`/work/.git`]:a?.kind===`file`?[`--ro-bind`,`/dev/null`,`/work/.git`]:[];return{executable:ff,args:[`--die-with-parent`,`--new-session`,`--unshare-all`,`--clearenv`,...o,`--proc`,`/proc`,`--dev`,`/dev`,`--tmpfs`,`/tmp`,`--dir`,`/tmp/home`,`--bind`,r,`/work`,...c,`--chdir`,`/work`,`--setenv`,`HOME`,`/tmp/home`,...a?.commit?[`--setenv`,`TANGLE_SOLVE_COMMIT`,a.commit]:[],`--setenv`,`TMPDIR`,`/tmp`,`--setenv`,`PATH`,`/checker:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,`--setenv`,`LANG`,`C.UTF-8`,`--setenv`,`PYTHONDONTWRITEBYTECODE`,`1`,`--setenv`,`XDG_CONFIG_HOME`,`/tmp/home/.config`,`--setenv`,`XDG_CACHE_HOME`,`/tmp/home/.cache`,`--setenv`,`XDG_DATA_HOME`,`/tmp/home/.local/share`,`--setenv`,`GIT_CONFIG_GLOBAL`,`/dev/null`,`--setenv`,`GIT_CONFIG_SYSTEM`,`/dev/null`,`--setenv`,`NPM_CONFIG_USERCONFIG`,`/dev/null`,s,...n]}}async function Nf(e,t){if(!t.command||t.command.includes(`/../`)||mf(t.command))throw Error(`The competition checker command is invalid`);if(!Array.isArray(t.args))throw Error(`The competition checker arguments must be an array`);for(let e of t.args)hf(e,`Checker argument`);let n=t.timeout_ms??15*6e4;if(!Number.isSafeInteger(n)||n<1e3||n>60*6e4)throw Error(`Checker timeout must be between one second and one hour`);let r=await Af(e),i;try{let e=await Mf(r,t.command,t.args);i=await df(e.executable,e.args,{cwd:r,timeout:n,maxBuffer:4194304,encoding:`utf8`})}catch(e){let t=e,n=t.stderr?.trim()||t.stdout?.trim()||t.message||`checker failed`;throw Error(`Pinned checker failed: ${n}`)}let a=String(i.stdout),o=String(i.stderr);return{...Cf(await wf(r,t,a)),stdout:a,stderr:o}}async function Pf(e,t){try{let{root:n,manifest:r}=await Xu(e,t.directory),i=await td(n),a=r.provenance?await nd(n,r,i,{allowMissing:!0}):void 0,o=fu(),s=I(`Running ${r.title} checker…`);t.json||s.start();let c;try{c=await Nf(n,r.checker)}finally{s.stop()}let l=od(c,a,r.provenance,void 0,{allowMissingSource:!0,requirePullRequest:!1}),u=_t(ne(32)),d=sf(c.candidateRef,u),f={version:1,competition:r.slug,candidateRef:c.candidateRef,evidence:l.evidence,evidenceJson:c.evidenceJson,evidenceRefs:l.evidenceRefs,salt:u,candidateId:d,...a?{source:a}:{},deviceAddress:o.account.address,clientSubmissionId:S(),createdAt:new Date().toISOString()};await sd(E.join(n,`.tangle-solve-run.json`),f),t.json?N({localRun:f}):(P(`Checker output recorded locally for operator evaluation`),L({Competition:r.slug,Candidate:c.candidateRef,"Device address":o.account.address,"Evidence refs":l.evidenceRefs.length}),F("Commit any changes, then run `tangle solve submit` from this directory."),r.provenance&&!a&&F(`Add your GitHub fork as 'origin' before submitting. The task repository is available as '${Ju}'.`))}catch(e){B(e)}}const Ff=/^0x[0-9a-f]{64}$/i;async function If(e){let t=await Mu({deviceAddress:e.deviceAddress,apiUrl:e.apiUrl,profile:e.profile}),n=await e.signer.signMessage({message:t.message});return{walletChallengeId:t.challengeId,walletSignature:n}}async function Lf(e,t){try{let{root:n,manifest:r}=await Xu(e,t.directory);ku({profile:t.profile});let i=await td(n),a=await cd(n);if(a.competition!==r.slug)throw Error(`.tangle-solve-run.json does not match this competition`);if(!Ff.test(a.salt)||!Ff.test(a.candidateId))throw Error("This run predates durable candidate identity. Run `tangle solve run` again");let o=r.provenance?await nd(n,r,i):void 0;if(r.provenance&&a.source&&!id(a.source,o))throw Error("The saved run points to a different repository or revision. Keep your fork as 'origin' and run `tangle solve run` again before submitting");let s=du();if(!s)throw Error("No Solve device signer found. Run `tangle solve run` first");if(s.account.address.toLowerCase()!==a.deviceAddress.toLowerCase())throw Error("The local Solve device account changed after `tangle solve run`; run the checker again");let c=I(`Checking the committed candidate…`);t.json||c.start();let l;try{l=await Nf(n,r.checker)}finally{c.stop()}if(l.candidateRef!==a.candidateRef||l.evidenceJson!==a.evidenceJson)throw Error("The committed checker output changed after `tangle solve run`; run the checker again");if(sf(l.candidateRef,a.salt).toLowerCase()!==a.candidateId.toLowerCase())throw Error(`The saved candidate identity does not match the checker output; run the checker again`);let u=Du(t.prUrl);if(!r.provenance&&u)throw Error(`This competition does not accept GitHub pull request provenance`);if(u){if(!o)throw Error(`A provenance policy is required for a pull request`);await ld({pullRequest:u,taskRepository:o.taskRepository,submissionRepository:o.submissionRepository,submissionRevision:i})}let d=od(l,o,r.provenance,u,{requirePullRequest:!0}),f={...a,...o?{source:o}:{},chainState:{status:`submitting`,transactions:{...a.chainState?.transactions??{}}}},p=E.join(n,`.tangle-solve-run.json`);await sd(p,f);let m=I(`Submitting candidate to Tempo…`);t.json||m.start();let h;try{h=await uf(Vu(r),s.account,{artifactRef:l.candidateRef,salt:a.salt,evidenceJson:l.evidenceJson,evidenceRefs:d.evidenceRefs},{resumeTransactions:f.chainState?.transactions,onTransaction:async(e,t)=>{f={...f,chainState:{status:`submitting`,transactions:{...f.chainState?.transactions??{},[e]:t}}},await sd(p,f)}})}finally{m.stop()}f={...f,chainReceipt:h,chainState:{status:`accepted`,transactions:{...f.chainState?.transactions??{},...ud(h)}}},await sd(p,f);let g=await If({deviceAddress:h.address,signer:s.account,apiUrl:t.apiUrl,profile:t.profile}),_=await ju({path:`/v1/submissions`,method:`POST`,apiUrl:t.apiUrl,profile:t.profile,body:{competition:r.slug,candidateRef:l.candidateRef,candidateId:h.candidateId,evidenceJson:l.evidenceJson,evidenceRefs:d.evidenceRefs,deviceAddress:h.address,reportTxHash:h.report,evaluationTxHash:h.evaluation,transactions:ud(h),...r.provenance&&o?{source:{...o,...u?{pullRequest:u}:{}}}:{},clientSubmissionId:a.clientSubmissionId,...g,...t.model?{model:t.model}:{},...t.note?{note:t.note}:{}}});t.json?N({..._,transactions:ud(h),candidateId:h.candidateId}):(P(`Submission accepted on Tempo`),L({Competition:r.slug,Candidate:h.candidateId,"Device address":h.address,"Report transaction":h.report,"Evaluation transaction":h.evaluation,"Submission ID":typeof _.id==`string`?_.id:_.submission?.id}))}catch(e){B(e)}}function Rf(){let e=new b(`solve`).description(`Participate in Tangle Solve competitions`);e.command(`clone <competition>`).description(`Clone the pinned competition repository`).argument(`[directory]`,`Destination directory`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(pd),e.command(`run [competition]`).description(`Run the competition checker and record its evidence`).option(`--directory <path>`,`Competition directory (defaults to the current directory)`).action(Pf),e.command(`submit [competition]`).description(`Submit checker evidence through the device account and Tempo`).option(`--directory <path>`,`Competition directory (defaults to the current directory)`).option(`--pr-url <url>`,`GitHub pull request containing the submission`).option(`--model <name>`,`Model used to produce the submission`).option(`--note <text>`,`Short note shown with the accepted submission`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(Lf),e.command(`account`).description(`Show the local Solve signing account`).option(`--create`,`Create the account if it does not exist`).action(mu);let t=e.command(`device`).description(`List and revoke the Solve devices bound to your account`);return t.command(`list`).description(`List your devices and whether each may submit jobs on Tempo`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(e=>af(e)),t.command(`revoke <address>`).description(`Permanently revoke a device; the local device is revoked with its own key`).option(`--reason <text>`,`Why the device is revoked (shown to the account)`).option(`--yes`,`Confirm the permanent revocation without a prompt`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action((e,t)=>of(e,t)),e}function zf(e,t){return`tangle ssh-proxy ${e.replace(/\/+$/,``)}/v1/sandboxes/${t}/runtime/ssh`}function Bf(e){return/^[A-Za-z0-9_/:=@%+.,-]+$/.test(e)?e:`'${e.replace(/'/g,`'"'"'`)}'`}function Vf(e){return`'${e.replace(/'/g,`''`)}'`}function Hf(e){return e===`win32`?`NUL`:`/dev/null`}function Uf(e,t){return t===`win32`?`$env:TANGLE_SSH_PROXY_AUTH_TOKEN=${Vf(`<token>`)}; ssh ${e.map(Vf).join(` `)}`:`TANGLE_SSH_PROXY_AUTH_TOKEN=${Bf(`<token>`)} ssh ${e.map(Bf).join(` `)}`}function Wf(e){return e.connection!==void 0&&!e.connection.ssh}function Gf(){At(`SSH is not enabled for this sandbox.`),F(`Create a sandbox with --ssh to enable SSH access.`),process.exit(1)}function Kf(e,t=[],n=process.platform){let r=Hf(n);return[`-o`,`ProxyCommand=${e.proxyCommand}`,`-o`,`StrictHostKeyChecking=no`,`-o`,`UserKnownHostsFile=${r}`,`-o`,`GlobalKnownHostsFile=${r}`,`-o`,`LogLevel=ERROR`,`-o`,`ServerAliveInterval=15`,`-o`,`ServerAliveCountMax=4`,`-o`,`TCPKeepAlive=yes`,`${e.username}@localhost`,`-p`,String(e.port),...t]}function qf(){return new b(`ssh`).description(`Open SSH session to a sandbox`).argument(`<ref>`,`Sandbox ID or name`).argument(`[sshArgs...]`,`Extra args passed through to ssh`).option(`-i, --identity-file <path>`,`Private key file to pass to ssh`).option(`--print`,`Print SSH command instead of connecting`).allowUnknownOption(!0).action(async(e,t,n)=>{let{context:r,client:i}=W(n),a=I(`Getting SSH credentials...`);a.start();let o=await K(i,r,e);if(Wf(o)){a.stop(),Gf();return}o=await q(o);let s=await o.ssh();if(a.stop(),!s){Gf();return}let c={...s,proxyCommand:zf(r.baseUrl,o.id)};if(!r.apiKey)throw Error(`SSH proxy requires API key auth. Set TANGLE_API_KEY or pass --api-key.`);let l=Kf(c,[...n.identityFile?[`-i`,n.identityFile,`-o`,`IdentitiesOnly=yes`]:[],...t]);if(n.print){console.log(Uf(l,process.platform));return}F(`Connecting via tunnel...`);let u=Ee(`ssh`,l,{stdio:`inherit`,env:{...process.env,TANGLE_SSH_PROXY_AUTH_TOKEN:r.apiKey}});u.on(`error`,e=>{e.code===`ENOENT`&&(At(`SSH client not found. Please install OpenSSH.`),process.exit(1)),B(e)}),u.on(`exit`,e=>{process.exit(e??0)})})}function Jf(){let e=new b(`ssh-keys`).description(`Manage SSH keys`);return e.command(`list`).description(`List SSH keys`).action(async e=>{let t=I(`Fetching SSH keys...`);try{t.start();let n=await U(H(e)).sshKeys.list();t.stop(),e.json?N({sshKeys:n}):n.length===0?F(`No SSH keys found.`):It([`Name`,`Type`,`Fingerprint`,`Created`],n.map(e=>[e.name,e.keyType,e.fingerprint,e.createdAt.toLocaleString()]))}catch(e){t.stop(),B(e)}}),e.command(`add`).description(`Add SSH key`).argument(`<name>`,`SSH key name`).requiredOption(`--key-file <path>`,`Public key file path`).action(async(e,t)=>{let n=I(`Adding SSH key...`);try{let r=fe(t.keyFile,`utf8`).trim();n.start();let i=await U(H(t)).sshKeys.create(e,r);n.stop(),t.json?N({sshKey:i}):P(`Added SSH key ${i.name} (${i.fingerprint})`)}catch(e){n.stop(),B(e)}}),e.command(`delete`).description(`Delete SSH key`).argument(`<name>`,`SSH key name or ID`).action(async(e,t)=>{let n=I(`Deleting SSH key...`);try{n.start(),await U(H(t)).sshKeys.delete(e),n.stop(),P(`Deleted SSH key ${e}`)}catch(e){n.stop(),B(e)}}),e}function Yf(e,t=1){process.stderr.write(`${e}\n`),process.exit(t)}function Xf(){return new b(`ssh-proxy`).description(`SSH proxy helper that pipes stdin/stdout to WebSocket`).argument(`<runtime-url>`,`Runtime WebSocket URL`).action(async e=>{let t=process.env.TANGLE_SSH_PROXY_AUTH_TOKEN;t||Yf(`TANGLE_SSH_PROXY_AUTH_TOKEN not set`);let n=new xt(new URL(e.replace(/^http/,`ws`)),{headers:{Authorization:`Bearer ${t}`},perMessageDeflate:!1}),r;function i(){r&&=(clearInterval(r),void 0)}n.on(`open`,()=>{r=setInterval(()=>{n.readyState===xt.OPEN&&n.ping()},15e3),r.unref?.(),process.stdin.on(`data`,e=>{n.readyState===xt.OPEN&&n.send(e,{binary:!0,compress:!1})}),process.stdin.on(`end`,()=>n.close(1e3))}),n.on(`message`,e=>{let t=Buffer.isBuffer(e)?e:Array.isArray(e)?Buffer.concat(e):Buffer.from(e);process.stdout.write(t)}),n.on(`error`,e=>{i(),Yf(`WebSocket error: ${e.message}`)}),n.on(`close`,e=>{i(),process.exit(e===1e3?0:1)}),process.stdin.on(`error`,()=>n.close())})}function Zf(){let e=new b(`team`).description(`Manage teams`);return $(e,`list`).description(`List teams for the current account`).action(async e=>{let t=H(e),n=U(t),r=e.json?null:I(`Fetching teams...`);r?.start();let i=await n.teams.list();if(r?.stop(),e.json){N({teams:i,activeTeamId:t.activeTeamId??null});return}M(i.map(e=>({active:e.id===t.activeTeamId,id:e.id,name:e.name,role:e.currentUserRole,members:e.memberCount})),[{key:`active`,header:`Active`,width:8},{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:24},{key:`role`,header:`Role`,width:10},{key:`members`,header:`Members`,width:10}])}),$(e,`create <name>`).description(`Create a team`).option(`--org-id <id>`,`External organization id`).option(`--no-switch`,`Do not set the new team as active`).action(async(e,t)=>{let n=H(t),r=U(n),i=t.json?null:I(`Creating team...`);i?.start();let a=await r.teams.create({name:e,orgId:t.orgId});if(t.switch&&Kl(a,n.profile),i?.stop(),t.json){N({team:a,active:!!t.switch});return}P(`Team created: ${Ul(a)}`),t.switch&&P(`Active team set to ${a.name}`)}),$(e,`switch <team>`).description(`Set the active team for the current profile`).action(async(e,t)=>{let n=H(t),r=await Wl(U(n),e);if(Kl(r,n.profile),t.json){N({team:r,activeTeamId:r.id});return}P(`Active team set to ${Ul(r)}`)}),e.command(`current`).description(`Show the active team for the current profile`).option(`--profile <profile>`,`Credential profile`).action(e=>{let t=cr(e.profile);if(e.json){N(t.activeTeamId?t:{activeTeamId:null});return}if(!t.activeTeamId){console.log(`No active team.`);return}L({ID:t.activeTeamId,Name:t.activeTeamName})}),e.command(`clear`).description(`Clear the active team for the current profile`).option(`--profile <profile>`,`Credential profile`).action(e=>{if(ql(e.profile),e.json){N({activeTeamId:null});return}P(`Active team cleared.`)}),$(e,`members [team]`).description(`List team members`).action(async(e,t)=>{let n=H(t),r=U(n),i=await Gl(r,e,n.profile),a=await r.teams.listMembers(i.id);if(t.json){N({team:i,members:a});return}M(a,[{key:`id`,header:`ID`,width:36},{key:`customerEmail`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:10},{key:`joinedAt`,header:`Joined`,width:16}])}),$(e,`update-member <member-id>`).description(`Update a team member role`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).requiredOption(`--role <role>`,`Role: admin, member, viewer`).action(async(e,t)=>{let n=H(t),r=U(n),i=await Gl(r,t.team,n.profile),a=Qf(t.role),o=await r.teams.updateMember(i.id,e,{role:a});if(t.json){N({team:i,member:o});return}P(`Member updated: ${o.customerEmail}`),L({Team:i.name,Role:o.role,Status:o.status})}),$(e,`invite <email>`).description(`Invite a user to a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--role <role>`,`Role: admin, member, viewer`,`member`).option(`--ttl-hours <hours>`,`Invitation lifetime in hours`).action(async(e,t)=>{let n=H(t),r=U(n),i=await Gl(r,t.team,n.profile),a=Qf(t.role),o=await r.teams.invite(i.id,{email:e,role:a,ttlHours:t.ttlHours?Number.parseInt(t.ttlHours,10):void 0});if(t.json){N({team:i,invitation:o});return}P(`Invitation created for ${o.email}`),L({Team:i.name,Role:o.role,Expires:o.expiresAt,"Invitation ID":o.id}),P(`Re-run with --json to retrieve the invitation token for sharing.`)}),$(e,`leave [team]`).description(`Leave a team as the current user`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=H(t),r=U(n),i=await Gl(r,e,n.profile);if(!(!t.force&&!t.json&&!await Jr(`Leave team '${i.name}'? (y/N) `,`--force`))){if(await r.teams.leave(i.id),n.activeTeamId===i.id&&ql(n.profile),t.json){N({success:!0,teamId:i.id});return}P(`Left team: ${i.name}`)}}),$(e,`transfer <new-owner-customer-id> [team]`).description(`Transfer team ownership to another active member`).option(`--force`,`Skip confirmation prompt`).action(async(e,t,n)=>{let r=H(n),i=U(r),a=await Gl(i,t,r.profile);if(!(!n.force&&!n.json&&!await Jr(`Transfer ownership of '${a.name}' to ${e}? This cannot be undone without the new owner's cooperation. (y/N) `,`--force`))){if(await i.teams.transferOwnership(a.id,e),n.json){N({success:!0,teamId:a.id,newOwnerCustomerId:e});return}P(`Ownership transferred for ${a.name}`)}}),e.addCommand($f()),e.addCommand(ep()),$(e,`invitations [team]`).description(`List pending and historical team invitations`).action(async(e,t)=>{let n=H(t),r=U(n),i=await Gl(r,e,n.profile),a=await r.teams.listInvitations(i.id);if(t.json){N({team:i,invitations:a});return}M(a,[{key:`id`,header:`ID`,width:38},{key:`email`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:12},{key:`expiresAt`,header:`Expires`,width:16}])}),$(e,`accept <token>`).description(`Accept a team invitation`).option(`--no-switch`,`Do not set the accepted team as active`).action(async(e,t)=>{let n=H(t),r=U(n),i=await r.teams.acceptInvitation(e),a=t.switch===!1?null:await r.teams.get(i.teamId);if(a&&Kl(a,n.profile),t.json){N({member:i,activeTeamId:a?.id??null});return}P(`Invitation accepted for team ${i.teamId}`),a&&P(`Active team set to ${a.name}`)}),$(e,`revoke-invitation <invitation-id>`).description(`Revoke a pending team invitation`).action(async(e,t)=>{if(await U(H(t)).teams.revokeInvitation(e),t.json){N({success:!0,invitationId:e});return}P(`Invitation revoked: ${e}`)}),$(e,`remove-member <member-id>`).description(`Remove a member from a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).action(async(e,t)=>{let n=H(t),r=U(n),i=await Gl(r,t.team,n.profile);if(await r.teams.removeMember(i.id,e),t.json){N({success:!0,teamId:i.id,memberId:e});return}P(`Member removed: ${e}`)}),e}function Qf(e){if(e===`admin`||e===`member`||e===`viewer`)return e;throw Error(`Role must be one of: admin, member, viewer`)}function $f(){let e=new b(`secret`).description(`Manage team secrets`);return $(e,`list [team]`).description(`List team secret names`).action(async(e,t)=>{let n=H(t),r=U(n),i=await Gl(r,e,n.profile),a=await r.teams.listSecrets(i.id);if(t.json){N({team:i,secrets:a});return}M(a,[{key:`name`,header:`Name`,width:28},{key:`updatedAt`,header:`Updated`,width:24},{key:`updatedBy`,header:`Updated By`,width:28}])}),$(e,`set <name> [value]`).description(`Create or replace a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--value-stdin`,`Read secret value from stdin`).action(async(e,t,n)=>{let r=H(n),i=U(r),a=await Gl(i,n.team,r.profile),o=await iu({value:t,valueStdin:n.valueStdin,prompt:`Enter value for team secret '${e}': `}),s=await i.teams.upsertSecret(a.id,e,o);if(n.json){N({team:a,secret:s});return}P(`Team secret saved: ${s.name}`)}),$(e,`delete <name>`).description(`Delete a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=H(t),r=U(n),i=await Gl(r,t.team,n.profile);if(!(!t.force&&!t.json&&!await Jr(`Delete team secret '${e}' from '${i.name}'? (y/N) `,`--force`))){if(await r.teams.deleteSecret(i.id,e),t.json){N({success:!0,teamId:i.id,name:e});return}P(`Team secret deleted: ${e}`)}}),$(e,`reveal <name>`).description(`Reveal a team secret value`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).action(async(e,t)=>{let n=H(t),r=U(n),i=await Gl(r,t.team,n.profile),a=await r.teams.revealSecret(i.id,e);if(t.json){N({teamId:i.id,...a});return}console.log(a.value)}),e}function ep(){let e=new b(`templates`).description(`Manage team golden-path templates`);return $(e,`list [team]`).description(`List a team's golden-path templates`).action(async(e,t)=>{let n=H(t),r=U(n),i=await Gl(r,e,n.profile),a=await r.teams.listTemplates(i.id);if(t.json){N({team:i,templates:a});return}if(a.length===0){console.log(`No templates yet for ${i.name}.`);return}M(a.map(e=>({id:e.id,name:e.name,environment:e.environment,snapshot:`${e.snapshotId.slice(0,12)}…`,updated:e.updatedAt})),[{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:28},{key:`environment`,header:`Env`,width:14},{key:`snapshot`,header:`Snapshot`,width:16},{key:`updated`,header:`Updated`,width:24}])}),$(e,`create <name> <snapshot-id>`).description(`Create a golden-path template from a snapshot`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`-d, --description <description>`,`Human-readable description shown in the dashboard`).option(`-e, --environment <environment>`,`Default environment to apply (defaults to 'universal')`).option(`--config <json>`,`Optional JSON config object merged into sandboxes created from this template`).action(async(e,t,n)=>{let r=H(n),i=U(r),a=await Gl(i,n.team,r.profile),o;if(n.config)try{let e=JSON.parse(n.config);if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`--config must be a JSON object`);o=e}catch(e){throw Error(`--config is not valid JSON: ${e instanceof Error?e.message:String(e)}`)}let s=await i.teams.createTemplate(a.id,{name:e,snapshotId:t,description:n.description,environment:n.environment,config:o});if(n.json){N({team:a,template:s});return}P(`Team template created: ${s.name} (${s.id})`)}),$(e,`delete <template-id>`).description(`Delete a team golden-path template`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=H(t),r=U(n),i=await Gl(r,t.team,n.profile);if(!(!t.force&&!t.json&&!await Jr(`Delete template '${e}' from '${i.name}'? (y/N) `,`--force`))){if(await r.teams.deleteTemplate(i.id,e),t.json){N({success:!0,teamId:i.id,templateId:e});return}P(`Team template deleted: ${e}`)}}),e}function $(e,t){return e.command(t).option(`--profile <profile>`,`Credential profile`)}async function tp(e,t,n){let r=new AbortController,i=()=>r.abort();try{let n=U(H({...e,timeout:void 0}));process.once(`SIGINT`,i),process.once(`SIGTERM`,i);let a=await t(n,{...e.timeout===void 0?{}:{timeoutMs:Number(e.timeout)*1e3},resumeJobId:e.resumeJob,signal:r.signal,onProgress:e=>{process.stderr.write(`Publication ${e.id}: ${e.status}\n`)}}).finally(()=>{process.off(`SIGINT`,i),process.off(`SIGTERM`,i)});e.json?N(a):P(`template`in a?`Published template: ${a.template.slug}`:`Published template version: ${a.version.id}`)}catch(t){if(t instanceof s&&t.status!==401&&t.job&&[`pending`,`scanning`,`ready`].includes(t.job.status)){let e=[`tangle`,`template`,...n,`--resume-job`,t.job.id].map(Ve).join(` `);Object.assign(t,{fix:{command:e}})}B(t,e.json)}}function np(){let e=new b(`template`).description(`Manage published public templates`);return e.command(`list`).option(`-q, --query <query>`,`Search query`).option(`--tag <tag>`,`Filter by tag`).option(`--featured`,`Show featured templates only`).action(async e=>{let t=U(H(e)),n=e.featured?await t.publicTemplates.featured():await t.publicTemplates.list({query:e.query,tag:e.tag});if(e.json){N({templates:n});return}M(n,[{key:`slug`,header:`Slug`,width:28},{key:`name`,header:`Name`,width:28},{key:`forkCount`,header:`Forks`,width:8},{key:`sandboxCount`,header:`Sandboxes`,width:12},{key:`updatedAt`,header:`Updated`,width:24}])}),e.command(`get <id-or-slug>`).action(async(e,t)=>{let n=await U(H(t)).publicTemplates.get(e);if(t.json){N({template:n});return}N(n)}),e.command(`versions <id-or-slug>`).action(async(e,t)=>{let n=await U(H(t)).publicTemplates.versions(e);if(t.json){N({versions:n});return}M(n.map(e=>({...e})),[{key:`id`,header:`Version ID`,width:38},{key:`versionNumber`,header:`Version`,width:8},{key:`snapshotId`,header:`Snapshot`,width:20},{key:`createdAt`,header:`Created`,width:24}])}),e.command(`publish <name> <snapshot-id> <sandbox-id>`).option(`--timeout <seconds>`,`Maximum wait for publication`).option(`--resume-job <id>`,`Resume an accepted publication for this snapshot`).option(`--slug <slug>`,`Stable public slug`).option(`-d, --description <description>`,`Template description`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).option(`--team-id <id>`,`Publish under a team`).option(`--forked-from <id>`,`Fork source template id`).action((e,t,n,r)=>tp(r,async(i,a)=>({template:await i.publicTemplates.publish({name:e,slug:r.slug,description:r.description,snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes,teamId:r.teamId,forkedFromTemplateId:r.forkedFrom},a)}),[`publish`,e,t,n])),e.command(`publish-version <id-or-slug> <snapshot-id> <sandbox-id>`).option(`--timeout <seconds>`,`Maximum wait for publication`).option(`--resume-job <id>`,`Resume an accepted publication for this snapshot`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).action((e,t,n,r)=>tp(r,async(i,a)=>({version:await i.publicTemplates.publishVersion(e,{snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes},a)}),[`publish-version`,e,t,n])),e}function rp(){let e=new b(`traces`).description(`Read hosted agent traces, spans, and eval-runs from Tangle Intelligence`);return e.command(`list`).description(`List trace summaries (one row per trace), newest first`).option(`--from <iso>`,`ISO-8601 lower bound on received time (inclusive)`).option(`--to <iso>`,`ISO-8601 upper bound on received time (inclusive)`).option(`--model <model>`,`Exact model match (any span carried this model)`).option(`--run <runId>`,`Exact run id match`).option(`--status <status>`,`ERROR | OK`).option(`-q, --query <text>`,`Substring over span name`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size (clamped server-side to [1, 200])`).action(async e=>{try{let t={from:e.from,to:e.to,model:e.model,runId:e.run,status:e.status===void 0?void 0:mp(e.status),q:e.query,cursor:e.cursor,limit:e.limit===void 0?void 0:yp(e.limit)},n=ap(e),r=e.json?null:I(`Fetching traces...`);r?.start();let i=await n.listTraces(t);if(r?.stop(),e.json)return N(i);cp(i.items),fp(i.nextCursor)}catch(t){sp(t,e)}}),e.command(`get <traceId>`).description(`Show one trace's spans. Streams NDJSON to stdout with --ndjson.`).option(`--ndjson`,`Stream the full span set as NDJSON to stdout`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Spans per page`).action(async(e,t)=>{try{let n=ap(t);if(t.ndjson){await op(n,e);return}let r=t.json?null:I(`Fetching trace spans...`);r?.start();let i=await n.getTraceSpans(e,{cursor:t.cursor,limit:t.limit===void 0?void 0:yp(t.limit)});if(r?.stop(),t.json)return N(i);lp(i.items),i.truncated&&L({Spans:`${i.items.length} of ${i.total} (truncated)`}),fp(i.nextCursor)}catch(e){sp(e,t)}}),e.addCommand(ip()),e}function ip(){let e=new b(`runs`).description(`Read eval-runs pivoted off the trace surface`);return e.command(`list`).description(`List eval-runs, newest first`).option(`--status <status>`,`Run status filter`).option(`--gate <decision>`,`Promotion-gate decision filter`).option(`--label <key:value>`,`Match over the run's labels`).option(`--from <iso>`,`ISO-8601 lower bound on received time`).option(`--to <iso>`,`ISO-8601 upper bound on received time`).option(`-q, --query <text>`,`Substring over run dir`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size`).action(async e=>{try{let t={status:e.status===void 0?void 0:gp(e.status),gate:e.gate===void 0?void 0:vp(e.gate),label:e.label,from:e.from,to:e.to,q:e.query,cursor:e.cursor,limit:e.limit===void 0?void 0:yp(e.limit)},n=ap(e),r=e.json?null:I(`Fetching runs...`);r?.start();let i=await n.listRuns(t);if(r?.stop(),e.json)return N(i);up(i.items),fp(i.nextCursor)}catch(t){sp(t,e)}}),e.command(`get <runId>`).description(`Show a single eval-run`).action(async(e,t)=>{try{let n=ap(t),r=t.json?null:I(`Fetching run...`);r?.start();let i=await n.getRun(e);if(r?.stop(),t.json)return N(i);dp(i)}catch(e){sp(e,t)}}),e}function ap(e){let t=Qn(e.apiKey);if(!t)throw Error(`No API key found. Set TANGLE_API_KEY or run: tangle auth login`);return St({apiKey:t,baseUrl:e.baseUrl??process.env.TANGLE_INTELLIGENCE_BASE_URL})}async function op(e,t){let n=(await e.exportTraceSpansNdjson(t)).getReader();try{for(;;){let{value:e,done:t}=await n.read();if(t)break;e&&process.stdout.write(Buffer.from(e))}}finally{n.releaseLock()}}function sp(e,t){return B(e,t.json===!0)}function cp(e){M(e.map(e=>({traceId:e.traceId,root:e.rootName??`-`,model:e.model??`-`,spans:e.spanCount,errors:e.errorCount,durationMs:e.durationMs,cost:pp(e.costUsd)})),[{key:`traceId`,header:`Trace`,width:36},{key:`root`,header:`Root`,width:24},{key:`model`,header:`Model`,width:22},{key:`spans`,header:`Spans`,width:8},{key:`errors`,header:`Errors`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14},{key:`cost`,header:`Cost`,width:10}])}function lp(e){M(e.map(e=>({spanId:e.id,name:e.name,model:e.model??`-`,status:e.statusCode??`-`,cost:e.costUsd===null?`-`:`$${e.costUsd}`})),[{key:`spanId`,header:`Span`,width:40},{key:`name`,header:`Name`,width:28},{key:`model`,header:`Model`,width:22},{key:`status`,header:`Status`,width:10},{key:`cost`,header:`Cost`,width:12}])}function up(e){M(e.map(e=>({runId:e.id,status:e.status,gate:e.gateDecision??`-`,cost:e.totalCostUsd===null?`-`:`$${e.totalCostUsd}`,receivedAt:e.receivedAt})),[{key:`runId`,header:`Run`,width:24},{key:`status`,header:`Status`,width:22},{key:`gate`,header:`Gate`,width:18},{key:`cost`,header:`Cost`,width:12},{key:`receivedAt`,header:`Received`,width:18}])}function dp(e){L({Run:e.id,Status:e.status,Gate:e.gateDecision??void 0,"Run Dir":e.runDir??void 0,Cost:e.totalCostUsd===null?void 0:`$${e.totalCostUsd}`,Duration:e.totalDurationMs===null?void 0:`${e.totalDurationMs}ms`,"Holdout Lift":e.holdoutLift??void 0,Received:e.receivedAt})}function fp(e){e&&L({"Next page":`--cursor ${e}`})}function pp(e){return e===null?`-`:`$${e.toFixed(4)}`}function mp(e){if(e===`ERROR`||e===`OK`)return e;throw Error(`--status must be ERROR or OK`)}const hp=[`started`,`baseline-complete`,`generation-complete`,`gate-decided`,`finished`,`errored`];function gp(e){let t=hp.find(t=>t===e);if(t)return t;throw Error(`--status must be one of ${hp.join(`, `)}`)}const _p=[`ship`,`hold`,`need_more_work`,`model_ceiling`,`arch_ceiling`];function vp(e){let t=_p.find(t=>t===e);if(t)return t;throw Error(`--gate must be one of ${_p.join(`, `)}`)}function yp(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function bp(){return new b(`usage`).description(`Show account usage and billing information`).action(async e=>{let{client:t}=W(e),n=e.json?null:I(`Fetching usage...`);n?.start();let[r,i]=await Promise.all([t.usage(),t.subscription().catch(()=>null)]);n?.stop(),e.json?N({...r,subscription:i}):(console.log(),console.log(`Account Usage`),console.log(`─`.repeat(40)),L({"Active Sandboxes":r.activeSandboxes,"Total Sandboxes":r.totalSandboxes,"Compute Minutes":xp(r.computeMinutes),"GPU Seconds":r.gpuSeconds,"GPU Spend":Sp(r.gpuCostUsd)}),i&&(console.log(),console.log(`Subscription`),console.log(`─`.repeat(40)),L({Plan:i.plan,Status:i.status,"Credits Available":Sp(i.creditsAvailableUsd),"Credits Used":Sp(i.creditsUsedUsd),"Monthly Balance":Sp(i.monthlyBalanceUsd)})),console.log(),console.log(`Billing Period`),console.log(`─`.repeat(40)),L({Start:r.periodStart.toLocaleDateString(),End:r.periodEnd.toLocaleDateString()}),console.log())})}function xp(e){if(e===void 0)return`-`;if(e<60)return`${e} min`;let t=Math.floor(e/60),n=e%60;return n===0?`${t} hr`:`${t} hr ${n} min`}function Sp(e){return e<0?`-$${(-e).toFixed(2)}`:`$${e.toFixed(2)}`}function Cp(){return new b(`use`).description(`Set or show the active sandbox (used when a command omits the id)`).argument(`[id]`,`Sandbox id to make active`).option(`--clear`,`Clear the active sandbox`).action((e,t)=>{if(t.clear){Wn(),F(`Cleared the active sandbox.`);return}if(e){Un(e),F(`Active sandbox set to ${e}. Commands now default to it; override with --box or TANGLE_SANDBOX.`);return}let n=Hn();F(n?`Active sandbox: ${n}`:"No active sandbox. Set one with `tangle use <id>`.")})}function wp(e){M(e,[{key:`id`,header:`ID`},{key:`nodeId`,header:`Node`},{key:`name`,header:`Name`},{key:`contentType`,header:`Content Type`},{key:`byteSize`,header:`Bytes`},{key:`createdAt`,header:`Created`}])}function Tp(e){e.command(`artifacts`).description(`List a run's artifact metadata (never the bytes)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await(await X(n)).workflows.listArtifacts(e,t);if(n.json)return N(r);wp(r.artifacts)}),e.command(`artifact-download`).description(`Download one run artifact's bytes to a file`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).argument(`<artifactId>`,`Artifact ID`).option(`--out <file>`,`Destination file (defaults to the artifact ID)`).action(async(e,t,n,r)=>{let i=await(await X(r)).workflows.downloadArtifact(e,t,n),a=r.out??n;try{me(a,i.bytes)}catch(e){throw Error(`Could not write artifact to "${a}": ${e instanceof Error?e.message:String(e)}`)}if(r.json)return N({file:a,contentType:i.contentType,bytes:i.bytes.length});F(`Wrote ${a} (${i.bytes.length} bytes, ${i.contentType}).`)})}function Ep(e){M(e.map(e=>({id:e.id,run:e.runId,title:e.title,options:e.options.join(`, `),requested:e.requestedAt,expires:e.expiresAt??``})),[{key:`id`,header:`ID`},{key:`run`,header:`Run`},{key:`title`,header:`Title`},{key:`options`,header:`Options`},{key:`requested`,header:`Requested`},{key:`expires`,header:`Expires`}])}function Dp(e){e.command(`decisions`).description(`List a workflow's pending human decisions`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{let n=(await(await X(t)).workflows.listPendingDecisions()).decisions.filter(t=>t.workflowId===e);if(t.json)return N({decisions:n});Ep(n)}),e.command(`decision-resolve`).description(`Answer the decision a run is parked on and resume it`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).requiredOption(`--choice <choice>`,`The option to resolve with (one of the decision's options)`).action(async(e,t,n)=>{let r=await X(n),i=await r.workflows.getRunDecision(e,t),a=await r.workflows.resolveRunDecision(e,t,{decisionId:i.id,choice:n.choice});if(n.json)return N(a);if(a.resumed){F(`Resolved decision ${a.decisionId} with "${a.choice}" — run ${a.runId} resumed.`);return}F(`Resolved decision ${a.decisionId} with "${a.choice}", but run ${a.runId} had already finished — nothing to resume.`)})}function Op(e){try{return fe(e,`utf8`)}catch(t){throw Error(`Could not read workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function kp(e){M(e.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,issues:e.validationErrors.length,updated:e.updatedAt})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`issues`,header:`Issues`},{key:`updated`,header:`Updated`}])}function Ap(e){let t=e.workflows.filter(e=>e.failed>0).length,n=e.workflows.filter(e=>e.failed===0&&e.waiting>0).length,r=e.workflows.filter(e=>e.failed===0&&e.waiting===0&&e.runsInWindow>0).length;F(`${t} failing · ${n} waiting · ${r} healthy · ${e.workflows.length} total over ${e.window}`),M(e.workflows.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,runs:e.runsInWindow,failed:e.failed,waiting:e.waiting,success:e.successRate===null?`—`:`${Math.round(e.successRate*100)}%`,lastRun:e.lastRunStatus??`—`,lastRunAt:e.lastRunAt??`—`})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`runs`,header:`Runs`},{key:`failed`,header:`Failed`},{key:`waiting`,header:`Waiting`},{key:`success`,header:`Success`},{key:`lastRun`,header:`Last Run`},{key:`lastRunAt`,header:`Last Run At`}])}function jp(e){if(L({ID:e.id,Name:e.name,Description:e.description??``,Enabled:e.enabled?`yes`:`no`,Actions:e.actions.length}),e.triggers&&e.triggers.length>0&&(F(`Triggers`),Mp(e.triggers)),e.validationErrors.length>0){F(`Validation issues`);for(let t of e.validationErrors)console.log(` ${t.path}: ${t.message}`)}}function Mp(e){M(e.map(e=>({id:e.id,kind:e.kind,enabled:e.enabled?`yes`:`no`,detail:e.kind===`schedule`?`${e.cron??``} (${e.timezone??``})`:`${e.provider??``}:${e.eventFilter?.event??``}${e.eventFilter?.action?`.${e.eventFilter.action}`:``}`})),[{key:`id`,header:`ID`},{key:`kind`,header:`Kind`},{key:`enabled`,header:`Enabled`},{key:`detail`,header:`Detail`}])}function Np(e){e.command(`list`).description(`List your workflows`).action(async e=>{let t=await(await X(e)).workflows.list();if(e.json)return N(t);kp(t)}),e.command(`fleet`).description(`Fleet overview: every workflow's run tallies over a trailing window, failing-first`).option(`--window <window>`,`Trailing window: 24h, 7d, or 30d`,`7d`).action(async e=>{let t=await(await X(e)).workflows.fleetInsights({window:e.window});if(e.json)return N(t);Ap(t)}),e.command(`get`).description(`Show a workflow's definition and compiled triggers`).argument(`<id>`,`Workflow ID`).option(`--yaml`,`Print only the raw definition YAML (the export path — pipe to a file)`).action(async(e,t)=>{let n=await(await X(t)).workflows.get(e);if(t.yaml){if(n.definitionYaml===null)throw Error(`Workflow ${n.id} has no stored definition YAML to export`);process.stdout.write(n.definitionYaml.endsWith(`
|
|
154
|
-
`)?n.definitionYaml:`${n.definitionYaml}\n`);return}if(t.json)return N(n);jp(n)}),e.command(`create`).description(`Create a workflow from a YAML file`).argument(`<file>`,`Path to the workflow YAML`).action(async(e,t)=>{let n=Op(e),r=await(await
|
|
155
|
-
`)?i.definitionYaml:`${i.definitionYaml}\n`)})}function Bp(e){M(e,[{key:`key`,header:`Key`},{key:`version`,header:`Version`},{key:`updatedAt`,header:`Updated`}])}function Vp(e){L({Key:e.key,Version:e.version,Updated:e.updatedAt}),F(`Value`),N(e.value)}function Hp(e){let t=e.command(`kv`).description(`Read and write a workflow's cross-run KV state`);t.command(`list`).description(`List every KV entry of a workflow`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{let n=await(await
|
|
156
|
-
`)?i.yaml:`${i.yaml}\n`)}),e.command(`rollback`).description(`Restore a prior revision's definition as a NEW head revision (re-validated)`).argument(`<id>`,`Workflow ID`).argument(`<rev>`,`Revision number to restore`).action(async(e,t,n)=>{let r=
|
|
153
|
+
`).requiredOption(`--profile <name|path>`,`Use a canonical analysis AgentProfile, distinct from the Tangle account profile`).option(`--dry-run`,`Inspect Braid's selected analysis configuration without dispatch`).option(`--timeout <ms>`,`Bound the analysis process in milliseconds`,Number,3e5).action(async(e,t)=>{let n=await Ms(e,t);N(n),`status`in n&&n.status!==`completed`&&(process.exitCode=1)})}function X(e){throw new R(`GRAPH_INVALID`,`Graph creation failed`,e,`tangle graph new --help`)}function Ps(e){return typeof e==`string`&&/^[a-z0-9][a-z0-9-]{0,62}$/i.test(e)}const Fs={maxBarren:2,failures:`verbatim`,panel:`off`,bar:`on`,profile:{id:`graph-new-v1`,opening:`The graph has not passed its outside check.`,plan:`Repair the concrete diagnostics with write_graph, run the saved file and submit the actual evidence.`,rules:`Completion requires a successful host run and unchanged YAML. Retain working graph content when blocked.`,headings:{failures:`Failures`,protected:`Passing checks`,changed:`Changes`,findings:`Findings`,bar:`Acceptance`,plan:`Next`,rules:`Rules`}}};var Is=class{owned;lastFailure;pending=Promise.resolve();revision=0;sealed=!1;constructor(e,t,n){this.directory=e,this.options=t,this.cwd=n}async digest(e=this.owned){e||X(`No graph file was saved`);let t=await We(e.file,le.O_RDONLY|le.O_NOFOLLOW);try{let[n,r]=await Promise.all([t.stat(),e.handle.stat()]);return(!n.isFile()||n.dev!==r.dev||n.ino!==r.ino)&&X(`The owned graph file was replaced`),kc(await t.readFile())}finally{await t.close()}}enqueue(e){let t=++this.revision,n=this.pending.then(()=>e(t));return this.pending=n.then(()=>void 0,()=>void 0),n}check=()=>this.enqueue(async e=>{let t=this.owned;if(!t?.result)return!1;let{digest:n,result:r}=t,i=await this.digest(t),a=this.revision===e&&this.owned===t&&t.digest===n&&t.result===r&&i===n;return a&&(this.sealed=!0),a});receipt(){this.owned?.result||X(`No successful graph run was recorded`);let{file:e,digest:t,result:n}=this.owned;return{file:e,digest:t,result:n}}invoke(e,t){return this.sealed&&X(`The graph is accepted; submit its recorded successful run`),this.enqueue(()=>this.write(e,t)).catch(e=>(this.lastFailure=e,{ok:!1,diagnostic:qt(e)}))}async write(e,t){t.throwIfAborted(),this.lastFailure=void 0;let n=e;(!n||!Ps(n.name)||typeof n.source!=`string`||typeof n.run!=`boolean`||Object.keys(n).some(e=>![`name`,`source`,`run`].includes(e)))&&X(`Expected only name, source and boolean run`),this.options.name!==void 0&&n.name!==this.options.name&&X(`The graph name must match --name`),this.owned&&(this.owned.result=void 0);let r=D(this.directory,`${n.name}.yaml`);if(this.owned&&this.owned.file!==r&&X(`This invocation owns one named graph file`),!this.owned)try{this.owned={file:r,handle:await We(r,le.O_RDWR|le.O_CREAT|le.O_EXCL|le.O_NOFOLLOW,384),digest:kc(``)}}catch(e){throw e.code===`EEXIST`&&X(`Graph already exists: ${r}; choose another --name`),e}let i=this.owned;await this.digest()!==i.digest&&X(`The owned graph was changed`);let a=Buffer.from(n.source);for(let e=0;e<a.length;){let{bytesWritten:t}=await i.handle.write(a,e,a.length-e,e);if(!t)throw Error(`Graph file write made no progress`);e+=t}await i.handle.truncate(a.length),await i.handle.sync(),i.digest=kc(a);let o={...this.options,param:[]},s={cwd:this.cwd,signal:t,source:n.source},c=await Pc(r,{...o,dryRun:!0},{...s,connectNeeds:!0});if(`graph`in c||X(`No canonical graph was returned`),c.graph.deliverable.checkRef===`command`&&X(`Host command checks need a jailed verifier node`),await this.digest()!==i.digest&&X(`Graph changed during validation`),!n.run)return{file:r,graphDigest:c.graph.digest,validated:!0};let l=await Pc(r,o,{...s,graphDigest:c.graph.digest});return(!(`status`in l)||l.status!==`winner`||l.graphDigest!==c.graph.digest||await this.digest()!==i.digest)&&X(`The graph must succeed with unchanged YAML`),i.result=l,this.receipt()}async close(){await this.pending,await this.owned?.handle.close()}};async function Ls(e,t,n){let{runId:r,runDir:i,cwd:a,bridge:o,signal:s}=e,c=await o(),l=D(await Ke(D(O(),`.tangle`)),`graphs`);(Ac(a,l)||Ac(l,a))&&X(`The graph store must be outside the agent workspace; choose another working directory`);try{await He(l,{mode:448})}catch(e){if(e.code!==`EEXIST`)throw e}await Ke(l)!==l&&X(`The graph store redirects outside its canonical location`);let u=n.seat??Rn().seat,d=await Es(a,s)(u,{node:`graph-designer`,cwd:a,signal:s,lastCandidate:!0});d||X(`No authenticated native subscription is available`);let{graphDesignerProfile:f}=await import(`@tangle-network/agent-runtime/profiles`),{supervisePursuit:p}=await import(`@tangle-network/agent-runtime/durable`),m=f({profile:{name:`graph-designer`,harness:d.harness,model:{provider:d.provider,default:d.model,...d.reasoningEffort===void 0?{}:{reasoningEffort:d.reasoningEffort}},prompt:{instructions:[`You are the sole graph designer. Author a canonical YAML graph for the requested intent, then qualify and run it using write_graph. Its nodes are complete AgentProfiles with a real independent verifier and declarative route/data outside check. Command checks execute on the host and are refused here; put executable verification in the verifier node's normal native tools. Read the supplied skills and preserve the user's task and authority.`,`Call write_graph with name, complete YAML source and run:false to validate; repair its concrete diagnostics, then call it with the identical source and run:true. The graph schema and executor are owned by the installed loader. Supply defaults for parameters needed by the first run. Only a real successful host run of the unchanged saved file passes. Submit that evidence using submit_result; explain concrete blockers using report_blocked.`]},tools:{agent_runtime_coordination_write_graph:!0,agent_runtime_coordination_submit_result:!0,agent_runtime_coordination_read_continuation:!0,agent_runtime_coordination_report_blocked:!0}}}),h=w(m),g=new Is(l,{...n,seat:u},a),_={maxIterations:6,maxTokens:3e4,deadlineMs:3e5};try{let e=await p(m,{intent:t,name:n.name},{pursuitId:r,runId:r,runDir:i,signal:s,backend:{...c,timeoutMs:_.deadlineMs},budget:_,maxDepth:0,coordination:{authentication:!0,requestTimeoutMs:_.deadlineMs},deliverable:{describe:`The saved graph succeeds with unchanged YAML`,check:g.check,checkState:g.check},continuation:Fs,resolveSupervisorTools:e=>e.runId!==r||e.nodeId!==r||e.depth!==0||e.identity.profileDigest!==h?[]:[{name:`write_graph`,description:`Save, validate and run this graph.`,inputSchema:{type:`object`,properties:{name:{type:`string`},source:{type:`string`},run:{type:`boolean`}},required:[`name`,`source`,`run`],additionalProperties:!1},handler:(t,n)=>((n.nodeId!==e.nodeId||n.ownerId!==e.ownerId||n.runId!==e.runId)&&X(`Wrong graph tool owner`),g.invoke(t,n.signal))}]});if(e.result.kind===`no-winner`||!await g.check()){if(g.lastFailure)throw g.lastFailure;let t=e.result.kind===`no-winner`?e.result.error?.message??e.result.reason:`The graph file changed after its successful run`;throw Object.assign(new R(`GRAPH_DESIGN_FAILED`,`Graph design did not finish`,t,`tangle graph new --help`),{runId:r,node:`graph-designer`})}return g.receipt()}finally{await g.close()}}function Rs(e){e.command(`new <intent>`).description(`Design, validate and run one portable graph`).option(`--seat <seat>`,`Use harness/model@effort for the designer and graph`).option(`--name <name>`,`Save this graph name`).action(async(e,t)=>{process.env.BRIDGE_JAIL_RW_PATHS?.trim()&&X(`Remove BRIDGE_JAIL_RW_PATHS before graph new; extra native write roots cannot contain its host store`),t.name!==void 0&&!Ps(t.name)&&X(`Use letters, numbers and hyphens in --name`);let n=await Mc({},n=>Ls(n,e,t));t.json?N(n):F(`Created ${n.file} · run ${n.result.runId}`)})}async function zs(e){if(!$n(e.apiKey)){if(e.json||e.dryRun||!process.stdin.isTTY)return;await Ai({baseUrl:e.sandboxBaseUrl,signal:e.signal})}return W(e)}async function Bs(e,t,n){let r=ic(t.parameter),i=n??await zs(t);if(!i)throw new R(`AUTH_REQUIRED`,`Hub authentication is required`,`No Tangle credential is configured`,`tangle auth login`);let a=await i.connections.start(e,{cli:!0,connectionParameters:r});return t.json?(N(oc(a)),a):(ac(a,t.browser===!1?!1:await xi(a.redirectUrl),t.wait),a)}async function Vs(e,t,n){let r=async()=>{n.signal?.throwIfAborted();let{connections:r}=await e.connections.list(),i=r.filter(e=>e.status===`active`&&e.providerId.toLowerCase()===t.trim().toLowerCase());return i.length?yr(i,t):void 0},i=await r();if(i||n.json||n.dryRun||!process.stdin.isTTY)return i;let a=await Bs(t,{...n,wait:!0},e);for(;!i&&Date.now()<Date.parse(a.expiresAt);)await Me(1e3,void 0,{signal:n.signal}),i=await r();return i}function Hs(){let e=new b(`hub`).description(`Discover and run Tangle Hub tools`);e.command(`connect`).description(`Connect a provider account`).argument(`provider`,`Provider to connect`).option(`--no-browser`,`Print the authorization URL instead of opening it`).option(`--parameter <key=value>`,`Provider-specific OAuth value. Repeatable.`,(e,t)=>[...t,e],[]).action(async(e,t)=>{await Bs(e,t)});let t=new b(`connections`).description(`List Hub provider connections`).action(async e=>{let t=await(await W(e)).connections.list();if(e.json){N(t);return}rc(t.connections)});t.command(`revoke <connection-id>`).description(`Revoke a Hub provider connection`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=await W(t),r=await vr(n,e);if(!t.force&&!await Yr(`Revoke Hub connection ${r}? `,`--force`)){F(`Revoke cancelled.`);return}let i=await n.connections.revoke(r);if(t.json){N(i);return}F(`Revoked Hub connection ${i.connection.id}.`)}),e.addCommand(t);let n=new b(`permissions`).description(`Manage Hub action permissions`);n.command(`list`).description(`List Hub permissions for a connection`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).action(async e=>{if(!e.connection)throw Error(`--connection is required.`);let t=await W(e),n=await vr(t,e.connection),r=await t.permissions.list(n);if(e.json){N(r);return}Qs(r.policies)}),n.command(`set`).description(`Set Hub permission for one action`).requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).requiredOption(`--action <path>`,`Executor action path`).requiredOption(`--decision <allow|ask|deny>`,`Permission decision`).action(async e=>{if(!e.connection)throw Error(`--connection is required.`);if(!e.action)throw Error(`--action is required.`);let t=$s(e.decision),n=await W(e),r=await vr(n,e.connection),i=await n.permissions.set({connectionId:r,actionPath:e.action,decision:t});if(e.json){N(i);return}Qs([i.policy])}),n.command(`revert-writes`).description("Revoke a bulk `--allow-writes` grant for a connection (deletes only the auto-granted write rows; manual permissions are untouched)").requiredOption(`--connection <ref>`,`Hub connection id, or provider[:account]`).action(async e=>{if(!e.connection)throw Error(`--connection is required.`);let t=await W(e),n=await vr(t,e.connection),r=await t.permissions.revertWrites(n);if(e.json){N(r);return}F(`Reverted ${r.reverted} write permission${r.reverted===1?``:`s`} for connection ${r.connectionId}.`)}),e.addCommand(n),e.addCommand(Ws());let r=new b(`tools`).description(`Discover Hub tools`);return r.command(`sources`).description(`List Hub tool sources`).action(async e=>{let t=await(await W(e)).tools.sources();if(e.json){N(t);return}ec(t.sources)}),r.command(`describe`).description(`Describe a Hub tool`).argument(`path`,`Executor tool path`).action(async(e,t)=>{let n=await(await W(t)).tools.describe(e);if(t.json){N(n);return}tc(n.tool)}),r.command(`search`).description(`Search Hub tools`).argument(`<query...>`,`Search query`).option(`--provider <provider>`,`Filter by provider/source ID`).action(async(e,t)=>{let n=await(await W(t)).tools.search(e.join(` `),{provider:t.provider});if(t.json){N(n);return}Zs(n.tools)}),e.addCommand(r),e.addCommand(Us(`call`)),e.addCommand(Us(`exec`)),e.command(`resume`).description(`Resolve a Hub approval created by a paused execution`).argument(`approval-id`,`Hub approval ID from HUB_APPROVAL_REQUIRED`).option(`--accept`,`Approve the execution approval`).option(`--decline`,`Deny the execution approval`).option(`--cancel`,`Unsupported for approval-backed Hub resume`).action(async(e,t)=>{if(Ks(e),t.cancel)throw Error(`Hub approval resume does not support --cancel. Use --decline to deny the approval.`);if(t.accept&&t.decline)throw Error(`Choose only one of --accept or --decline.`);if(!t.accept&&!t.decline)throw Error(`Choose --accept to approve or --decline to deny the Hub approval.`);let n=await W(t);Js(t.decline?await n.approvals.deny(e):await n.approvals.approve(e),t.json===!0)}),e.command(`status`).description(`Show Hub auth and connection status`).action(async e=>{let t=await(await W(e)).status();if(e.json){N(t);return}sc(t)}),e}function Us(e){return new b(e).description(`Execute a Hub tool`).argument(`<args...>`,`Tool path tokens followed by JSON input`).option(`--connection <ref>`,`Hub connection id, or provider[:account]`).option(`--auto-approve`,`Approve a HUB_APPROVAL_REQUIRED execution and retry once`).option(`--approve`,`Alias for --auto-approve`).option(`--no-hub-key`,`Do not auto-mint a platform Hub key; use the stored credential as-is`).action(async(e,t)=>{let{args:n,approve:r}=Gs(e,t),{path:i,input:a}=Xs(n),o=await W(t),s=t.connection?await vr(o,t.connection):void 0;N((await o.tools.invoke(i,a,{connectionId:s,approve:r})).result)})}function Ws(){let e=new b(`approvals`).description(`List and resolve Hub execution approvals`);e.command(`list`).description(`List pending Hub execution approvals`).action(async e=>{let t=await(await W(e)).approvals.list();if(e.json){N(t);return}qs(t.approvals)});for(let t of[`approve`,`deny`])e.command(t).description(`${t===`approve`?`Approve`:`Deny`} a pending Hub execution approval`).argument(`approval-id`,`Hub approval ID`).action(async(e,n)=>{Ks(e),Js(await(await W(n)).approvals[t](e),n.json===!0)});return e}function Gs(e,t){let n=t.autoApprove;return{args:e.filter(e=>e!==`--approve`&&e!==`--auto-approve`),approve:t.approve===!0||n===!0||e.includes(`--approve`)||e.includes(`--auto-approve`)}}function Ks(e){if(!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`Hub approval ID must contain only letters, numbers, underscores, and dashes.`)}function qs(e){M(e,[{key:`id`,header:`ID`},{key:`providerId`,header:`Provider`},{key:`actionPath`,header:`Action`},{key:`connectionId`,header:`Connection`},{key:`status`,header:`Status`},{key:`expiresAt`,header:`Expires`}])}function Js(e,t){if(t){N(Ys(e));return}F(`Hub approval ${e.approval.id} ${e.approval.status}.`),e.capabilityToken&&F("Capability token minted. Re-run the original command with `--approve` to execute automatically.")}function Ys(e){return{approval:e.approval,...e.capabilityToken?{capabilityToken:{tokenId:e.capabilityToken.tokenId,expiresAt:e.capabilityToken.expiresAt}}:{}}}function Xs(e){if(e.length<2)throw Error(`Usage: tangle hub call <path> <json-input>`);let t=e[e.length-1];try{return{path:e.slice(0,-1).join(`.`),input:JSON.parse(t)}}catch{throw Error(`Hub call input must be valid JSON.`)}}function Zs(e){M(e.map(e=>({...e,provider:e.providerId??e.requiredConnectionProviderId,connection:nc(e)})),[{key:`path`,header:`Path`},{key:`provider`,header:`Provider`},{key:`title`,header:`Title`},{key:`description`,header:`Description`},{key:`connection`,header:`Connection`},{key:`policyState`,header:`Policy`}])}function Qs(e){M(e,[{key:`connectionId`,header:`Connection`},{key:`providerId`,header:`Provider`},{key:`actionPath`,header:`Action`},{key:`decision`,header:`Decision`},{key:`updatedAt`,header:`Updated`}])}function $s(e){if(e===`allow`||e===`ask`||e===`deny`)return e;throw Error(`--decision must be one of: allow, ask, deny.`)}function ec(e){M(e,[{key:`sourceId`,header:`Source`},{key:`displayName`,header:`Provider`},{key:`toolCount`,header:`Tools`},{key:`connectionStatus`,header:`Connection`},{key:`health`,header:`Health`},{key:`configured`,header:`Configured`}])}function tc(e){L({Path:e.path,Provider:e.providerId??e.requiredConnectionProviderId,Title:e.title,Description:e.description,Connection:nc(e),Policy:e.policyState}),e.inputSchema!==void 0&&(F(`Input schema`),console.log(JSON.stringify(e.inputSchema,null,2))),e.outputSchema!==void 0&&(F(`Output schema`),console.log(JSON.stringify(e.outputSchema,null,2)))}function nc(e){if(e.connectionRequired===!1)return`not required`;if(e.connectionStatus)return e.connectionStatus}function rc(e){M(e.map(e=>({...e,account:e.accountDisplay??e.displayName,scopes:e.scopes.join(`, `)})),[{key:`id`,header:`ID`},{key:`providerId`,header:`Provider`},{key:`account`,header:`Account`},{key:`scopes`,header:`Scopes`},{key:`status`,header:`Status`},{key:`health`,header:`Health`},{key:`lastUsedAt`,header:`Last Used`}])}function ic(e){if(!e||e.length===0)return;let t={};for(let n of e){let e=n.indexOf(`=`);if(e<=0||e===n.length-1)throw Error(`Invalid --parameter "${n}": expected key=value (for example subdomain=acme)`);let r=n.slice(0,e);if(Object.hasOwn(t,r))throw Error(`Duplicate --parameter key "${r}".`);t[r]=n.slice(e+1)}return t}function ac(e,t,n=!1){t?F(`Opened browser to connect ${e.provider}.`):(F(`Open this URL to connect ${e.provider}:`),console.log(e.redirectUrl)),F(n?`Finish authorization in the browser; this run resumes when connected.`:"Finish authorization in the browser, then rerun `tangle hub status`.")}function oc(e){return{provider:e.provider,redirectUrl:e.redirectUrl,expiresAt:e.expiresAt,scopes:e.scopes,cli:e.cli}}function sc(e){let{principal:t,connections:n}=e;F(`Hub status`),L({Principal:t.kind,"User ID":t.userId,"API Key ID":t.apiKeyId,"Sandbox ID":t.sandboxId,"Connected Providers":n.connectedProviderCount,"Unhealthy Providers":n.unhealthyProviderCount}),n.unhealthyProviderCount>0&&F(`Some providers require reconnect.`)}const cc=[`claude-code`,`opencode`,`codex`,`kimi-code`,`prime`],lc=process.env.TANGLE_ROUTER_URL??`https://router.tangle.tools/v1`;function uc(e){let t=oe(e);if(t)return t;throw Error(`--model '${e}' has no provider. Pass a canonical id, for example 'google/${e}'.`)}function dc(e){let t=e.harness??`claude-code`;if(!cc.includes(t))throw Error(`Unknown --harness '${t}'. Supported: ${cc.join(`, `)}.`);let n=fc(e.maxTokens,2e5,`--max-tokens`),r=fc(e.maxIterations,50,`--max-iterations`),i=e.maxWorkers===void 0?void 0:fc(e.maxWorkers,0,`--max-workers`);return{harness:t,...e.model?{model:e.model}:{},maxTokens:n,maxIterations:r,...i===void 0?{}:{maxWorkers:i}}}function fc(e,t,n){if(e===void 0)return t;let r=Number.parseInt(e,10);if(!Number.isFinite(r)||r<=0)throw Error(`${n} must be a positive integer, got '${e}'.`);return r}function pc(e){let t={maxTokens:e.maxTokens,maxIterations:e.maxIterations};return e.maxWorkers===void 0?{budget:t}:{budget:t,perWorker:{maxTokens:Math.max(1,Math.floor(e.maxTokens/e.maxWorkers)),maxIterations:Math.max(1,Math.floor(e.maxIterations/e.maxWorkers))}}}function mc(e){let t=e.spentTotal,n=e.kind===`no-winner`?``:e.out;return{text:typeof n==`string`?n:typeof n==`object`&&n&&`content`in n&&typeof n.content==`string`?n.content:JSON.stringify(n),tokenUsage:{input:t.tokensKnown===!1?null:t.tokens.input,output:t.tokensKnown===!1?null:t.tokens.output},costUsd:t.usdKnown===!1?null:t.usd,status:e.kind===`no-winner`?`no-winner (${e.reason})`:`winner`}}let hc=null;function gc(){return hc??=import(`@tangle-network/agent-runtime/kernel`).catch(e=>{throw hc=null,e?.code===`ERR_MODULE_NOT_FOUND`?new R(`RUNTIME_UNAVAILABLE`,`Agent Runtime could not be loaded`,e.message,`npm install -g @tangle-network/sandbox-cli@latest`):e}),hc}async function _c(e,t,n){let r=V({apiKey:n.apiKey,baseUrl:n.baseUrl}),i=H(r),{budget:a,perWorker:o}=pc(t),s=[],c={async create(e){let{TANGLE_API_KEY:t,...r}=e?.env??{},a=await i.create(e?.env?{...e,env:r}:e);return s.push({id:a.id,status:`spawned`}),n.json||F(`worker ${a.id} spawned`),a}},l=await gc(),u=l.workerFromBackend({backend:`sandbox`,sandboxClient:c,maxIterations:1}),d=(e,n)=>u({...e,harness:t.harness},n),f={name:`supervisor`,harness:`cli-base`,model:{default:t.model??`gemini-2.5-flash-lite`,provider:t.model?uc(t.model):`google`},tools:{agent_runtime_coordination_spawn_worker:!0,agent_runtime_coordination_observe_agent:!0}},p={routerBaseUrl:lc,routerKey:r.apiKey},m=mc(await l.supervise(f,{goal:e},{budget:a,makeWorkerAgent:d,router:p,...o?{perWorker:o}:{},...t.model?{allowedModels:[t.model]}:{},runId:`supervise-${S()}`})),h=m.status===`winner`?`settled`:`failed`;for(let e of s)e.status=h,n.json||F(`worker ${e.id} settled (${e.status})`);return{task:e,result:m.text,workers:s,tokenUsage:m.tokenUsage,costUsd:m.costUsd,status:m.status}}function vc(){let e=new b(`supervise`);return e.description(`Run a budget-conserving supervisor that spawns isolated sandbox workers to deliver a task.`).argument(`<task>`,`What the supervisor should accomplish`).option(`--harness <name>`,`Worker harness (${cc.join(` | `)})`,`claude-code`).option(`--model <id>`,`Model for the supervisor + workers`).option(`--max-tokens <n>`,`Conserved token budget for the whole run`,`200000`).option(`--max-iterations <n>`,`Conserved iteration budget for the whole run`,`50`).option(`--max-workers <n>`,`Bound the fanout; each worker reserves floor(max-tokens / n) tokens and floor(max-iterations / n) iterations`).action(async(e,t)=>{let n=dc({harness:t.harness,model:t.model,maxTokens:t.maxTokens,maxIterations:t.maxIterations,maxWorkers:t.maxWorkers});t.json||(F(`Supervising: ${e}`),F(`harness=${n.harness} budget=${n.maxTokens}tok/${n.maxIterations}it`),console.log());let r=await _c(e,n,{apiKey:t.apiKey,baseUrl:t.baseUrl,json:t.json});if(t.json){N(r),r.status!==`winner`&&(process.exitCode=1);return}if(console.log(),r.result&&(console.log(r.result),console.log()),L({"Input Tokens":r.tokenUsage.input??`Unavailable`,"Output Tokens":r.tokenUsage.output??`Unavailable`,Cost:r.costUsd===null?`Unavailable`:`$${r.costUsd.toFixed(4)}`}),r.status!==`winner`)throw Error(`Supervisor finished without a winner: ${r.status}`)}),e}const yc=1e3;function bc(e,t){return[...t,e]}function xc(e,t=`input`,n){if(n===void 0&&!e?.length)return;let r={};if(n!==void 0)try{if(r=JSON.parse(fe(n,`utf8`)),!r||typeof r!=`object`||Array.isArray(r)||Object.entries(r).some(([e,t])=>!e.length||typeof t!=`string`))throw Error(`Invalid input map`)}catch{throw new R(`WORKFLOW_INPUT_FILE_INVALID`,`Could not load --input-file '${n}'`,`Expected a readable JSON object with nonempty keys and string values`,`tangle workflows run --help`)}let i=Object.entries(r);for(let n of e??[]){let e=n.indexOf(`=`);if(e<=0)throw Error(`Invalid --${t} "${n}": expected key=value (e.g. pull_request.number=123)`);i.push([n.slice(0,e),n.slice(e+1)])}return Object.fromEntries(i)}function Sc(e){M(e.map(e=>({id:e.id,status:e.status,attempts:e.attempts,created:e.createdAt,completed:e.completedAt??``})),[{key:`id`,header:`Run ID`},{key:`status`,header:`Status`},{key:`attempts`,header:`Attempts`},{key:`created`,header:`Created`},{key:`completed`,header:`Completed`}])}function Cc(e){if(L({"Run ID":e.id,Workflow:e.workflowId,Status:e.status,Error:e.error??``,Attempts:e.attempts,Created:e.createdAt,Started:e.startedAt??``,Completed:e.completedAt??``}),e.actionResults.length>0){F(`Actions`);let t=e.actionResults.some(e=>e.nodeId!==void 0||e.visit!==void 0);M(e.actionResults.map(e=>({index:e.index,...t?{node:e.nodeId??``,visit:e.visit??``}:{},kind:e.kind,status:e.status,error:e.error??``,cost:e.costUsd??``})),[{key:`index`,header:`#`},...t?[{key:`node`,header:`Node`},{key:`visit`,header:`Visit`}]:[],{key:`kind`,header:`Kind`},{key:`status`,header:`Status`},{key:`error`,header:`Error`},{key:`cost`,header:`Cost (USD)`}])}e.graph&&(F(`Graph`),L({Nodes:e.graph.nodes.length,Edges:e.graph.edges.length,"Max node visits":e.graph.maxNodeVisits}),M(e.graph.edges.map(e=>({from:e.from,to:e.to,guard:e.when===void 0?``:JSON.stringify(e.when)})),[{key:`from`,header:`From`},{key:`to`,header:`To`},{key:`guard`,header:`Guard`}])),e.edgeVerdicts&&e.edgeVerdicts.length>0&&(F(`Edge verdicts`),M(e.edgeVerdicts.flatMap(e=>Object.entries(e.verdicts).map(([t,n])=>({node:e.nodeId,edge:t,verdict:n?`taken`:`not taken`}))),[{key:`node`,header:`Node`},{key:`edge`,header:`Edge`},{key:`verdict`,header:`Verdict`}]))}function wc(e){if(e.status===`cancelled`){F(`Cancelled run ${e.runId}.`);return}if(e.signalled){F(`Cancelling run ${e.runId} — signalled the worker; it will stop shortly.`);return}F(`Requested cancellation of run ${e.runId}, but couldn't confirm it — the run may have just finished, or it's running on another instance and will stop on its own.`)}function Tc(e){switch(e.type){case`snapshot`:F(`snapshot: ${e.run.status} (${e.run.actionResults.length} action(s))`);break;case`action.started`:console.log(`→ action[${e.index}] ${e.kind} started`);break;case`action.finished`:{let t=e.status===`succeeded`?`✓`:e.status===`skipped`?`⊘`:`✗`;console.log(`${t} action[${e.index}] ${e.kind} ${e.status}${e.error?`: ${e.error}`:``}`);break}case`iteration.started`:console.log(` · action[${e.actionIndex}] iteration ${e.iterationIndex} started`);break;case`iteration.ended`:console.log(` · action[${e.actionIndex}] iteration ${e.iterationIndex} ${e.status}`);break;case`token`:typeof e.delta==`string`&&process.stdout.write(e.delta);break;case`ping`:break;case`run.done`:console.log(`\nrun.done: ${e.status}${e.error?`: ${e.error}`:``}`);break;case`run.waiting`:console.log(`\nrun.waiting: parked on a human decision (${e.decisionId}) — resolve it to resume`);break}}function Ec(e){e.command(`run`).description(`Trigger an immediate run of a workflow`).argument(`<id>`,`Workflow ID`).option(`--input-file <file>`,`Trigger inputs from a flat JSON string map; --input overrides its keys`).option(`--input <key=value>`,`Trigger input as key=value (e.g. pull_request.number=123). Repeatable.`,bc,[]).option(`--wait`,`Wait for the run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).action(async(e,t)=>{let n=xc(t.input,`input`,t.inputFile),r=t.timeout===void 0?void 0:Qa(t.timeout,`--timeout`),i=t.pollInterval===void 0?void 0:Qa(t.pollInterval,`--poll-interval`),a=await Y(t),{runId:o}=await a.workflows.run(e,n);if(!t.wait){if(t.json)return N({runId:o});F(`Started run ${o} for workflow ${e}.`),F(`Inspect it with: tangle workflows run-detail ${e} ${o}`);return}let s=t.json?null:I(`Waiting for run ${o} to finish...`).start(),c;try{c=await a.workflows.waitForRun(e,o,{...r===void 0?{}:{timeoutMs:r},...i===void 0?{}:{pollIntervalMs:i}})}finally{s?.stop()}if(c.status===`failed`&&(process.exitCode=1),t.json)return N(c);Cc(c)}),e.command(`runs`).description(`List a workflow's run history (newest first)`).argument(`<id>`,`Workflow ID`).option(`--limit <n>`,`Runs per page (1-100)`).option(`--cursor <cursor>`,`Pagination cursor from a previous page`).option(`--all`,`Fetch every page, not just the first`).action(async(e,t)=>{let n=await Y(t),r=t.limit===void 0?void 0:Qa(t.limit,`--limit`);if(t.all){let i=[],a=t.cursor,o=0,s=null;for(;;){let c=await n.workflows.listRuns(e,{...r===void 0?{}:{limit:r},...a===void 0?{}:{cursor:a}});if(i.push(...c.runs),o+=1,!c.nextCursor)break;if(o>=yc){s=c.nextCursor,t.json||F(`Stopped after ${yc} pages (${i.length} runs); more may exist — resume with --cursor ${c.nextCursor}`);break}a=c.nextCursor}if(t.json)return N({runs:i,nextCursor:s});Sc(i);return}let i=await n.workflows.listRuns(e,{...r===void 0?{}:{limit:r},...t.cursor===void 0?{}:{cursor:t.cursor}});if(t.json)return N(i);Sc(i.runs),i.nextCursor&&F(`More runs available — next page: --cursor ${i.nextCursor}`)}),e.command(`run-detail`).description(`Show a single run's detail (per-action output and errors)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await(await Y(n)).workflows.getRun(e,t);if(n.json)return N(r);Cc(r)}),e.command(`cancel`).description(`Cancel a queued or in-progress run`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await(await Y(n)).workflows.cancel(e,t);if(n.json)return N(r);wc(r)}),e.command(`retry`).description(`Re-run a failed or cancelled run (a fresh run with the same trigger context)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID of the failed/cancelled run to retry`).option(`--wait`,`Wait for the new run to finish and print its result`).option(`--timeout <ms>`,`With --wait, fail if the run has not finished after this many milliseconds`).option(`--poll-interval <ms>`,`With --wait, how often to poll for completion (default 2000)`).action(async(e,t,n)=>{let r=n.timeout===void 0?void 0:Qa(n.timeout,`--timeout`),i=n.pollInterval===void 0?void 0:Qa(n.pollInterval,`--poll-interval`),a=await Y(n),o=await a.workflows.retryRun(e,t);if(!n.wait){if(n.json)return N(o);F(`Started run ${o.runId} (retry of ${t}).`),F(`Inspect it with: tangle workflows run-detail ${e} ${o.runId}`);return}let s=n.json?null:I(`Waiting for run ${o.runId} to finish...`).start(),c;try{c=await a.workflows.waitForRun(e,o.runId,{...r===void 0?{}:{timeoutMs:r},...i===void 0?{}:{pollIntervalMs:i}})}finally{s?.stop()}if(c.status===`failed`&&(process.exitCode=1),n.json)return N(c);Cc(c)}),e.command(`events`).description(`Tail a run's live progress events until it finishes`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await Y(n);for await(let i of r.workflows.watchRun(e,t))n.json?console.log(JSON.stringify(i)):Tc(i),i.type===`run.done`&&i.status===`failed`&&(process.exitCode=1)})}const Dc=t(import.meta.url);if(!Dc)throw Error(`Tangle CLI package metadata was not found`);const Oc=ge(Dc),kc=e=>x(`sha256`).update(e).digest(`hex`);function Ac(e,t){let n=ye(e,t);return n!==`..`&&!n.startsWith(`..${xe}`)&&!ve(n)}function jc(e,t){if(/[\\/]/.test(e)||/\.(yaml|yml|json)$/.test(e))return be(t,e);let n=t;for(;!ue(D(n,`.git`))&&ge(n)!==n;)n=ge(n);ue(D(n,`.git`))||(n=t);let r=[D(n,`.tangle`,`graphs`,`${e}.yaml`),D(O(),`.tangle`,`graphs`,`${e}.yaml`)],i=r.find(ue);if(i)return i;throw new R(`GRAPH_NOT_FOUND`,`Graph '${e}' was not found`,`Looked in ${r.join(` and `)}`,`tangle graph --help`)}async function Mc(e,t){return ys(e.signal,async n=>{let r=e.runId??S(),i;try{let a=D(O(),`.tangle`,`runs`,r);await He(a,{recursive:!0,mode:448});let o=await Ke(D(O(),`.tangle`)),s=await Ke(e.cwd??process.cwd()),c=[`runs`,`graph-registry`,`graphs`].some(e=>Ac(s,D(o,e))||Ac(D(o,e),s))?D(O(),`.tangle`,`workspaces`,r):s;await He(c,{recursive:!0,mode:448});let l;return await t({runId:r,runDir:a,cwd:c,bridge:e=>l??=(async()=>{n.throwIfAborted();let t=ne(32).toString(`hex`),{loadConfig:r,startServer:o}=await import(`cli-bridge`),s=D(Oc,`dist`,`stdio.mjs`),l=r({...process.env,BRIDGE_HOST:`127.0.0.1`,BRIDGE_PORT:`3344`,BRIDGE_BEARER:t,BRIDGE_DATA_DIR:D(a,`bridge`),BRIDGE_BACKENDS:Ts,BRIDGE_JAIL_MODE:`fs-jail`,BRIDGE_JAIL_FALLBACK:`deny`,BRIDGE_SUBSCRIPTIONS_ONLY:`1`});e&&l.jailReadablePaths.push(s),i=await o({cwd:c,config:{...l,port:0},handleSignals:!1,quiet:!0,hub:e?{client:e,hash:vs,serverForGrant:e=>{if(!i)throw Error(`Hub host is not ready`);return{transport:`stdio`,command:process.execPath,args:[{kind:`public`,value:s}],env:{TANGLE_HUB_MCP_ENDPOINT:{kind:`public`,value:`${i.url}/hub/mcp/grants/${e}`}}}}}:void 0});let{graphNativeCapture:u}=await import(`./graph-native-CS_TmaCK.mjs`);return{harnessTranscript:u({bridgeUrl:i.url,bridgeBearer:t,cwd:c}),backend:`bridge`,bridgeUrl:i.url,bridgeBearer:t,cwd:c}})(),signal:n})}catch(t){throw t instanceof Error&&Object.assign(t,{runId:e.errorRunId??r}),t}finally{await i?.close()}},e.fix??`tangle graph --help`)}async function Nc(e,t,n,r){let i=await Y({...n,signal:r}),a=kc(t),o=xc(n.param,`param`),s={name:he(e).replace(/\.(yaml|yml|json)$/i,``),...o?{params:o}:{},...n.seat?{seat:n.seat}:{}},c,l;if(n.resume){let e=await i.workflows.getRun(n.resume,{signal:r});e.id!==n.resume&&J(`The cloud owner returned another run identity`);let t=e.execution;if((t?.kind!==`graph`||t.sourceSha!==a)&&J(`The authored cloud graph source changed`),Object.entries(o??{}).some(([e,n])=>!Object.hasOwn(t.params,e)||ae(t.params[e])!==ae(n))&&J(`A recorded cloud graph parameter changed`),n.seat!==void 0&&n.seat!==t.deploy.seat&&J(`The recorded cloud seat override changed`),n.dryRun)return{run:e};if((e.status===`cancelled`||e.status===`failed`)&&J(`The cloud run is terminal: ${e.status}`),e.status===`succeeded`)return e.graphResult||J(`The settled cloud run has no retained Runtime result`),{workflowId:e.workflowId,runId:e.id,sourceDigest:a,result:e.graphResult,replayed:!0,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(e.workflowId)}/runs/${encodeURIComponent(e.id)}`};if(e.recovery?.state===`running`)return{workflowId:e.workflowId,runId:e.id,sourceDigest:a,run:e,attached:!0,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(e.workflowId)}/runs/${encodeURIComponent(e.id)}`};e.recovery?.state!==`queued`&&e.recovery?.state!==`recoverable`&&J(`The owner has not confirmed recovery eligibility`),c=e.workflowId,l=e.revUsed??J(`The captured cloud revision is unavailable`)}else{if(n.dryRun)return i.workflows.validate(t,{format:`graph`,deploy:s});let e=await i.workflows.create(t,{format:`graph`,deploy:s});c=e.id,l=e.headRev??J(`The cloud workflow has no retained revision`)}r.throwIfAborted();let u=await i.workflows.run(c,void 0,{signal:r,sourceSha:a,expectedRev:l,...n.resume?{resumeRunId:n.resume}:{}});return n.resume&&u.runId!==n.resume&&J(`The cloud owner recovered another run identity`),{...u,workflowId:c,sourceDigest:a,viewerUrl:`${i.baseUrl}/app/workflows/${encodeURIComponent(c)}/runs/${encodeURIComponent(u.runId)}`}}async function Pc(e,t,n={}){let r=[`tangle graph run`,Ve(e),...t.dryRun?[`--dry-run`]:[],...t.cloud?[`--cloud`]:[],...t.resume?[`--resume`,Ve(t.resume)]:[],...t.seat?[`--seat`,Ve(t.seat)]:[],...t.param.flatMap(e=>[`--param`,Ve(e)])].join(` `);return await ys(n.signal,async i=>{i.throwIfAborted();let a=await Ke(jc(e,n.cwd??process.cwd())),o=n.source??await Ge(a,`utf8`);if(!t.resume&&t.cloud||t.resume?.startsWith(`wfrun_`))return Nc(a,o,t,i);let s=await gc(),c=kc(o),l=xc(t.param,`param`)??{},u=t.resume?await Ss(t.resume):void 0,d=s.graphRegistry(D(O(),`.tangle`,`graph-registry`)),f;if(u){u.file!==a&&J(`The recorded graph source path changed`);let e=await s.loadGraph(d,u.graphDigest);e||J(`The recorded executable graph is unavailable`),f=s.validateStoredGraph(e),ws(u,t,c,l)}let p={apiKey:t.apiKey,sandboxBaseUrl:t.baseUrl,signal:i,json:t.json,dryRun:t.dryRun&&!n.connectNeeds},m,h=()=>m??=zs(p),g=new Map,_=e=>{let t=e.trim().toLowerCase(),n=g.get(t)??(async()=>{let e=await h(),n=e&&await Vs(e,t,p);return n?{connectionId:n,capabilities:[`*`]}:void 0})();return g.set(t,n),n},v=async e=>{if(i.throwIfAborted(),u&&f)return{graph:f,params:u.params};let r=await s.loadGraphFile(a,{source:o,seat:t.seat??Rn().seat,resolveSeat:Es(e,i),resolveNeed:_,params:l,cwd:e,signal:i});if(i.throwIfAborted(),n.graphDigest&&r.graph.digest!==n.graphDigest)throw new R(`GRAPH_CHANGED`,`The validated graph changed before execution`,`Its compiled graph digest no longer matches validation`,`tangle graph run --help`);return r};return t.dryRun?v(n.cwd??process.cwd()):Mc({...n,...u?{runId:u.runId,cwd:u.cwd}:{},signal:i,fix:r},async({runId:e,runDir:n,cwd:r,bridge:o})=>{let l=await v(r),{superviseGraphPursuit:f,readSettleRecord:p}=await import(`@tangle-network/agent-runtime/durable`),m=await s.recordStoredGraphRun(d,l.graph),g=u??{version:1,runId:e,cwd:r,file:a,graphDigest:m.digest,sourceDigest:c,params:l.params,startedAt:new Date().toISOString(),...t.seat===void 0?{}:{seat:t.seat}};u||await Cs(n,g);let _=u?await p(n):void 0;if(_&&_.tree.root!==e&&J(`The settlement names another run`),_?.kind===`no-winner`&&J(`The local run is terminal: ${_.reason}`),_)return{runId:e,graphDigest:m.digest,sourceDigest:c,...mc(_),replayed:!0};let ee=s.graphFromStored(m),y=m.nodes.some(e=>e.profile.connections?.length),te=y?await h():void 0;if(y&&!te)throw new R(`AUTH_REQUIRED`,`Hub authentication is required`,`No Tangle credential is configured for this local graph`,`tangle auth login`);let b=await o(te),x=g.startedAt;F(`Run ${e} · ${he(a)} · ${r}`);let ne=await Fc(n);F(`Viewer ${ne.url}`);let S=await f(ee,{pursuitId:m.digest,runDir:n,runId:e,backend:b,resume:!!u,signal:i,profileSecurity:{allowConnections:y,allowLocalMcp:!1,allowHooks:!1,allowedMcpHosts:[]}}).finally(ne.close),re={runId:e,graphDigest:m.digest,sourceDigest:c,...mc(S.result.result)},C=S.result.result,{tokens:ie,tokensKnown:w,iterations:ae,ms:oe}=C.spentTotal;if(await s.recordStoredGraphRun(d,m,{graphDigest:m.digest,evidence:[{kind:`authored-graph`,url:`urn:sha256:${m.digest}`},{kind:`authored-yaml`,url:`urn:sha256:${c}`}],taskDigest:s.taskShapeDigest({graph:he(a),params:l.params}),startedAt:x,finishedAt:new Date().toISOString(),outcome:C.kind===`no-winner`?{kind:`no-winner`,reason:C.reason}:{kind:`delivered`,summary:re.text},cost:{iterations:ae,ms:oe,...w===!1?{}:{tokens:ie.input+ie.output},...re.costUsd===null?{}:{usd:re.costUsd}},traversals:S.result.ledger.length,exhaustedEdges:S.result.exhaustedEdges,source:{kind:`tangle-cli-graph`,id:e}}),C.kind===`no-winner`)throw Object.assign(new R(`GRAPH_RUN_FAILED`,`Graph '${he(a)}' finished without a result`,S.result.ledger.filter(e=>e.outcome===`unpropagated`&&e.reason).pop()?.reason||C.reason,`tangle graph inspect ${e}`),{runId:e,runtimeFailures:[...C.tree.nodes.filter(e=>e.failure).map(e=>({node:e.label,failure:e.failure})),...C.reason===`driver-failed`&&C.error.failure?[{node:`root`,failure:C.error.failure}]:[]]});return re})},r)}async function Fc(e){let{serveTopWeb:t}=await import(`@tangle-network/agent-runtime/tui`),{readGraphSessions:n}=await import(`./graph-native-CS_TmaCK.mjs`);return t({roots:[e],assets:D(Oc,`dist`,`graph-viewer`),readSessions:n})}async function Ic(e,t){if(e.startsWith(`wfrun_`)){let n=await Y(t),r=await n.workflows.getRun(e);return t.json?N(r):F(`Run ${e} · ${n.baseUrl}/app/workflows/${encodeURIComponent(r.workflowId)}/runs/${encodeURIComponent(e)}`)}let n=D(O(),`.tangle`,`runs`,e);if(!/^[a-f0-9-]{36}$/i.test(e)||!ue(n))throw new R(`RUN_NOT_FOUND`,`Run '${e}' was not found`,`Use a run ID printed by tangle graph run`,`tangle graph inspect --help`);let{loadTopSnapshot:r}=await import(`@tangle-network/agent-runtime/tui`);if(t.json)return N(await r(process.cwd(),{runDir:n}));F(`Run ${e} · ${(await Fc(n)).url}`)}function Lc(){let e=new b(`graph`).description(`Build and run portable agent graphs`);return Rs(e),Ns(e),e.command(`inspect <run>`).description(`Inspect a live or retained graph run`).action(Ic),e.command(`run <name-or-file>`).description(`Run a saved graph over native subscriptions`).option(`--cloud`,`Run through Tangle's durable cloud workflow owner`).option(`--resume <run>`,`Resume this run's saved graph and durable execution`).option(`--seat <seat>`,`Use harness/model@effort for every node`).option(`--param <key=value>`,`Graph parameter; repeatable`,(e,t)=>[...t,e],[]).option(`--dry-run`,`Validate and print the graph without starting agents`).action(async(e,t)=>{let n=await Pc(e,t);t.json||t.dryRun?N(n):`status`in n?(F(`${n.status} · ${n.runId}`),n.text&&console.log(n.text)):`viewerUrl`in n&&F(`Run ${n.runId} · ${n.viewerUrl}`)}),e}function Rc(){let e=new b(`intelligence`).description(`Create and inspect trace intelligence reports`);return e.command(`connect [agent]`).alias(`connect-agent`).description(`Connect local agent CLIs to Tangle Intelligence`).option(`--endpoint <url>`,`OTLP endpoint base`,ea).option(`--workspace <path>`,`Workspace to write hook files into`,`.`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`,`local`).option(`--dry-run`,`Print planned writes without changing files`).option(`--hook-command <command>`,`Command native hooks should run`,`tangle intelligence hook`).option(`--no-smoke`,`Skip the install smoke trace`).action(async(e,t)=>{let n=e??`local`;aa(n);let r=Bc(t.apiKey),i=await ua({selection:n,workspace:t.workspace,apiKey:r,endpoint:t.endpoint,serviceName:t.serviceName??sa(t.workspace),environment:t.environment,smoke:t.smoke,dryRun:!!t.dryRun,hookCommand:t.hookCommand}),a={configPath:i.configPath,agents:i.agents,nativeAgents:i.nativeAgents,manual:i.manual,written:i.written,smokeTraceId:i.smokeTraceId};if(t.json){N(a);return}L({Config:i.configPath,Agents:i.agents.join(`, `),"Native Hooks":i.nativeAgents.join(`, `)||void 0,"Manual Setup":i.manual.length?i.manual.map(e=>`${e.label}: ${e.reason}`).join(` `):void 0,Files:i.written.join(`, `),"Smoke Trace":i.smokeTraceId})}),e.command(`doctor`).description(`Check whether your agent traces carry CONTENT or are metadata-only`).option(`--endpoint <url>`,`OTLP endpoint base`,ea).action(async e=>{let t=la(),n=await ha({endpoint:e.endpoint===`https://intelligence.tangle.tools/v1/otlp`?t?.endpoint??`https://intelligence.tangle.tools/v1/otlp`:e.endpoint,apiKey:Bc(e.apiKey??t?.apiKey)});e.json?N(n):zc(n),n.contentSeen||(process.exitCode=1)}),e.command(`hook`).description(`Emit one local agent hook event to Tangle Intelligence`).requiredOption(`--agent <agent>`,`Agent surface`).requiredOption(`--event <event>`,`Hook event name`).option(`--payload <json>`,`Hook payload JSON`).option(`--endpoint <url>`,`OTLP endpoint base`).option(`--service-name <name>`,`OTel service.name label`).option(`--environment <name>`,`OTel deployment.environment label`).option(`--session-id <id>`,`Session id override`).option(`--dry-run`,`Build the OTLP request without sending it`).option(`--non-blocking`,`Do not fail the parent agent process`).action(async e=>{try{let t=Vc(e.agent),n=la(),r={agent:t,event:e.event,endpoint:e.endpoint??n?.endpoint??`https://intelligence.tangle.tools/v1/otlp`,apiKey:Bc(e.apiKey??n?.apiKey),serviceName:e.serviceName??n?.serviceName??sa(process.cwd()),environment:e.environment??n?.environment??`local`,sessionId:e.sessionId,payload:e.payload===void 0?await Uc():Hc(e.payload)};if(e.dryRun){let n=fa(r);if(e.json){N(n);return}L({Trace:n.traceId,Agent:t,Event:e.event});return}let i=await pa(r);if(e.json){N({traceId:i});return}L({Trace:i,Agent:t,Event:e.event})}catch(t){if(e.nonBlocking){let n=t instanceof Error?t.message:String(t);e.json?N({ok:!1,error:n}):console.error(`Tangle Intelligence hook skipped: ${n}`);return}B(t)}}),e.command(`sandbox <sandbox-id>`).description(`Create an intelligence report for one sandbox`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async(e,t)=>{await Wc({type:`sandbox`,id:e},t)}),e.command(`fleet <fleet-id>`).description(`Create an intelligence report for a sandbox fleet`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async(e,t)=>{await Wc({type:`fleet`,id:e},t)}),e.command(`create`).description(`Create a trace intelligence report`).requiredOption(`--subject-type <type>`,`sandbox | fleet`).requiredOption(`--subject-id <id>`,`Subject identifier`).option(`--mode <mode>`,`deterministic | agentic`,`deterministic`).option(`--max-usd <amount>`,`Maximum customer charge for agentic analysis`).option(`--metadata <json>`,`Metadata JSON object`).action(async e=>{await Wc({type:Kc(e.subjectType),id:e.subjectId},e)}),e.command(`get <job-id>`).description(`Get an intelligence report`).action(async(e,t)=>{let{client:n}=U(t),r=t.json?null:I(`Fetching intelligence report...`);r?.start();let i=await n.intelligence.getReport(e);if(r?.stop(),t.json){N(i);return}Gc(i)}),e.command(`list`).description(`List intelligence reports`).option(`--subject-type <type>`,`sandbox | fleet`).option(`--subject-id <id>`,`Subject identifier`).option(`--limit <count>`,`Maximum reports to return`).action(async e=>{let{client:t}=U(e),n=e.json?null:I(`Fetching intelligence reports...`);n?.start();let r=await t.intelligence.listReports({subjectType:e.subjectType===void 0?void 0:Kc(e.subjectType),subjectId:e.subjectId,limit:e.limit===void 0?void 0:Yc(e.limit)});if(n?.stop(),e.json){N(r);return}M(r.map(e=>({jobId:e.jobId,subject:`${e.subject.type}:${e.subject.id}`,mode:e.mode,status:e.status,cost:`$${e.billing.costUsd.toFixed(2)}`,updatedAt:e.updatedAt})),[{key:`jobId`,header:`Job`,width:20},{key:`subject`,header:`Subject`,width:28},{key:`mode`,header:`Mode`,width:15},{key:`status`,header:`Status`,width:14},{key:`cost`,header:`Cost`,width:10},{key:`updatedAt`,header:`Updated`,width:18}])}),e}function zc(e){L({Status:e.contentSeen?`content flowing`:e.tracesSeen?`metadata-only — a content gate is missing`:`no traces yet`,"Traces seen":e.tracesSeen?`yes`:`no`,"Content seen":e.contentSeen?`yes`:`no`,"Last seen":e.lastSeenAt??`never`,Window:`${e.windowDays}d`});let t=Object.entries(e.byAgent);t.length>0&&(console.log(),M(t.map(([e,t])=>({agent:e,traces:t.tracesSeen?`yes`:`no`,content:t.contentSeen?`yes`:`no`})),[{key:`agent`,header:`Agent`,width:18},{key:`traces`,header:`Traces`,width:10},{key:`content`,header:`Content`,width:10}]))}function Bc(e){let t=e??process.env.TANGLE_INTELLIGENCE_API_KEY??process.env.TANGLE_API_KEY;if(!t)throw Error(`--api-key, TANGLE_INTELLIGENCE_API_KEY, or TANGLE_API_KEY is required`);return t}function Vc(e){if(oa(e))return e;throw Error(`agent must be a known Tangle Intelligence agent surface`)}function Hc(e){try{return JSON.parse(e)}catch(e){throw Error(`--payload must be JSON: ${e instanceof Error?e.message:String(e)}`)}}async function Uc(){if(process.stdin.isTTY)return;let e=``;for await(let t of process.stdin)if(e+=typeof t==`string`?t:t.toString(`utf8`),e.length>65536)throw Error(`hook payload exceeds 65536 bytes`);let t=e.trim();if(t)try{return JSON.parse(t)}catch{return{body:t.slice(0,4096)}}}async function Wc(e,t){let n=qc(t.mode),r=Xc(t.metadata),i=t.maxUsd===void 0?void 0:Jc(t.maxUsd);if(n===`agentic`&&i===void 0)throw Error(`Agentic intelligence reports require --max-usd`);let{client:a}=U(t),o=t.json?null:I(`Creating intelligence report...`);o?.start();let s=await a.intelligence.createReport({subject:e,mode:n,...i===void 0?{}:{budget:{billTo:`customer`,maxUsd:i}},...r===void 0?{}:{metadata:r}});if(o?.stop(),t.json){N(s);return}Gc(s)}function Gc(e){L({Job:e.jobId,Subject:`${e.subject.type}:${e.subject.id}`,Mode:e.mode,Status:e.status,"Billed To":e.billing.billedTo,Cost:`$${e.billing.costUsd.toFixed(2)}`,Budget:e.billing.budgetMaxUsd===void 0?void 0:`$${e.billing.budgetMaxUsd.toFixed(2)}`,Updated:e.updatedAt}),e.result!==null&&(console.log(),N(e.result))}function Kc(e){if(e===`sandbox`||e===`fleet`)return e;throw Error(`subject type must be sandbox or fleet`)}function qc(e){if(e===`deterministic`||e===`agentic`)return e;throw Error(`mode must be deterministic or agentic`)}function Jc(e){let t=Number(e);if(!Number.isFinite(t)||t<0)throw Error(`--max-usd must be a non-negative number`);return t}function Yc(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function Xc(e){if(e===void 0)return;let t=JSON.parse(e);if(!t||typeof t!=`object`||Array.isArray(t))throw Error(`--metadata must be a JSON object`);return t}const Zc=[`router`,`sandbox`,`blueprint-agent`,`evals`,`agent-builder`];async function Qc(e,t){let n=await Nr({...e.apiKey===void 0?{}:{apiKey:e.apiKey},...e.platformUrl===void 0?{}:{baseUrl:e.platformUrl},...e.baseUrl===void 0?{}:{sandboxBaseUrl:e.baseUrl}});if(!t||!n.minted)return n;throw Error("This command needs a key you minted yourself. A browser login is exchanged for a short-lived key the platform will not accept for key management. Set TANGLE_API_KEY, run `tangle auth login --api-key sk-tan-…`, or mint the key in the web console. `tangle keys list` works from the login alone.")}async function $c(e,t,n={}){let r=new Headers(n.headers);n.body&&!r.has(`content-type`)&&r.set(`content-type`,`application/json`);let i=await Pr(e,t,{...n,headers:r});if(n.expected!==void 0&&i.status!==n.expected)throw Error(await el(i,t));return i}async function el(e,t){let n=await e.text().catch(()=>``),r;try{let e=JSON.parse(n),t=typeof e?.error==`string`?e.error:e?.error?.message;typeof t==`string`&&t.trim()&&(r=t)}catch{}if(r)return`${r} (HTTP ${e.status})`;let i=n?`: ${n.slice(0,400)}`:``;return`Platform request to ${t} returned ${e.status}${i}`}const tl=[`ID`,`Prefix`,`Name`,`Product`,`Created`,`Last used`,`Expires`];function nl(e){return[e.id,e.keyPrefix??``,e.name,e.product??`all`,e.createdAt,e.lastUsedAt??`—`,e.expiresAt??`—`]}function rl(){let e=new b(`keys`).description(`Manage sk-tan-* API keys on id.tangle.tools`);return e.command(`list`).description(`List your active API keys`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async e=>{let t=await Qc(e,!1),n=t.baseUrl,r=await(await $c(t,`${n}/v1/keys`,{expected:200})).json();if(e.json){N(r);return}It(tl,r.data.map(nl))}),e.command(`create`).description(`Create a new API key`).argument(`<name>`,`Human-readable name for the key`).option(`--product <product>`,`Restrict the key to one product (${Zc.join(`|`)}). Omit for all products.`).option(`--budget-usd <amount>`,`Hard budget cap in USD`).option(`--rpm-limit <limit>`,`Requests-per-minute cap`).option(`--expires-in-days <days>`,`Expire the key after N days (integer)`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(e,t)=>{if(t.product!==void 0&&!Zc.includes(t.product))throw Error(`Invalid --product. Expected one of ${Zc.join(`, `)}`);let n=await Qc(t,!0),r=n.baseUrl,i=t.expiresInDays===void 0?void 0:new Date(Date.now()+Number.parseInt(t.expiresInDays,10)*24*60*60*1e3).toISOString(),a=I(`Creating API key...`);a.start();let o=await $c(n,`${r}/v1/keys`,{method:`POST`,expected:201,body:JSON.stringify({name:e,product:t.product,budgetUsd:t.budgetUsd?Number.parseFloat(t.budgetUsd):void 0,rpmLimit:t.rpmLimit?Number.parseInt(t.rpmLimit,10):void 0,expiresAt:i})});a.stop();let s=await o.json();if(t.json){N(s);return}P(`API key created: ${s.data.prefix}…`),F(`Copy this key now — it will never be shown again:\n${s.data.key}`)}),e.command(`revoke`).description(`Revoke an API key`).argument(`<keyId>`,"Key ID (from `tcloud keys list`)").option(`--yes`,`Skip the confirmation prompt`).option(`--platform-url <url>`,`Override the platform URL (id.tangle.tools)`).action(async(e,t)=>{let n=await Qc(t,!0),r=n.baseUrl;if(!t.yes&&!await Yr(`Revoke key ${e}? Any service still using it will start to fail.`,`--yes`)){F(`Aborted.`);return}let i=await(await $c(n,`${r}/v1/keys/${encodeURIComponent(e)}`,{method:`DELETE`,expected:200})).json();if(t.json){N(i);return}P(`Revoked ${e}`)}),e}function il(e){if(Hn().token)throw Error(`A line relay cannot manage numbers or attachments. Use your owner CLI outside the agent box.`);return H(V(e))}function al(e){if(!e.yes)throw Error(`Review the selected line and use --yes to authorize this change. Attaching enables metered agent work.`)}function ol(e){if(e===`imessage`||e===`whatsapp`||e===`email`||e===`sms`||e===`voice`||e===`telegram`)return e;throw Error(`--transport must be imessage, whatsapp, email, sms, voice, or telegram`)}function sl(e){return e().catch(B)}async function cl(e){let t=await We(e,`r`);try{if(!(await t.stat()).isFile())throw Error(`Attachment input must be a regular JSON file`);let e=Buffer.alloc(131073),n=0;for(;n<e.length;){let{bytesRead:r}=await t.read(e,n,e.length-n,null);if(r===0)break;n+=r}if(n===e.length)throw Error(`Attachment JSON exceeds 128 KiB`);let r;try{r=JSON.parse(e.subarray(0,n).toString(`utf8`))}catch{throw Error(`Attachment file is not valid JSON`)}if(!r||typeof r!=`object`||Array.isArray(r))throw Error(`Attachment JSON must be an object`);if(Object.hasOwn(r,`number`))throw Error(`Use the line ID argument, not a number field in the attachment file`);return r}finally{await t.close()}}function ll(e){e.command(`providers`).description(`List provider transports supported by this Hub deployment`).action(e=>sl(async()=>{N(await il(e).lines.providers())})),e.command(`list`).description(`List owned lines, optionally for a saved agent profile or sandbox`).option(`--profile-id <id>`,`Stored profile ID`).option(`--sandbox <id>`,`Existing sandbox ID`).action(e=>sl(async()=>{N(await il(e).lines.list({profileId:e.profileId,sandboxId:e.sandbox}))})),e.command(`get`).argument(`<line-id>`).description(`Inspect a line and its current attachment`).action((e,t)=>sl(async()=>{N(await il(t).lines.get(e))})),e.command(`numbers`).argument(`<connection-id>`).description(`Discover owned provider numbers; this does not purchase or reserve a number`).option(`--transport <transport>`,`imessage, whatsapp, or sms`,`imessage`).action((e,t)=>sl(async()=>{let n=ol(t.transport);if(n===`email`)throw Error(`Email uses an owned mailbox, not phone inventory`);if(n===`voice`)throw Error(`Voice numbers are listed by ph0ny; provide the owned number ID to lines connect`);if(n===`telegram`)throw Error(`Telegram uses an owned bot, not phone inventory`);N(await il(t).lines.numbers(e,n))})),e.command(`connect`).argument(`<connection-id>`).description(`Bind an owned number or identity through Hub; no provider rental is purchased`).option(`--transport <transport>`,`imessage, whatsapp, sms, email, voice, or telegram`,`imessage`).option(`--number-id <id>`,`Exact owned provider number ID; required for voice, SMS, WhatsApp and Linq iMessage`).option(`--address <email>`,`Owned mailbox on a verified email domain`).requiredOption(`--reference <reference>`,`Stable client reference; keep it unchanged on retry`).option(`--label <label>`,`Line display name`).option(`--yes`,`Authorize provider webhook configuration and line binding`).action((e,t)=>sl(async()=>{al(t);let n=ol(t.transport);if(n!==`email`&&t.address)throw Error(`--address is email-only`);if((n===`email`||n===`telegram`)&&t.numberId)throw Error(`${n} does not take --number-id`);let r={connectionId:e,label:t.label,clientReference:t.reference},i;if(n===`email`)i={...r,transport:n,address:t.address};else if(n===`telegram`)i={...r,transport:n};else if(n===`imessage`)i={...r,transport:n,phoneNumberId:t.numberId};else{if(!t.numberId)throw Error(`${n} requires --number-id`);i={...r,transport:n,phoneNumberId:t.numberId}}N(await il(t).lines.fromConnection(i))})),e.command(`attach`).argument(`<line-id>`).description(`Attach a saved agent to any sandbox, or use an isolated on-demand member instance`).option(`--file <path>`,`Reviewed native attachment JSON (exclusive with quick-setup flags)`).option(`--profile-id <id>`,`Owner-scoped saved profile; each turn pins its source revision`).option(`--member <address>`,`The one allowed sender: E.164 phone or email`).option(`--sandbox <id>`,`Use an existing sandbox instead of an on-demand instance`).option(`--instance-prefix <prefix>`,`Stable instance namespace; defaults to profile:<profile-id>:`).option(`--tools <mode>`,`chat denies tools; act applies the profile's tools and permissions`).option(`--turns-per-day <count>`,`Per-member daily turn ceiling (default 30)`).option(`--yes`,`Authorize agent execution and spend against your key limits`).action((e,t)=>sl(async()=>{al(t);let n=il(t),r;if(t.file){if(t.profileId||t.member||t.sandbox||t.instancePrefix||t.tools||t.turnsPerDay)throw Error(`Choose --file or quick-setup flags, not both`);r=await cl(t.file)}else{if(!t.profileId||!t.member)throw Error(`Provide --profile-id and --member, or --file`);if(t.sandbox&&t.instancePrefix)throw Error(`Choose --sandbox or --instance-prefix`);let e=t.tools??`chat`,n=Number(t.turnsPerDay??`30`);if(e!==`chat`&&e!==`act`)throw Error(`--tools must be chat or act`);if(!Number.isSafeInteger(n)||n<1||n>1e4)throw Error(`--turns-per-day must be 1–10000`);if(e===`act`&&t.sandbox)throw Error(`Acting tools require an isolated on-demand instance; omit --sandbox`);r={mode:`personal`,members:[{address:t.member,role:`owner`}],unknownSenders:`reject`,roles:{owner:{context:`own`,tools:e}},respond:{kind:`agent`,profileId:t.profileId,...e===`act`?{rolePolicy:{version:1,roles:{owner:{kind:`general`}},members:{}}}:{}},limits:{turnsPerMemberPerDay:n},...t.sandbox?{sandboxId:t.sandbox}:{instance:{keyPrefix:t.instancePrefix??`profile:${t.profileId}:`,create:{ownerContext:`isolated`,...e===`act`?{egressPolicy:{mode:`strict`,allowDomains:[new URL(or()).hostname],includeImplicitDomains:!1}}:{}}}}}}if(typeof r.sandboxId==`string`==(r.instance!==void 0))throw Error(`Attachment requires exactly one of sandboxId and instance`);let{sandboxId:i,instance:a,...o}=r,s;if(i){let t=await n.get(i);if(!t)throw Error(`Sandbox not found`);s=await t.lines.attach({...o,number:e})}else{if(!a)throw Error(`Attachment requires an instance`);s=await n.lines.attach({...o,number:e,instance:a})}N(s)}));for(let t of[`detach`,`release`])e.command(t).argument(`<line-id>`).description(t===`detach`?`Stop dispatch; preserve history and provider rental`:`Retire a detached Hub line; does not cancel provider rental`).option(`--yes`,`Authorize this change`).action((e,n)=>sl(async()=>{al(n),N({[t]:await il(n).lines[t](e)})}));e.command(`threads`).argument(`<line-id>`).description(`List this line's separate participant threads`).action((e,t)=>sl(async()=>{N(await il(t).lines.threads(e).list())})),e.command(`messages`).argument(`<line-id>`).argument(`<thread-id>`).description(`Read one authorized participant thread`).action((e,t,n)=>sl(async()=>{N(await il(n).lines.threads(e).messages(t))}))}async function ul(e){let{token:t,baseUrl:n}=Hn();if(t===void 0)return W(e);if(!t.startsWith(`lrc_`)||!n)throw Error(`The line box needs TANGLE_LINE_TOKEN and TANGLE_HUB_URL`);if(e.apiKey||e.baseUrl&&new URL(e.baseUrl).origin!==new URL(n).origin)throw Error(`A line token cannot be sent to another Hub or combined with an API key`);return new Oe({baseUrl:n,authHeaders:()=>({Authorization:`Bearer ${t}`})})}async function dl(e,t){if(t)return t;if(!Hn().token)throw Error(`Provide --line <line-id>`);return(await e.lines.context()).line.id}function fl(e){return e().catch(B)}function pl(){return new b(`context`).description(`Show live line identity, members, consent, reminders and quotas`).action(e=>fl(async()=>{N(await(await ul(e)).lines.context())}))}function ml(){let e=new b(`lines`).description(`Connect, manage, message and schedule on a Hub line`);return e.command(`members`).description(`List names, roles and consent on this line`).option(`--line <line-id>`,`Line ID; inferred in a line box`).action(e=>fl(async()=>{let t=await ul(e);N(await t.lines.members.list(await dl(t,e.line)))})),e.command(`send`).description(`Send to a consenting member through Hub`).argument(`<to-member>`,`Exact member ID for an owner; name, ID, or self in a line box`).argument(`<text>`,`Message text`).option(`--line <line-id>`,`Line ID; inferred in a line box`).option(`--on-behalf-of <member>`,`Verified sender for a member relay`).option(`--not-before <iso-time>`,`Delay delivery until this ISO time`).option(`--idempotency-key <key>`,`Stable key for a retry`).action((e,t,n)=>fl(async()=>{let r=await ul(n),i=await dl(r,n.line);if(!Hn().token){if(n.onBehalfOf)throw Error(`--on-behalf-of is only available inside a line box`);if(!n.idempotencyKey)throw Error(`Owner sends require --idempotency-key so a retry keeps the same message`);if(!(await r.lines.members.list(i)).some(t=>t.id===e))throw Error(`Owner sends require an exact member ID from tangle lines members`);N(await r.lines.send(i,{memberId:e,text:t,idempotencyKey:n.idempotencyKey,...n.notBefore?{notBefore:n.notBefore}:{}}));return}N(await r.lines.send(i,{toMember:e,text:t,...n.onBehalfOf?{onBehalfOf:n.onBehalfOf}:{},...n.notBefore?{notBefore:n.notBefore}:{},...n.idempotencyKey?{idempotencyKey:n.idempotencyKey}:{}}))})),e.command(`remind`).description(`Wake the agent at a future time to write your reminder`).argument(`<text>`,`What to remember`).requiredOption(`--at <iso-time>`,`Future ISO time`).option(`--line <line-id>`,`Line ID; inferred in a line box`).option(`--idempotency-key <key>`,`Stable key for a retry`).action((e,t)=>fl(async()=>{if(!t.at)throw Error(`--at is required`);let n=await ul(t),r=t.idempotencyKey??x(`sha256`).update(JSON.stringify([e,t.at])).digest(`hex`).slice(0,32);N(await n.lines.remind(await dl(n,t.line),{text:e,notBefore:t.at,idempotencyKey:r}))})),ll(e),e}function hl(){let e=new b(`mcp`).description(`Model Context Protocol bridge commands.`);return e.command(`serve <id-or-name>`).description(`Run a local MCP server (stdio) backed by the given sandbox (ID or name). Pipe its stdio from an MCP client config to expose sandbox tools.`).option(`-s, --session <id>`,`Session id for kernel scoping`,`mcp-local`).option(`--name <name>`,`MCP server name reported to clients`,`tangle-sandbox`).action(async(e,t)=>{let n=V({apiKey:t.apiKey,baseUrl:t.baseUrl}),r=await G(H(n),n,e),i;try{i=(await import(`@modelcontextprotocol/sdk/server/stdio.js`)).StdioServerTransport}catch{throw Error("`@modelcontextprotocol/sdk` is not installed in this environment. Install it with: pnpm add -g @modelcontextprotocol/sdk (or as a dev dep in the project running this command).")}let{connect:a,close:o}=await Xe(r,{sessionId:t.session,name:t.name});await a(new i),process.stdin.resume(),process.stdin.on(`end`,()=>{o().finally(()=>process.exit(0))});for(let e of[`SIGINT`,`SIGTERM`])process.on(e,()=>{o().finally(()=>process.exit(0))})}),e}async function gl(e,t){if(t.self&&e)throw Error(`Use --self or an explicit sandbox, not both`);if(!t.self&&!e)throw Error(`Specify a sandbox id/name or --self`);let n=Nn(),r=t.baseUrl||n.tangleBaseUrl||n.sandboxBaseUrl,i=n.hubUrl;if(t.self&&!r&&i&&new URL(i).origin!==`https://id.tangle.tools`)throw Error(`This deployment must set SANDBOX_BASE_URL or pass --base-url for self preview access`);let a=t.self?t.apiKey??Qn():t.apiKey;if(t.self&&!a)throw Error(`Self preview access requires the injected sandbox runtime credential; it never reads saved owner credentials`);let o=V({apiKey:a,baseUrl:r}),s=H(o);return t.self?$e(s):G(s,o,e)}async function _l(e,t,n){let r=I(e);t||r.start();try{return await n()}finally{r.stop()}}function vl(e){return e}function yl(){let e=new b(`preview`).description(`Manage sandbox preview links`);return vl(e.command(`start`).description(`Start/reuse a managed development server and publish its ready preview`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`).option(`--cwd <directory>`,`Project directory in the selected workspace`).option(`--session <session-id>`,`Select the agent's session workspace`).option(`--name <name>`,`App/service label`)).action(async(e,t)=>{let n=await gl(e,t),r=await _l(`Starting managed preview...`,t.json,()=>Ze(n,{cwd:t.cwd,sessionId:t.session,name:t.name}));t.json?N(r):(P(`Preview ready: ${r.url}`),console.log(`Preview ID: ${r.previewId}`))}),vl(e.command(`list`).alias(`ls`).description(`List active preview links for a sandbox`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`)).action(async(e,t)=>{let n=await gl(e,t),r=await _l(`Fetching preview links...`,t.json,()=>n.previewLinks.list());t.json?N(r):r.length===0?console.log(`No preview links found`):It([`App`,`Preview ID`,`Port`,`URL`,`Status`],r.map(e=>[bl(e.metadata),e.previewId.slice(0,12),String(e.port),e.url,e.status]))}),vl(e.command(`publish`).description(`Publish one existing HTTP service; never starts or replaces a process`).argument(`[id-or-name]`,`Sandbox ID or name`).option(`--self`,`Use only the sandbox bound to the runtime credential`).requiredOption(`--port <port>`,`Existing service port`).option(`--name <name>`,`App/service label`)).action(async(e,t)=>{if(!t.port||!/^\d+$/.test(t.port))throw Error(`An integer service port is required`);let n=await gl(e,t),r=await _l(`Publishing service...`,t.json,()=>Qe(n,{port:Number(t.port),name:t.name}));t.json?N(r):P(`Preview ready: ${r.url}`)}),vl(e.command(`create`).description(`Create a preview link for a port`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<port>`,`Port number to preview`)).action(async(e,t,n)=>{if(!/^\d+$/.test(t)||Number(t)<1||Number(t)>65535)throw Error(`Port must be an integer between 1 and 65535`);let r=await gl(e,n),i=await _l(`Creating preview for port ${t}...`,n.json,()=>r.previewLinks.create(Number(t)));n.json?N(i):(P(`Preview created: ${i.url}`),console.log(`Preview ID: ${i.previewId}`))}),vl(e.command(`remove`).alias(`rm`).description(`Remove a preview link`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<preview-id>`,`Preview link ID (from 'preview list')`)).action(async(e,t,n)=>{let r=await gl(e,n);await _l(`Removing preview...`,n.json,()=>r.previewLinks.remove(t)),n.json?N({success:!0,previewId:t}):P(`Preview removed: ${t}`)}),e}function bl(e){let t=e?.app;if(!t||typeof t!=`object`)return``;let n=`name`in t?t.name:void 0,r=`cwd`in t?t.cwd:void 0;return typeof n==`string`?n:typeof r==`string`?r:``}function xl(){let e=new b(`process`).description(`Manage processes in a sandbox`);return e.command(`spawn`).description(`Spawn a process without blocking (returns PID)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<command>`,`Command to execute`).option(`--cwd <dir>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`-t, --timeout <ms>`,`Timeout in milliseconds`).option(`--blocking`,`Wait for completion (default: false)`).action(async(e,t,n)=>{let{context:r,client:i}=U(n),a=Go(n.env??[],`--env`,`env`),o=I(`Spawning: ${t}`);n.json||o.start();let s=await G(i,r,e);if(s=await K(s),n.blocking){let e=await s.exec(t,{cwd:n.cwd,env:Object.keys(a).length>0?a:void 0,timeoutMs:n.timeout?Number.parseInt(n.timeout,10):void 0});o.stop(),n.json?N(e):(e.stdout&&globalThis.process.stdout.write(e.stdout),e.stderr&&globalThis.process.stderr.write(e.stderr),e.exitCode!==0&&globalThis.process.exit(e.exitCode))}else{let r=await s.process.spawn(t,{cwd:n.cwd,env:Object.keys(a).length>0?a:void 0,timeoutMs:n.timeout?Number.parseInt(n.timeout,10):void 0});o.stop(),n.json?N({pid:r.pid,command:r.command}):(console.log(`Process started with PID: ${r.pid}`),console.log(`Use 'tangle process logs ${e} ${r.pid}' to view output`))}}),e.command(`list`).alias(`ls`).description(`List all processes in a sandbox`).argument(`<id-or-name>`,`Sandbox ID or name`).option(`--running`,`Show only running processes`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Fetching processes...`);t.json||i.start();let a=await G(r,n,e);a=await K(a);let o=await a.process.list();t.running&&(o=o.filter(e=>e.running)),i.stop(),t.json?N(o):o.length===0?console.log(`No processes found`):It([`PID`,`Command`,`Status`,`Exit Code`,`Started`],o.map(e=>[String(e.pid),e.command.length>40?`${e.command.slice(0,37)}...`:e.command,e.running?`running`:`exited`,String(e.exitCode),e.startedAt.toLocaleString()]))}),e.command(`get`).description(`Get detailed info about a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).action(async(e,t,n)=>{let{context:r,client:i}=U(n),a=I(`Fetching process info...`);n.json||a.start();let o=await G(i,r,e);o=await K(o);let s=await o.process.get(Number.parseInt(t,10));if(a.stop(),!s){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}let c=await s.status();n.json?N(c):(console.log(`PID: ${c.pid}`),console.log(`Command: ${c.command}`),console.log(`CWD: ${c.cwd||`(default)`}`),console.log(`Status: ${c.running?`running`:`exited`}`),console.log(`Exit Code: ${c.exitCode}`),c.exitSignal&&console.log(`Signal: ${c.exitSignal}`),console.log(`Started: ${c.startedAt.toLocaleString()}`),c.exitedAt&&console.log(`Exited: ${c.exitedAt.toLocaleString()}`))}),e.command(`kill`).description(`Kill a process`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`-s, --signal <signal>`,`Signal to send (SIGTERM, SIGKILL, etc.)`,`SIGTERM`).option(`--tree`,`Also kill descendants of the tracked process`).action(async(e,t,n)=>{let{context:r,client:i}=U(n),a=I(`Sending ${n.signal} to PID ${t}...`);n.json||a.start();let o=await G(i,r,e);o=await K(o);let s=await o.process.get(Number.parseInt(t,10));if(!s){a.stop(),console.error(`Process ${t} not found`),globalThis.process.exit(1);return}n.tree?await s.kill(n.signal,{tree:!0}):await s.kill(n.signal),a.stop(),n.json?N({pid:Number.parseInt(t,10),signal:n.signal,...n.tree===!0?{tree:!0}:{},killed:!0}):console.log(n.tree?`Sent ${n.signal} to process tree ${t}`:`Sent ${n.signal} to process ${t}`)}),e.command(`logs`).description(`Stream buffered and live process logs until the process exits`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pid>`,`Process ID`).option(`--stdout-only`,`Only show stdout`).option(`--stderr-only`,`Only show stderr`).action(async(e,t,n)=>{let{context:r,client:i}=U(n),a=await G(i,r,e);a=await K(a);let o=await a.process.get(Number.parseInt(t,10));if(!o){console.error(`Process ${t} not found`),globalThis.process.exit(1);return}for await(let e of o.logs())n.stdoutOnly&&e.type!==`stdout`||n.stderrOnly&&e.type!==`stderr`||(n.json?console.log(JSON.stringify(e)):e.type===`stdout`?globalThis.process.stdout.write(e.data):globalThis.process.stderr.write(e.data))}),e}const Sl=[`python`,`node`,`typescript`,`bash`];function Cl(e){switch(_e(e).toLowerCase()){case`.py`:return`python`;case`.js`:case`.mjs`:case`.cjs`:return`node`;case`.ts`:case`.tsx`:return`typescript`;case`.sh`:case`.bash`:return`bash`;default:return}}async function wl(e){if(e===`-`){let e=[];for await(let t of process.stdin)e.push(typeof t==`string`?Buffer.from(t):t);return Buffer.concat(e).toString(`utf8`)}return await Ge(be(e),`utf8`)}async function Tl(e,t,n=wl){let r=t?Sl.find(e=>e===t)??(()=>{throw Error(`unknown --lang ${t}: must be one of ${Sl.join(`, `)}`)})():void 0;if(!e||e===`-`){if(!r)throw Error(`reading from stdin requires --lang. Example: tangle run <id> -l python -`);return{language:r,source:await n(`-`)}}let i=Cl(e);return{language:r??i??(()=>{throw Error(`cannot infer language from "${e}". Pass it explicitly: tangle run <id> -l <python|node|typescript|bash> ${e}`)})(),source:await n(e)}}function El(e){return D(Ce(),`tangle-run-images`,e)}function Dl(){return new b(`run`).description(`Run code in a persistent kernel inside a sandbox. Variables persist across calls in the same --session.`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`[file]`,`Path to source file. Language is inferred from extension. Use - for stdin (requires --lang).`).option(`-l, --lang <lang>`,`Force language: ${Sl.join(` | `)}. Required for stdin.`).option(`-s, --session <id>`,`Session id for kernel scoping`).option(`-t, --timeout <ms>`,`Per-call timeout in ms (0 disables)`,`60000`).option(`--save-images <dir>`,`Write image results into this directory (default: $TMPDIR/tangle-run-images/<sandbox>/).`).option(`--no-save-images`,`Don't write image results to disk; print summary only`).action(async(e,t,n)=>{let{language:r,source:i}=await Tl(t,n.lang),{context:a,client:o}=U(n),s=await G(o,a,e);s=await K(s);let c=I(`Running ${r} (${i.length}b)…`);n.json||c.start();let l=await s.runCode(r,i,{sessionId:n.session,timeoutMs:Number.parseInt(n.timeout,10)});if(c.stop(),n.json){N(l),l.exitCode!==0&&process.exit(l.exitCode);return}l.stdout&&process.stdout.write(l.stdout),l.stderr&&process.stderr.write(l.stderr);let u=0;for(let t of l.results)if(t.type===`image`)if(n.saveImages!==!1){let r=typeof n.saveImages==`string`?n.saveImages:El(e);de(r,{recursive:!0});let i=`${r}/${Date.now()}-${u}.${t.format}`;me(i,Buffer.from(t.data,`base64`)),process.stderr.write(y.green(`✓ image → ${i}\n`)),u++}else process.stderr.write(y.gray(`[image: ${t.format}, ${t.data.length}b base64]\n`));else if(t.type===`dataframe`){let e=t.columns.map(e=>`${e.name}:${e.dtype}`).join(` | `);process.stderr.write(y.gray(`[dataframe ${t.rows.length}×${t.columns.length}${t.truncated?` (truncated)`:``}]\n`)),process.stderr.write(`${e}\n`);for(let e of t.rows.slice(0,20))process.stderr.write(`${e.map(e=>String(e)).join(` | `)}\n`);t.rows.length>20&&process.stderr.write(y.gray(`… ${t.rows.length-20} more rows\n`))}else t.type===`json`?(process.stderr.write(y.gray(`[json] `)),process.stderr.write(`${JSON.stringify(t.value,null,2)}\n`)):t.type===`html`?process.stderr.write(y.gray(`[html ${t.value.length}b]\n`)):t.type===`error`?(process.stderr.write(y.red(`✗ ${t.name}: ${t.message}\n`)),t.traceback&&process.stderr.write(`${t.traceback}\n`)):t.type===`text`&&process.stderr.write(`${t.value}\n`);l.error&&(process.stderr.write(y.red(`\n✗ ${l.error.name}: ${l.error.message}\n`)),l.error.traceback&&process.stderr.write(`${l.error.traceback}\n`)),l.exitCode!==0&&process.exit(l.exitCode)})}async function Ol(e,t){let n=await Nr({apiKey:t.apiKey,baseUrl:t.baseUrl??or()}),r=await fetch(`${n.baseUrl}/v1/agent-profiles/${encodeURIComponent(e)}`,{headers:{authorization:`Bearer ${n.token}`,accept:`application/json`}});if(!r.ok){let t=await r.text().catch(()=>``);throw r.status===404?Error(`profile '${e}' not found in the platform catalog (it may be a built-in, a stored profile you own, or neither — run 'tangle profile list' to see what is available)`):Error(`platform returned ${r.status}: ${t.slice(0,200)}`)}let i=await r.json();if(!i.definition||typeof i.definition!=`object`)throw Error(`profile '${e}' resolved but has no definition — the catalog entry is malformed`);return i.definition}async function kl(e){let t=typeof e.envVarName==`string`&&e.envVarName.length>0?e.envVarName:null,n=!!e.fromStdin;if(t&&n)throw Error(`Pass either ${e.flagPrefix}-env or ${e.flagPrefix}-stdin, not both`);if(t){let n=process.env[t];if(!n||n.length===0)throw Error(`${e.flagPrefix}-env points at ${t}, but that environment variable is empty or unset`);return n}if(n){let t=await Zr();if(t.length===0)throw Error(`${e.flagPrefix}-stdin received empty input on stdin`);return t}}function Al(e){if(e.secret===void 0)return;let t=e.backend===`claude-code`?`token`:e.backend===`codex`?`bundle`:void 0;if(!t)throw Error(`--cli-auth needs --backend claude-code or --backend codex`);if(e.apiKeyGiven)throw Error(`--cli-auth cannot be combined with --backend-api-key-env or --backend-api-key-stdin`);return{account:`cli`,secretEnv:e.secret,format:t}}function jl(e){if(e!==void 0)return e.map(e=>{if(e.includes(`@`)||e.includes(`:`))throw Error(`--secret ${e}: bare secret names only (box delivery). For proxy custody use --proxy-secret with a canonical binding`);return e})}function Ml(e,t){let n={};return e.cpu!==void 0&&(n.cpuCores=Ko(e.cpu,`--cpu`)),e.memory!==void 0&&(n.memoryMB=Ko(e.memory,`--memory`)),e.disk!==void 0&&(n.diskGB=Ko(e.disk,`--disk`)),t&&(n.accelerator=t),Object.keys(n).length>0?n:void 0}function Nl(e){let t=e.split(`/`);return t.length>=2?{provider:t[0],model:t.slice(1).join(`/`)}:{model:e}}function Pl(e){let t={};for(let n of e){let[e,...r]=n.split(`=`);if(!e||r.length===0)throw Error(`--metadata expects values in KEY=VALUE or KEY=JSON format`);t[e]=Fl(r.join(`=`))}return t}function Fl(e){try{return JSON.parse(e)}catch{return e}}function Il(e,t){if(!(!e.gitUrl&&!e.gitRef&&!e.gitDepth&&!e.gitSparse&&!t)){if(!e.gitUrl||typeof e.gitUrl!=`string`)throw Error(`--git-url is required when using git provisioning options`);return{url:e.gitUrl,ref:typeof e.gitRef==`string`?e.gitRef:void 0,depth:typeof e.gitDepth==`string`?Ko(e.gitDepth,`--git-depth`):void 0,sparse:Array.isArray(e.gitSparse)?e.gitSparse:void 0,auth:t?{token:t}:void 0}}}function Ll(e,t){if(!(!e.storageType&&!e.storageBucket&&!e.storageEndpoint&&!e.storageRegion&&!e.storagePrefix&&!e.storageAccessKeyId&&!t)){if(typeof e.storageType!=`string`||typeof e.storageBucket!=`string`||typeof e.storageAccessKeyId!=`string`||!t)throw Error(`Storage config requires --storage-type, --storage-bucket, --storage-access-key-id, and one of --storage-secret-access-key-env / --storage-secret-access-key-stdin`);return{type:Rl(e.storageType),bucket:e.storageBucket,endpoint:typeof e.storageEndpoint==`string`?e.storageEndpoint:void 0,region:typeof e.storageRegion==`string`?e.storageRegion:void 0,prefix:typeof e.storagePrefix==`string`?e.storagePrefix:void 0,credentials:{accessKeyId:e.storageAccessKeyId,secretAccessKey:t}}}}function Rl(e){if(e===`s3`||e===`gcs`||e===`r2`)return e;throw Error(`--storage-type must be one of s3, gcs, or r2`)}function zl(e){if(e===void 0)return;let t=[];for(let n of e){let e=n,r=`--proxy-secret <json>`;if(n.startsWith(`@`)){let t=n.slice(1);r=`--proxy-secret @${t}`;try{e=fe(t,`utf8`)}catch{throw Error(`${r}: file could not be read`)}}let i;try{i=JSON.parse(e)}catch(e){throw Error(`${r}: not valid JSON (${e instanceof Error?e.message:String(e)})`)}if(Array.isArray(i))t.push(...i);else if(typeof i==`object`&&i)t.push(i);else throw Error(`${r}: expected a binding object or an array of bindings`)}let n=re.parse(t);return n.length>0?n:void 0}function Bl(e){F(` Status: ${e.status}`),F(` Provider: ${e.provider}`),F(` GPU: ${e.accelerator.kind} x ${e.accelerator.count}`),e.customerPricePerHourUsd!==void 0&&F(` Customer price: $${e.customerPricePerHourUsd}/hr`),e.estimatedCustomerCostUsd!==void 0&&F(` Max estimate: $${e.estimatedCustomerCostUsd}`),e.billing&&(F(` Billed seconds: ${e.billing.seconds}`),F(` Customer cost: $${e.billing.customerCostUsd}`))}function Vl(e){e.result.stdout&&process.stdout.write(e.result.stdout),e.result.stderr&&process.stderr.write(e.result.stderr),F(`Exit code: ${e.result.exitCode}`)}function Hl(e){let t=e.command(`gpu`).description(`Manage on-demand GPU leases for a sandbox`);t.command(`providers <id-or-name>`).description(`List GPU clouds, whether each credential works, and current prices`).option(`--accelerator-kind <kind>`,`Price this GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`).option(`--accelerator-memory <mb>`,`Minimum GPU memory in MB`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Checking GPU providers...`);i.start();let a=await(await G(r,n,e)).gpu.providers(t.acceleratorKind?{accelerator:Bo({kind:t.acceleratorKind,count:t.acceleratorCount,memory:t.acceleratorMemory})}:{});if(i.stop(),t.json){N(a);return}M(a.statuses.map(e=>({provider:e.provider,state:e.state,gpu:e.estimate?.providerInstanceType??``,usdHr:e.estimate?e.estimate.customerPricePerHourUsd.toFixed(4):``,pricing:e.estimate?.pricingSource??``,needs:e.envVars.join(` `)})),[{key:`provider`,header:`Provider`},{key:`state`,header:`State`},{key:`gpu`,header:`GPU`},{key:`usdHr`,header:`$/hr`},{key:`pricing`,header:`Price`},{key:`needs`,header:`Needs`}]);for(let e of a.statuses){let t=e.state===`credential-invalid`?e.credential?.detail:e.estimateError;t&&F(`${e.provider}: ${t}`)}a.usable.length===0&&F(`No GPU provider is usable on this deployment: set the variables in Needs for one provider on the server.`)}),t.command(`attach <id-or-name>`).description(`Attach a temporary GPU worker to a sandbox`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum GPU memory in MB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Attaching GPU lease...`);i.start();let a=await(await G(r,n,e)).gpu.attach(Ho(t));i.stop(),t.json?N(a):(P(`GPU lease attached: ${a.id}`),Bl(a))}),t.command(`run <id-or-name> <command...>`).description(`Attach a GPU, run a command or script, then destroy it`).requiredOption(`--accelerator-kind <kind>`,`GPU kind, for example nvidia-h100`).option(`--accelerator-count <count>`,`GPU device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum GPU memory in MB`).option(`--provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--image <image>`,`GPU worker image override`).option(`--env <vars...>`,`Environment variables for the GPU worker and command (KEY=VALUE)`).requiredOption(`--max-spend-usd <usd>`,`Maximum customer spend for this lease`).requiredOption(`--max-lifetime <seconds>`,`Maximum lease lifetime in seconds`).option(`--idle-timeout <seconds>`,`Destroy after this many idle seconds`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).action(async(e,t,n)=>{let r,i,a,o;try{let{context:a,client:o}=U(n),s=await G(o,a,e),c=I(`Attaching GPU lease...`);c.start(),r=await s.gpu.attach(Ho(n)),c.stop();let l=I(`Running GPU command...`);l.start(),i=await s.gpu.exec(r.id,{command:Uo(t),...Wo(n),cwd:n.cwd}),l.stop(),n.json||Vl(i)}catch(e){a=e}finally{if(r)try{let{context:t,client:i}=U(n);r=await(await G(i,t,e)).gpu.detach(r.id)}catch(e){o=e}}if(a){B(a),o&&B(o);return}if(o){B(o);return}n.json?N({lease:r,result:i}):r&&P(`GPU lease detached: ${r.id}`);let s=i?.result.exitCode;s&&s!==0&&(process.exitCode=s)}),t.command(`list <id-or-name>`).description(`List GPU leases attached to a sandbox`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Fetching GPU leases...`);i.start();let a=await(await G(r,n,e)).gpu.list();i.stop(),t.json?N(a):a.length===0?F(`No GPU leases attached.`):M(a.map(e=>({id:e.id,status:e.status,provider:e.provider,accelerator:`${e.accelerator.kind}x${e.accelerator.count}`,customerUsdHr:e.customerPricePerHourUsd??``})),[{key:`id`,header:`ID`,width:28},{key:`status`,header:`Status`,width:12},{key:`provider`,header:`Provider`,width:12},{key:`accelerator`,header:`GPU`,width:24},{key:`customerUsdHr`,header:`$/hr`,width:10}])}),t.command(`exec <id-or-name> <lease-id> <command...>`).description(`Run a command or script on an attached GPU lease`).option(`--timeout <ms>`,`Command timeout in milliseconds`).option(`--cwd <path>`,`Working directory`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).action(async(e,t,n,r)=>{let{context:i,client:a}=U(r),o=I(`Running GPU command...`);o.start();let s=await(await G(a,i,e)).gpu.exec(t,{command:Uo(n),...Wo(r),cwd:r.cwd});o.stop(),r.json?N(s):Vl(s)}),t.command(`detach <id-or-name> <lease-id>`).description(`Detach and destroy a GPU lease`).action(async(e,t,n)=>{let{context:r,client:i}=U(n),a=I(`Detaching GPU lease...`);a.start();let o=await(await G(i,r,e)).gpu.detach(t);a.stop(),n.json?N(o):(P(`GPU lease detached: ${o.id}`),Bl(o))})}function Ul(e,t){if(t){N(e);return}if(!e.id){e.kind===`snapshot`&&e.result?.snapshot?P(`Snapshot created: ${e.result.snapshot.snapshotId}`):P(`Sandbox ${e.sandboxId} stopped.`);return}P(`${e.kind===`snapshot`?`Snapshot`:`Stop`} of sandbox ${e.sandboxId} accepted.`),F(`Operation: ${e.id}`),F(`Status: ${e.statusUrl}`)}function Wl(e){return`${e.name} (${e.id})`}async function Gl(e,t){if(t.startsWith(`team_`))return e.teams.get(t);let n=(await e.teams.list()).filter(e=>e.name.toLowerCase()===t.toLowerCase());if(n.length===0)throw Error(`Team not found: ${t}`);if(n.length>1)throw Error(`Team name is ambiguous: ${t}. Use a team id instead.`);return n[0]}async function Z(e,t,n){if(t)return Gl(e,t);let r=lr(n);if(!r.activeTeamId)throw Error("No active team. Run `tangle team switch <team>` or pass `--team <team>`.");return e.teams.get(r.activeTeamId)}function Kl(e,t){ur({id:e.id,name:e.name},t)}function ql(e){dr(e)}async function Jl(e){if(e.explicitTeam&&e.personal)throw Error(`--team and --personal cannot be used together`);if(!e.personal)return e.explicitTeam?(await Gl(e.client,e.explicitTeam)).id:e.activeTeamId}async function Yl(e){if([!!e.explicitTeam,!!e.personal,!!e.allScopes].filter(Boolean).length>1)throw Error(`--team, --personal, and --all-scopes are mutually exclusive`);if(e.allScopes)return`all`;if(e.personal)return`personal`;if(e.explicitTeam)return`team:${(await Gl(e.client,e.explicitTeam)).id}`;if(e.activeTeamId)return`team:${e.activeTeamId}`}function Xl(e){if(!e)return e;let t={...e};for(let e of[`authToken`,`execToken`])t[e]!==void 0&&(t[e]=`[REDACTED]`);return t}function Zl(e){e.command(`attestation <id-or-name>`).description(`Fetch TEE attestation evidence for a sandbox`).option(`--nonce <hex|auto>`,`Nonce to bind into a fresh attestation report; use auto to generate one`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=t.nonce===`auto`?g():t.nonce,a=I(`Fetching TEE attestation...`);a.start();let o=await(await G(r,n,e)).getTeeAttestation(i?{attestationNonce:i}:void 0);a.stop(),t.json?N(o):(P(`Attestation fetched for ${e}`),console.log(`TEE type: ${o.attestation.tee_type}`),console.log(`Evidence bytes: ${o.attestation.evidence.length}`),console.log(`Measurement bytes: ${o.attestation.measurement.length}`),console.log(`Timestamp: ${o.attestation.timestamp}`),o.attestationNonce&&console.log(`Nonce: ${o.attestationNonce}`))}),e.command(`list`).description(`List all sandboxes`).option(`-s, --status <status>`,`Filter by status (running, stopped, all)`).option(`-l, --limit <n>`,`Limit results`,`50`).option(`--team <team>`,`List sandboxes for a team by id or name`).option(`--personal`,`List personal sandboxes`).option(`--all-scopes`,`List personal and team sandboxes`).action(async e=>{let{context:t,client:n}=U(e),r=I(`Fetching sandboxes...`);r.start();let i=await Yl({client:n,explicitTeam:e.team,personal:e.personal,allScopes:e.allScopes,activeTeamId:t.activeTeamId}),a=await n.list({status:e.status===`all`?void 0:e.status,limit:Number.parseInt(e.limit,10),scope:i});r.stop(),e.json?N(a):M(a.map(e=>({id:e.id,status:e.status,createdAt:e.createdAt,name:e.name??``})),[{key:`id`,header:`ID`,width:24},{key:`status`,header:`Status`,width:14},{key:`createdAt`,header:`Created`,width:16},{key:`name`,header:`Name`,width:20}])}),e.command(`get <id-or-name>`).description(`Get sandbox details`).option(`--profile`,`Show the active agent profile provenance (name, hash, skills)`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Fetching sandbox...`);i.start();let a=await G(r,n,e);if(i.stop(),t.profile){let e=a.getProfileProvenance?.();e?(F(`Agent profile provenance:`),F(` Base profile: ${e.base.name??`(inline)`} (${e.base.sha256.slice(0,12)}...)`),F(` Effective: ${e.effective.name??`(inline)`} (${e.effective.sha256.slice(0,12)}...)`),F(` Materialized: ${e.materializedAt}`),e.base.sha256!==e.effective.sha256&&F(` ⚠ Profile changed since creation (base ≠ effective)`)):F(`No profile materialized (bare sandbox). Create with --profile <name> to install one.`);return}t.json?N(a):Ft({id:a.id,name:a.name,status:a.status,resources:a.resources,createdAt:a.createdAt?.toISOString(),expiresAt:a.expiresAt?.toISOString(),connection:a.connection})}),e.command(`shapes`).description(`List the named sandbox sizes, the default, and this account's ceiling`).action(async e=>{let{client:t}=U(e),n=await t.shapes();if(e.json){N(n);return}let r=e=>e.cpuCores<=n.ceiling.cpuCores&&e.memoryMB<=n.ceiling.memoryMB&&e.diskGB<=n.ceiling.diskGB;M(n.presets.map(e=>({name:e.name===n.default?`${e.name} (default)`:e.name,cpu:e.cpuCores,memory:`${e.memoryMB} MB`,disk:`${e.diskGB} GB`,available:r(e)?`yes`:e.name===n.default?`clamped to ceiling`:`above ceiling`})),[{key:`name`,header:`Shape`,width:18},{key:`cpu`,header:`vCPU`,width:6},{key:`memory`,header:`Memory`,width:10},{key:`disk`,header:`Disk`,width:8},{key:`available`,header:`Available`,width:14}]),F(`Ceiling for this account: ${Pt(n.ceiling)}`)}),e.command(`delete <id-or-name>`).description(`Delete a sandbox`).option(`-f, --force`,`Skip confirmation`).option(`--name`,`Treat the reference as a sandbox name`).option(`--retry-cleanup`,`Retry server-side cleanup after the sandbox disappeared from get/list`).action(async(e,t)=>{if(!t.force&&!await Yr(`Delete sandbox ${e}? [y/N] `,`--force`)){F(`Cancelled.`);return}let{context:n,client:r}=U(t),i=I(`Deleting sandbox...`);i.start();let a=await Hr(r,n,e,{retryCleanup:t.retryCleanup,name:t.name});i.stop(),P(a===`already_absent`?`Sandbox ${e} was already gone.`:`Sandbox ${e} deleted.`)}),e.command(`stop <id-or-name>`).description(`Stop a running sandbox`).option(`--name`,`Treat the reference as a sandbox name`).option(`--no-wait`,`Return once the stop is accepted and print the operation to poll`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Stopping sandbox...`);i.start();let a=await G(r,n,e,{nameOnly:t.name});if(t.wait===!1){let e=await a.stop({wait:!1});i.stop(),Ul(e.info,!!t.json);return}await a.stop(),i.stop(),P(`Sandbox ${e} stopped.`)}),e.command(`resume <id-or-name>`).description(`Resume a stopped sandbox`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`-t, --timeout <ms>`,`Resume timeout in milliseconds; a cold resume re-provisions the sandbox, so this defaults higher than other commands (default 120000)`,`120000`).action(async(e,t)=>{let n=Number.parseInt(t.timeout,10);if(!Number.isFinite(n)||n<=0)throw Error(`--timeout must be a positive number of milliseconds`);let r=V({apiKey:t.apiKey,baseUrl:t.baseUrl,timeout:n}),i=H(r),a=I(`Resuming sandbox...`);a.start();let o=await G(i,r,e);await o.resume({timeoutMs:n}),t.wait&&(a.text=`Waiting for sandbox to start...`,await o.waitFor(`running`,{timeoutMs:n})),a.stop(),P(`Sandbox ${o.id} resumed.`)})}function Ql(e){e.command(`create`).description(`Create a new sandbox`).option(`-n, --name <name>`,`Sandbox name`).option(`-e, --environment <environment>`,`Named environment, container image, or built image ID`).option(`--bare`,`Create a bare sandbox without the agent runtime`).option(`--ssh`,`Enable SSH access`).option(`--ssh-key <key>`,`SSH public key for authentication`).option(`--ssh-keys <names...>`,`Stored SSH key names or IDs for authentication`).option(`--ssh-key-file <paths...>`,`SSH public key file paths for authentication`).option(`--web-terminal`,`Enable web terminal`).option(`--env <vars...>`,`Environment variables (KEY=VALUE)`).option(`--secret <names...>`,`Secrets selected by bare name for box delivery (value in the sandbox env). For proxy custody use --proxy-secret`).option(`--proxy-secret <bindings...>`,`Canonical proxy custody binding(s): one binding as inline JSON, or @file with a JSON array. The value stays at the egress proxy and is redeemed only within the binding's scope (hosts/methods/paths/TTL); the box reads a placeholder. Repeatable`).option(`--metadata <entries...>`,`Metadata entries (KEY=VALUE or KEY=JSON)`).option(`--cpu <cores>`,"CPU cores (omit for the platform default; see `sandbox shapes`)").option(`--memory <mb>`,`Memory in MB (omit for the platform default)`).option(`--disk <gb>`,`Disk size in GB (omit for the platform default)`).option(`--accelerator-kind <kind>`,`Accelerator kind, for example nvidia-h100 or amd-mi300x`).option(`--accelerator-count <count>`,`Accelerator device count`,`1`).option(`--accelerator-memory <mb>`,`Minimum accelerator memory in MB`).option(`--gpu-provider <provider>`,`GPU cloud provider; omitted picks the cheapest configured provider`).option(`--gpu-worker-image <image>`,`GPU worker image override`).option(`--gpu-env <vars...>`,`Environment variables for the GPU worker (KEY=VALUE)`).option(`--gpu-max-spend-usd <usd>`,`Maximum customer spend for the create-time GPU lease`).option(`--gpu-max-lifetime <seconds>`,`Maximum create-time GPU lease lifetime in seconds`).option(`--gpu-idle-timeout <seconds>`,`Destroy the create-time GPU lease after this many idle seconds`).option(`--lifetime <seconds>`,`Max wall-clock lifetime before the sandbox is suspended — stopped, not deleted; resume it within the cold window (default 3600 = 1h). Raise it for long sessions, e.g. --lifetime 7200`,`3600`).option(`--idle-timeout <seconds>`,"Idle time before the sandbox is stopped — not deleted (default 900 = 15m). Resume it later with `tangle sandbox resume <id-or-name>`, or it auto-resumes on next use. Raise it for demos, e.g. --idle-timeout 3600",`900`).option(`--from-snapshot <id>`,`Create the sandbox from a snapshot`).option(`--public-template <id-or-slug>`,`Create the sandbox from a published public template`).option(`--public-template-version <id>`,`Pin creation to a specific published public-template version`).option(`--billing-owner <userId>`,`Platform user that pays for the sandbox. The API accepts this only from a first-party service key that is listed as a billing delegate, and refuses such a key that names no payer.`).option(`--team <team>`,`Create in a team by id or name`).option(`--personal`,`Create a personal sandbox even when a team is active`).option(`--git-url <url>`,`Git repository URL to clone during provisioning`).option(`--git-ref <ref>`,`Git branch, tag, or commit to checkout`).option(`--git-depth <depth>`,`Git clone depth`).option(`--git-sparse <paths...>`,`Sparse checkout paths`).option(`--git-token-env <name>`,`Name of an environment variable containing the Git HTTPS auth token`).option(`--git-token-stdin`,`Read the Git HTTPS auth token from stdin`).option(`--storage-type <type>`,`BYOS3 storage type (s3, gcs, r2)`).option(`--storage-bucket <name>`,`BYOS3 bucket name`).option(`--storage-endpoint <url>`,`BYOS3 endpoint URL`).option(`--storage-region <region>`,`BYOS3 region`).option(`--storage-prefix <prefix>`,`BYOS3 path prefix`).option(`--storage-access-key-id <id>`,`BYOS3 access key ID`).option(`--storage-secret-access-key-env <name>`,`Name of an environment variable containing the BYOS3 secret access key`).option(`--storage-secret-access-key-stdin`,`Read the BYOS3 secret access key from stdin`).option(`--driver <type>`,`Infrastructure driver (docker, firecracker, host-agent, tangle)`).option(`--driver-criu`,`Enable CRIU checkpointing (firecracker only)`).option(`--driver-region <region>`,`Preferred region for host-agent driver`).option(`--backend <type>`,`Backend agent type (${n.join(`, `)})`).option(`--backend-model <model>`,`Model override (format: provider/model)`).option(`--backend-api-key-env <name>`,`Name of an environment variable containing the BYOK backend API key`).option(`--backend-api-key-stdin`,`Read the BYOK backend API key from stdin`).option(`--cli-auth <secret>`,"Run --backend claude-code or codex on your own subscription: the stored secret holding a `claude setup-token` token or a Codex auth.json (see `tangle secret create`)").option(`--profile <path>`,`Path to an AgentProfile JSON file to install as the sandbox's backend profile (carries skills, tools, MCP, model). Use with --backend; the profile's inline skills materialize into the harness's native skill directory on first turn`).option(`--profile-stdin`,`Read the AgentProfile JSON from stdin instead of a file (use with --profile)`).option(`--tee <type>`,`Require a TEE backend (any, tdx, nitro, sev-snp, phala-dstack)`).option(`--sealed`,`Request TEE sealed-secret support`).option(`--attestation-nonce <hex|auto>`,`Deploy-time attestation nonce; use auto to generate one`).option(`--attestation-refresh`,`Generate a fresh deploy-time attestation nonce when --tee is set`).option(`--require-attestation`,`Fail unless TEE attestation evidence is returned`).option(`--wait`,`Wait for sandbox to be running`,!0).option(`--timeout <ms>`,`HTTP timeout in milliseconds`,`30000`).action(async e=>{let t=await kl({envVarName:e.gitTokenEnv,fromStdin:e.gitTokenStdin,flagPrefix:`--git-token`}),n=await kl({envVarName:e.storageSecretAccessKeyEnv,fromStdin:e.storageSecretAccessKeyStdin,flagPrefix:`--storage-secret-access-key`}),r=await kl({envVarName:e.backendApiKeyEnv,fromStdin:e.backendApiKeyStdin,flagPrefix:`--backend-api-key`}),i=Al({secret:e.cliAuth,backend:e.backend,apiKeyGiven:r!==void 0}),a;if(e.profileStdin){let e=await Zr(`--profile-stdin`,`the AgentProfile JSON`);try{a=JSON.parse(e)}catch{B(Error(`--profile-stdin: the input is not valid JSON`));return}}else if(e.profile){let t=String(e.profile);if(t.startsWith(`.`)||t.startsWith(`/`)||t.endsWith(`.json`))try{a=JSON.parse(fe(t,`utf8`))}catch(e){B(Error(`--profile ${t}: ${e.message}`));return}else try{a=await Ol(t,e)}catch(e){B(Error(`--profile ${t}: ${e.message}`));return}}let o=V({apiKey:e.apiKey,baseUrl:e.baseUrl,timeout:e.timeout?Number.parseInt(e.timeout,10):void 0}),s=H(o),c=I(`Creating sandbox...`);c.start();let l=await Jl({client:s,explicitTeam:e.team,personal:e.personal,activeTeamId:o.activeTeamId}),u=Go(e.env??[],`--env`,`env`),d=e.metadata?Pl(e.metadata):void 0,f=Il(e,t),p=Ll(e,n),m=e.acceleratorKind?Bo({kind:String(e.acceleratorKind),count:String(e.acceleratorCount),memory:typeof e.acceleratorMemory==`string`?e.acceleratorMemory:void 0}):void 0,g=Vo({provider:typeof e.gpuProvider==`string`?e.gpuProvider:void 0,image:typeof e.gpuWorkerImage==`string`?e.gpuWorkerImage:void 0,env:Array.isArray(e.gpuEnv)?e.gpuEnv:void 0,maxSpendUsd:typeof e.gpuMaxSpendUsd==`string`?e.gpuMaxSpendUsd:void 0,maxLifetime:typeof e.gpuMaxLifetime==`string`?e.gpuMaxLifetime:void 0,idleTimeout:typeof e.gpuIdleTimeout==`string`?e.gpuIdleTimeout:void 0},!!m,`Create-time GPU lease flags require --accelerator-kind`),v=e.driver?{type:e.driver,enableCriu:e.driverCriu||void 0,preferredRegion:e.driverRegion}:void 0,ee=e.backend||e.backendModel||a?{...e.backend?{type:_(e.backend)}:{},...a?{profile:a}:{},model:e.backendModel||r||i?{...e.backendModel?Nl(e.backendModel):{},apiKey:r,...i?{cliAuth:i}:{}}:void 0}:void 0,y=jl(e.secret),te=i?[...new Set([...y??[],i.secretEnv])]:y,b=zl(e.proxySecret),x=Ml(e,m),ne=e.sshKeyFile??(e.ssh&&!e.sshKey&&!e.sshKeys?.length?[$l()]:[]),S=[...e.sshKey?[e.sshKey]:[],...ne.map(e=>fe(e,`utf8`).trim())],re={name:e.name,environment:e.environment,bare:e.bare||void 0,sshEnabled:e.ssh||!!e.sshKey||S.length>0||!!e.sshKeys?.length,sshPublicKeys:S.length>0?S:void 0,sshKeyIds:e.sshKeys,webTerminalEnabled:e.webTerminal,env:Object.keys(u).length>0?u:void 0,git:f,...x?{resources:x}:{},gpuLease:g,maxLifetimeSeconds:Number.parseInt(e.lifetime,10),idleTimeoutSeconds:Number.parseInt(e.idleTimeout,10),storage:p,fromSnapshot:e.fromSnapshot,publicTemplateId:e.publicTemplate,publicTemplateVersionId:e.publicTemplateVersion,teamId:l,...e.billingOwner?{billingOwnerId:e.billingOwner}:{},secrets:te,...b?{proxySecrets:b}:{},metadata:d,driver:v,backend:ee},C=e.tee?{tee:e.tee,sealed:e.sealed||void 0,attestationRefresh:e.attestationRefresh||e.attestationNonce===`auto`||void 0}:void 0,ie=C?await h(s,{...re,confidential:C,attestationNonce:e.attestationNonce??(e.attestationRefresh?`auto`:void 0),requireAttestation:e.requireAttestation??!0}):void 0,w=ie?.sandbox??await s.create(re);e.wait&&(c.text=`Waiting for sandbox to start...`,await w.waitFor(`running`,{timeoutMs:12e4}),await w.refresh()),c.stop(),e.json?N({id:w.id,name:w.name,status:w.status,resources:w.resources,createdAt:w.createdAt,expiresAt:w.expiresAt,connection:Xl(w.connection),teamId:l,gpuLease:w.gpuLease,confidential:C,attestation:ie?.attestation,attestationNonce:ie?.attestationNonce}):(P(`Sandbox created: ${w.id}`),Ft({id:w.id,name:w.name,status:w.status,resources:w.resources,createdAt:w.createdAt?.toISOString(),expiresAt:w.expiresAt?.toISOString(),connection:w.connection}),l&&console.log(`Team: ${l}`),w.gpuLease&&(console.log(`GPU lease: ${w.gpuLease.id}`),Bl(w.gpuLease)),C&&(console.log(`TEE: ${C.tee}`),console.log(`Attestation: ${ie?.attestation?`present`:`not returned`}`),ie?.attestationNonce&&console.log(`Attestation nonce: ${ie.attestationNonce}`)))})}function $l(){let e=[`id_ed25519`,`id_ecdsa`,`id_rsa`].map(e=>`${O()}/.ssh/${e}.pub`),t=e.find(e=>ue(e));if(!t)throw Error(`--ssh needs a public key and found none at ${e.join(`, `)}. Run ssh-keygen -t ed25519, or pass --ssh-key-file.`);return t}function eu(e){e.command(`network <id-or-name>`).description(`Show runtime network state (exposed ports) for a sandbox. Outbound policy is the sandbox's egress policy.`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Updating network configuration...`);i.start();let a=await G(r,n,e);i.stop();let o=await a.network.getConfig();t.json?N(o):(F(`Network Configuration:`),o.ports&&o.ports.length>0?F(` Exposed Ports: ${o.ports.join(`, `)}`):F(` No exposed ports`))}),e.command(`expose <id-or-name>`).description(`Expose a port and get a public URL`).option(`-p, --port <port>`,`Port to expose`,`8000`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=Number.parseInt(t.port,10);if(Number.isNaN(i)||i<1||i>65535)throw Error(`Port must be a number between 1 and 65535`);let a=I(`Exposing port ${i}...`);a.start();let o=await(await G(r,n,e)).network.exposePort(i);a.stop(),t.json?N({port:i,url:o}):(P(`Port ${i} exposed.`),F(` URL: ${o}`))}),e.command(`urls <id-or-name>`).description(`List exposed port URLs for a sandbox`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Fetching exposed URLs...`);i.start();let a=await(await G(r,n,e)).network.listUrls();if(i.stop(),t.json)N(a);else{let e=Object.entries(a);if(e.length===0)F(`No ports exposed.`);else{F(`Exposed Ports:`);for(let[t,n]of e)F(` ${t}: ${n}`)}}})}function tu(){let e=new b(`sandbox`).description(`Manage sandboxes`);return Ql(e),Zl(e),Hl(e),eu(e),e}function nu(){return new b(`search`).description(`Search for text patterns in sandbox files (ripgrep)`).argument(`<id-or-name>`,`Sandbox ID or name`).argument(`<pattern>`,`Search pattern (regex)`).option(`-g, --glob <pattern>`,`File glob filter (e.g. '**/*.ts')`).option(`-n, --max-results <count>`,`Max results to return`).option(`-i, --ignore-case`,`Case-insensitive search`).action(async(e,t,n)=>{let{context:r,client:i}=U(n),a=I(`Searching...`);n.json||a.start();let o=await G(i,r,e),s=0,c=n.maxResults?Number.parseInt(n.maxResults,10):void 0,l={};n.glob&&(l.glob=n.glob),n.ignoreCase&&(l.ignoreCase=!0),c&&(l.maxResults=c);for await(let e of o.search(t,l))if(s===0&&a.stop(),s++,n.json?console.log(JSON.stringify(e)):console.log(`${e.path}:${e.line}:${e.column??0}: ${e.text}`),c&&s>=c)break;a.stop(),s===0&&!n.json&&console.log(`No matches found`)})}function ru(){let e=new b(`secret`).description(`Manage secrets`);return e.command(`create`).description(`Create a new secret`).argument(`<name>`,`Secret name (e.g., HF_TOKEN, AWS_ACCESS_KEY)`).argument(`[value]`,`Secret value`).option(`--value-stdin`,`Read secret value from stdin`).action(async(e,t,n)=>{let r=await U(n).client.secrets.create(e,await iu({value:t,valueStdin:n.valueStdin,prompt:`Enter value for secret '${e}': `}));n.json?N(r):(P(`Secret created: ${r.name}`),F(`Use --secret ${r.name} when creating a sandbox to select it for delivery.`))}),e.command(`list`).description(`List all secrets`).action(async e=>{let t=await U(e).client.secrets.list();e.json?N(t):t.length===0?(F(`No secrets found.`),F(`Use 'tangle secret create <name> [value]' to create one.`)):It([`Name`,`Created At`,`Updated At`],t.map(e=>[e.name,e.createdAt.toLocaleString(),e.updatedAt.toLocaleString()]))}),e.command(`delete`).description(`Delete a secret`).argument(`<name>`,`Secret name`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=U(t).client;if(!t.force&&!await Yr(`Are you sure you want to delete secret '${e}'? This cannot be undone. (y/N) `,`--force`)){F(`Cancelled.`);return}await n.secrets.delete(e),t.json?N({success:!0,deleted:e}):P(`Secret deleted: ${e}`)}),e}async function iu(e){if(e.value!==void 0&&e.valueStdin)throw Error(`Provide either a secret value argument or --value-stdin, not both`);let t=e.value??(e.valueStdin?await Zr():await Jr(e.prompt));if(!t.length)throw Error(e.valueStdin?`Secret value from stdin cannot be empty`:`Secret value cannot be empty`);return t}function au(){let e=new b(`skill`).description(`Print paths to shipped skill documentation`);return e.command(`path`).description(`Print the absolute path to the SKILL.md shipped with this CLI`).action(()=>{let e=E.dirname(et(import.meta.url)),t=E.resolve(e,`..`,`SKILL.md`);console.log(t)}),e}function ou(){let e=new b(`snapshot`).description(`Manage snapshots`);return e.command(`create <sandbox-id-or-name>`).description(`Create a snapshot of a sandbox`).option(`--tags <tags...>`,`Tags for the snapshot`).option(`--no-wait`,`Return once the snapshot is accepted and print the operation to poll`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Creating snapshot...`);i.start();let a=await G(r,n,e);if(t.wait===!1){let e=await a.snapshot({tags:t.tags,wait:!1});i.stop(),Ul(e.info,!!t.json);return}let o=await a.snapshot({tags:t.tags});i.stop(),t.json?N(o):(P(`Snapshot created: ${o.snapshotId}`),console.log(`Size: ${su(o.sizeBytes??0)}`))}),e.command(`list <sandbox-id-or-name>`).description(`List snapshots for a sandbox`).action(async(e,t)=>{let{context:n,client:r}=U(t),i=I(`Fetching snapshots...`);i.start();let a=await(await G(r,n,e)).listSnapshots();i.stop(),t.json?N(a):M(a.map(e=>({...e,size:su(e.sizeBytes??0)})),[{key:`snapshotId`,header:`ID`,width:24},{key:`createdAt`,header:`Created`,width:16},{key:`size`,header:`Size`,width:12},{key:`sandboxId`,header:`Sandbox`,width:20}])}),e.command(`restore <sandbox-id> <snapshot-id>`).description(`Create a new sandbox from a snapshot`).option(`--billing-owner <userId>`,`Platform user that pays for the restored sandbox. The API accepts this only from a first-party service key that is listed as a billing delegate, and refuses such a key that names no payer.`).action(async(e,t,n)=>{let{client:r}=U(n),i=I(`Restoring from snapshot...`);i.start();let a=await r.create({fromSnapshot:t,fromSandboxId:e,...n.billingOwner?{billingOwnerId:n.billingOwner}:{}});await a.waitFor(`running`,{timeoutMs:12e4}),i.stop(),n.json?N({sandboxId:a.id,restoredFrom:t,status:a.status}):(P(`New sandbox created: ${a.id}`),console.log(`Source snapshot: ${t}`))}),e.command(`revert <sandbox-id-or-name> <snapshot-id>`).description(`Revert an existing sandbox to a snapshot`).action(async(e,t,n)=>{let{context:r,client:i}=U(n),a=I(`Reverting sandbox to snapshot...`);a.start();let o=await G(i,r,e),s=await o.revertToSnapshot(t);await o.refresh(),a.stop(),n.json?N({sandboxId:o.id,snapshotId:s.snapshotId,status:o.status}):(P(`Sandbox reverted: ${o.id}`),console.log(`Source snapshot: ${s.snapshotId}`))}),e.command(`delete <sandbox-id-or-name> <snapshot-id>`).description(`Delete a sandbox snapshot`).action(async(e,t,n)=>{let{context:r,client:i}=U(n),a=I(`Deleting snapshot...`);a.start();let o=await(await G(i,r,e)).deleteSnapshot(t);a.stop(),n.json?N({success:!0,sandboxId:e,snapshotId:t,outcome:o.outcome}):o.outcome===`already_absent`?P(`Snapshot already gone: ${t}`):P(`Snapshot deleted: ${t}`)}),e}function su(e){if(e===0)return`0 B`;let t=1024,n=[`B`,`KB`,`MB`,`GB`,`TB`],r=Math.floor(Math.log(e)/Math.log(t));return`${Number.parseFloat((e/t**r).toFixed(1))} ${n[r]}`}const cu=`solve:device:secp256k1`,lu=/^0x[0-9a-f]{64}$/i;function uu(e){return e&&lu.test(e)?e:void 0}function du(){let e=un(cu),t=uu(e.value);if(!(!t||e.source===`none`))return{account:nt(t),source:e.source}}function fu(){let e=du();if(e)return e;let t=tt(),n=dn(cu,t);return{account:nt(t),source:n}}function pu(e){let t=uu(un(cu).value);if(!t||nt(t).address!==e.account.address)throw Error(`The local Solve device key changed; it was not retired`);let n=`${cu}:retired:${e.account.address.toLowerCase()}`;if(dn(n,t),un(n).value!==t)throw Error(`The revoked device key could not be retired safely`);return pn(cu),n}function mu(e){let t=e.create?fu():du();if(!t)throw Error("No Solve device signer found. Run `tangle solve account --create`");e.json?N({address:t.account.address,source:t.source}):L({Address:t.account.address,Source:t.source})}const hu=/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;function gu(e){return[...e].some(e=>{let t=e.charCodeAt(0);return t<32||t===127})}function _u(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`${t} must be an object`);return e}function vu(e,t,n=2048){if(typeof e!=`string`||!e.trim()||e.length>n)throw Error(`${t} is missing or invalid`);if(gu(e))throw Error(`${t} contains control characters`);return e.trim()}function yu(e,t){let n=vu(e,t,64).toLowerCase();if(!hu.test(n))throw Error(`${t} must be a 40 or 64 character Git revision`);return n}function bu(e,t,n=!1){let r=typeof e==`number`&&Number.isSafeInteger(e)?String(e):vu(e,t,80);if(!/^\d+$/.test(r)||!n&&r===`0`)throw Error(`${t} must be an unsigned integer`);return BigInt(r).toString()}function xu(e,t){let n=vu(e,t,2048),r=new URL(n);if(r.protocol!==`https:`&&!(r.protocol===`http:`&&(r.hostname===`localhost`||r.hostname===`127.0.0.1`)))throw Error(`${t} must use HTTPS outside local development`);return n.replace(/\/$/,``)}function Su(e,t){let n=xu(e,t).replace(/\.git$/,``),r=new URL(n),i=r.pathname.split(`/`).filter(Boolean);if(r.hostname!==`github.com`||r.username||r.password||r.search||r.hash||i.length!==2)throw Error(`${t} must be an HTTPS GitHub repository URL`);return`https://github.com/${i.join(`/`)}`}function Cu(e,t){let n=vu(e,t,42);if(!dt(n,{strict:!1}))throw Error(`${t} must be an EVM address`);return lt(n)}function wu(e,t){let n=bu(e,t),r=Number(n);if(!Number.isSafeInteger(r)||r<=0)throw Error(`${t} is out of range`);return r}function Tu(...e){for(let t of e)if(typeof t==`string`&&t.trim())return t.trim()}function Eu(e){let t=e.trim().replace(/\.git$/,``);return t.startsWith(`git@github.com:`)?`https://github.com/${t.slice(15)}`:t.startsWith(`ssh://git@github.com/`)?`https://github.com/${t.slice(21)}`:t}function Du(e){if(e===void 0)return;let t=vu(e,`pull request URL`,2048);if(!/^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/\d+(?:\/[^\s]*)?$/i.test(t))throw Error(`pull request URL must point to a GitHub pull request`);return t}function Ou(e,t){if(!/^https:\/\/[^\s]+$/i.test(e)&&!/^\/(?!\/).*$/.test(e)&&!/^[a-z][a-z0-9+.-]*:[^\s]+$/i.test(e))throw Error(`${t} must be an HTTPS URL or an absolute repository path`);if(e.split(/[?#]/,1)[0].split(`/`).includes(`..`))throw Error(`${t} cannot contain parent-directory segments`);return e}function ku(e){return Pn(`solve`,e.profile)}function Au(e){let t=ku(e),n=er(void 0,t);if(!n)throw Error(`No Solve credential found for profile '${t}'. Run: tangle auth login --provider github --app solve`);return n}async function ju(e){let t=sr(e.apiUrl),n=await fetch(`${t}${e.path}`,{method:e.method??`GET`,headers:{Accept:`application/json`,...e.body===void 0?{}:{"Content-Type":`application/json`},Authorization:`Bearer ${Au(e)}`},...e.body===void 0?{}:{body:JSON.stringify(e.body)},signal:AbortSignal.timeout(3e4)}),r=await n.json().catch(()=>null);if(!n.ok||!r?.success||r.data===void 0){let e=r?.error?.message??`Solve API request failed with HTTP ${n.status}`;throw Error(r?.error?.code?`${r.error.code}: ${e}`:e)}return r.data}function Mu(e){return ju({path:`/v1/wallet/challenges`,method:`POST`,apiUrl:e.apiUrl,profile:e.profile,body:{deviceAddress:e.deviceAddress,...e.purpose?{purpose:e.purpose}:{}}})}function Nu(e){return ju({path:`/v1/devices`,apiUrl:e.apiUrl,profile:e.profile})}function Pu(e){return ju({path:`/v1/devices/revoke`,method:`POST`,apiUrl:e.apiUrl,profile:e.profile,body:{deviceAddress:e.deviceAddress,...e.reason?{reason:e.reason}:{},...e.challengeId&&e.signature?{challengeId:e.challengeId,signature:e.signature}:{}}})}const Q={chainId:42431,rpcUrl:`https://rpc.moderato.tempo.xyz`,sponsorUrl:`https://drew-gtr-pro.taild10bfc.ts.net/solve-sponsor`,tangleAddress:`0xff137B9C879c47C28ce389e84501925438AB4cdA`,managerAddress:`0x5271732F893B622ac6793d6DBA5B2626CCa4EA14`,paymentAsset:`0x20C0000000000000000000000000000000000000`,blueprintId:15n,serviceId:9n,competitionId:1n,minStakeWei:0n};function Fu(e,t){return e.toLowerCase()===t.toLowerCase()}function Iu(e){if(e.chainId!==Q.chainId)throw Error(`Solve submissions require Tempo Moderato (chain ${Q.chainId}); received ${e.chainId}`);if(e.rpcUrl!==Q.rpcUrl)throw Error(`Solve metadata RPC does not match the trusted deployment`);if(e.sponsorUrl!==Q.sponsorUrl)throw Error(`Solve metadata sponsor does not match the trusted deployment`);if(!Fu(e.tangleAddress,Q.tangleAddress))throw Error(`Solve metadata Tangle contract does not match the trusted deployment`);if(!Fu(e.managerAddress,Q.managerAddress))throw Error(`Solve metadata competition manager does not match the trusted deployment`);if(!Fu(e.paymentAsset,Q.paymentAsset))throw Error(`Solve metadata payment asset does not match the trusted deployment`);if(e.blueprintId!==Q.blueprintId)throw Error(`Solve submissions require blueprint ${Q.blueprintId}; received ${e.blueprintId}`);if(e.serviceId!==Q.serviceId)throw Error(`Solve submissions require service ${Q.serviceId}; received ${e.serviceId}`);if(e.competitionId!==Q.competitionId)throw Error(`Solve submissions require competition ${Q.competitionId}; received ${e.competitionId}`);if(e.minStakeWei!==Q.minStakeWei)throw Error(`Solve submissions require zero stake for the trusted deployment`)}function Lu(e,t){let n=_u(t.check??e.check,`competition.participation.check`),r=vu(n.command,`competition.participation.check.command`,512);if(!Array.isArray(n.args)||n.args.some(e=>typeof e!=`string`))throw Error(`competition.participation.check.args must be an array of strings`);let i=n.args.map(e=>vu(e,`competition checker argument`,2048)),a=Tu(n.result_file,n.resultFile),o=n.timeout_ms??n.timeoutMs,s=o===void 0?void 0:wu(o,`competition checker timeout`);return{command:r,args:i,...a?{result_file:a}:{},...s?{timeout_ms:s}:{}}}function Ru(e){if(e.provenance===void 0)return;let t=_u(e.provenance,`competition.participation.provenance`);if(t.mode!==`github_pull_request`)throw Error(`competition.participation.provenance.mode is unsupported`);if(t.required!==void 0&&typeof t.required!=`boolean`)throw Error(`competition.participation.provenance.required must be a boolean`);return{mode:`github_pull_request`,required:t.required===!0}}function zu(e){let t=_u(e.chain??e.network??{},`competition.chain`),n=e.rewards&&typeof e.rewards==`object`&&!Array.isArray(e.rewards)?_u(e.rewards,`competition.rewards`):{},r=n.minStake&&typeof n.minStake==`object`&&!Array.isArray(n.minStake)?_u(n.minStake,`competition.rewards.minStake`).raw:void 0,i=Tu(t.minStakeWei,t.min_stake_wei,e.minStakeWei,e.min_stake_wei,r),a=t.chainId??t.chain_id??e.chainId??e.chain_id,o=Tu(t.chainName,t.chain_name,e.chainName,e.chain_name)??`Tempo`,s=Tu(t.nativeSymbol,t.native_symbol,e.nativeSymbol,e.native_symbol)??`TNT`,c=Tu(t.rpcUrl,t.rpc_url,e.rpcUrl,e.rpc_url,process.env.TANGLE_SOLVE_RPC_URL),l=Tu(t.sponsorUrl,t.sponsor_url,e.sponsorUrl,e.sponsor_url,process.env.TANGLE_SOLVE_SPONSOR_URL),u=Tu(t.tangleAddress,t.tangle_address,t.coreAddress,t.core_address,e.tangleAddress,e.tangle_address,e.coreAddress,e.core_address),d=Tu(t.managerAddress,t.manager_address,e.managerAddress,e.manager_address),f=Tu(t.paymentAsset,t.payment_asset,t.servicePaymentAsset,t.service_payment_asset,e.paymentAsset,e.payment_asset,e.servicePaymentAsset,e.service_payment_asset),p=Tu(t.blueprintId,t.blueprint_id,e.blueprintId,e.blueprint_id),m=Tu(t.serviceId,t.service_id,e.serviceId,e.service_id),h=Tu(t.competitionId,t.competition_id,e.competitionId,e.competition_id,e.id);if(!c||!l||!u||!d||!p||!m||!h||!i||a===void 0)throw Error(`Solve competition metadata must include complete Tempo chain configuration`);return{chainId:wu(a,`chain.chainId`),chainName:o,nativeSymbol:s,rpcUrl:xu(c,`chain.rpcUrl`),sponsorUrl:xu(l,`chain.sponsorUrl`),tangleAddress:Cu(u,`chain.tangleAddress`),managerAddress:Cu(d,`chain.managerAddress`),paymentAsset:Cu(f??Q.paymentAsset,`chain.paymentAsset`),blueprintId:bu(p,`chain.blueprintId`),serviceId:bu(m,`chain.serviceId`),competitionId:bu(h,`chain.competitionId`,!0),minStakeWei:bu(i,`chain.minStakeWei`,!0)}}function Bu(e){let t=_u(e,`competition`),n=_u(t.participation??t.task,`competition.task`),r={...t,participation:{...n,...n.repositoryRevision===void 0&&n.revision!==void 0?{repositoryRevision:n.revision}:{}}},i=r.participation,a=Su(Tu(r.repository,r.repo_url,i.repository)??``,`competition.repository`),o=yu(Tu(r.repositoryRevision,r.repository_revision,i.revision,i.repositoryRevision,i.repository_revision),`competition.repositoryRevision`),s=vu(r.slug??r.id,`competition.slug`,128),c=vu(r.name??r.title??s,`competition.name`,256),l=Lu(r,i),u=Ru(i);return{version:1,slug:s,title:c,repository:a,taskRevision:o,checker:l,chain:zu(r),...u?{provenance:u}:{}}}function Vu(e){return{chainId:e.chain.chainId,chainName:e.chain.chainName,nativeSymbol:e.chain.nativeSymbol,rpcUrl:e.chain.rpcUrl,sponsorUrl:e.chain.sponsorUrl,tangleAddress:e.chain.tangleAddress,managerAddress:e.chain.managerAddress,paymentAsset:e.chain.paymentAsset,blueprintId:BigInt(e.chain.blueprintId),serviceId:BigInt(e.chain.serviceId),competitionId:BigInt(e.chain.competitionId),minStakeWei:BigInt(e.chain.minStakeWei)}}async function Hu(e){let t=_u(JSON.parse(await A.readFile(E.join(e,`.tangle-solve.json`),`utf8`)),`.tangle-solve.json`);if(t.version!==1)throw Error(`.tangle-solve.json has an unsupported version`);let n=_u(t.checker,`.tangle-solve.json.checker`),r=_u(t.chain,`.tangle-solve.json.chain`);return Bu({slug:t.slug,name:t.title,repository:t.repository,repositoryRevision:t.taskRevision,participation:{check:n,provenance:t.provenance},chain:r,competitionId:r.competitionId})}const Uu=rt(we),Wu=`.tangle-solve-run.json`,Gu=`.tangle-solve.json`,Ku=`tangle.solve.manifestSha256`,qu=new Set([Gu,Wu]),Ju=`upstream`;async function Yu(e,t){let n=await Uu(`git`,[`-C`,e,...t],{encoding:`utf8`,maxBuffer:1e6});return String(n.stdout).trim()}async function Xu(e,t){let n=E.resolve(t??process.cwd()),r=await Hu(n);if(e&&e!==r.slug&&e!==r.chain.competitionId)throw Error(`This directory contains '${r.slug}', not '${e}'`);return{root:n,manifest:r}}async function Zu(e){let t=E.join(e,Gu),n;try{n=await A.lstat(t)}catch{throw Error(`${Gu} is missing`)}if(n.isSymbolicLink()||!n.isFile())throw Error(`${Gu} must be a regular file`);return x(`sha256`).update(await A.readFile(t)).digest(`hex`)}async function Qu(e){let t=await Zu(e);return await Yu(e,[`config`,`--local`,`--replace-all`,Ku,t]),t}async function $u(e){let t;try{t=await Yu(e,[`config`,`--local`,`--get`,Ku])}catch{throw Error(`The local Git metadata has no ${Ku} pin; run tangle solve clone again`)}if(!/^[0-9a-f]{64}$/i.test(t))throw Error(`The local ${Ku} pin is invalid`);if(await Zu(e)!==t.toLowerCase())throw Error(`${Gu} changed after clone; run tangle solve clone again`)}async function ed(e,t){try{return await Yu(e,[`ls-files`,`--error-unmatch`,`--`,t]),!0}catch{return!1}}async function td(e){await $u(e);for(let t of qu)if(await ed(e,t))throw Error(`${t} must remain untracked and local to this Solve workspace`);let t=await Uu(`git`,[`-C`,e,`status`,`--porcelain=v1`,`--untracked-files=all`,`--ignored=matching`],{encoding:`utf8`,maxBuffer:1e6});if(String(t.stdout).split(/\r?\n/).filter(Boolean).filter(e=>{let t=e.slice(0,2),n=e.slice(3);return!((t===`??`||t===`!!`)&&qu.has(n))}).length>0)throw Error(`Commit the candidate before running Solve. Only the local manifest and run record may remain uncommitted.`);return yu(await Yu(e,[`rev-parse`,`HEAD`]),`submission revision`)}async function nd(e,t,n,r={}){let i=await rd(e,t,r);if(i)return{taskRepository:t.repository,taskRevision:t.taskRevision,submissionRepository:i,submissionRevision:n}}async function rd(e,t,n={}){let r;try{r=Eu(await Yu(e,[`config`,`--get`,`remote.origin.pushurl`]))}catch{try{r=Eu(await Yu(e,[`config`,`--get`,`remote.origin.url`]))}catch{if(n.allowMissing)return;throw Error(`Add your GitHub fork as the 'origin' remote before submitting. The task repository is available as '${Ju}'.`)}}let i=Su(r,`git remote.origin.url`);if(i.toLowerCase()===t.repository.toLowerCase()){if(n.allowMissing)return;throw Error(`The 'origin' remote is the task repository. Add your GitHub fork as 'origin'; keep the task repository as '${Ju}' before submitting.`)}return i}function id(e,t){return!e||!t?!1:e.taskRepository.toLowerCase()===t.taskRepository.toLowerCase()&&e.taskRevision.toLowerCase()===t.taskRevision.toLowerCase()&&e.submissionRepository.toLowerCase()===t.submissionRepository.toLowerCase()&&e.submissionRevision.toLowerCase()===t.submissionRevision.toLowerCase()}function ad(e,t){return`${e}/commit/${t}`}function od(e,t,n,r,i={}){let a=e.evidenceRefs.map(e=>Ou(e.trim(),`checker evidence reference`));if(n){if(!t){if(i.allowMissingSource)return{evidence:e.evidence,evidenceRefs:a};throw Error(`Provenance policy requires a submission source`)}let o=Du(r);if(n.required&&(i.requirePullRequest??!0)&&!o)throw Error(`This competition requires a GitHub pull request`);a.push(ad(t.taskRepository,t.taskRevision),ad(t.submissionRepository,t.submissionRevision),...o?[o]:[])}return{evidence:e.evidence,evidenceRefs:[...new Set(a)]}}async function sd(e,t){let n=`${e}.${process.pid}.tmp`;await A.writeFile(n,`${JSON.stringify(t,null,2)}\n`,{mode:384}),await A.rename(n,e)}async function cd(e){let t=JSON.parse(await A.readFile(E.join(e,Wu),`utf8`));if(t.version!==1||typeof t.competition!=`string`)throw Error(`${Wu} has an unsupported format`);return t}async function ld(e){let t=Du(e.pullRequest);if(!t)throw Error(`A pull request URL is required`);let n=new URL(t).pathname.split(`/`).filter(Boolean),r=await fetch(`https://api.github.com/repos/${n[0]}/${n[1]}/pulls/${n[3]}`,{headers:{Accept:`application/vnd.github+json`,"User-Agent":`tangle-solve-cli`},signal:AbortSignal.timeout(15e3)}),i=await r.json().catch(()=>null),a=e=>e.replace(/\/$/,``).toLowerCase();if(!r.ok||a(i?.base?.repo?.html_url??``)!==a(e.taskRepository)||i?.head?.sha?.toLowerCase()!==e.submissionRevision.toLowerCase()||a(i?.head?.repo?.html_url??``)!==a(e.submissionRepository))throw Error(`GitHub pull request must target the pinned task repository and contain the current committed submission`)}function ud(e){return{...e.authorization?{authorization:e.authorization}:{},...e.stake?{stake:e.stake}:{},join:e.join,commit:e.commit,reveal:e.reveal,report:e.report,evaluation:e.evaluation}}const dd=rt(we);function fd(){return`Task source is '${Ju}'. Add your fork as 'origin', commit your candidate, push it, and open a pull request before submitting.`}async function pd(e,t,n){try{let r=_u(await ju({path:`/v1/competitions/${encodeURIComponent(e)}`,apiUrl:n.apiUrl,profile:n.profile}),`competition response`),i=Bu(r.competition??r),a=E.resolve(t??i.slug),o=I(`Cloning ${i.slug}…`);n.json||o.start();try{await dd(`git`,[`clone`,`--no-tags`,`--origin`,Ju,i.repository,a],{encoding:`utf8`,maxBuffer:1e6}),await Yu(a,[`checkout`,`--detach`,i.taskRevision]);let e=await Yu(a,[`rev-parse`,`HEAD`]);if(e.toLowerCase()!==i.taskRevision.toLowerCase())throw Error(`Pinned checkout resolved to ${e}, expected ${i.taskRevision}`);await sd(E.join(a,`.tangle-solve.json`),i),await Qu(a)}finally{o.stop()}n.json?N({competition:i,directory:a}):(P(`Cloned ${i.slug} at ${i.taskRevision.slice(0,12)}`),i.provenance&&F(fd()),F(`Run the pinned checker with: cd ${a} && tangle solve run`))}catch(e){B(e)}}const md=12e4,hd=mt(`event JobSubmitted(uint64 indexed serviceId, uint64 indexed callId, uint8 jobIndex, address caller, bytes inputs)`),gd=mt(`event JobCompleted(uint64 indexed serviceId, uint64 indexed callId)`),_d=mt(`event JobResultSubmitted(uint64 indexed serviceId, uint64 indexed callId, address indexed operator, bytes result)`),vd=mt(`event AggregatedResultSubmitted(uint64 indexed serviceId, uint64 indexed callId, uint256 signerBitmap, bytes output)`),yd=mt(`event EvaluationAccepted(uint64 indexed serviceId, uint64 indexed competitionId, address indexed researcher, bytes32 candidateId, bytes32 submissionRefHash, bytes32 evaluationDigest, bytes32 metricsHash, bytes32 evidenceRefsHash)`),bd=[...pt([`function submitJob(uint64 serviceId, uint8 jobIndex, bytes inputs) payable returns (uint64 callId)`,`function getJobEventRate(uint64 blueprintId, uint8 jobIndex) view returns (uint256 rate)`,`function getServicePaymentAsset(uint64 serviceId) view returns (address)`,`function isPermittedCaller(uint64 serviceId, address caller) view returns (bool)`]),hd,gd,_d,vd],xd=pt([`function authorizeSelf(uint64 serviceId)`,`function revokeSelf(uint64 serviceId)`,`function isDeviceRevoked(address device) view returns (bool)`,`function postStake(uint64 serviceId, uint64 competitionId) payable`,`function stakes(uint64 serviceId, uint64 competitionId, address researcher) view returns (uint256)`,`function pendingResults(uint64 serviceId, uint64 jobCallId) view returns (uint8 job, bytes32 outputHash, uint256 signerBitmap, bool exists, bool executed)`,`function executePendingResult(uint64 serviceId, uint64 jobCallId, bytes output)`,`function acceptedCandidates(uint64 serviceId, uint64 competitionId, address researcher, bytes32 candidateId) view returns (bool)`]),Sd=pt([`function allowance(address owner, address spender) view returns (uint256)`,`function approve(address spender, uint256 amount) returns (bool)`]),Cd=ht(`uint64 competitionId, uint256 stakeWei`),wd=ht(`uint64 competitionId, bytes32 commitment`),Td=ht(`uint64 competitionId, bytes32 commitment, string artifactRef, bytes32 salt`),Ed=ht(`string artifactRef, bytes32 salt`),Dd=ht(`uint64 competitionId, bytes32 candidateId, string submissionRef, string evidenceJson, string evidenceRefsJson`),Od=ht(`string status, string detail`),kd=/^0x[0-9a-f]{64}$/i;function Ad(e,t){if(e!==t)throw Error(`Tempo RPC returned chain ${e}; expected ${t}`)}function jd(e,t,n){return{...e,feePayer:!0,nonceKey:t,nonce:n}}function Md(e,t){if(e!==`success`)throw Error(`${t} transaction reverted`)}function Nd(e,t,n,r){if(!kd.test(t))throw Error(`${n} transaction hash is invalid`);if(typeof e.transactionHash!=`string`||e.transactionHash.toLowerCase()!==t.toLowerCase())throw Error(`${n} receipt hash does not match the saved transaction`);if(Md(e.status??``,n),typeof e.from!=`string`||e.from.toLowerCase()!==r.from.toLowerCase())throw Error(`${n} receipt sender does not match the Solve device`);if(typeof e.to!=`string`||e.to.toLowerCase()!==r.to.toLowerCase())throw Error(`${n} receipt destination does not match the expected contract`)}function Pd(e,t){return e>=t?[]:e>0n?[0n,t]:[t]}function Fd(e,t,n=Date.now()){return n>=e+t}function Id(e,t){return e.filter(e=>e.args?.candidateId?.toLowerCase()===t.toLowerCase()).at(-1)?.transactionHash}function Ld(e,t,n,r,i){for(let a of e.logs)if(a.address.toLowerCase()===t.tangleAddress.toLowerCase())try{let e=st({abi:[hd],eventName:`JobSubmitted`,data:a.data,topics:a.topics});if(e.args.serviceId===t.serviceId&&e.args.jobIndex===n&&e.args.caller.toLowerCase()===r.toLowerCase()&&(!i||e.args.inputs.toLowerCase()===i.toLowerCase()))return e.args.callId}catch{}throw Error(`Tangle did not emit job ${n} for ${r}`)}function Rd(e,t,n,r){for(let i of e.logs)if(i.address.toLowerCase()===t.managerAddress.toLowerCase())try{let e=st({abi:[yd],eventName:`EvaluationAccepted`,data:i.data,topics:i.topics}).args;if(e.serviceId===t.serviceId&&e.competitionId===t.competitionId&&e.researcher.toLowerCase()===n.address.toLowerCase()&&e.candidateId.toLowerCase()===r.toLowerCase())return!0}catch{}return!1}function zd(e){if(e.chainId!==vt.id)throw Error(`Solve submissions require Tempo Moderato (chain ${vt.id}); received ${e.chainId}`);if(!e.sponsorUrl)throw Error(`Solve submissions require a Tempo sponsor relay URL; unsponsored writes are disabled`);return{...vt,name:e.chainName,nativeCurrency:{name:e.nativeSymbol,symbol:e.nativeSymbol,decimals:18},rpcUrls:{default:{http:[e.rpcUrl]}}}}async function Bd(e,t){Iu(e);let n=zd(e),r=it({chain:n,transport:ut(e.rpcUrl)});return Ad(await r.getChainId(),e.chainId),await Vd({publicClient:r},e),{publicClient:r,walletClient:at({account:t,chain:n,transport:bt(ut(e.rpcUrl),ut(e.sponsorUrl))}),account:t}}async function Vd(e,t){let n=await e.publicClient.readContract({address:t.tangleAddress,abi:bd,functionName:`getServicePaymentAsset`,args:[t.serviceId]});if(n.toLowerCase()!==t.paymentAsset.toLowerCase())throw Error(`Tempo service payment asset ${n} does not match the trusted Solve asset ${t.paymentAsset}`)}async function Hd(e,t,n){let[r,i]=await Promise.all([e.publicClient.readContract({address:t.tangleAddress,abi:bd,functionName:`getJobEventRate`,args:[t.blueprintId,n]}),e.publicClient.readContract({address:t.tangleAddress,abi:bd,functionName:`getServicePaymentAsset`,args:[t.serviceId]})]);if(i.toLowerCase()!==t.paymentAsset.toLowerCase())throw Error(`Tempo job payment asset ${i} does not match the trusted Solve asset ${t.paymentAsset}`);return{asset:i,amount:r,value:i===`0x0000000000000000000000000000000000000000`?r:0n}}async function Ud(e,t,n){return await e.publicClient.readContract({address:t,abi:Sd,functionName:`allowance`,args:[e.account.address,n.tangleAddress]})}async function Wd(e,t,n,r,i,a){let o=Date.now();for(;!Fd(o,a);){if((await e.publicClient.getLogs({address:t.tangleAddress,event:gd,args:{serviceId:t.serviceId,callId:n},fromBlock:r,toBlock:`latest`})).length>0){let a=(await e.publicClient.getLogs({address:t.tangleAddress,event:_d,args:{serviceId:t.serviceId,callId:n},fromBlock:r,toBlock:`latest`}))[0]?.args.result;if(!a)throw Error(`Tangle job ${n} completed without a result`);let[o,s]=ot(Od,a);if(o!==i)throw Error(`Tangle job ${n} ${o}: ${s}`);return{status:o,detail:s}}await new Promise(e=>setTimeout(e,1e3))}throw Error(`Tangle job ${n} did not complete within 120 seconds`)}async function Gd(e,t,n,r,i){let a=Date.now();for(;!Fd(a,i);){let i=(await e.publicClient.getLogs({address:t.tangleAddress,event:vd,args:{serviceId:t.serviceId,callId:n},fromBlock:r,toBlock:`latest`}))[0]?.args.output;if(i)return i;await new Promise(e=>setTimeout(e,1e3))}throw Error(`Tangle job ${n} did not produce an aggregate within 120 seconds`)}async function Kd(e,t,n){return!!await e.publicClient.readContract({address:t.managerAddress,abi:xd,functionName:`acceptedCandidates`,args:[t.serviceId,t.competitionId,e.account.address,n]})}const qd=BigInt(ft(gt(`tangle.solve.v1`)));async function Jd(e,t){let n=await yt.nonce.getNonce(e.publicClient,{account:e.account.address,nonceKey:qd});if(n>BigInt(2**53-1))throw Error(`The Solve transaction nonce exceeds the safe range`);return e.walletClient.writeContract(jd(t,qd,Number(n)))}async function Yd(e,t,n,r){if(!await e.publicClient.readContract({address:t.tangleAddress,abi:bd,functionName:`isPermittedCaller`,args:[t.serviceId,e.account.address]}))try{let i=r??await Jd(e,{address:t.managerAddress,abi:xd,functionName:`authorizeSelf`,args:[t.serviceId]});if(r||await n?.(`authorization`,i),Nd(await e.publicClient.waitForTransactionReceipt({hash:i}),i,`Authorization`,{from:e.account.address,to:t.managerAddress}),!await e.publicClient.readContract({address:t.tangleAddress,abi:bd,functionName:`isPermittedCaller`,args:[t.serviceId,e.account.address]}))throw Error(`authorization transaction did not add the device`);return i}catch(e){let t=e instanceof Error?e.message:`unknown chain error`;throw Error(`The competition manager did not authorize this device. The deployed manager must expose authorizeSelf(uint64): ${t}`)}}async function Xd(e,t){let n=await Jd(e,{address:t.managerAddress,abi:xd,functionName:`revokeSelf`,args:[t.serviceId]});return Nd(await e.publicClient.waitForTransactionReceipt({hash:n}),n,`Revocation`,{from:e.account.address,to:t.managerAddress}),n}async function Zd(e,t,n,r,i=`allowance`,a={}){if(t.amount===0n||t.asset===`0x0000000000000000000000000000000000000000`)return;let o=await Ud(e,t.asset,n);for(let s of Pd(o,t.amount)){let o=s===0n?`${i}:reset`:`${i}:approval`,c=a[o];if(c){if(Nd(await e.publicClient.waitForTransactionReceipt({hash:c}),c,s===0n?`ERC-20 allowance reset`:`ERC-20 allowance approval`,{from:e.account.address,to:t.asset}),await Ud(e,t.asset,n)!==s)throw Error(`${s===0n?`ERC-20 allowance reset`:`ERC-20 allowance approval`} did not set the expected allowance`);continue}let l=await Jd(e,{address:t.asset,abi:Sd,functionName:`approve`,args:[n.tangleAddress,s]});await r?.(o,l),Nd(await e.publicClient.waitForTransactionReceipt({hash:l}),l,s===0n?`ERC-20 allowance reset`:`ERC-20 allowance approval`,{from:e.account.address,to:t.asset})}}async function Qd(e,t,n,r,i,a=`job:${n}`,o={}){let s=await Hd(e,t,n);await Zd(e,s,t,i,`allowance:${a}`,o);let c=o[a],l=c??await Jd(e,{address:t.tangleAddress,abi:bd,functionName:`submitJob`,args:[t.serviceId,n,r],value:s.value});c||await i?.(a,l);let u=await e.publicClient.waitForTransactionReceipt({hash:l});return Nd(u,l,`Job ${n}`,{from:e.account.address,to:t.tangleAddress}),{hash:l,callId:Ld(u,t,n,e.account.address,r),blockNumber:u.blockNumber}}async function $d(e,t,n,r,i,a,o=`job:${n}`,s={}){let c=await Qd(e,t,n,r,a,o,s),l=await Wd(e,t,c.callId,c.blockNumber,i,md);return{...c,acknowledgement:l}}const ef={...Q,chainName:`Tempo Moderato`,nativeSymbol:`TNT`},tf={async read(e){let t=it({chain:vt,transport:ut(ef.rpcUrl,{timeout:15e3})}),n=e=>e.catch(()=>null),r=await Promise.all(e.map(async e=>{let[r,i]=await Promise.all([n(t.readContract({address:ef.tangleAddress,abi:bd,functionName:`isPermittedCaller`,args:[ef.serviceId,e]})),n(t.readContract({address:ef.managerAddress,abi:xd,functionName:`isDeviceRevoked`,args:[e]}))]);return[e.toLowerCase(),{permitted:r,revoked:i}]}));return new Map(r)},async revokeSelf(e){return Xd(await Bd(ef,e),ef)}},nf={permitted:null,revoked:null};function rf(e){return e.revoked?`revoked`:e.permitted===null?`unknown`:e.permitted?`permitted`:`not permitted`}async function af(e,t=tf){try{let{devices:n}=await Nu({apiUrl:e.apiUrl,profile:e.profile}),r=du()?.account.address.toLowerCase(),i=n.map(e=>({...e,local:e.address===r,status:e.revokedAt?`revoked`:`active`}));r&&!i.some(e=>e.local)&&i.push({address:r,local:!0,status:`unbound`,boundAt:null,lastUsedAt:null,revokedAt:null,revocationMethod:null,revocationReason:null});let a=await t.read(i.map(e=>lt(e.address))),o=i.map(e=>({...e,onChain:a.get(e.address)??nf}));if(e.json){N({serviceId:ef.serviceId.toString(),devices:o});return}It([`Address`,`Status`,`Local`,`Service ${ef.serviceId}`,`Last used`,`Revoked`],o.map(e=>[e.address,e.status,e.local?`yes`:``,rf(e.onChain),e.lastUsedAt??``,e.revokedAt?`${e.revokedAt} (${e.revocationMethod})`:``]))}catch(t){B(t,e.json)}}async function of(e,t,n=tf){try{if(!dt(e))throw Error(`${e} is not an EVM address`);let r=lt(e),i=du(),a=i?.account.address===r;if(!t.yes){if(!process.stdin.isTTY)throw Error(`Revoking a device is permanent. Re-run with --yes to confirm`);if(!await Yr(`Permanently revoke Solve device ${r}${a?` (this machine's device)`:``}? [y/N] `,`--yes`)){F(`Revocation cancelled`);return}}let o;if(i&&a){let e=await Mu({deviceAddress:r,purpose:`revoke`,apiUrl:t.apiUrl,profile:t.profile});o={challengeId:e.challengeId,signature:await i.account.signMessage({message:e.message})}}let s=await Pu({deviceAddress:r,reason:t.reason,...o,apiUrl:t.apiUrl,profile:t.profile}),c=r.toLowerCase(),l=(await n.read([r])).get(c)??nf,u;if(i&&a&&!l.revoked){try{u=await n.revokeSelf(i.account)}catch(e){let t=e instanceof Error?e.message:String(e);throw Error(`The Solve API revoked ${r}, but the on-chain revocation failed and the local key was kept: ${t}. Run the command again to retry`)}l=(await n.read([r])).get(c)??nf}let d=i&&a&&l.revoked?pu(i):void 0;if(t.json){N({...s,serviceId:ef.serviceId.toString(),onChain:l,...u?{revocationTransaction:u}:{},localKeyRetired:!!d});return}P(s.alreadyRevoked?`${r} was already revoked in the Solve API`:`Revoked ${r}; the Solve API refuses its signatures`),u&&P(`Revoked on Tempo in ${u}; service ${ef.serviceId} refuses its jobs`),d&&F("The local device key was moved aside because its address may still hold stake or rewards. Run `tangle solve account --create` for a new device"),!a&&l.permitted&&jt(`The device can still submit jobs to service ${ef.serviceId}. Only its key, or the Solve blueprint owner, can revoke it on chain`)}catch(e){B(e,t.json)}}function sf(e,t){return ft(ct(Ed,[e.trim(),t]))}function cf(e){let t=/^submission=(\S+)/.exec(e);if(!t?.[1])throw Error(`COMMIT_CANDIDATE did not return a submission reference`);return t[1]}async function lf(e,t,n,r,i){let a=i.resumeTransactions?.evaluation;if(a){let n=await e.publicClient.waitForTransactionReceipt({hash:a});if(Nd(n,a,`Evaluation`,{from:e.account.address,to:t.managerAddress}),!Rd(n,t,e.account,r))throw Error(`Saved evaluation transaction did not emit EvaluationAccepted for this candidate`);return a}let o=Date.now();for(;!Fd(o,md);){if(await Kd(e,t,r)){let i=Id(await e.publicClient.getLogs({address:t.managerAddress,event:yd,args:{serviceId:t.serviceId,competitionId:t.competitionId,researcher:e.account.address},fromBlock:n.blockNumber,toBlock:`latest`}),r);if(i)return i;throw Error(`Candidate is already accepted, but its EvaluationAccepted transaction is unavailable`)}let[a,o,,s,c]=await e.publicClient.readContract({address:t.managerAddress,abi:xd,functionName:`pendingResults`,args:[t.serviceId,n.callId]});if(s&&a!==4)throw Error(`Manager pending result ${n.callId} has unexpected job ${a}`);if(s&&c)throw Error(`Manager executed the report without EvaluationAccepted`);if(s&&!c){if(o.toLowerCase()!==ft(n.output).toLowerCase())throw Error(`Manager pending report output does not match the aggregate`);let a=await Jd(e,{address:t.managerAddress,abi:xd,functionName:`executePendingResult`,args:[t.serviceId,n.callId,n.output]});await i.onTransaction?.(`evaluation`,a);let s=await e.publicClient.waitForTransactionReceipt({hash:a});if(Nd(s,a,`Evaluation`,{from:e.account.address,to:t.managerAddress}),!Rd(s,t,e.account,r))throw Error(`Evaluation transaction did not emit EvaluationAccepted for this candidate`);return a}await new Promise(e=>setTimeout(e,1e3))}throw Error(`Manager did not emit EvaluationAccepted within 120 seconds`)}async function uf(e,t,n,r={}){if(Iu(e),!/^0x[0-9a-f]{64}$/i.test(n.salt))throw Error(`Reveal salt must be bytes32`);if(!n.artifactRef.trim())throw Error(`Candidate reference is required`);if(!n.evidenceJson.trim()||n.evidenceRefs.length===0)throw Error(`Checker evidence is required`);let i=await Bd(e,t),a=await Yd(i,e,r.onTransaction,r.resumeTransactions?.authorization),o,s=await i.publicClient.readContract({address:e.managerAddress,abi:xd,functionName:`stakes`,args:[e.serviceId,e.competitionId,i.account.address]});s<e.minStakeWei&&(o=await Jd(i,{address:e.managerAddress,abi:xd,functionName:`postStake`,args:[e.serviceId,e.competitionId],value:e.minStakeWei-s}),await r.onTransaction?.(`stake`,o),Nd(await i.publicClient.waitForTransactionReceipt({hash:o}),o,`Stake`,{from:i.account.address,to:e.managerAddress}));let c=sf(n.artifactRef,n.salt),l=ct(Cd,[e.competitionId,e.minStakeWei]),u=ct(wd,[e.competitionId,c]),d=ct(Td,[e.competitionId,c,n.artifactRef.trim(),n.salt]),f=await $d(i,e,1,l,`joined`,r.onTransaction,`join`,r.resumeTransactions),p=await $d(i,e,2,u,`committed`,r.onTransaction,`commit`,r.resumeTransactions),m=cf(p.acknowledgement.detail),h=await $d(i,e,3,d,`revealed`,r.onTransaction,`reveal`,r.resumeTransactions),g=await Qd(i,e,4,ct(Dd,[e.competitionId,c,m,n.evidenceJson,JSON.stringify(n.evidenceRefs)]),r.onTransaction,`report`,r.resumeTransactions),_=await Gd(i,e,g.callId,g.blockNumber,md),v=await lf(i,e,{callId:g.callId,output:_,blockNumber:g.blockNumber},c,r);return{address:i.account.address,...a?{authorization:a}:{},...o?{stake:o}:{},join:f.hash,commit:p.hash,reveal:h.hash,report:g.hash,evaluation:v,candidateId:c,submissionRef:m}}const df=rt(we),ff=`/usr/bin/bwrap`,pf=[`/usr`,`/bin`,`/sbin`,`/lib`,`/lib64`];function mf(e){return[...e].some(e=>{let t=e.charCodeAt(0);return t<32||t===127})}function hf(e,t){if(!e||e.length>2048||mf(e))throw Error(`${t} contains invalid control characters or is too long`)}function gf(e,t){let n=t;for(;n<e.length&&/\s/.test(e[n]??``);)n+=1;return n}function _f(e,t){if(e[t]!==`"`)throw Error(`Checker output must be valid JSON`);let n=t+1;for(;n<e.length;){let t=e[n];if(t===`\\`){n+=2;continue}if(t===`"`)return n+1;if((t?.charCodeAt(0)??0)<32)throw Error(`Checker output must be valid JSON`);n+=1}throw Error(`Checker output must be valid JSON`)}function vf(e,t,n){let r=new Set,i=gf(e,t+1);if(e[i]===`}`)return i+1;for(;i<e.length;){let t=_f(e,i),a=JSON.parse(e.slice(i,t));if(r.has(a))throw Error(`Checker output must not contain duplicate object keys`);if(r.add(a),i=gf(e,t),e[i]!==`:`)throw Error(`Checker output must be valid JSON`);let o=gf(e,i+1),s=bf(e,o);if(n?.(a,o,s),i=gf(e,s),e[i]===`}`)return i+1;if(e[i]!==`,`)throw Error(`Checker output must be valid JSON`);i=gf(e,i+1)}throw Error(`Checker output must be valid JSON`)}function yf(e,t){let n=gf(e,t+1);if(e[n]===`]`)return n+1;for(;n<e.length;){if(n=gf(e,bf(e,n)),e[n]===`]`)return n+1;if(e[n]!==`,`)throw Error(`Checker output must be valid JSON`);n=gf(e,n+1)}throw Error(`Checker output must be valid JSON`)}function bf(e,t){if(e[t]===`"`)return _f(e,t);if(e[t]===`{`)return vf(e,t);if(e[t]===`[`)return yf(e,t);let n=t;for(;n<e.length&&!/[\s,\]}]/.test(e[n]??``);)n+=1;return n}function xf(e){let t=e.trim();if(gf(t,bf(t,0))!==t.length)throw Error(`Checker output must be valid JSON`)}function Sf(e,t){let n=e.trim();if(n[0]!==`{`)return;let r;return vf(n,0,(e,i,a)=>{e===t&&(r=n.slice(i,a).trim())}),r}function Cf(e){let t;try{t=JSON.parse(e)}catch{throw Error(`Checker output must be one JSON object`)}if(xf(e),!t||typeof t!=`object`||Array.isArray(t))throw Error(`Checker output must be a JSON object`);let n=t,r=n.candidate_ref;if(typeof r!=`string`||!r.trim())throw Error(`Checker output must include candidate_ref`);let i=r.trim(),a=n.evidence_refs;if(!Array.isArray(a)||a.length===0||a.some(e=>typeof e!=`string`||!e.trim()))throw Error(`Checker output must include a non-empty evidence_refs array`);hf(i,`candidate_ref`);for(let e of a)hf(e.trim(),`evidence_refs`);if(!n.evidence_json||typeof n.evidence_json!=`object`||Array.isArray(n.evidence_json))throw Error(`Checker output must include an evidence_json object`);let o={...n.evidence_json},s=Sf(e,`evidence_json`);if(!s)throw Error(`Checker evidence_json source text is missing`);if(o.candidate_ref!==i)throw Error(`Checker evidence_json candidate_ref must match candidate_ref`);return{candidateRef:i,evidenceRefs:a.map(e=>e.trim()),evidence:o,evidenceJson:s}}async function wf(e,t,n){let r=n.trim();if(r.startsWith(`{`)&&r.endsWith(`}`)||!t.result_file)return r;let i=await Af(e),a=E.resolve(i,t.result_file),o=E.relative(i,a);if(o.startsWith(`..`)||E.isAbsolute(o))throw Error(`Checker result_file must stay inside the competition repository`);let s;try{s=await A.lstat(a)}catch{throw Error(`Checker result_file must be an existing regular file inside the competition repository`)}if(s.isSymbolicLink())throw Error(`Checker result_file must not be a symbolic link`);if(!s.isFile())throw Error(`Checker result_file must be an existing regular file inside the competition repository`);let c;try{c=await A.realpath(a)}catch{throw Error(`Checker result_file must resolve to a regular file inside the competition repository`)}let l=E.relative(i,c);if(l.startsWith(`..`)||E.isAbsolute(l))throw Error(`Checker result_file must stay inside the competition repository`);return(await A.readFile(c,`utf8`)).trim()}function Tf(e,t){let n=E.relative(e,t);return n===``||!n.startsWith(`..`)&&!E.isAbsolute(n)}function Ef(e){return pf.some(t=>Tf(t,e))}async function Df(e,t,n){let r=e.includes(`/`)?[E.resolve(t,e)]:(process.env.PATH??``).split(E.delimiter).filter(Boolean).map(t=>E.join(t,e));for(let i of r){let r;try{r=await A.realpath(i),await A.access(r,A.constants.X_OK)}catch{continue}if(!Tf(t,r)&&!Ef(r)&&r!==n)throw Error(`Checker executable '${e}' must resolve inside the competition repository or a trusted runtime directory`);return r}throw Error(`Checker executable '${e}' was not found`)}async function Of(e){let t=[];for(let n of e)try{(await A.stat(n)).isDirectory()&&t.push(n)}catch{}return t}async function kf(e){let t=await A.realpath(Se.homedir());if(e===E.parse(e).root||e===t)throw Error(`Solve checker repository must be a dedicated directory, not the filesystem or home root`)}async function Af(e){let t=await A.realpath(e);return await kf(t),t}async function jf(e){let t=E.join(e,`.git`),n;try{n=await A.lstat(t)}catch{return}if(n.isSymbolicLink())throw Error(`Solve checker repository .git must not be a symbolic link`);if(!n.isDirectory()&&!n.isFile())return;let r;try{let t={...process.env};for(let e of[`GIT_DIR`,`GIT_WORK_TREE`,`GIT_INDEX_FILE`,`GIT_OBJECT_DIRECTORY`,`GIT_ALTERNATE_OBJECT_DIRECTORIES`,`GIT_COMMON_DIR`,`GIT_CONFIG_COUNT`,`GIT_CONFIG_PARAMETERS`])delete t[e];let n=await df(`/usr/bin/git`,[`-C`,e,`rev-parse`,`--verify`,`HEAD^{commit}`],{encoding:`utf8`,maxBuffer:1e5,env:{...t,GIT_CONFIG_GLOBAL:`/dev/null`,GIT_CONFIG_SYSTEM:`/dev/null`,GIT_CONFIG_NOSYSTEM:`1`,GIT_TERMINAL_PROMPT:`0`}}),i=String(n.stdout).trim();/^[0-9a-f]{40}$/i.test(i)&&(r=i.toLowerCase())}catch{}return{kind:n.isDirectory()?`directory`:`file`,...r?{commit:r}:{}}}async function Mf(e,t,n){let r=await Af(e);if(process.platform!==`linux`)throw Error(`Solve checkers require the Linux sandbox runtime (bubblewrap) with network isolation`);try{await A.access(ff,A.constants.X_OK)}catch{throw Error(`Solve checkers require /usr/bin/bwrap; install bubblewrap or run the checker in a Tangle sandbox`)}let i=await Df(t,r,await A.realpath(process.execPath)),a=await jf(r),o=(await Of(pf)).flatMap(e=>[`--ro-bind`,e,e]),s=Tf(r,i)?`/work/${E.relative(r,i)}`:Ef(i)?i:`/checker/node`;!Tf(r,i)&&!Ef(i)&&o.push(`--ro-bind`,i,`/checker/node`);let c=a?.kind===`directory`?[`--tmpfs`,`/work/.git`]:a?.kind===`file`?[`--ro-bind`,`/dev/null`,`/work/.git`]:[];return{executable:ff,args:[`--die-with-parent`,`--new-session`,`--unshare-all`,`--clearenv`,...o,`--proc`,`/proc`,`--dev`,`/dev`,`--tmpfs`,`/tmp`,`--dir`,`/tmp/home`,`--bind`,r,`/work`,...c,`--chdir`,`/work`,`--setenv`,`HOME`,`/tmp/home`,...a?.commit?[`--setenv`,`TANGLE_SOLVE_COMMIT`,a.commit]:[],`--setenv`,`TMPDIR`,`/tmp`,`--setenv`,`PATH`,`/checker:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,`--setenv`,`LANG`,`C.UTF-8`,`--setenv`,`PYTHONDONTWRITEBYTECODE`,`1`,`--setenv`,`XDG_CONFIG_HOME`,`/tmp/home/.config`,`--setenv`,`XDG_CACHE_HOME`,`/tmp/home/.cache`,`--setenv`,`XDG_DATA_HOME`,`/tmp/home/.local/share`,`--setenv`,`GIT_CONFIG_GLOBAL`,`/dev/null`,`--setenv`,`GIT_CONFIG_SYSTEM`,`/dev/null`,`--setenv`,`NPM_CONFIG_USERCONFIG`,`/dev/null`,s,...n]}}async function Nf(e,t){if(!t.command||t.command.includes(`/../`)||mf(t.command))throw Error(`The competition checker command is invalid`);if(!Array.isArray(t.args))throw Error(`The competition checker arguments must be an array`);for(let e of t.args)hf(e,`Checker argument`);let n=t.timeout_ms??15*6e4;if(!Number.isSafeInteger(n)||n<1e3||n>60*6e4)throw Error(`Checker timeout must be between one second and one hour`);let r=await Af(e),i;try{let e=await Mf(r,t.command,t.args);i=await df(e.executable,e.args,{cwd:r,timeout:n,maxBuffer:4194304,encoding:`utf8`})}catch(e){let t=e,n=t.stderr?.trim()||t.stdout?.trim()||t.message||`checker failed`;throw Error(`Pinned checker failed: ${n}`)}let a=String(i.stdout),o=String(i.stderr);return{...Cf(await wf(r,t,a)),stdout:a,stderr:o}}async function Pf(e,t){try{let{root:n,manifest:r}=await Xu(e,t.directory),i=await td(n),a=r.provenance?await nd(n,r,i,{allowMissing:!0}):void 0,o=fu(),s=I(`Running ${r.title} checker…`);t.json||s.start();let c;try{c=await Nf(n,r.checker)}finally{s.stop()}let l=od(c,a,r.provenance,void 0,{allowMissingSource:!0,requirePullRequest:!1}),u=_t(ne(32)),d=sf(c.candidateRef,u),f={version:1,competition:r.slug,candidateRef:c.candidateRef,evidence:l.evidence,evidenceJson:c.evidenceJson,evidenceRefs:l.evidenceRefs,salt:u,candidateId:d,...a?{source:a}:{},deviceAddress:o.account.address,clientSubmissionId:S(),createdAt:new Date().toISOString()};await sd(E.join(n,`.tangle-solve-run.json`),f),t.json?N({localRun:f}):(P(`Checker output recorded locally for operator evaluation`),L({Competition:r.slug,Candidate:c.candidateRef,"Device address":o.account.address,"Evidence refs":l.evidenceRefs.length}),F("Commit any changes, then run `tangle solve submit` from this directory."),r.provenance&&!a&&F(`Add your GitHub fork as 'origin' before submitting. The task repository is available as '${Ju}'.`))}catch(e){B(e)}}const Ff=/^0x[0-9a-f]{64}$/i;async function If(e){let t=await Mu({deviceAddress:e.deviceAddress,apiUrl:e.apiUrl,profile:e.profile}),n=await e.signer.signMessage({message:t.message});return{walletChallengeId:t.challengeId,walletSignature:n}}async function Lf(e,t){try{let{root:n,manifest:r}=await Xu(e,t.directory);ku({profile:t.profile});let i=await td(n),a=await cd(n);if(a.competition!==r.slug)throw Error(`.tangle-solve-run.json does not match this competition`);if(!Ff.test(a.salt)||!Ff.test(a.candidateId))throw Error("This run predates durable candidate identity. Run `tangle solve run` again");let o=r.provenance?await nd(n,r,i):void 0;if(r.provenance&&a.source&&!id(a.source,o))throw Error("The saved run points to a different repository or revision. Keep your fork as 'origin' and run `tangle solve run` again before submitting");let s=du();if(!s)throw Error("No Solve device signer found. Run `tangle solve run` first");if(s.account.address.toLowerCase()!==a.deviceAddress.toLowerCase())throw Error("The local Solve device account changed after `tangle solve run`; run the checker again");let c=I(`Checking the committed candidate…`);t.json||c.start();let l;try{l=await Nf(n,r.checker)}finally{c.stop()}if(l.candidateRef!==a.candidateRef||l.evidenceJson!==a.evidenceJson)throw Error("The committed checker output changed after `tangle solve run`; run the checker again");if(sf(l.candidateRef,a.salt).toLowerCase()!==a.candidateId.toLowerCase())throw Error(`The saved candidate identity does not match the checker output; run the checker again`);let u=Du(t.prUrl);if(!r.provenance&&u)throw Error(`This competition does not accept GitHub pull request provenance`);if(u){if(!o)throw Error(`A provenance policy is required for a pull request`);await ld({pullRequest:u,taskRepository:o.taskRepository,submissionRepository:o.submissionRepository,submissionRevision:i})}let d=od(l,o,r.provenance,u,{requirePullRequest:!0}),f={...a,...o?{source:o}:{},chainState:{status:`submitting`,transactions:{...a.chainState?.transactions??{}}}},p=E.join(n,`.tangle-solve-run.json`);await sd(p,f);let m=I(`Submitting candidate to Tempo…`);t.json||m.start();let h;try{h=await uf(Vu(r),s.account,{artifactRef:l.candidateRef,salt:a.salt,evidenceJson:l.evidenceJson,evidenceRefs:d.evidenceRefs},{resumeTransactions:f.chainState?.transactions,onTransaction:async(e,t)=>{f={...f,chainState:{status:`submitting`,transactions:{...f.chainState?.transactions??{},[e]:t}}},await sd(p,f)}})}finally{m.stop()}f={...f,chainReceipt:h,chainState:{status:`accepted`,transactions:{...f.chainState?.transactions??{},...ud(h)}}},await sd(p,f);let g=await If({deviceAddress:h.address,signer:s.account,apiUrl:t.apiUrl,profile:t.profile}),_=await ju({path:`/v1/submissions`,method:`POST`,apiUrl:t.apiUrl,profile:t.profile,body:{competition:r.slug,candidateRef:l.candidateRef,candidateId:h.candidateId,evidenceJson:l.evidenceJson,evidenceRefs:d.evidenceRefs,deviceAddress:h.address,reportTxHash:h.report,evaluationTxHash:h.evaluation,transactions:ud(h),...r.provenance&&o?{source:{...o,...u?{pullRequest:u}:{}}}:{},clientSubmissionId:a.clientSubmissionId,...g,...t.model?{model:t.model}:{},...t.note?{note:t.note}:{}}});t.json?N({..._,transactions:ud(h),candidateId:h.candidateId}):(P(`Submission accepted on Tempo`),L({Competition:r.slug,Candidate:h.candidateId,"Device address":h.address,"Report transaction":h.report,"Evaluation transaction":h.evaluation,"Submission ID":typeof _.id==`string`?_.id:_.submission?.id}))}catch(e){B(e)}}function Rf(){let e=new b(`solve`).description(`Participate in Tangle Solve competitions`);e.command(`clone <competition>`).description(`Clone the pinned competition repository`).argument(`[directory]`,`Destination directory`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(pd),e.command(`run [competition]`).description(`Run the competition checker and record its evidence`).option(`--directory <path>`,`Competition directory (defaults to the current directory)`).action(Pf),e.command(`submit [competition]`).description(`Submit checker evidence through the device account and Tempo`).option(`--directory <path>`,`Competition directory (defaults to the current directory)`).option(`--pr-url <url>`,`GitHub pull request containing the submission`).option(`--model <name>`,`Model used to produce the submission`).option(`--note <text>`,`Short note shown with the accepted submission`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(Lf),e.command(`account`).description(`Show the local Solve signing account`).option(`--create`,`Create the account if it does not exist`).action(mu);let t=e.command(`device`).description(`List and revoke the Solve devices bound to your account`);return t.command(`list`).description(`List your devices and whether each may submit jobs on Tempo`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action(e=>af(e)),t.command(`revoke <address>`).description(`Permanently revoke a device; the local device is revoked with its own key`).option(`--reason <text>`,`Why the device is revoked (shown to the account)`).option(`--yes`,`Confirm the permanent revocation without a prompt`).option(`--api-url <url>`,`Solve API base URL`).option(`--profile <name>`,`Tangle profile`,`solve`).action((e,t)=>of(e,t)),e}function zf(e,t){return`tangle ssh-proxy ${e.replace(/\/+$/,``)}/v1/sandboxes/${t}/runtime/ssh`}function Bf(e){return/^[A-Za-z0-9_/:=@%+.,-]+$/.test(e)?e:`'${e.replace(/'/g,`'"'"'`)}'`}function Vf(e){return`'${e.replace(/'/g,`''`)}'`}function Hf(e){return e===`win32`?`NUL`:`/dev/null`}function Uf(e,t){return t===`win32`?`$env:TANGLE_SSH_PROXY_AUTH_TOKEN=${Vf(`<token>`)}; ssh ${e.map(Vf).join(` `)}`:`TANGLE_SSH_PROXY_AUTH_TOKEN=${Bf(`<token>`)} ssh ${e.map(Bf).join(` `)}`}function Wf(e){return e.connection!==void 0&&!e.connection.ssh}function Gf(){At(`SSH is not enabled for this sandbox.`),F(`Create a sandbox with --ssh to enable SSH access.`),process.exit(1)}function Kf(e,t=[],n=process.platform){let r=Hf(n);return[`-o`,`ProxyCommand=${e.proxyCommand}`,`-o`,`StrictHostKeyChecking=no`,`-o`,`UserKnownHostsFile=${r}`,`-o`,`GlobalKnownHostsFile=${r}`,`-o`,`LogLevel=ERROR`,`-o`,`ServerAliveInterval=15`,`-o`,`ServerAliveCountMax=4`,`-o`,`TCPKeepAlive=yes`,`${e.username}@localhost`,`-p`,String(e.port),...t]}function qf(){return new b(`ssh`).description(`Open SSH session to a sandbox`).argument(`<ref>`,`Sandbox ID or name`).argument(`[sshArgs...]`,`Extra args passed through to ssh`).option(`-i, --identity-file <path>`,`Private key file to pass to ssh`).option(`--print`,`Print SSH command instead of connecting`).allowUnknownOption(!0).action(async(e,t,n)=>{let{context:r,client:i}=U(n),a=I(`Getting SSH credentials...`);a.start();let o=await G(i,r,e);if(Wf(o)){a.stop(),Gf();return}o=await K(o);let s=await o.ssh();if(a.stop(),!s){Gf();return}let c={...s,proxyCommand:zf(r.baseUrl,o.id)};if(!r.apiKey)throw Error(`SSH proxy requires API key auth. Set TANGLE_API_KEY or pass --api-key.`);let l=Kf(c,[...n.identityFile?[`-i`,n.identityFile,`-o`,`IdentitiesOnly=yes`]:[],...t]);if(n.print){console.log(Uf(l,process.platform));return}F(`Connecting via tunnel...`);let u=Ee(`ssh`,l,{stdio:`inherit`,env:{...process.env,TANGLE_SSH_PROXY_AUTH_TOKEN:r.apiKey}});u.on(`error`,e=>{e.code===`ENOENT`&&(At(`SSH client not found. Please install OpenSSH.`),process.exit(1)),B(e)}),u.on(`exit`,e=>{process.exit(e??0)})})}function Jf(){let e=new b(`ssh-keys`).description(`Manage SSH keys`);return e.command(`list`).description(`List SSH keys`).action(async e=>{let t=I(`Fetching SSH keys...`);try{t.start();let n=await H(V(e)).sshKeys.list();t.stop(),e.json?N({sshKeys:n}):n.length===0?F(`No SSH keys found.`):It([`Name`,`Type`,`Fingerprint`,`Created`],n.map(e=>[e.name,e.keyType,e.fingerprint,e.createdAt.toLocaleString()]))}catch(e){t.stop(),B(e)}}),e.command(`add`).description(`Add SSH key`).argument(`<name>`,`SSH key name`).requiredOption(`--key-file <path>`,`Public key file path`).action(async(e,t)=>{let n=I(`Adding SSH key...`);try{let r=fe(t.keyFile,`utf8`).trim();n.start();let i=await H(V(t)).sshKeys.create(e,r);n.stop(),t.json?N({sshKey:i}):P(`Added SSH key ${i.name} (${i.fingerprint})`)}catch(e){n.stop(),B(e)}}),e.command(`delete`).description(`Delete SSH key`).argument(`<name>`,`SSH key name or ID`).action(async(e,t)=>{let n=I(`Deleting SSH key...`);try{n.start(),await H(V(t)).sshKeys.delete(e),n.stop(),P(`Deleted SSH key ${e}`)}catch(e){n.stop(),B(e)}}),e}function Yf(e,t=1){process.stderr.write(`${e}\n`),process.exit(t)}function Xf(){return new b(`ssh-proxy`).description(`SSH proxy helper that pipes stdin/stdout to WebSocket`).argument(`<runtime-url>`,`Runtime WebSocket URL`).action(async e=>{let t=process.env.TANGLE_SSH_PROXY_AUTH_TOKEN;t||Yf(`TANGLE_SSH_PROXY_AUTH_TOKEN not set`);let n=new xt(new URL(e.replace(/^http/,`ws`)),{headers:{Authorization:`Bearer ${t}`},perMessageDeflate:!1}),r;function i(){r&&=(clearInterval(r),void 0)}n.on(`open`,()=>{r=setInterval(()=>{n.readyState===xt.OPEN&&n.ping()},15e3),r.unref?.(),process.stdin.on(`data`,e=>{n.readyState===xt.OPEN&&n.send(e,{binary:!0,compress:!1})}),process.stdin.on(`end`,()=>n.close(1e3))}),n.on(`message`,e=>{let t=Buffer.isBuffer(e)?e:Array.isArray(e)?Buffer.concat(e):Buffer.from(e);process.stdout.write(t)}),n.on(`error`,e=>{i(),Yf(`WebSocket error: ${e.message}`)}),n.on(`close`,e=>{i(),process.exit(e===1e3?0:1)}),process.stdin.on(`error`,()=>n.close())})}function Zf(){let e=new b(`team`).description(`Manage teams`);return $(e,`list`).description(`List teams for the current account`).action(async e=>{let t=V(e),n=H(t),r=e.json?null:I(`Fetching teams...`);r?.start();let i=await n.teams.list();if(r?.stop(),e.json){N({teams:i,activeTeamId:t.activeTeamId??null});return}M(i.map(e=>({active:e.id===t.activeTeamId,id:e.id,name:e.name,role:e.currentUserRole,members:e.memberCount})),[{key:`active`,header:`Active`,width:8},{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:24},{key:`role`,header:`Role`,width:10},{key:`members`,header:`Members`,width:10}])}),$(e,`create <name>`).description(`Create a team`).option(`--org-id <id>`,`External organization id`).option(`--no-switch`,`Do not set the new team as active`).action(async(e,t)=>{let n=V(t),r=H(n),i=t.json?null:I(`Creating team...`);i?.start();let a=await r.teams.create({name:e,orgId:t.orgId});if(t.switch&&Kl(a,n.profile),i?.stop(),t.json){N({team:a,active:!!t.switch});return}P(`Team created: ${Wl(a)}`),t.switch&&P(`Active team set to ${a.name}`)}),$(e,`switch <team>`).description(`Set the active team for the current profile`).action(async(e,t)=>{let n=V(t),r=await Gl(H(n),e);if(Kl(r,n.profile),t.json){N({team:r,activeTeamId:r.id});return}P(`Active team set to ${Wl(r)}`)}),e.command(`current`).description(`Show the active team for the current profile`).option(`--profile <profile>`,`Credential profile`).action(e=>{let t=lr(e.profile);if(e.json){N(t.activeTeamId?t:{activeTeamId:null});return}if(!t.activeTeamId){console.log(`No active team.`);return}L({ID:t.activeTeamId,Name:t.activeTeamName})}),e.command(`clear`).description(`Clear the active team for the current profile`).option(`--profile <profile>`,`Credential profile`).action(e=>{if(ql(e.profile),e.json){N({activeTeamId:null});return}P(`Active team cleared.`)}),$(e,`members [team]`).description(`List team members`).action(async(e,t)=>{let n=V(t),r=H(n),i=await Z(r,e,n.profile),a=await r.teams.listMembers(i.id);if(t.json){N({team:i,members:a});return}M(a,[{key:`id`,header:`ID`,width:36},{key:`customerEmail`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:10},{key:`joinedAt`,header:`Joined`,width:16}])}),$(e,`update-member <member-id>`).description(`Update a team member role`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).requiredOption(`--role <role>`,`Role: admin, member, viewer`).action(async(e,t)=>{let n=V(t),r=H(n),i=await Z(r,t.team,n.profile),a=Qf(t.role),o=await r.teams.updateMember(i.id,e,{role:a});if(t.json){N({team:i,member:o});return}P(`Member updated: ${o.customerEmail}`),L({Team:i.name,Role:o.role,Status:o.status})}),$(e,`invite <email>`).description(`Invite a user to a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--role <role>`,`Role: admin, member, viewer`,`member`).option(`--ttl-hours <hours>`,`Invitation lifetime in hours`).action(async(e,t)=>{let n=V(t),r=H(n),i=await Z(r,t.team,n.profile),a=Qf(t.role),o=await r.teams.invite(i.id,{email:e,role:a,ttlHours:t.ttlHours?Number.parseInt(t.ttlHours,10):void 0});if(t.json){N({team:i,invitation:o});return}P(`Invitation created for ${o.email}`),L({Team:i.name,Role:o.role,Expires:o.expiresAt,"Invitation ID":o.id}),P(`Re-run with --json to retrieve the invitation token for sharing.`)}),$(e,`leave [team]`).description(`Leave a team as the current user`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=V(t),r=H(n),i=await Z(r,e,n.profile);if(!(!t.force&&!t.json&&!await Yr(`Leave team '${i.name}'? (y/N) `,`--force`))){if(await r.teams.leave(i.id),n.activeTeamId===i.id&&ql(n.profile),t.json){N({success:!0,teamId:i.id});return}P(`Left team: ${i.name}`)}}),$(e,`transfer <new-owner-customer-id> [team]`).description(`Transfer team ownership to another active member`).option(`--force`,`Skip confirmation prompt`).action(async(e,t,n)=>{let r=V(n),i=H(r),a=await Z(i,t,r.profile);if(!(!n.force&&!n.json&&!await Yr(`Transfer ownership of '${a.name}' to ${e}? This cannot be undone without the new owner's cooperation. (y/N) `,`--force`))){if(await i.teams.transferOwnership(a.id,e),n.json){N({success:!0,teamId:a.id,newOwnerCustomerId:e});return}P(`Ownership transferred for ${a.name}`)}}),e.addCommand($f()),e.addCommand(ep()),$(e,`invitations [team]`).description(`List pending and historical team invitations`).action(async(e,t)=>{let n=V(t),r=H(n),i=await Z(r,e,n.profile),a=await r.teams.listInvitations(i.id);if(t.json){N({team:i,invitations:a});return}M(a,[{key:`id`,header:`ID`,width:38},{key:`email`,header:`Email`,width:28},{key:`role`,header:`Role`,width:10},{key:`status`,header:`Status`,width:12},{key:`expiresAt`,header:`Expires`,width:16}])}),$(e,`accept <token>`).description(`Accept a team invitation`).option(`--no-switch`,`Do not set the accepted team as active`).action(async(e,t)=>{let n=V(t),r=H(n),i=await r.teams.acceptInvitation(e),a=t.switch===!1?null:await r.teams.get(i.teamId);if(a&&Kl(a,n.profile),t.json){N({member:i,activeTeamId:a?.id??null});return}P(`Invitation accepted for team ${i.teamId}`),a&&P(`Active team set to ${a.name}`)}),$(e,`revoke-invitation <invitation-id>`).description(`Revoke a pending team invitation`).action(async(e,t)=>{if(await H(V(t)).teams.revokeInvitation(e),t.json){N({success:!0,invitationId:e});return}P(`Invitation revoked: ${e}`)}),$(e,`remove-member <member-id>`).description(`Remove a member from a team`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).action(async(e,t)=>{let n=V(t),r=H(n),i=await Z(r,t.team,n.profile);if(await r.teams.removeMember(i.id,e),t.json){N({success:!0,teamId:i.id,memberId:e});return}P(`Member removed: ${e}`)}),e}function Qf(e){if(e===`admin`||e===`member`||e===`viewer`)return e;throw Error(`Role must be one of: admin, member, viewer`)}function $f(){let e=new b(`secret`).description(`Manage team secrets`);return $(e,`list [team]`).description(`List team secret names`).action(async(e,t)=>{let n=V(t),r=H(n),i=await Z(r,e,n.profile),a=await r.teams.listSecrets(i.id);if(t.json){N({team:i,secrets:a});return}M(a,[{key:`name`,header:`Name`,width:28},{key:`updatedAt`,header:`Updated`,width:24},{key:`updatedBy`,header:`Updated By`,width:28}])}),$(e,`set <name> [value]`).description(`Create or replace a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--value-stdin`,`Read secret value from stdin`).action(async(e,t,n)=>{let r=V(n),i=H(r),a=await Z(i,n.team,r.profile),o=await iu({value:t,valueStdin:n.valueStdin,prompt:`Enter value for team secret '${e}': `}),s=await i.teams.upsertSecret(a.id,e,o);if(n.json){N({team:a,secret:s});return}P(`Team secret saved: ${s.name}`)}),$(e,`delete <name>`).description(`Delete a team secret`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=V(t),r=H(n),i=await Z(r,t.team,n.profile);if(!(!t.force&&!t.json&&!await Yr(`Delete team secret '${e}' from '${i.name}'? (y/N) `,`--force`))){if(await r.teams.deleteSecret(i.id,e),t.json){N({success:!0,teamId:i.id,name:e});return}P(`Team secret deleted: ${e}`)}}),$(e,`reveal <name>`).description(`Reveal a team secret value`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).action(async(e,t)=>{let n=V(t),r=H(n),i=await Z(r,t.team,n.profile),a=await r.teams.revealSecret(i.id,e);if(t.json){N({teamId:i.id,...a});return}console.log(a.value)}),e}function ep(){let e=new b(`templates`).description(`Manage team golden-path templates`);return $(e,`list [team]`).description(`List a team's golden-path templates`).action(async(e,t)=>{let n=V(t),r=H(n),i=await Z(r,e,n.profile),a=await r.teams.listTemplates(i.id);if(t.json){N({team:i,templates:a});return}if(a.length===0){console.log(`No templates yet for ${i.name}.`);return}M(a.map(e=>({id:e.id,name:e.name,environment:e.environment,snapshot:`${e.snapshotId.slice(0,12)}…`,updated:e.updatedAt})),[{key:`id`,header:`ID`,width:38},{key:`name`,header:`Name`,width:28},{key:`environment`,header:`Env`,width:14},{key:`snapshot`,header:`Snapshot`,width:16},{key:`updated`,header:`Updated`,width:24}])}),$(e,`create <name> <snapshot-id>`).description(`Create a golden-path template from a snapshot`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`-d, --description <description>`,`Human-readable description shown in the dashboard`).option(`-e, --environment <environment>`,`Default environment to apply (defaults to 'universal')`).option(`--config <json>`,`Optional JSON config object merged into sandboxes created from this template`).action(async(e,t,n)=>{let r=V(n),i=H(r),a=await Z(i,n.team,r.profile),o;if(n.config)try{let e=JSON.parse(n.config);if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`--config must be a JSON object`);o=e}catch(e){throw Error(`--config is not valid JSON: ${e instanceof Error?e.message:String(e)}`)}let s=await i.teams.createTemplate(a.id,{name:e,snapshotId:t,description:n.description,environment:n.environment,config:o});if(n.json){N({team:a,template:s});return}P(`Team template created: ${s.name} (${s.id})`)}),$(e,`delete <template-id>`).description(`Delete a team golden-path template`).option(`-t, --team <team>`,`Team id or name (defaults to active team)`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{let n=V(t),r=H(n),i=await Z(r,t.team,n.profile);if(!(!t.force&&!t.json&&!await Yr(`Delete template '${e}' from '${i.name}'? (y/N) `,`--force`))){if(await r.teams.deleteTemplate(i.id,e),t.json){N({success:!0,teamId:i.id,templateId:e});return}P(`Team template deleted: ${e}`)}}),e}function $(e,t){return e.command(t).option(`--profile <profile>`,`Credential profile`)}async function tp(e,t,n){let r=new AbortController,i=()=>r.abort();try{let n=H(V({...e,timeout:void 0}));process.once(`SIGINT`,i),process.once(`SIGTERM`,i);let a=await t(n,{...e.timeout===void 0?{}:{timeoutMs:Number(e.timeout)*1e3},resumeJobId:e.resumeJob,signal:r.signal,onProgress:e=>{process.stderr.write(`Publication ${e.id}: ${e.status}\n`)}}).finally(()=>{process.off(`SIGINT`,i),process.off(`SIGTERM`,i)});e.json?N(a):P(`template`in a?`Published template: ${a.template.slug}`:`Published template version: ${a.version.id}`)}catch(t){if(t instanceof s&&t.status!==401&&t.job&&[`pending`,`scanning`,`ready`].includes(t.job.status)){let e=[`tangle`,`template`,...n,`--resume-job`,t.job.id].map(Ve).join(` `);Object.assign(t,{fix:{command:e}})}B(t,e.json)}}function np(){let e=new b(`template`).description(`Manage published public templates`);return e.command(`list`).option(`-q, --query <query>`,`Search query`).option(`--tag <tag>`,`Filter by tag`).option(`--featured`,`Show featured templates only`).action(async e=>{let t=H(V(e)),n=e.featured?await t.publicTemplates.featured():await t.publicTemplates.list({query:e.query,tag:e.tag});if(e.json){N({templates:n});return}M(n,[{key:`slug`,header:`Slug`,width:28},{key:`name`,header:`Name`,width:28},{key:`forkCount`,header:`Forks`,width:8},{key:`sandboxCount`,header:`Sandboxes`,width:12},{key:`updatedAt`,header:`Updated`,width:24}])}),e.command(`get <id-or-slug>`).action(async(e,t)=>{let n=await H(V(t)).publicTemplates.get(e);if(t.json){N({template:n});return}N(n)}),e.command(`versions <id-or-slug>`).action(async(e,t)=>{let n=await H(V(t)).publicTemplates.versions(e);if(t.json){N({versions:n});return}M(n.map(e=>({...e})),[{key:`id`,header:`Version ID`,width:38},{key:`versionNumber`,header:`Version`,width:8},{key:`snapshotId`,header:`Snapshot`,width:20},{key:`createdAt`,header:`Created`,width:24}])}),e.command(`publish <name> <snapshot-id> <sandbox-id>`).option(`--timeout <seconds>`,`Maximum wait for publication`).option(`--resume-job <id>`,`Resume an accepted publication for this snapshot`).option(`--slug <slug>`,`Stable public slug`).option(`-d, --description <description>`,`Template description`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).option(`--team-id <id>`,`Publish under a team`).option(`--forked-from <id>`,`Fork source template id`).action((e,t,n,r)=>tp(r,async(i,a)=>({template:await i.publicTemplates.publish({name:e,slug:r.slug,description:r.description,snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes,teamId:r.teamId,forkedFromTemplateId:r.forkedFrom},a)}),[`publish`,e,t,n])),e.command(`publish-version <id-or-slug> <snapshot-id> <sandbox-id>`).option(`--timeout <seconds>`,`Maximum wait for publication`).option(`--resume-job <id>`,`Resume an accepted publication for this snapshot`).option(`--readme <markdown>`,`README markdown`).option(`--tags <tags...>`,`Template tags`).option(`--release-notes <text>`,`Release notes`).action((e,t,n,r)=>tp(r,async(i,a)=>({version:await i.publicTemplates.publishVersion(e,{snapshotId:t,sourceSandboxId:n,readmeMarkdown:r.readme,tags:r.tags,releaseNotes:r.releaseNotes},a)}),[`publish-version`,e,t,n])),e}function rp(){let e=new b(`traces`).description(`Read hosted agent traces, spans, and eval-runs from Tangle Intelligence`);return e.command(`list`).description(`List trace summaries (one row per trace), newest first`).option(`--from <iso>`,`ISO-8601 lower bound on received time (inclusive)`).option(`--to <iso>`,`ISO-8601 upper bound on received time (inclusive)`).option(`--model <model>`,`Exact model match (any span carried this model)`).option(`--run <runId>`,`Exact run id match`).option(`--status <status>`,`ERROR | OK`).option(`-q, --query <text>`,`Substring over span name`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size (clamped server-side to [1, 200])`).action(async e=>{try{let t={from:e.from,to:e.to,model:e.model,runId:e.run,status:e.status===void 0?void 0:mp(e.status),q:e.query,cursor:e.cursor,limit:e.limit===void 0?void 0:yp(e.limit)},n=ap(e),r=e.json?null:I(`Fetching traces...`);r?.start();let i=await n.listTraces(t);if(r?.stop(),e.json)return N(i);cp(i.items),fp(i.nextCursor)}catch(t){sp(t,e)}}),e.command(`get <traceId>`).description(`Show one trace's spans. Streams NDJSON to stdout with --ndjson.`).option(`--ndjson`,`Stream the full span set as NDJSON to stdout`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Spans per page`).action(async(e,t)=>{try{let n=ap(t);if(t.ndjson){await op(n,e);return}let r=t.json?null:I(`Fetching trace spans...`);r?.start();let i=await n.getTraceSpans(e,{cursor:t.cursor,limit:t.limit===void 0?void 0:yp(t.limit)});if(r?.stop(),t.json)return N(i);lp(i.items),i.truncated&&L({Spans:`${i.items.length} of ${i.total} (truncated)`}),fp(i.nextCursor)}catch(e){sp(e,t)}}),e.addCommand(ip()),e}function ip(){let e=new b(`runs`).description(`Read eval-runs pivoted off the trace surface`);return e.command(`list`).description(`List eval-runs, newest first`).option(`--status <status>`,`Run status filter`).option(`--gate <decision>`,`Promotion-gate decision filter`).option(`--label <key:value>`,`Match over the run's labels`).option(`--from <iso>`,`ISO-8601 lower bound on received time`).option(`--to <iso>`,`ISO-8601 upper bound on received time`).option(`-q, --query <text>`,`Substring over run dir`).option(`--cursor <cursor>`,`Opaque pagination cursor from a prior page`).option(`--limit <count>`,`Page size`).action(async e=>{try{let t={status:e.status===void 0?void 0:gp(e.status),gate:e.gate===void 0?void 0:vp(e.gate),label:e.label,from:e.from,to:e.to,q:e.query,cursor:e.cursor,limit:e.limit===void 0?void 0:yp(e.limit)},n=ap(e),r=e.json?null:I(`Fetching runs...`);r?.start();let i=await n.listRuns(t);if(r?.stop(),e.json)return N(i);up(i.items),fp(i.nextCursor)}catch(t){sp(t,e)}}),e.command(`get <runId>`).description(`Show a single eval-run`).action(async(e,t)=>{try{let n=ap(t),r=t.json?null:I(`Fetching run...`);r?.start();let i=await n.getRun(e);if(r?.stop(),t.json)return N(i);dp(i)}catch(e){sp(e,t)}}),e}function ap(e){let t=$n(e.apiKey);if(!t)throw Error(`No API key found. Set TANGLE_API_KEY or run: tangle auth login`);return St({apiKey:t,baseUrl:e.baseUrl??process.env.TANGLE_INTELLIGENCE_BASE_URL})}async function op(e,t){let n=(await e.exportTraceSpansNdjson(t)).getReader();try{for(;;){let{value:e,done:t}=await n.read();if(t)break;e&&process.stdout.write(Buffer.from(e))}}finally{n.releaseLock()}}function sp(e,t){return B(e,t.json===!0)}function cp(e){M(e.map(e=>({traceId:e.traceId,root:e.rootName??`-`,model:e.model??`-`,spans:e.spanCount,errors:e.errorCount,durationMs:e.durationMs,cost:pp(e.costUsd)})),[{key:`traceId`,header:`Trace`,width:36},{key:`root`,header:`Root`,width:24},{key:`model`,header:`Model`,width:22},{key:`spans`,header:`Spans`,width:8},{key:`errors`,header:`Errors`,width:8},{key:`durationMs`,header:`Duration(ms)`,width:14},{key:`cost`,header:`Cost`,width:10}])}function lp(e){M(e.map(e=>({spanId:e.id,name:e.name,model:e.model??`-`,status:e.statusCode??`-`,cost:e.costUsd===null?`-`:`$${e.costUsd}`})),[{key:`spanId`,header:`Span`,width:40},{key:`name`,header:`Name`,width:28},{key:`model`,header:`Model`,width:22},{key:`status`,header:`Status`,width:10},{key:`cost`,header:`Cost`,width:12}])}function up(e){M(e.map(e=>({runId:e.id,status:e.status,gate:e.gateDecision??`-`,cost:e.totalCostUsd===null?`-`:`$${e.totalCostUsd}`,receivedAt:e.receivedAt})),[{key:`runId`,header:`Run`,width:24},{key:`status`,header:`Status`,width:22},{key:`gate`,header:`Gate`,width:18},{key:`cost`,header:`Cost`,width:12},{key:`receivedAt`,header:`Received`,width:18}])}function dp(e){L({Run:e.id,Status:e.status,Gate:e.gateDecision??void 0,"Run Dir":e.runDir??void 0,Cost:e.totalCostUsd===null?void 0:`$${e.totalCostUsd}`,Duration:e.totalDurationMs===null?void 0:`${e.totalDurationMs}ms`,"Holdout Lift":e.holdoutLift??void 0,Received:e.receivedAt})}function fp(e){e&&L({"Next page":`--cursor ${e}`})}function pp(e){return e===null?`-`:`$${e.toFixed(4)}`}function mp(e){if(e===`ERROR`||e===`OK`)return e;throw Error(`--status must be ERROR or OK`)}const hp=[`started`,`baseline-complete`,`generation-complete`,`gate-decided`,`finished`,`errored`];function gp(e){let t=hp.find(t=>t===e);if(t)return t;throw Error(`--status must be one of ${hp.join(`, `)}`)}const _p=[`ship`,`hold`,`need_more_work`,`model_ceiling`,`arch_ceiling`];function vp(e){let t=_p.find(t=>t===e);if(t)return t;throw Error(`--gate must be one of ${_p.join(`, `)}`)}function yp(e){let t=Number(e);if(!Number.isInteger(t)||t<1)throw Error(`--limit must be a positive integer`);return t}function bp(){return new b(`usage`).description(`Show account usage and billing information`).action(async e=>{let{client:t}=U(e),n=e.json?null:I(`Fetching usage...`);n?.start();let[r,i]=await Promise.all([t.usage(),t.subscription().catch(()=>null)]);n?.stop(),e.json?N({...r,subscription:i}):(console.log(),console.log(`Account Usage`),console.log(`─`.repeat(40)),L({"Active Sandboxes":r.activeSandboxes,"Total Sandboxes":r.totalSandboxes,"Compute Minutes":xp(r.computeMinutes),"GPU Seconds":r.gpuSeconds,"GPU Spend":Sp(r.gpuCostUsd)}),i&&(console.log(),console.log(`Subscription`),console.log(`─`.repeat(40)),L({Plan:i.plan,Status:i.status,"Credits Available":Sp(i.creditsAvailableUsd),"Credits Used":Sp(i.creditsUsedUsd),"Monthly Balance":Sp(i.monthlyBalanceUsd)})),console.log(),console.log(`Billing Period`),console.log(`─`.repeat(40)),L({Start:r.periodStart.toLocaleDateString(),End:r.periodEnd.toLocaleDateString()}),console.log())})}function xp(e){if(e===void 0)return`-`;if(e<60)return`${e} min`;let t=Math.floor(e/60),n=e%60;return n===0?`${t} hr`:`${t} hr ${n} min`}function Sp(e){return e<0?`-$${(-e).toFixed(2)}`:`$${e.toFixed(2)}`}function Cp(){return new b(`use`).description(`Set or show the active sandbox (used when a command omits the id)`).argument(`[id]`,`Sandbox id to make active`).option(`--clear`,`Clear the active sandbox`).action((e,t)=>{if(t.clear){Gn(),F(`Cleared the active sandbox.`);return}if(e){Wn(e),F(`Active sandbox set to ${e}. Commands now default to it; override with --box or TANGLE_SANDBOX.`);return}let n=Un();F(n?`Active sandbox: ${n}`:"No active sandbox. Set one with `tangle use <id>`.")})}function wp(e){M(e,[{key:`id`,header:`ID`},{key:`nodeId`,header:`Node`},{key:`name`,header:`Name`},{key:`contentType`,header:`Content Type`},{key:`byteSize`,header:`Bytes`},{key:`createdAt`,header:`Created`}])}function Tp(e){e.command(`artifacts`).description(`List a run's artifact metadata (never the bytes)`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).action(async(e,t,n)=>{let r=await(await Y(n)).workflows.listArtifacts(e,t);if(n.json)return N(r);wp(r.artifacts)}),e.command(`artifact-download`).description(`Download one run artifact's bytes to a file`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).argument(`<artifactId>`,`Artifact ID`).option(`--out <file>`,`Destination file (defaults to the artifact ID)`).action(async(e,t,n,r)=>{let i=await(await Y(r)).workflows.downloadArtifact(e,t,n),a=r.out??n;try{me(a,i.bytes)}catch(e){throw Error(`Could not write artifact to "${a}": ${e instanceof Error?e.message:String(e)}`)}if(r.json)return N({file:a,contentType:i.contentType,bytes:i.bytes.length});F(`Wrote ${a} (${i.bytes.length} bytes, ${i.contentType}).`)})}function Ep(e){M(e.map(e=>({id:e.id,run:e.runId,title:e.title,options:e.options.join(`, `),requested:e.requestedAt,expires:e.expiresAt??``})),[{key:`id`,header:`ID`},{key:`run`,header:`Run`},{key:`title`,header:`Title`},{key:`options`,header:`Options`},{key:`requested`,header:`Requested`},{key:`expires`,header:`Expires`}])}function Dp(e){e.command(`decisions`).description(`List a workflow's pending human decisions`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{let n=(await(await Y(t)).workflows.listPendingDecisions()).decisions.filter(t=>t.workflowId===e);if(t.json)return N({decisions:n});Ep(n)}),e.command(`decision-resolve`).description(`Answer the decision a run is parked on and resume it`).argument(`<id>`,`Workflow ID`).argument(`<runId>`,`Run ID`).requiredOption(`--choice <choice>`,`The option to resolve with (one of the decision's options)`).action(async(e,t,n)=>{let r=await Y(n),i=await r.workflows.getRunDecision(e,t),a=await r.workflows.resolveRunDecision(e,t,{decisionId:i.id,choice:n.choice});if(n.json)return N(a);if(a.resumed){F(`Resolved decision ${a.decisionId} with "${a.choice}" — run ${a.runId} resumed.`);return}F(`Resolved decision ${a.decisionId} with "${a.choice}", but run ${a.runId} had already finished — nothing to resume.`)})}function Op(e){try{return fe(e,`utf8`)}catch(t){throw Error(`Could not read workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function kp(e){M(e.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,issues:e.validationErrors.length,updated:e.updatedAt})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`issues`,header:`Issues`},{key:`updated`,header:`Updated`}])}function Ap(e){let t=e.workflows.filter(e=>e.failed>0).length,n=e.workflows.filter(e=>e.failed===0&&e.waiting>0).length,r=e.workflows.filter(e=>e.failed===0&&e.waiting===0&&e.runsInWindow>0).length;F(`${t} failing · ${n} waiting · ${r} healthy · ${e.workflows.length} total over ${e.window}`),M(e.workflows.map(e=>({id:e.id,name:e.name,enabled:e.enabled?`yes`:`no`,runs:e.runsInWindow,failed:e.failed,waiting:e.waiting,success:e.successRate===null?`—`:`${Math.round(e.successRate*100)}%`,lastRun:e.lastRunStatus??`—`,lastRunAt:e.lastRunAt??`—`})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`enabled`,header:`Enabled`},{key:`runs`,header:`Runs`},{key:`failed`,header:`Failed`},{key:`waiting`,header:`Waiting`},{key:`success`,header:`Success`},{key:`lastRun`,header:`Last Run`},{key:`lastRunAt`,header:`Last Run At`}])}function jp(e){if(L({ID:e.id,Name:e.name,Description:e.description??``,Enabled:e.enabled?`yes`:`no`,Actions:e.actions.length}),e.triggers&&e.triggers.length>0&&(F(`Triggers`),Mp(e.triggers)),e.validationErrors.length>0){F(`Validation issues`);for(let t of e.validationErrors)console.log(` ${t.path}: ${t.message}`)}}function Mp(e){M(e.map(e=>({id:e.id,kind:e.kind,enabled:e.enabled?`yes`:`no`,detail:e.kind===`schedule`?`${e.cron??``} (${e.timezone??``})`:`${e.provider??``}:${e.eventFilter?.event??``}${e.eventFilter?.action?`.${e.eventFilter.action}`:``}`})),[{key:`id`,header:`ID`},{key:`kind`,header:`Kind`},{key:`enabled`,header:`Enabled`},{key:`detail`,header:`Detail`}])}function Np(e){e.command(`list`).description(`List your workflows`).action(async e=>{let t=await(await Y(e)).workflows.list();if(e.json)return N(t);kp(t)}),e.command(`fleet`).description(`Fleet overview: every workflow's run tallies over a trailing window, failing-first`).option(`--window <window>`,`Trailing window: 24h, 7d, or 30d`,`7d`).action(async e=>{let t=await(await Y(e)).workflows.fleetInsights({window:e.window});if(e.json)return N(t);Ap(t)}),e.command(`get`).description(`Show a workflow's definition and compiled triggers`).argument(`<id>`,`Workflow ID`).option(`--yaml`,`Print only the raw definition YAML (the export path — pipe to a file)`).action(async(e,t)=>{let n=await(await Y(t)).workflows.get(e);if(t.yaml){if(n.definitionYaml===null)throw Error(`Workflow ${n.id} has no stored definition YAML to export`);process.stdout.write(n.definitionYaml.endsWith(`
|
|
154
|
+
`)?n.definitionYaml:`${n.definitionYaml}\n`);return}if(t.json)return N(n);jp(n)}),e.command(`create`).description(`Create a workflow from a YAML file`).argument(`<file>`,`Path to the workflow YAML`).action(async(e,t)=>{let n=Op(e),r=await(await Y(t)).workflows.create(n);if(t.json)return N(r);F(`Created workflow ${r.id} (${r.name}).`),jp(r)}),e.command(`apply`).description(`Create or update a workflow idempotently, matched by the definition's name`).argument(`<file>`,`Path to the workflow YAML`).action(async(e,t)=>{let n=Op(e),r=await Y(t),i=await r.workflows.validate(n,{structural:!0});if(!i.valid){if(process.exitCode=1,t.json)return N(i);F(`Invalid workflow:`);for(let e of i.errors)console.log(` ${e.path}: ${e.message}`);return}let a=(await r.workflows.list()).find(e=>e.name===i.name);if(a){let e=await r.workflows.update(a.id,n);if(t.json)return N({action:`updated`,workflow:e});F(`Updated workflow ${e.id} (${e.name}) — matched by name.`),jp(e);return}let o=await r.workflows.create(n);if(t.json)return N({action:`created`,workflow:o});F(`Created workflow ${o.id} (${o.name}).`),jp(o)}),e.command(`update`).description(`Replace a workflow's definition from a YAML file`).argument(`<id>`,`Workflow ID`).argument(`<file>`,`Path to the workflow YAML`).option(`--note <note>`,`Revision note recorded on the appended revision (why this change)`).action(async(e,t,n)=>{let r=Op(t),i=await(await Y(n)).workflows.update(e,r,{...n.note===void 0?{}:{note:n.note}});if(n.json)return N(i);F(`Updated workflow ${i.id} (${i.name}).`),jp(i)}),e.command(`delete`).description(`Delete a workflow and its triggers`).argument(`<id>`,`Workflow ID`).option(`--force`,`Skip confirmation prompt`).action(async(e,t)=>{if(!t.force&&!await Yr(`Delete workflow ${e}? `,`--force`)){F(`Delete cancelled.`);return}if(await(await Y(t)).workflows.delete(e),t.json)return N({deleted:!0,id:e});F(`Deleted workflow ${e}.`)}),e.command(`validate`).description(`Validate a workflow YAML file without saving it`).argument(`<file>`,`Path to the workflow YAML`).option(`--structural`,`CI mode: compile + capability checks only, no connection resolution — the verdict is the same regardless of connected providers`).action(async(e,t)=>{let n=Op(e),r=await(await Y(t)).workflows.validate(n,{...t.structural?{structural:!0}:{}});if(t.json)return N(r);if(r.valid)F(`Valid: ${r.name} (${r.actionCount} action(s), ${r.triggerCount} trigger(s)).`);else{F(`Invalid workflow:`);for(let e of r.errors)console.log(` ${e.path}: ${e.message}`);process.exitCode=1}}),e.command(`schema`).description(`Print the JSON Schema for the workflow YAML`).action(async e=>{N(await(await Y(e)).workflows.schema())})}async function Pp(e,t,n){let r=await(await Y(n)).workflows.setEnabled(e,t);if(n.json)return N(r);F(`${t?`Enabled`:`Disabled`} workflow ${r.id}.`),jp(r)}function Fp(e,t){try{return JSON.parse(e)}catch{throw Error(`Invalid ${t}: not valid JSON`)}}function Ip(e,t){try{me(e,t,`utf8`)}catch(t){throw Error(`Could not write workflow file "${e}": ${t instanceof Error?t.message:String(t)}`)}}function Lp(e){M(e.map(e=>({id:e.id,name:e.name,category:e.category,providers:e.providers.join(`, `),summary:e.summary})),[{key:`id`,header:`ID`},{key:`name`,header:`Name`},{key:`category`,header:`Category`},{key:`providers`,header:`Providers`},{key:`summary`,header:`Summary`}])}function Rp(e,t){let n=e.kind===`github_app`,r=n?`${e.provider} (App installation)`:e.provider,i=e.connectUrl?` — ${n?`install`:`connect`}: ${e.connectUrl}`:``,a=e.prerequisite;return`${r}${i}${a&&t.some(e=>e.provider===a.provider&&e.kind===a.kind&&!e.connected)?` (after connecting ${a.provider})`:``}`}function zp(e){e.command(`enable`).description(`Enable a workflow so its triggers and manual runs fire`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{await Pp(e,!0,t)}),e.command(`disable`).description(`Disable a workflow (pause its triggers and manual runs)`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{await Pp(e,!1,t)}),e.command(`templates`).description(`List the curated starter workflow templates`).action(async e=>{let t=await(await Y(e)).workflows.listTemplates();if(e.json)return N(t);Lp(t)}),e.command(`init`).description(`Create a workflow from a gallery template and print (or save) its YAML`).argument(`<template-id>`,"Template ID from `workflows templates`").option(`--param <key=value>`,`Template parameter value. Repeatable.`,bc,[]).option(`--file <out>`,`Write the instantiated workflow YAML to this file instead of stdout`).action(async(e,t)=>{let n=xc(t.param,`param`)??{},r=await(await Y(t)).workflows.instantiateTemplate(e,n);if(t.json)return N(r);if(!r.created){F(`Template ${e} needs provider connections before it can run:`);for(let e of r.connectionRequirements)console.log(` ${e.connected?`✓`:`✗`} ${Rp(e,r.connectionRequirements)}`);process.exitCode=1;return}let{workflow:i}=r;if(i.definitionYaml===null)throw Error(`Workflow ${i.id} was created but the server returned no definition YAML`);if(F(`Created workflow ${i.id} (${i.name}).`),t.file){Ip(t.file,i.definitionYaml),F(`Wrote ${t.file}.`);return}process.stdout.write(i.definitionYaml.endsWith(`
|
|
155
|
+
`)?i.definitionYaml:`${i.definitionYaml}\n`)})}function Bp(e){M(e,[{key:`key`,header:`Key`},{key:`version`,header:`Version`},{key:`updatedAt`,header:`Updated`}])}function Vp(e){L({Key:e.key,Version:e.version,Updated:e.updatedAt}),F(`Value`),N(e.value)}function Hp(e){let t=e.command(`kv`).description(`Read and write a workflow's cross-run KV state`);t.command(`list`).description(`List every KV entry of a workflow`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{let n=await(await Y(t)).workflows.listKv(e);if(t.json)return N(n);Bp(n.entries)}),t.command(`get`).description(`Show one KV entry (value and version)`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).action(async(e,t,n)=>{let r=await(await Y(n)).workflows.getKv(e,t);if(n.json)return N(r);Vp(r)}),t.command(`set`).description(`Write a KV entry from a JSON value`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).argument(`<json>`,`Value as JSON (e.g. '{"cursor":123}' or '"abc"')`).option(`--cas <version>`,`Compare-and-swap: write only if the stored version still equals this`).action(async(e,t,n,r)=>{let i=Fp(n,`<json>`),a=r.cas===void 0?void 0:Qa(r.cas,`--cas`),o=await Y(r),s=a===void 0?await o.workflows.putKv(e,t,i):await o.workflows.casKv(e,t,a,i);if(r.json)return N(s);Vp(s)}),t.command(`delete`).description(`Delete a KV entry (idempotent)`).argument(`<id>`,`Workflow ID`).argument(`<key>`,`KV key`).action(async(e,t,n)=>{let r=await(await Y(n)).workflows.deleteKv(e,t);if(n.json)return N(r);F(r.deleted?`Deleted KV entry "${t}" of workflow ${e}.`:`No KV entry "${t}" on workflow ${e}.`)})}function Up(e){M(e.map(e=>({rev:e.rev,created:e.createdAt,by:e.createdBy,source:e.source,note:e.note??``})),[{key:`rev`,header:`Rev`},{key:`created`,header:`Created`},{key:`by`,header:`Created By`},{key:`source`,header:`Source`},{key:`note`,header:`Note`}])}function Wp(e){e.command(`revisions`).description(`List a workflow's definition revision history (newest first)`).argument(`<id>`,`Workflow ID`).action(async(e,t)=>{let n=await(await Y(t)).workflows.listRevisions(e);if(t.json)return N(n);Up(n)}),e.command(`revision`).description(`Show one revision's metadata and definition YAML`).argument(`<id>`,`Workflow ID`).argument(`<rev>`,`Revision number`).action(async(e,t,n)=>{let r=Qa(t,`<rev>`),i=await(await Y(n)).workflows.getRevision(e,r);if(n.json)return N(i);L({Revision:i.rev,Created:i.createdAt,"Created by":i.createdBy,Source:i.source,Note:i.note??``}),process.stdout.write(i.yaml.endsWith(`
|
|
156
|
+
`)?i.yaml:`${i.yaml}\n`)}),e.command(`rollback`).description(`Restore a prior revision's definition as a NEW head revision (re-validated)`).argument(`<id>`,`Workflow ID`).argument(`<rev>`,`Revision number to restore`).action(async(e,t,n)=>{let r=Qa(t,`<rev>`),i=await(await Y(n)).workflows.rollback(e,r);if(n.json)return N(i);F(`Rolled back workflow ${i.id} to rev ${r}.`),jp(i)})}function Gp(){let e=new b(`workflows`).description(`Create and manage Tangle workflows`);return Np(e),Ec(e),zp(e),Wp(e),Hp(e),Tp(e),Dp(e),e}function Kp(e){for(let[t,n]of Object.entries(e.optsWithGlobals()))e.getOptionValue(t)===void 0&&n!==void 0&&e.setOptionValue(t,n)}const qp=e(import.meta.url)(`../package.json`);function Jp(){let e=new b;e.name(`tangle`).description(`CLI for Tangle Sandbox operations`).version(qp.version??`0.0.0`).option(`--json`,`Output JSON where supported, including errors`).option(`--api-key <key>`,`API key (or set TANGLE_API_KEY)`).option(`--base-url <url>`,`API base URL`),e.hook(`preAction`,(e,t)=>{Kp(t);let n=t.opts();wt(n.json===!0||n.ndjson===!0)}),e.addCommand(ji()),e.addCommand(tu()),e.addCommand(Cp()),e.addCommand(ru()),e.addCommand(rl()),e.addCommand(pl()),e.addCommand(ml()),e.addCommand(Xo()),e.addCommand(qf()),e.addCommand(Jf()),e.addCommand(Xf()),e.addCommand(di()),e.addCommand(ou()),e.addCommand(ps()),e.addCommand(bp()),e.addCommand(Zf()),e.addCommand(np()),e.addCommand(Bi()),e.addCommand(Zi()),e.addCommand(xl()),e.addCommand(ms()),e.addCommand(_s()),e.addCommand(Lc()),e.addCommand(Hs()),e.addCommand(Gp()),e.addCommand(zo()),e.addCommand(nu()),e.addCommand(Rf()),e.addCommand(au()),e.addCommand(Qi()),e.addCommand(yl()),e.addCommand(Rc()),e.addCommand(Mo()),e.addCommand(No()),e.addCommand(Dl()),e.addCommand(hl()),e.addCommand(rp()),e.addCommand(vc());function t(e){e.configureHelp({showGlobalOptions:!0}),e.configureOutput({writeErr:()=>{}}),e.exitOverride(t=>{t.exitCode===0&&process.exit(0),B(t,e.optsWithGlobals().json===!0)});for(let n of e.commands)t(n)}return t(e),e}const Yp=Jp();Yp.parseAsync(process.argv).catch(e=>{B(e,Yp.opts().json===!0)});export{};
|